Bilko demo — 7 real-user bug fixes + live verification (MC #102887) — 2026-06-04

Summary 
 CEO smoke-tested the live Bilko demo and found real bugs in minutes that the prior Phase-B QA (#102883) missed because it tested API-with-token, not real UI clicks. This task ran a REAL-USER browser walkthrough, found 7 bugs, fixed all 7, and LIVE-verified them on bilko-demo.alai.no. 
 The 7 bugs (all fixed + live-verified) 
 
 PDV €NaN on invoice detail — vatRate undefined (backend serializes taxAmount ); fixed formatCurrency NaN-guard + vatAmount ?? taxAmount . Live: now €30,50 . 
 No pagination on invoice list — added server-side pagination controls (shows when >1 page). 
 Draft save → 400 — customerId required unconditionally + e-invoice XML generated for drafts. Fixed: V63 migration (customer_id nullable), skip e-invoice for drafts. 
 /pricing 401 on /me/trial + /chatbot/history — components fired before auth hydrated. Fixed: auth guard (isAuthenticated && !authLoading) on TrialBanner + pricing/page.tsx. 
 PDF download no refresh-on-401 — added refresh-and-retry to downloadPdf in api.ts. 
 Credit-note button shown but 403 — gated button on plan ( planTier added to /auth/me; hidden for BASIC). 
 Trial banner "26874 dana" — TrialService caps >3650 days; banner guards. 
 
 Critical deploy lesson (worth remembering) 
 A "green build" with the correct git-sha label did NOT mean the fix was live: 
 
 The first fix attempt edited dead code ( invoices/[id]/_client.tsx ) — the live App Router page is page.tsx . The component was never compiled/served. 
 The demo web Docker build reused a stale BuildKit layer , shipping an old apps/web bundle even from a "fresh" build labeled with the new commit.
Both were caught ONLY by live outcome-verification (Playwright on the real demo showing €NaN), not by trusting build SUCCESS. Fixes: move logic to page.tsx (#249) + Dockerfile BUILD_SHA cache-bust arg (#248). 
 
 Deploy + verification 
 
 PRs #247, #248, #249, #250 merged to main. Tags v0.2.11 (5 bugs) + v0.2.12 (last 2). 
 Live: bilko-web-demo rev 00049-w6q (git 11bd914) 100% traffic; api rev git-matched (ADC-direct Cloud Run API). 
 regression-102887.spec.ts: 7/7 PASS vs live bilko-demo.alai.no (real browser + API-auth). integrationTest required CI gate green on all PRs. 
 Independent pre-verifier (Company Mesh / Proveo): PASS — mesh-thr-bbe0fe04-bc49-4dc0-8713-b3daa9ad602d. til-done DONE. 
 
 Process takeaways 
 
 API-with-token QA ≠ real-user QA. Always click the actual UI affordances. 
 Verify deploys by OUTCOME on the live surface, never by "build SUCCESS" + git-sha label.