Generated 2026-08-18 by Woz. Sources: 12-agent read of revparpro origin/main and the AceHQ vault, live production queries (PostgREST, 2026-08-18), the CoStar STR census you sent Marriott (Feb 2026), and Ace's decisions of 2026-08-18. Every number carries its source inline.
The short answer. RPP is a deep operating system for one company: every one of the 17 active people sits in a single tenant called default, and "my portfolio" is a flag on THM's own 15 hotels (RPP Authorization Architecture.md, 2026-07-23 production verification; profiles all tenant_id='default' per the 2026-07-16 audit). What already works for any Texas hotel is the market layer: 27,686 hotel records, statewide room-tax receipts, the census, and compset discovery (hotels row count, PostgREST 2026-08-18). To sell it, four layers have to exist that do not exist today, and they should be built in this order: (1) a mailer control plane, (2) a customer registry and admin desk, (3) plans and billing, (4) real tenancy. The first three can ship without giving any outsider a login, which is exactly what your July decisions asked for (lightweight report surface, no /app login for trials, card-less trial, email first then trial). Tenancy comes when the first management company converts.
| Layer | Exists today | Gap | Order |
|---|---|---|---|
| Mailer control plane blocker |
The v06 letter (HTML/PDF sample for Best Western Plus Austin Central); teaser_tokens and teaser_leads with 6 dev rows; a token minting script; the /t/:code teaser page (artifacts/direct-mail; migrations 252/253/270; teaser_tokens query 2026-08-18) |
No record anywhere of a piece being sent; the printed QR points at revparpro.com/?mail= which nothing handles; every version was hand-built with hand-queried numbers; no address roster, no suppression list, no campaign or wave entity, no response report (direct-mail reader; grep of src/landing/workers for 'mail='; live curl of revparpro.com/?mail=) |
1 |
| Customer registry blocker |
Nothing. Prospects, Sales Pipeline and Frontline Leads are THM's own hotel-sales tools (companies buying room nights), not RPP customers (migration 073; ProspectPipeline.tsx; living doc 2026-07-29) | No table says who a customer is, which hotels they claimed, what plan, what status, or which letter they came from. "Start my free trial" only flips wants_trial; nothing consumes it (Teaser.tsx 1010-1022; teaser-page/index.ts 379-388) |
2 |
| Plans and billing blocker |
A dormant subscriptions table from migration 001 with 0 rows and Stripe columns nobody reads (001_initial_schema.sql 1288-1300; repo-wide grep for stripe) |
No processor, no plan catalog, no entitlement check anywhere in RLS, edge functions or nav. Two entry prices were set the same day: $9/month (Instagram note) and "Plans from $12.50/month" (all direct-mail artifacts) (RPP Instagram Soft Launch.md:30; rpp-june-snapshot-decision-packet.md:20) | 3 |
| Tenancy and isolation major, gated |
The primitives: tenant_id on about 322 tables, about 207 tenant-keyed RLS policies, a fail-closed tenant_id() helper, the authz capability schema, and a synthetic second tenant for the RLS harness (tenancy reader parse of origin/main migrations 2026-08-18; migrations 002/007/342/005) |
No tenants/organizations table; roughly 30 finance and deal tables are role-only and about 28 operating tables are open to any authenticated user, so an outside login today would read THM P&L and night audits; invite-user hardcodes default; 34 edge-function files and 63 scripts write to default (migrations 259, 258, 320, 308, 306; invite-user/index.ts:95; grep counts on origin/main) |
4 (after first company converts) |
| Public funnel major |
Marketing site, /t/:code teaser, star-intake worker, Resend one-pager email (landing/index.html; workers/star-intake) | Site has no pricing, no signup, no /pricing, footer /terms and /privacy resolve to the homepage; star@revparpro.com has no Cloudflare routing rule so forwarded STAR files go nowhere (live curl 2026-08-18; Cloudflare API email routing rules 2026-08-18) |
with 1 and 3 |
| Data feed ownership major |
SIFT sync, month-close eval, discovery precompute, all working (scripts/sift-sync.mjs; scripts/month-close-eval.mjs) | The Comptroller feed runs under a THM entity login with the password committed in the script, on the Mac Mini crontab; the census is a one-time Feb 2026 extract with no refresh path (sift-sync.mjs:74-78; pipelines reader) | program dependency |
The mailer needs a ledger and a loop, not a screen first. Every printed number gets frozen at render time so the letter and the QR page are the same bytes, and every step writes one event so "campaign to paid" is one query.
| Entity | Purpose | Attaches to what exists |
|---|---|---|
mail_campaigns | One row per wave: report period, market, format, offer copy as printed, fulfillment path, approval, status (draft, proofing, approved, printing, mailed, closed) | parent that teaser_tokens.campaign never had; issuance refuses to mint while the plan price is null |
mail_targets | Who the campaign is aimed at: a hotel (str_number) or a management company (company_id), with tier and score | str_hotel_summary, new management_companies |
mail_recipients | Person and address block per target: "General Manager" at the property address (locked), or a named executive at company HQ; source and verified flag | hotels.address, Comptroller location address; company HQ later via Apollo |
mail_pieces | The issuance ledger: one row per envelope, its unique token, frozen report payload and set snapshot, render hash, printed_at, mailed_at, returned | 1:1 with a teaser_tokens row (new tier mail, plus campaign_id, expires_at) |
funnel_events (append-only) | printed, mailed, returned, scanned, page_view, email_captured, star_uploaded, trial_started, brief_sent, checkout_started, subscription_activated, canceled | written by the /r redirect, teaser-page GET/POST, star-intake worker, provisioner, webhook, brief job |
mail_suppressions | Do-not-mail and dedupe: THM properties, existing customers, returned addresses, dual-brand siblings sharing a taxpayer number | seeded from hotels.is_thm_property, taxpayer_chain, active claims |
vw_campaign_funnel | The report: pieces, scanned, scan rate, leads, trials, paid, cost per lead per campaign, plus company-level rollups | the four tables above |
mail-batch select: applies the frozen target rule (metro, complete filings for the period and prior year, suggested-set coverage, one piece per taxpayer, not suppressed), inserts pieces and mints tokens.mail-batch render: suggested set from the str_number-keyed discovery path (deal-compset), monthly named receipts from compset-engine.ts (allowlisted, so the "never read raw receipts" CI gate holds), then the v06 template with QR = revparpro.com/r/<code>. Proof index goes to Drive.month_close_evals passes and the row count is stable against the same month last year, not a calendar day (scripts/month-close-eval.mjs; GTM proposal, verified by the founder-lens judge).revparpro.com/r/<code> records the scan and 302s to app.revparpro.com/t/<code>. Today the printed URL lands on the generic homepage and the token is discarded (funnel reader; live curl 2026-08-18).Customers are accounts, not logins, for the first waves. A single-hotel buyer's account is their email plus a full-tier report link and a monthly brief. A management company is the same account kind with many claimed hotels. Nobody gets an /app login until isolation is proven, which keeps every tenancy leak latent.
| Piece | What it does | Notes |
|---|---|---|
rpp_accounts | kind (single_hotel, management_company), display name, primary email, plan, status (trial, active, past_due, canceled, comped), source campaign and piece, trial dates | Manual create exists so the first five concierge-onboarded companies (locked, Instagram note) are registered the same way as self-serve buyers |
rpp_account_hotels | The claim model: which hotels this account owns access to, claim status (self-declared, verified, rejected), chosen set, report token | Replaces is_thm_property as "my hotels" for outsiders; a STAR upload whose auto-detect matches the str_number auto-verifies the claim |
plan_products, rpp_subscriptions | The catalog (key, price, interval, Stripe price id, entitlements JSON) and the commercial state per account | Copies the shipped email_products / email_policies pattern from migration 364; the letter, the /t page and the trial email all read one price row |
platform_admins + is_platform_admin() | Who may see and run customers and mailers | Deliberately separate from THM company access administrators (Ace, Rahil, Zabir, Alyssa) and from the 8 owner-role profiles that isAdmin lets in today (nav-config.ts; RPP Authorization Architecture.md 2026-07-23) |
| Screens | /app/platform/customers (list, filters, MRR, next brief), /app/platform/customers/:id (claimed hotels, subscription, funnel timeline, actions: provision trial, extend, resend link, record payment, comp, cancel), /app/platform/mailers and /:id (campaign metrics, piece table, Approve, Mark printed, Mark mailed, Mark returned, Suppress) | Existing PageShell, tokens, UserTable and dialog primitives; numbers and labels only, explanations behind hover icons (2026-08-17 rule) |
| Money, first version | A hosted Stripe Payment Link (or invoice) emailed at trial end, payment recorded by hand on the customer screen with paid_through; the webhook backfills later | Enough for wave-1 volume; any live billing write or webhook go-live needs your explicit authorization per the finance-writes rule |
You are right that the letter is GM-shaped. The census in RPP already names the operator, and the decision packet already says the ultimate product is for management companies with GM outreach as the exposure channel (artifacts/direct-mail/rpp-june-snapshot-decision-packet.md:17; RPP Instagram Soft Launch.md:26-27). Two facts change the plan: the management-company names live in str_census, not hotels (the hotels.management_company column from migration 025 does not exist in prod, error 42703 on 2026-08-18), and RPP's census is Texas only, so Texas-share needed the national file. That file is the "Participating Hotels" sheet inside the CoStar Comp Set Check Tool you emailed star.program@marriott.com on 2026-03-23; it is now extracted at ~/agents-runtime/data/str-census-global-feb2026/.
| Tier (companies with 5+ TX hotels) | Companies | TX hotels | Examples (TX / US total) | Treatment |
|---|---|---|---|---|
| Tier 1: 50%+ of US portfolio in Texas | 70 | 709 | Ocean Gate 25/25, BH Hospitality 25/25, Texas Western 25/30, Magnolia 24/30, Whitestone 20/20, RGB 20/20, Palette 20/31, Patel Capital 18/22, Insignia 18/25, American Liberty 16/18 | Company letter to the Texas ops executive plus GM letters to their hotels. Wave 1 subset with 2+ hotels in Austin or San Antonio: 21 companies, 89 hotels |
| Tier 2: 25 to 50% Texas | 14 | 193 | MCR 41/136, J&P Asset Management 41/146, K&K 19/41, White Lodging 15/59 (all 15 in Austin/SA), Avion 13/38 | Second wave after tier 1 reads |
| 10 to 25% Texas | 25 | Aimbridge 116/634, InTown Suites 42/195, Hotel Equities 26/161, HHM 26/211, Remington 22/101, Baywood 21/131, GF Hotels 20/125 | Later, or a different pitch; a Texas-heavy product is a small slice of their book | |
| Under 10% Texas | 18 | Marriott International 39/480, Hyatt 25/178, Extended Stay America 20/533, Highgate 18/301, Drury 16/128 | Deprioritized; mostly brand-managed |
TX counts from prod str_census (2026-08-18); US totals and shares from participating_hotels.csv (Feb 2026). Tier hotel counts for the two middle rows were not summed. Brand-managed proxy (management company equals parent company) covers 199 TX rows: InTown 42, Marriott 39, Hyatt 25, ESA 20, Drury 15, Hilton 10, Omni 10, Kasa 7. Owner-operator proxy (management company equals owner company) covers 897 TX rows; 420 of tier 1's 709 hotels are owner-operated. 166 TX census rows carry a hotel name in the management-company field and need an alias table.
management_companies (canonical name, kind: brand_manager, third_party, owner_operator; HQ address, domain, Apollo org id, TX and US counts, TX share, THM relationship flag) seeded from the national file, plus management_company_aliases for the variants, plus a national census reference table (str_census_national) so the live TX table stays lean.management_company_portfolio rollup: TX hotels, Austin/SA count, TTM receipts as a ratio of sums (the stored per-hotel YoY percent has absurd outliers, one RGB hotel at 550,944,373.9), hotels trailing their suggested set.apollo-enrich function already resolves an org by domain and searches people by title); the domain list for the top 60 is a curation task.management_company is an authz scope kind (migration 342) and email_tenant_settings.management_company_name exists. When tenancy arrives, one org per company, hotels claimed underneath, GMs as property-scoped seats, one subscription with quantity = properties (per-property base plus premium tier, locked).Estimates assume Woz plus agents while THM operations continue; each phase is cut so it can pause without leaving THM half-migrated. Two of the three roadmap designs were rated top by one judge each; this merges them and takes the architecture judge's grafts (platform admins from day one, no re-keying of tenant_id, price seeded before any print, trial provisioning before the first envelope).
| Phase | When | Deliverables | Exit | Needs from Ace |
|---|---|---|---|---|
| 0. Lock inputs | Days 1-2 | Decisions 1 to 8 below recorded in the vault; one plan row seeded from the price; rebase the working branch onto origin/main before any migration (working tree holds 335 migration files, main holds 581); star@ routing rule created; real return address | Written price, plan, admin set, landing rule, set algorithm, fulfillment path; star@ round-trip verified | All of section 6 |
| 1. Ledger, redirect, trial provisioning | Weeks 1-2 | Migrations: mail_campaigns, mail_targets, mail_recipients, mail_pieces, funnel_events, mail_suppressions, plan_products, rpp_accounts, rpp_account_hotels, platform_admins; teaser_tokens tier mail + expiry; revparpro.com/r/* redirect writing the scan; trial-provision edge function that mints the full-tier link and sends the report email; landing site moved into CI so a redeploy cannot be skipped | A test /r/<code> scanned from a phone writes scan and page_view; a lead clicking Start my free trial gets a working link within minutes; RLS harness passes | None |
| 2. Render pipeline, Mailers desk, wave 1 | Weeks 2-4 | v06 moved out of artifacts into a template on its embedded JSON contract; mail-batch select/render/proof; Mailers screens with Approve, printed, mailed, returned; Austin/SA GM wave under the frozen rule (metro, complete filings both years, one piece per taxpayer, suggested-set coverage, no bad-month hunting) | Ace opens the proof index and the numbers match /t/<code> byte for byte; wave 1 in status mailed with a piece-level ledger; metrics view live | Proof approval; the physical mailing |
| 3. Customers desk, first dollar | Weeks 4-6 | Customers screens; monthly brief job (compose, preview index, explicit send, analyst-letter voice); trial-ending email with the Payment Link; Record payment; real /terms and /privacy; runbook for run a wave, provision a trial, record a payment | End to end on a test hotel: scan, gate, trial, link, expiry, trial-ending email; first payment recorded and attributed to a piece | Trial email copy; terms text; per-action billing authorization |
| 4. Management-company track | Weeks 5-8 | Company tables and national census load; portfolio rollup; alias pass on the top 60; company letter template and company token page; Apollo executive lookup for tier 1; tier-1 Austin/SA company wave (21 companies) alongside GM wave 2 | Company letters mailed with company-level attribution visible per campaign; company accounts registered manually for concierge onboarding | Decision 7; Apollo credit approval |
| 5. Money automation and cadence | Weeks 6-9 | Stripe Checkout, webhook with idempotency table, billing portal; entitlement read in the report page and brief; /pricing on the landing site; cadence check tied to filing close; weekly loop report (pieces, scan rate, email rate, trials, paid, cost per lead) | A test card converts a trial to active through the webhook; two consecutive monthly issuances run from the close trigger with Ace approving only the proof | Stripe as processor; card vs ACH split; go or no-go after touch 2 |
| 6. Real tenancy | Gated: first company converts | organizations whose slug equals the existing tenant_id text (THM stays default, nothing re-keyed); per-tenant authz template seeding; invite-user takes tenant from the caller; tenant term added to the ~30 role-only and ~28 open tables; hardcoded default writes fixed; check-tenant-policies CI gate; harness proves a second tenant sees zero THM rows; then a customer login surface and MFA policy | One management company operates inside its own tenant with its own hotels and team; THM users see the identical portfolio they see today | Decision 4; feature slice for outsiders; MFA for customers |
origin/main name Management HD LLC and describe RPP as an internal system (commit ed0abf8c, 2026-07-23). (b) Redistributing named per-hotel room-tax receipts: SB 1086 (85th Legislature) stops state agencies from posting individual hotels' taxable receipts on public websites and keeps the data public information via open records and the SIFT login; it does not itself bar a private party, but the SIFT account terms and the bill's stated purpose (cutting unsolicited vendor mail to hotels) make this a counsel question, and the vault's own SIFT spec says do not expose raw receipts publicly (sift-operations-spec.md "SB 1086 Compliance"; capitol.texas.gov SB01086I analysis; comptroller.texas.gov hotel-receipts page). (c) Texas sales tax on a SaaS subscription (CPA Niraj; a printed price is either tax-inclusive or tax is added at checkout). (d) Whether the CoStar census extract obtained through Marriott's tool may underpin a product sold to outsiders. Recommendation: engage counsel and Niraj this week; phases 1 and 2 build regardless; the print run waits on (b).star@revparpro.com Cloudflare routing rule now via the API (the token is in Vaultwarden), and open a RevParPro-owned Comptroller SIFT account so the data feed stops running under ace@howdyhotels.com. Recommendation: yes to both; the second needs you only for the account signup.origin/main or the vault by six read-only agents and spot-checked by two judges; file and line references are inline. The working branch is 246 migration files behind main (335 vs 581, git ls-tree origin/main), which is why the roadmap starts with a rebase.str_census queried by PostgREST on 2026-08-18; national figures from participating_hotels.csv extracted from Spark attachment 21912 (message 58190, thread "HOURP STR ID 9971 Compset Change and OTR", 2026-03-23).deal-compset path reproduces the hand-assembled v06 suggested set exactly; parity must be proven on the sample hotel before printing.