From 8d066617afb19590b5d63153f0758ff04df34c6d Mon Sep 17 00:00:00 2001
From: tornidomaroc-web <tornido.maroc@gmail.com>
Date: Thu, 23 Jul 2026 14:10:23 +0100
Subject: [PATCH] docs: close register #45 (verified + rotated) and log design
 items #46-#49
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Convert #45 in place (🔴→✅) with the measured evidence chain: production
/_/ingestion/health went 200 (no redirect) → 307 → 404 after PR #67 merged;
config removal alone sufficed, no dashboard deletion. INGESTION_TOKEN rotated
Railway-first then Vercel, verified by a real production upload reaching READY.

Log four product-design items raised by Abo Jad as registers #46-#49 (all
OPEN): settings-page premium polish, per-material actions, landing-page nav
menu, and an animated terminal demo (with the #20 "Ready in 0.4s" correction).

Append-only §7: one new block (18→19), no landed entry touched. Refresh the
three header fields. Docs-only; Phase 7 stays ⬜, register #17 stays OPEN.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
---
 docs/PROGRESS.md | 14 +++++++++++---
 1 file changed, 11 insertions(+), 3 deletions(-)

diff --git a/docs/PROGRESS.md b/docs/PROGRESS.md
index 3257c18..9c3e132 100644
--- a/docs/PROGRESS.md
+++ b/docs/PROGRESS.md
@@ -6,8 +6,8 @@ file at the **end of every step** so we never jump ahead on a deferred item or
 skip a main phase.
 
 - **Last updated:** 2026-07-23 - see [PROGRESS §7 Changelog](#7-changelog). This field carries the date only; the narrative lives in §7.
-- **Active branch:** `fix/remove-duplicate-vercel-ingestion-service` - this PR removes the vestigial `experimentalServices.ingestion` sub-key from `vercel.json` that was serving a LIVE DUPLICATE of the ingestion service at `/_/ingestion` (confirmed 200 on `/health`), and logs the incident as register **#45**. Touches **only** `vercel.json` and this file (the #45 row, this §7 block, and these three header fields). **No code, no other register row, no §1-§6 content, no B5b row, `PIVOT_PLAN.md` untouched.** Register **#45** stays OPEN until production `/_/ingestion/health` is confirmed 404 AND `INGESTION_TOKEN` is rotated.
-- **Main tip:** `2d0856d` (PR **#66** merge - the changelog migration off the line-8 header field into the append-only §7, all 17 entry bodies byte-identical), on top of `c119f6b` (PR **#65** - register #17 WIP preservation snapshot) and `0a0557f` (PR **#64** - the gate-integrity arc log). Both required checks green on `2d0856d` (`tsc`, `db-types`).
+- **Active branch:** `docs/close-45-and-log-design-items` - this docs-only PR CLOSES register **#45** (the live duplicate Vercel ingestion service is gone and `INGESTION_TOKEN` was rotated) by converting its row in place (🔴→✅, original lead preserved after "Was:"), and logs four new product-design items as registers **#46-#49** (settings-page premium polish, per-material actions, landing-page nav menu, animated terminal demo). Touches **only** this file (the #45 row, four new register rows, one new §7 block, and these three header fields). **No code, no other register row's substance, no §1-§6 phase content, no B5b row, `PIVOT_PLAN.md` untouched.** Register **#17** stays OPEN.
+- **Main tip:** `ecb1ed5` (PR **#67** merge - the duplicate-ingestion-service removal: the `experimentalServices.ingestion` sub-key dropped from `vercel.json`, keeping `frontend`), on top of `2d0856d` (PR **#66** - the §7 changelog migration off the line-8 header field, all 17 entry bodies byte-identical) and `c119f6b` (PR **#65** - register #17 WIP preservation snapshot). Both required checks green on `ecb1ed5` (`tsc`, `db-types`).
 
 > ✅ **RESOLVED 2026-07-04 — Supabase project back online (register #21).** The
 > project **auto-paused** (free-tier inactivity) and then hit Supabase's free
@@ -141,7 +141,11 @@ project memory, and per-step review debates. "Where" is the target phase/trigger
 | 42 🔎 **SURFACED 2026-07-17 (P4 wiring session) — the class behind #3 stays open. `file_type` sub-class ROOT-closed 2026-07-18 (PR #56); `language` sub-class app-closed 2026-07-18 (PR #58); `Tier` inline copy deduped 2026-07-20 (PR #60); CLASS STILL OPEN — `Message.role` primary.** | **Nothing prevents the NEXT drifted hand-written type.** `db-types` proves `database.types.ts` matches the migrations; `tsc` (post-`<Database>`) proves app **code** matches those generated types. **Neither checks that the hand-written types in `src/types/index.ts` match the generated `Row` types.** Under `strict:false` (see #41) a wider DB row assigns cleanly to a narrower/wrong hand-written interface, so a stale union or a missing column drifts **silently** — exactly how #3's `file_type` was wrong on `main` for months, and why `Quiz` was missing `lang`. Adding `lang` to `Quiz` (PR #53) closed **today's instance**; the **class stays open.** **UPDATE 2026-07-18 (PR #56, merge `77ffdd3`) — the MOST HARMFUL sub-class is now closed AT ITS ROOT for `file_type`, not merely corrected.** The sub-class is: **a narrowed, app-enforced string column whose union can rot apart from a SECOND declaration** (the write-path validator). PR #56 hoisted `ALLOWED_FILE_TYPES` (an `as const` array) into `src/types/index.ts` as the SINGLE SOURCE OF TRUTH; `Document.file_type = FileType | null` DERIVES from it, and the ingest route's upload validator IMPORTS the same array (MIME map typed `Record<FileType, string[]>`; runtime allowlist tests membership against that array) — so the compile-time domain and the write-path allowlist are LITERALLY the same declaration, and a drift is a `tsc` error instead of the silent 415/type-lie that made #3's `file_type` wrong for months. **Type-level dedup only — ingestion behaviour UNCHANGED** (same accepted set, same 415 + message, same MIME cross-check, same `ext` written). **#42 STAYS OPEN — this is ONE column at its root, NOT the class.** The same rot-capable second declaration still exists for **`KnowledgeBase.language`** (`useState<'ar'|'en'|'both'>` + a lying `as 'ar'|'en'|'both'` cast on the `<select>`'s `onChange` in `dashboard/knowledge/new/page.tsx` — an unlisted `<option>` would write a value the type forbids) and **`Message.role`** (`'user'|'assistant'` re-declared inline in `agent/route.ts`, `ChatBox.tsx`, `MessageBubble.tsx` + two `as 'user'|'assistant'` casts); the generic closures below (derive from the generated `Row` types, or a conformance check) are still **unbuilt**, and #41's null-blindness sub-class is untouched. **EROSION-SURFACE RECORD (stated here for the FIRST time — a correction of the WORKING figure, since this register never carried an erosion count): the true count is 1 pre-existing `as any`, NOT 0** — `src/components/upload/DropZone.tsx:50`, from the INITIAL-MVP commit `2d0f592` (2026-04-12), untouched by every hardening PR; `@ts-ignore`/`@ts-expect-error` = **0**. **PR #56's own delta = 0/0/0** (`as const` is a const assertion, not a cast). **UPDATE 2026-07-18 (PR #58, merge `da57070`) — the `KnowledgeBase.language` sub-class is now closed AT THE APP LEVEL, the structural parallel to #56.** `src/types/index.ts` exports `KB_LANGUAGES` (`as const`) as the SINGLE SOURCE OF TRUTH; `KnowledgeBase.language = KbLanguage` derives from it; the KB-create form (`dashboard/knowledge/new/page.tsx`) imports the array, RENDERS the `<select>`'s `<option>` list from it (so the option values are no longer a fourth independent copy — the part a bare const hoist would have left drifting), and REPLACES the lying `as 'ar'|'en'|'both'` cast with an `isKbLanguage` guard mirroring the ingest route's `isAllowedFileType`; a `Record<KbLanguage, 'languageAr'|'languageEn'|'languageBoth'>` pins each member to its EXISTING i18n key (none invented, none dropped). **APP-ENFORCED ONLY — no DB CHECK, DB untouched:** `knowledge_bases.language` stays bare `text` with no CHECK (`001_initial_schema.sql`), so this makes the app's own declarations agree with each other; it does NOT make the database enforce the domain, and a row written outside the web app can still violate it. **Runtime behaviour UNCHANGED** (same three options `ar`/`en`/`both` in the same order, same values, same labels, same inserted value; the `<select>` can only emit its own option values, all in `KB_LANGUAGES`, so the guard always passes for real interaction). Erosion delta **−1 typed cast** (the lying `as` removed), **0 `as any` / 0 `@ts-ignore`** (`as const` is not a cast); the pre-existing DropZone `as any` (baseline 1) untouched; both checks green on `da57070`. **#42 STAYS OPEN. COMPLETE remaining surface after `file_type` (#56), `language` (#58), and `Tier` (#60) are all closed — verified: `Message.role` is now the LAST app-enforced inline union, and the rest of the surface is STRUCTURAL, not another inline copy: (a) `Message.role` — PRIMARY, the last unhoisted app-enforced union**: inline `'user'|'assistant'` at `agent/route.ts:116`, `ChatBox.tsx:11`, `MessageBubble.tsx:12`; two lying casts at `agent/route.ts:128` and `ChatBox.tsx:40`; two `role:string` widenings at `ChatBox.tsx:20` and `KBSelector.tsx:33` — its domain is externally PINNED by the Anthropic API, so the drift trigger is near-zero. **(b) the `Tier` inline copy — CLOSED 2026-07-20 (PR #60, merge `71e1c9d`)**: `rate-limit.ts:29`'s `Record<'free'|'pro', …>` key now imports the already-hoisted `Tier` from `@/types`, so the entitlement domain has ONE declaration — a pure type-source dedup (delta 0/0/0, no runtime change, both required checks green on `71e1c9d`). (Was: a one-line import dedup, weaker than `role` — no lying cast, `tsc` partially guards a `Record` key; the B2 entanglement was with `Profile.plan` the COLUMN, distinct from this surviving `Tier` entitlement type, so #60 was never B2-blocked.) **(c) STRUCTURAL sub-classes**: #41 (`strict:false` ⇒ `strictNullChecks` off, so a wrong non-null claim is invisible to `tsc`) and the generic closure (derive `src/types` from the generated `Row` types, or a conformance test) — both UNBUILT. **Verified NOT open app-enforced instances (do NOT reopen): `Document.status`** (DropZone's `UploadState = 'idle'|'uploading'|'processing'|'ready'|'error'` is a DIFFERENT domain — has `idle`/`uploading`, lacks `pending` — single-declaration, no mirror of `Document.status`); **`Conversation.platform`** (grep-empty — no second copy anywhere); **`Quiz.lang` and `StudyEventKind`** (DB-CHECK-backed — a different invariant kind, not app-enforced-only, so a TS const hoist cannot dedupe them). | The real closures — **deriving** these types from `Database['public']['Tables'][...]['Row']`, or a **conformance test** that fails when a hand-written type diverges — are unbuilt, and each is its own design choice (deriving changes how every hand-written type is authored). Out of scope for the wiring session. | **Later — its own step.** Either derive `src/types` from the generated `Row` types or add a conformance check. Related: **#3** (the instance just fixed), **#41** (why the drift is invisible to `tsc`). |
 | 43 ✅ **CLOSED 2026-07-21 (PR #63, merge `3378dd8`) — the gate's LAST unpinned dependency, and it redded `main` twice with no commit to the repo.** | **`supabase gen types` does not talk to Postgres itself — it shells out to `docker run public.ecr.aws/supabase/postgres-meta:v0.96.6`.** That reference is **compiled into the CLI binary** (verified: `grep -a` on the pinned 2.109.1 binary yields `postgres-meta:v0.96.6`), and it is a **MUTABLE TAG on a rate-limited anonymous registry** — the one dependency of `db-types` that sat **outside** `gen-db-types.sh`'s digest-pinning discipline, in a script whose own premise is that an unpinned toolchain *"turns any upstream release into a spontaneous red main, with no commit to this repo."* It fired on 2026-07-21: `main` at `d8c8fde` went red **twice** (runs `29835675126`, then again after a 17-minute cooldown) with `docker: toomanyrequests: Rate exceeded` / `error running container: exit 125`, while `tsc` stayed green and the merged change was provably innocent (the verify step passed, all 13 migrations applied, the failure was 26s later inside the CLI). **This was a PINNING hole, not merely a reliability one:** `db-types` is a `git diff --exit-code` gate, so a republished `v0.96.6` with a changed emitter is indistinguishable from schema drift. | Not deferred — surfaced and closed the same day, because a required check that reds on a third party's traffic trains people to re-run it (the exact anti-pattern `gen-db-types.sh` already argues against for its readiness probe: *"A gate that reds main on a coin flip is worse than no gate"*). The alternative of authenticating ECR or mirroring to GHCR was **rejected**: both keep a third-party registry in the hot path, and both would introduce a credential into a job whose stated property is that it *"never needs a Supabase token … cannot reach, read, or mutate production."* | **FIXED in `scripts/gen-db-types.sh`: `META_IMAGE` pinned by multi-arch INDEX digest `sha256:a84cc713…`, pre-pulled from Docker Hub, then `docker tag`-ed to the exact ECR reference before the CLI runs.** The digest is **byte-identical at Docker Hub and public.ecr.aws** (verified against both), so this is the SAME image over a registry that works — content addressing means docker verifies the bytes or fails the pull. **The retag is REQUIRED, not defensive:** a digest-only local copy under `docker.io/...` satisfies neither the registry, the repo path, nor the tag the CLI asks for, and `docker run`'s pull-if-missing would go straight back to ECR. **Deliberately in the SCRIPT, NOT `db-types.yml`** — per that workflow's own principle at `:57-60` (*"the generator is a script so that CI and a developer's machine run the exact same code path … a second place that only CI exercises … is where drift hides"*); relocating this into the workflow would silently un-fix local runs. Proven on the merged commit `3378dd8`: `toomanyrequests` count **0**, `Pulling from supabase/postgres-meta` count **0**, and `Unable to find image` fired **only** for `PG_IMAGE` — never for the ECR reference, i.e. the CLI never contacted ECR. **RESIDUAL, carried here rather than hidden behind the ✅ (the #38 precedent):** **(1)** Docker Hub is **also** anonymous-rate-limited per IP and GitHub runners share NAT pools — this job now makes **two** Hub pulls per run, so the same failure shape can return under a different registry name; today's evidence is that Hub works where ECR did not, which is not immunity. **(2)** The `v0.96.6` tag is **coupled to `SUPABASE_CLI_VERSION`**: bumping the CLI may change the compiled-in tag, leaving `META_TAG` naming an image the new CLI never asks for — the retag goes unused and the CLI **silently falls back to an ECR pull**. That degrades to flakiness, **never to a wrong result**, but it is invisible until the throttle hits, so **a CLI bump requires re-deriving the tag from the new binary** and updating both values. Related: **#44** (same class, still open). |
 | 44 🔎 **SURFACED 2026-07-21 (while closing #43) — same class, UNFIXED. No PR, no phase.** | **`npx --yes "supabase@$SUPABASE_CLI_VERSION"` fetches from the npm registry on every run with NO integrity pin** (`scripts/gen-db-types.sh`). It is a third-party fetch in the **hot path of a required check** — structurally the same shape as **#43**, which was just closed for the image side of the same problem: `db-types` pins Postgres by digest and now pins `postgres-meta` by digest, but the **generator binary itself** arrives over an unpinned network fetch. The version string is pinned (`2.109.1`), so this is weaker than #43's mutable-tag hole — npm versions are immutable once published — but the FETCH is still unpinned by integrity hash, and an npm outage or throttle reds `main` with no commit to the repo, exactly as ECR did. | **Not scoped, not scheduled, no phase assigned** — recorded the moment it was noticed so the class is not silently considered "handled" because #43 closed. Deliberately NOT folded into #43: that row is about an image pulled by a tool we invoke; this is about the tool itself, and the fixes differ (a lockfile/integrity pin or a vendored binary, versus a digest pre-pull). | **Later — its own decision.** Options not yet weighed: pin by integrity hash, vendor the CLI, or accept it explicitly in writing. Related: **#43** (the image half, closed), and `gen-db-types.sh`'s pinning rationale, which this fetch currently sits outside. |
-| 45 🔴 **OPEN — LIVE SECURITY SURFACE, found 2026-07-23 (while scoping B5b).** | **A live DUPLICATE of the ingestion service is being served by Vercel** at `/_/ingestion`, from the vestigial `experimentalServices.ingestion` block in `vercel.json` (`entrypoint: services/ingestion`). Confirmed live: `GET https://tryknowflow.com/_/ingestion/health` returns `200 {"ok":true,"embed_provider":"voyage",...}`. **CORRECTS an earlier misdiagnosis:** this is NOT stale April code — Vercel rebuilds `services/ingestion` from the deployed commit, so it runs the SAME current `main.py` as the real Railway service (`INGESTION_SERVICE_URL` = `knowflow-production.up.railway.app`). The danger is the DUPLICATE itself, not a code delta. **(a)** It is **token-shared**: `INGESTION_TOKEN` is a Vercel project env var the Next route already needs, so the same token that authorizes Next→Railway also opens this copy's `/convert` and `/embed` (`_check_auth` is a single-token equality). `VOYAGE_API_KEY` **is** set on Vercel (confirmed), so a token-holder can **burn Voyage embedding credits** and run arbitrary documents through MarkItDown here, **bypassing every Next-route guard** (auth, per-KB doc limit, `enforceLimit('upload')`, rate limits) — none of which live in the Python service. `/convert` here IS Vercel-edge-capped at 4.5 MB inbound (unlike Railway), which bounds but does not remove the abuse. **(b)** `/health` is **unauthenticated** (no `_check_auth`) and discloses embedding provider/model/dimension plus a liveness oracle. **(c)** `INGESTION_TOKEN` has been reachable on an unintended public endpoint and MUST be rotated. | Not deferred — **acted on immediately** as a live surface, ahead of the B5b scoping doc. A distinct incident from B5b (upload content hardening), NOT B5b progress: `PROGRESS.md` §1 B5b row and `PIVOT_PLAN.md:270` are deliberately untouched. | **Config fix in flight (this PR):** remove the `ingestion` sub-key from `vercel.json` `experimentalServices`, keeping `frontend`. **Mandatory sequencing (rotate LAST):** (1) merge the config fix; (2) confirm production `/_/ingestion/health` → **404** — and if it does NOT 404, **delete the service in the Vercel dashboard** (config removal may be necessary-but-insufficient if Vercel persists an already-built service); (3) THEN rotate `INGESTION_TOKEN` on **Railway first, then Vercel** as near-simultaneously as possible (a mismatch window 401s uploads until both match — an availability blip, not a security gap). **Rotate-last is deliberate:** rotating before teardown just re-exposes the fresh token on the still-live copy (shared env). Mandatory PREVIEW check before merge: frontend still serves + a real upload completes end-to-end via Railway, AND `<preview>/_/ingestion/health` → 404. Closes when production 404 + rotation are both confirmed. |
+| 45 ✅ **CLOSED 2026-07-23 (PR #67, merge `ecb1ed5`) — the duplicate Vercel ingestion service is gone and `INGESTION_TOKEN` was rotated.** Was: **OPEN — LIVE SECURITY SURFACE, found 2026-07-23 (while scoping B5b).** | **A live DUPLICATE of the ingestion service is being served by Vercel** at `/_/ingestion`, from the vestigial `experimentalServices.ingestion` block in `vercel.json` (`entrypoint: services/ingestion`). Confirmed live: `GET https://tryknowflow.com/_/ingestion/health` returns `200 {"ok":true,"embed_provider":"voyage",...}`. **CORRECTS an earlier misdiagnosis:** this is NOT stale April code — Vercel rebuilds `services/ingestion` from the deployed commit, so it runs the SAME current `main.py` as the real Railway service (`INGESTION_SERVICE_URL` = `knowflow-production.up.railway.app`). The danger is the DUPLICATE itself, not a code delta. **(a)** It is **token-shared**: `INGESTION_TOKEN` is a Vercel project env var the Next route already needs, so the same token that authorizes Next→Railway also opens this copy's `/convert` and `/embed` (`_check_auth` is a single-token equality). `VOYAGE_API_KEY` **is** set on Vercel (confirmed), so a token-holder can **burn Voyage embedding credits** and run arbitrary documents through MarkItDown here, **bypassing every Next-route guard** (auth, per-KB doc limit, `enforceLimit('upload')`, rate limits) — none of which live in the Python service. `/convert` here IS Vercel-edge-capped at 4.5 MB inbound (unlike Railway), which bounds but does not remove the abuse. **(b)** `/health` is **unauthenticated** (no `_check_auth`) and discloses embedding provider/model/dimension plus a liveness oracle. **(c)** `INGESTION_TOKEN` has been reachable on an unintended public endpoint and MUST be rotated. | Not deferred — **acted on immediately** as a live surface, ahead of the B5b scoping doc. A distinct incident from B5b (upload content hardening), NOT B5b progress: `PROGRESS.md` §1 B5b row and `PIVOT_PLAN.md:270` are deliberately untouched. | **Config fix in flight (this PR):** remove the `ingestion` sub-key from `vercel.json` `experimentalServices`, keeping `frontend`. **Mandatory sequencing (rotate LAST):** (1) merge the config fix; (2) confirm production `/_/ingestion/health` → **404** — and if it does NOT 404, **delete the service in the Vercel dashboard** (config removal may be necessary-but-insufficient if Vercel persists an already-built service); (3) THEN rotate `INGESTION_TOKEN` on **Railway first, then Vercel** as near-simultaneously as possible (a mismatch window 401s uploads until both match — an availability blip, not a security gap). **Rotate-last is deliberate:** rotating before teardown just re-exposes the fresh token on the still-live copy (shared env). Mandatory PREVIEW check before merge: frontend still serves + a real upload completes end-to-end via Railway, AND `<preview>/_/ingestion/health` → 404. Closes when production 404 + rotation are both confirmed. **CLOSED 2026-07-23 (PR #67, merge `ecb1ed5`) — evidence chain (measured):** before merge, `curl https://tryknowflow.com/_/ingestion/health` returned **200 with no redirect** (the duplicate served at the Vercel edge); after merge, the same curl returned **307 → `/ar/_/ingestion/health`**, and following the redirect returned **404** (Next's own page, not the service JSON) — proving nothing intercepts the path at the edge any more and that **config removal alone was sufficient** (no dashboard service deletion was needed). `INGESTION_TOKEN` was then **rotated Railway-first, then Vercel**, and verified by a **real production upload reaching READY**. Both required checks green on `ecb1ed5` (`tsc`, `db-types`). |
+| 46 🔎 **OPEN — product-design item, raised 2026-07-23 (Abo Jad design review). DESIGN-QUALITY, NOT A BUG.** Overarching framing for **#46-#49**: the app currently reads as visually **empty/cold** and does not match a **paid premium product**; these are design-quality items, not defects. | **Settings page is plainly styled** and does not convey a premium paid product tier. | Not a defect — a polish/tier item tracked for a design pass; no phase assigned. | Wanted: **language-switcher buttons**, a **dark-mode toggle**, and further visual refinement befitting the product tier. |
+| 47 🔎 **OPEN — product-design item, raised 2026-07-23 (Abo Jad design review). DESIGN-QUALITY, NOT A BUG.** | **Materials page has no per-item management** — a material, once listed, cannot be acted on. | Not a defect — a missing-affordance/UX item; no phase assigned. | Wanted: **per-material actions** — **rename**, **delete**, and similar. |
+| 48 🔎 **OPEN — product-design item, raised 2026-07-23 (Abo Jad design review). DESIGN-QUALITY, NOT A BUG.** | **Pre-login landing page has no navigation menu.** | Not a defect — a missing-nav/UX item for the mobile app; no phase assigned. | Wanted: a **hamburger (three-line) icon** opposite the KnowFlow wordmark in the header, opening a **main dropdown menu** for the mobile app. |
+| 49 🔎 **OPEN — product-design item, raised 2026-07-23 (Abo Jad design review). Carries a correctness rider, not pure polish.** | **The landing page's terminal-style demo window shows static text.** **Cross-ref #20:** that window currently displays **"Ready in 0.4s"**, a timing claim **#20 already flags**, and this session proved **ingestion is synchronous and takes real seconds** — so the number MUST be corrected or removed as part of this work rather than re-shipping a false claim. | Not pure polish — the embedded "0.4s" IS a false claim (see **#20**), so this row carries a correctness rider; no phase assigned. | Wanted: **animate the terminal** so the text **types out live from start to finish**; as part of the same work, **correct or remove "Ready in 0.4s"** (per **#20**) rather than re-ship it. |
 
 **Founder-owned open items (PIVOT_PLAN §10) — not engineering-blocked, tracked for launch:**
 Next.js hosting decision (Vercel Pro vs self-host, ~Phase 7/10) · **Supabase backend
@@ -203,6 +207,10 @@ bodies total 37,095 bytes. **This retires the Option C frozen-tail invariant by
 existed only to police a boundary inside an unreviewable single line, and the append-only rule above
 supersedes it. No bespoke hash is needed for future updates: the diff is the proof.
 
+### 2026-07-23 - closed register #45 and logged four product-design items (#46-#49)
+
+(**Register #45 CLOSED and four new design registers opened.** #45 — the live DUPLICATE Vercel ingestion service at `/_/ingestion` — is now closed: the `experimentalServices.ingestion` sub-key removal shipped in PR #67 (merge `ecb1ed5`), and the closure evidence was MEASURED, not asserted — before merge `curl https://tryknowflow.com/_/ingestion/health` returned **200 with no redirect**; after merge the same curl returned **307 → `/ar/_/ingestion/health`** and, following it, **404** (Next's own page, not the service JSON), proving nothing intercepts the path at the edge any more and that **config removal alone sufficed** — no Vercel-dashboard service deletion was needed. `INGESTION_TOKEN` was then **rotated Railway-first then Vercel** and verified by a **real production upload reaching READY**. The #45 row was CONVERTED IN PLACE (🔴→✅, original lead preserved after "Was:"), per the #38/#40 keep-history convention. Separately, Abo Jad's design review raised **four product-design items**, logged as registers **#46-#49**, all 🔎 OPEN — overarching framing: the app reads as visually **empty/cold** and does not match a **paid premium product**; these are DESIGN-QUALITY items, not bugs. **#46** the settings page needs premium polish (language-switcher buttons, a dark-mode toggle, further refinement); **#47** the materials page needs per-item actions (rename, delete, and similar); **#48** the pre-login landing page needs a hamburger nav menu opposite the wordmark for the mobile app; **#49** the landing page's terminal demo should type out live from start to finish, AND its **"Ready in 0.4s"** claim — already flagged by **#20** and disproven this session (ingestion is synchronous, takes real seconds) — must be corrected or removed rather than re-shipped. **Docs-only: no code, no migration, no DB; `Phase 7` stays ⬜, §1 B5b row untouched, `PIVOT_PLAN.md` untouched, register #17 stays OPEN.**)
+
 ### 2026-07-23 - closed the live duplicate Vercel ingestion service (register #45)
 
 (**Register #45 — a LIVE DUPLICATE of the ingestion service, served by Vercel at `/_/ingestion` from the vestigial `experimentalServices.ingestion` block in `vercel.json`, found while scoping B5b.** `GET https://tryknowflow.com/_/ingestion/health` returned `200` — the block was ACTIVE, not vestigial-inert. It runs the SAME current `main.py` as the real Railway service (Vercel rebuilds `services/ingestion` per deploy — so NOT stale April code, correcting an earlier misdiagnosis), and is **token-shared**: the `INGESTION_TOKEN` the Next route uses for Railway also opens this copy's token-gated `/convert` and `/embed`, while `/health` is open. `VOYAGE_API_KEY` is set on Vercel, so a token-holder could burn Voyage credits and run MarkItDown here, bypassing every Next-route guard. This PR removes ONLY the `ingestion` sub-key (keeps `frontend`); the fix then requires, IN ORDER: merge → confirm production `/health` 404 (delete the Vercel service if it does not) → rotate `INGESTION_TOKEN` (Railway then Vercel). Rotate LAST, because rotating before teardown re-exposes the fresh token on the shared-env duplicate. A distinct incident from B5b, logged as register #45; the B5b row and `PIVOT_PLAN.md:270` are untouched.)