…Part of #899)

Stream's server-side API bypasses its permission system, so the gate
must live app-side: token minting now requires a session, is bound to
the caller's own userId (staff/admin excepted), and refuses banned
users — a revoked token was otherwise trivially re-mintable.
addMemberToChannel (previously unguarded, zero callers) now allows
only staff/admin or the channel creator, without lazy channel creation
for non-privileged callers.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

…ects (Part of #734)

The payment-success and payment-failure notification paths dragged
4–5-level includes (full User + profile rows across all four
appointment shapes) to read an id and a name. OPT-1 from the retired
payment task file.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

…-chat decisions

All 13 task files verified superseded — fixed in code, tracked in open
issues (#738/#899/#701/#863), or drafts of issue bodies that exist.
The 2026-07-10 issue triage plan moves into docs/roadmap so it is
tracked. Stream docs now state the deliberate consultee↔consultee DM
block (group/event channels are the sanctioned shared space), the
deterministic channel-id design, and moderation token
revocation/deactivation. New ADR covers the #693 enforcement design.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

…fe Set iteration, number money fields

Part of #693.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

…merged 404 branch, session-mocked stream tests

Gemini triage on PR #974: suspension-days input NaN sentinel so the
field can be cleared (Suspend disables until valid); single 404
conditional in the review GET. The channel-actions suite mocks
auth-server/auth-helpers (jest can't parse better-auth ESM) and gains
3 tests for the #899 addMemberToChannel guard.

Part of #693, #899.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

…e server errors in toast, roadmap addendum

The non-throwing Novu wrappers return {success:false} on delivery
failure, so sideEffects.notification now reads the flag instead of
always "ok". The staff toast surfaces the API's 400/409 message.
Roadmap snapshot gains a dated #693-implemented addendum; the ADR
names the best-effort reconciliation path as an explicit follow-up
(the 409 guard defers it, thread left open).

Part of #693.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

Any caller could mint any user's Stream identity and every user was a global Stream admin.

Part of #899
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

…ent at checkout

#971 shipped ProgramConsultantAllowlist and Membership.exclusiveEngagement
as write-only stubs: the flag's only reference was a default-false write and
the allowlist was never read at checkout. Enforcement now runs inside
revalidateInsideLock, under the distributed lock, exactly where the ADR-18
comment pointed: allowlist rows on the funding Program restrict org-sponsored
bookings to listed consultants (zero rows = open network), and an ACTIVE
membership with exclusiveEngagement blocks the consultant's independent
(non-org-owned) plans. Defaults are unchanged, so behaviour only shifts when
an operator opts in. The "hide" half of exclusivity (marketplace visibility
filtering) remains future work per ADR 18.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

…per pair, recompute rating on all mutations

POST /api/user/reviews trusted the body's consulteeProfileId, letting any
user post reviews as any consultee, with no check that they ever booked the
consultant, no per-pair uniqueness, and no recompute of the denormalized
ConsultantProfile.rating that explore sort/filter reads. Reviews are now
authored only as the session's own consultee profile, gated on a completed
booking (COMPLETED consultation/subscription, a held slot, or a
COMPLETED/CONVERTED trial), deduped by @@unique on
(consultantProfileId, consulteeProfileId) with P2002 mapped to 409, and
every create/update/delete recomputes the rating in-transaction via a
shared lib/reviews helper. Also drops the email OR-clause from the public
consultant search, which was a PII enumeration key.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

…hannels

Extends least-privilege role mapping: video-call host and event-channel
creators get channel-scoped grants instead of relying on global admin.

Part of #899
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

…loads, delete objects on retention

Phase-0 hardening: wire the dead queueRecordingTransfer so SUPABASE_PERMANENT
recordings enqueue on recording_ready (cron becomes backstop); stream uploads
instead of buffering the whole blob; retention now deletes the Supabase object,
not just the DB row; bounded transfer concurrency; <72h backlog alert; doc drift.

Part of #899
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

…ENTS gateway enum

Gateway-evaluation ADR marks Lemon/XFlow REMOVE; deletes their checkout stubs,
webhook routes, config, seed refs and doc mentions (and stray day-pass docs).
Stripe retained. Adds DODO_PAYMENTS enum value for post-MVP evaluation.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

…endly conflict

Reuses the checkout tentative-hold machinery so a NOTIFIED waitlist user gets a
real seat reservation for the response window instead of an FCFS race at
checkout; join is transactional with a friendly 409 on double-join.

Part of #837
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

…dempotency, widen reconcile, tx CRUD, shard auto-allocate lock

A single/multi-session subscription reschedule no longer flips the whole
subscription to PENDING (#448); allocate endpoints dedupe double-submits via
Appointment.allocationIdempotencyKey (#837); the reconcile detector uses the
canonical occupancy filter so unpaid/tentative overlaps are caught; webinar/
class plan deletes wrap guard-check+delete in a Serializable tx to close the
check-then-act race; the auto-allocate Redis lock shards by target day so
non-overlapping-day allocations for one consultant no longer serialize (#860),
backstopped by the #440 GiST exclusion constraint.

Closes #860
Part of #837, #448
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

…ollaborator perms, legal constants, DPDP docstring

Trust & safety sweep bundling seven correctness/compliance fixes:
- Referral stash no longer wiped when landing without ?ref= (#891).
- Novu triggers carry a deterministic transactionId (dedup) and fail loud
  via Sentry when unconfigured in prod; reminders pass a per-window key.
- Payment-linked support tickets dedup against an open ticket; staff status
  transition is now a status-guarded CAS (updateMany).
- Collaborator permission booleans are set at invite time; canSeeAttendees
  is enforced on the participant-roster endpoints.
- Legal constants set name=Practitionist and drop the [ADDRESS] placeholder
  and its rendered blocks; contact emails kept as loud TODO placeholders.
- DPDP header docstring corrected to describe the live fail-closed behavior.
- Webinar/class XOR added to the check-constraints.sql sidecar.

Closes #891
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

…eeze wallet on ledger drift

Two verified webhook paths left captured funds stuck on manual ops, and a
detected wallet cache/journal drift was only reported. Reuse the existing
refundPayment infra to auto-refund both captured-but-blocked cases (manual
recovery preserved as the fallback if the refund call itself throws), and
introduce a scoped wallet-spend freeze the checkout path honors on drift.

Part of #837
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

…s, correct session-revoke claim on membership removal

Kills last-write-wins races: compare-and-swap on onboarding final submit
(guarded on onboardingCompleted) and SSO settings PATCH (optimistic
expectedVersion lock); SCIM user provisioning now honors the unverified-org
seat governance (UNVERIFIED_ORG_SEAT_CAP) the invite path already enforces.

For membership removal, no true server-side revoke-by-userId exists: the
BetterAuth admin plugin (revokeUserSessions) is not installed and core
revokeSession needs the target's own session token, so the misleading
"calls revokeSession" comment is corrected to describe the real mechanism —
the sessionGeneration bump the customSession reader honors, with the 24h
cookie-cache window as backstop.

Part of #724, #840
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

…t earnings, wire domain-verify gate

The INVOICE-sponsor trust park was mis-wired: it keyed on the expert's HOST
org instead of the sponsoring org that owes the invoice, consultant earnings
were never parked at all, and the domain-verification gate had zero callers.
An unverified sponsor could book, accrue real consultant/org payables, and
ghost the invoice (#687 threat model).

- E-01: key the PENDING_TRUST decision on payment.organizationId (the sponsor),
  decided once and applied to consultant, primary-org and collaborator-org rows.
- E-02: park ConsultantEarnings under the same sponsor gate; extend the
  release-valve cron to promote parked consultant rows (joined via Payment).
- K-02: call assertVerifiedDomainOrThrow on the INVOICE checkout accrual path
  and the fundingSource->INVOICE transition.
- Host-dashboard honesty: gate host-earnings query/route on ENABLE_HOST_ORGS.

Part of #687, #837
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

…fication

The platform promised a full refund on a consultant no-show but had no code
path — only the MeetingAttendance foundation data existed. Add an hourly job
that detects confirmed consultant no-shows (consultee joined, consultant never
did, past a conservative grace window), full-refunds via B1's refundPayment,
cancels the booking, and notifies both parties. Idempotent via a status CAS
claim plus refundPayment's refundable-balance guard. No schema changes.

Closes #471
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

Earnings flipped to PAID the moment a payout BATCH was created — before
any gateway wire / UTR, and even with ENABLE_LIVE_PAYOUTS off. Finance
exports and consultant/host dashboards therefore claimed money had moved
when no cash had left. Introduce a BATCHED status: batch creation stages
earnings as BATCHED; PAID is written only when the payout row reaches
COMPLETED (+ UTR). Batch-eligibility excludes BATCHED, and every failure
/ reject / reversal path that predates COMPLETED releases BATCHED back to
READY.

Part of #837
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

… window

Option B (compensating-write, not tx-fold). Folding earnings + the BOOKING
journal into the checkout/webhook tx is unsafe: createEarningsFromPayment opens
its OWN withSerializableRetry(prisma.$transaction(Serializable)) — the #896
waiver-race guard needs to abort + re-run the whole tx, impossible nested — and
the double-entry journal lives inside that same internal tx, so folding would
balloon the outer tx's lock footprint/duration. So we keep it post-commit but
stop pretending success: on failure we now page (recordSystemError → Sentry
ERROR + durable SystemEvent) instead of a silent level:warning. The guaranteed
idempotent healer is the existing data-state sync-payment-earnings scan
(SUCCEEDED payment + earnings:none), which keys on row state, not on this
marker. B1 auto-refund / B2 PENDING_TRUST park / B3 BATCHED status are untouched
— initialEarningStatus logic stays inside createEarningsFromPayment.

Part of #837
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

…BigInt-safe amount compare

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

…response, findFirst for relation filters

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

…ual-recovery marker after auto-refund

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

…tentative holds

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

…compute

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

…-message channels

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

…etention delete concurrency

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

…ave behavior changes

- reschedule: partial no longer flips subscription; mock subscription.count
- allocation: day-sharded manual lock key
- capture parity: auto-refund path
- payouts: BATCHED status transitions

Part of #995
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

… onto dev

Part of #693
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

…gin initializes at build

Part of #693
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

The real build fix is the BetterAuth admin roles config (888a7ae); the
analytics route builds fine without force-dynamic, same as on dev.

Part of #693
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

Merges feature/moderation-actions-693 (#974) into the integration branch so
#995 merges cleanly after #974. Union resolutions (not take-one-side):

- stream.action.ts assertCanMintToken: keep #995's getSession(true) cache-bypass
  AND #974's banned-user check AND the isPrivileged/forUserId gate.
- lib/reviews.ts recomputeConsultantRating: add deletedAt:null so soft-removed
  reviews (#974) don't count — the DRY helper (#987) now honors soft-delete;
  staff-moderation route uses the helper instead of an inline duplicate.
- user/reviews/[id] select: union consulteeProfileId + consultantProfileId
  (#987 recompute) + deletedAt (#974 edit-guard).
- channel.action.ts auto-merged: retains both #995's channel_moderator grant
  and #974's addMemberToChannel authz gate.
- tasks/1.txt: honor #974 task-folder retirement (deleted).

Part of #995, #693
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

…r.NaN

Review triage: doc now states re-run is blocked by the 409 guard (remediation
is manual via the best-effort-persisted sideEffects summary); NaN -> Number.NaN.

Part of #693
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

…into integration/cto-audit-wave

The earlier prefer-array-to-sorted fix left toSorted() without a compare
function, which Sonar flags as an unreliable string sort (new_reliability_rating
D). Add localeCompare — matches the payload sort above and makes the dedup key
deterministic.

Part of #995
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

Part of #693
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

Part of #995
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

…ating

Number.parseInt("7.5") silently became 7; validate as an integer and fall back
to the NaN sentinel (Suspend stays disabled) for non-integers. (CodeRabbit)

Part of #693
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

…p/no-show fns (S3776)

Helper extraction only — no behavior change. Money/moderation orchestrators
were accepted in Sonar instead.

Part of #995
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

…into integration/cto-audit-wave

# Conflicts:
#	app/dashboard/staff/[staffId]/(features)/moderation/page.tsx

…ion/cancel orchestrators (S3776)

Helper extraction only — byte-identical behavior (phase split, CAS guards,
refund/hold/ban ordering, and per-step catch-and-record all preserved).

Part of #693
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

…into integration/cto-audit-wave