[Muawiya-contact]

Release 1.10.16 — operator handoff

Head/base: develop → main. Reconciliation PR #462 is merged; the release diff is conflict-free. The owner reports production SQL 0131–0136 applied, the six read-only catalog checks returned true, and their filenames are recorded. Merge only after the final required checks and review pass. This PR does not itself deploy an Edge Function, change a Supabase Auth setting, send email, or publish a mobile update.

User-visible changes

• #458: new learners choose followed topics, lessons and code read more clearly, profile editing stays visible above the keyboard, and gallery/camera photos are prepared for upload. Mobile state and offline topic choices get safer rollback behavior.
• #436: reviewer invitations share a learner's Supabase Auth identity; new reviewers can use password-only sign-in, choose authenticator protection later, and owners can manage a ten-member team or permanently remove review access without deleting a learning account.
• #459 and #461: the site and app use the Supabase Edge API and current public pages, with a separate public /account web entry, verified email returns, the shipped One Concept icon across web pages, and four reviewed Auth email HTML sources. “Coding Moves” links to the products page in all those emails.
• Dependency updates from the merged develop PRs are included. Production #460 is already on main; merged Reconcile production hotfix and release gates for 1.10.16 #462 reconciles that hotfix and its protected release gates into develop so this release retains both.

mobile/app.config.js bumps expo.version 1.10.15 → 1.10.16 and native runtimeVersion 1.10.8 → 1.10.16 because the release adds expo-image-manipulator/updated Expo native packages. A new Android APK is required; an older-runtime installation cannot receive this new runtime's OTA. The matching nonempty 1.10.16 What's New card is already in mobile/src/data/whatsNew.ts, using the existing once-per-version dismissal. It highlights topic choice, clearer lesson/code reading, and easier profile/photo editing. Both version and card are in this develop → main diff.

Production SQL — operator reported complete; protected verification still required

The owner reports applying these files in order to production Supabase project egdszjoesxlccauahmsx. A read-only catalog query on that project returned true for all six migration markers. The ledger commit 922e67c records them in backend/migrations/applied.txt; all 136 filenames are now ordered and present. The complete protected schema checker still runs after the release merge, before Edge deployment or OTA publication:

Order	Migration	Effect
1	backend/migrations/0131_opt_in_followed_topics.sql	New Auth users start without automatic followed topics.
2	backend/migrations/0132_opt_in_edge_bootstrap.sql	Edge first-request paths keep that opt-in choice.
3	backend/migrations/0133_editorial_reviewer_limit.sql	Ten active reviewers including owner; new invitation MFA is optional.
4	backend/migrations/0134_editorial_reviewer_removal.sql	Versioned permanent reviewer removal preserves learner identity and review evidence.
5	backend/migrations/0135_optional_authenticator_email_copy.sql	Assignment email copy reflects optional MFA.
6	backend/migrations/0136_editorial_reinvite_unconfirmed.sql	Existing unconfirmed Auth users can receive a fresh invitation.

The six catalog markers cover the signup trigger, opt-in daily API, reviewer cap, reviewer-removal RPC, optional-authenticator email copy, and unconfirmed-invite behavior. They are a bounded read-only check, not proof of the complete schema or live user flows. Do not rerun these applied SQL files. The protected checker in docs/SCHEMA_VERIFICATION.md must pass on the exact main revision before production Edge deployment and release publication.

Pre-merge gates

1. Confirm merged Reconcile production hotfix and release gates for 1.10.16 #462 keeps this PR conflict-free and retains version/runtime 1.10.16, its What's New card, API-origin mobile Auth redirects, the /account and earlier public browser routes, and the exact-deployment-run/preview-first/second-approval release gates.
2. Confirm the updated Migrations applied check and all PR quality jobs pass on the final head. Inspect the final diff and obtain the owner's explicit approval for this release PR before merging it.
3. Confirm the production/preview EAS public variables are valid and matched: EXPO_PUBLIC_API_BASE_URL is the matching Supabase /functions/v1/api URL, EXPO_PUBLIC_SUPABASE_URL and publishable key belong to that same Auth project, and EXPO_PUBLIC_WEB_BASE_URL is the intended public website origin. Check any optional legacy web origin. Do not paste keys into this PR.

After merge, in order

1. On the exact current main SHA, run Deploy Supabase API and worker to production, approve its protected production-schema gate, and record the successful Actions run ID. It verifies the real database schema and target, deploys the two Edge Functions, checks unsigned worker rejection and /health. Keep existing generation switches and Cron settings unchanged until their separate checks pass.
2. Publish the matching review-site build and public icon. Check /account, /account/callback, /auth/callback, the icon URL, and the current confirmation/recovery/privacy pages. In production Supabase Auth, allow the exact Edge /confirmed and /reset-password URLs plus review-site /account/callback and /auth/callback. Set the Site URL fallback only after the landing page is live. Confirm the Edge invitation callback, ALLOWED_ORIGINS, and editorial email dashboard origin match the published site. See docs/AUTH_REDIRECTS.md and admin/README.md; docs/EDITORIAL_ROLLOUT.md is historical.
3. Check production and staging Auth sender/template eligibility separately. If supported, install the source-controlled Confirm sign up, Invite user, Reset password and Password changed HTML/subjects in Supabase Dashboard, and enable the Password changed security notification as planned. The repository does not install these settings. Verify the exact {{ .ConfirmationURL }} actions, icon and Coding Moves byline in real inboxes; check SMTP/recipient limits. See docs/EMAIL_TEMPLATES.md.
4. Using only test accounts/inboxes you control, verify mobile signup and recovery, public web signup/recovery, a new reviewer invitation, an existing learner invitation, password setup, and that ordinary learner accounts cannot enter the private review workspace. Recheck Today's lesson, topic choice, profile photo, privacy links, and scheduled reminders on the matching production API. Do not post tokens, email links, passwords or keys in logs or PR comments.
5. Because runtimeVersion changes to 1.10.16, build a preview APK from the exact merged main commit before dispatching Release: from mobile/, run eas build --platform android --profile preview --non-interactive --wait. Install it on a spare phone; preview and production share one Android application ID and cannot coexist on the same phone. Keep the production APK on the regular phone until approval.
6. Dispatch Release on main with backend_revision equal to the full verified main SHA and production_deploy_run_id equal to step 1's successful run ID. The workflow verifies schema/deployment/version, publishes preview OTA first, and waits for the second protected approval. Test the compatible preview APK on the spare phone before approving production OTA. Then verify the v1.10.16 tag/release, the native production APK build and stable apk-latest download, install the new APK on a test phone, and retest sign-in and core flows. Older native runtime installations need the new APK for this release.

Evidence and limits

The merged feature PRs passed their own quality checks. #462's local reconciliation passed mobile typecheck and 103 tests, review-site 24 unit tests/build and 74 browser tests, Edge TypeScript and 98 handler tests, and eight focused cutover-guard tests. Its hosted quality run and other PR checks passed. On the earlier #463 head, hosted backend, mobile, review-site, Release guard and Netlify checks passed; its migration ledger check failed as expected before the six filenames were recorded. The final head must pass all required checks. The owner reported production SQL application and six true catalog markers; this review did not run SQL, the complete production schema checker, live Auth email, EAS environment, Netlify publication, or phone flow.

[netlify]

✅ Deploy Preview for coding-moves-one-concept-review canceled.

Name	Link
🔨 Latest commit	8537292
🔍 Latest deploy log	https://app.netlify.com/projects/coding-moves-one-concept-review/deploys/6ae377180fe9ed663eac14c9

[chatgpt-codex-connector]

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	⚠️ Failed 2026-10-29T16:44:45.514140Z We couldn’t complete this review. Comment @codex review to try again.	8537292	Draft marked ready

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

[chatgpt-codex-connector]

You have reached your Codex usage limits for code reviews. You can see your limits in the Codex usage dashboard.

[Muawiya-contact]

ok