[Mcgyver-ai]

Summary

Follow-ups from a full-repo audit of main (e493421), covering findings 1–4 and 6. Branched from main, so it's independent of #39–#42.

#	Fix	Test
1	The live SMS sender now honours STOP. The Firebase sendReminders function has been the only live reminder sender since July, and it never read smsSuppressed, so leads who replied STOP kept getting texts. #41 fixes only the disabled Vercel cron route. The function now normalizes the number to E.164, marks non-E.164 numbers failed: invalid number, and marks opted-out leads skipped (functions/smsGuard.js, CommonJS, since functions/ can't import lib/).	lib/__tests__/smsGuard.test.js: suppressed lead stopped, local-format number failed without a lookup, valid number allowed.
2	A double "booked" no longer double-fires. updateProspect reads, decides and writes in one runTransaction, so the second of two concurrent booked updates sees the first one's write and fires no webhooks, reminders or GHL appointment.	prospectService.test.js: a transaction reading an already-booked prospect fires nothing; normal transition still fires; missing prospect → 404.
3	No duplicate prospects from back-to-back replies. ingestInboundReply matches-or-creates inside a transaction (tx.get(query) + tx.set). Firestore server transactions are serializable, so concurrent Meta webhooks for one sender can't both create a prospect.	prospectService.test.js: creates inside the transaction when there's no match, reuses the match otherwise.
4	Outreach to must be exactly one address. nodemailer sends to every address in a comma list, and the unsubscribe check hashed the whole string, so "unsub@x.com, new@y.com" reached an unsubscribed address. New outreachRecipientSchema (single trimmed email); anything else → 400.	schemas.test.js: comma, semicolon and display-name forms rejected.
6	Long threads can be deleted. deleteProspect used one batch, which caps at 500 writes. It now uses db.recursiveDelete, the same as accountService.	prospectService.test.js updated.

Manual step after merge: the Cloud Function is deployed separately from Vercel. Run firebase deploy --only functions:sendReminders, otherwise fix 1 isn't live.

Not in this PR (logged in TASKS.md):

• onProspectBooked still stores prospect.phone as typed. Those reminders now fail visibly instead of sending. Normalizing at save time should wait for fix: UK GDPR/PECR erasure, deletion callback and SMS opt-out #41's normalizeE164.
• The duplicated route/service handlers (audit Install Vercel Speed Insights #5) are a larger refactor, already tracked in fix: close authz and SSRF holes in API routes #40.
• The disagreeing functions/ lockfiles and the in-memory rate-limit growth (audit Fix send-reminders workflow auth header for cron endpoint #7, Install Vercel Web Analytics #8).

Test plan

• yarn test: Test Files 21 passed (21) / Tests 150 passed (150)
• yarn build passes (CI placeholder env): ✓ Compiled successfully / ✓ Generating static pages using 7 workers (75/75)
• node --check functions/index.js functions/smsGuard.js
• Manually verified locally / in preview. Not done: the Cloud Function isn't redeployed, and Vercel previews have no Firebase creds.

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated
dm-forge	Ready	Preview	Oct 17, 2026 1:36pm UTC

[Copilot]

Copilot was unable to review this pull request because the user who requested the review has reached their quota limit.