Roadmap & Ship Log

/learn/vpd-chart rebuilt as the niche's best VPD resource: interactive VPD calculator (leaf-temp offset, per-stage color verdict), how-to-dial-in steps, raise/lower guidance, 10-Q FAQ targeting query variants, CTR title, FAQ+HowTo+WebApp schema. Strain route now 301-redirects old name-only slugs to the breeder-suffixed slug (recovers all 124 GSC 404s, verified). Backfill script caches strain images locally (backfill_strain_images.mjs).

Strain form now has two parent typeaheads (pick from DB or type new; unknown parents auto-created on save so lineage resolves). Grower edits propagate to the community mirror. Founder dashboard gets a Strains tab to approve/reject/delete/edit submissions. Server: /admin/community-strains + /admin/community-strain.

Ended grows (Died/Culled/Harvested) kept their old stage, so the hourly Govee poll kept writing readings to them and the daily cron pushed VPD-drift/heartbeat notifications about dead plants. Excluded conditions.ended plants from pollGoveeSensors, the notification cron (activePlants), and /heartbeat-now.

Novel grower crosses now auto-join a shared community strain library. New PB collection community_strains (setup_fields_v10.mjs); saveStrain mirrors any non-DB strain (status approved, slug-deduped, no user toggle); server keeps a 60s in-memory cache merged into /strain-search + strainBySlug so community strains are searchable AND get a /learn/strain page with a 'Community' badge. Auto-list moderation: prune junk in PB admin (set status=rejected). node --check + esbuild clean. NEXT: founder admin moderation card in FounderModal; breeder-page live-grow highlights.

learnShell strain template reworked: breeder now beside strain name in title + H1; scannable hero fact-chip strip (type/flower/THC/yield/cross); real grow journals hoisted from the footer to the top (the unique content); CTA hierarchy (green=start journal, amber=seeds disclosed, sand outline=diagnose); FAQ collapsed to <details>; 6 intro variants keyed on slug hash (was 3) to kill AI-generated sameness. Pedigree tree already present. Validated node --check. Community-strain template + badge deferred to strain_pipeline phase 2.

Film frames no longer crop (contain fit); film and lightbox close on click-outside, Esc, and the mobile back button; public-page photo strip enlarged; 'Watch her grow' made sex-neutral.

Sage now docks as a Gmail-style popup (lower right, minimizes to a pill, remembers state) instead of eating a sidebar column; the env chart gains a Height metric (from height check-ins, feeds the Growth grade); chart metric + timeframe persist across every plant.

Growers can now see and edit their profile from Settings: display name inline, email change via PocketBase confirm-link flow, password reset email.

ALL sensor/space readings (incl. [Tent] sync logs) now fold into the collapsed auto-readings row; log-type filter persists across plants; the Photo button turns solid with a 'Nd ago' badge when the last photo is 5+ days old.

Sage dock is now collapsible on desktop (persisted); plant summary reads wide instead of columnar; env chart spans the full canvas; hero photo drag-to-recenter; Sync-now restored on the promax plant page; action buttons never overflow; lone garden space fills the width; needs-attention card explains WHY.

Paste a public GrowDiaries diary link in Settings: layered parser (JSON-LD, embedded state, HTML heuristics) imports weeks, notes and photos as a completed grow. 3/day cap, preview before import.

Android back button now closes the open modal (kanban admin included) instead of leaving the page; floating help pill hidden on coach view where it covered the chat send button.

Bing flagged thin content. Every strain page now renders a generated intro, type-aware growing guide, FAQ with FAQPage JSON-LD, and related-strains-from-breeder links - all from the DB, per-slug phrasing variation, zero LLM cost. ~60 words to 400+.

Root cause: hourly cron early-returned when push_subs.json was empty, silently killing daily tips, heartbeat, weekly digest AND founder brief. Digest/brief moved above the gate; push_subs self-heals from .bak; client re-registers its subscription on every boot; founder brief now emailed + pushed on generation.

kanban.json reads now self-heal from a last-good .bak (fixes the empty /updates regression class); Caddyfile guard timer validates + restores from a canonical copy on the USB disk every 5 min; hourly storage sentinel pushes an alert to admins at >=85% full. Root-caused to thin-storage truncation (3rd incident).

Every /learn strain page now lists real published Cultivar journals of that strain; every public grow links back to its strain guide (in-app + crawlable /share OG). Fixed the relation-filter bug (strain.name) that would have left all 3k pages empty.

Closed harvests now carry coach advice samples from that grow window; brief judges advice-vs-outcome harshly each Monday. The loop only Cultivar can run — nobody else has outcomes.

Hits on /learn, /share, /updates, /disclosures counted (30d window, hourly flush); brief reports top-12 pages + "what content to make next". The content engine measures itself.

Both error boundaries send crash messages to /track (k:err persisted w/ msg); weekly brief counts + ranks them and flags the top crash. Bugs file themselves.

SVG logo favicon on app + all server-rendered pages (learn/updates/disclosures) — no more mystery checkmark.

lastGood/recent (max 3) survive proxy restarts (llm_recent.json); all 3 clickable-to-switch in LLM settings.

Visit /?ab=a or /?ab=b (logged out) to force+persist a landing variant for review.

Timeline rows show "Flower d12" chips; "N other public grows" header scrolls to the linked grid.

Pages now show yield/THC/CBD/harvest window/environment; 1,304 parent links + 388 descendant lists hyperlinked (🧬 Explore the family) — internal link graph for SEO + browsing.

Equipment/garden added to hash-route whitelist (pull-to-refresh no longer bounces to garden); error toasts wrap at 92vw instead of running offscreen.

/?explore works again: public no-login grid of published grows (cover, strain, stage, yield blurb) w/ signup CTAs — restored from the lost server-only R40 version, now in git.

/updates: fixed-cell ship graph (labeled, no drifting), vote counts (▲N) on cards, working category filters, clean responsive grid, sections labeled In-progress/Planned/Suggested/Shipped.

Subtle inset highlight + drop shadow on cards (theme-aware) — hierarchy without heavier borders.

New log entries slide into the timeline; vitals action buttons compress on tap. Decoration-free per design brief.

"How is she doing?" in one glance: photo · name · Day N/stage (Fraunces) · live VPD chip w/ ok/warn dot · env grade letter · 📏 rate/wk · one-tap Water/Feed/Photo. Sticky w/ blur, mobile-tuned, hidden actions on ended plants.

"ad" marker removed from links; tiny footnote appears under the chat composer ONLY while the latest coach reply contains a paid link, linking to /disclosures. Clean chat, adjacent disclosure.

Custom link template field (amazon/amzn.to domains only, {q} placeholder, auto-appends tag) alongside tag + % slider. the founder: paste your Associates tag/link — it was not recoverable from prior chats.

In-chat disclosure sentence removed; links carry a tiny superscript "ad" marker → /disclosures (affiliate, privacy-in-plain-words, AI transparency, beta terms). Apple-style: product clean, legal on its own page.

mdBold now renders [text](url) as safe links (nofollow sponsored noopener) alongside bold.

Admin card in Founder dashboard: enable toggle, Associates tag, 0-100% link-rate slider, 30d click stats + top terms. Coach linkifies max ONE product term per reply via /go/amzn redirect (click-logged, 5MB-rotated) with FTC disclosure line. rel=sponsored. Conversions live in the Associates dashboard.

Logout/login in one tab now applies to ALL tabs (storage listener — PB SDK does not watch storage); token refreshes propagate; "Keep me signed in" checkbox (default ON) on both landings — off = session-only auth; sign-out clears the session marker.

Dated addendum: flywheels 1-8 shipped, constraint = distribution; LLC/EIN/Stripe/S-corp trigger ladder (not legal advice).

Server computes stage-aware VPD grade (≥3 readings) for published grows; share page shows the A-F chip + % in band. The moat, visible to every visitor.

test_render dataPlant now carries heights + pH logs (incl. out-of-range) — HeightTrend + Logging/pH grade rows exercised at every deploy.

Founder brief ctx includes harvests_closed_30d (strain/weight/grade) — first plumbing for the outcome eval-harness.

+harvest-timing (trichomes), +light-schedules, +training-guide (LST/topping/SCROG w/ auto-safety column). All JSON-LD, sitemap, llms.txt.

First-touch UTM captured client-side (cv-utm), rides every event; /founder-stats topUtm per unique session; 🏷 Campaigns line in funnel card. Tag every forum/Reddit link ?utm_source=X.

120 empty catch blocks across 20 files now console.warn — client failures visible in replays/console at last.

/replay-list scans rrweb clicks (3+ same-node <2.5s = 🔥), cached per file; flagged sessions sort to top with badge.

Cache-first for hashed /assets/* + icons (instant repeat loads); navigations/API always network — no stale-app risk; old caches purged on activate.

/learn/vpd-calculator: interactive calc w/ °F/°C + leaf-temp offset + stage readout; WebApplication JSON-LD; sitemap + llms.txt.

founder-stats computes sessions+signups per landing variant; funnel card shows 🧪 conversion line.

Three more citable reference pages w/ Article JSON-LD, cross-linked, in sitemap + llms.txt.

/learn/strain/{slug} + A-Z library from StrainDB facts ONLY (name/breeder/type/flowering/lineage — no scraped prose, sanitized) + grow-target bands + app CTA. All in sitemap. The long-tail SEO engine.

Site orientation file pointing AI crawlers at citable reference pages + public grow sitemap.

Server-rendered /learn/vpd-chart + /learn/autoflower-schedule + index: crawlable factual tables w/ FAQPage/Article JSON-LD, in sitemap at 0.9. Built to be the source Google AI Overviews + ChatGPT/Claude cite.

12MB body limit scoped to 4 routes (was global); coach_ratings 5MB rotation; rating dedupe.

deploy.ps1 now aborts on NUL bytes or export-mismatch (the SettingsView P0 class) before anything ships.

Caddy zstd/gzip + immutable asset caching; font preconnect; 7 admin modals lazy-loaded (boot bundle -14%, splits into on-demand chunks).

logEvent() layer: signup-auth, plant-add, log-saved, coach-send, harvest-closed, share-open — structured stream for AI mining; counts feed the weekly founder brief.

LandingView2: signup form IN the hero (zero clicks), grade-card proof, honest FAQ, sticky mobile CTA. 50/50 rotation vs classic; variant rides on every tracked event; weekly brief reports the split.

logmygrow.com now unfurls properly (og:title/desc/image, journal-first title + description).

Timeline showed "Quick log" instead of Water/Feed; title now falls through to real type.

export default Settings (undefined) would have white-screened the app on next deploy; fixed + scan carded.

Closing the harvest report opens the share card once per plant (positive-moment-only rule). Never repeats.

Coach heartbeat sees daysSincePhoto per plant; stale 7+ days = valid "snap a progress photo" push. Keeps the photo timeline dense.

Equipment → Home Assistant now includes a ready automation + rest_command YAML with your webhook URL prefilled. Any HA-visible sensor bridges in.

Hourly poll + heartbeat passed goveeKey to all providers — SwitchBot/AC Infinity bindings now resolve their own credential (providerKey).

UIS controllers via unofficial cloud API: login in Equipment, link controller to a space, temp/RH/VPD flow into the journal hourly + Sync now. Read-only — we never touch controller settings.

Every deploy appends its commit message to shiplog_draft.md — Monday ship log becomes a 5-minute edit.

Previously-active grower silent 5-13 days gets ONE push naming their plant and day; lifetime cap 2, respects heartbeat opt-out.

Thumbs on every coach reply; stored w/ question+answer context; weekly founder brief now clusters downvotes and proposes a system-prompt fix.

Monday 8am cron: LLM digests week's feedback + funnel into ranked improvement actions; Founder dashboard card w/ Regenerate.

/track drops bot/headless/script user-agents — founder funnel now counts humans only.

Identity from verified token (body.userId ignored) + STRIPE_PRICE_IDS env whitelist.

Report card gains Logging consistency (days-with-entries %, 30d) and pH discipline (% in medium-aware range) bars — env-grade family grows.

Water/Feed buttons now log INSTANTLY (repeat last entry, earn credit, tap entry to edit) — modal only as fallback. Square-style fewer clicks.

Settings → Preferences On/Off for the Monday email digest (prefs.emailDigest).

📏 Growth card: latest height, +X in/wk rate (21-day window), sparkline of all height check-ins. First member of the growth-grade family.

/kanban write now admin-only (was open!); /health no longer leaks config/system instructions; VAPID keys moved to env.

Monday email recap (plants, log count, VPD) via SMTP; opt-out pref. Dormant until SMTP creds + nodemailer installed on proxy.

Optional height (in/cm) on any log entry; shows in timeline; heartbeat coach prompts a weekly measurement when stale 7+ days.

① Cross-device chat FIXED (root cause: /my-chats returned all-time history into a week-partitioned chat AND leaked advisor/[feedback] lines — now week-scoped + filtered). ② Onboarding nudge banner for skipped-intake empty gardens. ③ Govee Platform API: already migrated (stale card). ④ Proactive env-drift push alerts (server stage bands, worst offender, 1/user/day). ⑤ Monday weekly-recap push replaces heartbeat that day. ⑥ TZ-aware: covered by learned habit-hour (computeNudgeHours). ⑦ Grower profile -> structured USER.md sections. ⑩ Reddit_Launch_Kit.md (mod DMs, Builders Request, reply discipline, ship-log, do-not list). ⑧ obj feedback btn + ⑨ replay overhaul remain on board.

Legacy Garden component (dead since Spaces shipped) deleted; SettingsView extracted to views/ with auto-scanned dependency imports; ErrorBoundary two-layer setup confirmed intentional (root in main.jsx + view-level in App); EnvChart/CoachTips dup warnings resolved as false alarms (already extracted, re-export only). App.jsx 1801->1675 lines. Deploy tagging added (-Tag param, CT git tag, rollback hint).

Stripe webhook: unverified duplicate deleted — signature-verified handler now actually receives events. PB collection-rules audit script runs on every deploy (flags public writes, missing owner scoping, user enumeration — the #1 open security item, automated). Coach core identity = master gardener + plant doctor + grow-room engineer reading the JOURNAL first. api.js silent catches now log. Stale localStorage swept on boot. Landing: humble trust strip + "gets smarter every cycle". Founder users list paging. Community lock links the public gallery. (Sidebar collapse, replay delete/bookmarks, ringfenced admin: found already shipped by parallel agents.)

SwitchBot: official OpenAPI v1.1 (HMAC-signed) — token+secret connect, live meter discovery (Meter/MeterPlus/Hub 2/MeterPro), bind-to-space via the provider registry so manual sync, hourly poll, and heartbeat all flow automatically. Home Assistant: real webhook (secret-token URL generated in-app, validated/clamped payload, writes readings+env to journal, multi-space aware). Kasa honestly "soon" (real cloud auth is flaky — carded). All mock endpoints DELETED. Founder dashboard gains 💾 Data Drive meter (/disk-stats: USB capacity bar + pb_data/photos/replays/analytics breakdown). Tailscale carded for deploy-from-anywhere.

Landing feature cards now claim ONLY shipped features (journal-first order; canopy/timelapse/CO2 vaporware removed; "trained on thousands" -> "reads YOUR journal"); Kasa/SwitchBot/HA integrations were MOCKS with fake "Successfully authenticated!" theater — badges honest ("soon"), fake auth replaced with roadmap-vote message, mock endpoints left unrouted in prod; /admin/* Caddy route added (2 admin modals were broken in prod); Plan v5 amended with founder corrections: journal-first identity, humble security posture until internal hardening, sensors-as-core-context.

ObjFeedback component: tiny dashed "💬 request" chip that expands to a one-line ask -> feedback collection kind:object_request tagged [sensors]/[integration]/[daily-plan] — placed on Equipment Hub header, the Request-an-Integration card (whose button was DEAD — did nothing when clicked), and under Today's plan. Replay: rrweb player CSS injected (mouse cursor was invisible + wrapper could collapse = white-page look), final flush now keepalive+pagehide so the last seconds before a visitor leaves survive. Heatmap fully removed (HeatCanvas, HeatmapModal, /track-summary endpoint, Caddy route) — replay is the movie view the founder wanted; funnel tracking untouched. Also fixed mojibake arrows in Equipment Hub.

LANDING: hero rewritten journal-first ("The grow journal that knows your grow"), beta chip now carries the first-200-free-for-life offer (it had been lost in the truth audit), CSS-drawn product mock in the hero (journal entries + live VPD sparkline + coach tip — no screenshots to go stale, sample data clearly product demo), new How-It-Works 3-step section (60-second start, mid-grow OK), founders-deal line at final CTA. SHARE PAGE: timeline now reads chronologically (was newest-first — stories read forward), journal-proof stat chips (days/entries/waterings/feedings/readings/photos — all real counts from the journal), "Through the weeks" horizontal photo gallery with day badges + lightbox, Genetics lineage card (name/generation/parents/type — the ancestry moat made visible), CTA reframed: "This page is just a grow journal ... it builds itself as you log" (dropped the unprovable "only grow log that..." claim). OG unfurls verified already live via /share/g/:id.

1) Root password REMOVED from deploy.ps1 (was hardcoded 10x in a committed file) -> gitignored .deploy.env (+.example); ROTATION STILL REQUIRED since old password is in git history + chats. 2) Caddy security headers on every response: nosniff, X-Frame-Options, Referrer-Policy, Permissions-Policy, HSTS, Server header stripped (CSP carded separately - inline-style app needs careful rollout). 3) /community-vault PRIVACY FIX: was aggregating EVERY strain including private vaults; now only strains attached to a PUBLISHED grow enter the public aggregate. 4) PB rules audit now BLOCKS deploys on criticals (public writes/missing owner scoping) instead of warn-only. 5) 34 silent catch(e){} in server.js now log to journald - the "silent failure" class from the June audit. 6) Enumeration review: /grower-grows + /community-grows + /public-grow confirmed published-only, opaque fields. ALSO: VPD/env card moved to TOP of plant page (founder request - it is the #1 check-in reason).

FounderModal: funnel + disk meter stay pinned on top; Users and Feedback are now tabs (with live counts). Feedback tab upgraded for beta triage: full list (was capped at 20), each item shows who sent it + date + country, and has a delete button. Object-request chips land here tagged.

Content-Security-Policy-Report-Only header added in Caddy: self-only defaults, allows CF insights, Google fonts, inline styles (app architecture), Amazon device img. Blocks NOTHING yet - logs violations to browser console. Promote after a clean week (csp_promote card).

Simple Water/Flush view now captures PPM next to pH (was Feed-only).

Latest logged photo = plant-page hero + garden grid thumbnails.

EnvChart now shows per-lifecycle-stage averages and % time-in-ideal-band for the active metric (VPD/Temp/RH), color-coded. Outcome-quality signal; great for show-off.

White/light palette via :root[data-theme=light] in index.css (green accent kept). Settings Appearance toggle; persisted to users.prefs.theme + localStorage; no-flash apply in main.jsx; cross-device via profile effect.

Player rebuilt on rrweb core Replayer (auto-scaled iframe, play/pause/1-2-4x speed) — the Svelte wrapper was the white-screen culprit; recordings now emit a fresh full snapshot every 2min so a lost first batch can no longer orphan a session (cause of the unplayable 703-event session); heatmap now SAYS what is wrong (HTTP errors shown, zero-data explains the day/screen/device filter). Plant ✕ restyled: top-left, fully opaque, smaller, overlapping the card corner. CT git: replays/ + analytics/ must be gitignored.

New /api/govee-devices lists the whole account; /api/govee-sync now reads a bound {device,model}; Settings picker persists prefs.goveeDevice; EnvModal Cloud Sync sends it. Back-compat fallback to first sensor. Fixes wrong-sensor reads on multi-device accounts.

Daily-plan push now fires 1h before each grower's habitual (modal) log hour, computed daily from recent logs in server-local time (timezone-agnostic). Also fixed a latent bug: the old 9am nudge was dead code behind an `if hour!==10 return` guard.

Lean Track A: environment stored on garden.setup.environment (no migration), 3-way toggle in Space settings, non-indoor chip on space card, fed into coach + Today's Plan context. Weather/frost/EnvChart-outdoor deferred to full Track A.

Community locked until first real plant ("your grow is the ticket in" + Add-plant CTA); intake completion lands in the Coach with persona greeting + two starter paths (💬 coach my setup / 📷 diagnose a photo); plant ✕ corner menu (archive-with-data / move-to-space / delete-forever w/ double confirm); signup keeps instant access for THAT session only — returning unverified users are signed out, auto re-sent the verification email, and gated at login. Access Codes hidden while free beta is on. SSR gate css fix (externals match subpaths).

Intake now includes "Pick your coach's personality" (Old-Timer / Lab Coat / Chill Buddy / Straight Shooter — tone only, never accuracy); coach voice respects it. Chats scroll to the TOP of the newest message. Replay player white-page fixed (CSS was dynamically imported = no-op in prod; now static) + clear message when a session lacks a full snapshot.

⛶ toggle grows the advisor to near-fullscreen (persisted). Every 8 exchanges the conversation folds into app_config.advisor_memory (decisions, positions, experiments, numbers, open questions — 80-line cap) which is injected into every future session: the advisor now remembers strategy across months.

Watch real visitors like you're over their shoulder: rrweb records (ALL INPUTS MASKED at record time, cv-no-track opt-out honored, no canvas), batches to /replay (3MB/session, 40MB/day caps, 14-day auto-prune on the USB). Settings → Session Replays lists sessions with a built-in player. Built BEFORE community posting per founder request.

Coach & Today's Plan now know which plants are autos (no flip advice, compressed-clock priority, age-based feeding) via strain seedType. Landing: "First 200 beta growers: free for life" chip (grant executes at P3 flip from users.created order — no code needed now). Settings gains a prominent Send Feedback button (existing in-app FeedbackModal). Founder dash shows per-user AI calls today.

All wide popups now kanban-width (min 1100px). Vision-model persistence suspect found: client and server read app_config UNSORTED — with a duplicate record they could read different rows; both now sort by created (oldest = canonical) and the modal warns if strays exist. Backup drill PASSED (restore verified, data.db intact).

💼 pill follows co-founders/admins across every screen; the advisor reads the business-plan brief, live funnel metrics, AND the visible text of the current page ("What's weak on this page?" works). Removed from FounderModal (now global). pb.js made SSR-safe — fixes the render-smoke window crash that blocked the last deploy.

Funnel adds visitor countries (Cloudflare CF-IPCountry header per event — no IPs stored, privacy intact), device split, top screens. New 💼 Business Advisor chat in Founder Dashboard: world-class SaaS BD coach persona grounded in the full business plan brief + LIVE funnel metrics, admin-only via existing /coach (system override is admin-gated). Persisted locally, one-concrete-action-per-answer style.

Track male/female/unsexed per plant (feeds the cross-breeding roadmap). Public-page copy already made sex-neutral pending this.

Beyond GrowDiaries: Grow with Jane and Bud app exports, a generic CSV + photo-folder importer as the universal fallback, and a 'request an importer' link that logs the source growers ask for.

Reading logs store temp/RH/VPD in data{} (the chart reads that, not the note). LogModal should surface those fields when editing a Reading so growers aren't editing display-only note text.

Drop a folder of dated photos -> a grow with the photos timeline (EXIF/file-date ordered). Pairs with the CSV importer for the full spreadsheet-grower migration.

Founder: page needs a rethink now that Pest/Disease/Spray log types are retired from the picker. Direction: IPM becomes program + photo-diagnosis centric — weekly inspect rhythm with one-tap 'inspected, all clear', Sage photo diagnosis as the primary door, issues tracked as notes/photos with severity chips, field guide kept. History view should read notes/photos, not dedicated types.

Free rotation (callWithFreeRotation) worked, then died — likely the free-model catalog drifted or account-wide free quota (50/day without $10 balance) exhausted. Diagnose via /test-llm + LLM journal on the live box; refresh the seed pool; the $10 balance (~1000/day) remains the real fix.

OpenRouter supports token streaming — the proxy currently buffers whole replies. Add SSE pass-through on /coach + incremental render in the chat so Sage types in real time.

StrainDB/master_scraper.py + crawler_queue.txt ready; overnight run → rerun JSON generator (facts only, no prose/pics — copyright).

the founder wants more professional than current sprout mark. Ask direction: monogram / botanical line-art / custom wordmark — then iterate with her screenshots.

Unspecified — ASK the founder to describe/screenshot, then fix.

/scan-local should sweep subnet for 11434 (multiple hosts) then list models per host. the founder reports not finding. Debug with her on-network.

Concrete :free models work; the openrouter/free meta-model errors. Next agent: capture exact error via /test-llm, consider defaulting live-chat to lastGood instead of openrouter/free.

SettingsView export, ExploreGallery, InviteCard placement all diverged. One-time diff of CT100 /opt/cultivar/build/app/src vs local git to find remaining drift.

plink silently truncated the remote block once (false success). Add final REMOTE-DONE echo + PS check that it appeared, else FAIL.

Add sha256 hashes for the theme/track inline scripts, then promote CSP from report-only.

Replace 🌱 emoji with a designed mark (SVG, dark+light variants, favicon set).

ExploreGallery existed only in the diverged server copy — never in local git. Rebuild /?explore public gallery from /community-grows in local source.

/updates: show votes on cards, clickable theme filters that actually filter, labeled grid w/ fixed borders, ship-log separated from board. the founder repro notes 2026-07.

One real-account verification of the new provider post-deploy.

Weekly ship log currently manual post. Add a pinned “this week” section to /changelog from the same markdown so site visitors see momentum.

Monday recap exists for growers; founder version: signups, activations, feedback count, disk %, top source. One push, Monday 9am.

Coach knows autos; Today’s Plan copy still stage-generic in places. Compressed-clock priorities + no flip advice for autos (plan v5 niche).

check_rules.mjs now BLOCKS deploys on criticals. First real deploy may surface findings — triage each: fix rule in PB admin, or consciously allowlist in the script.

Landing hero drives to free diagnosis; funnel does not attribute which signups came from it. Tag sid, surface in founder funnel as a source row.

First split per God_File_Seam_Map: Govee/SwitchBot/HA provider registry + polling into own module. Server is ~2k lines.

Beta users currently unverified. Configure PB SMTP (founder task: pick provider), enforce instant-verification flow already built client-side.

Report-Only header ships with next deploy. Watch browser consoles ~1 week for violations (esp. PWA/service worker + photo URLs), tighten policy, then rename header to Content-Security-Policy.

THE NEXT MAJOR. Claude-style collapsible sidebar, top-bar breadcrumb, extract Coach/Garden views per God_File_Seam_Map.md while restructuring. Apple/Dyson/Google bar. Dedicated session, full context.

Install Tailscale on the Proxmox host + founder devices so [internal-host] (deploy.ps1 target) is reachable securely off-LAN. 10-minute setup next time at home.

Two handlers registered (line ~668 unverified + ~1460 signature-verified). Express serves the FIRST — the secure one is dead code. Delete the unverified handler before live Stripe keys. Zero user impact during beta.

tar -tzf + test restore to /tmp. An unverified backup is a hope. Audit §6.

Mount App against fixtures (imported/ended plant, zero-log plant, empty garden) in happy-dom; assert no throw. Would have caught today's white page. Audit §5.

Commit db_schema.json; deploy diffs it vs live collections via admin API. Kills the silent-field-drop bug class (beta_mode, vision_*, 3 strikes). Audit §1.

One render bug currently white-screens the whole app (proven today). ~30 lines, highest-leverage reliability fix. Audit §1.

Both appeared in past session history. Rotate before public traffic.

Apex shows 'not secure' — visitors bounce at the browser warning before seeing the app. Add logmygrow.com (+www) as Tunnel public hostnames -> http://[internal-host]:80, proxied DNS, SSL mode Full. THE likely zero-signups cause.

Extract modals, views, and components into separate files. Stages 2-6 of the refactor plan.

Coach naturally suggests GRAS, grower-recommended gear via Amazon links with referral tag when relevant — never pushy, no 'featured product' UI.

Aggregate strain × environment → outcome data. Show growers how they compare to peers on the same genetics.

Clean formatted PDF export of an entire grow cycle for sharing or archival.

Town-AI-style intake step: choose a coach personality (e.g. Old-Timer, Lab Coat, Chill Buddy, Straight Shooter) -> stored in prefs, injected into the system prompt alongside admin instructions. Cheap to build (prompt-only), high felt-personalization. Needs care: personas must never override accuracy or the admin coaching rules.

Sync the local Kanban board updates.

Distinct lifecycle for clones (no germination, trace back to mother). Pollen collection and targeted pollination events.

Every knob configurable: heartbeat hour/caps, win-back thresholds, credit values, burst limits, digest day/hour, rage-click sensitivity, AFF_TERMS product map editor — one admin Config panel backed by JSON files like affiliate.json.

One-dominant-element rule, type scale, whitespace budget, green=status-only color discipline, elevation tones, motion-as-feedback, Tesla dashboard prototype behind beta toggle. Brief: Design_Ideas_2026-07-05.md.

Submit sitemap in both (Bing feeds ChatGPT browsing). 10 minutes, free, mandatory.

Add to clean-device funnel walk checklist; update known-issues.

Align remaining "family tree" copy to journal-first during nav overhaul.

One requireAdmin helper instead of two check styles.

goveeKey/sbKey/acKey (incl. AC Infinity password) plaintext in prefs; server-side encryption.

On harvest close, compare coach advice given during the grow vs outcome grade; monthly accuracy note in the founder brief. Only possible with our outcome-labeled data.

Behind beta toggle: growth-rate score, feed discipline grade, strain-vs-community benchmark, premium harvest report.

Filter bots (UA + no-JS heuristics) from funnel, click-path + bounce views per page, UTM capture into track.js.

No public API (app-only, RJ12 ecosystem). Recommend users bridge via Home Assistant webhook today; revisit when iControl opens up.

Letter grade for pH-in-range % and feed cadence vs medium norms. Third member of the report-card family.

Stretch/growth-rate letter grade from height check-ins vs strain/stage norms; sparkline on plant page + share card stat.

After a week of clean console reports, switch Content-Security-Policy to enforcing.

Old private key lives in git history. Generate new pair, set VAPID_* env, resubscribe clients.

Network-effect engagement: follow public growers/gardens/plants, a 'following' feed of new photos/harvests/updates, optional follow notifications. Needs a follows collection + feed query. Complements the business plan's show-off surfaces & community challenges (P2 engagement, not P1).

Replay: skip-idle button, show current URL/page, clearer play/stop state, clickable timeline. Heatmap is non-functional -> remove once replay is solid.

Coach chat persisted to localStorage cv-chat-{userId} + chats collection but does not appear on other devices. Investigate server-side chats sync/load.

AI-generated Grower Profile = only about the grower; Garden Profile = only about the garden. Never mix. Each capped at 200 lines, durable facts.

If a user hasn't finished all onboarding steps, prompt them to complete it on their next visit.

Move coach-name edit out of Settings to a tiny pencil on the Coach page. Send the coach name to the LLM on EVERY call so it OWNS the name and adapts, alongside onboarding persona — a SOUL.md-style identity.

Legacy developer-api.govee.com/v1/devices has documented gaps listing H5xxx BLE/Wi-Fi thermo-hygrometers. New Platform API (Govee-API-Key header, /router/api/v1/user/devices + /device/state) returns sensors reliably. Needed for the device picker to actually surface most users' sensors.

Water reminders still fire at a fixed 10am SERVER time -> can hit users at 3am local. Apply the same activity-hour/timezone logic now used for daily nudges.

Public subs ban tool promo (r/microgrowery declined). Build organic distribution: share-your-grow already exists -> add 'invite a grow buddy' with a reward-credit incentive on both sides.

Promote environment to a real column (schema v10), add /weather (Open-Meteo, no key), location picker, frostRisk/dli helpers, cron weather writer, EnvChart outdoor rendering. Serves the ignored outdoor-cannabis segment.

Power users package env targets + feed schedule + training calendar as importable recipes; revenue share turns them into stakeholders.

Vault + coach already name genetics & gear; add disclosed 'where to get it' links. Neutral-platform version of the BudLabs funnel.

Sell the premium PDF at the peak-pride moment even to free users — tests willingness-to-pay BEFORE the beta toggle flips. Lowest-effort first revenue.

For now the auth screen IS the landing (photo-first hero). Revisit a separate marketing page at apex + app.logmygrow.com when running ads/SEO — not before.

3 post templates (r/microgrowery etc.): diagnosis screenshot + 'built this' story + public grow link. Post AFTER Step D checklist is done and the funnel walk passes.

Then flip REQUIRE_EMAIL_VERIFICATION=true. Also unlocks password reset + weekly digest emails.

Feed from kanban Done column. 'We ship weekly' as marketing + the trust signal this audience checks before committing their grow logs.

Promised prominently in the business plan ('take your data') and unbuilt — now a trust/credibility gap. One settings button, two formats.

If a user opens pricing then leaves, show a friendly 'not ready to jump in with both feet? earn AI coaching now by…' re-engagement CTA.

Tap phone to NFC tag on plant to open its profile and log instantly.

Live payment processing for Pro and Cultivator premium tiers.

New signups auto-start with full Pro features for one grow cycle (~120 days), then gracefully downgrade.

First 500 signups get Lifetime Pro at $99 + Founding Grower badge + direct feedback channel.

Watch real user sessions like a movie — cursor, scrolling, clicks. rrweb is MIT-licensed and self-hostable (fits the privacy architecture: first-party only, opt-out honored). Storage-heavy; revisit after pb_data relocation. — DONE: pb_data relocated to flash storage.

pb_data ~92% full on CT 100. Move to USB/larger volume before onboarding waves, or writes start failing. — DONE: pb_data relocated to flash storage.

Full disk corrupts SQLite. External USB before any promotion. — DONE: pb_data relocated to flash storage.

Database relocated to dedicated flash drive (bind-mounted into CT 100, uid-mapped for unprivileged container); nightly 3:15am tar rotation to the host internal disk. Existential disk risk retired. Host root also freed (14G HA backup relocated path provided).

users update rule must block role/plan/ai_credits self-edits; users CREATE rule must block role/plan injection; chats create rule must enforce [email protected].

Root cause of broken beta toggle: field doesn't exist, PB drops the write. One-time PB Admin field add.

Shell/Row/Stepper/TopBar/etc to components/. Then Stage 4 modals (~1,800 lines).

Three-posture sequencing (Adoption → Habit/Data → Monetize) with the beta toggle as the documented switch; competition hardened into 4 operating edges; full monetization ladder incl. side-hustle rungs (harvest-report one-off, affiliates, recipes marketplace, sensor bundles, challenges) and the year-2 breeder data-licensing endgame. Replaces v3 + addendum (2 fewer files).

Auth screen now shows a live-styled Today's Plan + coach-diagnosis preview built from the app's own UI — no screenshot asset to maintain, always matches the product.

One source of truth (local git), Claude project = docs only, code attached per-chat, data-safe deploy procedure, git cadence + tags, runtime files gitignored on CT 100.

Plan reviewed vs shipped product: staleness corrected, 90-day adoption-first operating thesis added, beta toggle documented as the monetization switch, funnel-integrity rule added, metrics tightened.

CORRECTION: SMTP was configured & working (Resend) — earlier 'black hole' diagnosis came from a stale doc. Change kept on merit: signups now land directly in the app (one less drop-off step); verification email still sends best-effort; flip REQUIRE_EMAIL_VERIFICATION=true in AuthScreen to restore the gate anytime.

Sampled %-coordinate tracking → /track JSONL (5MB/day cap) → admin-only /track-summary → Usage Heatmap viewer in Settings (per screen/day/breakpoint). Opt-out toggle in Preferences. Zero new infra, zero PII.

+1/log, +1/photo (cap 5/day), +5/harvest (once per plant). Server verifies ownership/freshness/dedupe; wallet ceiling 25; /coach spends credits past the daily allowance server-side. test_credits.js guards it all.

Client no longer sends role/plan on signup; PB defaults own them. VERIFY PB create rule blocks role/plan injection.

Morning push to subscribed users: 'Your plan is ready' → opens garden.

One-tap native share / clipboard card after every photo analysis. Diagnosis in, share out.

AuthScreen leads with 'Snap a photo, get an instant diagnosis' — the acquisition wedge.

Garden tip upgraded to 2-3 ranked daily actions with check-offs, day-cache, tap-to-coach walkthrough. The habit engine.

Free beta users no longer paywalled at 1 plant; AI bulk-add capped too.

PB token verified server-side; anonymous 401; plan/role from PB not client; provider/model overrides admin-only; test_security.js added.

Coach state extracted to hooks/useCoach.js; runtime-beta aware; counter syncs on reload. App.jsx 4,076 → ~3,250.

API key stored in users.prefs.goveeKey; Cloud Sync in EnvModal; /api/govee-sync proxy endpoint.

Service worker, VAPID keys, /push-subscribe /push-unsubscribe /push-test endpoints; toggle in Settings.

/stripe-checkout and /stripe-webhook endpoints in place. Needs live keys.

/leaderboard endpoint + strain-keyed SEO pages for organic traffic.

Automated git commits on deploy with changelog tracking.

Crowdsourced roadmap board with voting for all logged-in users.

4-column kanban board, collapsible changelog, premium public share page redesign.

Claude-style collapsible sidebar with icon/hover states.

Survive page reload/back-button via URL hash router.

Make intake skip safe and infer temperature unit from locale.

Fix PB file URL generator path formatting for photos.

Derive ideal VPD from temp/RH to prevent contradictions.

Context-aware AI coach with photo diagnosis, grow memory, citation, daily counter.

Shareable public grow pages with QR codes and community feed.

Multiple grow spaces per user with independent environments, embedded plant cards, inline env steppers.

11 log types (Water/Feed/Flush/Foliar/Spray/Pest/Disease/Transplant/Defoliation/Stage/Note), Simple/Advanced toggle, health 1-5, photos.

Segmented progress bar from stage_dates with STAGE_TYPICAL fallback. Harvest countdown.

Full harvest/cure capture with premium analytics report at cycle end.

Full genetics tracking: generation, lineage, I/S split, seeds-made date, photo. Locked when plant links.

Anonymized aggregate strain stats + public community grows feed.

Clear pricing modal with Pro $69/yr vs Cultivator $29/mo, promo-code link.

Manage users/roles, premium codes, LLM settings, notification bubble for new feedback.

Installable PWA manifest + JSON data export.