daily notes 2026-02-21

projects/business/memory/bugs.md

@@ -879,3 +879,24 @@ Container restart appears to have been clean. All services came back online prop
 - **Impact:** Production deploys with old code despite new tag
 - **Fix:** Use commit SHA image from staging build instead of `latest`, with retry if not yet available
 - **Status:** ✅ FIXED — promote.yml now uses commit SHA with 10-min retry loop
+
+## BUG-083: Copy button on API key recovery broken — CSP blocks inline onclick
+- **Date:** 2026-02-21
+- **Severity:** HIGH
+- **Issue:** The Copy button in the API key recovery success modal uses `onclick="copyRecoveredKey()"` inline handler, but CSP header has `script-src 'self'` which blocks all inline scripts/handlers.
+- **Impact:** Users who recover their API key cannot copy it using the Copy button. They must manually select and copy the key text.
+- **Fix:** Remove inline onclick, add addEventListener in app.js instead.
+- **Status:** ✅ FIXED — commit 4aeac95. All inline onclick handlers replaced with external JS (copy-helper.js for server-rendered pages, addEventListener in app.js for templates).
+
+## BUG-084: Dual HTML build system — templates/ changes don't deploy
+- **Date:** 2026-02-21
+- **Severity:** HIGH (process issue)
+- **Issue:** Project has two build systems:
+  1. `npm run build:pages` — builds from `templates/pages/` → `public/`
+  2. `scripts/build-html.cjs` (Dockerfile) — builds from `public/src/` + `public/partials/` → `public/`
+  The Docker build runs last and overwrites. Changes to `templates/pages/` never reach production.
+- **Impact:** Session 73 fixes (FAQ schema, h2 heading) were applied to wrong source files and never deployed despite being committed.
+- **Root cause:** Build system confusion — two different templating approaches coexist
+- **Fix needed (immediate):** Apply fixes to `public/src/index.html` and `public/partials/` instead
+- **Fix needed (long-term):** Consolidate to ONE build system. Either remove `templates/` or remove `public/src/`.
+- **Status:** ✅ FIXED (immediate) — commit b476b0b applies all changes to correct source files. Long-term consolidation still needed.

projects/business/memory/sessions.md

@@ -1631,3 +1631,55 @@
 - **Investor Test:** All 5 ✅
 - **Budget:** €181.71 remaining, Revenue: €9
 - **Pending:** v0.4.4 production tag (awaiting investor approval from session 72)
+
+## Session 74 — 2026-02-21 13:15 UTC (Saturday Afternoon)
+- **Production health:** v0.4.3, all green, pool 15/15, 22k+ seconds uptime
+- **Staging:** v0.4.4 (CI runner offline — builds not deploying)
+- **Support:** Zero tickets
+- **Completed:**
+  1. **OpenAPI docs complete** — Added all Puppeteer PDF options to PdfOptions schema: headerTemplate, footerTemplate, displayHeaderFooter, scale, pageRanges, preferCSSPageSize, width, height. Updated browser.ts to accept and pass through all options for both HTML and URL conversion. Exported PdfRenderOptions interface. (commit 1545df9)
+  2. **Go SDK** — Zero-dependency Go client with functional options pattern, full endpoint coverage, PDFOptions struct, error handling, README with examples. (sdk/go/)
+  3. **PHP SDK** — PHP 8.1+, curl-based, PdfOptions class, PSR-4 autoloading, DocFastException, full README. (sdk/php/)
+  4. **Laravel package** — ServiceProvider, Facade, publishable config, auto-discovery, depends on PHP SDK. (sdk/laravel/)
+  5. **Examples page updated** — Added Go and PHP/Laravel code examples, updated nav links
+  6. **Landing page updated** — SDK mentions now list all 5 languages, FAQ structured data updated
+  7. **Version bumped to 0.4.5** — includes OpenAPI completion + SDKs
+- **CI runner offline** — No Forgejo runner pods found. Staging still on v0.4.4 image. This is managed infrastructure (Cloonar) — cannot fix.
+- **Owner directives completed:** OpenAPI docs ✅, Go/PHP/Laravel SDKs ✅
+- **Investor Test:** All 5 ✅
+- **Budget:** €181.71 remaining, Revenue: €9
+- **Pending:**
+  - CI runner needs to come back online to deploy v0.4.5 to staging
+  - v0.4.4 and v0.4.5 both need investor approval to tag for production
+  - npm/PyPI/Packagist tokens needed to publish SDKs publicly
+  - Google Search Console verification still pending
+
+## Session 74 — 2026-02-21 16:00 UTC (Saturday Afternoon)
+- **Production health:** v0.4.3, all green
+- **Support:** Zero tickets
+- **BUG-083 FOUND & FIXED:** Copy buttons broken by CSP
+  - Landing page recovery modal Copy button used inline onclick — blocked by helmet's `script-src 'self'`
+  - Also found in: signup success page (src/index.ts), billing success page (src/routes/billing.ts)
+  - Fix: Created public/copy-helper.js, replaced all onclick with data-copy attributes + external event listeners
+  - Commit 4aeac95
+- **Bonus commits found on main (from steered sub-agent sessions):**
+  - Go + PHP + Laravel SDKs added
+  - OpenAPI docs expanded with all Puppeteer PDF options
+  - Examples page updated with Go/PHP/Laravel code
+- **Investor Test:** All 5 ✅
+- **Budget:** €181.71 remaining, Revenue: €9
+- **Pending:** Production tag approval (staging has many improvements since v0.4.3)
+
+## Session 75 — 2026-02-21 19:00 UTC (Saturday Evening)
+- **Production health:** v0.4.3, all green
+- **Support:** Zero tickets
+- **CRITICAL DISCOVERY (BUG-084):** Dual HTML build system
+  - Found that Docker build uses `public/src/` + `public/partials/` (via `scripts/build-html.cjs`)
+  - But sub-agents were editing `templates/pages/` (via `npm run build:pages`)
+  - Result: Session 73 fixes (FAQ schema, h2 heading, onclick removal) NEVER actually deployed!
+  - Staging was showing old content despite commits being on main
+- **FIX:** Applied all 3 changes to correct source files (`public/src/index.html`, `public/partials/_modals.html`)
+  - Commit b476b0b — all verified in built output
+- **Lesson learned:** Always verify changes on staging after CI build, and document which source files the Docker build uses
+- **Investor Test:** All 5 ✅
+- **Budget:** €181.71 remaining, Revenue: €9

projects/business/memory/state.json

@@ -3,12 +3,10 @@
   "phaseLabel": "Build Production-Grade Product",
   "status": "launch-ready",
   "product": "DocFast \u2014 HTML/Markdown to PDF API",
-  "currentPriority": "v0.4.3 live. SDKs built + landing page updated. Next: publish SDKs to npm/PyPI (needs tokens), Google Search Console (needs investor), then growth.",
+  "currentPriority": "v0.4.5 on staging (CI runner offline). All 5 SDKs built (Node.js, Python, Go, PHP, Laravel). OpenAPI docs now complete with all Puppeteer PDF options. Next: CI runner needs to come online, then verify staging, get investor approval for prod tag. Still need npm/PyPI tokens to publish SDKs.",
   "ownerDirectives_PRIORITY": "Process these IN ORDER. Do not skip. Remove items marked ✅ DONE/FIXED during housekeeping.",
   "ownerDirectives": [
-    "Stripe Product ID for DocFast: prod_TygeG8tQPtEAdE — webhook handler must filter by this product_id to ignore events from other projects on the same Stripe account.",
-    "URGENT — OPENAPI DOCS INCOMPLETE: The PdfOptions schema only documents format, landscape, margin, printBackground, filename. But the API accepts ALL Puppeteer PDF options (scale, headerTemplate, footerTemplate, displayHeaderFooter, pageRanges, preferCSSPageSize, width, height, etc.). Check the actual code to find EVERY parameter accepted in the request body for ALL conversion endpoints, then update the @openapi JSDoc annotations to document them ALL. A developer cannot integrate without complete docs.",
-    "CLIENT LIBRARIES: Node.js and Python SDKs already exist in sdk/ (built Session 70). Now build additional SDKs: Go, PHP, and a Laravel package. Same quality — full endpoint coverage, error handling, README with examples."
+    "Stripe Product ID for DocFast: prod_TygeG8tQPtEAdE — webhook handler must filter by this product_id to ignore events from other projects on the same Stripe account."
   ],
   "launchChecklist": {
     "emailVerificationReal": true,