Bilko demo — 7 real-user bug fixes + live verification (MC #102887) — 2026-06-04

Summary

CEO smoke-tested the live Bilko demo and found real bugs in minutes that the prior Phase-B QA (#102883) missed because it tested API-with-token, not real UI clicks. This task ran a REAL-USER browser walkthrough, found 7 bugs, fixed all 7, and LIVE-verified them on bilko-demo.alai.no.

The 7 bugs (all fixed + live-verified)

1. PDV €NaN on invoice detail — vatRate undefined (backend serializes taxAmount); fixed formatCurrency NaN-guard + vatAmount ?? taxAmount. Live: now €30,50.
2. No pagination on invoice list — added server-side pagination controls (shows when >1 page).
3. Draft save → 400 — customerId required unconditionally + e-invoice XML generated for drafts. Fixed: V63 migration (customer_id nullable), skip e-invoice for drafts.
4. /pricing 401 on /me/trial + /chatbot/history — components fired before auth hydrated. Fixed: auth guard (isAuthenticated && !authLoading) on TrialBanner + pricing/page.tsx.
5. PDF download no refresh-on-401 — added refresh-and-retry to downloadPdf in api.ts.
6. Credit-note button shown but 403 — gated button on plan (planTier added to /auth/me; hidden for BASIC).
7. Trial banner "26874 dana" — TrialService caps >3650 days; banner guards.

Critical deploy lesson (worth remembering)

A "green build" with the correct git-sha label did NOT mean the fix was live:

• The first fix attempt edited dead code (invoices/[id]/_client.tsx) — the live App Router page is page.tsx. The component was never compiled/served.
• The demo web Docker build reused a stale BuildKit layer, shipping an old apps/web bundle even from a "fresh" build labeled with the new commit. Both were caught ONLY by live outcome-verification (Playwright on the real demo showing €NaN), not by trusting build SUCCESS. Fixes: move logic to page.tsx (#249) + Dockerfile BUILD_SHA cache-bust arg (#248).

Deploy + verification

• PRs #247, #248, #249, #250 merged to main. Tags v0.2.11 (5 bugs) + v0.2.12 (last 2).
• Live: bilko-web-demo rev 00049-w6q (git 11bd914) 100% traffic; api rev git-matched (ADC-direct Cloud Run API).
• regression-102887.spec.ts: 7/7 PASS vs live bilko-demo.alai.no (real browser + API-auth). integrationTest required CI gate green on all PRs.
• Independent pre-verifier (Company Mesh / Proveo): PASS — mesh-thr-bbe0fe04-bc49-4dc0-8713-b3daa9ad602d. til-done DONE.

Process takeaways

• API-with-token QA ≠ real-user QA. Always click the actual UI affordances.
• Verify deploys by OUTCOME on the live surface, never by "build SUCCESS" + git-sha label.