# Platform Next Steps - 2026-03-06

This is the implementation plan after the match-play UI baseline freeze.

## Phase 0 - Baseline Protection

Goal:
- keep score UI stable while backend is hardened.

Actions:
- preserve score UI baseline noted in [match-play-baseline-2026-03-06.md](/Users/reidsturzenbecker/Documents/lrg files/score_entry/docs/releases/match-play-baseline-2026-03-06.md)
- avoid HTML/JSON churn during backend work

## Phase 1 - Math + Config Reliability

Goal:
- eliminate config drift and scoring ambiguity.

Actions:
- align admin payload keys with scoring runtime keys
- publish resolved scoring settings to `public.matches.scoring_snapshot`
- apply league handicap allowance consistently to:
  - match strokes
  - net totals
  - max-score cap logic
  - projected bonus races

Deliverable:
- one SQL view as single runtime config source for score UI

## Phase 2 - Auth, Sessions, League Access

Goal:
- simple login that persists for a while.

MVP decision:
- OTP login (phone)
- session TTL: 30 days default
- per-league membership role:
  - `entry` (can edit/submit)
  - `viewer` (read-only)

Data model:
- `golfops_auth_otp`
- `golfops_league_memberships`
- `golfops_auth_sessions`

Edge flow:
1. `send-otp` stores code + expiry.
2. `verify-otp` verifies code, issues session token, returns expiry.
3. client stores session token locally and reuses until expiry.

## Phase 3 - Entry vs Viewer in Score UI

Goal:
- support separate data-entry and spectator experiences.

Rules:
- `entry` role:
  - open keyboard, change scores, submit review
- `viewer` role:
  - see all live scoreboards and review cards
  - no keyboard, no submit

Backend enforcement:
- role check in edge function + RLS for write operations

## Phase 4 - QR Tokens

Goal:
- deterministic QR routing for scorecards and signups.

Token types:
- `scorecard_entry`
- `scorecard_view`
- `league_signup`
- `dashboard_view`

Behavior:
- QR points to short token URL
- token resolves to league/week/match role scope
- optional expiry and max-use limits

Data model:
- `golfops_qr_tokens`

## Phase 5 - Google Sheet / Excel Import + Email

Goal:
- bulk roster and schedule import with auditable processing.

Import path:
1. upload file or sheet URL
2. create import job
3. normalize rows
4. validate row-by-row
5. apply upserts
6. write summary/errors

Data model:
- `golfops_import_jobs`
- `golfops_import_rows`

Email path:
- queue first, send async worker
- templates:
  - signup link
  - week open notification
  - scorecard ready

Data model:
- `golfops_email_queue`

## Phase 6 - Finalize and Provisional HC

Goal:
- move authoritative final math to backend transaction.

Actions:
- implement `golfops_finalize_week` RPC with idempotency
- implement provisional handicap assignment RPC
- edge functions call RPC only
- dashboard actions become thin clients over RPC

## Suggested Order For Immediate Work

1. Apply schema extension file and re-run seeds.
2. Fix send/verify OTP edge functions.
3. Wire session persistence in score app (role-aware read/write).
4. Add resolved scoring-config view and consume it in publish bridge.
5. Implement finalize/provisional RPC behavior beyond scaffolding.