Known limitations

Public list of accepted gaps, dual-write warnings, and things this release does not ship. Not an attack guide.

Entitlements

• Read source of truth is user_access.course_ids. orders.course_ids records what was purchased. Junctions order_courses and access_grant_courses are dual-write only.
• Cutting invoker RLS over to access_grant_courses caused permission denied on entitled course loads. Do not repeat that cutover until a dedicated migration grants the right reads.
• public.student_has_paid_course(uuid) is SECURITY INVOKER and must keep reading the array.

Auth

• Leaked-password protection is off until it is toggled in the Supabase Auth dashboard (HaveIBeenPwned). SQL cannot enable it.
• Phone signup is not offered.
• Dark mode and i18n are not shipped. Appearance and language settings UI stay removed.

Payments

• Live checkout is Whish. There is no reservation path and no placeholder provider.
• Refunds are course withdrawal/drop with university documentation only.
• Hobby Vercel uses a daily Whish reconcile cron; webhooks are still the live grant path.

Routing

• Anonymous / → marketing homepage
• Logged-in, no active user_access → marketing homepage
• Logged-in, pending/abandoned/expired/revoked access → marketing homepage
• Logged-in, any currently valid paid plan → /dashboard (proxy + app/page.tsx, no homepage flash)
• Active users may still open /pricing, /courses, public course pages, and legal pages on purpose

Product flags

• Homepage AI Tutor stays Coming soon while workspace_ai_tutor_enabled is off.
• Public leaderboards, XP, tournaments, boss battles, campus petitions, and schedule-upload lockout are retired. Tables may still exist with grants revoked.

SEO

• /robots.txt disallows /dashboard, /my-courses, /admin, /checkout, /welcome, /api/, and auth/dev routes.
• /connects stays indexable. /sitemap.xml lists marketing pages, catalog courses, and connects docs.

Database advisors (accepted)

• INFO rls_enabled_no_policy on archived or server-only tables (orders, payment_events, order_courses, reservations, petitions, XP, tournaments). Grants were revoked.
• WARN multiple_permissive_policies on public catalog tables (admin SELECT plus public/own SELECT).
• INFO unused indexes: do not drop or add indexes on archived tables in this pass.
• WARN auth_leaked_password_protection: dashboard toggle, documented above.

Error catalog (student-facing)

Not in this release

• Junction-table entitlement cutover
• Dropping course_ids arrays or archived tables
• Enabling AI Tutor on the homepage without the platform flag
• Dark mode / language switching
• Playwright suites or new npm packages