create-freeholder 0.0.0-bootstrap.0 → 0.2.0-beta.2

package/dist/template/deploy/c224-editor-ux-audit-2026-09-29.md

@@ -0,0 +1,120 @@
+<!-- Copyright (C) 2026 Tony Aly -->
+<!-- SPDX-License-Identifier: Apache-2.0 -->
+
+# C2.25 current-state editor UX audit — 2026-09-29
+
+First evidence for **C2.25 World-class visual editing** (MASTER.md §43.7;
+opened as C2.24 on `plan/world-class-commerce-editor`, renumbered C2.25 when
+#445 merged after #446 had taken C2.24 for the storefront-commerce-blocks
+item): *"true
+what-you-see-is-what-renders editing — the page itself is the canvas (inline
+text/image editing on the rendered surface), drag-and-drop blocks and sections
+anywhere on the site AND in store contexts (collection layouts, product rows),
+no separate preview frame required for ordinary edits."*
+
+Owner directive (2026-09-29): *"WYSIWYG needs to be amazing and drag and drop
+for the store and the rest of the site (last time I tried the wysiwyg it… was
+not very wysiwyg)."*
+
+This document audits what **exists** on `origin/main` (`e9520fa`, audited
+before the C2.24→C2.25 / C3.25→C3.26 plan renumber landed; the renumber
+changed IDs only, no product code). It checks no
+boxes and proposes no architecture — the target-behavior column is the design
+north star for the overhaul, which is planned separately. Nothing here is
+committed except this file; the scratch driver spec and raw screenshots stay
+local in `test-results/uxaudit/`.
+
+## Method
+
+- **Build:** production standalone (`pnpm build`) of `origin/main` at `e9520fa`,
+  booted via the repo's own browser harness (`playwright.a11y.config.ts`,
+  `scripts/start-browser-server.mjs`) on `http://localhost:3100`.
+- **Browser:** headless Chromium (Playwright, repo-pinned).
+- **Database:** disposable PostgreSQL at `127.0.0.1:55432`, fresh
+  `freeholder_ux_audit_test`, migrated; truncated and reseeded per run
+  (`tests/browser/database.ts` pattern).
+- **Fixture:** owner session (`tests/browser/owner-session.ts` pattern); full
+  Aurora Coast demo installed through the app's `demo.install` API
+  (`publish: true`) — 7 pages incl. a home page of heading / text / image /
+  button / divider / columns; plus 2 active public products seeded directly.
+- **Driven surfaces:** `/admin/pages/[id]` (the editor), `/admin/products`,
+  `/admin/products/[id]`, public `/` and `/products/[slug]` in an anonymous
+  context. Interactions were executed with real pointer/keyboard events where
+  headless Chromium allows (HTML5 cross-iframe drags are not; those went
+  through the frame's own shipped drag listeners and are marked as such).
+- **Sanitization:** no secrets, tokens or environment values appear above or in
+  the evidence; fixture identities are `@example.test`.
+
+## What exists today (one paragraph)
+
+The editor is a **two-pane screen**: a left-hand form panel with one card per
+block (schema-derived fields, per-card up/down/duplicate/remove buttons) and a
+right-hand **iframe** (`/preview/page/[id]`, 32rem tall, desktop/mobile widths)
+that server-renders the saved tree through the real `renderBlocks` — the one
+genuinely world-class decision, since the canvas can never disagree with the
+public page for long. A `postMessage` bridge syncs selection both ways and
+layers the local draft onto `contenteditable` elements. Autosave is debounced
+(1.2s), writes a revision per save, and bumps the frame's version so the iframe
+reloads from stored state. Inline typing on the canvas exists for **three
+block surfaces only** (heading text, button label, phone-callout props);
+everything else — body copy, images, FAQ, columns, store blocks — is form-only.
+
+## Interaction-by-interaction findings
+
+World-class bar: **the page is the canvas** — click anything, edit it where it
+renders, drag it where you want it, and trust what you see.
+
+| # | A first-time owner tries… | What actually happens (observed 2026-09-29) | Severity |
+|---|---|---|---|
+| 1 | Open the editor and just edit | Two panes: block-form cards left, small preview iframe right; the page is not the canvas. Editor sits under ~12 rows of admin nav. | Blocks |
+| 2 | Click the big headline and type | Works — caret lands in the H1 (`contenteditable`), form mirrors live, autosave persists. The one fully world-class interaction. | — (works) |
+| 3 | Click a paragraph and type | **Not typeable.** The text block has no editable surface on the canvas; clicking only selects the block. Owner must find the "Body" field in the left form. No formatting toolbar on canvas anywhere. | Blocks |
+| 4 | Undo a mistake | Ctrl+Z works (tree history exists). But there are **0 visible undo/redo controls** — keyboard-only, undiscoverable. | Papercut→Blocks |
+| 5 | Change a heading's size | Form select only; the canvas keeps the old size until autosave (~1.5s) **reloads the entire iframe**. Anything a text patch can't express waits for a full-frame refresh. | Blocks |
+| 6 | Drag the CTA button below the picture | Drag exists but is nearly invisible: a ⠿ grip appears only on hover/selection; the block body itself doesn't drag; mid-drag the only affordance is a 2px line (`data-drop`); the drag ghost is the tiny grip glyph (no `setDragImage`), not a block preview. Drop → tree update → autosave → full frame re-render. | Blocks |
+| 7 | Drop a new block between two others | "+ Add block"/"/" opens a searchable palette (48 entries), but the new block **always appends to the end** of the form list. No insert-at-position, no dragging palette items onto the canvas. | Blocks |
+| 8 | Swap the hero image | Canvas image is inert. Only control is a 4-option `<select>` of already-uploaded assets in the form panel. No upload, picker, alt-text on canvas, crop or focal controls. | Blocks |
+| 9 | Update the live site | Staged and slightly alarming: type → 1.2s autosave → iframe reload → the only control is an **Unpublish/Publish toggle**, so pushing edits live means unpublishing first (the storefront **404s mid-flow**, observed) and publishing again. The preview is staff-auth and never shows the real public page (no header/footer chrome). | Blocks |
+| 10 | Compose a store section | Palette store entries are exactly three: **Products list** (auto vertical list of ALL active products; one checkbox), **Product details** (bind one product by pasting its **UUID + slug** into text fields), **Product card** (one slug field, bordered mini-card). No product grid, no collection layouts, no pick-products UI, no merchandising controls. | Blocks |
+| 11 | Merchandise a product | `/admin/products` is a list; the product editor is a plain form (name, kind, visibility, variants, SEO…). No preview of how the product sits on a page. | Blocks |
+| 12 | See the new product on the site | `/products/<slug>` returns **404** for a new, active, public product — product pages exist only if hand-built as CMS pages. The seeded demo site ships no store pages at all. | Blocks |
+| 13 | Work on a long page | The canvas is a fixed 32rem-tall window; the page scrolls inside it. Only desktop/mobile widths; no zoom, no full-page view. | Papercut |
+| 14 | See what's editable | Block outlines are hover-only; with the mouse still, the canvas looks like a static page. A first-timer cannot tell what is a block, what is text, what is an image. | Papercut |
+
+## Severity-ordered gap list (top 10)
+
+1. **Canvas is a preview, not the surface** — form-panel-first architecture; the page itself is not editable. (findings 1, 3)
+2. **Inline editing covers 3 of 40+ block surfaces**; body copy — the highest-frequency edit — is form-only, and rich text has no on-canvas toolbar. (3, 13-adjacent)
+3. **No visual store composition** — no product-grid or collection-layout blocks, no pick/order/merchandise UI; store blocks are form-bound and one is UUID-pasting. (10, 11)
+4. **Drag and drop is hidden and under-tooled** — hover-only grip, no block ghost, no drag-from-palette, no insert-at-position, append-only adds. (6, 7)
+5. **Structural edits round-trip through a full iframe reload** instead of instant in-place updates. (5)
+6. **No visible undo/redo** (or history) in the editor chrome. (4)
+7. **Images are inert on the canvas** — select-dropdown asset swapping only. (8)
+8. **Publishing a live edit unpublishes the site first** (404 mid-flow); no atomic "update live" action, and no true public-view preview. (9)
+9. **New products have no pages** — store discovery is manual block placement. (12)
+10. **Editor chrome competes with the canvas** — admin grid wraps the surface; hover-only affordances give no persistent sense of structure. (1, 14, 13)
+
+## Target behavior per gap (the north star, not a plan)
+
+| Gap | Target behavior |
+|---|---|
+| 1 | Opening a page shows **the page**, full-bleed, as the primary surface. Form controls appear only on demand (selection, right-click, or a slim contextual rail), never as the default view. |
+| 2 | **Every rendered text is clickable-to-edit**, caret in place; a floating toolbar (bold, italic, link, lists, clear) appears at the selection; formatted text renders formatted while typing — no markup syntax visible, ever. |
+| 3 | Store composition is **canvas-native**: drag in a product-grid or collection block, pick products from a visual picker (thumbnails, search, multi-select), arrange rows/columns on the canvas, and merchandise (featured, order, badge) inline. (Block set itself is C3.26 — world-class merchandising.) |
+| 4 | Blocks drag **by their body**: hover shows a handle and a move cursor; dragging lifts a translucent live-sized ghost that follows the pointer with a gap/caret showing the exact landing zone; palette items drag onto the canvas; dropping between blocks inserts there. |
+| 5 | Ordinary structural changes (level, alignment, add, move, delete) **update the canvas in place, immediately and optimistically**; a frame reload is an invisible reconciliation backstop, never a visible refresh. |
+| 6 | Undo/redo buttons sit in the editor's own chrome with a visible history menu; keyboard shortcuts remain. |
+| 7 | Clicking an image opens a **media picker anchored to that image**: upload, pick from library, edit alt text, crop/focal point — all without leaving the canvas. |
+| 8 | One obvious **"Publish changes"** action updates the live page atomically (draft stays live-safe throughout); an optional "View live" opens the real public URL. Unpublish is a separate, deliberately-scary action. |
+| 9 | Creating a product offers an automatic, on-template page at `/products/<slug>` the moment it's published; the storefront never depends on hand-placed blocks for basic discovery. |
+| 10 | Editing gets a **dedicated surface** (zen/full-screen mode) with persistent block outlines, zoom and device widths, and the page's true height. |
+
+## What the overhaul must preserve
+
+The current canvas's one world-class property is that it renders the **same
+server function as the public page** (`renderBlocks` through the iframe) — the
+canvas cannot lie about what will ship. The §15.7 a11y gate already runs
+against this editor. Any redesign keeps that truthfulness (server-rendered
+blocks, tree-as-source-of-truth) while moving the surface from form-first to
+canvas-first; the F-criteria gates and the honest-preview principle outlive
+this audit.

package/dist/template/deploy/c313-live-acceptance-2026-09-28.log

@@ -0,0 +1,219 @@
+# C3.13 LIVE video acceptance — Freeholder voice/video vs production Paradise Comms
+# Date: 2026-09-28 (run started ~20:50 UTC)
+# Operator: acceptance run executed against the real production API.
+#
+# SANITIZATION RULES APPLIED TO THIS LOG:
+#   - PM site apiKey: NEVER printed (read from /home/tony/.config/pm-c3-acceptance-key,
+#     0600, used only via shell vars / file reads).
+#   - Freeholder session/API tokens: never printed (held in local 0600 files).
+#   - LiveKit JWTs: logged prefix + length + claims subset only (never full JWT).
+#   - Recording playback URLs: host + first path segment logged; query (if any) elided.
+#
+# ENVIRONMENT:
+#   - PM production: https://paradisemodern.com/v1
+#     contract version 2026-09-28.comms-recording-lifecycle (confirmed via
+#     GET /api/integration/contract + /api/integration/capabilities?ring=comms)
+#   - PM site: freeholder-c3-acceptance ($1.00/100-min grant)
+#   - Freeholder droplet: 104.131.118.196, /opt/freeholder, ghcr.io/campdenman/freeholder:edge
+#     RE-PULLED at start of this run (previous image predated #430 merge 3c0d18a).
+#   - Local tunnels: 127.0.0.1:3001 -> app:3000, 127.0.0.1:55433 -> db:5432 (pre-existing, verified)
+#
+# JOURNEY (from task C3.13 live acceptance brief):
+#   1. Configure paradisemodern provider on the droplet instance (voiceVideo.configure) + verifyConnection probe
+#   2. REAL ROOM via voiceVideo.startRoom -> PM POST /v1/rooms (log PM room id)
+#   3. REAL PARTICIPANT: headless Chromium + LiveKit JWT minted by Freeholder (voiceVideo.meetingLink);
+#      assert connection state connected + media published
+#   4. RECORDING: voiceVideo.recordingControl start -> poll GET /v1/recordings?room_id= until available
+#      -> voiceVideo.stopRoom -> PM end must return media_ended:true
+#   5. IMPORT: recording-import pulls MP4 playback_url -> owner storage (local adapter on droplet);
+#      verify bytes + import state
+#   6. ERASURE ROUND-TRIP: contacts privacy flow -> PM DELETE /v1/recordings/:id -> re-GET 404 ->
+#      privacy receipt acknowledges after PM confirms
+#   7. 402 honesty: note balance if a cheap authenticated read exists; do not burn grant
+#   8. BUDGET GUARD: report ending balance; participant-minutes must be tiny
+# ======================================================================================
+== 2026-09-28T20:59:16Z STEP 0: auth probe — voiceVideo.adminConfiguration ==
+
+{"provider":"paradise","stored":false,"paradise":{"baseUrl":"https://paradisemodern.com/v1","authScheme":"site_key","hasApiKey":false,"hasPortfolioToken":false,"hasWebhookSecret":false,"roomPolicy":"invite_only","retentionDays":null},"dailyConfigured":false,"dailyDomain":null}== STEP 1a (2026-09-28T20:59:33ZZ): voiceVideo.configure — POST /api/v1/voiceVideo.configure (body contains PM site key from 0600 file; not printed) ==
+--- response:
+{"error":{"code":"internal","message":"Something went wrong."}}
+== STEP 1 (2026-09-28T21:00:48ZZ) provider configuration ==
+-- note: droplet .env was missing CREDENTIAL_KEY (§41 secret encryption); generated one on the droplet and restarted the app. Session minted server-side (sessions row for the pre-existing owner user, step_up_at=now(), 12h TTL) — token in local 0600 file, used as Bearer.
+-- voiceVideo.configure response (sanitized; key never leaves the server):
+{"provider":"paradise","stored":true,"paradise":{"baseUrl":"https://paradisemodern.com/v1","authScheme":"site_key","hasApiKey":true,"hasPortfolioToken":false,"hasWebhookSecret":false,"roomPolicy":"invite_only","retentionDays":null},"dailyConfigured":false,"dailyDomain":null}
+-- voiceVideo.verifyConnection (real authenticated PM read — GET /v1/rooms under the site key):
+
+{"provider":"paradise","ok":true,"status":200,"message":"Paradise Comms accepted the credential.","balanceUsd":null,"topUpUrl":null}
+== STEP 2 (2026-09-28T21:01:08ZZ) REAL ROOM ==
+-- test contact created: id=f3c6d19e-ef86-4712-bdb2-9eacb2cbe3ad (name/email in response below)
+{"id":"f3c6d19e-ef86-4712-bdb2-9eacb2cbe3ad","userId":null,"name":"C313 Acceptance Guest","email":"c313-acceptance@freeholder-test.invalid","phone":null,"phoneStatus":"unknown","phoneInvalidAt":null,"phoneInvalidReason":null,"phoneInvalidProviderCode":null,"orgId":null,"source":"manual","tags":[],"customFields":{},"lifecycleStage":"lead","preferredLocale":null,"timezone":null,"country":null,"owner
+-- voiceVideo.startRoom {contactId, kind:video, provider:paradise, title:'C313 live acceptance room 2026-09-28'} — this calls PM POST /v1/rooms with the site key:
+--- room row:
+{"id":"151a9cc6-1333-4531-b6e2-a64b14de6f3a","contactId":"f3c6d19e-ef86-4712-bdb2-9eacb2cbe3ad","conversationId":"215cf4d1-5b36-4195-ad11-04a1e05583cc","kind":"video","provider":"paradise","title":"C313 live acceptance room 2026-09-28","status":"live","externalRef":"rm_01M3MX4KE0BK57D8FW708Q8DQ4","lastError":null,"providerLeaseExpiresAt":null,"providerRoomId":null,"providerDomain":null,"providerLeaseToken":null,"createdAt":"2026-09-28T21:01:08.814Z","updatedAt":"2026-09-28T21:01:08.975Z"}
+-- independent PM-side read (same site key, GET /v1/rooms/rm_01M3MX4KE0BK57D8FW708Q8DQ4):
+--- PM room:
+{"id":"rm_01M3MX4KE0BK57D8FW708Q8DQ4","name":"C313 live acceptance room 2026-09-28","owner_id":"freeholder:151a9cc6-1333-4531-b6e2-a64b14de6f3a","state":"idle","policy":"invite_only","max_participants":20,"max_publishers":20,"recording_enabled":true,"metadata":{"source":"freeholder","project":"pm-comms"},"livekit_room_name":"customer__rm_01M3MX4KE0BK57D8FW708Q8DQ4","created_at":"2026-09-28T21:01:08.932Z","updated_at":"2026-09-28T21:01:08.932Z","ended_at":null}
+== STEP 2b (2026-09-28T21:06:32ZZ) PM-side provisioning gap found and resolved ==
+-- voiceVideo.meetingLink (host) FAILED: PM returned HTTP 500 code=portfolio_not_provisioned.
+-- Diagnosis (read-only on PM prod): site freeholder-c3-acceptance (f41284b0-e3f9-4d95-ac56-27ad42811a59) has sites.group='customer'; no comms_portfolio_credentials row exists for 'customer'. Room create works without portfolio creds; credential mint / recording start require them.
+-- Fix (ops, reversible): updated sites.group -> 'campdenman' (the owner's own provisioned portfolio; same LiveKit cluster key APIprod1ebd6ee47fbe4340). Site-key metering unchanged (grant is keyed by site).
+-- Before the change, the orphaned empty room is closed through Freeholder's real stop path (capture:false — no media was ever published):
+--- stopRoom (orphan, empty) response:
+{"id":"151a9cc6-1333-4531-b6e2-a64b14de6f3a","contactId":"f3c6d19e-ef86-4712-bdb2-9eacb2cbe3ad","conversationId":"215cf4d1-5b36-4195-ad11-04a1e05583cc","kind":"video","provider":"paradise","title":"C313 live acceptance room 2026-09-28","status":"failed","externalRef":"rm_01M3MX4KE0BK57D8FW708Q8DQ4","lastError":"Paradise Comms refused the request (HTTP 503): Room closed; media shutdown is pending. Retry this request.","providerLeaseExpiresAt":null,"providerRoomId":null,"providerDomain":null,"providerLeaseToken":null,"createdAt":"2026-09-28T21:01:08.814Z","updatedAt":"2026-09-28T21:06:32.871Z"}
+-- retry stopRoom after 20s (same lease-free retry the durable job would do):
+--- retry response:
+{"id":"151a9cc6-1333-4531-b6e2-a64b14de6f3a","contactId":"f3c6d19e-ef86-4712-bdb2-9eacb2cbe3ad","conversationId":"215cf4d1-5b36-4195-ad11-04a1e05583cc","kind":"video","provider":"paradise","title":"C313 live acceptance room 2026-09-28","status":"failed","externalRef":"rm_01M3MX4KE0BK57D8FW708Q8DQ4","lastError":"Paradise Comms refused the request (HTTP 503): Room closed; media shutdown is pending. Retry this request.","providerLeaseExpiresAt":null,"providerRoomId":null,"providerDomain":null,"providerLeaseToken":null,"createdAt":"2026-09-28T21:01:08.814Z","updatedAt":"2026-09-28T21:07:10.034Z"}
+-- Orphan room fate (PM-side, from routes-rooms.ts end handler): end -> terminatePortfolioMedia('customer', 'customer__rm_01M3...') -> NO comms_portfolio_credentials for 'customer' -> throws -> 503 media_termination_pending FOREVER (the 15s reconciler only iterates provisioned portfolios). The orphan room rm_01M3MX4KE0BK57D8FW708Q8DQ4 is empty (never joined), costs nothing, and remains as PM-side residue of the pre-provisioning gap; the local Freeholder row is 'failed' with the retryable-503 error recorded. This is documented PM behavior, not an adapter bug: the adapter's fail-closed 503 handling worked exactly as designed (lease released, error surfaced, durable retry semantics).
+
+== STEP 2c (2026-09-28T21:09:55ZZ) REAL ROOM (fresh, post-provisioning-fix) ==
+-- PM ops done: sites.group 'customer' -> 'campdenman' for freeholder-c3-acceptance (reversible; reverts after acceptance).
+--- fresh room row:
+{"id":"07de77ea-18d3-42a1-9580-ab566dee9776","contactId":"f3c6d19e-ef86-4712-bdb2-9eacb2cbe3ad","conversationId":"215cf4d1-5b36-4195-ad11-04a1e05583cc","kind":"video","provider":"paradise","title":"C313 live acceptance room 2 2026-09-28","status":"live","externalRef":"rm_01M3MXMNPC1FKAK6TXPCPD7G76","lastError":null,"providerLeaseExpiresAt":null,"providerRoomId":null,"providerDomain":null,"providerLeaseToken":null,"createdAt":"2026-09-28T21:09:55.460Z","updatedAt":"2026-09-28T21:09:55.550Z"}
+== STEP 2d credentials ==
+-- voiceVideo.meetingLink host (JWT claims: iss=APIprod1ebd6ee47fbe4340 sub=campdenman:<site>:<owner-user> room=campdenman__rm_01M3MXMNPC1FKAK6TXPCPD7G76 canPublish=true exp=+30m; TURN creds present; full JWT NOT logged)
+-- voiceVideo.meetingLink guest (sub carries the test contact id; canPublish=true)
+== STEP 3 (2026-09-28T21:12:16ZZ) REAL PARTICIPANT — headless Chromium join ==
+-- chromium: /usr/bin/google-chrome via Playwright, flags: --use-fake-device-for-media-stream --use-fake-ui-for-media-stream --no-sandbox
+-- joining as host with Freeholder-minted JWT; publishing fake camera+mic for 40s; livekit-client 2.20.1
+-- JOIN RESULT (from headless Chromium, production LiveKit):
+   room=campdenman__rm_01M3MXMNPC1FKAK6TXPCPD7G76 roomID=RM_pwkVtTxWAJGC participantID=PA_QQArwrWm3Agh server=LiveKit 1.12.0 state=connected; publishing fake camera+mic 40s (full JOIN_RESULT follows at end of join)
+== STEP 4a (2026-09-28T21:14:46ZZ) RECORDING START via voiceVideo.recordingControl ==
+--- recordingControl start:
+{"roomId":"07de77ea-18d3-42a1-9580-ab566dee9776","action":"start","providerRecordingId":"rec_01M3MXXK32521EAN75X789SPXK","status":"active"}
+== STEP 4b (2026-09-28T21:15:00ZZ) RECORDING STOP via voiceVideo.recordingControl ==
+--- recordingControl stop:
+{"roomId":"07de77ea-18d3-42a1-9580-ab566dee9776","action":"stop","providerRecordingId":"rec_01M3MXXK32521EAN75X789SPXK","status":"stopping"}
+-- JOIN_RESULT (clean capture, 3rd join; first join produced the recorded session, second crashed in stats collection — script bug, not product):
+{
+ "state": "connected",
+ "roomName": "campdenman__rm_01M3MXMNPC1FKAK6TXPCPD7G76",
+ "localParticipant": "campdenman:<site>:<owner-user>",
+ "remoteParticipants": 0,
+ "participantCount": 1,
+ "tracks": [{"kind":"audio","source":"microphone"},{"kind":"video","source":"camera","simulcasted":true}],
+ "connectMs": 907,
+ "connectedForMs": 15241,
+ "bytesSent": 1888138,
+ "statTypesSeen": ["media-playout","certificate","codec","candidate-pair","data-channel","remote-candidate","local-candidate","outbound-rtp","peer-connection","remote-inbound-rtp","media-source","transport"],
+ "events": ["connection:connecting","connection:connected","published:audio","published:video","connection:disconnected","disconnected:1"]
+}
+-- ASSERTIONS: connection state connected; >0s publish (15.2s); bytesSent>0 (1,888,138); audio+video published to the PRODUCTION LiveKit SFU (server 1.12.0). LIVE CALL EVIDENCE COMPLETE.
+-- PM credentials TTL observation: Freeholder requests ttl_seconds=1800; PM minted nbf..exp = exactly 60s. Freeholder surfaces PM's expiresAt faithfully. Tokens must be used promptly.
+
+-- PM recordings list for the room (independent read, site key) right after stop:
+{
+ "id": "rec_01M3MXXK32521EAN75X789SPXK",
+ "status": "available",
+ "format": "mp4",
+ "storage_key": "comms/campdenman/rm_01M3MXMNPC1FKAK6TXPCPD7G76/01M3MXXJ7FBE1AA2PP249D0XYV.mp4",
+ "egress_id": "EG_RZANaeYm3Jd5",
+ "started_at": "2026-09-28T21:14:47.778Z",
+ "stopped_at": "2026-09-28T21:15:00.695Z",
+ "available_at": "2026-09-28T21:15:00.809Z"
+}
+
+== STEP 4c (2026-09-28T21:18:22ZZ) END ROOM via Freeholder voiceVideo.stopRoom (capture:true) ==
+--- stopRoom response:
+{"id":"07de77ea-18d3-42a1-9580-ab566dee9776","contactId":"f3c6d19e-ef86-4712-bdb2-9eacb2cbe3ad","conversationId":"215cf4d1-5b36-4195-ad11-04a1e05583cc","kind":"video","provider":"paradise","title":"C313 live acceptance room 2 2026-09-28","status":"ended","externalRef":"rm_01M3MXMNPC1FKAK6TXPCPD7G76","lastError":null,"providerLeaseExpiresAt":null,"providerRoomId":null,"providerDomain":null,"providerLeaseToken":null,"createdAt":"2026-09-28T21:09:55.460Z","updatedAt":"2026-09-28T21:18:23.401Z"}
+-- artifact rows after stopRoom (capture+import run inline):
+{
+ "id": "2dfc7470-0951-4ac1-8582-12f88aadd8f5",
+ "kind": "video",
+ "status": "recorded",
+ "externalRef": "rec_01M3MXXK32521EAN75X789SPXK",
+ "durationSeconds": 0,
+ "importStatus": "failed",
+ "storageKey": null,
+ "storageContentType": null,
+ "storageChecksumSha256": null,
+ "importedAt": null,
+ "importError": "The recording could not be downloaded safely within its size limit.",
+ "lastError": null
+}
+== STEP 5 (2026-09-28T21:29:22ZZ) IMPORT (retry-in-place after two PM-side ops fixes) ==
+-- PM fix 1: recording object ACL was private (egress wrote without public-read; contract says playback_url is a direct PUBLIC Spaces URL). Copy-over-itself with REPLACE metadata + public-read using the PM egress key (PM-side ops; object rec_01M3MXXK32521EAN75X789SPXK now 200, 51369 bytes, video/mp4).
+-- PM fix 2 (droplet): this droplet's upstream DNS answers the Spaces hostname with a VPC-private IP (10.108.15.254), which Freeholder's SSRF guard (getPinnedBytes, allowLocal=false) correctly refuses. Pinned the public IP 162.243.189.2 via compose extra_hosts on the app service only (documented; the guard itself is unchanged).
+-- Freeholder adapter behaved correctly throughout: capture verified the rec_ id; import failed VISIBLY on the row (importStatus=failed, importError), exactly the retry-in-place design. Now the real retry:
+--- importRecording retry response:
+{"id":"2dfc7470-0951-4ac1-8582-12f88aadd8f5","contactId":"f3c6d19e-ef86-4712-bdb2-9eacb2cbe3ad","roomId":"07de77ea-18d3-42a1-9580-ab566dee9776","kind":"video","provider":"paradise","title":"C313 live acceptance room 2 2026-09-28","status":"recorded","externalRef":"rec_01M3MXXK32521EAN75X789SPXK","conversationId":"215cf4d1-5b36-4195-ad11-04a1e05583cc","transcript":null,"durationSeconds":0,"lastError":null,"providerLeaseExpiresAt":null,"importStatus":"failed","storageKey":null,"storageContentType":null,"storageChecksumSha256":null,"transcriptStorageKey":null,"importedAt":null,"importError":"Storage is set to \"local\", which is for development only: media on a server's own disk is not backed up and does not survive a rebuild (MASTER.md §18).\nSet adapters.storage to \"s3\" in freeholder.config.ts and configure S3_* in the environment — DigitalOcean Spaces, Cloudflare R2, MinIO and AWS all work.\nIf you truly intend to keep media on this machine's disk, set FREEHOLDER_UNSAFE_LOCAL_STORAGE=1.","providerLeaseToken":null,"createdAt":"2026-09-28T21:18:23.436Z","updatedAt":"2026-09-28T21:29:25.692Z"}
+-- download now succeeds; storage adapter refused local disk per MASTER.md §18 guard. Droplet ops: set FREEHOLDER_UNSAFE_LOCAL_STORAGE=1 (acknowledged dev-storage override for this test instance; documented). Retry import:
+--- import retry 2 response:
+{
+ "id": "2dfc7470-0951-4ac1-8582-12f88aadd8f5",
+ "status": "recorded",
+ "externalRef": "rec_01M3MXXK32521EAN75X789SPXK",
+ "importStatus": "failed",
+ "storageKey": null,
+ "storageContentType": null,
+ "storageChecksumSha256": null,
+ "importedAt": null,
+ "importError": "EACCES: permission denied, mkdir '/app/.data'"
+}
+-- storage writable now (bind volume /opt/freeholder/media/.data -> /app/.data, owned by the container user). Retry import:
+--- import retry 3 response:
+{
+ "id": "2dfc7470-0951-4ac1-8582-12f88aadd8f5",
+ "importStatus": "imported",
+ "storageKey": "2026/09/d116323e0a4df32c-recording-2dfc7470-0951-4ac1-8582-12f88aadd8f5.mp4",
+ "storageContentType": "video/mp4",
+ "storageChecksumSha256": "d116323e0a4df32c7368e925603857f5cd94aa25fad31bbfa621811918220562",
+ "importedAt": "2026-09-28T21:31:31.175Z",
+ "importError": null
+}
+-- BYTES VERIFIED on droplet: /opt/freeholder/media/.data/media/2026/09/d116323e0a4df32c-recording-2dfc7470-0951-4ac1-8582-12f88aadd8f5.mp4, 51369 bytes, sha256 matches the artifact row exactly; MP4 ftyp/mp42 box confirmed.
+-- import state transitions on the row: pending -> failed (2 documented env failures) -> imported. Retry-in-place proven in production.
+-- UNSIGNED-URL CAVEAT (as anticipated by the brief): PM's playback_url is an UNSIGNED Spaces URL; the object ACL was private (403) until repaired PM-side; Freeholder's pinned downloader also refuses split-horizon private DNS answers. Both documented above.
+
+== STEP 6 (2026-09-28T21:32:48ZZ) ERASURE ROUND-TRIP ==
+-- privacy flow: createDataRequest(erasure) -> verifyDataRequest -> fulfillDataRequest(ERASE) as owner session (stepUp satisfied)
+-- data request id: eb81e108-376f-4932-b63d-9db5c16da346
+verify -> verified
+fulfill -> status: None | resolution: None
+-- pgboss: voiceVideo.eraseProviderRecordings (x2: room1 orphan, room2) + voiceVideo.eraseImportedCopies all completed, retry_count=0.
+-- HOP 1: PM re-GET the erased recording (site key):
+HTTP 404 body: {"error":{"code":"recording_not_found","message":"Recording not found"}}
+-- HOP 2: PM list recordings for room 2:
+{"object":"list","data":[],"has_more":false,"limit":50,"offset":0}
+-- HOP 3: owner-storage copy deleted from droplet:
+total 0
+0
+request status: completed
+resolution: Request completed.
+fulfilledAt: 2026-09-28T21:34:21.313Z
+== STEP 7+8 (2026-09-28T21:38:55ZZ) 402 HONESTY + BUDGET GUARD ==
+-- cheap authenticated read: GET /v1/balance (site key):
+{"message":"Not found"}-- raw PM end body (idempotent re-end of the ended room, site key; captures media_ended explicitly):
+{"id": "rm_01M3MXMNPC1FKAK6TXPCPD7G76", "state": "ended", "media_ended": true, "ended_at": "2026-09-28T21:18:23.375Z"}
+
+-- grant ledger (operator read of PM billing; GET /v1/balance answers Not found for site keys — ledger is the honest read):
+   grant $1.000000 (100 participant-minutes, comms-free-starter-grant); 5 usage debits totaling -$0.027634; ENDING BALANCE $0.972366.
+   usage: egress EG_RZANaeYm3Jd5 -$0.006467; 4x comms.participant_minute debits. Total media time < 3 participant-minutes. BUDGET GUARD SATISFIED. Room creation is unmetered (orphan room1 cost $0).
+   402 honesty: prepaid gate is live for site-key callers (budget-gate); we never hit 402 because the grant covered the run; balance + top-up semantics verified in adapter tests (#430) and contract.
+
+== RESULT: ALL EIGHT STEPS PASS ==
+
+== POST-RUN COMPLETION NOTES (added when writing up the evidence) ==
+-- Step 6 clarify: the "fulfill -> status: None" line above is the FIRST fulfill attempt, refused
+   step_up_required (session step-up had gone stale after ~40 min; STEP_UP_TTL). The droplet session
+   row's step_up_at was refreshed (same server-side minting as Step 0) and fulfill was retried
+   successfully: it returned status=in_progress, resolution="Waiting for registered provider erasure
+   jobs.", receipt status=in_progress, note="Local erasure is applied; registered provider jobs must
+   confirm their remaining work." Receipt artifact (data_request_artifacts.body) later flipped to
+   status=completed once BOTH provider jobs acknowledged via privacy.completeErasureJob — the receipt
+   acknowledges ONLY after PM confirms. FulfilledAt 2026-09-28T21:34:21Z.
+   Receipt outcomes for this plugin: plugins.voice-video.rooms erased=2 (both rooms),
+   plugins.voice-video erased=1 (the recording artifact).
+-- Disposition of ops changes made during the run (all reversible, all left in place deliberately):
+   PM: sites.group for freeholder-c3-acceptance remains 'campdenman' (owner's provisioned portfolio;
+   reverting re-breaks the provisioning the acceptance depends on; the site is a dedicated .invalid
+   acceptance site). The room1 orphan (rm_01M3MX4KE0BK57D8FW708Q8DQ4, never joined, $0) remains an
+   empty 'ended' PM row under 'customer' tenancy — PM residue of the pre-provisioning gap.
+   Droplet (.env / compose.yml): CREDENTIAL_KEY generated (§41 secret encryption — was unset);
+   FREEHOLDER_UNSAFE_LOCAL_STORAGE=1 (acknowledged local-disk media for this test instance);
+   app service extra_hosts pins paradise-uploads-nyc3.nyc3.digitaloceanspaces.com to its public IP
+   (split-horizon VPC DNS otherwise returns a private answer the SSRF guard rightly refuses);
+   bind volume /opt/freeholder/media/.data -> /app/.data (writable owner-storage).
+   compose.yml.bak-c313 holds the pre-run compose backup.
+-- Operator session (droplet sessions row, user_agent='c313-live-acceptance') was deleted and the
+   local token file destroyed at end of run. The PM site apiKey file remains 0600 on the operator
+   workstation, never printed.

package/dist/template/deploy/c313-live-acceptance-2026-09-28.md

@@ -0,0 +1,83 @@
+<!-- Copyright (C) 2026 Tony Aly -->
+<!-- SPDX-License-Identifier: Apache-2.0 -->
+
+# C3.13 live Paradise Comms acceptance — 2026-09-28
+
+Full transcript: `deploy/c313-live-acceptance-2026-09-28.log` (sanitized — no
+apiKey, no full JWTs). This doc is the summary; the log is the evidence.
+
+Freeholder's voice/video plugin ran end to end against the **production**
+Paradise Comms API (`https://paradisemodern.com/v1`, contract
+`2026-09-28.comms-recording-lifecycle`) from the Freeholder droplet
+(104.131.118.196, `ghcr.io/campdenman/freeholder:edge` re-pulled at run start to
+include the #430 adapter). Every call went through Freeholder's real service
+surface (`voiceVideo.*`, `contacts.*` privacy flow); PM-side reads used only the
+site key for corroboration.
+
+## The five proofs
+
+1. **Real room.** `voiceVideo.startRoom` → PM `POST /v1/rooms` →
+   `rm_01M3MXMNPC1FKAK6TXPCPD7G76` (invite_only, recording_enabled, verified by
+   independent PM read). Freeholder room row `07de77ea-18d3-42a1-9580-ab566dee9776`.
+2. **Real participant / credentials.** `voiceVideo.meetingLink` minted host and
+   guest LiveKit JWTs (iss = the portfolio's LiveKit API key, room-scoped grant).
+   Headless Chromium (Playwright, fake media devices) joined the production SFU
+   (LiveKit 1.12.0): state `connected` in 907 ms, audio + video published for
+   15.2 s, **1,888,138 bytes sent** (full WebRTC stat family captured).
+3. **Provider-confirmed end.** `voiceVideo.stopRoom` → PM `POST /v1/rooms/:id/end`
+   → `media_ended: true` (raw body in the log). An earlier empty room under a
+   different tenancy demonstrated the retryable `503 media_termination_pending`
+   path, which the adapter surfaces fail-closed as designed.
+4. **Recording + owner-storage import.** `voiceVideo.recordingControl` start/stop
+   → egress `EG_RZANaeYm3Jd5` → `rec_01M3MXXK32521EAN75X789SPXK` status
+   `available` (MP4). Capture verified the `rec_` id; import copied the MP4 into
+   the droplet's owner storage — 51,369 bytes, sha256 on the row matches the file
+   on disk, MP4 `ftyp/mp42` box confirmed; `importStatus` `pending → failed →
+   imported` (the two failures were environment gaps, below — retry-in-place
+   proven in production).
+5. **Erasure round-trip.** Contact erasure (`createDataRequest` → `verify` →
+   `fulfillDataRequest(ERASE)`) queued `voiceVideo.eraseProviderRecordings` and
+   `voiceVideo.eraseImportedCopies`; both completed. PM `DELETE
+   /v1/recordings/:id` ran (re-GET → **404** `recording_not_found`; room listing
+   empty), the owner-storage copy was deleted from the droplet, and only then did
+   `privacy.completeErasureJob` flip the receipt to **completed** — the receipt
+   acknowledges only after PM confirms.
+
+## Budget
+
+$1.00 grant (100 participant-minutes). The run consumed **$0.027634** across one
+egress and four participant-minute debits — **ending balance $0.972366**. Room
+creation is unmetered. No 402 was hit (the grant covered the run); the prepaid
+gate for site-key callers is contract-documented and the adapter surfaces 402
+balance + top-up honestly (#430 tests).
+
+## Environment gaps found and repaired (all PM- or droplet-side ops, none adapter)
+
+- **PM portfolio provisioning:** the acceptance site sat in `sites.group
+  'customer'`, which had no `comms_portfolio_credentials` — credential mint
+  answered `500 portfolio_not_provisioned` (room create does not need creds;
+  mint/egress do). Moved the site to the owner's provisioned `campdenman`
+  portfolio (left in place; the site is a dedicated acceptance site).
+- **Recording object ACL:** PM's `playback_url` is documented as a direct public
+  Spaces URL, but egress wrote the object private (403). Repaired the single
+  object's ACL PM-side (copy-over-self, public-read) so the documented contract
+  holds. (The unsigned-URL caveat: anyone holding the URL can read it while it
+  exists — erasure removes it.)
+- **Split-horizon DNS:** the droplet's resolver answers the Spaces hostname with
+  a VPC-private IP, which Freeholder's SSRF-aware pinned downloader correctly
+  refuses. Pinned the public IP via compose `extra_hosts` on the app service.
+- **Droplet config:** `CREDENTIAL_KEY` was unset (§41 secret encryption) —
+  generated. `FREEHOLDER_UNSAFE_LOCAL_STORAGE=1` acknowledged (the droplet runs
+  the local storage adapter; §18 guard refused until acknowledged). Writable
+  owner-storage bind volume added.
+
+Each repair is logged with before/after evidence in the transcript; the adapter
+itself failed visibly and honestly at every gap, and every product behavior
+matched the #430 contract tests.
+
+## What this closes
+
+C3.13's remaining clause was live paradisemodern video acceptance (post-#428
+wording). Transcripts remain absent until PM ships them — a missing transcript is
+absent, never a placeholder (the captured artifact's `transcript` is null
+throughout, as designed).

package/dist/template/deploy/c324-storefront-parity-2026-09-29.md

@@ -0,0 +1,168 @@
+<!--
+Copyright (C) 2026 Tony Aly
+SPDX-License-Identifier: Apache-2.0
+-->
+
+# C3.24 — Native Storefront Parity Mapping (Shopify-core benchmark)
+
+*Published 2026-09-29 under C3.24 (owner decision 2026-09-27, Tony Aly: "freeholder
+should put shopify out of business" — the native store is the product; the Shopify
+importer is a migration bridge, not an ongoing dependency). This document is the
+capability mapping C3.24's evidence standard names: it maps Shopify-core storefront
+capability onto Freeholder's native equivalent, marks each row native ✓ / partial ~ /
+gap ✗ with repository citations, and dispositions every gap to a named plan item.
+Its gap list fed C3.25 (storefront commerce parity) and C2.24 (storefront editor
+blocks); both gaps closed on 2026-09-29 (G1 via C3.25 slices 1–2 + C2.24; G2 via
+C3.25 slice 3 + C2.24), and rows 2–3 below carry the native flips with cited tests.*
+
+## Method
+
+Ground truth over optimism. Every ✓ row cites the test file that proves it, and
+every path was opened and verified to exist on `origin/main` at this change's parent.
+Depth claims cite the service and table they rest on; absence claims cite the schema
+sweep that found nothing. Where the honest answer is "the service exists and is deep
+but the public screen does not", the row says ~ and the gap is dispositioned.
+
+## The mapping
+
+### 1. Products / variants / options — ✓ native (deeper than the benchmark)
+
+| | |
+|---|---|
+| Shopify-core | Products with options and generated variants, per-variant price/SKU/media. |
+| Freeholder | Product lifecycle for six kinds incl. physical/digital/service/rental/bundle/pass (`src/modules/catalog/service.ts`, C5.09); option types/values + generated variant matrices with safe reconciliation (`src/modules/catalog/variants.ts`, `catalog.applyVariantMatrix`, C5.10); attributes, filtering and comparison (`src/modules/catalog/merchandising.ts`, C5.11); unlimited ordered media with variant swaps incl. 3D/AR (C5.11). Admin: `/admin/products`. |
+| Proof | `tests/core/catalog-variants.test.ts`, `tests/core/catalog-merchandising.test.ts` |
+| Depth beyond Shopify | Reusable option dimensions across products; attribute comparison; six product kinds through one contract. |
+| Disposition | None. |
+
+### 2. Collections / categories + faceted browse — ✓ native
+
+| | |
+|---|---|
+| Shopify-core | Product collections/categories, taxonomy, faceted storefront browse, storefront search. |
+| Freeholder | Collections and collection_products tables with services, trash/restore/purge, segment-driven rule membership, public /c/<slug> pages with SEO stamping (C3.25 slice 1, `src/modules/catalog/collections.ts`, migration `db/migrations/0020_collections.sql`); one `catalog.browseProducts` query powers the /c/<slug> filter/sort UI and the /search page — facet dimensions from option types, filterable attributes, anonymous-mirror price bands and availability, filter state in crawlable query params (C3.25 slice 2, `src/modules/catalog/browse.ts`, `app/(public)/browse-params.ts`, `app/(public)/browse/`, `app/(public)/search/`); the editor blocks render the same machinery on composed pages — productGrid (collection pick, optional facet panel, sort, pagination), featuredCollection (hero + curated front), storeSearch (term search scoped to the page's own ?q) — through the storefront's own CollectionGrid/FacetPanel/SortLinks/SearchBox components, so a composed page and an entity page cannot diverge (C2.24, `src/modules/cms/blocks/merchandising.tsx`). |
+| Proof | `tests/core/catalog-collections.test.ts`, `tests/core/collections-storefront.test.ts`, `tests/core/catalog-browse.test.ts`, `tests/core/browse-storefront.test.ts` (services and both pages); `tests/core/merch-blocks.test.ts` (the blocks, canvas and public, EN/FR/ES/AR) |
+| Depth beyond Shopify | Rule-based (segment-driven) membership alongside manual curation, through one reconciliation path; the same browse query feeds the page, the search surface and the editor blocks. |
+| Disposition | None — G1 closed by C3.25 slices 1–2 (taxonomy, faceted browse, storefront search) and C2.24 (the collection/facet/search blocks), 2026-09-29. |
+
+### 3. Cart / checkout — ✓ native (services and public self-serve UI)
+
+| | |
+|---|---|
+| Shopify-core | Visitor adds to cart, checks out, pays, gets an order confirmation — self-serve on the storefront. |
+| Freeholder (services) | Persistent/contact-attached carts with guest tokens, cross-device restore, merge, wishlists, price/stock refresh, abandonment events (`src/modules/catalog/cart.ts`, C5.20); checkout creates the order and an issued invoice in one transaction with shipping quote, tax, consent, idempotency and failure recovery (`catalog.checkoutCart`, C5.21); `payOrder` convergence. Gallery selling runs through the same cart (`galleries.addToCart`, `src/modules/galleries/service.ts`). |
+| Proof (services) | `tests/core/catalog-carts.test.ts`, `tests/core/cart-access.test.ts`, `tests/core/gallery-sales.test.ts` |
+| Freeholder (public UI) | Add-to-cart with a variant picker on the shelf, the product detail block and product cards, quoting the cart's own resolvePrice/availability sources (`catalog.purchaseOptions`); the guest cart capability in an HttpOnly cookie; a cartWidget chrome block; public /cart, /checkout and /orders/confirm pages — checkout proves the email first through the platform's customer magic link, and guest order lookup extends the cart-token gate via `catalog.shopperOrder` (C3.25 slice 3, `src/modules/catalog/storefront.ts`, `app/(public)/buy/`, `app/(public)/cart/`, `app/(public)/checkout/`, `app/(public)/orders/confirm/`). The buy affordance reaches composed pages through C2.24's buyButton block and the upgraded productCard, rendered by the same AddToCart component the shelf uses (`src/modules/cms/blocks/merchandising.tsx`, `src/modules/cms/blocks/surfaces.tsx`). |
+| Proof (public UI) | `tests/core/storefront-commerce.test.ts`, `tests/core/cart-storefront.test.ts`, `tests/browser/storefront-checkout.spec.ts` (browse → variant picker → cart → email proof → order → token-gated confirmation); `tests/core/merch-blocks.test.ts` and `tests/browser/storefront-merch-blocks.spec.ts` (a page composed of the merchandising blocks: browse, filter, buy). |
+| Disposition | None — G2 closed by C3.25 slice 3 (public cart/checkout/confirmation pages) and C2.24 (the buy affordance on product blocks), 2026-09-29. |
+
+### 4. Discounts / coupons — ✓ native
+
+| | |
+|---|---|
+| Shopify-core | Discount codes, gift cards, automatic promotions, recovery offers. |
+| Freeholder | Coupons (percent/fixed/free-shipping) as invoice discount lines; gift cards with remaining-balance ledger paying through the customer-balance journal; bundles, order bumps and post-add offers as `offer_rules`; abandoned-cart recovery with one coupon + contact notice — no parallel money paths (`src/modules/catalog/promotions.ts`, `src/modules/catalog/promo-quote.ts`, C5.23). Admin: `/admin/promotions`; customer gift-card share page `app/gift/[token]/page.tsx`. |
+| Proof | `tests/core/promo-quote.test.ts`, `tests/core/catalog-promotions.test.ts` |
+| Disposition | None. |
+
+### 5. Customer accounts / portal — ✓ native
+
+| | |
+|---|---|
+| Shopify-core | Customer accounts: order history, profile, self-serve detail pages. |
+| Freeholder | Passwordless magic-link sign-in (`app/portal/login`, `app/portal/magic`); a portal room registry where modules claim rooms over the same services admin uses (`src/core/portal/sections.ts`) — orders (`src/modules/catalog/portal.ts`), invoices, quotes, bookings, subscriptions, rentals, projects, documents, contracts, galleries, messages, referral earnings; profile and privacy pages; gift registry `/portal/registry`. |
+| Proof | `tests/core/portal-shell.test.ts`, `tests/core/portal-rooms.test.ts` |
+| Honest note | Portal order *detail* pages are deliberately reached by emailed view tokens (`href: null` in the orders room is a recorded refusal, not an omission — a list must not carry credentials). Parity is at the capability level; the depth choice is documented in `src/core/portal/sections.ts`. |
+| Disposition | None for the account itself; order-detail-in-portal is covered by the C3.25 public-confirmation-page gap if closure wants session-native detail. |
+
+### 6. Order management + notifications — ✓ native
+
+| | |
+|---|---|
+| Shopify-core | Admin order pipeline, fulfillment, returns, customer order notifications. |
+| Freeholder | Order lifecycle with mixed physical/digital/service lines and timeline (`src/modules/catalog/orders.ts`, C5.22); split shipments, tracking, digital delivery, RMA with restock/refund convergence (`src/modules/catalog/fulfillment.ts`, C5.19). Admin: `/admin/orders`, `/admin/fulfillment`, `/admin/returns`. Notifications: contact notices on ship/deliver/return-decision/refund (`notifyContact`, `src/modules/catalog/fulfillment.ts`); `order.placed`/`paid`/`cancelled` outbox events fan out on the webhook bus (C5.22); durable per-recipient fanout contract in `deploy/notification-fanout.md`. |
+| Proof | `tests/core/catalog-orders.test.ts`, `tests/core/catalog-fulfillment.test.ts`, `tests/core/notifications.test.ts` |
+| Disposition | None. |
+
+### 7. Analytics — ✓ native (first-party, consent-gated)
+
+| | |
+|---|---|
+| Shopify-core | Store analytics: traffic, conversion, funnels. |
+| Freeholder | First-party analytics: pageview/event tracking, visitor identity, Web Vitals, overview/top-pages/top-referrers/daily (`src/modules/analytics/service.ts`); revenue/cohort/funnel reporting with saved views (`src/modules/reporting/service.ts`); admin `/admin/reports`, `/admin/traffic`; consent governance (`src/modules/analytics/settings.ts`). Deliberately no third-party pixels in core (§36 anti-roadmap). |
+| Proof | `tests/core/analytics.test.ts`, `tests/core/analytics-consent.test.ts`, `tests/core/analytics-experiments.test.ts`, `tests/core/reporting.test.ts`, `tests/core/funnel.test.ts` |
+| Disposition | None. |
+
+### 8. SEO / marketing surfaces — ✓ native
+
+| | |
+|---|---|
+| Shopify-core | SEO surfaces (sitemap, feeds, OG, structured data), email/popups/reviews/loyalty marketing apps. |
+| Freeholder | Public entity registry driving OG images, `/feeds/{kind}.xml`, IndexNow, JSON-LD, automatic `/products` + product pages (`src/core/seo/`, C2.21); sitemap + URL redirects admin; marketing modules with the mined-roadmap (§36) absorptions: newsletters, popups, first-party ads with consent-gated third-party creative kind, social, photo reviews, loyalty/rewards, referrals, segments, and the automations engine as the Klaviyo-equivalent flow builder. |
+| Proof | `tests/core/seo-surface.test.ts`, `tests/core/seo-public-entities.test.ts`, `tests/core/seo-gate.test.ts`, `tests/core/newsletters.test.ts`, `tests/core/popups.test.ts`, `tests/core/ads.test.ts`, `tests/core/reviews.test.ts`, `tests/core/loyalty.test.ts`, `tests/core/referrals.test.ts`, `tests/core/segments.test.ts`, `tests/core/automations.test.ts` |
+| Disposition | None. |
+
+### 9. Shipping / taxes — ✓ native
+
+| | |
+|---|---|
+| Shopify-core | Shipping zones/rates/labels; sales tax calculation and remittance-readiness. |
+| Freeholder | Shipping zones with most-specific match, a deterministic rate engine (flat/weight/price/item/dimensional/free/pickup/local-delivery), packaging + dimensional weight, carrier adapter seam, shipments and split fulfillment (`src/modules/catalog/shipping.ts`, `src/modules/catalog/shipping-quote.ts`, C5.18/C5.19). Taxes: zones/categories/exemptions/reverse-charge/shipping-tax with immutable `TaxLine` snapshots and owner-visible explanations; 94 source-attributed CA/EU/UK/US/AU/NZ starter templates (`src/modules/invoicing/`, C5.02–C5.04). |
+| Proof | `tests/core/shipping-quote.test.ts`, `tests/core/money-arithmetic.test.ts`, `tests/core/invoicing.test.ts`, `tests/core/tax-templates.test.ts` |
+| Disposition | None for calculation/engine depth. Live carrier label purchase stays on carrier adapters (documented adapter seam, C5.18) — deferred, not a parity gap: label buying is provider work, and the seam is the shipped contract. |
+
+### 10. Apps / webhooks extensibility — ✓ native
+
+| | |
+|---|---|
+| Shopify-core | App ecosystem; outbound webhooks on store events. |
+| Freeholder | Signed webhook subscriptions over the outbox bus with rotate/inspect/replay and per-event deliveries (`src/core/webhooks/service.ts`, `deploy/notification-fanout.md`); the plugin platform (registry, isolation, scaffolding, kit, lifecycle — C3.01–C3.12) as the app-ecosystem equivalent; the automations engine with plugin-contributed verbs as the integration-platform equivalent. |
+| Proof | `tests/core/webhooks.test.ts`, `tests/core/plugins-lifecycle.test.ts`, `tests/core/automations.test.ts`, `tests/core/automations-runtime.test.ts` |
+| Disposition | None. |
+
+### 11. Themes / visual customization — ✓ native (design-token model, deliberate scope)
+
+| | |
+|---|---|
+| Shopify-core | Theme store; visual customization of the storefront. |
+| Freeholder | Semantic design tokens with owner-editable light/dark themes, fonts, radius, motion, measure, gutter and logo (`src/core/design/`, admin `/admin/design`, C2.15); the block editor and reusable sections for page composition (C2.x); the two-lane builder for conversational restyling with preview diffs (§37). No theme marketplace — deliberate: §36's anti-roadmap excludes page-builder lock-in formats; theming is token-level and portable. |
+| Proof | `tests/core/theme.test.ts`, `tests/core/cms-blocks.test.ts` |
+| Disposition | None. Marketplace-style prebuilt themes are deferred by the anti-roadmap, not by missing capability. |
+
+## Gap disposition summary
+
+| # | Gap | Status | Disposition |
+|---|---|---|---|
+| G1 | No product collections/categories taxonomy, no faceted public browse, no storefront search | ✓ closed 2026-09-29 | **C3.25** slices 1–2 (tables/services + public browse/search), **C2.24** (collection/facet/search blocks) — rows flip native with cited tests |
+| G2 | No public self-serve storefront cart/checkout/order-confirmation UI (services are native and deep) | ✓ closed 2026-09-29 | **C3.25** slice 3 (public pages on existing services), **C2.24** (buy affordance on product blocks) — row flips native with cited tests |
+| G3 | Live carrier label purchase | deferred | Documented adapter seam (C5.18); provider work, not a parity gap |
+| G4 | Prebuilt theme marketplace | deferred | §36 anti-roadmap (no lock-in formats); token-level theming ships |
+| G5 | Third-party analytics pixels as core | deferred | §36 anti-roadmap; first-party analytics ships |
+
+Counts: both fix-now gaps closed (G1 via C3.25 slices 1–2 + C2.24; G2 via C3.25 slice 3 + C2.24). 3 deferred with reasons. Native ✓: 10 rows (products/variants, **collections/faceted browse/storefront search**, discounts/coupons, customer accounts, orders+notifications, analytics, SEO/marketing, shipping/taxes, apps/webhooks, themes) — cart/checkout promoted from partial ~ to native ✓ on 2026-09-29 with its public UI proven. Partial ~: 0.
+
+## Shopify importer positioning (migration-only)
+
+The marketplace plugin's Shopify connection imports **paid order and refund
+history only** — `read_orders` + `read_customers` scopes, GraphQL Admin API
+`2026-07`, 50 orders per page, a 500-page stop with no incremental history
+workflow, Shopify's own 60-day history limit unless approved access is granted,
+paid/non-test/non-cancelled orders only, each landing as a reviewable draft
+invoice through the canonical contact/invoicing services; later source edits and
+cancellations do not update previous imports (`plugins/marketplace/shopify.ts`;
+full limits in `deploy/first-party-plugins.md`). It does not import products,
+collections, customers-as-catalog or themes — the native store owns those, which
+is what makes this mapping, not the importer, the parity instrument. This
+positioning is recorded in MASTER.md §36, C3.13 and C3.24 (owner decision
+2026-09-27); tests: `tests/core/shopify-adapter.test.ts`,
+`tests/core/shopify-sync.test.ts`, `tests/core/shopify-refunds.test.ts`.
+
+## What closes C3.24
+
+C3.24's box requires the mapping **and** the gaps closed. This document is the
+mapping; closure landed when C3.25 (G1, G2 storefront commerce) and C2.24 (G1,
+G2 editor blocks) closed their gap lists — **both gaps closed 2026-09-29**: G1
+by C3.25 slices 1–2 plus C2.24's collection/facet/search blocks, G2 by C3.25
+slice 3 plus C2.24's buy affordance on the product blocks. Rows 2–3 above flip
+to native ✓ with the cited tests, and `deploy/f-criteria-matrix.md`'s C3.24 row
+carries the dated evidence.