SHIP LOG. ▮

Authentication replatformed onto Authentik OIDC. Sign-in runs through a server-side BFF — Authorization Code with PKCE, an encrypted httpOnly session cookie, and edge refresh — so the browser never talks to the identity provider and no token is ever readable by page scripts.

Route permissions unified onto a single source, and the account pane reads its verification claim through the token relay rather than a client-held session.

Supabase removed entirely — client libraries, call sites and lockfile entries.

The CRT terminal redesign landed across the console (P1-P8), including the overview screen, and the interim compatibility shims were dissolved.

Sitemap slugs now derive from the canonical coin registry, and the email template registry validates each template with a schema instead of trusting its props.

Duplicate resources routes collapsed; the dead infrastructure page archived.

The UI kit and Kafka client are vendored as workspace packages instead of being pulled from a registry, so a clean install needs no registry credentials.

End-to-end runs cache the browser and build output, cutting several minutes per pull request.

Whale tracker, network-health, whale-feed, velocity and cohort screens realigned to the shapes the API actually returns — several were reading fields the backend never sent and rendering empty.

Restored the block height, difficulty, hashrate and mempool figures that come from the live event stream; an earlier cleanup had stripped them because the REST endpoint has no equivalent.

Live-data source spike — verified ~70% of the console (every free tab except analytics, shell, AI and public routes) is fully serviceable directly from 3xpl live data, bypassing the degraded Snowflake/Valkey warehouse tier. Documented the T/T-1 freshness boundary and a full per-screen data contract.

Email/password + Google OAuth authentication — login, signup with email verification, forgot-password (anti-enumeration), reset-password (PKCE flow), sign-out with JTI blacklist, and SSR session refresh via proxy.ts.

Public marketing rebuild — dual-audience hero, /pricing, /use-cases, and /chains/[coin] programmatic SEO across all 11 chains. About, API docs, changelog, and contact rewritten against the product roadmap.

Postgres user-data cluster cutover — migrated mugenlink_userdata to the dedicated user-data-pg cluster. Alembic head 021, 30 tables under row-level security, six application roles separated by least privilege.

Circuit breaker and read-replica routing — Snowflake queries now run behind a circuit breaker (5-failure trip, 60s recovery). Read-only endpoints route to a Postgres read replica when configured. Tiered rate-limit keys (API key -> user -> IP) prevent NAT collisions.

Roadmap published — 10 products spanning Phase 1 and Phase 2. Plans vaulted with delivery maps and dependency graphs.

PAT-only auth for service accounts — retired RSA/JWT keypair authentication. All 12 service users moved to programmatic access tokens with least-privilege role bindings. Account migrated to FWPGNQM-WTB81124 in us-west-2.

mugenlink_logging v4.0.0 — cross-pod cache keys switched to blake2b. 12 audit findings closed. 148/148 unit tests pass; structured JSON output remains the canonical format.

Dual-source 11-coin load — end-to-end load completed for both sources: 96 Blockchair files across 6 UTXO chains and 29 3xpl files across all 11 chains. Landing prefixes finalized and locked in the registry.