Daily engineering digest — 2026-10-08 → 2026-10-09 (UTC)

Date range covered

2026-10-08 17:08 UTC through 2026-10-09 17:08 UTC (cron window).

No merges to main in this window. Latest production tip remains d31dd56 — fix(deps): close patchable prod audit findings (#23, merged 2026-10-07).
#30 — fix(billing): retain checkout references for superseded Xendit sessions (opened 2026-10-09): Addresses a paid-but-not-activated Plus case when a user completes payment on an older checkout after starting a newer one. Adds billing_checkout_sessions, migration backfill, and webhook resolution via session registry (packages/db). Impact: revenue/entitlement correctness for multi-checkout flows. CI (lint, typecheck, unit, Postgres journeys, Web E2E) passed on the PR branch.
#31 — docs: auth email, rate limits, and SMTP self-host setup (opened 2026-10-09): Documentation-only catch-up for merged auth work (#12) — docs/architecture.md, docs/self-host.md, README.md SMTP env split. Impact: operator runbooks for verification/reset mail and managed-AI throttling. Full CI green.
Scheduled verification: nightly verification workflow on main succeeded (2026-10-09 09:17 UTC).
Billing fix still in flight: #28 — prevent Plus demotion on duplicate checkout expiry (last updated 2026-10-08) remains open; last CI run reported Lint and Typecheck failures (other jobs including E2E passed).

Merge + migrate before billing fix ships: #30 introduces a Prisma migration (20261009110000_billing_checkout_sessions); plan deploy order and verify webhook paths in staging/production.
Overlapping billing PRs: #28 and #30 both touch checkout/expiry edge cases — reconcile scope and fix #28 CI before merging either, to avoid conflicting behavior.
Stale dependency PRs: #24, #25, #26 still open from 2026-10-07; main already absorbed related security work via #19/#23 — triage or close to reduce noise.

Automated daily digest (Cursor automation 17c2ced7-b684-11f1-bb68-864e54d14197).