spree_cm_commissioner 2.15.2 → 2.15.4

data/app/services/spree_cm_commissioner/seats/swap_seats.rb

@@ -0,0 +1,265 @@
+require 'zlib'
+
+module SpreeCmCommissioner
+  module Seats
+    # Swaps the seats assigned to two tickets, or moves one ticket onto an empty seat -- the admin
+    # picks two blocks, which code path runs is derived here from each block's live
+    # ReservedBlock status, never chosen by the caller.
+    #
+    #   success(blocks: [Block, Block])
+    #   | failure(nil, :same_block | :block_not_found | :not_a_seat | :block_not_assigned
+    #                | :different_seat_layout | :different_variant
+    #                | :seat_locked | :seat_on_hold | :nothing_to_swap
+    #                | :guest_checked_in | :seat_no_longer_reserved
+    #                | :target_seat_no_longer_available | :lock_conflict)
+    #   | failure({ guest_name:, messages: [...] }, :guest_invalid)
+    #
+    # IMPORTANT: `cm_reserved_blocks` has a blanket unique index on (block_id, inventory_item_id) --
+    # a block has exactly one row per inventory item for its whole lifetime, reused across its
+    # statuses (the same reason ReservedBlocks::Hold uses find_or_initialize_by(inventory_item:,
+    # block:) rather than creating a fresh row each time). That means `block_id` is each row's
+    # stable identity, never something this service can repoint -- what actually moves between seats
+    # is the *guest*.
+    #
+    # Swap (both blocks carry a `reserved` row): both existing rows are locked (one `SELECT ... FOR
+    # UPDATE ... ORDER BY id`, ascending, so two concurrent swaps touching an overlapping pair always
+    # request row locks in the same order and cannot deadlock), re-verified still reserved and not
+    # checked in, then their `guest_id`s are exchanged. Neither row's `block_id` ever changes, so
+    # neither can collide with the unique index; each produces its own `update`-type PaperTrail
+    # version.
+    #
+    # Move (exactly one block carries a `reserved` row, the other has none or only a `canceled` one):
+    # the ticket's existing row is locked, and the target seat's row is found-or-initialized by
+    # (block: target_block, inventory_item_id: <the ticket's own inventory item>) -- reusing a
+    # `canceled` row there if one exists, same as Hold would. No row to lock at a target that may not
+    # exist yet, so a Postgres advisory lock closes the race window instead (same shape as
+    # InventoryHolds::Acquire's with_advisory_lock!, keyed by the sorted block-id pair rather than an
+    # order id); inside it, the target's row is re-read fresh and re-checked for availability
+    # immediately before writing, closing the TOCTOU gap between the admin's view and this write. The
+    # source row is left behind as `canceled`, not destroyed, so its guest_id and history survive as
+    # the record of where the ticket used to sit; the target row's own `block_id` never changes
+    # either -- only its status/guest/gender move onto it.
+    class SwapSeats
+      prepend ::Spree::ServiceModule::Base
+      extend SpreeCmCommissioner::ServiceModuleThrowable
+
+      def call(block_a_id:, block_b_id:, actor: nil)
+        return failure(nil, :same_block) if block_a_id == block_b_id
+
+        block_a = SpreeCmCommissioner::Block.find_by(id: block_a_id)
+        block_b = SpreeCmCommissioner::Block.find_by(id: block_b_id)
+        return failure(nil, :block_not_found) if block_a.nil? || block_b.nil?
+
+        reject_reason = blocks_ineligibility_reason(block_a, block_b)
+        return failure(nil, reject_reason) if reject_reason
+
+        outcome, log_data = dispatch(block_a, block_b, actor)
+        return failure(nil, outcome) unless outcome == :ok
+
+        CmAppLogger.log(label: "#{self.class.name}#call success", data: log_data)
+        success(blocks: [block_a.reload, block_b.reload])
+      rescue StandardError => e
+        error = { error_type: e.class.name.demodulize, block_a_id: block_a_id, block_b_id: block_b_id, message: e.message }
+        CmAppLogger.error(label: "#{self.class.name}#call failed", data: error)
+        return guest_invalid_failure(e.record) if guest_invalid?(e)
+
+        failure(nil, e.message)
+      end
+
+      private
+
+      # move_guest! runs Guest's own validations, which can fail for reasons unrelated to seats (a
+      # guest saved before a validation was added, a seat whose variant no longer matches the ticket).
+      # The whole swap has already rolled back by here; this only names the guest and what to fix.
+      def guest_invalid?(error)
+        error.is_a?(ActiveRecord::RecordInvalid) && error.record.is_a?(SpreeCmCommissioner::Guest)
+      end
+
+      def guest_invalid_failure(guest)
+        failure({ guest_name: guest.full_name.presence, messages: guest.errors.full_messages }, :guest_invalid)
+      end
+
+      # Everything that can be decided from the two blocks alone, before either's live reservation
+      # status is even read.
+      def blocks_ineligibility_reason(block_a, block_b)
+        return :not_a_seat unless block_a.seatable? && block_b.seatable?
+        return :block_not_assigned if block_a.variant_id.nil? || block_b.variant_id.nil?
+        return :different_seat_layout if block_a.seat_layout_id != block_b.seat_layout_id
+        return :different_variant if block_a.variant_id != block_b.variant_id
+
+        nil
+      end
+
+      # Derives which of Swap/Move applies (or that neither does) from each block's live status, and
+      # runs it.
+      def dispatch(block_a, block_b, actor)
+        reserved_a = block_a.current_reserved_block
+        reserved_b = block_b.current_reserved_block
+        status_a = status_of(reserved_a)
+        status_b = status_of(reserved_b)
+
+        reject_reason = statuses_ineligibility_reason(status_a, status_b)
+        return [reject_reason, nil] if reject_reason
+        return swap!(reserved_a, reserved_b, actor) if status_a == :reserved && status_b == :reserved
+        return move!(reserved_a, block_b, actor) if status_a == :reserved
+
+        move!(reserved_b, block_a, actor)
+      end
+
+      def status_of(reserved_block)
+        reserved_block&.status&.to_sym || :available
+      end
+
+      # A seat reads "available" to #current_reserved_block whether it was never touched or only has
+      # a `canceled` row -- both are valid swap/move targets. `locked`/`on_hold` never are, on either
+      # side, and two `available` sides mean neither block carries a ticket to act on.
+      def statuses_ineligibility_reason(status_a, status_b)
+        return :seat_locked if status_a == :locked || status_b == :locked
+        return :seat_on_hold if status_a == :on_hold || status_b == :on_hold
+        return :nothing_to_swap if status_a == :available && status_b == :available
+
+        nil
+      end
+
+      def checked_in?(reserved_block)
+        guest = reserved_block&.guest
+        guest.present? && guest.check_ins.exists?
+      end
+
+      # Exchanges guest_id (and the other guest-carried fields) between the two rows -- block_id
+      # stays put on each, so this can never collide with the (block_id, inventory_item_id) unique
+      # index. Runs inside a single transaction with both rows locked by one ordered query, so two
+      # concurrent swaps touching an overlapping pair always request Postgres row locks in the same
+      # order and cannot deadlock each other.
+      def swap!(reserved_a, reserved_b, actor)
+        ordered_ids = [reserved_a.id, reserved_b.id].sort
+        outcome = nil
+        log_data = nil
+
+        SpreeCmCommissioner::ReservedBlock.transaction(requires_new: true) do
+          rows = SpreeCmCommissioner::ReservedBlock.lock.where(id: ordered_ids).order(:id).to_a
+
+          if rows.size != 2 || rows.any? { |row| !row.reserved? }
+            outcome = :seat_no_longer_reserved
+            raise ActiveRecord::Rollback
+          elsif rows.any? { |row| checked_in?(row) }
+            outcome = :guest_checked_in
+            raise ActiveRecord::Rollback
+          else
+            row_a = rows.find { |row| row.id == reserved_a.id }
+            row_b = rows.find { |row| row.id == reserved_b.id }
+            carry_a = guest_payload(row_a)
+            carry_b = guest_payload(row_b)
+
+            row_a.update!(**carry_b, updated_by: actor)
+            row_b.update!(**carry_a, updated_by: actor)
+            move_guest!(carry_a[:guest_id], row_b.block_id)
+            move_guest!(carry_b[:guest_id], row_a.block_id)
+
+            outcome = :ok
+            log_data = { mode: :swap, reserved_block_ids: ordered_ids, swapped_guest_ids: [carry_a[:guest_id], carry_b[:guest_id]],
+                         actor_id: actor&.id
+}
+          end
+        end
+
+        [outcome, log_data]
+      end
+
+      def move!(reserved, target_block, actor)
+        return [:guest_checked_in, nil] if checked_in?(reserved)
+
+        with_advisory_lock(swap_lock_key(reserved.block_id, target_block.id)) { perform_move!(reserved, target_block, actor) }
+      end
+
+      def perform_move!(reserved, target_block, actor)
+        outcome = nil
+        log_data = nil
+
+        SpreeCmCommissioner::ReservedBlock.transaction(requires_new: true) do
+          source_row = SpreeCmCommissioner::ReservedBlock.lock.find_by(id: reserved.id)
+
+          if source_row.nil? || !source_row.reserved?
+            outcome = :seat_no_longer_reserved
+            raise ActiveRecord::Rollback
+          elsif checked_in?(source_row)
+            outcome = :guest_checked_in
+            raise ActiveRecord::Rollback
+          else
+            # find_or_initialize_by, same as ReservedBlocks::Hold -- reuses a `canceled` row at this
+            # (block, inventory_item) if one exists, instead of ever creating a second row for the
+            # same pair. `.lock` is a no-op on a row that doesn't exist yet; it only matters when one
+            # does, which is exactly the case this re-check needs to be safe against a concurrent
+            # writer.
+            target_row = SpreeCmCommissioner::ReservedBlock.lock.find_or_initialize_by(block: target_block,
+                                                                                       inventory_item_id: source_row.inventory_item_id
+                                                                                      )
+
+            # Re-read fresh under the lock, not off any memoized association -- this is what closes
+            # the TOCTOU gap between the admin's view and this write.
+            if target_row.persisted? && target_row.unavailable?
+              outcome = :target_seat_no_longer_available
+              raise ActiveRecord::Rollback
+            else
+              target_row.assign_attributes(**guest_payload(source_row), updated_by: actor)
+              target_row.save!
+
+              source_row.update!(status: :canceled, expired_at: nil, updated_by: actor)
+              move_guest!(source_row.guest_id, target_block.id)
+
+              outcome = :ok
+              log_data = {
+                mode: :move, from_reserved_block_id: source_row.id, to_reserved_block_id: target_row.id,
+                from_block_id: source_row.block_id, to_block_id: target_block.id, actor_id: actor&.id
+              }
+            end
+          end
+        end
+
+        [outcome, log_data]
+      end
+
+      # The ReservedBlock row is what the seat map reads, but tickets, the guest email and the Telegram
+      # order message read Guest#block_id / #seat_number, so both have to move together. Plain
+      # update!, same as Guests::UpdateSeat: Guest's own callbacks reassign
+      # seat_number and recompute the order's preload_block_ids from all its guests, so a swap between
+      # two guests of the same order still ends with the right set once both have moved.
+      def move_guest!(guest_id, block_id)
+        guest = SpreeCmCommissioner::Guest.find_by(id: guest_id)
+        guest.update!(block_id: block_id) if guest && guest.block_id != block_id
+      end
+
+      # Everything that belongs to the guest's booking, not to the row's (block, inventory_item)
+      # identity -- what a swap exchanges and a move carries onto the target row.
+      def guest_payload(reserved_block)
+        {
+          status: :reserved,
+          guest_id: reserved_block.guest_id,
+          gender: reserved_block.gender,
+          expired_at: nil,
+          payment_locked_at: reserved_block.payment_locked_at,
+          inventory_date: reserved_block.inventory_date
+        }
+      end
+
+      def swap_lock_key(block_id_a, block_id_b)
+        "spree_cm_commissioner:seats_swap:#{[block_id_a, block_id_b].sort.join('-')}"
+      end
+
+      # Same pg_try_advisory_lock/pg_advisory_unlock shape as InventoryHolds::Acquire, keyed by the
+      # block pair instead of an order id -- a seat has no row of its own to lock until the move
+      # creates (or revives) one, so this is what stands in for a row lock here.
+      def with_advisory_lock(key)
+        lock_id = Zlib.crc32(key)
+        locked = [true, 't'].include?(ActiveRecord::Base.connection.select_value("SELECT pg_try_advisory_lock(#{lock_id})"))
+        return [:lock_conflict, nil] unless locked
+
+        begin
+          yield
+        ensure
+          ActiveRecord::Base.connection.execute("SELECT pg_advisory_unlock(#{lock_id})")
+        end
+      end
+    end
+  end
+end

data/app/services/spree_cm_commissioner/seats/unlock_blocks.rb

@@ -2,9 +2,12 @@ module SpreeCmCommissioner
   module Seats
     # Returns operator-locked seats to sale — the inverse of LockBlocks.
     #
-    # Deletes the locked row and gives the seat back to quantity_available. Rows that are no longer
-    # `locked` — a customer's booking, or a lock already released — are skipped and never resurrected, so
-    # a stale unlock request cannot destroy a real reservation.
+    # Cancels the locked row and gives the seat back to quantity_available. The row is kept rather than
+    # destroyed so the seat's PaperTrail history stays reachable from its block (Seats::BlockHistory) —
+    # a destroyed row's versions are keyed only by its old id. Hold/Reserve/LockBlocks all
+    # find_or_initialize_by (block, inventory_item), so the next booking or lock reuses this row. Rows
+    # that are no longer `locked` — a customer's booking, or a lock already released — are skipped, so a
+    # stale unlock request cannot touch a real reservation.
     #
     #   success(applied: [ReservedBlock, ...], skipped: [{ date:, block_label:, reason: }, ...])
     class UnlockBlocks
@@ -44,17 +47,13 @@ module SpreeCmCommissioner
           inventory_item_id: item.id, block_id: block.id
         )
 
-        # Absent, or belongs to a customer now, or already released — not ours to remove.
+        # Absent, or belongs to a customer now, or already released — not ours to release.
         return :not_locked if reserved_block.nil? || !reserved_block.locked?
 
-        # Stamp the actor before destroying so the paper_trail destroy version records who released it.
-        # update_columns, not update!: the row is about to be deleted, so validations and callbacks are
-        # pointless, and PaperTrail serialises the in-memory attributes either way. (whodunnit is not
-        # configured in this app, so this stamp is the only audit trail for an unlock.)
-        # rubocop:disable Rails/SkipsModelValidations
-        reserved_block.update_columns(updated_by_id: actor.id) if actor.present?
-        # rubocop:enable Rails/SkipsModelValidations
-        reserved_block.destroy!
+        # Reason/note are cleared so a later reuse of this row doesn't carry a stale lock reason; the
+        # lock itself stays readable in the versions. updated_by is what history attributes the
+        # release to — the async lock job runs with no whodunnit.
+        reserved_block.update!(status: :canceled, lock_reason: nil, lock_note: nil, updated_by: actor)
 
         # lock: false — we are already inside item.with_lock. warm_redis: false — the whole
         # grid was warmed once in each_block_date.

data/app/services/spree_cm_commissioner/voting_credits/de_allocate.rb

@@ -10,6 +10,10 @@ module SpreeCmCommissioner
       def call
         return true if already_canceled?
 
+        # Every canceled order lands here, but only paid vote packages get a `purchase` transaction
+        # (free-claim packages record `free_claim` only), so anything else has nothing to refund.
+        return true unless paid_vote_line_items?
+
         # DeAllocate#call
         #   → purchase_transaction_exists? → false
         #   → raise RuntimeError
@@ -41,6 +45,13 @@ module SpreeCmCommissioner
         false
       end
 
+      def paid_vote_line_items?
+        order.line_items
+             .joins(variant: :product)
+             .where(spree_products: { type: SpreeCmCommissioner::ShowEpisode.name, product_type: :vote_package })
+             .any? { |line_item| !line_item.product.claimable_vote_package }
+      end
+
       def purchase_transaction_exists?
         SpreeCmCommissioner::VotingCreditTransaction.exists?(
           idempotency_key: "#{order.number}::purchase"

data/app/views/spree/admin/inventory_holds/_insights.html.erb

@@ -0,0 +1,99 @@
+<%
+  i = @insights
+  hold, order, user = i[:hold], i[:order], i[:user]
+  q = SpreeCmCommissioner::InventoryHoldInsightsQuery
+  uh, ih, uo = i[:user_holds], i[:ip_holds], i[:user_orders]
+  verdicts = {
+    normal: ['success', 'Looks like a normal customer', 'No test, abandon or fraud signals found.'],
+    test: ['info', 'Probably a test order', 'Made by staff or a test account — exclude it from real sales numbers.'],
+    abandon: ['warning', 'Likely abandoned', 'This customer keeps holding seats without paying.'],
+    fraud: ['danger', 'Suspicious activity', 'Hold pattern looks automated or abusive — check the IP section below.']
+  }
+  tone, headline, explanation = verdicts[i[:verdict]]
+%>
+
+<div class="hi-verdict <%= tone %>">
+  <div class="hi-verdict-title"><%= headline %></div>
+  <div class="small"><%= explanation %></div>
+  <% reasons = i[:flags].values.flatten %>
+  <% if reasons.any? %>
+    <ul class="mb-0 mt-2 pl-3 small">
+      <% reasons.each do |reason| %><li><%= reason %></li><% end %>
+    </ul>
+  <% end %>
+</div>
+
+<%= render layout: 'section', locals: { title: 'This order', hint: 'Where the customer stopped in checkout.' } do %>
+  <dl class="hi-kv">
+    <dt>Order</dt><dd><%= order ? link_to(order.number, cart_admin_order_path(order)) : '—' %> · <%= order ? Spree::Money.new(order.total, currency: order.currency) : '—' %></dd>
+    <dt>Checkout step</dt><dd><%= order&.state&.humanize || '—' %></dd>
+    <dt>Payment</dt><dd><%= order&.payment_state&.humanize || 'Never reached payment' %></dd>
+    <dt>Hold</dt><dd><%= hold.status.humanize %><%= " — #{hold.release_reason.humanize.downcase}" if hold.release_reason %> · <%= hold.total_quantity_on_hold.to_i %> seats/items</dd>
+  </dl>
+<% end %>
+
+<%= render layout: 'section', locals: { title: 'Customer history', hint: 'Many paid orders = trusted customer. Zero paid orders = new, stuck, or not a real buyer.' } do %>
+  <div class="mb-2 small">
+    <%= user ? link_to(user.email, admin_user_path(user)) : (order&.email.presence || 'Guest checkout') %>
+    <% i[:roles].each do |role| %><span class="badge badge-dark ml-1"><%= role %></span><% end %>
+  </div>
+  <div class="hi-stats">
+    <%= render 'stat', value: uo[:completed], label: 'Paid orders', tone: ('success' if uo[:completed].positive?) %>
+    <%= render 'stat', value: uo[:incomplete], label: 'Unfinished orders', tone: ('warning' if uo[:completed].zero? && uo[:incomplete].positive?) %>
+    <%= render 'stat', value: uo[:last_completed_at] ? time_ago_in_words(uo[:last_completed_at]) + ' ago' : 'Never', label: 'Last paid' %>
+  </div>
+<% end %>
+
+<%= render layout: 'section', locals: { title: 'How fast is this user holding seats?', hint: 'Counted up to the moment this hold was made. A real person rarely makes more than 1–2 holds in 5 minutes.' } do %>
+  <div class="hi-stats">
+    <%= render 'stat', value: uh[:in_5m], label: 'Holds in 5 min' %>
+    <%= render 'stat', value: uh[:concurrent], label: 'Open right now', tone: ('danger' if uh[:concurrent] >= q::USER_CONCURRENT_HOLDS) %>
+    <%= render 'stat', value: uh[:abandoned], label: 'Expired unpaid', tone: ('warning' if uh[:abandoned] >= q::USER_ABANDONED_NO_CONVERT && uh[:converted].zero?) %>
+    <%= render 'stat', value: "#{uh[:converted]} / #{uh[:total]}", label: 'Paid / all holds' %>
+  </div>
+<% end %>
+
+<%= render layout: 'section', locals: { title: "Same internet address (IP #{hold.ip_address.presence || 'unknown'})", hint: 'Everyone connecting from this IP. Many accounts or many holds in a few minutes from one IP usually means a bot or one person with several accounts. A few users can also be shared office/café WiFi.' } do %>
+  <div class="hi-stats mb-3">
+    <%= render 'stat', value: ih[:in_3m], label: 'Holds in 3 min', tone: ('danger' if ih[:in_3m] >= q::IP_BURST_5M) %>
+    <%= render 'stat', value: ih[:in_5m], label: 'Holds in 5 min', tone: ('danger' if ih[:in_5m] >= q::IP_BURST_5M) %>
+    <%= render 'stat', value: ih[:distinct_users_24h], label: 'Accounts in 24h', tone: ('danger' if ih[:distinct_users_24h] >= q::IP_DISTINCT_USERS_24H) %>
+    <%= render 'stat', value: "#{ih[:converted]} / #{ih[:total]}", label: 'Paid / all holds' %>
+  </div>
+  <% if i[:ip_recent_holds].any? %>
+    <div class="small text-muted mb-1">Latest other holds from this IP</div>
+    <table class="table table-sm small mb-1">
+      <thead class="text-muted"><tr><th>Customer</th><th>Order</th><th>Order status</th><th>Hold</th><th></th></tr></thead>
+      <% i[:ip_recent_holds].each do |h| %>
+        <tr>
+          <td class="text-truncate" style="max-width:160px;"><%= h[:email] || 'Guest' %></td>
+          <td><%= h[:order_number] || '—' %></td>
+          <td class="no-wrap"><%= render 'order_status', state: h[:order_state], payment_state: h[:payment_state] %></td>
+          <td><span class="badge badge-light"><%= h[:status].to_s.humanize %></span></td>
+          <td class="text-muted no-wrap text-right"><%= time_ago_in_words(h[:created_at]) %> ago</td>
+        </tr>
+      <% end %>
+    </table>
+    <%= link_to 'See all holds from this IP →', admin_inventory_holds_path(q: { ip_address_eq: hold.ip_address }), class: 'small' %>
+  <% else %>
+    <div class="small text-muted">No other holds from this IP.</div>
+  <% end %>
+<% end %>
+
+<%= render layout: 'section', locals: { title: "Customer's recent orders", hint: 'Last 10 orders, newest first. A long list of unfinished carts with no paid order is a warning sign.' } do %>
+  <% if i[:recent_orders].any? %>
+    <table class="table table-sm small mb-0">
+      <thead class="text-muted"><tr><th>Order</th><th>Order status</th><th class="text-right">Total</th><th></th></tr></thead>
+      <% i[:recent_orders].each do |o| %>
+        <tr>
+          <td><%= o[:number] %></td>
+          <td class="no-wrap"><%= render 'order_status', state: o[:state], payment_state: o[:payment_state] %></td>
+          <td class="text-right"><%= Spree::Money.new(o[:total], currency: o[:currency]) %></td>
+          <td class="text-muted no-wrap text-right"><%= time_ago_in_words(o[:created_at]) %> ago</td>
+        </tr>
+      <% end %>
+    </table>
+  <% else %>
+    <div class="small text-muted">No orders.</div>
+  <% end %>
+<% end %>

data/app/views/spree/admin/inventory_holds/_insights_drawer.html.erb

@@ -0,0 +1,83 @@
+<%# Hidden until an Insights / Overall insights button is clicked; the body is fetched from its data-url. %>
+<div id="hold_insights_backdrop" class="hold-insights-backdrop"></div>
+<div id="hold_insights_drawer" class="hold-insights-drawer" role="dialog" aria-labelledby="hold_insights_title">
+  <div class="hold-insights-header">
+    <h5 class="mb-0" id="hold_insights_title">Hold insights</h5>
+    <button type="button" class="btn btn-sm btn-outline-secondary" data-dismiss="drawer" aria-label="Close">&times;</button>
+  </div>
+  <div id="hold_insights_body" class="hold-insights-body"></div>
+</div>
+
+<style>
+  .hold-insights-backdrop { position: fixed; inset: 0; background: rgba(0,0,0,.4); opacity: 0; visibility: hidden; transition: opacity .2s ease; z-index: 1040; }
+  .hold-insights-backdrop.open { opacity: 1; visibility: visible; }
+  .hold-insights-drawer { position: fixed; top: 0; right: 0; height: 100%; width: 600px; max-width: 92vw; background: #fff; box-shadow: -2px 0 12px rgba(0,0,0,.2); transform: translateX(100%); transition: transform .25s ease; z-index: 1050; display: flex; flex-direction: column; }
+  .hold-insights-drawer.open { transform: translateX(0); }
+  .hold-insights-header { display: flex; align-items: center; justify-content: space-between; padding: 1rem 1.25rem; border-bottom: 1px solid #e9ecef; }
+  .hold-insights-body { padding: 1.25rem; overflow-y: auto; flex: 1; }
+  .hold-insights-body { background: #f8f9fa; }
+  .hi-section { background: #fff; border: 1px solid #e9ecef; border-radius: .5rem; padding: .875rem 1rem; margin-bottom: 1rem; }
+  .hi-section-title { font-weight: 600; }
+  .hi-section-hint { font-size: .8rem; color: #6c757d; margin-bottom: .75rem; }
+  .hi-stats { display: grid; grid-template-columns: repeat(auto-fill, minmax(115px, 1fr)); gap: .5rem; }
+  .hi-stat { background: #f1f3f5; border-radius: .375rem; padding: .5rem .75rem; }
+  .hi-stat-value { font-size: 1.25rem; font-weight: 600; line-height: 1.2; }
+  .hi-stat-label { font-size: .75rem; color: #6c757d; }
+  .hi-stat.success { background: #e6f4ea; } .hi-stat.success .hi-stat-value { color: #1e7e34; }
+  .hi-stat.warning { background: #fff4e0; } .hi-stat.warning .hi-stat-value { color: #b86e00; }
+  .hi-stat.danger { background: #fdecea; } .hi-stat.danger .hi-stat-value { color: #c0392b; }
+  .hi-verdict { border-radius: .5rem; padding: .875rem 1rem; margin-bottom: 1rem; border-left: 4px solid; }
+  .hi-verdict-title { font-size: 1.05rem; font-weight: 600; }
+  .hi-verdict.success { background: #e6f4ea; border-color: #28a745; }
+  .hi-verdict.info { background: #e7f3fb; border-color: #17a2b8; }
+  .hi-verdict.warning { background: #fff4e0; border-color: #f0a500; }
+  .hi-verdict.danger { background: #fdecea; border-color: #dc3545; }
+  .hi-kv { display: grid; grid-template-columns: 110px 1fr; gap: .25rem .75rem; margin: 0; font-size: .875rem; }
+  .hi-kv dt { color: #6c757d; font-weight: normal; }
+  .hi-kv dd { margin: 0; }
+  .hi-dot { display: inline-block; width: 8px; height: 8px; border-radius: 50%; margin-right: 4px; }
+</style>
+
+<script>
+  (function() {
+    var drawer = document.getElementById('hold_insights_drawer');
+    var backdrop = document.getElementById('hold_insights_backdrop');
+    var body = document.getElementById('hold_insights_body');
+    var title = document.getElementById('hold_insights_title');
+    var requestId = 0;
+
+    function close() {
+      drawer.classList.remove('open');
+      backdrop.classList.remove('open');
+      document.body.style.removeProperty('overflow');
+    }
+
+    backdrop.addEventListener('click', close);
+    drawer.querySelector('[data-dismiss="drawer"]').addEventListener('click', close);
+
+    document.querySelectorAll('.js-hold-insights').forEach(function(button) {
+      button.addEventListener('click', function() {
+        var current = ++requestId;
+        title.textContent = button.dataset.title;
+        body.innerHTML = '<p class="text-muted">Loading…</p>';
+        drawer.classList.add('open');
+        backdrop.classList.add('open');
+        document.body.style.overflow = 'hidden';
+
+        fetch(button.dataset.url, { credentials: 'same-origin', headers: { 'Accept': 'text/html' } })
+          .then(function(response) {
+            if (!response.ok) throw new Error('Request failed (' + response.status + ')');
+            return response.text();
+          })
+          .then(function(html) { if (current === requestId) body.innerHTML = html; })
+          .catch(function(error) {
+            if (current !== requestId) return;
+            var message = document.createElement('p');
+            message.className = 'text-danger';
+            message.textContent = error.message;
+            body.replaceChildren(message);
+          });
+      });
+    });
+  })();
+</script>

data/app/views/spree/admin/inventory_holds/_order_status.html.erb

@@ -0,0 +1,9 @@
+<%# Checkout step + payment state, shared by the holds table and the insights drawer. %>
+<% if state %>
+  <span class="badge <%= state == 'complete' ? 'badge-success' : 'badge-light' %>"><%= state.humanize %></span>
+  <% if payment_state %>
+    <span class="badge <%= { 'paid' => 'badge-success', 'failed' => 'badge-danger', 'void' => 'badge-secondary' }[payment_state] || 'badge-warning' %>"><%= payment_state.humanize %></span>
+  <% end %>
+<% else %>
+  <span class="text-muted">—</span>
+<% end %>

data/app/views/spree/admin/inventory_holds/_overview.html.erb

@@ -0,0 +1,109 @@
+<%
+  o = @overview
+  f = o[:funnel]
+  pct = ->(n) { f[:total].zero? ? 0 : (100.0 * n / f[:total]).round(1) }
+  segments = [
+    [:converted, 'Paid', 'bg-success'],
+    [:open, 'Still in checkout', 'bg-primary'],
+    [:cart_abandoned, 'Left at cart', 'bg-warning'],
+    [:payment_abandoned, 'Left at payment', 'bg-danger'],
+    [:user_canceled, 'Canceled', 'bg-secondary'],
+    [:cart_changed, 'Changed cart', 'bg-info']
+  ]
+%>
+
+<p class="small text-muted">All holds matching the table filters since <strong><%= order_time(@overview_from) %></strong>.</p>
+
+<%= render layout: 'section', locals: { title: 'How did holds end?', hint: '"Left at payment" jumping suddenly usually means a payment gateway problem, not customers.' } do %>
+  <div class="hi-stats mb-3">
+    <%= render 'stat', value: f[:total], label: 'Holds' %>
+    <%= render 'stat', value: "#{f[:conversion_rate]}%", label: 'Paid (conversion)', tone: 'success' %>
+    <%= render 'stat', value: "#{pct.call(f[:cart_abandoned])}%", label: 'Left at cart', tone: 'warning' %>
+    <%= render 'stat', value: "#{pct.call(f[:payment_abandoned])}%", label: 'Left at payment', tone: 'danger' %>
+  </div>
+  <% if f[:total].positive? %>
+    <div class="progress mb-2" style="height: 10px;">
+      <% segments.each do |key, _, css| %>
+        <div class="progress-bar <%= css %>" style="width: <%= pct.call(f[key]) %>%"></div>
+      <% end %>
+    </div>
+    <div class="small d-flex flex-wrap">
+      <% segments.each do |key, label, css| %>
+        <span class="mr-3 no-wrap"><span class="hi-dot <%= css %>"></span><%= label %>: <strong><%= f[key] %></strong></span>
+      <% end %>
+    </div>
+  <% end %>
+<% end %>
+
+<%= render layout: 'section', locals: { title: 'Suspicious bursts', hint: 'Time is cut into 3- and 5-minute blocks. Each row is one IP making many holds inside one block — a human can do 1–2, a bot does 10+.' } do %>
+  <% o[:bursts].each do |bin, rows| %>
+    <div class="small font-weight-bold mb-1">Within <%= bin.sub('m', ' minutes') %></div>
+    <% if rows.any? %>
+      <table class="table table-sm small mb-3">
+        <thead class="text-muted"><tr><th>IP</th><th>When</th><th class="text-right">Holds</th><th class="text-right">Accounts</th></tr></thead>
+        <% rows.each do |row| %>
+          <tr class="<%= 'table-danger' if row[:holds] >= SpreeCmCommissioner::InventoryHoldInsightsQuery::IP_BURST_5M %>">
+            <td><%= link_to row[:ip_address], admin_inventory_holds_path(q: { ip_address_eq: row[:ip_address] }) %></td>
+            <td class="no-wrap"><%= order_time(row[:started_at]) %></td>
+            <td class="text-right"><%= row[:holds] %></td>
+            <td class="text-right"><%= row[:users] %></td>
+          </tr>
+        <% end %>
+      </table>
+    <% else %>
+      <div class="small text-muted mb-3">No IP made more than 1 hold in any <%= bin.sub('m', '-minute') %> block.</div>
+    <% end %>
+  <% end %>
+<% end %>
+
+<%= render layout: 'section', locals: { title: 'Busiest IPs', hint: 'IPs with the most holds. Red = more than 2 accounts on one IP (shared WiFi, or one person with many accounts). Many holds but 0 paid = likely blocking seats.' } do %>
+  <% if o[:top_ips].any? %>
+    <table class="table table-sm small mb-0">
+      <thead class="text-muted"><tr><th>IP</th><th class="text-right">Holds</th><th class="text-right">Accounts</th><th class="text-right">Paid</th></tr></thead>
+      <% o[:top_ips].each do |row| %>
+        <tr class="<%= 'table-danger' if row[:users] > 2 %>">
+          <td><%= link_to row[:ip_address], admin_inventory_holds_path(q: { ip_address_eq: row[:ip_address] }) %></td>
+          <td class="text-right"><%= row[:holds] %></td>
+          <td class="text-right"><%= row[:users] %></td>
+          <td class="text-right"><%= row[:converted] %></td>
+        </tr>
+      <% end %>
+    </table>
+  <% else %>
+    <div class="small text-muted">No holds with an IP.</div>
+  <% end %>
+<% end %>
+
+<%= render layout: 'section', locals: { title: 'Customers who hold but never pay', hint: 'Let holds expire and paid 0 times in this period. These block seats from real buyers.' } do %>
+  <% if o[:abandoners].any? %>
+    <table class="table table-sm small mb-0">
+      <thead class="text-muted"><tr><th>Customer</th><th class="text-right">Expired unpaid</th><th class="text-right">All holds</th></tr></thead>
+      <% o[:abandoners].each do |row| %>
+        <tr>
+          <td class="text-truncate" style="max-width:260px;"><%= link_to row[:email], admin_inventory_holds_path(q: { user_id_eq: row[:user_id] }) %></td>
+          <td class="text-right"><%= row[:abandoned] %></td>
+          <td class="text-right"><%= row[:holds] %></td>
+        </tr>
+      <% end %>
+    </table>
+  <% else %>
+    <div class="small text-muted">Nobody — every customer with expired holds also paid at least once.</div>
+  <% end %>
+<% end %>
+
+<%= render layout: 'section', locals: { title: 'Test & staff accounts', hint: 'Holds by staff (admin/vendor role) or test-looking emails. Not real customers — ignore them in sales numbers.' } do %>
+  <% if o[:test_accounts].any? %>
+    <table class="table table-sm small mb-0">
+      <thead class="text-muted"><tr><th>Account</th><th class="text-right">Holds</th><th></th></tr></thead>
+      <% o[:test_accounts].each do |row| %>
+        <tr>
+          <td class="text-truncate" style="max-width:260px;"><%= link_to row[:email], admin_inventory_holds_path(q: { user_id_eq: row[:user_id] }) %></td>
+          <td class="text-right"><%= row[:holds] %></td>
+          <td class="text-right"><span class="badge <%= row[:staff] ? 'badge-dark' : 'badge-info' %>"><%= row[:staff] ? 'Staff' : 'Test email' %></span></td>
+        </tr>
+      <% end %>
+    </table>
+  <% else %>
+    <div class="small text-muted">None in this period.</div>
+  <% end %>
+<% end %>

data/app/views/spree/admin/inventory_holds/_section.html.erb

@@ -0,0 +1,5 @@
+<div class="hi-section">
+  <div class="hi-section-title"><%= title %></div>
+  <div class="hi-section-hint"><%= hint %></div>
+  <%= yield %>
+</div>

data/app/views/spree/admin/inventory_holds/_stat.html.erb

@@ -0,0 +1,4 @@
+<div class="hi-stat <%= local_assigns[:tone] %>">
+  <div class="hi-stat-value"><%= value %></div>
+  <div class="hi-stat-label"><%= label %></div>
+</div>