Session 13 · July 29, 2026

We finished hardening the pilot, then walked the product as a user for the first time.

The morning closed out the trial-to-pilot conversion at every layer it was still hiding in — five of them, found one at a time. The afternoon was the first end-to-end operator walkthrough of SDR Hive: forty-two findings across every surface an inbound SDR touches. Nothing in the product was broken by today's work; a great deal that was already broken is now written down.

8 build passes shipped 14 files changed 42 UAT findings 2 zip verifications · zero drift 0 migrations required

Trial writers found & closed

Upgrade surfaces removed

Hidden enforcers removed

UAT items catalogued

Morning · Pilot Hardening

The 14-day trial was retired on the 28th. It was still running in five places.

Each was found only after the previous one was closed. Every fix was scoped, prompted, executed by the Lovable agent, and then verified against the codebase.

CLOSED

Display layer — six readers disagreed with the enforcer

call_limit had a null-fallback of 10 in the sidebar, the SDR dashboard, entitlements, and internal BI, while the enforcer and the usage banner defaulted to 60. All six now read 60. Also removed: "Free trial" plan label, four upgrade CTAs, and two billing links that led an invited AE to a credit-card form in two clicks.

CLOSED

Write path — HQ approval was setting the cap to 10

hqSetTier wrote call_limit = 10 for free tier in the same statement that set status = 'approved'. Every pilot user approved through HQ would have been capped at 10 and every reader would have honestly reported it. Zero rows affected — HQ approval had not yet been used on a free-tier lead.

CLOSED

The day-15 lockout

me.functions.ts gated the entire pilot feature unlock on trial_state.expiry_date, which create_trial_on_signup writes as NOW + 14 days. On day 15 every pilot user would lose case studies, battle cards, proof points, and AE analysis tuning — and clicking any of them opened a modal stating they had used all 60 analyses. Fixed by removing the expiry comparison. trial_state and create_trial_on_signup untouched.

CLOSED

A nightly cron was expiring pilots and emailing them about it

monthly-credit-reset — scheduled daily at 03:15 — flipped trial_state.status to expired and enqueued the trial-expired template, which tells the user their trial ended and links to /pricing. Both removed; the credit grant was left untouched. The dormant expire-trials endpoint was also stubbed.

CLOSED

The real writer wasn't a cron at all

checkTrialExpiry ran in a useEffect on the Qualifier — the SDR's primary work surface. Opening the page on day 15 performed the expiry, then replaced the analyze button with a "Trial Expired · View Plans" paywall. Same function carried a hardcoded 50-analysis cap reading trial_state.analyses_run — a second enforcer firing ten analyses early. Both removed.

CLOSED

Near-cap nudge was asserting something false

The 80% warning opened a modal reading "You've reached your pilot limit — you've used all 60 analyses." At 48 of 60 that is simply untrue. The nudge is now informational with the amber→red progression preserved, and UpgradeModal now reads the user's actual call_limit rather than a hardcoded 60.

Verification became real today

The day-15 fix was proven by execution, not inspection: a real auth user was seeded with trial_state.expiry_date 30 days in the past, signed in with a live password grant, and driven in Chromium. Case studies and battle cards both rendered unlocked — and because the database row said free, an unlocked render was only reachable via the corrected free_trial promotion. Behaviour, not a re-read of the condition. Test account and its org, profile, and trial rows were torn down afterward.

Morning · Verification & Enumeration

Three questions we should have asked days ago

Every reader and writer of trial_state.status

Eleven locations enumerated. Only two writers can still close the pilot gate: expire_lapsed_org_trials(), which nothing calls and whose only HTTP caller is now stubbed, and an explicit admin action in admin-billing.functions.ts. The client-triggered writer is gone. We had been surprised by this column three times before asking for the complete list.

CLOSED
Every path that can block an analysis

Five gates. Two are caps, both reading call_limit. The remaining three are the terms-of-service gate and an anti-abuse rate limiter — neither a usage cap. Confirmed: call_limit is the single enforcer, and no trial_state value can block an analysis any longer.

CLOSED
Every pg_cron job on the project

Seven. Nothing calls the trial-expiry endpoint, which made that stub belt-and-braces. But job 36 is refresh_call_activity_daily, running nightly at 02:00 — against the standing constraint that it should never be invoked or scheduled. The call_activity_daily table checked clean (16 rows, zero with a stale org_id), so yesterday's backfill left no damage there. The job is still scheduled and the decision to unschedule it is open.

OPEN

Morning · Last Night's Work, Audited

The org_id backfill: what landed, what didn't

Item	Status
`set_org_id_from_user` rewrite Resolution order with the owner exclusion in branch (b) — the part that matters.	Landed correctly. Attached to `analysis_history`, `trial_state`, `subscriptions`, `notifications`. Not reported by the agent; confirmed by reading the migration.
`profiles_autofill_org_id` audit Requested, not delivered.	Not fixed. Still selects the earliest accepted membership with no owner exclusion — which is always the personal org. Four writers to `profiles.org_id` exist; only `accept_relationship_invite` has the correct preference order. Two others resolve to the personal org and are masked only by ordering.
Notifications with null `org_id`	Left in place. The migration's guard excludes them regardless of whether the profile has an org, so the inline justification is asserted rather than verified. Recommendation on record: resolve them — a null in a column every RLS policy filters on makes those rows invisible to everyone permanently.

Still unverified by execution — carried into Session 14 as item one

The trigger rewrite governs where new rows land; the backfill only repaired the 35 that existed. Verifying it requires creating an analysis as a paired SDR and reading it as a leader in the same org. That never happened today. The walkthrough went deep on product surfaces and never reached step 8. This remains the only open security question on the project, and the project's own standard says verification means execution.

Afternoon · First Operator Walkthrough

Forty-two findings, and one of them blocks seven others.

Kevin walked SDR Hive as a real inbound user with fresh accounts. Every finding was then traced to a file and line before being recorded. Full detail lives in docs/UAT_2026-07-29_FINDINGS.md. What follows is the shape of it.

7 P0 · blocks a pilot user 14 P1 · before design build 8 P2 · polish 13 product decisions

The dependency chain — this is the headline

There is no way for an SDR to establish a relationship with an AE or a leader. ae_roster is a private address book with no invite and no linked account. relationships is the real pairing. Nothing connects them and no invite action is reachable from the SDR side.

Consequences: the dashboard checklist is permanently stuck at 1/4 because two of its four items require a paired AE. "Send to AE" has nothing to send to. Opportunities cannot be assigned. 1:1s cannot exist. Demo data cannot preview a 1:1. And five steps of the original walkthrough script were untestable.

Seven items resolve behind this one fix. If one thing goes to the design team first, it is the relationship on-ramp.

P0 · Blocks a pilot user

Seven things a real pilot user would hit today

No AE invite path exists anywhere in the product

The "MY AES" panel writes a contact row with no account and sends no email. team.functions.ts:404

BLOCKS 7
Transactional email may not be delivering at all

No welcome email arrived on signup. The queue is pgmq transactional_emails; the drain is an HTTP route and no pg_cron job calls it. If Lovable doesn't invoke it as a platform job, every email is stuck — including the relationship invite, which would make the AE on-ramp fail silently even once built. Read-only diagnostic pending.

UNRESOLVED
AE self-signup lands on the SDR dashboard

Three defects: useState(defaultRole) captures a stale first render so ?role=ae deep links submit SDR; the post-signup redirect uses local form state while the persistence RPC fails on a bare console.warn, so UI and database can diverge silently; and routing falls back to guessing the role from an email-suffix regex — a UAT fixture that shipped.

IDENTITY
HQ cannot change a user's active hive

current_role is derived from roles[0] while the checkbox handler appends, so the pre-existing first role always wins. ADMIN sits as a peer checkbox and can become the active role — it has no dashboard and grants org-wide read across every rep's MBO, coaching notes, and 1:1s.

ADMIN
Signup terms links strand the user in a new tab

target="_blank" on both links; the privacy page's Back button guards on a history length that is always 1 in a fresh tab. Form state survives — in the other tab. Fix is a scroll-to-accept modal; the component already exists twice in the codebase.

P0
"Send to AE" is a navigation link, not an action

Styled green like a commit action. No AE picker, no handoff record, no confirmation — Handoffs then correctly reports zero sent. _app.sdr.follow-ups.tsx:491

P0
Onboarding checklist permanently reads 1/4

Items 3 and 4 both require a paired AE. Every pilot user sees a checklist that cannot be completed.

GATED

P1 · Highlights

Fourteen items needed before the design team build

REBUILD

Landing-page demo stripped to one button

Closing the unauthenticated Claude front door on the 28th took the whole config experience with it — transcript picker, BAE/PAE selector, methodology choice, tuning panel. All three components are intact and orphaned in the file. Rebuild sends a transcript_id instead of text, validates config against an enum allowlist, and caches on a config hash so results are real, genuinely config-driven, and effectively free once warmed.

WRONG DOCTRINE

Coaching Guide always shows IMPACT

A Brand SDR on MEDDPICC is shown the partner-side E.M.I./IMPACT library, because the modal hardcodes it while the same file's gate list respects the framework. IMPACT_COACHING is the only library that exists — 24 more cards needed for MEDDPICC, BMANTR, MEDDIC, and BANT. That is authoring doctrine, not a code change.

DATA INTEGRITY

Two editors on one column

Profile's "What I Sell" free-text and "Products Represented" chips both write testhive_leads.products_sold with separate save buttons. Last save wins silently. The UI carries a "remember to save" note — someone knew and papered it with an instruction.

SILENT LOSS

CSV mapper allows two columns to target one field

industry and sub_industry both mapped to industry; one silently wins. Duplicate detection covers company names only. Otherwise the import handled a 26-column arbitrary file with suggested matches cleanly — that part works well.

Product Direction

Thirteen decisions, not defects

These came out of the walkthrough as design positions rather than bugs. Full reasoning in the findings document.

The unpaired AE is the default case, not the degraded one. A pilot begins with one curious SDR whose AE has never heard of Hyvara. Requiring invite-and-accept before the product does anything useful puts a two-person dependency in front of a one-person decision. Model: one AE list, two states — Contact and Paired — with one action on every Contact row. The emailed scorecard is plausibly the acquisition loop: the AE receives the work product and asks what made it.

GROWTH LOOP Item #30

The call-execution loop needs one entity, not five features. The data model knows about analyses and follow-up dates but has no record of "I tried and didn't reach them." Add a call attempt with an outcome enum and everything falls out — voicemail flagging, the SLA re-follow-up trigger, real call numbering, dial counts for growth and leaderboard, and abandon as an outcome rather than a dead end. Requires an attempt ceiling or the queue floods and reps stop trusting it.

ARCHITECTURE Item #31

Eleven dashboard blocks; four earn their place. Test: does it change what the rep does in the next hour? Keep a thin targets strip, Today's Work at the top merging three currently-separate lists, and a handoff status block that doesn't exist yet. Cut the block that restates the subtitle above it, the usage number that appears on screen three times, the changelog, the duplicate welcome card, and the Customize button — a customize control on a cluttered default asks the user to fix the information architecture.

INFORMATION ARCHITECTURE Item #37

Config ownership should follow the relationship graph — but layered, not switched. When a leader is paired they set locked guardrails: offer limits, why-buy, framework. The rep still tunes within them, and locked fields show who set them and why. A hard shutdown would punish reps for inviting a leader, and five items already depend on those relationships forming.

GIVE / GET AS PERMISSION MODEL Item #40

Why today mattered

Every one of these would have landed on a real pilot user, mid-pilot.

The pattern across all five trial-expiry defects: none of them throw, none of them log, and all of them fire on a date rather than an action. They were invisible today because every test account is under fourteen days old.

Revenue & Credibility

What we prevented

Defect	What it would have cost
Pilot cap enforced at 10	Every HQ-approved pilot user capped at 10 analyses instead of 60, with every display honestly reporting 10 — a consistent, wrong number. A pilot designed to prove value on 60 real calls would have died at call eleven. Zero users affected; HQ approval hadn't been used on a free-tier lead yet.
Day-15 feature lockout	Case studies, battle cards, proof points, and AE tuning all closing two weeks into a pilot, with the product telling the user they'd exhausted 60 analyses when they may have run three. This would have arrived after the design review and during the first pilot conversations.
Silently degraded analyses	The most expensive one. Post-day-15 users stopped receiving battle-card context in their analyses — no error, no visible difference in the output. A worse analysis that looks exactly like a good one. The product would have been quietly disproving its own value proposition, and no one would have known why the pilot underperformed.
"Trial expired · Upgrade now" email	A nightly cron telling pilot participants their trial had ended and linking them to a pricing page. To an enterprise prospect mid-evaluation, that reads as either a bait-and-switch or a company that doesn't know what it sold them.
Hidden 50-analysis cap	A second enforcer blocking users ten analyses early, contradicting both the enforced cap and every number shown on screen.
Card-entry paywall two clicks from the AE dashboard	An invited AE reaching "Enter a card to activate — we won't charge for 14 days" during a pilot that has no billing. Directly contradicts the pilot framing.
Seven surfaces of trial and upgrade copy	Against a landing page promising zero AI training and Anthropic zero-retention, inconsistent commercial copy is a trust problem, not a cosmetic one. Enterprise security reviews read the surfaces together.

Asset Created

What we now have that we didn't this morning

DELIVERABLE

A design-team build brief

Forty-two items, ranked, each traced to a file and line, grouped by the four-stage critical path — identity, onboarding, AE relationship, account list — with the dependency chain called out so seven items are visibly downstream of one fix. This is what the design team has been waiting on, and it exists because someone used the product instead of reading about it.

KNOWLEDGE

Two traps worth promoting into AGENTS.md

Wrong defaults are the dominant bug class — a null-coalesce on a business-critical value is a bug until proven otherwise. And entitlement tiers gate model context, not just UI — the day-15 defect degraded analysis quality invisibly, which no access-control review would have caught.

Process

What worked, and what cost us time.

Recorded plainly. Three of today's misses were mine, and they share a shape worth naming so the next session doesn't repeat them.

Done Well

Five things to keep doing

Execution replaced inspection, and it held

The seeded 30-day-lapsed account driven in a real browser is the standard. It proved the fix by observed behaviour rather than by re-reading the condition that was changed — and it distinguished a working fix from a plausible one.

KEEP
Zip-diff drift checking — two passes, zero drift

Ten files verified, then four. Every claimed change landed exactly; nothing was rewritten wholesale; nothing outside a prompt was touched. That confidence is why we stopped asking for a zip after every turn and only asked when the change set was wide.

KEEP
Reading the codebase instead of round-tripping

Three of last night's five requested items came back unreported. Rather than re-prompting, all three were answered directly from the repo in one pass — including confirming the trigger rewrite had landed correctly. Cheaper in credits and faster than a second turn.

KEEP
Asking for complete enumerations after being surprised

After being wrong twice about trial_state.status being closed, we asked for every reader and writer of the column and every path that can block an analysis. Both lists immediately surfaced things that scoped questions had missed. Enumerate, then scope.

KEEP
The walkthrough found more than the script would have

Twelve scripted steps would have produced maybe six findings. Walking the product freely produced forty-two, including the relationship gap that turned out to gate seven of them. Operator instinct beat the checklist.

KEEP

Do Better

Four misses, and the shape they share

Prompts scoped to named files missed adjacent surfaces — twice

Tier and upgrade copy was removed from five files, then found again in the qualifier, then the SDR dashboard, then the leaderboard, then the dashboard header — seven surfaces across three passes. The agent complied exactly each time; the scope was wrong. Correction: when removing a category of thing, grep the whole tree first, then scope the prompt.

MINE
I called the edge-function CAP a blocker without checking the column

Told Kevin not to start UAT over CAP = 10 in the analyze path. But call_limit is NOT NULL DEFAULT 60, so the null-coalesce is unreachable. I reasoned about a fallback without checking whether the column could produce a null. Walked back the same session; it cost a delay.

MINE
I recommended deleting a live email template as dead code

trial-expired.tsx was reachable through the credit-reset cron. I had traced cron endpoints but not the enqueue calls inside them. Acting on that advice would have produced a runtime failure in a nightly job instead of a bad email.

MINE
We never ran the analysis

Step 8 and step 11 were the reason the walkthrough script existed. Fourteen hours of work and the one unverified security fix is still unverified. The exploration was more valuable than the script — but the script had one job that didn't get done.

TOMORROW

The shape all three of my misses share

Each was an incomplete enumeration presented with complete confidence. I looked at one class of caller, one layer, one file set — and reported a conclusion as though I'd looked at all of them. The zip verification caught none of these, because drift was never the problem. The correction isn't more checking; it's saying "here is what I looked at" alongside every conclusion, so the boundary of the claim is visible.

Session 14 · Tomorrow

Verify the trigger, resolve the email queue, then build the on-ramp.

Ordered by what unblocks the most. The first two are cheap and answer questions; the third is the one that makes five walkthrough steps testable and seven findings disappear.

Session 14 · First

Execute walkthrough steps 8 and 11

Run an analysis as a paired SDR; read it as a leader in the same org. This is the only execution test of the set_org_id_from_user rewrite and the only open security question on the project. Everything else on the list is a product question.

Session 14 · Second

Resolve the email queue

Read-only: email_send_log rows for the test accounts, pgmq queue depth, last successful send, and whether Lovable invokes the drain route as a platform job. Determines whether the AE invite can work at all once built.

Session 14 · Third

The relationship on-ramp

One AE list, two states — Contact and Paired — with an Invite to Hyvara action on every Contact row. Defers the ae_roster / relationships consolidation rather than forcing it. Unblocks seven findings and five script steps.

Session 14–15

Identity and admin correctness

Signup role persistence and the stale defaultRole; remove the email-suffix role guess; HQ active-seat control separated from capability checkboxes; scroll-to-accept terms modal; make "Send to AE" an actual action.

Before rebuild

Three decisions to lock

Account provenance — imported versus inherited from a paired AE's book, and what happens when a pairing ends. Dashboard reduction. Opportunities as a dense table with one verb. All three should be settled before the corresponding surface is rebuilt, not after.

Session 15+

Doctrine and content

Twenty-four CoachingCard entries for MEDDPICC, BMANTR, MEDDIC, and BANT, drafted from Get to No Quickly for Kevin's correction. That is backlog item 7 — the doctrine map — arriving as product content rather than a diagram.

Carried Forward

Open items from before today, unchanged

Phase C — blanket org-wide grant on 18 policies

Any admin or manager can currently read every rep's MBO, coaching notes, and 1:1s rather than only their own reports. Today's HQ finding adds weight: ADMIN is one checkbox away in the user editor.

RANKED 1
Signup role flip and enforce_roles

Blocked behind Phase C. Today's session 13 findings on current_role derivation and the four writers to profiles.org_id are direct evidence for both.

BLOCKED
refresh_call_activity_daily is scheduled

Job 36, nightly at 02:00, against the standing constraint that it should never be scheduled. The aggregation table checked clean, so there is no damage to repair — but the contradiction between the rule and reality is open.

DECIDE
Edge function sweep

_shared/lead.ts CAP = 10, generate-briefing's hardcoded cap ignoring call_limit, and the 429 message hardcoding "60". None reachable on the live path. Needs a redeploy, not just a file change.

LOW
Private Brain — deliberately deferred

Progress Agentic RAG is live across the vaults and considered complete. Not walked today and not queued. It is the one part of the product that doesn't need attention.

STABLE

Business Development · DCN Pilot

Mike and Colin have connected.

The direct track has moved. Kevin is still working toward a final individual to communicate with, and concerns have been raised about the current state of the partner motion. Next step is outreach to additional Adobe partner connections. Objective: close down the DCN pilot scope within the next one to two weeks.

Mike ↔ Colin connected Final contact pending Adobe partner outreach next 1–2 week window to lock scope

Status

Where the tracks stand

Mike Neumann ↔ Colin Schaap — connected

The direct sales-floor track and the partner-side conversation are now talking to each other. Mike's window remains the binding constraint: he retires December 31, which makes September the deadline for a pilot agreement before his attention shifts to exit and transition.

MOVED
Final individual to communicate with — still open

Kevin is working toward identifying and reaching the last contact needed to complete the picture. Concerns have been expressed about the current state of partners, which is consistent with the read that has driven DCN's positioning from the start.

IN PROGRESS
Additional Adobe partner connections — Kevin's next action

Reaching out to a small number of partner contacts inside Adobe directly, alongside the existing Kyle-sponsored path to Sarah Lacey and Alison Webster. Broadens the base of validation rather than depending on a single sponsored introduction.

NEXT
Objective — close down DCN pilot scope in 1–2 weeks

The intent is to stop exploring and define what the pilot actually is: who participates, what it proves, and over what period. Everything currently in flight on the BD side feeds that decision.

TARGET

Standing Thesis

Why the partner concerns are the opening, not the obstacle

Adobe has been reducing headcount in partner alliances to cut costs. Partners are losing access to deals and dropping out of the program. DCN is the digital replacement — what an alliance manager did manually and without data, done at scale with full behavioural tracking. Concerns raised about the current state of partners are the problem statement, not an objection to work around.

POSITIONING Carried from Session 15 · June 18

Product readiness against a 1–2 week scoping window

Worth stating plainly for anyone reading both halves of this report. The SDR Hive walkthrough surfaced seven P0 items, and the relationship on-ramp — the ability for one user to pair with another — does not exist yet. DCN's entire premise is cross-organisation co-sell visibility between a brand AE and a partner AE. That is the same primitive, one layer up.

This isn't a reason to slow the BD conversation. It is a reason the relationship on-ramp is ranked first in the Session 14 queue: it is simultaneously the SDR Hive unblock and the DCN foundation. One build serves both tracks.