Where this site
is going.

Editorial marketing site is live and Chip is qualifying inquiries. Commerce stays off — every product CTA routes to the unified /event quote form. Honest soft-launch state: most things work, a few things still want Daniel's input.

• Marketing site (10 editorial pages)

  Live

  Home, About, Event, Catalog, Gallery, Service Areas, Contact, FAQ, Privacy, Terms — full editorial design system, slate primitive, JetBrains Mono, magnetic CTAs, card tilt.

• 204-image categorized gallery

  Live

  Real archive grouped by category (Weddings, Bars, Luges, Brand activations, Festivals, Live carving, Culinary, Packaged ice, Holidays). Category-aware alt text.

• Unified quote form (with contact + email dispatch)

  Live

  Every product CTA routes to /event. Captures contact + occasion + date + budget. Sends staff dispatch to the right inbox + customer auto-reply. Confirmation page on submit.

• Chip — AI lead qualifier (Gemini 3.5 Flash)

  Live

  Conversational sales assistant. Reads live cart, weather, history. Routes inquiries to the right inbox (sculptures → danny@, packaged → orders@, freezers → info@). aria-live for screen readers.

• Resend transactional email

  In progress

  Code shipped, helpers wrap Resend gracefully. End-to-end production test pending — currently sends via Nodemailer/Ethereal locally.

• SEO + structured data

  Live

  Sitemap, robots, manifest, LocalBusiness + Product + Breadcrumb JSON-LD, per-route OG images for /, /about, /catalog, /event, /gallery, canonicals.

• Security baseline

  Live

  Next.js 15.5.18 (3 GHSAs patched), HSTS, X-Frame-Options, Referrer-Policy, Permissions-Policy, focus-visible rings, lang=en-CA, PII redacted from auth logs.

• AODA + automated WCAG 2.2 AA gate

  Live

  /accessibility page documents WCAG 2.2 AA target + AODA compliance posture + feedback channel. axe-core runs against key public pages on every build (tests/a11y/axe-pages.test.tsx). Linked in footer + sitemap.

• Cookie disclosure banner

  Live

  Minimal dismissable banner discloses essential-only cookies + links to /privacy. PIPEDA + Quebec Law 25 don't require a consent gate for essential cookies (we set none other than session + auth), but transparency earns trust.

• PIPEDA data-request form

  Live

  /privacy/data-request — access / correction / deletion request form. Submissions log to ErrorEvent (kind=email) for 30-day staff follow-up. Stronger than the bare 'email us' pattern.

• Version-gated feature flags

  Live

  DB-overridable flag registry, /admin/feature-flags toggle UI, /proposal renders status chips from this same source. No redeploy needed to flip a stage.

• Real team bios

  Live

  5 verified bios live — Greg (President), Peter (GM), Danny (Ice Carver), Daniel (digital/brand), Richard (Lead Driver). Pulled from iceboy.ca/team-member/<slug>/.

• Real product photography

  In progress

  Catalog uses real event/sculpture shots; some product detail pages still fall back to schematic. Pending Daniel's photo folder.

Operational launch: the site is the first trusted touchpoint, leads route reliably end-to-end, no customer-visible placeholders remain. V1 ships when every item below passes the checklist.

• Lead email dispatch (Daniel + customer)

  Live

  Already wired in V0.5 — every /event submit emails the right inbox and auto-replies to the customer.

• Resend tested end-to-end in production

  In progress

  Confirm dispatch + auto-reply land in real inboxes from the live server, not just locally.

• Customer confirmation UI

  Live

  /event/submitted page explains what happens next + fallback phone.

• Team roster complete

  Live

  5 bios verified + shipped (Greg, Peter, Danny, Daniel, Richard). Roster confirmed complete 2026-05-26.

• Resolve known pricing discrepancies

  Blocked

  Two known_discrepancy notes in products.json (small freezer + event trailer form/PDF mismatches).

  Blocked · Daniel decision

• Review 6 confirm_before_launch flags

  Blocked

  Each open product flag needs to be confirmed or accepted as known.

  Blocked · Daniel review

• HST# confirmed with CRA

  Blocked

  Not used in V1 (commerce still off) but registering early de-risks V2.

  Blocked · Daniel admin

• Google AI Studio key rotated

  Blocked

  Leaked key from 2026-05-21 still active.

  Blocked · Daniel admin

• Dedicated Vultr box provisioned + hardened

  Blocked

  Deploy artifacts ready on this branch; awaiting box provisioning.

  Blocked · Daniel provisioning

• DNS cut over to new box

  Planned

  Lower TTL, hosts-file smoke test, flip A-records for iceboy.ca + www.iceboy.ca.

• Self-hosted error tracking + admin viewer

  Live

  captureError() persists uncaught errors to the ErrorEvent table — no third-party tracker. Wired into the global error boundary + submitEventInquiry. Admin viewer at /admin/errors with kind + time-window filters, pagination, expandable stack/context. Replaces Sentry per the no-third-party-freemium principle.

• 301 redirects from legacy WP city pages

  In progress

  Skeleton 301 map shipped in next.config.ts (~25 paths covering city pages, product pages, retired blog). docs/SEO-MIGRATION.md documents the audit process. Awaiting Daniel's GSC export to make the list authoritative.

Self-serve checkout for the fixed-price products (bagged ice + freezer rentals). Sculptures stay quote-only — variable pricing + premium AOV warrants the human touch.

• Stripe checkout — 9 buy-cards

  Code shipped

  Bagged ice (5kg / 12kg / 20kg) + freezer deliveries. Code shipped, dormant behind commerceLive flag.

• Distance-based delivery + setup + deposit pricing

  Planned

  Replaces postal-zone surcharges with a transparent distance engine: $100 base covers 25km from shop, +$2.50/km beyond, ~60km max → contact us (Google Maps distance via GOOGLE_API_KEY). After-hours (before 9am / after 4pm) +$100; access surcharges stairs +$50 and long-carry +$50 (stack to $100). Sculpture-only auto-pricing: setup $50 × slab count, 2-crew +$150 when 3+ slabs or 6ft/8ft/multi-block. Customer enters only address + date/time + 2 access checkboxes; size/qty/crew derived from cart. Payment: 25% deposit online at booking, 75% balance via the invoice-payment 'Pay an Invoice' product ~7 days pre-event (folds in event-day adjustments); balance due at booking if event <7 days out; rush +20% under 14 days. Design only — spec docs/superpowers/specs/2026-05-29-consolidated-delivery-setup-payment-design.md (commit f2eddea), awaiting Daniel's post-test thumbs-up. Build risk: delivery-eligibility must allow sculpture-only carts (legacy ice≥120kg-OR-$900 rule is wrong for a single small sculpture) + mixed-cart HST treatment of delivery fees.

• Apple Pay + Google Pay

  Code shipped

  One-toggle in Stripe Dashboard once we go live.

• HST# registered with Stripe Tax

  Planned

  Auto-calculates HST per-line at checkout.

• CASL opt-in + /unsubscribe endpoint

  Code shipped

  Opt-in checkbox on /event (unchecked default, persists marketingOptInAt timestamp for CASL audit). /unsubscribe?t=<token> live with RFC 8058 token model. mintUnsubscribeToken() ready to wire into marketing-email footers when those ship.

• Data retention policy + automated purge cron

  Live

  Privacy page documents retention for inquiries (24mo), orders (7yr per CRA ITA §230), chat (12mo), unsubscribe records (3yr per CASL), error logs (90d). Automated purge enforced by scripts/cron/retention-purge.mjs running daily via docker-compose.prod.yml retention-purge-cron service. Converted-to-order inquiries kept for tax retention.

• Content-Security-Policy header (enforced w/ nonces)

  Live

  Enforced CSP issued per-request by src/middleware.ts via buildCspHeader() + a fresh nonce on every response. 'unsafe-inline' and 'unsafe-eval' are gone; nonces propagate to RSC via headers() → getNonce() and are applied to JSON-LD <script> tags. Static security headers (HSTS, X-Frame-Options, Permissions-Policy, Referrer-Policy) stay in next.config.ts.

• Rate limiting across all public submit paths

  In progress

  Generic sliding-window limiter at src/lib/rate-limit.ts. Wired into /api/buy-card/quote (120/min/IP), /api/party-luge/quote (60/min/IP), /unsubscribe (20/min/IP), and submitEventInquiry (10/min/IP). Stripe webhook rate-limit still pending — gated on V2 commerce-live work.

• Stripe webhook hardening + manual replay

  Live

  Signature verification, StripeEvent dedup, payment_failed + dispute.created staff alerts, captureError on every failure path. Manual-replay admin tool at /admin/stripe-replay — look up an event by id, see dedup status, re-run the local handler. Every replay is captureError-audited.

• Admin order detail (HST card)

  Live

  Full order view at /admin/orders/[id] — customer, event details, line items with subtotal + HST + zero-rated split, status badges, dispatch workflow buttons, Stripe session link, payment-link send action. Already shipped pre-audit; flag was stale.

• Capacity-aware date hint

  Live

  Shared checkCapacityForDate() at src/lib/capacity/check.ts feeds both the Chip prompt and the /event form. Form shows an inline chip on date change: ✓ available / ⚠ heavy demand / ⓘ calendar flagged. Powered by BlackoutDate + CapacitySlot tables; UTC day-of-week to be timezone-stable.

• Limitation of liability + governing law in Terms

  Live

  Terms now include: limitation of liability (cap at 12-month spend), governing law (Ontario + Canada), dispute resolution (Small Claims < $35k, Ontario courts above), severability.

• Real photography for ice + freezer SKUs

  Planned

  Half-day shoot — bags, blocks, freezer trailers, drip trays.

Sculptures go self-serve with engraving thresholds + commissioned photography. Customer accounts unlock re-order flows for the catering venues and bars that are Daniel's actual revenue base.

• Sculpture self-serve checkout

  In progress

  Slab-based pricing, engraving up to admin threshold, LED add-ons, removal options. Safety rail enforced in computeRouteDecision: 3+ slab / tall_install / custom always routes to request_booking even if a row in products.json is accidentally marked purchase_mode:direct. Direct-to-Stripe path remains for slab_half / slab_1 / slab_2 with purchase_mode:direct.

• Customer accounts

  In progress

  Magic-link sign-in via Better Auth — already wired for staff, now extended with a `customer` role (new default for self-signups). /account shell shipped: overview + orders list + per-order detail. Role hierarchy hardened (admin > staff > customer); requireRole() gates the /admin layout against customer sessions.

• Re-order flow for repeat venues

  In progress

  One-click re-order from /account/orders/[id] — pulls the order's buildJson cart, stashes it on the session via getOrMintSid(), routes the customer to /checkout/review for confirmation. SavedAddress table in place; per-customer address management lands in the next V3 PR.

• Commissioned sculpture photography

  Blocked

  Half-day shoot — sculptures, luges, real events golden hour. Required gate for sculpture self-serve.

  Blocked · Photo shoot not booked

• Referral codes

  Planned

  1 free 12kg bag for every referred customer who converts. ?ref= attribution.

• Post-event review-request emails

  Planned

  Auto-send 48h after delivery with a discount code. Drives repeat business + organic reviews.

Pursue Awwwards / Webby / FWA. Brand-led work, not feature work. Out-of-province inbound from planners. The 3D configurator is the moat.

• 3D sculpture configurator

  Concept

  Three.js + ice-refraction shader. Realtime preview. Shareable URL. 'See it in your venue' composite mode. No one in the GTA has this.

• Brand identity refresh

  Concept

  Custom typeface, frosted-glass color system, refracted-light hero animations, custom illustrations. Commissioned from a real Toronto studio.

• Cinematic scroll storytelling

  Concept

  'What does Toronto's ice supply look like at 4am?' Narrative scroll: production line, trucks, events. Award judges reward this.

• AR sculpture preview (WebXR)

  Concept

  Hold up phone in venue, see sculpture rendered in place. Mobile only.

• AI sculpture designer

  Concept

  Customer types 'elegant winter wedding centerpiece, art deco' → 3 mockups → picks → goes to carving queue.

• B2B portal + subscription model

  Concept

  White-label customer portal for major venue partners. Stripe Subscriptions for weekly-ice contracts.

• Public order tracker

  Concept

  SMS link, customer sees truck on a map for delivery day.