docs: capture M8 live-deploy lessons learned + Path A demo proven

[Bytes0211]

Summary

Documents what actually happened during the live M8 deploy on May 2, 2026 so the next setup (e.g. staging environment, second restaurant onboarding) doesn't re-discover the same issues.

Files:

• developer/m8-live-demo-checklist.md — completion criteria updated to reflect Path A done; new "Lessons learned" section covers Stripe env confusion, CORS preflight, auth init pattern, success_url 404, Path B deferral
• docs/project-status.md — Current Status updated, Recently Completed gains detailed M8 entry, Current Focus shows the two M8 fast-follows before M9

Two known follow-ups documented (not fixed in this PR):

1. Stripe success_url lands on dialtone.menu/orders/:id/paid which 404s — webhook fires regardless so order flips to paid, but customer-facing experience is broken
2. Path B — vapi_call_start response shape doesn't match Vapi's assistant-request contract; voice integration was never live-tested

Test plan

• pnpm ci:fast still green (188 unit tests)
• Markdown renders cleanly (no broken links or code-fence issues)
• Docs-only PR — no behavior change

🤖 Generated with Claude Code

Greptile Summary

Docs-only PR capturing M8 live-deployment lessons learned: completion criteria updated to reflect Path A proven end-to-end, and a new "Lessons Learned" section documents the Stripe environment confusion, CORS preflight gap, auth init bootstrap fix, success_url 404, and Path B deferral. No behavior changes; two known follow-ups (success_url 404 and Vapi response shape rewrite) are explicitly tracked as fast-follows before M9.

Confidence Score: 5/5

Docs-only PR with no behavior changes; safe to merge.

Only P2 finding present: the M8 Milestone Summary table row in project-status.md was not updated to match the live-deploy narrative in the rest of the document. No P0 or P1 issues identified.

docs/project-status.md — M8 roadmap table row note is stale relative to the updated Current Status and Recently Completed sections.

Important Files Changed

Filename	Overview
developer/developer-journal.md	New M8 journal entry documenting live deployment, two ship-blocker fixes (CORS preflight and auth init bootstrap), and follow-up items (success_url 404, Path B voice rewrite). Supabase project ref and DID appear inline but that concern was flagged in the previous thread.
developer/m8-live-demo-checklist.md	Completion criteria updated to mark Path A items ✅ and explicitly defer Vapi/voice items; new Lessons Learned section added covering Stripe env confusion, CORS preflight, auth init, success_url 404, and Path B deferral. Stripe/Telnyx identifiers replaced with angle-bracket placeholders; Supabase project ref and DID remain (previously flagged).
docs/project-status.md	Current Status, Current Focus, and Recently Completed updated to reflect M8 Path A live; Milestone Summary roadmap table row for M8 left unchanged with stale note and unchecked steps, creating internal inconsistency with the rest of the document.

Flowchart

%%{init: {'theme': 'neutral'}}%%
flowchart TD
    subgraph PathA["Path A — Proven Live (May 2, 2026)"]
        A1[Admin SPA] -->|POST admin_create_manual_order| A2[Edge Function\nhandlePreflight → CORS fix]
        A2 -->|card path| A3[Stripe Checkout Session]
        A3 -->|customer pays| A4[checkout.session.completed\nwebhook]
        A4 -->|order → paid| A5[Supabase Realtime push]
        A5 --> A6[Kitchen tablet\nNew → Preparing → Ready → Completed]
        A2 -->|Telnyx SMS| A7[Customer receives\npayment link]
    end

    subgraph PathB["Path B — Deferred (voice contract mismatch)"]
        B1[Vapi inbound call] -->|assistant-request| B2[vapi_call_start\n⚠ returns wrong shape]
        B2 -.->|needs rewrite| B3["Expected: { assistant: {...} }\nActual: { status, prompt, tools, ... }"]
        B3 -.->|4–6h focused work| B4[Path B unblocked]
    end

    subgraph KnownIssues["Known Open Issues"]
        I1["success_url → dialtone.menu/orders/:id/paid\n(404 on marketing site)\nWebhook fires ✓ — UX broken ✗"]
        I2["Failure modes not yet validated\n(abandoned / declined / replay)"]
    end

Loading

_{Reviews (4): Last reviewed commit: "docs: address Greptile P2 — replace conc..." | Re-trigger Greptile}

[Bytes0211]

Addressed Greptile's P2/security finding in 3a250f6.

Replaced with angle-bracket placeholders across developer/m8-live-demo-checklist.md, docs/project-status.md, and developer/developer-journal.md:

• acct_1TSRbH2ME93XgAX1 → <stripe-connected-account-id>
• B0YDBOE → <telnyx-tcr-brand-id>
• CNZVYD6 → <telnyx-tcr-campaign-id>

Kept as-is (not actually sensitive in our context):

• Supabase project ref klzznfagrtormretqsgb — already baked into the deployed admin/kitchen JS bundles as VITE_SUPABASE_URL (anyone hitting admin.dialtone.menu can extract it from the bundle). Obfuscating in docs while leaking in the bundle is theater.
• Telnyx DID +16296001047 — the customer-facing public phone number; will be on Sui's Sushi's published menu and marketing materials.

Note on git history: the original concrete values are still in this PR's earlier commits' history (per Greptile's note that they're "permanently discoverable"). Going forward, docs reference placeholders only. Actual values live in Stripe dashboard / Telnyx Mission Control / 1Password — not in source.

Validated: pnpm ci:fast still green (188 unit tests pass).