Software Updates

7-day send calendar + by-time / by-rank board ordering

• Owner ask: "a calendar view where we can see which ones are being sent within
• what time windows on which dates" and sorting the drafted area "by both the
• planned send date and time and also their ranking".
• The Send-queue strip grows into a collapsible Send-schedule panel: seven day
• columns (Today / Tomorrow / weekday+date), each listing its sends in ET order
• as compact chips — time, name, score — green when approved (sends itself),
• amber when still DRAFT (holds; auto-approve arms it within a tick). Reads as
• the week the cron is about to execute.
• The board's view toggle gains two flat orderings alongside the stage/location
• groupings:
• By send time — the queue exactly as it will fire, soonest first
• By rank — score order; on weekdays the top of this list always owns
• the next slot, so it IS the priority queue
• Both bypass section grouping (one list), and unscheduled rows sink to the end
• of the time ordering rather than vanishing.
• 249/249 tests, scoped tsc clean.

auto-approve due-pinned drafts too — a rewritten email resets to DRAFT, and if its slot is already due it was pinned out of the plan, so approving only planned rows stranded it at a past slot forever

peer-respect voice — condescension banned, research-backed CTA

• Reciprocity: unconditional free value — "the fixes are yours either way".
• Interest-based CTA over meeting demand (Gong response data: roughly 2x replies): offer the twenty minutes, never demand them — "reply and I'll walk you through it. Twenty minutes, no pitch."
• Autonomy / "but you are free" (Carpenter meta-analysis, 42 studies): one explicit release — "no pressure either way".
• Concrete stakes in neutral operational language, no alarm, no blame.
• Peer respect as the governing register: the reader has run their store longer than most agencies have existed; assume they know their business.

send BEFORE re-planning — the re-rank was starving due emails

• First live evening, first live bug: tick at 9:14 PM showed replanned: 25,
• sent: []. A new autopilot lead had arrived, the standing re-rank ran FIRST,
• and it moved the 9:11 due email's slot into the future — so the send step
• found nothing due. With autopilot continuously feeding new leads, a due email
• could be deferred one tick at a time forever.
• Order inverted: an email whose time has come is sent, full stop; planning is
• for the future only. Due-but-unsent rows (a DRAFT past its slot, or overflow
• beyond the per-tick send budget) are also PINNED out of the re-plan so their
• published time stops dancing.

cost guardrails, Sent tab, coverage ledger, relevance-sorted picker

• Owner priorities, in their order:
• 1. COST. No cron fires every 5 minutes anymore, anywhere:
• outreach-send */5 -> */15 (a send lands <=15 min after its slot —
• still "their morning hour"; 96 invocations
• /day, idle tick = 3 light queries)
• prospecting-tick */5 -> */10 (autopilot advances slightly slower)
• refresh-stats */5 -> */30 (a stats cache needs no 5-min freshness)
• outreach-send maxDuration 300 -> 120: the worst case IS the bill on a
• forever-schedule. <=3 PDF renders per tick.
• 2. "Sent · awaiting reply" tab — the waiting room between Ready and a
• conversation. SENT prospects were lumped into "In motion" with
• REPLIED/WON/LOST/CLOSED; now motion means an actual conversation.
• 3. Discovery pass ledger. Every discoverJewelers sweep (manual or autopilot)
• appends one ProspectingDiscoveryPass row (metro, state, campaign, created,
• dup/out-of-area skips) — raw SQL on purpose, no Prisma-client regen.
• Backfilled from prospect history so counts start truthful. New
• /api/admin/prospecting/coverage aggregates passes + prospects per
• state/metro.
• 4. The state picker is no longer alphabetical — the alphabet is not a
• strategy. States sort by Tier-1/Tier-2 metro weight (stateRelevance:
• expected yes-probability), with live coverage in each label:
• "** Georgia . 3 passes, 14 found" — high-value FRESH ground floats to
• the top, swept territory sinks within its band.
• 249/249 tests, scoped tsc clean, eslint clean.

NULL-safe refusal filter — production planned zero sends

• First production tick returned sendable: 0 with 60+ eligible emails. The
• refusal backoff clause — NOT (errorDetail LIKE 'Scheduled send blocked:%'
• AND updatedAt > now()-20h) — hits SQL three-valued logic: errorDetail is
• NULL on every clean row, NULL LIKE x is NULL, NULL AND TRUE is NULL, and
• NOT NULL is NULL, which WHERE treats as not-true. Every clean email was
• silently excluded from re-planning and auto-approval; only rows carrying an
• unrelated old errorDetail would have qualified. COALESCE to ''.
• The send step itself was unaffected (Prisma findMany, no raw SQL) — due
• approved emails would still have gone out on time.

living schedule — standing re-rank, auto-approve, readable rows

• Owner decisions (2026-08-22 evening), all three: 1. THE SCHEDULE RE-RANKS ITSELF. Every cron tick recomputes the whole plan over ALL unsent sendable emails: weekday slots from the top of the score ranking, weekend slots from the bottom. Run discovery on a Wednesday and find a lead that outscores the board -> it takes the next weekday slot and everyone shifts down one. Discovery stays manual; the ordering reacts on its own. Published times stay stable across ticks — the minute-in-hour is a hash of the email id, not a fresh random draw, so times only move when the RANKING moves. Refused sends are pinned out of the re-plan for ~20h so their backoff holds instead of hot-looping. 2. AUTO-APPROVE (PROSPECTING_AUTO_APPROVE, default on): every scheduled, fact-check-passed draft is approved automatically — by the cron for new arrivals, and backfilled now for the existing board (45 approved on top of the prior 17). Every send-time gate still runs at send. Set the env to "false" to restore per-email human sign-off. 3. READABLE ROWS. The single-line row let the action cluster crush the name to zero width — the board read as anonymous chips. Rows are now two-line cards: line 1 is the NAME (truncating, never wrapping) + score + status + Open; line 2 is meta (location
• reviews
• email
• campaign
• evidence
• AI cost) with the send-time badge and actions on the right. 249/249 tests, scoped tsc clean, eslint clean.

two more machine-tells the filters missed

• "your homepage capture showed 0 visible prices" — the capture pattern only covered the/our/a as determiners, so "your"/"this"/"that" slipped by.
• "0 price(s) in product-page HTML" — the parenthetical plural is pure machine text; nobody types "price(s)" in a one-to-one email. New MACHINE_PLURAL check.

scheduled send cadence — hourly slots, best-first weekdays, worst-first weekends

• The owner's cadence, now automatic: Mon-Fri: one send per hour, 8 AM-8 PM (12/day), BEST leads first — the highest score gets Monday 8 AM. Sat-Sun: one send per hour, 10 AM-10 PM (12/day), WORST leads first, starting from the very bottom on Saturday. All hours are the RECIPIENT'S own wall clock (STATE_TZ; Eastern fallback), and the minute within the hour is randomized so the pattern never looks mechanical. assignSendSlots (schedule.ts) is a pure function over one ranking consumed from both ends
• weekday slots from the top, weekend slots from the bottom
• with Canadian provinces excluded up front (CASL; a slot would be a lie the send gate exposes later). 10 deterministic tests pin the windows, the orderings, the timezone math (incl. UK/BST), and the CASL skip. /api/cron/outreach-send (every 5 min): 1. assigns slots to newly sendable emails, APPENDING after the last planned slot so published times never shuffle; 2. sends due emails
• ONLY those a human has APPROVED. A slot is a plan, not consent: a DRAFT that reaches its time just waits, shown as "missed
• approve to send". Gate refusals are recorded and pushed +24h so the cron never hot-loops on a blocked email. Every send still passes the full gate chain (fact-check, suppression, CASL, twin guard, daily cap, attachment integrity, TEST_MODE reroute). Every lead row now shows its plan: "sends Mon, Aug 24, 9:46 AM (their time)", red when the slot passed un-approved. scheduledFor was an existing unused column
• no migration needed. DAILY_SEND_CAP default 10 -> 12 to match the cadence (the scheduler is the pace; the cap is the backstop). Initial assignment run against production: 69 leads scheduled Sat Aug 22 -> Wed Aug 26, zero skipped. Saturday opened with the three lowest scores; Monday 8 AM opens with the 90s. 236/236 tests (10 new), scoped tsc clean.

repair near-misses instead of discarding researched emails

• repairSubject: takes the first real clause, caps it, falls back to a plain note line only if nothing usable survives.
• repairSelfDescription: splits the welded appositive into two sentences.
• Retries go 2 -> 3, each carrying the specific failures back to the model. Anything still failing is a real content problem and still gets the fallback.
• `jewell?ery` matches "jewellery" and "jewelery" but NOT the American "jewelry" — so every one of these rules was half-blind on US prospects, which are most of the board. Now `jewell?e?ry`.
• GARBLED_SELF_DESCRIPTION matched the CORRECT predicate form ("We're a jewelry house ourselves, and we built this for our own store first") as well as the broken appositive one ("at Katura, a jewellery house ourselves, which is why"). It would have rejected 52 perfectly good emails on the next generation. Narrowed to require the comma before the article, and the correct form is now asserted ACCEPTED and never rewritten.

build the cold email to land in Primary, not Promotions

• From name is now the PERSON ("Zachary Rosser"), matching how the body signs itself. "Zack — Katura" reads as a brand to the recipient and to the tab classifier alike.
• List-Unsubscribe + List-Unsubscribe-Post (one-click), which Gmail's and Yahoo's bulk-sender rules expect — its ABSENCE is the violation.
• Brevo's open-tracking pixel and link rewriting switched off (X-Mailin-Track/-Track-Links). A 1x1 beacon and rewritten redirect links are two of the loudest "this is marketing" signals available, and neither is worth anything on one-to-one mail whose replies we read by hand. (Brevo needed a `headers` field to carry any of this; it now has one.)
• Subject-line spam triggers rejected deterministically (free, guarantee, act now, %-off, $-amounts, emoji, !!/??, ALL CAPS).
• Subject-only failures are now REPAIRED rather than fatal. The model pasted a 16-word page title into Farrah's subject and the whole researched body was discarded for it; repairSubject takes the first real clause, caps it, and falls back to a plain note line.

the email must say who is writing (I banned that by accident)

• FORBIDDEN_OPENING applies to the FIRST SENTENCE only — the first line still belongs to the recipient, not to us.
• SELF_INTRODUCTION is REQUIRED in the first 60% of the body: a name, or a plainly stated role at Katura. The body must also name Katura at all.

regeneration must retire the first-touch draft it replaces

• Regenerating a deck CREATED a new step-1 email and left the previous one
• DRAFT. Prospects had quietly accumulated up to four competing first-touch
• emails — Diamond Gems and Rand Jewelers had four each, Koorosh, Mitchell's,
• Premier, Skeie's, Underwood's and Viir three — every one of them still
• sendable, and all but the newest written to a superseded spec.
• The console renders the newest, so this was invisible. It was not harmless:
• any older row could still be opened, approved, or picked up by a bulk action,
• and the voice rewrite only reached the newest row per prospect, so 46 stale
• agency-voice drafts were sitting behind ready-to-send prospects.
• Creating a first touch now cancels the open ones it supersedes, inside the
• same transaction. SENT rows are never touched — those are the outreach record.
• Backfilled the same rule over existing data: 46 superseded drafts cancelled,
• leaving exactly one open first-touch per prospect (70/70).
• 209/209 tests, scoped tsc clean.

make the two send buttons impossible to confuse, and prove it

• is red, not black, and prints the actual recipient on its face ("Send LIVE → owner@example.com")
• requires a confirm naming the address, business, subject, and whether the PDF rides along, and says plainly that it cannot be recalled Test send now reads "Test to my inbox only" and its success alert states that the prospect was not contacted.

retry near-misses, and keep the machinery out of the inbox

• Two problems the first live rewrites exposed.
• 1. A genuinely bespoke email was being thrown away over a nine-word subject
• against an arbitrary eight-word cap — and the prospect got the canned
• fallback instead. The subject band was never part of the voice spec, so it
• is now 3–10; more importantly, a rejected draft now gets ONE retry with the
• deterministic failures handed back ("your subject is 9 words, fix it, keep
• everything that was working"). Most rejections are near-misses, and
• discarding them is precisely how 59 prospects end up with one identical
• template.
• 2. The first clean output read: "the validated dataset only surfaced homepage
• title work". That is internal pipeline vocabulary in a jeweler's inbox — it
• tells the reader a SYSTEM looked at their business, not a person, which
• undoes the entire premise of the email. Banned deterministically
• (validated dataset, evidence rows, structured metrics, storefront capture,
• fact-check, "our data shows") and called out in the writer rules.
• POSH Fine Jewelers before: rejected, generic fallback.
• After: 165 words, 4 paragraphs, opens on "4.8 stars with 100+ reviews as
• observed on 2026-08-22", states an opinion, gives away a specific homepage
• title fix, asks for twenty minutes.
• 203/203 tests.

an API failure must not overwrite a bespoke email with the template

• Discovered while regenerating the ready-to-send emails: the OpenAI balance is
• exhausted, every rewrite call 429s — and rewriteFirstTouchEmail treated that
• exactly like a spec violation, writing the canned fallback over the existing
• draft. One sweep would have flattened all 59 individually-researched emails
• into the same generic paragraph, losing "504 Google reviews at 4.8" and every
• other specific the whole spec exists to surface.
• Now the two cases are separated. A model answer that VIOLATES the spec still
• earns the fallback; a model/API FAILURE returns outcome "failed" and leaves
• the stored draft untouched, so a transient 429 costs nothing.
• RewriteResult also carries `failures[]` now — the reason an attempt was
• rejected. Without it a fallback is indistinguishable from a rate limit, and
• "every prospect got the identical template" is exactly the failure this
• system must never hide.
• 203/203 tests.

adopt the Virgil first-touch voice spec across every layer

• compose: greeting is now "Hi Farha —" / "Good afternoon —". It no longer introduces the sender — his name is in the signature, and the opening line is the only one with the reader's full attention. Greeting stays compose-time so the name can still only come from contact-safety's confirmed-and-cited check; the writer can never guess one.
• validator: 110–200 words (spec target 120–180), 3–6 paragraphs (mobile readability is part of the spec — the old emails were one block), 4–14 sentences. Plus four new deterministic bans: agency jargon (the full banned-phrase list), self-introducing openings, fabricated familiarity ("followed your company for years"), and faux-passive CTAs. A prompt alone does not hold a voice; the model drifts back to agency register under pressure, which is how the Farrah email shipped.
• writer + auditor prompts rewritten to the same spec, and the auditor is now told the opinionated operator voice IS the specification, not a defect, so it judges only whether factual claims are supported.
• rewriter now receives the CAPTURED EVIDENCE ROWS (exact ratings, counts, dates) rather than only the summary sentences — specificity is what makes these land — at temperature 0.75, since 59 near-identical emails read as a template.
• safe fallback rewritten to the same voice, and verified to satisfy the validator it is the fallback for.

"never audited" is not "passed" — close the unaudited-send hole

• Found while verifying the post-sweep board: Luxor Fine Jewelry sat in READY
• with a drafted first-touch email and the proposal PDF attached, despite its
• deck carrying no fact check at all.
• Both the approve route and the send path gated on `passed === false`. A deck
• with NO independentFactCheck block satisfies "not failed", so every pre-gate
• legacy deck could be approved and emailed to a real jeweler with an unaudited
• PDF attached — precisely the outcome the fact-check gates exist to prevent.
• Now an affirmative pass is required, and the rule lives in ONE exported
• function (factCheckGate) that both the approve route and the send path call.
• Two hand-maintained copies of a rule is exactly how today's stale-auditor bug
• happened; this one gets a single truth and 7 regression tests instead.
• The console predicate matches the API: an unaudited deck now shows under
• "Needs fix" rather than promising a send the server would refuse.
• Blast radius verified against production: 59 audited-and-passed decks are
• unaffected; exactly 1 deck (Luxor, a V1-era proposal) moves to Needs fix,
• where the Reassess button regenerates it under current gates.
• 187/187 tests, scoped tsc clean.

make dark mode actually dark, across every page

• hsl(var(--token)) is INVALID here — the tokens hold oklch/hex, so the declaration was dropped and Recharts fell back to white tooltips, #ccc grids and black axis ticks on navy. 30+ instances across charts.
• gradients (background-image beats the sheet's background-color)
• SVG stroke/fill literals, chart colour props, prose without dark:prose-invert
• email-body iframes whose sandboxed HTML sets dark text but no background

heal the UK run — stale auditor rule, city-name collisions, rule drift

• validator banned "ninety-day/roadmap" mentions the auditor requires — ban now applies only in attachment-free mode
• validator/fallback now invert cleanly when FIRST_TOUCH_ATTACH=false (no more emails claiming an attachment that isn't there)
• send path: resolveEmailAttachment is now genuinely the single truth (real send, test send, preview), plus a words-vs-wire gate — a body claiming an attachment can never send without one
• stage-2 proposal email no longer writes its own greeting/sign-off (compose adds both; they were doubling on the wire)
• stale "NO ATTACHMENT" badge/comments across the console and routes

territory tiers, jeweler-not-agency voice, previews, 6-up runs

• Metros are now RANKED by yes-probability — curated tiers combining
• spending power with win likelihood (affluent, independent-jeweler-rich,
• under-pitched markets like Scottsdale, Naples, Charleston rank 1;
• pitch-saturated megacities sit at 2; thin markets at 3 — documented as
• editable judgment). Everything consumes the ranking: pickers list
• best-first with T1/T3 badges, state sweeps and Autopilot rotation spend
• attention tier-1-first.
• Identity, everywhere the words are written: Katura is a JEWELRY
• BUSINESS that does everything in-house — never an agency. The rule
• leads the email prompt, the rewriter persona states it, and a
• deterministic validator ban rejects agency framing outright.
• In-site email preview: an Eye button on every row renders the EXACT
• composed email (greeting, signature, opt-out) in a sandboxed frame with
• the attachment truth — the PDF is really rendered so the chip shows its
• true size, and blocked attachments say exactly why. One shared
• resolveEmailAttachment is now the single truth for send, test-send,
• and preview.
• Console: up to six concurrent Autopilot runs in a three-across grid,
• and the entire admin nav collapses ChatGPT-style via a slim edge strip
• (persisted per browser) so every admin page can run full-width.

the outreach email becomes a real letter, and duplicates die

• The test email exposed everything wrong at once: the deterministic
• fallback shipped a mid-clause fragment ('…a third-party store listing
• that states.'), zero context or introduction, no PDF, a bare signature,
• and the raw [SET PROSPECTING_POSTAL_ADDRESS] placeholder in the footer.
• Now: every email opens 'Good morning, {Name} — my name is Zack.' in the
• RECIPIENT's local time (state→timezone), the writer produces a fuller
• 70–130-word letter (one line of who-Zack-is context, the strongest
• verified observation, the strength worth keeping, a casual reference to
• the attached proposal, a soft CTA — no compliance hedging in the pitch
• voice), and the proposal PDF rides on the first email by owner decision
• (PROSPECTING_FIRST_TOUCH_ATTACH=false reverts). The signature mirrors
• the admin/mail card — wordmark, Zachary Rosser, gold EST. 1999 line,
• mailto — and the opt-out is one 10px italic line that hides the postal
• address until a real one is configured. The fallback is rewritten with
• clause-safe trimming (a fragment that doesn't fit whole is dropped, not
• cut), 'Regen all emails' refreshes every un-sent draft from its audited
• proposal content for ~1–3¢ each, and APPROVED drafts reset to DRAFT.
• Duplicate protection hardened on the mid-flight question: discovery
• dedupe is now GLOBAL (any campaign — concurrent jurisdiction runs made
• cross-campaign duplicates likely), and a send-time twin guard refuses
• to email a business any other prospect row already reached at the same
• domain or address.

multi-run console, cost chips, auditor round-two fixes

• The reassess sweep exposed a second failure class: the auditor put
• advisory commentary ('this is acceptable… but would be cleaner') in
• unsupportedClaims, failing decks that passed every structured check.
• Pass/fail is now reconciled deterministically — structured ledger
• verdicts + contradictions are ground truth; prose advisory notes become
• non-blocking research guidance. Auditor prompt gains discipline rules
• (only genuine failures in unsupportedClaims; rhetorical transitions are
• framing); writer is barred from review counts in copy assets without
• validated evidence and from truncating proper nouns; site-fetch treats
• 4xx homepages as unreachable (a 403 bot-wall's title once scored as a
• passing tag). Console: the Autopilot card renders up to three stacked
• live run panels (per-run stop, activity, CASL/PECR territory notes,
• auto-distinct campaign tags), and every prospect row shows its
• attributed AI cost with tokens in the tooltip.

concurrent autopilot runs, CA/UK jurisdictions, cost attribution

• Up to three Autopilot runs may now run at once, one jurisdiction each:
• budgets are metered per campaign (every AI spend path — discover,
• enrich, validate, write, audit — now tags the campaign in the usage
• ledger; the migration is applied to the live DB), so concurrent runs
• can never consume each other's budgets, and the runs API enforces
• distinct campaigns. Six Canadian provinces and the UK join the
• territory map as an experiment — with the compliance line drawn in
• code: CASL blocks cold email to Canadian prospects at the send gate
• (their decks feed the physical-mail channel), while UK B2B email is
• permitted under PECR corporate rules. The prospects list now ships
• per-prospect attributed AI cost (cents + tokens) from the ledger.

prospecting console: tabs + per-row send actions

• The pipeline is now organized by what to DO next, not by raw status:
• Ready to email (verified channel, clean deck, drafted email) · Needs
• fix (fact-check failures, contradictions, needs-research) · Research ·
• Mail only · In motion · All — live counts, group-by preserved within a
• tab. Every row carries 'Test → my inbox' (full-fidelity test send, no
• mutations) and 'Send real' / 'Approve & send' with confirm dialogs —
• server gates stay authoritative, errors surface verbatim. The list API
• now ships generationStatus so tab predicates read the real field.

fix the fact-check's false-positive patterns

• Reviewed all 12 failed fact-checks in the database; five patterns, four
• of them auditor false-positives: (1) the auditor was never told the
• prospect's identity, so legitimate references to the known city/state
• (Underwood's 'Fayetteville', Porterfi's 'Rocky River') failed as
• unsupported — it now receives a PROSPECT CONTEXT FACTS block that is
• established ground truth; (2) properly date-hedged absence statements
• ('we did not identify X in our review on [date]') were demanded to have
• positive evidence, inverting their meaning — the auditor now judges
• them on scope discipline; (3) writer overreach on page layout ('only in
• navigation', 'above the fold') is now prohibited unless evidenced; (4)
• comparative industry flattery ('stronger than most independents') is
• banned; (5) site-fetch described a 404'd sitemap as 'present but weak',
• which the auditor rightly flagged — HTTP 4xx observations now phrase as
• absences.

marketing site: audit fixes — the funnel now survives its own success

• The reply loop was the weakest link: both funnel emails inherited a
• BREVO_FROM_EMAIL whose historical default is a dead @katura.com address,
• and lead notifications defaulted to unmonitored marketing@. Emails now
• send from an explicit verified marketing@katura1999.com with replies
• routed to zack@ (which exists and is watched), notifications default to
• zack@ with reply-to set to the lead, submissions populate the indexed
• email/name columns, dedupe keys on the column and per-offer, and the
• tenant fallback uses tenant zero's real id instead of a nonexistent FK
• that 500'd on submit.
• Attribution: the EN/PT switch preserves the query string (the promised
• SwitchLocaleLink finally exists), the lead form captures attribution on
• mount instead of first focus, and proposal-PDF clicks carry
• utm_source=proposal — they were the funnel's one unattributable entry.
• Rendering and SEO: PT pages get html lang=pt via a pinned x-pathname in
• the marketing proxy branch (EN pages immune to stale locale cookies),
• OG/Twitter images added, six double-branded titles deduplicated, KPI
• cells align and the 5th card no longer leaves a gray hole on phones,
• FAQ heading localizes, storefront chrome (invoice popup, support
• hotkey) stays off the funnel, sitemap lastmod is stable, JSON-LD
• jobTitle matches 'Director of Brand & Growth', thank-you copy is
• offer-neutral, wa.me numbers sanitize to digits.
• Truth locks: CAMPAIGN_DURATION_DAYS derived from the dates (= 7) plus a
• test that fails if any prose surface ever says six-day/seis dias or
• frames the $498.39 campaign as a test again; the stale implementation
• brief carries a correction banner; PT terminology unified.

marketing site: the Charleston campaign was seven days, and not a test

• June 1–7, 2026 — corrected at the single source of truth
• (case-study.ts campaignEnd + qualifiers) and in every en/pt copy
• surface that described Katura's own campaign as a 'six-day test'. The
• collection-launch service's testing methodology language is unchanged —
• that describes the offering, not our campaign.

verify discovery-claimed emails automatically, honest badges

• Two mail-only states looked identical and one was fixable by machine:
• an email on file whose source was never cited (discovery-claimed) vs no
• email at all. Site capture now upgrades unverified addresses in place —
• published on the prospect's own site ⇒ published_source (Da Vinci Fine
• Jewelry verified this way); otherwise the cited source page itself is
• fetched and, when it visibly contains the address, third_party_verified.
• Bot-walled sources (J.P. Haase's allbiz 403) honestly stay unverified
• for the manual confirm flow. Badges split: amber '✉ UNVERIFIED EMAIL'
• with the fix in its tooltip vs stone '📮 MAIL ONLY'; the pipeline's
• mail-only notation now says which case it is.

email-first economy, personal email format, reassess for old decks

• Reachability by VERIFIED email now dominates scoring: only a
• source-cited address counts (22/25 pts), an unverified one scores 10,
• and none at all caps the tier at C and routes the prospect to a
• mail-only bucket — notated on the record, no deck money spent (autopilot
• and Process All both honor the gate; single-prospect runs may override
• for the physical-mail channel). Site capture becomes the token-free
• email finder: addresses visibly published on the prospect's own pages
• are adopted as published_source contacts automatically.
• Outreach emails now read like a person wrote them: client-default
• typography, no logos or headers, greeting by the verified first name
• only, Zack's three-line signature (CTO, Katura 1999 / K99 Jeweler
• Services), and a small italic reply-'remove' line with the postal
• address instead of an unsubscribe button — bare 'remove' replies
• auto-suppress. A 'Send test to my inbox' button delivers the exact
• composition (PDF included per attachment policy) from DRAFT and in live
• mode, mutating nothing.
• Older decks are refreshable: 'Reassess with current engine' on any
• proposal, plus a bulk 'Reassess pre-gate decks' sweep for proposals
• that predate the claim-ledger gates.