Product bugs

Live 2026-10-29 03:50 UTC: zip-day run 40644873119 on main failed at 06:44 UTC. This result differs from run 40463374774. Provider stayed openstreetmap. NY 10016, GA 30305, FL 33604, and MI 48226 each returned Scrape timed out. VA 23221 found 30 and upserted 30 with error null. newSalons stayed 0, updatedSalons was 30, zipsToday was 10, then the job recorded Directory provider unavailable, stopped remaining areas, and exited 1. The seed step still pushed main to 8a64928. Do not force exit 0. Do not add a third retry. Do not switch the shared data URL. Do not switch sign-in. Scraped price rows stay off the shared database. Agent left empty.

On 2026-10-28 around 18:50 UTC, https://scytherdeck.com/ and https://www.scytherdeck.com/ returned HTTP 526. The GitHub Pages origin certificate (CN www.scytherdeck.com, Let's Encrypt YR1) notAfter is 2026-10-28 17:46:00Z. The edge certificate (Google Trust Services WE1) notAfter is 2026-12-24 21:40:52Z. The zone SSL mode was strict, which rejects that expired origin certificate. 1099:cursor-plat-1847 set the zone to full under the cloudflare lease. Both hosts then returned 200 and the page text contains JBNX. tensuite.net was not changed. Do not set this zone back to strict. Do not use Flexible SSL. Do not close this bug on the public 200 while notAfter stays 2026-10-28 17:46:00Z. No live portfolio project is named scytherdeck.

Live 2026-10-28 00:57 UTC: zone SSL is full. GET https://tensuite.net/ returns 200. GET /insights/ returns 200. GET /tos/ returns 200. GET /login returns 302 to https://app.tensuite.net/login. www.tensuite.net returns 301 to the apex, and www /login returns 302 to the app. ai.tensuite.net, book.tensuite.net, and app.tensuite.net stay 200. The origin certificate is still Let's Encrypt YR1, CN tensuite.net, notAfter 2026-10-27 23:10:52Z. It is expired. Visitors see the Cloudflare edge certificate, which is still valid. Do not set the zone back to strict. Strict returns 526. The 23:53 UTC note said full still returned 526 and restored strict. That did not reproduce after the setting read back as full. Left on full. Do not repeat a three-minute unproxy. Do not use Flexible SSL. GitHub HTTP still 301s to https://tensuite.net/. A renewal still needs a GitHub Pages certificate from an account that can manage jbnx/tensuite. After notAfter is in the future, set SSL back to strict and confirm GET / stays 200. Do not close until that is true. Do not switch sign-in. Do not promise JBNX email. Bug 9 and bug 35 stay open. FedM8 is not part of this. Checked by 1099:cursor-plat-0050. Agent left empty.

Live 2026-10-27 21:48 UTC: Schema drift run 40589110625 on main failed at 21:43 UTC, commit f2ba338. The same provenance check failed on production commit 9d58db1, run 40589789559, at 21:48 UTC. Repo migration files are still not in production schema_migrations. It says to export the live migration or fix the header, and not to invent versions. Owner jbnx merged https://github.com/jbnx/nodedough/pull/208 onto production at 21:48 UTC. This sweep did not merge it and did not revert it. Agent left empty. Gated. Do not promote further. Do not paste the database URL.

Live 2026-10-27 15:48 UTC: Supabase Preview on main commit 0f23f62 failed. The summary is: Remote migration versions not found in local migrations directory. The same summary failed on d9726de at 23:15 UTC on 2026-10-26 and on 4b8f6e7 at 12:50 UTC on 2026-10-25. Production apply run 40534483249 on 0f23f62 succeeded, and test, gate, gitleaks, and legal-and-gates succeeded. This is not bug 69 (apply still succeeds while list schema_migrations returns 401) and not bug 81 (edge deploy 401). Pull request 655 merged at 15:47 UTC and did not introduce this check. Agent left empty. Gated. Do not promote. Do not paste a key. Do not close from another preview failure with this same summary.

Live 2026-10-26 07:46 UTC: scheduled security-scan run 40282525027 on main failed at 06:54 UTC, commit 4b8f6e7. It scanned 1541 commits and reported 29 low-entropy findings. generic-api-key was 27, max entropy about 4.3. linkedin-client-secret was 2, entropy about 3.5. The telemetry registry and telemetry runtime spec are still in that set. The 2026-10-24 one-commit success 40060941149 does not clear this scheduled scan. Do not paste the matched text. Gated. Do not promote. Agent left empty.

Live 2026-10-26 07:46 UTC: security-scan run 40282812605 on main failed at 06:56 UTC, commit d38191a. gitleaks generic-api-key reported 5 matches. Files: search_listings.py and tests/test_app.py. Entropy stays about 3.5 to 3.9. Pull-request scans of the diff were not this run. Gated. Do not promote. Do not paste the matched values. Do not treat this as a customer 404. FedM8 is not part of this. Agent left empty.

Live 2026-10-25 18:50 UTC: RSI promote run 40196199869 failed at 13:07 UTC on pull request https://github.com/jbnx/nodedough/pull/211. The pull request is still a draft. Title is Record the 2026-10-25 framework note. Branch is cursor/rsi-proposer-policy-d929. The only file is rsi/updates/2026-10-25.md. The judge marked it promotable, then gh pr merge returned that the pull request is still a draft. Main tip stays d38191a. Production stays owner-gated. Do not mark the pull request ready. Do not merge. Do not promote. Agent left empty. FedM8 is not part of this.

Live 2026-10-25 16:50 UTC: main tip 4b8f6e7 at 12:49 UTC did not run Deploy fedm8-headers, Deploy railway-fedm8, or Deploy fedm8-ops. It did run Deploy GitHub Pages 40194841962 and Deploy Cloudflare Pages 40194841991, both success. Latest failures of those three edge workflows remain 39817792028, 39817791941, and 39817791924 at 16:52 UTC on 2026-10-22, commit 4b1c868. Agent left empty. Gated. Do not promote.

Live 2026-10-25 16:50 UTC: Apply migrations 40194857748 on main commit 4b8f6e7 succeeded at 12:50 UTC, and the log still says list schema_migrations returned 401. The job conclusion is success. The prior success 40115628676 on d01f56f at 17:19 UTC on 2026-10-24 had the same 401. Agent left empty. Gated. Do not promote. Do not paste the key. Do not close while that list still returns 401.

Live 2026-10-24 23:50 UTC: GET https://openclaw-production-b802.up.railway.app/ and /healthz return HTTP 404 with header x-railway-fallback true. The body is HTML titled 404 Not Found. This replaces the 22:50 UTC JSON status error, code 404, message Application not found. Agent left empty. Do not roll back. Do not restart only to repeat the fallback page. Do not create a second service.

Live 2026-10-24 23:50 UTC: GET https://pdf.jbnx.io/ and https://pdf-production-3b5a.up.railway.app/ and /login and the railway hostname /healthz return HTTP 404 with header x-railway-fallback true. The body is HTML titled 404 Not Found. This replaces the 22:50 UTC JSON status error, code 404, message Application not found. pdf.jbnx.io/healthz returns 200 with ok true from the insights collector. pdf.jbnx.io/insights returns 200. Agent left empty. Do not restart only to repeat the fallback page. Do not roll back removed deployments. Do not create a second service. Do not change the proxied name record.

Live 2026-10-24 21:47 UTC: fedm8.net and www.fedm8.net returned HTTP 200 with their own company page. fedm8.net/login and www.fedm8.net/login returned HTTP 404 with body Not found. This hour was not a Cloudflare challenge. Visible page text does not say JBNX. Agent left empty. Do not add a JBNX line. Do not promote.

Live 2026-10-24 05:47 UTC: Security boundaries run 40067503061 on main failed at 05:45 UTC, commit d38191a. The prove step failed because relation institution_members does not exist. Agent left empty. Gated. Do not promote. Do not paste the database URL.

Live 2026-10-24 04:47 UTC: Data retention run 40062776709 on main failed at 04:32 UTC. The purge step failed because purge_analytics_events() does not exist. Agent left empty. Gated. Do not promote. Do not paste the database URL.

Live check 2026-10-20 08:50 UTC: GET /api/1099/llm-health is HTTP 200. probe.ok is false, probe.status is 502, working_model is null, and probe.tried is cheap, fast, then standard, then openrouter/qwen/qwen3-vl-30b-a3b-instruct. The inner message is still gateway 400 on that fourth name, an invalid catalogue model. cheap, fast, and standard were tried first and did not complete, so fact extraction still falls back. The gateway config defines those three aliases. /v1/models lists them, and the projects virtual key still cannot complete a call. Railway list-variables returns names only. Do not invent a model. Add cheap, fast, and standard on the projects virtual key from the LiteLLM admin key. Do not paste that key. Status and usage still save.

Live 2026-10-20: the JBNX vault already has a secret named resend_api_key. The Supabase management token in this environment returns 401, and the connector has no auth-config write. SMTP was not changed. Do not paste or read the key. Do not invent a second key. Password reset mail stays broken until that existing secret is set as auth SMTP.

Live 2026-10-20: GET https://db.jbnx.io/ returns 404 JSON, requested path is invalid. GET /rest/v1/ and GET /auth/v1/health return 401 No API key found, so the database host is up. The old Cloudflare 1014 error is gone. Do not put a worker in front of /rest/v1 or /auth/v1. Do not point app data calls at auth.jbnx.io. A browser note was not added. FedM8 is not part of this.

Live 2026-10-04: test host only. GET https://test.cipherdeck.com/login?next=%2Fcredits returns 302 to https://test.app.cipherdeck.com/login?next=%2Fcredits. GET /signin/ returns 302 to https://test.app.cipherdeck.com/login. GET /sign-in?x=1, /signup, /sign-up, /account, and /reset return 302 to that test login. GET /forgot?x=1 returns 302 to https://test.app.cipherdeck.com/login?x=1. HEAD /login?x=1 returns 302 to https://test.app.cipherdeck.com/login?x=1. GET https://test.www.cipherdeck.com/forgot?x=1 returns 302 to https://test.app.cipherdeck.com/login?x=1. GET https://cipherdeck-test.up.railway.app/account returns 302 to https://test.app.cipherdeck.com/login. GET /login/extra stays 404. POST /login stays 405. GET / and /about.html return 200. GET /insights returns 200. The test app page is the standing not-production note. Production was not changed: GET https://cipherdeck.com/login and https://www.cipherdeck.com/login?next=%2Fshop stay 404, last-modified Tue, 01 Sep 2026. HEAD https://www.cipherdeck.com/signin stays 404. POST https://www.cipherdeck.com/login stays 404. Draft PR https://github.com/jbnx/cipherdeck/pull/12 is commit 8b6d9e8. node --test passed (2). gitleaks passed. Railway project-jbnx service cipherdeck test deploy 144dcb4d SUCCESS. The test environment now tracks branch cursor/test-signin-aliases, not main. Do not merge and do not point production at this branch until chat approval. Bot POST https://www.cipherdeck.com/collect returned ignored. Scripted GET /go/call?to=0000000000&place=verify returned 302 to tel:+0000000000 and www.cipherdeck.com calls stayed 0, page views stayed 6. No JBNX footer and no auth.jbnx.io promise. FedM8 is not part of this.

Live 2026-10-06: GET https://fedm8.net/ returns 200. The footer link labeled security.txt points at .well-known/security.txt on that same host. GET https://fedm8.net/.well-known/security.txt returns 404. GET https://www.fedm8.net/.well-known/security.txt returns 404. GET https://test.fedm8.net/.well-known/security.txt returns 404. GET https://fedm8.com/.well-known/security.txt returns 200. Privacy, terms, and refunds in that footer already use absolute https://fedm8.com links. FedM8 keeps its own sign-in. Do not point it at auth.jbnx.io. FedM8 is gated: do not promote a production change without chat approval.

2026-10-05: PR https://github.com/jbnx/mahjong/pull/3 CI 37293127192 passed all 279 tests. Push to main run 37293244410 failed, then the failed-job rerun failed a different test. First failure: tests/claim-sync-api.test.mjs expected /expired/ and got 'That call window has ended. Your current table is ready.' Second failure: own-data export listen EADDRINUSE 0.0.0.0:34830. The insights slash fix was already live on deploy 90baf893. Do not treat this as a product regression. Do not edit those tests just to make a red run pass.

Live 2026-10-04: www.seo.jbnx.io and www.mkt.jbnx.io had no address record. A proxied placeholder plus a redirect was tried and removed. The edge certificate covers *.jbnx.io only, so www.seo and www.mkt (a second label) fail the TLS handshake. Ordering another certificate was refused for this zone. Do not leave the placeholder records in place. seo.jbnx.io stays the canonical host. mkt.jbnx.io already redirects there. FedM8 is not part of this.

Live 2026-10-04: https://docs.jbnx.io fails during the TLS handshake (unexpected EOF). DNS is a DNS-only CNAME to ghs.googlehosted.com. This environment has no Google site credential. Do not invent one. Restore the Google custom-domain mapping, or point the name at a host that can serve docs. FedM8 is not part of this.

Live 2026-10-04: GET https://ai.tensuite.net/ returns 200 titled Mochi, the appointment assistant. GET https://ai.tensuite.net/login returns 404 Page not found. Production book sign-in aliases skip the assistant host on purpose. Do not redirect assistant /login until the assistant has its own sign-in target. Do not change production app or book routes for this. No auth.jbnx.io promise. FedM8 is not part of this.

Live 2026-10-04: https://executivenailsuite.com and /login return 200 and the footer says A JBNX product, linking to https://jbnx.io. No auth.jbnx.io promise. Merged PR https://github.com/jbnx/executivenailsuite/pull/15 as bfbc195. Railway deploys aac1fa3a and b5b6695b SUCCESS. Sign-in still uses the Executive Nail Suite database, not auth.jbnx.io. Do not switch until those accounts exist on the JBNX project. Scraped price rows stay there. FedM8 is not part of this.

https://cipherdeck.com returns 200 and the visible page text does not say JBNX. Auth on the marketing site is not auth.jbnx.io. CipherDeck is gated: do not promote a footer change to production without chat approval. Do not promise JBNX email until sign-in really uses auth.jbnx.io. The seller app is a separate open bug. FedM8 is not part of this.

book.tensuite.net, app.tensuite.net, and tensuite.net return 200 and do not mention JBNX. The test hosts match. Live app.js has no auth.jbnx.io calls; sign-in is the salon app's own API. Do not add a line that promises JBNX email until sign-in really uses auth.jbnx.io. FedM8 is not part of this.

countingdayz.com is not a DNS name in the JBNX Cloudflare account, so it does not resolve. The live game is https://dayz.localfave.org and that page returns 200 and already mentions JBNX. Do not buy or invent a domain. Point countingdayz.com at the game only after the name is in an account that can edit it.

https://nguy.in/ and https://nguy.in/login return 200 and do not mention JBNX. The sign-in page calls a Supabase host, not https://auth.jbnx.io. Do not switch the URL until those accounts exist on the JBNX project, or sign-in breaks. Do not add a line that promises JBNX email until that switch is real. FedM8 is not part of this.

https://localfave.com and www.localfave.com return HTTP 200 with the text Error. Page cannot be displayed. The working site is https://localfave.org. The .com host is not a zone in the JBNX DNS account; the response host header is a shared host. Do not invent host credentials. Point .com at the same site as .org, or redirect it, once the domain is in the account that can edit it.

app.cipherdeck.com talks to the JBNX Supabase project host and the homepage does not say JBNX. Auth calls should use https://auth.jbnx.io so the sign-in URL and email are JBNX. Keep data calls on the project API if the custom domain only proxies /auth/v1.

Live 2026-10-28 08:55 UTC: GET https://book.tensuite.net/book and /book?next=%2Fcredits still return 404. GET /book/ returns 404. GET /book/extra stays 404. POST /book stays 404. GET /book.js stays 200. GET https://app.tensuite.net/book stays 200. GET https://tensuite.net/book stays 301 to /book/ and that page stays 200. Agent 1099:cursor-plat-0846 claimed app-tensuite after the 0746 lease expired. The redirect is commit 1c971e5 on branch cursor/book-home-0746, one commit ahead of main 8ecf153. Local node --test of that redirect passed 3. Pull request is opening. Do not switch sign-in. Do not change the marketing /book page. FedM8 is not part of this.

Live 2026-10-25 03:46 UTC: main tip is f627e37 at 03:42 UTC, parent f6c0bc6, message Replace Kayla anchor and add full-body 360° references. quality-gates 40159207249 succeeded. portal-guards 40159207192 succeeded. Cyber owner boundaries 40159207147 succeeded. The 16:39 UTC failure on 6fb39f1 is not the tip of main. Pull request https://github.com/jbnx/jbnx.io/pull/199 head 0490706 on cursor/fix-main-gates-2147 is still open against main. mergeable is CONFLICTING. mergeStateStatus is DIRTY. reviewDecision is APPROVED from the approval agent. That is not an owner chat approval. Agent stays 1099:cursor-plat-2147. Lane is prodit. Do not merge. Do not paste a key.

Closed 2026-10-28 04:53 UTC by 1099:cursor-plat-0448. Empty validation probe. Not a product finding. No host was changed.

Closed 2026-10-28 04:53 UTC by 1099:cursor-plat-0448. Empty validation probe. Not a product finding. No host was changed.

Closed 2026-10-28 04:53 UTC by 1099:cursor-plat-0448. Empty validation probe. Not a product finding. No host was changed.

Closed 2026-10-27 21:55 UTC. Production trailing slash now answers 301. GET https://nodedough.com/legal/privacy/ returns 301 to /legal/privacy. GET /legal/privacy/?x=1 returns 301 to /legal/privacy?x=1. GET /legal/terms/?x=1 returns 301 to /legal/terms?x=1. GET /legal/, /support/?x=1, /quick/, /admin/, /privacy/?x=1, /login/?next=%2Fcredits, and /signin/?x=1 return 301 and keep the query. GET /legal/privacy stays 200. GET /legal/privacy/extra and /login/extra stay 404. POST /legal/ and POST /login/ stay 404. GET /healthz/ stays 404. GET /insights and /insights/ stay 200. www.nodedough.com/legal/privacy/ returns 301 to https://nodedough.com/legal/privacy/, and that path 301s to /legal/privacy. Owner jbnx merged pull request 208 at 21:48 UTC. This sweep did not merge it. No JBNX email promise. Bug 2 stays open. FedM8 is not part of this. Do not reopen.

Closed 2026-10-27 21:55 UTC. Owner jbnx merged https://github.com/jbnx/nodedough/pull/208 onto production at 21:48 UTC as 9d58db1. This sweep did not merge it. Live GET https://nodedough.com/login and /login?next=%2Fcredits return 302 to /#authPanel. HEAD /login?x=1 and HEAD /signin?x=1 return 302 to /#authPanel. GET /signin returns 302 to /#authPanel. GET /login/?next=%2Fcredits returns 301 to /login?next=%2Fcredits. GET /login/extra stays 404. POST /login stays 405. POST /login/ stays 404. Production config.js authUrl is https://auth.jbnx.io/auth/v1. Data calls stay on the project host. Password reset mail stays bug 2, so this does not promise JBNX email. Schema drift on that production commit stays bug 72. October page views were 4020. Calls stayed 0. Finished stayed 0. FedM8 is not part of this. Do not reopen.

Closed 2026-10-22. Main booking tests are green. Run 38760099484 on main succeeded at 2026-10-15 15:24 UTC, job test, commit 1940a18, title Fix the 11 failing booking tests. The commit changes assistant-conversation.js and mochi-desk.js and aligns the Gel-X removal assertion with the book price. It is not a skipped job. The 2026-10-14 failures, including 38649403852, are older than that green run. This run did not redeploy TenSuite and did not switch sign-in. No auth.jbnx.io promise. FedM8 is not part of this. Do not reopen.

Closed 2026-10-20. Scheduled security-scan on main failed 2026-10-19, run 39212883229. gitleaks generic-api-key matched the public Cloudflare Insights beacon attribute in index.html. Entropy was about 3.6. The token was not copied into the allowlist. PR https://github.com/jbnx/scytherdeck/pull/8 squash-merged as 892e4b2. Local gitleaks 8.30.1 scanned 734 commits and found no leaks. A different generic key on the same page still fails. Pull-request scan 39361552742 passed. Push scan 39361744674 passed. Full-history workflow_dispatch 39361760934 succeeded. Pages deploy 39361744440 succeeded. GET https://www.scytherdeck.com/ stays 200 and still says JBNX. It does not name auth.jbnx.io. GET /login?next=%2Fshop still redirects home. Sign-in was not switched. There is no portfolio project row for scytherdeck, so no write claim was taken. FedM8 is not part of this. Do not reopen.

Closed 2026-10-20. Live GET https://pdf.jbnx.io/ returned Railway JSON 404 Application not found, and GET /login and GET /api/health did the same. GET /healthz and GET /insights stayed 200. The last successful deploy 2a61fbe2 (commit 7f65b24, 2026-10-04) was REMOVED, so the host had no app. Redeployed that build as 04404600. Status SUCCESS. GET https://pdf.jbnx.io/ returns 200 titled pdf.jbnx.io fill and sign. The footer says A JBNX product and links to https://jbnx.io. It does not name auth.jbnx.io and does not promise JBNX email. GET /login?next=%2Fbugs returns 302 to /?next=%2Fbugs. HEAD /login?x=1 returns 302 to /?x=1. GET /signin/ returns 302 to /. GET /forgot?x=1 returns 302 to /?x=1. GET /login/extra stays 404 text not found. POST /login stays 405 method not allowed. GET /api/health returns 200 {"ok":true}. The service hostname returns 200 with the same title. Insights counts for the month stayed empty. FedM8 is not part of this. Do not reopen.

Live 2026-10-09 06:57 UTC: zip-day run 37895783604 on main exited 1 after the price seed push. The log error is OpenStreetMap HTTP 429, then the job stops remaining areas. The same error failed run 37739990940 on 2026-10-08 and run 37583666042 on 2026-10-07. The price seed still committed. This is not the closed stats-view refresh. Do not point FedM8 at this. Do not paste database URLs.

https://docs.prelysium.com is the player wiki and its footer only links Game Log and Dev. The game at https://prelysium.com already says A JBNX game and that sign-in and email come from JBNX. FedM8 is unrelated. Do not change the game sign-in host.

2026-10-06: GitHub zip-day run 37426009653 failed after the scrape with SQLSTATE 0A000: CONCURRENTLY cannot be used when the materialized view is not populated. The dedicated project function already fills an empty view first. The live function used by zip-day still refreshes both stats views concurrently, and both views are unpopulated. Bug 61 stays closed for the dedicated project. Do not point FedM8 at this. Agent 1099:cursor-plat-fb31 is fixing it on 2026-10-06.

Closed 2026-10-06. Live GET https://ai.tensuite.net/api/assistant/status reports deskFramework 29, publicDesk true, signInRequired true. The book lists My-Le Nguyen and CeCe N. Rose is not on the book. POST /api/assistant/desk: - Gel allergy, can I get a classic manicure? topic allergy. Classic manicure is 50 dollars, 60 minutes, plus the allergy line. - BIAB or Gel-X if I want length? topic length-choice. Gel-X adds a tip (100 dollars / 90 min). BIAB does not (85 dollars / 90 min). Length add-ons are Gel-X long 10 dollars and XL 20 dollars. - Chrome on a gel manicure, how much extra? topic chrome-extra. Gel manicure is 60 dollars. Chrome is not its own line. Art levels are 10 to 80 dollars. - Website says Rose, can I book her? topic unknown-artist. Rose is not on the online book. The online book lists My-Le Nguyen and CeCe N. - Send me the book link. topic book-link. https://tensuite.net/book. A live opening still needs sign-in. Chrome on Gel-X quotes the Gel-X price, 100 dollars, not the gel manicure. Rose gold stays a finish. PR https://github.com/jbnx/tensuite/pull/90 squash-merged as 03d9980. PR https://github.com/jbnx/tensuite/pull/92 squash-merged as ef41e5a. CI on both stayed 523 pass and 8 fail, the same eight failures already on main. gitleaks passed. Railway project tensuite service book production deploy b1b4da04 SUCCESS. Insights stayed reached 194, finished 0, calls 0, page views 20. Bot POST /collect returned 204. Scripted GET /go/call returned 302 to tel:+10000000000 and calls stayed 0. No auth.jbnx.io promise. Bug 9 stays open. FedM8 is not part of this. Do not reopen.

GET /login, /signin, /sign-in, /signup, /sign-up, /account, /forgot, and /reset on https://auth.jbnx.io returned plain text Not found. GET / is the JBNX sign-in note. /auth/v1 must stay proxied. POST on those names stays 404. Worker jbnx-auth-host. Source scripts/auth-jbnx-worker.js in jbnx/workt.win.

Closed 2026-10-05. Live GET https://tensuite.net/terms?x=1 returns 301 to https://tensuite.net/tos/?x=1. GET /terms/?x=1 returns 301 to /tos/?x=1. HEAD /terms/?x=1 returns 301 to /tos/?x=1. GET https://www.tensuite.net/terms?x=1 returns 301 to https://tensuite.net/tos/?x=1. GET /tos/ stays 200 titled Terms of service. GET /tos/?x=1 stays 200. GET /terms/extra stays 404. POST /terms stays 405. GET /login?next=1 still 302s to https://app.tensuite.net/login?next=1. Cloudflare zone tensuite.net ruleset 91426b77784d466b9e8348ce370f0c5e rule tensuite_terms_tos (09a5fded040647b0bb8a3689193bc989). PR https://github.com/jbnx/tensuite/pull/89 squash-merged as 48b87f9. node --test cloudflare/redirects.test.js passed (2). Secret scan 37338459465 passed. Main secret scan 37338596855 passed. GitHub Pages deploy 37338596862 succeeded. Pull-request checks did not queue on their own; the secret scan was started with workflow_dispatch. book.tensuite.net/terms?x=1 still 301s to https://tensuite.net/tos/ and drops the query. That redirect was already on the book server. Do not reopen this bug for that drop. Insights stayed an empty month note. Bot POST /collect returned 204. Scripted GET /go/call returned 302 to tel:+10000000000. The homepage still does not say JBNX and does not name auth.jbnx.io. Bug 9 stays open. FedM8 is not part of this. Do not reopen. Do not turn POST /terms into a form.

Closed 2026-10-05. The daily refresh had failed since 2026-10-01 because a concurrent refresh cannot run until the stats view has been filled once. The function now fills an empty view first, then keeps the concurrent refresh. PR https://github.com/jbnx/executivenailsuite/pull/18 squash-merged as bf44969. CI https://github.com/jbnx/executivenailsuite/actions/runs/37330490235 passed. Worker tests 62 pass. App tests 46 pass. A live refresh through the new function succeeded. https://executivenailsuite.com/ stayed 200 and the footer still says A JBNX product. No auth.jbnx.io promise. Do not switch the database.

Closed 2026-10-05. The Read Google reviews button on https://tensuite.net/ uses /go/map?app=google&place=reviews. Live GET https://tensuite.net/go/map?app=google&dest=TEN+SUITE+NAILS&place=reviews returns 302 to https://www.google.com/maps/search/?api=1&query=TEN%20SUITE%20NAILS. https://book.tensuite.net/go/map with the same query returns the same 302. https://www.tensuite.net/go/map?app=google&dest=TEN+SUITE+NAILS&place=reviews&x=1 returns 302 to that search URL. GET place=directions and place=address stay 302 to https://www.google.com/maps/dir/?api=1&destination=... GET with no place stays on directions. Apple place=reviews stays 302 to https://maps.apple.com/?q=... POST /go/map?place=reviews stays 302 to the search listing for the salon address and is not a form. GET /go/map/extra stays 404. The button text is still Read Google reviews. PR https://github.com/jbnx/tensuite/pull/88 squash-merged as 9bf812c. Booking tests 530 run, 522 pass, 8 fail. Those 8 are the same failures already on the last merged booking change. gitleaks, Bugbot, the approval agent, and the security review passed. node --test for the map wrapper passed. Railway project tensuite service book production deploy 673b6475 SUCCESS. Book insights stayed reached 159, page views 0, calls 0, maps 0, finished 0. App stayed reached 176, page views 6, calls 0, maps 0, finished 0. Bot POST /collect returned ignored. The homepage still does not say JBNX and does not name auth.jbnx.io. Bug 9 stays open. FedM8 is not part of this. Do not reopen. Do not turn POST /go/map into a page.

Closed 2026-10-05. sample.jbnx.io had no DNS record, so the name did not resolve. It is now a custom domain on Railway project project-jbnx, service jbnx.io, production, port 8080, the same service as demo.jbnx.io. Certificate status is valid. Cloudflare proxied CNAME is vdvdww0j.up.railway.app. The edge certificate is CN jbnx.io with *.jbnx.io. GET https://sample.jbnx.io/ returns 200 titled Private Client Realty — John Doe, Arlington VA. GET /login?next=%2Fwork returns 302 to /support?next=%2Fwork. HEAD /login?x=1 returns 302 to /support?x=1. GET /signin returns 302 to /support. GET /login/extra stays 404. POST /login stays 405. GET /insights and /insights/?month=2026-10 stay 200. demo.jbnx.io and www.jbnx.io stay 200. After the checks, visitors were 13, unique people 13, page views 13, called 0, finished 0. Bot POST /collect returned ignored. Scripted GET /go/call?to=0000000000&place=verify returned 302 to tel:+0000000000 and called stayed 0. Eight later GETs of /login?next=%2Fwork all returned 302. The host is the sample client site. No auth.jbnx.io promise. FedM8 is not part of this.

Closed 2026-10-05. Live GET https://seo.jbnx.io/insights/?month=2026-10 returns 302 to /insights?month=2026-10. HEAD /insights/?x=1 returns 302 to /insights?x=1. GET /insights stays 200. GET /insights/extra stays 302 to /signin. POST /insights/ stays 302 to /signin and is not a page. https://mkt.jbnx.io/insights/?month=2026-10 returns 301 to https://seo.jbnx.io/insights/?month=2026-10, and that path 302s to /insights?month=2026-10. https://test.mkt.jbnx.io/insights/?month=2026-10 returns 302 to /insights?month=2026-10. HEAD /insights/?x=1 returns 302 to /insights?x=1. GET /insights stays 200. GET /insights/extra and POST /insights/ stay 302 to /signin. GET /login?next=%2Fdesk still 302s to /signin and drops the query. The operator door does not use that next value. POST /signin with an empty body stays 401. PR https://github.com/jbnx/mkt.jbnx.io/pull/17 squash-merged as af5ca96. python3 test_security.py passed 100/100. gitleaks, Bugbot, security review, and the approval agent passed. Railway project jbnx service mkt production deploy 82aa6dfe SUCCESS and test deploy e497ef9e SUCCESS. The page still says JBNX. No auth.jbnx.io promise. Insights stays the empty operator note. Bot POST /collect returned ignored. Scripted GET /go/call stayed 302 to /signin. Bug 45 stays open. FedM8 is not part of this. Do not reopen. Do not turn POST /insights/ into a page. Do not switch this operator door to auth.jbnx.io.

Closed 2026-10-05. Live GET https://mahjong.localfave.org/insights/?month=2026-10 returns 302 to /insights?month=2026-10. HEAD /insights/?x=1 returns 302 to /insights?x=1. GET /insights stays 200. GET /insights/extra stays 404. POST /insights/ with the game origin stays 401 Please log in, not a page. GET /login?next=%2Fcredits still 302s to /?next=%2Fcredits. PR https://github.com/jbnx/mahjong/pull/3 squash-merged as 31b0d6c. PR CI 37293127192 passed (279). Railway project mahjong service mahjong deploy 90baf893 SUCCESS. Page views stayed 74, browsers stayed 72, finished stayed 0, taps stayed 0. Bot POST /collect returned ignored. Scripted GET /go/call 302s to tel:+10000000000 and finished stayed 0. Footer still links to https://jbnx.io. No auth.jbnx.io and no JBNX email promise. Main CI 37293244410 failed twice on unrelated flakes (claim-window wording, then EADDRINUSE :34830) after the PR run passed. Do not reopen. Do not turn POST /insights/ into a page.

Live 2026-10-05: GET /insights is 200 and GET /insights/ is 404 on wieldlings.com, www.wieldlings.com, and wieldling.com. A typed trailing slash on the insights page should land on the page and keep the query. The live host is the project-jbnx service, not the separate project named wieldlings.

Closed 2026-10-05. GET https://localfave.org/insights/?month=2026-10 returns 302 to https://localfave.org/insights?month=2026-10. HEAD /insights/?x=1 returns 302 to /insights?x=1. www.localfave.org/insights/?month=2026-10 returns 301 to the apex path with the slash, then that path 302s to the page. GET /insights stays 200. GET /insights/extra stays 404. POST /insights/ stays 405. tetris.localfave.org/insights/ and vivanessa.com/insights/ stay 404. GET /login?next=%2Fstack still 302s to /?next=%2Fstack. PR https://github.com/jbnx/localfave/pull/61 squash-merged as a44043c. PR https://github.com/jbnx/localfave/pull/62 squash-merged as eeccf85 so the deploy check expects POST 405. Deploy 37280280881 succeeded, including live verify. npm test passed (116). Visitors stayed 302, unique stayed 302, page views stayed 312, finished stayed 0, calls stayed 0. Bot POST /collect returned ignored. Scripted GET /go/call 302s to tel:+10000000000 and calls stayed 0. Do not reopen. Do not redirect tenant /insights/. Do not turn POST /insights/ into a page.

Live 2026-10-05: GET /insights/?month=2026-10 returns 302 to /insights?month=2026-10. HEAD /insights/?x=1 returns 302 to /insights?x=1. GET /insights stays 200. GET /insights/extra stays 404. POST /insights/ stays 405. GET /healthz/ stays 404. GET /login?next=1 still returns 302 to /?next=1. POST /login stays 405. PR https://github.com/jbnx/CountingDayZ/pull/2 squash-merged as 4967433. CI 37275580087 and 37275917313 passed. Deploy 82519d9e SUCCESS. Page views stayed 0, views today stayed 0, unique sessions stayed 0. Bot POST /collect returned ignored. GET /go/call stays 404. Homepage still says JBNX and does not name auth.jbnx.io. Do not promise JBNX email. Do not reopen. Do not turn POST /insights/ into a page. countingdayz.com DNS stays bug 15.

Live 2026-10-05: GET https://bill.jbnx.io/admin returns 200. GET /admin/ returns 404. GET https://hub.jbnx.io/admin returns 200. GET /admin/ returns 404. GET https://hub.jbnx.io/login/ stays 302 to /admin. GET /bugs and /bugs/ stay 200. FedM8 is not part of this.

Live 2026-10-05: GET https://dreamt.win/login/ returns 302 to /login. GET /login/?next=%2Fcredits returns 302 to /login?next=%2Fcredits. HEAD /login/?x=1 returns 302 to /login?x=1. GET /signup/ returns 302 to /signup. GET /legal/privacy/?x=1 returns 302 to /legal/privacy?x=1. HEAD /legal/terms/ returns 302 to /legal/terms. GET /legal/refunds/ returns 302 to /legal/refunds. GET /insights/?month=2026-10 returns 302 to /insights?month=2026-10. GET https://www.dreamt.win/login/ returns 301 to https://dreamt.win/login/, and that path returns 302 to /login. GET https://workt.win/login stays 308 to https://dreamt.win/login. GET /login, /signup, and /legal/privacy stay 200 HTML. GET /login/extra stays 404 JSON. POST /signin stays 404 JSON. POST /login/ stays 404 JSON. Merged PR https://github.com/jbnx/workt.win/pull/33 as 4bef773. CI 37265435278 passed. npm test passed (300). Railway project workt-win service web deploy 07318fb2 SUCCESS. GET /insights returns 200. Finished outcomes stayed 3. Bot POST /collect returned ignored. Scripted GET /go/call?to=0000000000&place=verify returned 404 because no call target is configured. FedM8 is not part of this.

Live 2026-10-05: GET https://hi.jbnx.io/core/?x=1 returns 301 to /core?x=1. HEAD /core/?x=1 returns 301 to /core?x=1. GET /toc/, /md/, /txt/, /json/, /pointer/, /directive/, /healthz/, /llm/, and /sections/ return 301 to the page. GET /ref/R16/?x=1 returns 301 to /ref/R16?x=1. GET /insights/?month=2026-10 returns 301 to /insights?month=2026-10. HEAD /signin?next=%2Fbugs stays 302 to https://projects.jbnx.io/?next=%2Fbugs. GET /signup, /core/extra, and /login/extra stay 404. POST /core/ stays 404. POST /login stays 405. GET /core stays 200 and is still directive version 83. GET https://projects.jbnx.io/framework/token-efficiency/?x=1 returns 301 to /framework/token-efficiency?x=1. HEAD /framework/continuous-improvement-os/ returns 301 to the document. GET /framework/ stays 200. GET /bugs/ stays 200. GET /insights/?x=1 returns 301 to /insights?x=1. HEAD /api/insights/?x=1 returns 301 to /api/insights?x=1. POST /framework/token-efficiency/ stays 405. GET /framework/jev-router/ stays 401 Private document. GET /framework/no-such-doc and /framework/no-such-doc/ stay 401 Private document. GET /login?next=%2Fbugs stays 302 to /?next=%2Fbugs. POST /login stays 405. test.projects.jbnx.io matches: /framework/token-efficiency/?x=1 and /insights/?x=1 return 301, and /framework/no-such-doc/ stays 401. Merged PR https://github.com/jbnx/jbnx.io/pull/158 as 0124cab. node --test desk-signin and owner-auth passed (10). node --check server.js passed. check-directive.py passed. CI owner-boundaries, pytest, gitleaks, osv-scanner, and config smoke passed. quality-gates semgrep still fails on jev_lead.py only, the same failure main had before this change. Railway project jbnx service projects production deploy d3340eb7 SUCCESS and test deploy 25c28a8e SUCCESS. GET /insights returns 200 on hi, projects, and test.projects. Visitors stayed 0, unique people stayed 0, finished stayed 0, calls stayed 0. Bot POST /collect returned ignored. Scripted GET /go/call?to=0000000000&place=verify returned 302 to tel:+0000000000 and calls stayed 0. FedM8 is not part of this.

Live 2026-10-05: GET https://executivenailsuite.com/signup/ returns 303 to /signup. GET /forgot/?x=1 returns 303 to /forgot?x=1. GET /reset/ returns 303 to /reset. GET /login/?next=%2Fdesk returns 303 to /login?next=%2Fdesk. HEAD /prices/ returns 303 to /prices. GET /desk/, /billing/, /zips/, and /insights/ return 303 to the page. GET /prices/?city=arlington returns 303 to /prices?city=arlington. GET /login, /signup, /forgot, and /reset stay 200. GET /login/extra stays 303 to /login?next=%2Flogin%2Fextra. HEAD /sign-in?x=1 stays 303 to /login?x=1. GET /signin/?next=%2Fdesk stays 303 to /login?next=%2Fdesk. POST /signin stays 303 to /login?next=%2Fsignin and is not a form. POST /login without a body stays 400. POST /signup/ stays 303 to /login?next=%2Fsignup%2F and is not a form. www.executivenailsuite.com/forgot/?x=1 returns 301 to the apex path, then 303 to /forgot?x=1. test.executivenailsuite.com/login/?next=%2Fdesk returns 303 to /login?next=%2Fdesk. test.executivenailsuite.com/reset/?x=1 returns 303 to /reset?x=1. executivenailsuite-test.up.railway.app/signup/ returns 303 to /signup. Merged PR https://github.com/jbnx/executivenailsuite/pull/17 as a2bd56a. CI test 37257100299 passed. node --test passed (107). Railway project robust-consideration service executivenailsuite production deploy 137512ef SUCCESS and test deploy 335015b6 SUCCESS. Footer still says A JBNX product and links to https://jbnx.io. No auth.jbnx.io and no JBNX email promise. Bug 1 stays open. GET /api/insights counts stayed empty: visitors 0, unique people 0, finished 0, calls 0. Bot POST /collect returned ignored. Scripted GET /go/call?to=0000000000&place=verify returned 303 to tel:+0000000000 and calls stayed 0. FedM8 is not part of this.

Live 2026-10-05: GET https://www.jbnx.io/demo/ returns 301 to /demo. GET /studio/?x=1 returns 301 to /studio?x=1. HEAD /studio/?x=1 returns 301 to /studio?x=1. GET /agreement/ returns 301 to /agreement. GET /privacy/ and /terms/ return 301 to the page. GET /support/?x=1 returns 301 to /support?x=1. GET /services/branding/ returns 301 to /services/branding. GET /work/tensuite/ returns 301 to /work/tensuite. GET /services/ and /work/ stay 200. GET /hack/?x=1 stays 301 to /hack?x=1. GET /pricing/ stays 301 to /prices. GET /contact/ and /no-such-page/ stay 404. POST /agreement/ stays 404. GET /demo stays 200. GET https://games.jbnx.io/studio/ returns 301 to /studio. GET https://demo.jbnx.io/demo/ returns 301 to /demo. GET https://app.jbnx.io/prices/ stays 200. GET https://test.jbnx.io/agreement/?x=1 returns 301 to /agreement?x=1. GET https://jbnx.io/studio/ returns 301 to https://www.jbnx.io/studio/, and that page then 301s to /studio. Merged PR https://github.com/jbnx/jbnx.io/pull/157 as 170d3dd. pytest tests/test_routes.py and tests/test_agency_routes.py passed (27). CI pytest, owner-boundaries, gitleaks, osv-scanner, and config smoke passed. quality-gates semgrep still fails on jev_lead.py, the same failure main had before this change. Production deploy 0f64ecbe SUCCESS and test deploy c3cba302 SUCCESS. ship-it-inbox was fast-forwarded from 13657b5 to 170d3dd. GET /insights returns 200 on www, test, games, and demo. www visitors stayed 952, unique people stayed 952, page views stayed 1128, finished stayed 0, calls stayed 0. Bot POST /collect returned ignored. Scripted GET /go/call?to=0000000000&place=verify returned 302 to tel:+0000000000 and calls stayed 0. FedM8 is not part of this.

Live 2026-10-05: GET https://hi.jbnx.io/signin?next=%2Fbugs returns 302 to https://projects.jbnx.io/?next=%2Fbugs. HEAD /login?x=1 returns 302 to https://projects.jbnx.io/?x=1. GET /sign-in/ returns 302 to https://projects.jbnx.io/. GET /account returns 302 to https://projects.jbnx.io/. GET /forgot?x=1 returns 302 to https://projects.jbnx.io/?x=1. GET /signup stays 404. GET /login/extra stays 404. POST /login stays 405. POST /signin stays 405. GET / stays 200. GET /core stays version 83. GET https://projects.jbnx.io/signin?next=%2Fbugs still returns 302 to /?next=%2Fbugs. POST https://projects.jbnx.io/login stays 405. GET https://test.projects.jbnx.io/signin?next=%2Fbugs still returns 302 to /?next=%2Fbugs. Merged PR https://github.com/jbnx/jbnx.io/pull/156 as 6244dc9. node --test desk-signin passed (3). owner-boundaries passed. pytest passed. quality-gates semgrep still fails on jev_lead.py, the same failure main had before this change. Production deploy 55fc8af8 SUCCESS and test deploy 2ef2bd7f SUCCESS. GET /insights returns 200. Visitors stayed 0, unique people stayed 0, finished stayed 0, calls stayed 0. Bot POST /collect returned ignored. Scripted GET /go/call?to=0000000000&place=verify returned 302 to tel:+0000000000 and calls stayed 0. No auth.jbnx.io promise. FedM8 is not part of this.

Live 2026-10-05: GET https://seo.jbnx.io/signin returns 200 and the email field has no default value. https://test.mkt.jbnx.io/signin matches. https://mkt.jbnx.io/signin returns 301 to https://seo.jbnx.io/signin and that field is empty. GET /login?next=%2Fdesk still returns 302 to /signin and drops the query. The operator door does not use that next value, so the redirect was left as it was. POST /signin with an empty body stays 401. The page still says JBNX. No auth.jbnx.io promise. Merged PR https://github.com/jbnx/mkt.jbnx.io/pull/16 as b8e3f61. Security checks passed 96/96 and the smoke check passed. Secret scan passed. Production deploy 7ec26166 SUCCESS and test deploy 7e57aa9a SUCCESS. GET /insights stays the empty operator note. Bot POST /collect returned ignored. Scripted GET /go/call stays 302 to /signin. Bug 45 stays open. FedM8 is not part of this.

Live 2026-10-04: GET https://executivenailsuite.com/signin?next=%2Fdesk returns 303 to /login?next=%2Fdesk. HEAD /sign-in?x=1 returns 303 to /login?x=1. GET /signin/ returns 303 to /login. GET /sign-up?x=1 returns 303 to /signup?x=1. HEAD /account returns 303 to /login. GET /account/?x=1 returns 303 to /login?x=1. GET /login, /signup, /forgot, and /reset stay 200. The login form next value for /desk is /desk. GET /login/extra stays 303 to /login?next=%2Flogin%2Fextra. POST /signin stays 303 to /login?next=%2Fsignin and is not a form. POST /login without a body stays 400. www.executivenailsuite.com/signin?next=1 returns 301 to the apex path, then 303 to /login?next=1. test.executivenailsuite.com/signin?next=%2Fdesk returns 303 to /login?next=%2Fdesk. executivenailsuite-test.up.railway.app/sign-in?x=1 returns 303 to /login?x=1. Merged PR https://github.com/jbnx/executivenailsuite/pull/16 as 67563a9. CI test passed. node --test passed (106). Railway project robust-consideration service executivenailsuite production deploy 3c6890ac SUCCESS and test deploy 97c80cc9 SUCCESS. Footer still says A JBNX product and links to https://jbnx.io. No auth.jbnx.io and no JBNX email promise. Bug 1 stays open. GET /api/insights counts stayed empty. Bot POST /collect returned ignored. Scripted GET /go/call?to=0000000000&place=verify returned 303 to tel:+0000000000 and calls stayed 0. FedM8 is not part of this.

Live 2026-10-04: GET https://nguy.in/signin?next=%2Fcredits returns 302 to https://nguy.in/login/?next=%2Fcredits. HEAD /signin?x=1 returns 302 to /login/?x=1. GET /signin/ returns 302 to /login/. GET /sign-in?x=1 returns 302 to /login/?x=1. GET /signup, /sign-up?x=1, /account, and /reset return 302 to /login/ and keep the query. GET /forgot?x=1 returns 302 to /login/?x=1. GET /login/extra stays 404. POST /login stays 405. POST /signin stays 405. GET /login still returns 301 to /login/, and that page stays 200 titled Sign in. GET / stays 200. www.nguy.in/signin?x=1 returns 301 to https://nguy.in/signin?x=1, then 302 to /login/?x=1. www.nguy.in/forgot?x=1 follows the same way to /login/?x=1. Cloudflare zone nguy.in ruleset 0101f17f96b64e26bb3a883b0ddfec20 rule nguy_signin_login (c07331a808804c17a53053caf7e24d5d). The four apex address records are proxied so the rule can run. www stays a DNS-only CNAME to GitHub Pages. The login page still does not name auth.jbnx.io and does not promise JBNX email. Bug 13 stays open. GET /insights/ returns 200. Page views stayed 2, visitors stayed 2, unique people stayed 2, finished stayed 0. Bot POST /collect returned ignored. Scripted GET /go/call?to=0000000000&place=verify still 301s to /go/call/ and keeps the query. GET /privacy/, /terms/, and /app/ stay 200. FedM8 is not part of this.

Live 2026-10-04: llm.jbnx.com is a custom domain on the litellm production service. Certificate CN is llm.jbnx.com. DNS-only CNAME is 62pf1h25.up.railway.app. llm.jbnx.io stayed on its own target. GET / returns 200 on both names. GET /v1/models returns 401 on both names when no key is sent. Gateway model names were not changed. FedM8 is not part of this.

Live 2026-10-04: app.jbnx.io is a custom domain on the jbnx.io production service, target port 8080, certificate valid for app.jbnx.io. DNS-only CNAME is qp9j7lu7.up.railway.app, same service as www.jbnx.io, not a different origin. GET / returns 200 titled JBNX. GET /login?next=1 returns 302 to /support?next=1. POST /login stays 405. GET /insights returns 200 titled Insights · app.jbnx.io. Finished stayed 0, unique people stayed 13, reached stayed 33, call taps stayed 0. Bot POST /collect returned ignored. Scripted GET /go/call?to=0000000000&place=verify returned 302 to tel:+0000000000 and calls stayed 0. No auth.jbnx.io promise. FedM8 is not part of this.

Live 2026-10-04: jbnx.net, www.jbnx.net, jbnx.org, and www.jbnx.org now resolve. Cloudflare proxied placeholder records plus a dynamic redirect 301 to https://www.jbnx.io and keep the path and query. HEAD https://jbnx.net/foo/bar?x=1&y=2 returns 301 to https://www.jbnx.io/foo/bar?x=1&y=2. HEAD https://www.jbnx.org/login?next=%2Fbugs returns 301 to https://www.jbnx.io/login?next=%2Fbugs. GET https://jbnx.net/login?next=1 and GET https://jbnx.org/login?next=1 do the same. security.txt stays 403, matching jbnx.com. No second site. No mail records added. FedM8 is not part of this.

Live 2026-10-04: GET https://jev.jbnx.io/login?next=%2Fcredits returns 302 to https://jev.jbnx.io/?next=%2Fcredits. HEAD /login?x=1 returns 302 to /?x=1. GET /signin/ returns 302 to /. GET /sign-in?x=1 returns 302 to /?x=1. GET /signup, /sign-up, /account, and /reset return 302 to /. GET /forgot?x=1 returns 302 to /?x=1. GET /login/extra stays 404. POST /login stays 404. GET /pricing stays 404 because this page has no prices. GET / returns 200 titled Jev. The bar links to https://jbnx.io/. The page does not name auth.jbnx.io and does not promise JBNX email. Cloudflare zone jbnx.io ruleset e2994283d32f4514b1535829a6701f2d rule jev_signin_home (dd33a02ee00645bfb2349309b6c12e7e). GET /healthz returns ok. GET /insights returns 200. Visitors stayed 57 and page views stayed 58. Bot POST /collect returned ignored. Scripted GET /go/call?to=0000000000&place=verify returned 302 to tel:+0000000000 and the call count stayed unset. FedM8 is not part of this.

Live 2026-10-04: the test marketing host was still on branch ship-it-inbox at commit 6f81954 from 2026-09-11. That branch was 0 commits ahead of main and 126 behind, so it had nothing of its own left. GET https://test.jbnx.io/login, /signin, /account, and /pricing were Flask 404 Not Found. Production already redirected those paths. Fast-forwarded ship-it-inbox to main 13657b5. Test deploy f8ea62ca SUCCESS. Production deploy stayed 2a9c194d. GET https://test.jbnx.io/login?next=1 returns 302 to /support?next=1. HEAD /login?x=1 returns 302 to /support?x=1. GET /signin/ returns 302 to /support. GET /sign-in?x=1 returns 302 to /support?x=1. GET /signup returns 302 to /support?signup=1. GET /sign-up?x=1 returns 302 to /support?x=1&signup=1. GET /account, /forgot?x=1, and /reset return 302 to /support and keep the query. GET /pricing?plan=retainer returns 301 to /prices?plan=retainer. HEAD /pricing/ returns 301 to /prices. GET https://jbnxio-test.up.railway.app/account?x=1 returns 302 to /support?x=1. GET /login/extra stays 404. POST /login stays 405. GET https://www.jbnx.io/login?next=1 still returns 302 to /support?next=1. GET /insights returns 200. After the checks, page views stayed 71, visitors stayed 65, and calls stayed 0. Bot POST /collect returned ignored. Scripted GET /go/call?to=0000000000&place=verify returned 302 to tel:+0000000000 and the call count stayed 0. The test host still follows ship-it-inbox, which now matches main. The next main commit will not update the test host until that branch moves again. Do not force it backward. Password reset mail stays bug 2. FedM8 is not part of this.

Live 2026-10-04: the test book service is a separate Railway environment from production. It was still on branch agent/openai-tensuite-c097/audit-fixes, last deployed 2026-09-10. test.app.tensuite.net does not start with app., so both test hosts served the booking site and typed sign-in names were the 404 page. GET https://test.book.tensuite.net/login?next=%2Fcredits returns 302 to https://test.app.tensuite.net/login?next=%2Fcredits. GET /signin/ returns 302 to https://test.app.tensuite.net/login. GET /sign-in?x=1 returns 302 to https://test.app.tensuite.net/login?x=1. GET /signup, /sign-up, /account, and /reset return 302 to https://test.app.tensuite.net/login. GET /forgot?x=1 returns 302 to https://test.app.tensuite.net/login?x=1. HEAD /login?x=1 returns 302 to https://test.app.tensuite.net/login?x=1. GET https://book-test.up.railway.app/account?x=1 returns 302 to https://test.app.tensuite.net/login?x=1. GET /login/extra stays 404. POST /login stays 404. GET https://test.app.tensuite.net/login?next=%2Fcredits returns 200 titled Suite. GET /signin, /sign-in, /signup, /account, /forgot, and /reset return 200 titled Suite. GET /login/extra returns 200 titled Suite, the same as https://app.tensuite.net/login/extra. GET https://test.app.tensuite.net/ now returns 200 titled Suite. GET https://test.book.tensuite.net/ stays 200 titled Book. Merged PR https://github.com/jbnx/tensuite/pull/87 as 3b7fc95 onto the test branch. Booking tests 37222252631 and 37222255114 passed. gitleaks 37222255146 passed. node --test test/signin-alias.test.js passed (2). Railway project tensuite service book test deploy 896c9746 SUCCESS. Production deploy stayed 0c21353f. GET https://book.tensuite.net/login?next=1 still returns 302 to https://app.tensuite.net/login?next=1. GET https://app.tensuite.net/login stays 200. GET /api/insights on the test book stayed reached 1, page views 0, calls 0. The test app stayed reached 20, page views 0, calls 0. Bot POST /collect returned 204. Scripted GET /go/call?to=0000000000&place=verify returned 302 to tel:+10000000000 and the call count stayed 0. No auth.jbnx.io promise. Bug 9 stays open. FedM8 is not part of this.

Live 2026-10-04: GET https://tensuite.net/login?next=%2Fcredits returns 302 to https://app.tensuite.net/login?next=%2Fcredits. GET /signin/ returns 302 to https://app.tensuite.net/login. GET /sign-in?x=1 returns 302 to https://app.tensuite.net/login?x=1. GET /signup, /sign-up, /account, and /reset return 302 to https://app.tensuite.net/login. GET /forgot?x=1 returns 302 to https://app.tensuite.net/login?x=1. HEAD /login?x=1 returns 302 to https://app.tensuite.net/login?x=1. GET https://www.tensuite.net/login?next=1 returns 302 to https://app.tensuite.net/login?next=1. HEAD https://www.tensuite.net/sign-in?x=1 returns 302 to https://app.tensuite.net/login?x=1. GET /login/extra stays 404. POST /login stays 405. Cloudflare ruleset 91426b77784d466b9e8348ce370f0c5e phase http_request_dynamic_redirect rule tensuite_signin_app. GET https://book.tensuite.net/login?next=%2Fcredits returns 302 to https://app.tensuite.net/login?next=%2Fcredits. GET /signin/ returns 302 to https://app.tensuite.net/login. GET /sign-in?x=1 returns 302 to https://app.tensuite.net/login?x=1. GET /signup, /sign-up, /account, and /reset return 302 to https://app.tensuite.net/login. GET /forgot?x=1 returns 302 to https://app.tensuite.net/login?x=1. HEAD /login?x=1 returns 302 to https://app.tensuite.net/login?x=1. GET /login/extra stays 404. POST /login stays 404. GET /app stays 200. GET https://app.tensuite.net/login and /forgot stay 200. Merged PR https://github.com/jbnx/tensuite/pull/86 as 44f46fd on main. Booking tests 37214842977: the new sign-in tests passed. The job still fails 8 tests that already fail on main (519 pass / 8 fail on 37155187990; this run 522 pass / 8 fail). gitleaks passed. Railway project tensuite service book deploy 0c21353f SUCCESS. GET /api/insights on book stayed reached 75, page views 0, calls 0. App stayed reached 87, page views 6, calls 0. Bot POST /collect returned 204 and did not move those counts. Scripted GET /go/call?to=0000000000&place=verify returned 302 to tel:+10000000000 on book, app, and tensuite.net, and the call count stayed 0. Sign-in is still the salon app, not auth.jbnx.io. No JBNX email promise. Bug 9 stays open. FedM8 is not part of this.

Live 2026-10-04: GET https://www.scytherdeck.com/login?next=%2Fshop returns 302 to /?next=%2Fshop. GET /signin, /sign-in, /signup, /sign-up, /account, and /reset return 302 to /. GET /forgot/ returns 302 to /. HEAD /sign-in?x=1 returns 302 to /?x=1. GET https://scytherdeck.com/forgot?x=1 returns 302 to https://www.scytherdeck.com/?x=1. GET /login/extra stays 404. POST /login stays 405. The footer still says A JBNX shop and links to https://jbnx.io. The page does not name auth.jbnx.io and does not promise JBNX email. Cloudflare dynamic redirect rule hub_signin_home. Merged PR https://github.com/jbnx/scytherdeck/pull/6 as 30d890b on main. Pages deploy 37210904203 succeeded. security-scan 37210904159 succeeded. portfolio.claim_project still has no scytherdeck row. GET /insights/ returns 200. Visitors stayed 0. Bot POST /collect returned ignored. Scripted GET /go/call?to=0000000000&place=verify returned 302 to tel:+0000000000 and the call count stayed 0. FedM8 is not part of this.

Live 2026-10-04: GET https://localfave.org/login?next=%2Fstack returns 302 to /?next=%2Fstack. GET /signin/ returns 302 to /. GET /sign-in?x=1 returns 302 to /?x=1. GET /signup, /sign-up, /account, and /reset return 302 to /. GET /forgot?x=1 returns 302 to /?x=1. HEAD /login?x=1 returns 302 to /?x=1. GET /login/extra stays 404. POST /login stays 405. GET https://www.localfave.org/login?next=1 returns 301 to https://localfave.org/login?next=1, and that path 302s home. GET https://vivanessa.com/login, https://zensoma.localfave.org/login, https://tetris.localfave.org/login, and https://marcobros.net/login stay 404. GET https://mahjong.localfave.org/login?next=%2Fcredits stays 302 to /?next=%2Fcredits. The homepage still names JBNX and hello@jbnx.io and does not name auth.jbnx.io. Merged PR https://github.com/jbnx/localfave/pull/60 as 98aef3e on main. GitHub Actions deploy 37210887913 succeeded, including the live host checks. npm test passed (116). GET /insights returns 200. After the checks, visitors stayed 241 and page views stayed 249. Bot POST /collect returned ignored. Scripted GET /go/call?to=0000000000&place=verify returned 302 to tel:+10000000000 and the call count stayed 0. FedM8 is not part of this.

Live 2026-10-04: GET https://wieldlings.com/login?next=%2Fplay returns 302 to /?next=%2Fplay. GET /signin/ returns 302 to /. GET /sign-in?x=1 returns 302 to /?x=1. GET /signup, /sign-up, /account, and /reset return 302 to /. GET /forgot?x=1 returns 302 to /?x=1. HEAD /login?x=1 returns 302 to /?x=1. GET /login/extra stays 404 text Not found. POST /login stays 405. GET https://www.wieldlings.com/login?next=1 returns 302 to /?next=1. GET https://wieldling.com/sign-in?x=1 returns 302 to /?x=1. GET / returns 200 and the welcome footer still says A JBNX game. The page does not name auth.jbnx.io and does not promise JBNX email. Merged PR https://github.com/jbnx/wieldlings/pull/31 as 035c14a on main. CI run 37207115758 test passed, plus build-pause, cloud, expedition, performance, stress, and windows. Railway project project-jbnx service wieldlings deploy 0b6c4bfe SUCCESS. GET /insights returns 200. A scripted browser-style GET / during this check moved wieldlings.com visitors 1425 to 1426 and page views 1735 to 1736. Bot POST /collect returned ignored. Scripted GET /go/call?to=0000000000&place=verify returned 302 to / and game interface actions stayed 24. FedM8 is not part of this.

Confirmed 2026-10-04 during the 8 o'clock America/Chicago hour. billing.digest_sends has one row for 2026-10-04, recorded at 08:14 America/Chicago. Bill inserts that row only in that hour and deletes it if the mail call fails, so the remaining row means the morning summary for that date was accepted by the mail sender. It does not send at other hours. The board stays at https://projects.jbnx.io/bugs and https://bill.jbnx.io/bugs. FedM8 is not part of this.

Live 2026-10-04: GET https://pdf.jbnx.io/login?next=%2Fbugs returns 302 to /?next=%2Fbugs. GET /signin/ returns 302 to /. GET /sign-in?x=1 returns 302 to /?x=1. GET /signup, /sign-up, /account, and /reset return 302 to /. GET /forgot returns 302 to /. HEAD /sign-in?x=1 returns 302 to /?x=1. GET /login/extra stays 404 text not found. POST /login stays 405 method not allowed. GET / returns 200 and the footer says A JBNX product, linking to https://jbnx.io. The page does not name auth.jbnx.io and does not promise JBNX email. GET /api/health returns 200. Merged PR https://github.com/jbnx/jbnx.io/pull/155 as 7f65b24 onto branch cursor/pdf-jbnx-documenso-5e44, which is the branch Railway builds. The pdf app is not on main. Railway deploy 2a61fbe2 SUCCESS. npm test in pdf/ passed (10). quality-gates semgrep failed on pre-existing files outside pdf/ (agreement.py, insights_host.py, scripts/db_health.py, seo_listings.py, templates/games.html, templates/studio.html). GET /insights returns 200. Visitors stayed 0. Bot POST /collect returned ignored. Scripted GET /go/call?to=0000000000&place=verify returned 302 to tel:+0000000000 and the call count stayed 0. There is no portfolio slug pdf-jbnx, so the write claim was lp-jbnx. FedM8 is not part of this.

Live 2026-10-04: GET https://dayz.localfave.org/login returns 302 to /. GET /login?next=1 returns 302 to /?next=1. GET /signin/ returns 302 to /. GET /forgot?x=1 returns 302 to /?x=1. HEAD /sign-in?x=1 returns 302 to /?x=1. GET /signup, /account, and /reset return 302 to /. GET /login/extra stays 404 text not found. POST /login stays 405 method not allowed. GET /healthz returns 200 ok. The homepage still says JBNX and does not name auth.jbnx.io. Do not promise JBNX email. Merged PR https://github.com/jbnx/CountingDayZ/pull/1 as 32baeb9 on main. CI runs 37200654870 and 37200856237 succeeded, including Chromium gameplay gates. Railway deploy f591b502 SUCCESS. GET /insights returns 200. In-memory counters reset on this deploy, which the server documents. Bot POST /collect returned ignored. GET /go/call?to=0000000000&place=verify stays 404 not found. countingdayz.com DNS stays bug 15. FedM8 is not part of this.

Live 2026-10-04: GET https://mahjong.localfave.org/login returns 302 to /. GET /login?next=%2Fcredits returns 302 to /?next=%2Fcredits. GET /signin/ returns 302 to /. GET /sign-in?x=1 returns 302 to /?x=1. GET /signup, /sign-up, /account, and /reset return 302 to /. GET /forgot?x=1 returns 302 to /?x=1. HEAD /login?x=1 returns 302 to /?x=1. GET /login/extra stays 404 JSON. POST /login without the game origin stays 403. POST /login with the game origin stays 401 Please log in. POST /api/auth/login stays 403 until the request comes from the game. GET / returns 200 and the Log in button is still on the homepage. The footer already links to https://jbnx.io. Mail sender is still Mahjong at localfave.org, so this does not promise JBNX email. Merged PR https://github.com/jbnx/mahjong/pull/2 as 50371bc on main. CI runs 37200314014 and 37200385004 succeeded. Railway deploy 6280d32a SUCCESS. Live /healthz commit is 50371bc. node --test passed (279) and npm run build passed on Node 24. GET /insights returns 200. Visits stayed 47 across a scripted GET /go/call?to=0000000000&place=verify, which 302s to tel:+10000000000. Bot POST /collect returned ignored. FedM8 is not part of this.

Live 2026-10-04: GET https://projects.jbnx.io/login?next=%2Fbugs returns 302 to /?next=%2Fbugs. GET /signin/ returns 302 to /. GET /sign-in?x=1 returns 302 to /?x=1. HEAD /account returns 302 to /. GET /forgot?x=1 returns 302 to /?x=1. POST /login returns 405. GET / returns 200. POST /api/1099/sign-in still returns 200 for this actor. https://test.projects.jbnx.io/login?next=%2Fbugs returns 302 to /?next=%2Fbugs. hi.jbnx.io/login still 302s to https://projects.jbnx.io/. Merged PR https://github.com/jbnx/jbnx.io/pull/153 as 60b64e9. That image failed health checks (deploy 48ee758d) because the Dockerfile did not copy desk-signin.mjs. Merged PR https://github.com/jbnx/jbnx.io/pull/154 as 13657b5. Railway production deploy ebbf76a8 SUCCESS and test deploy aaee94a7 SUCCESS. owner-boundaries and pytest passed. quality-gates semgrep still fails on jev_lead.py, the same failure main had before this change. GET /insights returns 200. Finished outcomes stayed 0. Bot POST /collect returned ignored. Scripted GET /go/call?to=0000000000&place=verify returned 302 and the call count stayed 0. FedM8 is not part of this.

Live 2026-10-04: GET https://www.jbnx.io/login?next=%2Fwork returns 302 to /support?next=%2Fwork. GET /signup returns 302 to /support?signup=1. GET /sign-up?x=1 returns 302 to /support?x=1&signup=1. GET /forgot?x=1 returns 302 to /support?x=1. GET /signin/, /sign-in, /account, and /reset return 302 to /support. HEAD /login returns 302 to /support. POST /login returns 405. https://jbnx.io/login returns 301 to https://www.jbnx.io/login, then 302 to /support. https://games.jbnx.io/login returns 302 to /support. https://demo.jbnx.io/signup returns 302 to /support?signup=1. GET /support?signup=1 returns 200. GET /insights returns 200. Merged PR https://github.com/jbnx/jbnx.io/pull/152 as 6f0d431. Railway deploy 09361ce3 SUCCESS. pytest (jbnx.io site) passed. quality-gates semgrep still fails on jev_lead.py, the same failure main had before this change. Password reset mail stays bug 2. FedM8 is not part of this.

Live 2026-10-04: GET https://prelysium.com/login returns 302 to /?mode=signin. GET /login?next=%2Fcredits returns 302 to /?next=%2Fcredits&mode=signin. GET https://www.prelysium.com/signin/ returns 302 to /?mode=signin. GET /sign-in returns 302 to /?mode=signin. GET /signup and /sign-up return 302 to /?mode=signup. GET /account returns 302 to /?mode=signin. GET /forgot?x=1 returns 302 to /?x=1&mode=reset. GET /reset returns 302 to /?mode=reset. HEAD /login returns 302 to /?mode=signin. POST /login returns 405. GET https://docs.prelysium.com/login returns 302 to https://prelysium.com/?mode=signin. GET https://docs.prelysium.com/forgot returns 302 to https://prelysium.com/?mode=reset. GET /?mode=signup returns 200 and the page still says it is a JBNX game and names auth.jbnx.io. Live /play/account.mjs?v=auth-5 reads mode signup, reset, and signin. Merged PR https://github.com/jbnx/prelysium/pull/9 as d1a6a92 on main. Railway deploy 1083b5d8 SUCCESS. node --test auth-alias and server-domain passed. GET /insights returns 200. Finished outcomes stayed none defined. Bot POST /collect returned ignored. Scripted GET /go/call returned 404 because no call target is configured. FedM8 is not part of this.

Live 2026-10-04: GET https://dreamt.win/signin returns 302 to /login. GET /sign-in?next=%2Fcredits returns 302 to /login?next=%2Fcredits. GET /sign-up returns 302 to /signup. GET /privacy?x=1 returns 302 to /legal/privacy?x=1. GET /terms returns 302 to /legal/terms. GET /account returns 302 to /login. GET /forgot?x=1 returns 302 to /login?x=1&mode=reset. GET /reset returns 302 to /login?mode=reset. GET /signin?x=1 returns 302 to /login?x=1. HEAD /signin returns 302 to /login. POST /signin still returns 404 JSON. GET /login, /signup, /legal/privacy, and /legal/terms return 200 HTML. https://www.workt.win/signin?x=1 returns 301 to https://dreamt.win/signin?x=1. Live /assets/console.js opens the reset form when mode=reset. Merged PR https://github.com/jbnx/workt.win/pull/32 as c029d5e on main. CI run 37187565453 succeeded. Railway deploy f47ac4da SUCCESS. GET /insights returns 200 and finished outcomes stayed at 3. Bot POST /collect returned ignored. Scripted GET /go/call?to=0000000000&place=verify returned 404 because no call target is configured, and the insights count did not change. FedM8 is not part of this.

Live 2026-10-04: GET https://bill.jbnx.io/login returns 302 to /. GET /login?next=%2Fbugs returns 302 to /?next=%2Fbugs. GET /signin and /forgot return 302 to /. HEAD /sign-in returns 302 to /. GET /account returns 302 to /. GET /reset/abc still returns 200 HTML. POST /api/login with an empty body returns 400 email and password required. GET https://hub.jbnx.io/login returns 302 to /admin. https://test.bill.jbnx.io/login returns 302 to /. /healthz and /bugs and / return 200. GET /insights returns 200. Bot POST /collect returned ignored. Merged PR https://github.com/jbnx/jbnx-bill/pull/16 as 284a314. Railway deploys 4a92178f and 9ccf3b39 SUCCESS. node --test passed (19). FedM8 is not part of this.

Live 2026-10-04: GET https://www.jbnx.io/pricing returns 301 to /prices. GET /pricing/?plan=retainer returns 301 to /prices?plan=retainer. GET /pricing/ returns 301 to /prices. GET /prices returns 200. https://jbnx.io/pricing still 301s to https://www.jbnx.io/pricing, then that page redirects to /prices. Commits 52c6ab7 and 32fef67 on main. Railway deploy 91f15d39 SUCCESS. pytest (jbnx.io site) succeeded. quality-gates semgrep still fails on jev_lead.py, the same failure main had before this change. Bot POST /collect returned ignored. GET /insights returned 200. Scripted GET /go/call?to=0000000000&place=verify returned 302 and did not count a user call. FedM8 is not part of this.

Live 2026-10-04: https://www.scytherdeck.com/ and /insights/ return 200. The footer says A JBNX shop and links to https://jbnx.io. Hero and footer mottos point at CipherDeck, not at this site. No auth.jbnx.io promise. Merged PR https://github.com/jbnx/scytherdeck/pull/5 as fddb111 on main. GitHub Pages deploy 37172573619 succeeded. Bot POST /collect returned ignored. portfolio.claim_project still has no scytherdeck row. FedM8 is not part of this.

https://wieldlings.com, https://www.wieldlings.com, and https://wieldling.com return 200 and the HTML does not mention JBNX. Confirmed 2026-10-04: those names are custom domains on Railway project project-jbnx, service wieldlings, production. Source is jbnx/wieldlings branch main. The separate Railway project named wieldlings is not the live host. Add one line on the welcome footer in index.html: it is a JBNX game. Do not promise JBNX email until sign-in really uses auth.jbnx.io. FedM8 is not part of this.

Live check 2026-10-03: www.workt.win and www.dreamt.win had no DNS record, so a browser could not open them. The apex names already served Dream Twin (workt.win returns 308 to https://dreamt.win/). Added proxied CNAMEs and a Cloudflare redirect. After the change, GET https://www.workt.win/signin?x=1 returns 301 to https://dreamt.win/signin?x=1, and GET https://www.dreamt.win/privacy?x=1 returns 301 to https://dreamt.win/privacy?x=1. https://dreamt.win/ still returns 200. FedM8 is not part of this.

The game already signs in through auth.jbnx.io. The public homepage HTML does not mention JBNX, so a visitor is not told to expect JBNX email and the JBNX sign-in URL.

https://www.jbnx.io/hack/ now returns 301 to /hack, and that page is the desk.

Live at https://projects.jbnx.io/bugs and https://bill.jbnx.io/bugs. Open rows, then working, then closed. Sort controls change the order.

The sign-in API at /auth/v1 responds. Opening https://auth.jbnx.io/ returns the text Not found, so a person who follows the host does not see that this is JBNX sign-in. Other paths must stay hidden. Live check 2026-10-03: GET / returns the JBNX sign-in note. /auth/v1/health still answers. Other paths stay Not found.