HumanKind overnight — round 2
Sun 19 → Mon 20 Jul 2026 · go-live Wed 22 Jul · everything merged into overnight/integration · backend 261/261 · frontend 350/350 · local servers running it · nothing on main, nothing deployed
1 · Morning checklist
- ☐ Booked Foundations (Tue 21 Jul): page now shows Your guest: Sahil C
- ☐ Tap Cancel Booking → three options appear (just me / just guest / both). Cancel the GUEST — first live run of the host-side cancel. Then verify in Momence that Sahil C's booking is gone
- ☐ Re-add the same guest email on another included class → allowed (never-attended rule)
- ☐ Presence: keep app open on desktop, have someone comment on your post → no push while you watch; close the app → push arrives (needs 30s for lease expiry)
- ☐ Load extension v0.13.0 (chrome://extensions → Load unpacked →
momence-ext/.claude-worktrees/app-bridge) → "App Bridge" appears in Momence's left sidebar → Refunds sub-tab lists a row after you cancel a PAID class in the app
- ☐ Login: cold-open the PWA after install-token flow — no zombie 401 sessions
2 · Decisions needed
Merge + deploy window. Sat's round 1 + tonight's round 2 are one branch. Tuesday is the last comfortable deploy day before Wed go-live. After your checklist passes: merge → clone/onidel-syd → deploy + version bumps.
Host-token disarm is in-memory only. On a terminal invalid_grant the refresher stops hammering (by design) but a pm2 restart re-arms it for exactly one attempt. Fine for a single prod process; flag if you want it persisted to the token doc later.
Refund queue trigger is broad. Any priced-class cancellation logs a refunds-to-process row (Momence doesn't tell us if THAT booking was paid vs membership). Staff triage the noise; narrowing it needs a per-booking payment lookup — post-launch.
3 · What was built tonight (all reviewed by me, suites re-run by me)
Guest bookings: storage + 3-way cancel merged ✓
GuestBooking model links member→guest→sessionBookingId (Momence has no guest-of concept). "Your guest(s)" on the booked view. Cancel modal: just me / just guest / both; guest cancel via host-Bearer DELETE (endpoint schema-confirmed, one live run owed). newCustomersOnly now means "never attended" (visits.totalVisits), so a cancelled guest stays bookable — your exact ask.
Presence-based push suppression merged ✓
20s heartbeat + hidden/pagehide clear beacon; 30s server lease; ONE gate at sendPushNotification (every push type funnels there); fail-open on any doubt. Badge/unread untouched. In-memory lease, single-process — noted for future scale.
Login-audit hardening (4 fixes) merged ✓
Host-token refresh: single-flight + exponential backoff + disarm on invalid_grant. Frontend 401s: one redirect, latched. Install-token sessions now carry Momence tokens (kills zombie sessions). Momence sync circuit-breaks the whole sweep on a 429 with Retry-After cooldown.
App Bridge (momence-ext v0.13.0) feature/app-bridge + merged API ✓
"App Bridge" item injected into Momence's left nav (text-sniffed labels, clones native styling, MutationObserver keep-alive — same proven pattern as the inbox tab). Panel with sub-tabs; first = Refunds to process, fed by a real RefundRequest queue written on paid-class cancellations. Backend routes x-api-key gated. Needs your manual browser load-test — the live DOM walk is the one untestable surface.
4 · Loose ends I'm carrying
- Live-verify: guest host-cancel (your checklist), totalVisits semantics on one known attendee
- Guest-pass decrement question stands from round 1: Momence doesn't consume a pass on our free-book (studio absorbs it) — Ruth's call whether that matters
- Extension branch not merged to momence-ext main yet — after your load-test
- Fixed my own test bug from Sat (jsdom scrollTo rejection made the frontend suite exit 1 while showing all-green — the kind of thing that hides real failures)