Session Handoff — BookifAI Phase 0 money-path fixes (shipped live)

Where it started

Sondra pasted a BookifAI session handoff (Fable-mode money-path audit: 3 findings, plan reordered so money-path fixes come before nav/UX). She then greenlit Phase 0 with "fix everything in place, don't stop to ask unless 100% crucial," and separately ordered Agent Opus permanently off the board ("we've already taken care of it"). Scope this session = Phase 0 only (the 3 money holes) + Agent Opus cleanup. Phases 1–4 untouched.

Decisions locked + what shipped

• #1 export paywall bypass — server gate (NOT full server-side assembly). New edge fn authorize-export re-checks book_meters.entitlement === 'paid' under the caller's JWT (RLS proves ownership+payment). ExportOptions.tsx now guards all 5 download formats (KDP/PDF/Word/txt/HTML) through a guardExport() call. Closes the realistic DevTools-flip freeloader. Residual (Phase 0b): file still assembled client-side, so a dev who RE's the bundle can extract their OWN text (illustrations stay server-gated) — deliberately NOT one-shot on a live money app.
• #2 refund clawback. Migration adds purchases.refunded_at + revoke_purchase(p_session) RPC (service_role, idempotent, floors credits at 0, reverts single book to unpaid). stripe-webhook/index.ts now handles charge.refunded + charge.dispute.created, mapping payment_intent → checkout session → revoke.
• #3 AI-bill drain. Migration adds profiles.ai_text_day/ai_text_day_count + claim_ai_text_quota(p_user,p_limit=100) RPC (service_role, fail-CLOSED on error). Wired into generate-title, generate-toc, ideation-chat (text actions only, not generate_cover), and the LEGACY edit path of generate-chapter. Book-writing chapter path left untouched (already slot-gated).
• Stripe webhook subscription — DONE via API this session. Endpoint we_1TrRAWRvzUwDwHkjpjU3bffO was checkout.session.completed-only; updated via STRIPE_API_KEY_MAIN (rk_live) to also send charge.refunded + charge.dispute.created. Clawback now actually fires.
• Deployed + verified live (Supabase umnlokuehteqwrheoyai, migration 20260710020000_money_path_hardening, 6 functions via Supabase CLI; CF Pages bookifai). Committed LOCALLY only: 1d07930 (remote is lovable-remix upstream — not pushed, matches prior practice).
• Agent Opus — permanently closed. Dashboard already had it closed; added a "do not resurface" banner to top of open-questions.md + struck the 2 live credit-expiry render bullets.

Key files for next session

• c:\Users\srver\AIOS-Workspace\aios-starter-kit\reference\fable-mode-money-path-audit.md — findings log; read the 2026-07-10 entries (audit + "Phase 0 fixes SHIPPED") for full detail incl. residuals.
• c:\Users\srver\AIOS-Workspace\aios-starter-kit\Sondra Brain\wiki\memory\open-questions.md — top section "BookifAI — Phase 0 money-path fixes SHIPPED" lists residuals + Phases 1–4 backlog.
• c:\Users\srver\AIOS-Workspace\aios-starter-kit\PROJECTS\Bookify AI Studio\app\supabase\functions\authorize-export\index.ts — new gate.
• c:\Users\srver\AIOS-Workspace\aios-starter-kit\PROJECTS\Bookify AI Studio\app\supabase\functions\_shared\quota.ts — daily text quota helper.
• c:\Users\srver\AIOS-Workspace\aios-starter-kit\PROJECTS\Bookify AI Studio\app\supabase\migrations\20260710020000_money_path_hardening.sql
• c:\Users\srver\AIOS-Workspace\aios-starter-kit\PROJECTS\Bookify AI Studio\app\src\components\create-book\ExportOptions.tsx — guardExport() + 5 call sites.
• Original pasted handoff (context for Phases 1–4): c:\Users\srver\AIOS-Workspace\aios-starter-kit\PROJECTS\Bookify AI Studio\handoffs\ (Fable-mode audit handoff, dated 2026-07-10).
• Memory files touched: none.

Running state

• Background processes: none.
• Dev servers / ports: none.
• Open worktrees / branches: none. App repo PROJECTS\Bookify AI Studio\app on main, 1 local commit ahead (1d07930), unpushed.

Verification — how to confirm things still work

• curl -s -o /dev/null -w "%{http_code}" -X POST https://umnlokuehteqwrheoyai.supabase.co/functions/v1/authorize-export -H "Content-Type: application/json" -d '{"projectId":"x"}' → 401 (gateway, no JWT).
• authorize-export with a valid publishable key but no user session → 401 {"ok":false,"error":"Not authenticated"}. With a logged-in unpaid book → 402 not_paid. Paid book → {"ok":true}.
• Live SQL (MCP, project umnlokuehteqwrheoyai): select public.revoke_purchase('nope') → false; select public.claim_ai_text_quota('00000000-0000-0000-0000-000000000000'::uuid,100) → allowed=true reason=no_profile. Both RPCs granted to service_role only.
• bookifai.app live bundle contains authorize-export (grep the referenced assets/index-*.js).
• Stripe webhook we_1TrRAWRvzUwDwHkjpjU3bffO enabled_events = [checkout.session.completed, charge.refunded, charge.dispute.created].

Deferred + open questions

• Deferred: Phase 0b — full server-side file assembly (the airtight #1 fix). Too risky to one-shot on a live money app (KDP bleed/spine geometry). Its own careful task.
• Deferred: Phases 1–4 from the pasted handoff — Phase 1 shared nav/Shell + widen landing; Phase 2 CORS pin off * + DOMPurify sanitize AI HTML (DOMPurify already bundled); Phase 3 Admin dashboard + onboarding + template cards + "any book" copy; Phase 3.5 Import-Your-Book (mammoth.js needs Sondra's OK before install); Phase 4 Google consent branding. Re-run money-path audit + /app-safety-check after any money change.
• Open: refund clawback + purchase/webhook emails are verified by logic/DB but NOT fire-tested end-to-end (live Stripe = a 4242 test card can't complete; real refund is the only true proof). Not required, just not proven.
• Open (from pasted handoff, not this session): BookifAI purchase/receipt emails still missing; her account confirmation landed in Gmail spam; BookifAI Admin area still missing.

Pick up here

Money-path (Phase 0) is done and live; the natural next task is Phase 1 (shared nav Shell like Pain-2-Profit + widen the landing page) — but confirm with Sondra since she's non-technical and was overwhelmed; do not auto-start Phase 0b or push the local commit without her ask.