Session Handoff — 12 Days of Marketing Magic: DFY rebuild, Base44 editor-vs-deploy conflict, fresh code-first master

Where it started

Sondra asked to clean up her first Base44 app ("12 Days of Marketing Magic", original id 692dd8080c8de14061ca0d8f) into a done-for-you lead magnet her vibe coders can clone and rebrand. Requirements evolved during session: no 24-hour expiry, public home page (browse without login, signup fires when a gift is clicked), and it MUST clone correctly every time. Session also included a /prime at start (repeat prime, compile already done).

Decisions locked + what shipped

• Full v2 rebuild of the app code at c:\Users\srver\AIOS-Workspace\aios-starter-kit\PROJECTS\12 Days of Christmas\app\ — 12 duplicate Day pages collapsed into one DayPage.jsx driven by src/config/days.js; all branding in src/config/branding.js. Fixes: blank-input validation, user-facing AI error messages, drip bypass closed (direct /Day12 bounces), timezone-correct calendar-day unlock, 20/day generation cap (localStorage), ErrorBoundary, removed unused Toaster (blocked clicks), replaceAll placeholders, tab title.
• Expiry REMOVED (her explicit choice): days unlock one per calendar day, stay usable forever. ReminderPopup deleted.
• RLS root-cause fix: original rules used bare custom field user_email (never matches — needs data. prefix) so real users got 403 on first use; original app only ever worked for her because admin. Rewritten on built-in created_by per Base44 docs, in base44/entities/UserProgress.jsonc.
• serverUrl bug fixed in src/api/base44Client.js — ejected scaffold passed null serverUrl making ALL API calls hit /null/api/...; now falls back to SDK default.
• Custom branded login page src/pages/Login.jsx (Google + email/OTP register/verify) — code-first apps get no platform login page; also persists token to base44_access_token (SDK keeps it memory-only). Loop-guard added in src/App.jsx.
• CRITICAL DISCOVERY — editor-vs-deploy conflict: CLI-deploying code over an EDITOR-BORN Base44 app leaves the old app inside the editor; pressing Publish restores the old version over the deploy (happened live when Sondra enabled custom auth + published on clone 6a49c409…). Editor-born clones are poisoned for this workflow.
• Resolution: abandoned all editor-born clones; created a FRESH code-first app (same birth pattern as ShortLinks/LinkHub, which passed real clone tests): app 6a49d736a5c794f9de3acac7, live at https://12-days-of-marketing-magic-de3acac7.base44.app. Born public_without_login. Full e2e passed 2026-07-05 ~00:05: anonymous browse + CTA → gift click → signup gate → OTP (via her Gmail alias srverva+finaltest@gmail.com) → auto-login persists → welcome popup → Day 1 → validation → real AI blog post rendered → /Day12 bounce.
• Clone-safety audit of ALL her Base44 apps (her demand, she was very upset): ONLY the 12-Days editor-born line was ever affected. ShortLinks DFY (69b775a3…) clone-verified with a REAL clone (code byte-identical, PROJECTS\ShortLinks DFY\clone\); LinkHub Pro (69f95f9b…) clone-readiness passed clean; PawKeeper + LeadScout code-first and not distributed; her 50+ pure-editor apps can't have this problem. Documented in the handoff file below.
• Dashboard radar row updated in c:\Users\srver\AIOS-Workspace\aios-starter-kit\Sondra Brain\wiki\dashboard.md.

Key files for next session

• c:\Users\srver\AIOS-Workspace\aios-starter-kit\PROJECTS\12 Days of Christmas\handoffs\12-days-dfy-cleanup-2026-07-04.md — full project handoff: final state, app inventory, audit, all fixes. Read first.
• c:\Users\srver\AIOS-Workspace\aios-starter-kit\PROJECTS\12 Days of Christmas\app\ — the codebase, linked (base44/.app.jsonc + .env.local) to master app 6a49d736a5c794f9de3acac7. npx base44 deploy -y ships it.
• c:\Users\srver\AIOS-Workspace\aios-starter-kit\PROJECTS\12 Days of Christmas\app\check-config.mjs — node check-config.mjs validates days.js integrity.
• Plan file: none (no plan drove this session).
• Memory files touched: none.

Running state

• Background processes: none
• Dev servers / ports: none
• Open worktrees / branches: none (app folder has its own nested git repo from eject, uncommitted)
• Playwright MCP browser: profile at C:\Users\srver\AppData\Local\ms-playwright-mcp\mcp-chrome-ce90e1a holds test-user sessions; was flaky all night — kill script at C:\Users\srver\AppData\Local\Temp\claude\c--Users-srver-AIOS-Workspace-aios-starter-kit\54106847-3b35-4bdd-af59-a912d8e1a2c2\scratchpad\kill_pw_chrome.ps1 clears it

Verification — how to confirm things still work

• Open https://12-days-of-marketing-magic-de3acac7.base44.app in incognito — expect full public page + "Unwrap Day 1 Free" CTA, NO login redirect; clicking any gift → branded signup page
• curl -s -H "X-App-Id: 6a49d736a5c794f9de3acac7" "https://base44.app/api/apps/public/prod/public-settings/by-id/6a49d736a5c794f9de3acac7" — expect "public_settings":"public_without_login"
• cd "c:\Users\srver\AIOS-Workspace\aios-starter-kit\PROJECTS\12 Days of Christmas\app" && npx eslint src --quiet && npx vite build — expect clean exit
• Test accounts that exist: srverva+finaltest@gmail.com / FinalTest2026!Ab on the new master; OTP emails readable via gws gmail users messages list --params '{"userId":"me","q":"to:srverva+ALIAS@gmail.com newer_than:1d"}'

Deferred + open questions

• Open (BLOCKING, she was doing it when session ended): Sondra clones the new master (app.base44.com → app 6a49d736… → Settings → Clone App → Create Copy) and pastes the clone link. Next agent must run the SAME full e2e on the clone (fresh signup with a new srverva+…@gmail.com alias, OTP via gws, Day 1 generation, /Day12 bounce) BEFORE she distributes to anyone. She was frustrated the dashboard link opened as visitor — she must be signed in at app.base44.com.
• Open: whether clones of a code-first app inherit deployed site correctly — expected yes (ShortLinks precedent) but THIS app's clone not yet tested.
• Deferred: delete dead apps — CLI copy 6a49994d56f1e14658b34a02, clone "(Copy)" 6a49ab4b079c734cf918e745, clone "(DFY)" 6a49c409b1d2d618b8c799bd. Original 692dd808… stays as archive.
• Deferred: privacy-policy link before wide distribution; delete test users from apps (srverva+magictest/2/dfytest/finaltest); GHL auto-push of signups (currently manual CSV via AdminExport).
• Deferred: vibe-coder distribution mechanics + rebrand instructions (edit src/config/branding.js + days.js; or Base44 chat on their clone — untested on this app type).
• Note: user was VERY upset about clone reliability tonight — do not hand-wave verification; prove everything on the clone before saying done.

Pick up here

Sondra pastes the clone link → run the full e2e battery on the clone (anonymous browse, fresh signup + OTP, Day 1 generation, Day 12 bounce, lead appears in clone's user list) and report pass/fail before she gives it to anyone.