DocFast session 140: OpenAPI spec accuracy fix, 530 tests

projects/business/memory/sessions.md

@@ -1,5 +1,25 @@
 # Session Log
 
+## Session 140 — 2026-03-07 14:00 UTC (Saturday Afternoon)
+- **Production:** v0.5.1 ✅ healthy, 2 replicas, 0 restarts, ~9d uptime
+- **Staging:** v0.5.2 ✅ commit 6b1b3d5 (50+ commits ahead of prod)
+- **K8s cluster:** All 3 nodes Ready
+- **Support:** Zero tickets
+- **Completed:**
+  1. **OpenAPI spec accuracy fix (TDD)** — Removed `@openapi` annotations from `/v1/billing/webhook` (Stripe-internal, not user-callable) and `/v1/billing/success` (browser redirect page). Marked `/v1/signup/verify` as deprecated (returns 410 like `/v1/signup/free`). Public API docs now show only endpoints developers actually call. 3 new TDD tests + 2 existing tests updated. Commit 6b1b3d5.
+  2. **Full codebase audit** — Reviewed: all route files for annotation accuracy, N+1 query patterns (none found), error handling in convert routes (solid), npm audit (0 vulns), test coverage (41 files, 530 tests), examples page (no stale SDK refs), landing page (no stale free tier refs).
+  3. **Infrastructure health check** — All 3 K8s nodes Ready, both prod replicas healthy (0 restarts, ~9d uptime), DB connected (PostgreSQL 17.4), browser pool 15/15 on both environments.
+- **Total tests:** 530 (all passing, 0 errors), 41 test files
+- **Open bugs:** ZERO 🎉
+- **CI runner:** Still absent. Managed by Cloonar — needs investor action.
+- **Investor test:**
+  1. Would a stranger trust this with money? Yes ✅
+  2. Pod crash = data loss? No — CNPG WAL archiving + MinIO ✅
+  3. Free tier abuse? No — removed, demo rate-limited ✅
+  4. Pro key recovery? Yes — with DB fallback across pods ✅
+  5. Every feature works? Yes ✅
+- **Recommendation:** Staging v0.5.2 production-ready. 50+ commits ahead with 530 tests. Awaiting investor approval for production tag + CI runner restoration.
+
 ## Session 139 — 2026-03-07 10:00 UTC (Saturday Late Morning)
 - **Production:** v0.5.1 ✅ healthy, 2 replicas, 0 restarts, ~9d uptime
 - **Staging:** v0.5.2 ✅ commit 1d5d9ad (49+ commits ahead of prod)

projects/business/memory/state.json

@@ -3,7 +3,7 @@
   "phaseLabel": "Build Production-Grade Product",
   "status": "launch-ready",
   "product": "DocFast — HTML/Markdown to PDF API",
-  "currentPriority": "Production on v0.5.1. Staging v0.5.2 (49+ commits ahead). npm audit 0 vulns. 527 tests passing (40 files). ZERO open bugs. Fixed CORS security gap on /v1/email-change. Ready for production tag when investor approves.",
+  "currentPriority": "Production on v0.5.1. Staging v0.5.2 (50+ commits ahead). npm audit 0 vulns. 530 tests passing (41 files). ZERO open bugs. Fixed OpenAPI spec accuracy (internal endpoints hidden, signup/verify deprecated). Ready for production tag when investor approves.",
   "ownerDirectives_PRIORITY": "Process these IN ORDER. Do not skip. Remove items marked ✅ DONE/FIXED during housekeeping.",
   "ownerDirectives": [
     "Stripe Product ID for DocFast: prod_TygeG8tQPtEAdE — webhook handler must filter by this product_id to ignore events from other projects on the same Stripe account."
@@ -83,7 +83,7 @@
     "LOW": [],
     "note": "All bugs resolved. BUG-105 fixed 4f6659c. BUG-104 fixed 503e651. BUG-103 (template validation bypass) fixed 47571c8. BUG-102 (sanitized options ignored) fixed ba2e542. BUG-101 (body limits) fixed c03f217. BUG-100 (flush poisoning) fixed d2f819d. BUG-099 (memory leak) fixed 5f776db. BUG-098 (interceptor leak) fixed 024fa00."
   },
-  "sessionCount": 139
+  "sessionCount": 140
   },
   "blockers": [],
   "startDate": "2026-02-14"