OCLA — Online Coach Launch Academy

Sign-ups come from a Skool community, whose Zapier integration exposes only two events — “Answered Membership Questions” and “New Paid Member.” There's no trial-converted, cancellation, or payment-failed event, and Stripe Express was locked. So access can't be read straight from billing.

The answer is a subscription state machine on the approved-emails table — invited → trial → paid → overdue / cancelled / revoked. A “New Paid Member” webhook (/api/zapier/skool-join) opens a 7-day trial row; feature access is gated by trial day (Module 1 from day 1, Module 2 from day 5, the rest on paid); and from day 7 the app infersconversion — Skool would have removed the member if the auto-charge failed, so continued membership is the signal. A daily Vercel cron drives the trial clock, and admin override buttons are the deliberate manual fallback for the states the platform never reports. It's integration architecture designed around real, missing hooks — not the happy path.

Generation is split into small, per-section endpoints (12 in total) rather than one giant call — that keeps each request inside Vercel's limit (every AI route sets maxDuration = 60 and each fetch carries a 60-second AbortSignal.timeout). Where a screen needs many pieces at once — the eight-section website generator, the ad planner — they fan out in parallel with Promise.allSettled, so one failed section never sinks the rest.

The subtle one is drift. When a user regenerates their client insights, the prompt first strips their previous answers out of the context — otherwise the model anchors to the old wording and returns lightly-reworded variations instead of fresh thinking (especially damaging after a user redoes their niche). Every AI endpoint is also rate-limited (200 requests/hour/user via Upstash Redis, failing open in local dev) to keep a runaway loop from burning the API budget.

Isolation is enforced with row-level securityin Postgres, so the boundary lives in the database rather than hopeful checks in the UI. Privileged work (admin actions, the cron) runs through a server-only service-role client that's never exposed to the browser. Even the support “log in as this user” feature is done safely — the admin mints a server-side magic link and POSTs the token in the request body (never in a URL that could leak) to land in the user's session.

Edits are optimistic with rollback— the change shows immediately and reverts only if the save fails. Autosave treats local state as the source of truth so a slow response can't clobber newer typing, and a per-resource AbortController cancels an in-flight save when a newer one starts, killing out-of-order races. Schema changes ship as additive, numbered migrations (001–019) so live user data is never reshaped from under them, and finished module work exports to polished PDF and DOCX.