For testers reviewing the staging environment (https://stg-rcme.membervu.com). This consolidates issues closed in the membervu/membervu-pm tracker between 2026-06-04 and 2026-06-10, grouped by module + feature, with a "What to verify" hint for each. Items are organized as Enhancements ✨, Bug Fixes 🐛, and Security 🔒.
♻️ Partially superseded 2026-06-15: the "branch reality" / "⛔ not yet on stage" / "⚠ still open on dev" notes below were accurate on 2026-06-10. Since then the Jun 15 accounting milestone (!136) landed on stage — #152 / #153 / #158 are now testable, #151 is fixed (reactivate sets a future expiry), and treasury loads for all roles (#262). Use the Jun 15 note for current finance/retention scope; the enhancement/bug rows below remain valid.
Before you test — branch reality (verified against dev on 2026-06-10):
Stage builds from the dev branch. Everything below is confirmed merged to dev = on stage, except the items in the ⛔ Not yet on stage box, which live on the separate mile/accounting branch.
Two "closed" issues are not actually effective on dev — #151 (reactivate still doesn't reset expiry) and #148 (treasury dashboard still 403 — the FINANCE:VIEW:treasury permission isn't seeded). They're marked ⚠ still open on dev below. Test the actual behaviour and report.
⛔ Not yet on stage — DO NOT test these (on mile/accounting, not dev):
These will appear in a future release note once they land on dev.
🎟 Events
✨ Enhancements
#
Change
Feature
What to verify on stage
#183 / #188
Event countdown moved from the banner to a right-side panel (DateCard sizing fixed in follow-up).
Event detail · UI
Open an upcoming event; countdown shows in the right panel, correctly sized (not overflowing its card).
#187 / #192 / #193 / #194 / #195
Admin pre-enrol / bulk-register members into an event. Free-base events with PAID ticket types are skipped (SKIPPED_PAID_EVENT); "already enrolled" indicator + invalid-member validation added.
Events admin · Registrations
As admin, open an event → Registrations → pre-enrol drawer; bulk-add members; confirm already-enrolled members are flagged and invalid IDs are rejected cleanly (no raw error).
🐛 Bug Fixes
#
Fix
Feature
What to verify on stage
#170 / #179 / #174 / #146 / #145 / #147
Event link previews overhaul: social/Viber link previews now show the event's own Open-Graph image on the canonical event URL (previously generic MemberVu OG); regression where the OG fix served HTML on the JSON API endpoint was fixed.
Events · Sharing / link previews
Share an event link (paste into a chat that renders previews, e.g. Viber/Messenger); preview shows the event banner + title. Confirm the event detail page itself still loads (no JSON parse error).
#159
Public event pages had no Sign In option — members couldn't authenticate from an event link.
Events · Public page / auth
Open a public event link while logged out; a Sign In affordance is present.
#181
Public event routes ejected a member to /login on a stale token instead of showing the guest view.
Events · Public page / session
Open a public event link with an expired session; you should see the guest event view, not a forced logout/login bounce.
#172 / #173
Event-registration referral: verify the referring member by full name (browse → verify), closing a masked-name integrity hole.
Events · Registration / referral
Register for an event using "a member referred me"; verify the referral flow uses the full-name browse→verify path.
#198
16:9 event banner was cropped top/bottom on the detail page (container was 21:9).
Events · UI
Open an event with a 16:9 banner; the image is not cropped.
#166
Paid (ticket-typed) events were showing as "Free" in lists/cards — prismaEventToRecord ignored TicketType[] for isFree/price. Fixed on dev (Bug #19).
Events · Pricing display
A ticketed/paid event shows its price (not "Free") in the events list, cards, and detail page.
👥 Membership
✨ Enhancements
#
Change
Feature
What to verify on stage
#184
Admin can edit a member's "since / joined" date.
Members admin · Profile
As admin, edit a member; change the joined/since date; it saves and displays.
#185
Tenant-configurable registration form fields.
Membership · Registration / settings
As admin, configure which registration fields appear; verify the public registration form reflects the configuration.
#186 / #189 / #191
Admin notifications for new member sign-ups (email + in-app "recent sign-ups" widget); idempotency hardened; recipient input save fixed.
Membership · Notifications
Trigger a new sign-up; admin receives one email (not duplicated) and the recent-signups widget updates. MEMBER role gets 403 on the widget endpoint.
🐛 Bug Fixes
#
Fix
Feature
What to verify on stage
#182
US / international phone number was not saved during member registration.
Membership · Registration
Register with a US/intl phone; the number persists on the member's profile.
#199
Member avatars not loading — avatarUrl was stored as inline data: URIs instead of S3 keys.
Membership · Profile / avatars
Upload a member avatar; it displays in the directory and profile (loaded from storage, not broken).
#180
Add-Host member search — search icon was off-center.
Members · Search UI
Open the host/member search; the search icon is aligned.
#151 ⚠ verify
Admin reactivate did not reset membershipExpiresAt → member silently re-expired on the next renewal run (OQ-RET-16).
Membership · Reactivation / renewal
On dev the reactivate handler itself still doesn't set a new expiry — verify the behaviour via the renewal run (reactivated member should not immediately re-expire). Report what you observe.
💳 Payments & Billing
(Invoice discount #152 and late-fee engine #153/#158 are not on stage — see the ⛔ box at the top.)
🐛 Bug Fixes
#
Fix
Feature
What to verify on stage
#142
Member PaymentModal showed blank / no payment options — usePayment.loadMethods() never fetched channels.
Payments · Member payment modal
As a member, open a payable invoice → Pay; payment channel options appear.
#144
Bulk "Pay Selected" modal showed blank / no options.
Tenant logo not rendering in transactional emails (Set-Up-Password CTA + ~20 senders); the /images/* CORP header blocked logos/banners in non-proxying email clients. Private image kinds were also split onto /secure-images/* (defense-in-depth).
Communications · Email branding / images
Trigger a transactional email (e.g. password setup); the tenant logo + any banner render in the email (check via the MailHog web UI: https://stg-webmail.membervu.com).
🔑 Auth & Login
✨ Enhancements
#
Change
Feature
What to verify on stage
#160–#165
Sign-in via modal: login now opens in a modal from public event pages, the event catalog, the tenant-header "Sign In", and the registration "existing member" CTA (previously a full-page redirect). Platform-admin redirect + accessibility handled.
Auth · Login modal
From a public event page / catalog / tenant header, click Sign In; a login modal opens (no full-page navigation). After login you land back where you were.
🛡 RBAC
#
Fix
Feature
What to verify on stage
#122 🔒
Suspension audit-log endpoint was missing a role guard (now guarded).
RBAC · Suspension audit
A non-privileged user cannot read the suspension audit-log endpoint (403).
#148 ⚠ still 403 on dev
Treasury dashboard returned 403 for all roles — FINANCE:VIEW:treasury was missing from the permission catalog.
RBAC · Finance permissions
Verified not effective on dev: the treasuryRouter exists but FINANCE:VIEW:treasury is still absent from the seeded catalog, so the dashboard still 403s for everyone. Confirm on stage and re-open if so.
🔒 Security Hardening (VAPT batch)
A large backend security-hardening batch closed this week (issues #121–#140, #150). Most are not directly visible to a tester (JWT secret/algorithm hardening, webhook integrity, audit-log PII scrubbing, SSRF/config). A few have observable behaviour worth a spot-check:
#
Hardening
Feature
What to verify on stage
#127
SVG uploads were accepted and served as image/svg+xml → stored XSS.
Uploads
Attempt to upload an .svg as an avatar/logo; it should be rejected or sanitized (not served as executable SVG).
#129
Guest registration capacity check was unguarded against a last-slot race.
Events · Guest registration
Two guests racing for the final seat — only one succeeds; the event does not over-book.
#167 / #168
Suspending a member did not revoke their active sessions (JWT stayed valid).
Membership · Suspension / session
Suspend a logged-in member; their existing session is invalidated (next request forces re-auth).
#123
Public-invoice payment marked an invoice PAID with no Payment record.
Payments · Public invoice
Pay a public invoice; a corresponding Payment record exists (visible in admin Payments).
No direct tester action — backend hardening. Note any auth/session anomalies if observed.
Source: membervu/membervu-pm issues closed 2026-06-04 → 2026-06-10. Stage builds from dev. Generated for the MemberVu Test Guide on 2026-06-10. Internal/test-infra closures (#141 test-helper flake, #154 retention fixtures, #169/#190 test coverage, #157 FE message check, #196 dev-build fix) are omitted as non-tester-facing.