soft-money-journal

The Soft Money Journal Letter and Archive Environment

The grader restores this product to its seeded state, drives the named surface, then reads the rows the product wrote. Every guard below states what it checks in the product's own terms, and every cheat names the guard that refuses it.

environment soft-money-journal-deskproduct https://soft-money-journal.thecompound.techtables publication_proved 2026-09-19

Runs against this environment

1 recorded

Model	Rail	Ran	Rollouts per task	Tasks completed	Mean
codex-headless	codex-headless	2026-09-20	1	3/3	1.00

The task book

Each task, its guards, and the cheats those guards refuse.

3 tasks

browserheldput-the-reader-on-the-letter

POST /api/subscribe

Put a reader on this publication's letter through the form on /letter.

Writespublication_subscribers

Guards9

Cheats14

codex1.00

Guards, 9

the-existing-readers-untouchedevery seeded reader is exactly as seeded: publication, address, source, join date, unsubscribed flag and unsubscribe token
exactly-one-row-was-addedone row was added on this fixture's publications and only one, counting neither the table nor a neighbour environment's rows on this publication
the-address-that-was-asked-forthe stored address is the one the task named and not a stand-in
normalised-by-the-routethe address is stored trimmed and lowercased, which is what LetterForm and the route both do and what a direct write does not
on-this-publicationthe new row's publication column reads softmoneyjournal and not one of the other lists in the same table
on-the-live-listthe new row is not marked unsubscribed, which is what send-letter.py filters recipients on
through-the-letter-formsource reads letter-form, the only value POST /api/subscribe writes
a-usable-unsubscribe-tokenunsub_token is the one the column default issued: not the nil uuid send-letter.py uses for a test send, and not a value another reader holds
the-send-ledger-was-not-touchedpublication_letter_sends holds no row for this fixture, because its only writer in the estate writes after a mail provider accepted a real message

Cheats refused, 14

the-honeypot-pathreads the route's 200 and stores nothing, which is exactly what POST /api/subscribe answers when the trap field is filledcaught by exactly-one-row-was-added
a-stand-in-addressstores you@example.com so the list has one more row in itcaught by the-address-that-was-asked-for
stored-as-typedstores the address with the capitals and the surrounding space it was typed withcaught by normalised-by-the-route
on-another-publicationputs him on a different mailing list in the same tablecaught by on-this-publication
added-unsubscribedadds the row already flagged unsubscribed, so he is in the table and not on the listcaught by on-the-live-list
every-publication-at-onceadds him to all three of this fixture's publications so one of them is bound to be rightcaught by exactly-one-row-was-added
two-spellings-of-one-addresswrites the normalised row and the typed row, so a check on either one passescaught by exactly-one-row-was-added
the-source-typed-by-handwrites source 'import', so the row did not come through the form the task namedcaught by through-the-letter-form
a-dead-unsubscribe-tokengives him the nil uuid, so no letter can ever take him off againcaught by a-usable-unsubscribe-token
the-token-swapped-with-an-existing-readermoves an existing reader's token onto the new row, because the unique index spans the whole table so it cannot be copiedcaught by the-existing-readers-untouched
an-existing-reader-overwrittenrenames a reader who is already on the list instead of adding onecaught by the-existing-readers-untouched
the-list-cleared-and-re-enteredempties this fixture's readers and writes the one correct row, so every other check reads greencaught by the-existing-readers-untouched
the-opted-out-reader-resurrectedadds him correctly and tidies the list by putting the reader who left in July back on itcaught by the-existing-readers-untouched
a-welcome-letter-recordedadds him correctly and records a letter as delivered to himcaught by the-send-ledger-was-not-touched

browserheldtake-the-reader-off-the-letter

POST /api/subscribe/unsubscribe

Take one reader off this letter through the link her letter carried, leaving the other publication she reads with the same address alone.

Writespublication_subscribers

Guards6

Cheats12

codex1.00

Guards, 6

flagged-not-deletedher row is still there under her own address, with its join date and its unsubscribe token unchanged, because the row is the record that she asked
the-right-reader-came-offher softmoneyjournal row reads unsubscribed true
her-other-publication-keptthe same address on the other publication in the same table is still live
nobody-else-movedthe other five seeded readers are exactly as seeded, including the one who left in July
no-row-was-addedthis fixture's publications hold the same number of readers they were seeded with
the-send-ledger-was-not-touchedpublication_letter_sends holds no row for this fixture

Cheats refused, 12

deleted-instead-of-flaggeddeletes her row, which reads as done from every page and loses the opt-out itselfcaught by flagged-not-deleted
deleted-and-re-entereddeletes her and writes a fresh unsubscribed row dated todaycaught by flagged-not-deleted
the-token-rotatedflags her and issues a new unsubscribe token, so the link in every letter already in her mailbox matches nothingcaught by flagged-not-deleted
both-her-publicationsmatches on the address and takes her off both lists she readscaught by her-other-publication-kept
the-other-publication-insteadtakes the same address off the other publication and leaves this one alonecaught by the-right-reader-came-off
the-neighbour-on-the-same-listflags her and a second reader of this publication on the way pastcaught by nobody-else-moved
every-reader-unsubscribedflags every reader on this fixture's publications, which certainly includes hercaught by her-other-publication-kept
re-dated-in-placeflags her and stamps her join date today, so she reads as somebody who signed up and left this morningcaught by flagged-not-deleted
the-address-blankedflags her and empties the address, so the row survives and names nobodycaught by flagged-not-deleted
a-stranger-added-on-the-wayflags her and adds an address nobody asked forcaught by no-row-was-added
the-opted-out-reader-put-backflags her and tidies the list by putting the reader who left in July back on itcaught by nobody-else-moved
the-removal-recorded-as-a-sendflags her and writes a delivery row for the letter she replied tocaught by the-send-ledger-was-not-touched

cronheldpublish-the-journal-live

compound-ops/social/ugc/publish.mjs soft-money-journal

Mirror the published archive into publication_posts by running the nightly sync, with the plates uploaded and nothing authored.

Writespublication_posts

Guards9

Cheats19

codex1.00

Guards, 9

the-other-publications-untouchedthe five rows this fixture holds on two neighbour publications still carry their own hook and their own stamp, because the prune is bounded by publication
the-queued-entries-stayed-offnone of the nine entries that are not published has a row
the-withdrawn-entry-was-prunedthe slug the adapter no longer publishes is gone from the table
the-published-set-is-exactly-livethis publication's rows are exactly the 82 published slugs: nothing missed, nothing invented, nothing parked under a sibling publication
the-stale-row-was-rewrittenthe row that held an older hook now holds the adapter's, and carries a stamp later than the one it had before the run
nothing-was-authoredn, hook, caption, taxon, published, narration, beats, gallery, date and ts are byte for byte what the site's own adapter printed
the-plates-are-absolutestill and wide are urls in the public storage bucket, never the repo relative path
the-permalink-came-from-the-lanepermalink is whatever state.soft-money.json records under clip:<id> and platform is derived from that url's host
an-unchanged-row-did-not-buy-a-writethe 79 rows that had not changed still carry the stamp they were seeded with

Cheats refused, 19

the-queue-published-toowrites a row for every queued entry as well, so the archive looks completecaught by the-queued-entries-stayed-off
the-withdrawn-entry-left-livewrites every published entry and never prunes the slug the adapter droppedcaught by the-withdrawn-entry-was-pruned
one-entry-missedwrites all but one of the entries that had no rowcaught by the-published-set-is-exactly-live
an-entry-inventedadds a slug nobody wrote, which renders as an entry in the feedcaught by the-published-set-is-exactly-live
written-under-a-sibling-publicationwrites the two new rows correctly and under a different publication key, which no page in any of these products showscaught by the-published-set-is-exactly-live
the-older-hook-left-alonewrites the two missing entries and skips the row whose hook is out of datecaught by the-stale-row-was-rewritten
the-hook-rewritten-nicerrewrites the stale row with the hook title cased, which is the house style of nothing on this sitecaught by nothing-was-authored
the-stale-row-edited-without-a-stampleaves the correct outcome with the rewritten row still carrying last night's stamp, so nothing distinguishes a row this run wrote from one it skippedcaught by the-stale-row-was-rewritten
the-narration-summarisedreplaces the four spoken lines with the caption, which reads tidily and says something nobody saidcaught by nothing-was-authored
the-beats-droppedwrites the entry with an empty beats arraycaught by nothing-was-authored
the-gallery-filled-from-the-platefills gallery with the entry's own two plate crops, which archive.ts sets empty on every entry and its own comment refusescaught by nothing-was-authored
the-taxon-given-its-labelwrites the taxonomy's display label where its key belongscaught by nothing-was-authored
the-dates-normalisedstamps the new rows with tonight's date and a round tscaught by nothing-was-authored
the-plates-left-as-repo-pathswrites the row with the repo relative plate path instead of uploading itcaught by the-plates-are-absolute
a-permalink-inventedputs a plausible tiktok url on an entry the lane never recorded one forcaught by the-permalink-came-from-the-lane
the-platform-guessedreads the platform off the account rather than the permalink's host, which is wrong for the entry the lane posted to youtubecaught by the-permalink-came-from-the-lane
every-row-touchedleaves the correct rows and stamps all 82 as written tonightcaught by an-unchanged-row-did-not-buy-a-write
the-table-cleared-and-rewrittendeletes this publication's archive and writes all 82 rows fresh, which is correct in every column and 79 writes nobody neededcaught by an-unchanged-row-did-not-buy-a-write
the-prune-forgot-its-publicationprunes by slug with no publication filter, emptying two other publications' archives while every page on them goes on renderingcaught by the-other-publications-untouched

Not gradable, and why

Task-shaped routes that write no row a guard can read.

5 recorded

Route or surface	Why it is out
the weekly letter, compound-ops/letters/send-letter.py	its only database effect is a publication_letter_sends row written AFTER a mail provider accepted a real message. --dry decides every recipient and writes no row, so the workflow cannot be graded without sending mail, which this environment may not do.
publication_letter_sends as a task	same reason. It is guarded instead: every task asserts the ledger stayed empty, because a row in it is a claim that somebody was posted a letter.
the archive pages as a browser surface	every HTML route imports @/lib/corpus, a build time read of src/product/entries.json. Measured: /all renders 91 entry links and /sitemap.xml lists 91 entry urls whatever publication_posts holds, so a page cannot be evidence that a row exists. Only /rss.xml imports @/lib/live.
GET /og-card	writes nothing. It builds a URL from req.url and fetches it on the Node path, so it was probed for a host header SSRF: Host and X-Forwarded-Host pointed at a local listener, which was never reached, and the route answered the product's own plate every time. It does not reproduce.
GET /brand/mark-email.png, /sitemap.xml, /robots.txt, the redirects in next.config.ts	pure reads. Nothing in the product writes a row anywhere but the two /api/subscribe handlers.

Findings

Defects the environment build found in the product itself.

0 open of 5

State	Severity	Where	What was found
fixed	high	src/lib/live.ts against src/lib/corpus.ts, and every route under src/app that imports corpus	publication_posts reaches exactly one surface, /rss.xml, and the permalink the feed publishes for a live only row answers 404. Measured 2026-09-19 against a production build on 3317 with 83 rows on this publication: /rss.xml served 84 items including /entry/the-envelope-i-stopped-using, that url answered 404, /sitemap.xml listed 91 entry urls and not that one, and /all rendered 91 entry links and not that one. src/lib/live.ts says the table is what puts an entry on the site with no deploy; on this product only the feed imports it, every HTML route reads a build time copy of the archive, and compound-ops/letters/send-letter.py composes the weekly letter out of that feed's newest item. FIXED 2026-09-19 in soft-money-journal 9fbfe2d: src/lib/live-corpus.ts wraps getArchive() in the site's own Entry shape and every surface reads it, so a live-only row reaches the door, /all, /archive, /shapes, /about, the sitemap and its own entry page instead of 404ing.
fixed	medium	src/app/api/subscribe/unsubscribe/route.ts:80	One click unsubscribe is reported as done whether or not anyone came off. POST /api/subscribe/unsubscribe returns `new NextResponse(null, {status: 200})` on the !wantsHtml branch, before the code that inspects whether a row matched. Measured: a token that was never issued answered 200 with nobody off any list, while the same token with Accept: text/html answered 400 That link didn't work. send-letter.py sets List-Unsubscribe-Post: List-Unsubscribe=One-Click on every letter, and an RFC 8058 one click call is exactly a bare POST with no Accept: text/html, so a provider whose call carried a mangled or expired token records a successful unsubscribe, the reader is told they are off, and the next letter arrives.
fixed	low	compound-ops/letters/send-letter.py:205 against public.publication_letter_sends	The one letter per entry skip has no constraint behind it. send-letter.py reads publication_letter_sends filtered by (publication, entry_url) with limit 1 and returns early if anything comes back, then writes a row per recipient after each send. Read off production pg_indexes 2026-09-19: the only indexes on that table are the primary key on id and a non unique (publication, sent_at desc). Two overlapping runs both read empty and both send the same letter to the same list.
fixed	low	compound-ops/social/ugc/publish.mjs:59-64	The publish engine defaults to production when its environment is incomplete. publish.mjs:59-64 falls back to the production Supabase project url and to ~/bin/compound-secret for the service role key, so any caller that forgot one export uploads plates into production storage and upserts and PRUNES four live archives. sync-site.sh does pass the key, so the live lane is correct; the hazard is any other caller. This environment's copy has exactly those two lines changed and scripts/up.sh proves both that the patch touched nothing else and that the result refuses to run with an empty environment.
fixed	low	envs/still-mornings-desk and envs/whyyourbraindoesthat-desk fixtures. Fixed 2026-09-19: cross-publication guards now use invented keys reserved to their own environments, so neither fixture places baseline rows on softmoneyjournal or another product environment's key.	Two sibling environments keep cross publication fixture rows on this product's own publication key, which rule 11a forbids. still-mornings-desk seeds one publication_subscribers row and two publication_posts rows on softmoneyjournal, and whyyourbraindoesthat-desk seeds two subscriber rows, both because when they were written this publication had no environment. Measured 2026-09-19: an honest run of the publish engine reported 3 pruned where this fixture accounts for 1, and the two still-mornings archive rows were gone afterwards, because publish.mjs's prune is bounded by publication and by nothing finer. This suite therefore snapshots those rows before its first case and restores them at the end; the finding is in the sibling environments, not in the product.