Build Log

MedinaCHF Home Address — A Shared Field, and a Live Production Risk Found Along the Way

August 16, 2026

Added a private home address to the shared member/family record for Courtney's next onboarding test, then found and fixed a real production-risk bug in the app's Google Fonts dependency along the way.

MedinaCHFSchemaPrivacyDeployInfrastructure

new private address columns on the shared families record

surfaces wired: Leadership Add/Edit Member + Member My Profile

real production-risk bug found and fixed: Google Fonts CDN dependency

databases updated and independently verified: dev + prod Neon

Timeline

Start

Received Courtney's Charge — home address on the shared member/family record

Read HOW_TO_WORK_WITH_ZEB.md + PROJECT_INDEX.md, ran OS pulse check (Environment & Config flagged hot — 3 spins/3 sessions), oriented against the actual MedinaCHF codebase before touching anything

Orient

Traced the existing shared-record pattern (spouse/phone/birthday) through schema, actions, queries, and both UI surfaces

Confirmed FamilyCard/toFamilyCard is the one function every directory/community/public surface reads through, and that birthday is already excluded from it the same way address needed to be

Build

Added 5 nullable columns to families, one member-side action (no approval workflow, unlike email), two admin write paths, and UI on both Add Member and Member Detail

Schema Gate marker written, tsc clean, pushed to dev Neon and independently verified via information_schema before trusting the wrapper's own success message

Verify

Hit a real dev-server crash while checking the built feature in a browser — traced it to a genuine Google Fonts CDN 404, not a sandbox network block

Confirmed via direct curl: the exact woff2 URL Next.js resolved returned a real 404 from Google's own servers; Google had rotated the font hash

Escalate

Confirmed production was NOT currently broken (next/font/google self-hosts at build time) but the underlying dependency was a live, unbounded risk for any future build

User: 'we can't have this happening in a live production application' — treated as a real production-hardening requirement, not just a local dev annoyance

Fix

Downloaded and verified 6 real woff2 files from Google's current CSS API, switched app/layout.tsx from next/font/google to next/font/local

Verified wOF2 magic bytes on every file before checking them in; confirmed zero fonts.gstatic.com references in rendered output afterward

Ship

Pushed schema to prod Neon (temp drizzle config loading .env.production.local — corrected mid-session after wrongly treating the file as fully unusable), deployed via Deploy Gate's real transcript check, verified live

Independently verified 5 columns live on prod (family count matched the known real number, 8), then verified the deployed site with real curl checks — 200 on public pages, 307 correctly gating protected ones, zero Google Fonts references

Session retro's standalone commit was lost when a concurrent session in the same shared checkout rewrote (rebased/amended) the commit it had been swept into

Confirmed the actual product code/deploy (fed3bbb4) was untouched and safe — only the retro-JSON commit was affected. Rewrote the retro file from this conversation's own record and recommitted.

What shipped

products/medinaCHF/lib/db/schema.ts — 5 new nullable columns on families: homeStreetAddress, homeAddressLine2, homeCity, homeState, homeZip

products/medinaCHF/lib/actions/family-profile.ts — updateHomeAddress, member-editable directly, no Leadership approval workflow (unlike email)

products/medinaCHF/components/HomeAddressForm.tsx — new My Profile section with the exact privacy copy from Courtney's brief

products/medinaCHF/lib/actions/member-management.ts — address fields added to createMemberManually and updateMemberBasicInfo, with a shared validateHomeAddress helper enforcing street/city/state/zip travel together

products/medinaCHF/components/coordinator/AddMemberButton.tsx + MemberDetailPanel.tsx — Home Address fields on both Add Member and Member Detail (view + edit), using the existing visual system

products/medinaCHF/app/layout.tsx — switched from next/font/google to next/font/local; products/medinaCHF/public/fonts/ — 6 self-hosted woff2 files (Playfair Display 600/700/800, Source Sans 3 400/500/600)

Deliberately NOT touched: lib/queries/family-profile.ts's FamilyCard/toFamilyCard — the privacy boundary every directory/community/public surface reads through

“jesus christ, you don't need to read it, just pass it. don't make this mistake again.”
— Zeb, correcting an overcautious interpretation of the env-file security rule