Preview deployments use the PRODUCTION database — preview writes mutate live data

Reported by Yue (confirmed live). Changing a work item's status in the preview deployment also changes it in production — the preview and prod environments share the same database.

Symptom

• Flipping a work item's status in a Vercel preview deployment is immediately reflected in production (and vice-versa: prod changes show in the preview). The two environments read/write the same rows.

Root cause (to verify)

• The Vercel Preview environment's DATABASE_URL resolves to the production Neon database instead of an isolated preview branch.
• This contradicts the intended setup documented in .github/workflows/cleanup-preview-deployments.yml (2026-06-09 note): previews are supposed to point at ONE long-lived shared preview Neon branch (a static DATABASE_URL on Vercel's Preview env). Either that shared branch was never wired as the Preview-scope DATABASE_URL, or the Vercel-managed Neon Marketplace integration is injecting the prod connection string into Preview.

Impact — HIGH (production data integrity / safety)

• Any action taken while testing a preview (status transitions, edits, deletes, reseeds) mutates the live moooon/motir tenant. A preview could corrupt or delete real plan data.
• It also defeats preview isolation: previews can't be exercised safely, and per-PR test data leaks into prod.

Expected

• The Preview environment must use a separate database — the shared preview Neon branch (or a per-PR branch) — and never production.
• Verify: Vercel Project → Settings → Environment Variables → scope Preview → DATABASE_URL points at the preview branch, not prod. Confirm the Neon integration's branch mapping. After the fix, a status flip in a preview must NOT appear in production.

Where

• Vercel project env configuration (not app code): DATABASE_URL for the Preview environment scope.
• Cross-check the Neon Marketplace integration branch mapping and .github/workflows/ notes that assume a separate preview branch.

Notes

• Surfaced while investigating MOTIR-1285 (burndown). Because preview == prod DB, testing the burndown fix on the preview also reads/writes live data.