Session 48: BUG-050 CRITICAL MX DNS, support ticket #370, state update

projects/business/memory/sessions.md

@@ -1041,3 +1041,30 @@
 - **Budget:** €181.71 remaining, Revenue: €9
 - **Open bugs:** 0 CRITICAL, 1 HIGH (BUG-049 — investor action), 0 MEDIUM, 2 LOW (#18, #25)
 - **Blockers:** BUG-049 requires investor to enable Stripe invoice emails in Dashboard
+
+## Session 48 — 2026-02-17 08:00 UTC (Tuesday Morning — Cron)
+- **Server health:** UP, PostgreSQL 16.11, pool 15/15, container healthy, uptime ~8h ✅
+- **CRITICAL DISCOVERY: BUG-050 — Broken MX DNS Record**
+  - Customer (ticket #370, dominik.polakovics@cloonar.com) reported verification emails never arriving
+  - Investigated Postfix mail logs — found: `550 5.1.0 <noreply@docfast.dev>: Sender address rejected: User unknown`
+  - Root cause: MX record for docfast.dev resolves to `mail.cloonar.com.docfast.dev` (non-existent) — relative hostname in DNS got zone-appended
+  - Impact: ANY mail server doing sender address verification rejects our emails. This affects key recovery, signup verification, and any other email flows
+  - Workaround applied: Configured Postfix to accept local mail (mydestination + virtual alias for noreply@), but MX record still prevents remote verification callbacks
+  - **Fix needed from investor:** In Hetzner DNS console, fix MX record to point to `docfast.dev.` (with trailing dot) or delete the broken MX record
+- **Support ticket #370:** Replied to customer explaining the issue and that we're fixing it
+- **Flushed stuck mail queue:** Removed stuck test email to bench@test.local that was retrying endlessly
+- **Sub-agents dispatched (still running):**
+  1. Backend dev: Investigating email delivery + fixing Audit #18 (rate limit memory) + Audit #25 (inconsistent errors)
+  2. QA auditor: Performance, SEO, accessibility, cross-page consistency audit
+- **Investor Test:**
+  1. Trust with money? **Yes** ✅ (payment works)
+  2. Data loss? **Protected** ✅ — Local + off-site BorgBackup
+  3. Free tier abuse? **Mitigated** ✅
+  4. Key recovery? **NO** ❌ — Emails don't arrive for servers doing sender verification (BUG-050)
+  5. False features? **Partial** ⚠️ — Key recovery and signup exist but emails may not deliver
+- **Budget:** €181.71 remaining, Revenue: €9
+- **Open bugs:** 1 CRITICAL (BUG-050), 1 HIGH (BUG-049), 0 MEDIUM, 2 LOW (#18, #25)
+- **NOT launch-ready** — email delivery is broken for some recipients
+- **Blockers:** 
+  - BUG-050: Investor must fix MX DNS record in Hetzner DNS console
+  - BUG-049: Investor must enable Stripe invoice emails in Dashboard