Building FoxyInvoice — Appendix: Glossary & Checklists

This series is written in the open, from a real production system. This closing reference page collects every term the series used and the two checklists that turn it into a launch. [All chapters and diagrams live in the public repo.]

Glossary — every term this series used

Git & process

• Repository (repo) — the project plus its full history.
• Commit — one versioned snapshot with a message.
• Branch / merge / rebase — parallel lines of work / combining them / replaying yours on top.
• Worktree — a second checkout of the same repo, for working two branches at once (source of a war story).
• Tag — a named point in history (blog-v1.0).
• CI/CD — automation that tests (CI) and deploys (CD) on push.
• Concurrency group — pipeline lock ensuring one deploy at a time.

Frontend

• SPA — single-page app; the server ships a shell, JavaScript renders pages.
• PWA — progressive web app; installable, offline shell via service worker.
• UI vs UX — what's on the screen vs whether the person succeeds.
• Progressive disclosure — show only what's needed now; hide the rest behind "Advanced."
• Route input binding — URL parameters delivered as component inputs (timing matters — Story 1).
• Signals — reactive values the UI tracks automatically.
• SSR / prerendering — server renders pages per-request / static HTML generated at build time.

Backend & data

• REST / HTTP verbs / status codes — the request vocabulary (GET/POST/PUT/DELETE; 200/201/400/401/404/409/500).
• JWT — signed token carrying claims (user, tenant, permissions).
• Refresh token — long-lived credential rotated to extend sessions.
• ORM (EF Core) — write objects; it writes the SQL.
• Query filter — automatic WHERE clause (ours: tenant scoping).
• Migration — versioned schema-change script; the only legal writer of schema.
• Idempotent — safe to run twice (ADD COLUMN IF NOT EXISTS).
• Transaction / outbox pattern — commit business row + email row atomically; a worker delivers.
• Value object — a type defined by its values (Money = decimal + currency), equality by content, refuses illegal math.
• Nexus — a presence in a US state that triggers sales-tax duties.

Infrastructure

• DNS records: A / MX / TXT — name→IP / mail routing / free-form proofs.
• TLS / certificate / ACME — encryption; the proof you own the domain; the protocol that issues it (Caddy automates).
• Grey-cloud — DNS-only routing (no proxy) — required for direct ACME challenges.
• VPS — your rented Linux box.
• Docker: image / container / compose / volume / network — blueprint / running instance / stack file / persistent disk / private LAN.
• BuildKit secret — credential mounted during build only; never in image layers.
• Rate limiting — per-IP request budgets on public endpoints.
• X-Robots-Tag / robots.txt allowlist — crawler directives; default-closed indexing.
• IndexNow — push protocol telling engines your URLs changed.
• llms.txt — markdown menu for AI answer engines.

Product & ops

• Multi-tenancy — many businesses, one system, isolated data.
• RBAC — roles → permissions → guards.
• Share token — unguessable URL as scoped authorization.
• Funnel — stranger → visitor → signup → activated → paid.
• Marginal cost — cost of one more user (ours: ≈0).
• Break-even — subscribers covering fixed costs (ours: 2 Pro).
• GEO (generative-engine optimization) — being the machine-readable answer.

The checklists

Server setup (full walkthrough in Chapter 6):

• [ ] Domain bought; nameservers → Cloudflare; A record grey-cloud
• [ ] VPS up; compose stack: postgres healthy → api healthy → worker running
• [ ] Caddy certificates issued; site loads over HTTPS
• [ ] SES identity verified; probe email sent & received
• [ ] Email routing rules + verified destinations; probe again
• [ ] Nightly backups, size-checked, landing off-box
• [ ] Secrets generated on-host; repo secret-scan green

Launch (product-level):

• [ ] Signup → onboarding → first invoice sent, tested in a clean browser
• [ ] Feedback widget round-trip (submit → email → console → resolve)
• [ ] Payments sandbox end-to-end (link → webhook → Paid status)
• [ ] robots.txt allowlist reviewed; prerendered pages spot-checked with curl
• [ ] Search Console + Bing Webmaster verified; sitemap submitted
• [ ] Access logs on; one organic crawl observed

---

— That's the series. Every chapter, diagram, and scar lives in the
repo, versioned in git, ready for whoever builds the next one.

---

The machine this series documents is live, and reading these words is
the proof it ships. Create a free workspace at
foxyinvoice.com, then redeem founding code
U8B4Z8S87X on the Upgrade page — 6 months of Pro, free, no card. If anything
breaks, there's a feedback button in the app. I read every one.