Catalog

Three priorities
1. Churn — the jump from 1.1% to 2.4% is the headline, not the 8% growth. Pull the six churned accounts and call two of them by Wednesday.
2. Head of CS — the loop has been stuck in week 3 for three weeks. Raise the comp band by Friday or take the role yourself for six weeks.
3. The two silent enterprise prospects — a three-line note each referencing one specific demo moment, with a closed question.

Two decisions you are avoiding
- Pulling engineering off roadmap item #3 onto the churn investigation. Cost of waiting: roughly $9k of MRR per week. Make the call: pull them for two weeks.
- Whether the CS contractor runs next month's renewal calls. You do not trust her with them; say so by Thursday.

The risk nobody is flagging
Net of the churn jump, growth is closer to 5% than 8%, and the board deck still says 8%.

The question you are not asking
Did the churned accounts all come from the March paid campaign?

Team line: "This week we find out why six customers left, and nothing on the roadmap outranks that."

1. Object-level authorisation — FAIL
   app/api/invoices/[id]/route.ts:14 fetches by id with no owner check. Any signed-in user can read any invoice by changing the id.
2. Secrets — FAIL
   NEXT_PUBLIC_STRIPE_SECRET_KEY in .env.local is shipped to the client bundle; the secret key must not have the NEXT_PUBLIC_ prefix.
3. Server-side enforcement — FAIL
   The "3 free uploads" limit is checked in components/Uploader.tsx only; the /api/upload route accepts unlimited calls.
4. Input handling — PASS (parameterised queries via Supabase client; uploads restricted to PDF under 10 MB server-side)
5. Auth plumbing — CANNOT TELL — no rate limit visible on /api/auth/magic-link; confirm at the provider.
6. Webhooks — PASS — stripe.webhooks.constructEvent verifies the signature before any write.
7. Data exposure — FAIL — /api/me returns the full users row including stripe_customer_id and internal notes.
8. Dependencies — PASS — no critical advisories in lockfile.

Ranked by exploitability: #1 (no account needed beyond free sign-up), #3 (free plan abuse), #2 (key visible in view-source), #7.

Fix for #1:
- const invoice = await db.from("invoices").select("*").eq("id", id).single()
+ const invoice = await db.from("invoices").select("*").eq("id", id).eq("user_id", session.user.id).single()

8-second cinematic product teaser, one continuous shot.

Subject: a fictional woman in her thirties at a wooden desk, white shirt with rolled sleeves.
Action: she closes her laptop, exhales, and lets a slow smile arrive; the laptop closes exactly at second 4 and nothing else happens.
Camera: slow dolly push-in from a medium shot to a medium close-up, steady speed, slight handheld feel, holds for the last 2 seconds.
Lighting: golden-hour window light from frame-left with a warm desk lamp filling the shadow side; skin tones warm and natural; subtle film grain.
Setting: a quiet home office, plant on the sill, no readable text, no logos, no legible screen.
Audio: quiet room tone, the soft click of the laptop at second 4, very soft piano entering at second 5 and resolving at second 8. No voice-over.

Leave clean negative space on the right third for a headline overlay.

Render notes: the push-in ends tighter than expected — if the headline space is compromised, change "medium close-up" to "medium shot" and re-render; everything else holds.

Five segments your current campaign collapses into one:

1. Just-launched grads (22–25) — 31% of reviews
Pain: "first real paycheck and no clue where it goes"
Objection: "feels like another subscription I'll forget about"
Tipped by: the free 60-second setup
Headline: Your first salary deserves better than a spreadsheet.
Primary text: You got the job. Now the money shows up and disappears. We built the 60-second setup that 84% of grads were still using 18 months later — no categories to maintain, no guilt.
Visual: a phone on a kitchen table next to an unopened pay slip.

2. Burned-by-Mint switchers (28–32) — 24%
Pain: "Mint died, YNAB is too much homework"
Objection: "will this one still exist next year?"
Headline: You don't want a finance hobby. You want answers.
...
CAC ranking: 2, 1, 4, 3, 5 — switchers already have intent and a vocabulary; students need education first.
Overlap: your current "take control of your money" angle speaks to nobody specifically; retire it.

Integrations

Auth — DONE. Supabase magic link; /app and /history require a session; /login and / are public.
Database — DONE. users(id, email, plan, trial_ends_at), courses(id, title), progress(id, user_id, course_id, lesson_no, completed_at). RLS: users read/write only rows where user_id = auth.uid().
Payments — NEEDS KEY. Stripe Checkout, $49/month, 5-day trial. Webhook /api/stripe/webhook verifies the signature with STRIPE_WEBHOOK_SECRET before any write. checkout.session.completed → users.plan = "pro"; invoice.payment_failed → plan = "past_due"; customer.subscription.deleted → plan = "free".
Email — NEEDS KEY. Resend: welcome on sign-up ("You're in — here's day 1"); trial-ending 2 days before trial_ends_at ("Your trial ends Thursday").

Source of truth for "paid": users.plan, written only by the webhook. The client never sets it.

Secrets expected in the environment panel: SUPABASE_URL, SUPABASE_ANON_KEY, SUPABASE_SERVICE_ROLE_KEY (server only), STRIPE_SECRET_KEY, STRIPE_WEBHOOK_SECRET, RESEND_API_KEY.

Test before going live:
1. Sign up with a fresh email → magic link arrives → /app loads → one row in users with plan = "free".
2. Stripe test card 4242… → return to /app → plan = "pro" within 5 seconds → welcome email received.
3. Fire a test `customer.subscription.deleted` from the Stripe dashboard → plan = "free".

BRAND BRIEF — Northwood Beard Oil

1. Positioning
We help men 28–45 with full beards stop smelling like drugstore musk. We can do this because a third-generation perfumer blends 14 natural notes other beard brands will not pay for.

2. Audience snapshot
- Situation: has worn the same $9 oil for years; wife or colleague has commented on the smell
- Trigger: a wedding, a new job, or the bottle running out
- Tried: "premium" brands that still lean on synthetic musk
- Fears: smelling like a teenager's locker; paying $40 for marketing

3. Promise
A scent people ask about, not one they step away from — within the first week.

4. Voice rules
Do: short declaratives ("Three notes. Zero musk.") / Don't: "elevate your grooming ritual"
...
6. Instruction for future prompts
Use this brief. Never use "elevate", "curated", "ritual". Always name a specific scent note.

Skeptic re-read: "Third-generation perfumer" is doing all the work — if it is not provable on the site, the positioning collapses to "nice smell". Holds only with proof.

Proposal — Loom · AE Onboarding Playbook Pilot

On Tuesday you said the eight incoming AEs have "no shared playbook" and that "ramp is going to kill us by Q2". You put current ramp at "14 weeks if we're honest" and a loaded AE at "about $140k".

Success: first cohort productive — first closed deal — inside 6 weeks instead of 14.

You said → What we do about it
"no shared playbook" → two-week build with your top two reps, delivered as a 5-day onboarding track
"ramp is 14 weeks" → week-1 to week-6 milestones with a manager checklist, so ramp is measured, not felt
"we tried a doc once and nobody read it" → every module ends with a recorded role-play a manager reviews in ten minutes

Timeline: build weeks 1–2; cohort onboarding weeks 3–8; review week 9.

Investment: $18,000. Payback: 8 AEs × 8 weeks saved × ($140k ÷ 52) ≈ $172k of ramp cost recovered. Breakeven at one AE.

Next step: a yes by Friday the 13th to start the build on the 16th.
Risk you raised: "our reps won't do homework" — modules are under 20 minutes and done live with the manager.

Walkthrough
Lines 1–8 pull `items` from the cache with no validation. Lines 10–18 loop and sum `item.price * item.qty`. Lines 20–22 return the total as a float.

Assumptions
1. The cache always returns a list → None raises AttributeError at line 10.
2. Every item has `price` and `qty` → legacy rows without `qty` raise KeyError mid-loop; partial sums are lost.
3. `price` is numeric → a string price silently concatenates on some paths. Dangerous.
4. The list is not mutated during iteration → a concurrent cache refresh mutates it; totals come back inconsistent with no error. Dangerous.
5. An empty list means a zero total → returns 0 silently; callers cannot tell "no items" from "free". Dangerous.

Verdict on your concerns: concurrency — unsafe; error handling — none; empty list — silent zero.

Tests
- items = None → a clear 500 with a logged cause
- one item missing qty → validation error naming the item id
- 10k items during a cache refresh → a consistent snapshot or a retry

Confirm the diagnosis and I will propose a patch.

Built. Here is what exists now:

- /today — the screen learners live on: today's lesson card, a 7-day streak strip, and a trial banner counting down from 5 days with one coral "Keep my streak" button that routes to /upgrade.
- /login — magic-link sign-in by email, no password.
- /settings — sign-out only.

Data model (created before UI, as asked):
users(id, email, created_at, trial_ends_at, plan)
lessons(id, day_number, title, duration_min)
completions(id, user_id, lesson_id, completed_at)
Streak is computed from completions, not stored.

Assumptions: one lesson per day; streak resets after a missed day; trial length fixed at 5 days.
Left out on purpose: analytics, onboarding tour, dark mode, admin.
One question before the next screen: should a learner on day 6 with no plan still see today's lesson, or only the upgrade page?

PILLAR — "The async standup playbook: how 14 distributed teams dropped the 9 AM call"
Keyword: async standup (~1,900/mo) · Intent: informational, late-stage
Gap in current top results: none give a template by team size; all assume 5–8 people.
H2s: Why the sync standup breaks past 3 time zones / The 3 formats by team size / Slack + Notion templates / What to do when nobody posts / Daily vs weekly / Tools compared honestly

Supporting articles
1. "Async standup template (Slack and Notion versions)" — async standup template (~720) · transactional · links to H2 #3
2. "Why your async standup is being ignored — and the 3-line fix" — async standup not working (~210) · informational · H2 #4
3. "Daily or weekly async standup for a 6-person team?" — daily vs weekly standup (~140) · comparison · H2 #5
4. "Async standup across 5+ time zones: what actually works" — async standup timezone (~95) · informational · H2 #1
...
Publishing order: 1, 2, 4 first (quick wins, low competition), pillar in week 3, remaining support weeks 4–6.

Scene 2 of 4 in a continuous short film. Use the attached character reference image.

Character (repeat verbatim in every scene prompt): a woman in her thirties, shoulder-length brown hair, navy blazer over a white shirt, warm intelligent expression — same face, same hair, same outfit, same build as the reference. No changes to wardrobe or hairstyle between scenes.
This scene: she pushes open the glass door of an empty office and walks in, slowing as she takes in the space, in a sunlit open-plan office at sunrise.
Camera: wide shot that begins a slow push-in as she enters.
Lighting: low golden sunrise through floor-to-ceiling windows — keep the colour temperature consistent with scene 1.
Ends on: her hand resting flat on a desk, centre frame — hold this frame for the final second so scene 3 can match-cut from it.
Audio: footsteps on hard floor and quiet office ambience; no music; no dialogue.
Avoid: additional people, mirrors, reflective surfaces, text, logos, any object she did not carry in scene 1.

Continuity check against scene 1: same blazer, same hair length, same warm temperature. Scene 3 will open on a hand on a different surface.

Node list
1. Stripe Trigger — fires on checkout.session.completed — reads nothing upstream.
2. Notion — Create database page in "Customers" — Email ← $json.customer_details.email; Plan ← $json.metadata.plan; Amount ← $json.amount_total / 100; Date ← $json.created.
3. Slack — Post to #revenue — "New paid signup: {email} on {plan} ({amount} USD)" built from the same fields.

Workflow JSON: attached below, importable; credentials referenced as "Stripe account", "Notion workspace", "Slack bot" — create those three in Credentials before activating.

Error path: Error Trigger workflow "Alerts" → Slack #ops with the failing workflow name, the item's customer email, and the error message.

Test plan: in the Stripe Trigger node, click "Listen for test event", then send a test checkout.session.completed from the Stripe dashboard → Notion shows one row with the four fields → Slack shows one message → execution list shows green.

Smallest v1: this is already the smallest version (3 nodes). Add the welcome email as node 4 next week, after you have watched this run for a few days.

Top 5 unmet needs (67 interviews)

1. Onboarding takes too long — 41 customers
   "I gave up before my first usable result." (I-12) · "Two evenings to set up something I wanted to try in ten minutes." (I-38)
   Trigger: trying the product between meetings, on a phone.
2. Sharing with the team is friction — 33
   "I ended up screenshotting the dashboard into Slack." (I-05)
3. Integration with the existing stack — 29
4. Pricing surprise in month two — 24
5. Progress does not sync between devices — 18

Early signals
- Offline mode — I-12, I-38, I-51: "I'd pay for it to just work on the train." Unprompted in three separate interviews; not noise.
- Public API — I-22 only.

Contradictions
- 14 customers want fewer notifications; 9 want a daily nudge. Both groups are under 30 days in.

Say vs. want
- Say: "more features." Want, from behaviour: the three they already use to be faster. (I-07, I-44)

Follow-ups for next round
1. "What did you expect to have working within ten minutes?"
2. "Who else looks at this, and how do they see it today?"

Ranked causes

1. Creative launch pushed spend into a worse-converting audience (fit: HIGH)
Mechanism: three new creatives entered learning Monday; Meta over-delivers early impressions to cheap, low-intent placements.
Supports: spike begins the same day; recovery by Sunday matches a 5–7 day learning window.
Contradicts: nothing in the inputs — but you have not split CAC by creative yet.

2. Competitor promo raised auction prices Tue–Thu (fit: MEDIUM)
Supports: Tuesday start; CPM data would show it.
Contradicts: the spike started Monday, a day before the promo.

3. +30% budget scale on the top campaign reset learning (fit: MEDIUM-LOW)
Supports: scaling same day. Contradicts: a 30% step rarely resets learning on its own.

Next data cut: CAC and CPM by creative, by day, Mon–Sun. If the three new creatives carry a CAC over $90 on Mon–Wed while legacy creatives stay near $48, cause 1 is confirmed.

Not considered: a tracking gap — check whether the pixel fired normally Mon–Wed before trusting any of this.
Do not: pause the new creatives today. You would destroy the data that tells you which of them is fine.

Subject: Launch moves to the 28th — plan attached

Jamie — I am moving the launch from the 14th to the 28th.

Two reasons. The security review surfaced one issue we want to fix properly rather than patch, and the marketing site needs one more full week of build. The rest of the timeline holds; the partner webinar on the 30th is unaffected.

Already handled: the fix is scoped and owned by Priya; the new site copy is in legal review. I need two things from you — approval of the new date, and a release of the email send that is booked for the 14th.

I will post a five-minute pulse in #launch every morning until the 28th.

— Alex

Questions you will get back:
- "Why didn't we catch the security issue earlier?" → It was found by the external review we scheduled for exactly this reason; that is the process working.
- "What else could slip?" → Nothing on the critical path; the only open risk is legal turnaround on copy, which has a Friday deadline.

Convergence
1. D2C ed-tech CAC has risen 30–40% over 18 months — McKinsey (n=200 companies), a16z note, Coursiv S-1 excerpt. Representative: "blended CAC up 36% YoY" (McKinsey). Confidence HIGH.
2. Subscription outperforms one-time pricing for content products — all four. Confidence HIGH.
3. Trial length matters less than trial-to-paid messaging — three of four; the fourth is silent. Confidence MEDIUM.

Biggest disagreement
McKinsey: auto-renewal optimisation is the largest revenue lever. a16z: cohort-driven retention beats it. Stronger side: McKinsey — 200-company sample versus a16z's four anecdotes, and McKinsey's data is 2025 while a16z's examples are 2023.

The question none of them answers
What happens to LTV when you send an honest reminder before auto-renewal. Likely gap: no operator has run it at scale, and the consultancies are paid by companies that do not want to.

Read or measure next: your own month-3 retention by acquisition channel — every source above assumes it is uniform, and for your decision it is the number that matters.

VOICE OF CUSTOMER — GrowNest (30 reviews, App Store, 3 competing apps)

Top 5 pains
1. "it was fine in the shop and now it's dropping leaves" (11)
2. "I can't tell if I'm overwatering or underwatering" (9)
3. "every blog says something different" (7)
4. "the reminders nag me but never tell me why" (5)
5. "I've killed three of these already" (4) — EARLY SIGNAL: one reviewer, "I'd honestly given up on plants"

Top 5 dream outcomes
1. "finally know what's wrong before it's too late" (8)
2. "it just told me: less water, more light. done." (6)
3. "my monstera actually grew a new leaf" (5)
...
Recurring words: dropping, yellowing, overwatering, "no idea", nag, finally, survive, confident, "too late", simple
Words to avoid: ecosystem, curated, holistic, "plant parent", elevate

Subject: Your pricing page is lying to you
Preview: Three founders raised prices last month. Two regret it.

Headline: The pricing change that costs more than it earns

1. The claim — Raising prices 20% sounds like free margin. For two of three founders I spoke to this month it cut net revenue, because the churn arrived three months later and nobody connected it.
2. The mechanism — Annual customers do not leave on day one. They leave at renewal, which is after you have already celebrated.
3. The numbers — Founder A: +20% price, −11% net revenue by month 5. Founder B: +15%, +9% — the difference was a grandfather clause.
4. What I would do — Raise for new customers only. Measure renewal cohorts for two quarters before touching existing plans.

CTA: Reply with your last price change and the month you measured it. I will tell you if you measured too early.

Cuts the author will push back on: the opening anecdote about the coffee shop (300 words, no number); the second example that repeats the first; "I think" ×6.

Voice rules

- Sentence length: 4–10 words. Never a sentence over 14.
- Tone: dry, mildly self-deprecating, never preachy. "Okay, controversial:" / "Weirdly, the most-asked question this month" / "Sorry. Also not sorry."
- Words used often: actually, okay, weirdly, notes inside, for a real face
- Words never used (peers use them): journey, elevate, unlock, glow-up, self-care, ritual, holy grail, obsessed
- Emoji: one at the end, never mid-caption. 🌿 or 😌.
- Hooks: a contrarian observation stated flat, never a question.
- Closes: one short verdict, no CTA.

New captions (launch week)
1. Most niacinamide serums are water with a marketing budget. Ours isn't. 🌿
2. Okay, controversial: your skin does not need 12 steps. It needs 3 that work.
3. Tested the new cleanser on a real face for 6 weeks. Notes inside.
4. Weirdly, the most-asked question this month: "safe during pregnancy?" Yes.
5. Discontinued the toner. It wasn't pulling its weight. Sorry. Also not sorry. 😌
...
Drift check: #7 uses a question hook; #9 runs 16 words. Cut both.

Done — one change.

Files changed:
- src/pages/Pricing.tsx — added a Monthly / Yearly segmented toggle above the plan cards; yearly shows the discounted price and a "save 20%" tag
- src/lib/pricing.ts — added `yearlyPrice(monthly)`; no other exports touched

Outside the pricing page: nothing. Layout, colour tokens, routes and the dashboard are untouched. I did not reformat Pricing.tsx beyond the inserted block.

Acceptance: toggle defaults to Monthly; switching shows $190/yr under the Pro plan instead of $19/mo, and the tag appears. Verified in preview.

Revert: delete the toggle block in Pricing.tsx (lines 41–58) and the `yearlyPrice` helper.

Weekly briefing — AI search and research tools, 29 Apr – 6 May

1. ChatGPT Deep Research extended to 30-minute runs with export (OpenAI release notes, 2 May) — Why: your "research faster" lesson shows a 5-minute run; the screenshots are stale. Do: re-capture by Friday.
2. Perplexity Spaces adds shared instructions for teams (Perplexity blog, 30 Apr) — Why: your team-research module assumes personal Spaces. Do: a one-paragraph update.
3. Google AI Mode expands to 12 countries incl. DE and ES (Google blog, 1 May) — Why: 40% of your traffic is DE/ES; organic click-through will move. Do: watch Search Console for two weeks.
4. Anthropic raises Claude file limits (Anthropic docs, 3 May) — Why: your "upload 400 pages" lesson can cite a bigger number. Do: nothing yet.
5. Perplexity reported raising at $18B (The Information, 5 May) — unverified, single source — affects nothing you ship.

Safe to ignore: the "AI search is dead" essay — opinion, no data.
Quiet item: AI Mode ad formats mentioned in a Google developer note (4 May) — if ads enter AI answers, your CAC assumptions change in Q3.

1. Three weeks ago it was perfect. Now it loses a leaf every other day.
2. The plant in the shop window is not the one in your living room.
3. You did not do anything wrong. Nobody told you the one thing it needs.
4. It is not the light. It is not the water. It is the third thing.
5. Day 21: the soil is wet, the leaves are yellow, the blog says "just wait".
6. Confession: I killed four of these before I learned to read the leaves.
7. Your plant has been asking for help for two weeks. You just did not speak the language.
8. 80% of dropped leaves come from the same two mistakes. Both are fixable tonight.
9. Still watering on a schedule? That is the thing killing it.
10. The nursery tag said "easy". The nursery tag lied.

Cold landing page: #2 — the contrast is visual and lands in one read.
Warm email: #3 — removes blame, which is what a subscriber who already feels guilty needs first.

Image-to-video, 8 seconds, from the attached reference still.

Locked (must not change): the woman's face, pose and wardrobe; the café table, the window and every object on the table; the cream-and-sage palette; the camera angle and framing; the light direction from the window.
Motion (subtle, continuous): steam rising from the coffee cup; a few strands of hair lifting in a soft breeze; she turns one page of the book.
Timing: the page turn happens once, at second 3; steam and hair are ambient and barely visible.
Camera: static.
Audio: quiet café ambience with distant cups, one soft paper rustle at second 3. No music.

Result: the photograph breathes — the frame is identical to the still at second 0 and second 8; the page turn is the only event. Render 2 of 3 drifted the background chair; rendered again with the same prompt and kept render 3.

Subject: eight AEs, one playbook

Sam — you posted eight AE roles this month, and the Head of Enablement role is still open from April.
Eight new reps and no owner for onboarding usually means ramp drifts past a quarter while everyone is "about to" write the playbook.
Vanta had the same gap last year; our playbook cut their AE ramp from 14 weeks to 6.
Is ramp time something you are measuring this quarter — yes or no?

— Dana

Backup first line (if the roles are filled by send time): "Saw the eight AEs you hired this spring — congratulations, and sympathies for whoever owns their ramp."