imagine 5,000 users next week — here's what actually happens.
Scale-readiness audit: today's ~90 users → 5,000
Four independent audits (infrastructure/DB capacity, third-party service tiers, known bugs re-assessed for scale, and crisis-safety under load) plus a direct correction pass on facts this project had gotten wrong. 24 findings, worst first within each group. Choose Fix before scaling · Monitor · Accept risk per finding, then copy your decisions back.
The single biggest thing this audit found isn't a bug. It's a pattern.
Four separate things on this list — the severity-gate fix, the classify-affect data-corruption fix, the granular-consent/analytics-gating rebuild, and the revenuecat-webhook CI fix — were reported as "fixed" earlier this week based on reading the repository, without confirming they were actually deployed or shipped. Re-checking against the live function versions and the live App Store build tonight found: the classify-affect fix was never actually deployed (live is still the vulnerable version); the consent/analytics-gating rebuild is real code sitting on a branch with no upstream, so every sign-up today still gets zero consent gating; same for the severity gate and the CI fix. None of these are bugs in the fixes themselves — the code is right. The gap was verification: "committed" was treated as "live." That's now fixed as a habit, not just as four individual items — every finding below states plainly whether it's live today, fixed but not shipped, or still broken either way.
Anthropic is a real data processor. It wasn't in the DPIA, the ROPA, or the privacy policy draft until tonight.
Earlier this week this project concluded recommend-plan was "100% Postgres FTS, no LLM call in the live path" — stated as verified fact, used to write the DPIA and ROPA, and repeated in the privacy-policy draft. It was wrong. The live app (v2.2, build 5, and every version since v2.1(4)) sends a version-gate header that activates a live Claude/Anthropic composition path — FTS is the fallback only, not the primary path. Separately, check-in text has always gone to Anthropic (via classify-affect/classify-crisis, unconditionally) — that part was documented correctly elsewhere in the project the whole time, just stated backwards in the ROPA. Net effect: both check-in free text and beliefs-plan intake are sent to Anthropic on essentially every user action. The DPIA, ROPA, deep-dive wiki, and the privacy-policy draft artifact have all been corrected tonight — Anthropic is now named as a processor everywhere it should be, and the privacy-policy draft's "never shared with anyone" line (which also missed this) has been rewritten. What's still missing: a signed DPA with Anthropic, and a consent step that names it specifically — the single highest-priority GDPR gap this whole project has found.
Does it survive 5,000 users?
Infrastructure: yes, gradually degrading, not falling over. Postgres is architecturally sound (everything goes through PostgREST, no raw per-request connections); the one real gap (a missing index on emotional_sessions.user_id) is cheap to fix and doesn't cause an outage, just added latency as row count compounds. Third-party services: mostly fine, one real unknown. Amplitude, Customer.io, and RevenueCat all have comfortable-to-manageable headroom or just a bill increase if crossed — Segment's actual current plan tier could not be confirmed, and if it's still Free, a second overage lockout in a 6-month window severs the entire analytics + lifecycle-email pipeline at once. Crisis safety: does not hold with full confidence. The three-layer design is real and mostly sound, but Layer B (the edge classifier) is a single attempt with no retry that fails to "false" on any error, all four AI functions share one Anthropic account's rate limits, and a genuine new bug was found — a back-button race that can discard a crisis classification result before it's checked. This is the one category where "probably fine" isn't good enough, and it's the one this audit is least confident about at 5,000 concurrent-ish users specifically because the account's actual Anthropic usage tier couldn't be confirmed from this environment.