Trial cancellation hard-deletes appointments; no paid-trial refund path (audit C5/M7 — must precede #969)

[teetangh]

Context

Trial cancellation hard-deletes the appointment (tx.appointment.delete, app/api/trials/[trialId]/route.ts:504-517, 710-727), violating the soft-cancel doctrine every other type follows. Because Payment.appointment is onDelete: Cascade, this becomes a money-destroying delete the moment paid trials ship (#969 adds trial payment columns). There is also no refund path for a paid trial cancellation (route.ts:217-224).

Proposed approach

Convert trial cancellation to the standard soft-cancel (status transition plus slot completion-status update, appointment preserved), and add the paid-trial refund path on top of the refund-gateway wiring. This must land before #969 merges.

Audit ids C5/M7; found alongside #998. Blocks #969.

[teetangh]

Triage 2026-08-01 (from #1072 §6.1) — this has stopped being a future risk

The title and body frame this as work that must land before paid trials ship. That framing is now wrong: paid trials already shipped, and the money-destroying path described here is live on dev today.

What changed. PR #969 was closed unmerged, so the issue's dependency looks unresolved — but PR #1046 (feat(trials): wire paid trials through the approval-payment flow) merged and carries the payment wiring instead.

Verified against dev at 839d359c:

• TrialSession.paymentId and the TrialSessionPayment relation are live in prisma/schema.prisma, with onDelete: SetNull on the trial side.
• Payment.appointment is @relation(..., onDelete: Cascade).
• app/api/trials/[trialId]/route.ts still hard-deletes the appointment at line 586 and line 795, in both cases inside a transaction that first disconnects the trial and then calls tx.appointment.delete.

Chained together, cancelling a paid trial deletes the Appointment, which cascade-deletes the Payment row. Because the trial's own payment relation is SetNull, the TrialSession survives with a nulled paymentId and the payment record is simply gone — no refund, no ledger entry, and nothing left to reconcile against Razorpay.

Reclassified as launch: pre-mvp + priority: critical, and it is now the top finance item on the launch gate in #1072.

The fix shape in the original body still stands: convert trial cancellation to the standard soft-cancel that every other appointment type follows (status transition plus slot completion-status update, appointment preserved), and add the paid-trial refund path. A hotfix PR for this is in progress.