Session Handoff — Virtual Restyle: Phases 2+3 FULL BUILD (done, verified, safety-checked)

What Sondra asked for

Keep moving without stopping at every little thing: build the whole app out per FABLE-BUILD-PROMPT.md, hold the Cloudflare deploy (deliberately — deploy when there's more to show), and never touch her original repo/main.

What shipped (all on branch relaunch-v2 — main untouched)

Two commits pushed to AmplifAI-Your-Business/testvirtualrestyle:

• 661f922 Phase 1 (re-home off Lovable — was already built last session, committed this session)
• 267234a Phases 2+3 + safety fixes (this session's build)

Phase 2 — lead offer + quality moat

• MLS Compliance Kit (src/components/ComplianceKit.tsx + src/lib/compliance.ts): watermark now reads "Virtually Staged" (legible pill, all download paths), original photo exported alongside, one-click zip = labeled + clean (paid only) + original + disclosure.txt, copy-paste disclosure line, AI-disclosure toggle. Buttons on the result view AND gallery viewer.
• Targeted non-destructive edit loop (src/components/EditRoom.tsx + supabase/functions/edit-room/): brush a mask over one item → Gemini regenerates → the browser composites so ONLY the masked region can change. Pixel-diff proof: 0 changed pixels outside the mask, exact, zero tolerance (verified live; dev builds expose window.__vr_lastEdit for re-testing). Sequential edits supported; edits save back to the gallery (saveEditedStagedImage).
• Guided experience: 8 suggestion chips, searchable example library (14 examples), structure guard (regex blocks wall/window/door/floor/layout requests with a plain-English why), Remove It mode (furniture removal/declutter — verified live).

Phase 3 — credits + CRM + honesty

• Never-expiring credits: credits + credit_grants tables, spend_generation / refund_generation / grant_credits RPCs (migrations 20260704120000 + 20260704150000). Spend order: tester → Pro → paid credits (clean) → free allowance (watermarked). Server-side ONLY — this also fixed a pre-existing double-spend bug (client + server both spent quota). Failed generations auto-refund.
• Stripe (TEST mode): packs $19/10cr, $59/40cr (inline price_data — nothing to pre-create in Stripe), optional Pro $29/mo (50/mo). stripe-webhook verifies signatures + grants idempotently (replay = no-op). Pricing page + landing cards rebuilt; Unlimited/Brokerage tiers removed.
• GoHighLevel: ghl-sync on signup (tag virtualrestyle-signup), webhook tags on purchase (virtualrestyle-paid/-pro). Verified live against her GHL, then test contact deleted.
• Honesty fix (Landing): 4.9★ / "Sell 73% Faster" / "hundreds of agents" all removed; compliance-led hero ("Stage Listings. Stay Legal."), founding-agent framing.
• Legal: real in-app /privacy + /terms (src/pages/Legal.tsx) with AB 723/MLS disclosure duty spelled out. Branding centralized in src/lib/brand.ts (per PRD, for the later Base44 white-label port).

/app-safety-check — run + fixed + re-verified

app-reviewer agent found 3 MUST FIX, all fixed same session:

1. Credit-minting hole: refund_generation was callable by any signed-in user → now REVOKEd from clients, service_role only; stage-room/edit-room refund via service client. Verified: user call → 403, balance unchanged.
2. Storage bucket was public → flipped private + public-read policy dropped. Verified: public URL 400, signed URLs still serve.
3. check-subscription crashed on any active sub (leftover productId ref) → fixed, returns 200.

Plus: global error boundary (white-screen guard), working forgot-password, gallery load-failure state, password min 8, mailto → brand.ts.

Verification evidence

• Backend suite (scratchpad/test_backend.py): 9/9 — webhook missing/bad sig rejected, valid grant, replay idempotent, balance math, checkout test-mode URLs (pack + pro), GHL synced.
• Browser E2E: stage via credit (clean, balance 10→9), edit (→8, →7), removal test (→6), post-redeploy stage (→5). Nav shows "2 of 3 free stagings used · 6 credits" (5 after final check). Compliance zip opened + contents verified. Screenshots + zip in PROJECTS/Virtual Restyle/verification/.
• npm run build clean.

Infra state

• Supabase uyloerfniphfxjvnuwmn: 2 new migrations applied; functions deployed: stage-room, edit-room, create-checkout, stripe-webhook, ghl-sync, check-subscription (+ Phase 1's email fns). Secrets set: STRIPE_SECRET_KEY = sk_test (TEST mode on purpose), STRIPE_WEBHOOK_SECRET (generated; copy in scratchpad whsec.txt — regenerate at launch from the real Stripe endpoint), GHL_API_KEY, GHL_LOCATION_ID, plus Phase 1's GEMINI/RESEND keys.
• Dev server: cd "PROJECTS/Virtual Restyle/app" && npm run dev → http://localhost:8080. Test login: srverva+vrtest1@gmail.com / VrTest!2026#Phase1 (~5 test credits left).

Launch checklist (deliberately NOT done)

1. Phase 0 distribution test (PRD gate): stage 5 real listings free in an agent FB/Reddit group — post draft offer still open.
2. Stripe LIVE: swap STRIPE_SECRET_KEY to the live key + create a real webhook endpoint in the Stripe dashboard pointing at https://uyloerfniphfxjvnuwmn.supabase.co/functions/v1/stripe-webhook + set its signing secret.
3. Google OAuth provider (Supabase dashboard + Google Cloud — ~10 min of her clicks).
4. Turn OFF mailer_autoconfirm; CORS: pin Access-Control-Allow-Origin to the final domain.
5. Cloudflare deploy + attach virtualrestyle.com. Free Supabase project pauses after ~1 week idle — upgrade at launch.
6. Real before/after gallery from Phase 0 results (landing showcase images are still the original stock/staging assets).

Addendum (same day, after Sondra's hands-on test)

Sondra staged a real photo and Gemini altered the structure (removed a bay window) — first-pass staging relied on prompt-only preservation (the edit loop's pixel guarantee never applied to first-pass, by design). Fix shipped + deployed (commit da959da): every staging is now reviewed by a second vision model (gemini-flash-latest, env GEMINI_JUDGE_MODEL) comparing original vs staged structure. On failure → one automatic retry with the judge's findings in the prompt → if still failing, the spend is auto-refunded and the UI shows an amber "structure check" notice ("you were not charged — re-stage"). Judge validated against her exact drifted pair: correctly flagged the removed bay window. Clean stagings verified passing (structureVerified:true, ~33s). Also fixed: Landing's orphan Pro mention now links to /pricing. Cost note: adds 1-2 cheap judge calls (+1 possible image retry) per staging, on her Gemini key.

Still open from before

• Her Supabase DB password → store as SUPABASE_VIRTUALRESTYLE_DB_PASSWORD in master .env (never provided).
• Old Lovable Supabase project spfgqgoakyvtjyywpmtw untouched = rollback.
• Phase 2 of the BUSINESS (Base44 white-label rebuild) — separate track, not started.