grim7/20/2026, 4:20:44 PM

the waitlist popup's postMessage allowlist bakes at build time, but the
dockerfile only declared VITE_SITE_URL — the allowlist was ALWAYS empty
in prod, so the landing never heard back and showed 'didn't finish' on
every successful submission. railway now carries the var
(https://www.tripwire.sh + apex); deploy.md documents it.

Parent38f9bc1