2026-09-30 (Dustin): projects.cert_public_url is written only when a cert is actually sent (routes/cert.deliver_cert_internal, after the email goes), never on render. Reason: unlikely.report hides never-sent drafts (9/27), so the render-time write cert_generator_v3 used to do published a live 404 link on the JES tracker (tracker_cert_link) and in the portal for every draft awaiting review. Consequences: preflight probe 7 became cert_public_url_mintable (display project_id + permit number) because the column is null before a first send by design; the cert.kulu.la fallback link is never stored; supabase_write_service.clear_cert_public_url() is the inverse and was run on MAN-9241/9216/9237/9227 (the four never-sent drafts carrying a 404 URL; no tracker rows touched). entirely-api f57ceb5, deployed 2026-09-30.