@odla-ai/chapter 0.50.0 → 0.52.0

package/dist/worker/index.js

@@ -143,11 +143,11 @@ async function clerkVerifiedPrimaryEmail(db, userId) {
 
 // src/crm-person-projection.ts
 import { createRecord } from "@odla-ai/crm";
-async function ensureProjectedPerson(deps2, input, options = {}) {
+async function ensureProjectedPerson(deps, input, options = {}) {
   const email = String(input.email ?? "").trim().toLowerCase();
   if (!email) throw new Error("crm_projection_email_required");
   const find = async () => {
-    const records = (await deps2.db.query({ crm_record: { $: {
+    const records = (await deps.db.query({ crm_record: { $: {
       where: { type: "person", primaryEmail: email },
       limit: 2
     } } })).crm_record ?? [];
@@ -160,7 +160,7 @@ async function ensureProjectedPerson(deps2, input, options = {}) {
   const digest = new Uint8Array(await crypto.subtle.digest("SHA-256", new TextEncoder().encode(`chapter:person:v1:${email}`)));
   const id6 = `person-${Array.from(digest, (byte) => byte.toString(16).padStart(2, "0")).join("")}`;
   try {
-    const created = await createRecord({ ...deps2, db: deps2.db }, {
+    const created = await createRecord({ ...deps, db: deps.db }, {
       id: id6,
       type: "person",
       input: { ...input, email },
@@ -176,14 +176,14 @@ async function ensureProjectedPerson(deps2, input, options = {}) {
 }
 
 // src/crm-account-projection.ts
-async function syncAccountToCrm(deps2, userId) {
-  const user = (await deps2.db.query({ $users: { $: { where: { id: userId }, limit: 1 } } })).$users?.[0];
+async function syncAccountToCrm(deps, userId) {
+  const user = (await deps.db.query({ $users: { $: { where: { id: userId }, limit: 1 } } })).$users?.[0];
   if (!user || user.deleted === true || typeof user.email !== "string" || !user.email.trim()) return null;
-  const linked = (await deps2.db.query({ crm_record: { $: { where: { type: "person", clerkUserId: userId }, limit: 2 } } })).crm_record ?? [];
+  const linked = (await deps.db.query({ crm_record: { $: { where: { type: "person", clerkUserId: userId }, limit: 2 } } })).crm_record ?? [];
   if (linked.length > 1) throw new Error("crm_projection_identity_ambiguous");
   if (linked.length === 1) return String(linked[0].id);
   const email = user.email.trim().toLowerCase();
-  const peers = (await deps2.db.query({ $users: { $: { where: { email }, limit: 2 } } })).$users ?? [];
+  const peers = (await deps.db.query({ $users: { $: { where: { email }, limit: 2 } } })).$users ?? [];
   if (peers.length !== 1 || peers[0]?.id !== userId) throw new Error("crm_projection_identity_ambiguous");
   const userGuard = {
     ns: "$users",
@@ -192,14 +192,14 @@ async function syncAccountToCrm(deps2, userId) {
     equals: { email: user.email, ...user.deleted !== void 0 ? { deleted: user.deleted } : {} },
     ...user.deleted === void 0 ? { absent: ["deleted"] } : {}
   };
-  const { record: record4 } = await ensureProjectedPerson(deps2, {
+  const { record: record4 } = await ensureProjectedPerson(deps, {
     name: typeof user.name === "string" && user.name.trim() ? user.name : email,
     email
   }, { stage: null, guards: [userGuard], emailConsent: { state: "unsubscribed", source: "account-no-marketing-consent" } });
   if (record4.clerkUserId === userId) return String(record4.id);
   if (record4.clerkUserId != null) throw new Error("crm_projection_identity_conflict");
   try {
-    await deps2.db.transact([{ t: "update", ns: "crm_record", id: String(record4.id), attrs: { clerkUserId: userId } }], {
+    await deps.db.transact([{ t: "update", ns: "crm_record", id: String(record4.id), attrs: { clerkUserId: userId } }], {
       guards: [userGuard, {
         ns: "crm_record",
         id: String(record4.id),
@@ -215,12 +215,37 @@ async function syncAccountToCrm(deps2, userId) {
     });
   } catch (error) {
     if (error.code !== "transact_guard_failed") throw error;
-    const current = (await deps2.db.query({ crm_record: { $: { where: { id: record4.id }, limit: 1 } } })).crm_record?.[0];
+    const current = (await deps.db.query({ crm_record: { $: { where: { id: record4.id }, limit: 1 } } })).crm_record?.[0];
     if (current?.clerkUserId !== userId) throw error;
   }
   return String(record4.id);
 }
 
+// src/worker-alerts.ts
+var consoleErrorRecorder = (error, report) => {
+  console.error("chapter_alert", JSON.stringify({ message: error.message, ...report }));
+};
+function reportChapterAlert(ctx, error, report) {
+  (ctx?.recordError ?? consoleErrorRecorder)(error, report);
+}
+var ACTIVATION_LIMIT = 50;
+function networkCommercialAlerts(ctx, route) {
+  return {
+    exceptionsActivated(activated, activeCount) {
+      if (activated.length === 0) return;
+      reportChapterAlert(ctx, new Error("network commercial exception activated"), {
+        code: "network_commercial_exception_activated",
+        route,
+        attributes: {
+          "odla.commercial.active_exceptions": activeCount,
+          "odla.commercial.activated_exceptions": activated.length
+        },
+        artifacts: { exceptions: activated.slice(0, ACTIVATION_LIMIT).map(({ eventId, kind }) => ({ eventId, kind })) }
+      });
+    }
+  };
+}
+
 // src/worker-context.ts
 var json = (body, status2 = 200) => new Response(JSON.stringify(body), { status: status2, headers: { "content-type": "application/json" } });
 function createWorkerContext(options) {
@@ -330,6 +355,7 @@ function createWorkerContext(options) {
     requirePaymentQuote: options.requirePaymentQuote === true,
     membershipAuthority: options.membershipAuthority,
     membershipAuthorityOperator: options.membershipAuthorityOperator,
+    recordError: options.recordError ?? consoleErrorRecorder,
     getPublicConfig,
     verifyUser,
     makeDb,
@@ -823,6 +849,17 @@ function projectNetworkCommercialEvents(input, sources) {
   };
 }
 
+// src/network-commercial-fact-identity.ts
+var stable = (value) => JSON.stringify(value, function(_key, item) {
+  return item && typeof item === "object" && !Array.isArray(item) ? Object.fromEntries(Object.entries(item).filter(([key3]) => key3 !== "digest").sort(([a], [b]) => a.localeCompare(b))) : item;
+});
+function sameNetworkCommercialFact(stored, incoming) {
+  if (!stored || typeof stored !== "object" || Array.isArray(stored)) return false;
+  const comparable = { ...incoming };
+  if (!stored.seatSubscriptionItems) delete comparable.seatSubscriptionItems;
+  return stable(comparable) === stable(stored);
+}
+
 // src/network-commercial-store.ts
 var eventRowId = (eventId) => `network-commercial-event:${eventId}`;
 var projectionId = (kind, sourceKey, providerId3) => `network-commercial:${kind}:${sourceKey}:${providerId3}`;
@@ -834,6 +871,7 @@ var materializedNamespaces = [
   "networkCommercialRefunds",
   "networkCommercialSeats"
 ];
+var RESOLUTION_ATTRS = ["resolvedDigest", "reviewedDigest", "resolvedBy", "reviewId"];
 async function rows(db, ns) {
   const all = [];
   const pageSize = 500;
@@ -883,13 +921,14 @@ function projectionOps(projection, now) {
     }
   })));
 }
-async function rebuildNetworkCommercialProjection(db, sources, mutationId, now = Date.now()) {
+async function rebuildNetworkCommercialProjection(db, sources, mutationId, now = Date.now(), alerts) {
   const projection = await loadNetworkCommercialProjection(db, sources);
   const [existing, ...materialized] = await Promise.all([
     rows(db, "networkCommercialExceptions"),
     ...materializedNamespaces.map((ns) => rows(db, ns))
   ]);
   const activeIds = new Set(projection.exceptions.map((item) => exceptionId(item.eventId, item.kind)));
+  const wasActive = new Set(existing.filter((row2) => row2.status === "active").map((row2) => String(row2.id)));
   const projectedIds = new Set(projectionOps(projection, now).map((op) => String(op.id)));
   const ops = [
     ...projectionOps(projection, now),
@@ -915,27 +954,80 @@ async function rebuildNetworkCommercialProjection(db, sources, mutationId, now =
       }
     }))
   ];
-  if (ops.length > 0) await db.transact(ops, { mutationId });
+  if (ops.length === 0) return projection;
+  const write = await db.transact(ops, { mutationId });
+  if (!write.duplicate) {
+    alerts?.exceptionsActivated(
+      projection.exceptions.filter((item) => !wasActive.has(exceptionId(item.eventId, item.kind))),
+      projection.exceptions.length
+    );
+  }
   return projection;
 }
-async function ingestNetworkCommercialFact(db, sources, fact, now = Date.now(), legacyDigest) {
-  const found = await db.query({ networkCommercialEvents: { $: { where: { eventId: fact.eventId }, limit: 1 } } });
-  const existing = found.networkCommercialEvents?.[0];
-  if (existing) {
-    const projection2 = await loadNetworkCommercialProjection(db, sources);
-    if (existing.digest === fact.digest || existing.digest === legacyDigest) return { status: "replayed", projection: projection2 };
-    const id7 = exceptionId(fact.eventId, "collision");
-    await db.transact([{ t: "update", ns: "networkCommercialExceptions", id: id7, attrs: {
-      id: id7,
+async function collide(db, sources, stored, fact, now, legacyDigest, alerts) {
+  const id6 = exceptionId(fact.eventId, "collision");
+  const exception = (await db.query({ networkCommercialExceptions: { $: { where: { id: id6 }, limit: 1 } } })).networkCommercialExceptions?.[0];
+  const exact = stored.digest === fact.digest || stored.digest === legacyDigest;
+  const canonical3 = !exact && sameNetworkCommercialFact(stored.fact, fact);
+  if (exact || canonical3) {
+    const recorded = exception?.incomingFact;
+    const resolvable = canonical3 && exception?.status === "active" && (recorded === void 0 || sameNetworkCommercialFact(stored.fact, recorded));
+    if (!resolvable) return { status: "replayed", projection: await loadNetworkCommercialProjection(db, sources) };
+    const reviewId = crypto.randomUUID();
+    await db.transact([
+      { t: "update", ns: "paymentRecoveryReviews", id: reviewId, attrs: {
+        id: reviewId,
+        eventId: fact.eventId,
+        actorUserId: "system",
+        reviewedAt: now,
+        previousDigest: String(stored.digest),
+        providerDigest: fact.digest,
+        scope: "network",
+        previousState: exception,
+        action: "canonical_replay",
+        reason: "a resend matched the retained canonical fact"
+      } },
+      { t: "update", ns: "networkCommercialExceptions", id: id6, attrs: {
+        status: "resolved",
+        resolvedDigest: stored.digest,
+        reviewedDigest: fact.digest,
+        resolvedBy: "system",
+        reviewId,
+        updatedAt: now
+      } }
+    ], { mutationId: `network-commercial-resolve:${fact.eventId}:${fact.digest}`, guards: [
+      { ns: "networkCommercialExceptions", id: id6, exists: true, equals: { status: "active", updatedAt: exception.updatedAt } }
+    ] });
+    const projection2 = await rebuildNetworkCommercialProjection(db, sources, `network-commercial-resolve-rebuild:${fact.eventId}:${fact.digest}`, now, alerts);
+    return { status: "replayed", resolvedCollision: true, projection: projection2 };
+  }
+  if (exception?.status === "resolved" && exception.reviewedDigest === fact.digest) {
+    return { status: "replayed", projection: await loadNetworkCommercialProjection(db, sources) };
+  }
+  const stale = RESOLUTION_ATTRS.filter((attr3) => exception !== void 0 && Object.hasOwn(exception, attr3));
+  await db.transact([
+    ...stale.length ? [{ t: "retract", ns: "networkCommercialExceptions", id: id6, attrs: stale }] : [],
+    { t: "update", ns: "networkCommercialExceptions", id: id6, attrs: {
+      id: id6,
       eventId: fact.eventId,
       kind: "collision",
       status: "active",
       incomingDigest: fact.digest,
+      incomingFact: fact,
       detail: { eventType: fact.eventType, objectId: fact.objectId },
       updatedAt: now
-    } }]);
-    return { status: "collision", projection: await loadNetworkCommercialProjection(db, sources) };
+    } }
+  ]);
+  const projection = await loadNetworkCommercialProjection(db, sources);
+  if (exception?.status !== "active") {
+    alerts?.exceptionsActivated([{ eventId: fact.eventId, kind: "collision", detail: { eventType: fact.eventType, objectId: fact.objectId } }], projection.exceptions.length);
   }
+  return { status: "collision", projection };
+}
+async function ingestNetworkCommercialFact(db, sources, fact, now = Date.now(), legacyDigest, alerts) {
+  const found = await db.query({ networkCommercialEvents: { $: { where: { eventId: fact.eventId }, limit: 1 } } });
+  const existing = found.networkCommercialEvents?.[0];
+  if (existing) return collide(db, sources, existing, fact, now, legacyDigest, alerts);
   const id6 = eventRowId(fact.eventId);
   let lostRace = false;
   let duplicate = false;
@@ -961,25 +1053,15 @@ async function ingestNetworkCommercialFact(db, sources, fact, now = Date.now(),
   if (duplicate || lostRace) {
     const raced = await db.query({ networkCommercialEvents: { $: { where: { eventId: fact.eventId }, limit: 1 } } });
     const row2 = raced.networkCommercialEvents?.[0];
-    const projection2 = await loadNetworkCommercialProjection(db, sources);
-    if (row2?.digest === fact.digest || row2?.digest === legacyDigest) return { status: "replayed", projection: projection2 };
-    const id7 = exceptionId(fact.eventId, "collision");
-    await db.transact([{ t: "update", ns: "networkCommercialExceptions", id: id7, attrs: {
-      id: id7,
-      eventId: fact.eventId,
-      kind: "collision",
-      status: "active",
-      incomingDigest: fact.digest,
-      detail: { eventType: fact.eventType, objectId: fact.objectId },
-      updatedAt: now
-    } }]);
-    return { status: "collision", projection: await loadNetworkCommercialProjection(db, sources) };
+    if (!row2) throw new Error("network commercial event vanished after a lost race");
+    return collide(db, sources, row2, fact, now, legacyDigest, alerts);
   }
   const projection = await rebuildNetworkCommercialProjection(
     db,
     sources,
     `network-commercial-project:${fact.eventId}:${fact.digest}`,
-    now
+    now,
+    alerts
   );
   return { status: "stored", projection };
 }
@@ -994,10 +1076,7 @@ async function readStripeRecoveryEvent(db, eventId) {
   const rawBody = JSON.stringify(response.body);
   return { event: response.body, rawBody, digest: await stripeEventDigest(rawBody) };
 }
-var stable = (value) => JSON.stringify(value, function(_key, item) {
-  return item && typeof item === "object" && !Array.isArray(item) ? Object.fromEntries(Object.entries(item).filter(([key3]) => key3 !== "digest").sort(([a], [b]) => a.localeCompare(b))) : item;
-});
-async function recoverNetworkCommercialEvent(db, sources, eventId, actorUserId, now = Date.now()) {
+async function recoverNetworkCommercialEvent(db, sources, eventId, actorUserId, now = Date.now(), alerts) {
   const eventRowId2 = `network-commercial-event:${eventId}`, exceptionId2 = `network-commercial-exception:${eventId}:collision`;
   const rows5 = await db.query({
     networkCommercialEvents: { $: { where: { id: eventRowId2 }, limit: 1 } },
@@ -1007,9 +1086,7 @@ async function recoverNetworkCommercialEvent(db, sources, eventId, actorUserId,
   if (!stored) throw new Error("stored event not found");
   const provider = await readStripeRecoveryEvent(db, eventId);
   const fact = normalizeNetworkCommercialStripeEvent(provider.event, provider.digest);
-  const comparable = { ...fact };
-  if (!stored.fact?.seatSubscriptionItems) delete comparable.seatSubscriptionItems;
-  if (stable(comparable) !== stable(stored.fact)) throw new Error("Stripe facts differ; collision requires investigation");
+  if (!sameNetworkCommercialFact(stored.fact, fact)) throw new Error("Stripe facts differ; collision requires investigation");
   const id6 = crypto.randomUUID();
   await db.transact([
     { t: "update", ns: "paymentRecoveryReviews", id: id6, attrs: {
@@ -1017,6 +1094,7 @@ async function recoverNetworkCommercialEvent(db, sources, eventId, actorUserId,
       eventId,
       actorUserId,
       reviewedAt: now,
+      action: "recover",
       previousDigest: stored.digest,
       providerDigest: provider.digest,
       scope: "network",
@@ -1027,7 +1105,7 @@ async function recoverNetworkCommercialEvent(db, sources, eventId, actorUserId,
       t: "update",
       ns: "networkCommercialExceptions",
       id: exceptionId2,
-      attrs: { status: "resolved", resolvedDigest: provider.digest, updatedAt: now }
+      attrs: { status: "resolved", resolvedDigest: provider.digest, resolvedBy: actorUserId, reviewId: id6, updatedAt: now }
     }] : []
   ], { mutationId: `payment-recovery:${id6}`, guards: [
     { ns: "networkCommercialEvents", id: eventRowId2, exists: true, equals: { digest: stored.digest } },
@@ -1038,7 +1116,7 @@ async function recoverNetworkCommercialEvent(db, sources, eventId, actorUserId,
       ...exception ? { equals: { status: exception.status, updatedAt: exception.updatedAt } } : {}
     }
   ] });
-  await rebuildNetworkCommercialProjection(db, sources, `payment-recovery-rebuild:${id6}`, now);
+  await rebuildNetworkCommercialProjection(db, sources, `payment-recovery-rebuild:${id6}`, now, alerts);
   return { recovered: true, eventId, reviewId: id6 };
 }
 
@@ -1200,12 +1278,12 @@ function applicationCrmFields(crm, app) {
 }
 
 // src/applicant-projection.ts
-async function upsertPerson(deps2, opts) {
+async function upsertPerson(deps, opts) {
   const email = opts.email.toLowerCase();
-  const crmDeps3 = { crm: deps2.crm, db: deps2.db, now: deps2.now, newId: deps2.newId };
-  const { record: record4, created } = await ensureProjectedPerson(deps2, { ...opts.input, email });
+  const crmDeps3 = { crm: deps.crm, db: deps.db, now: deps.now, newId: deps.newId };
+  const { record: record4, created } = await ensureProjectedPerson(deps, { ...opts.input, email });
   if (!created) await updateRecord(crmDeps3, { id: String(record4.id), input: opts.input, mutationId: opts.mutationId });
-  const initial = deps2.crm.initialStage("person");
+  const initial = deps.crm.initialStage("person");
   if (!created && record4.stage == null && initial) {
     await setStage(crmDeps3, {
       id: String(record4.id),
@@ -1217,7 +1295,7 @@ async function upsertPerson(deps2, opts) {
   }
   return { recordId: String(record4.id) };
 }
-async function projectApplicant(deps2, applicant) {
+async function projectApplicant(deps, applicant) {
   const base = sharedPersonInput({
     email: applicant.email,
     firstName: applicant.firstName,
@@ -1226,18 +1304,18 @@ async function projectApplicant(deps2, applicant) {
     linkedin: applicant.linkedin,
     hubRecordId: applicant.applicationId
   });
-  Object.assign(base, applicationCrmFields(deps2.crm, applicant));
+  Object.assign(base, applicationCrmFields(deps.crm, applicant));
   const mutationId = `apply:${applicant.applicationId}`;
   const extra = applicant.extra ?? {};
-  if (Object.keys(extra).length === 0) return upsertPerson(deps2, { email: applicant.email, input: base, mutationId });
+  if (Object.keys(extra).length === 0) return upsertPerson(deps, { email: applicant.email, input: base, mutationId });
   try {
-    return await upsertPerson(deps2, { email: applicant.email, input: {
+    return await upsertPerson(deps, { email: applicant.email, input: {
       ...base,
       ...extra,
-      ...applicationCrmFields(deps2.crm, applicant)
+      ...applicationCrmFields(deps.crm, applicant)
     }, mutationId });
   } catch {
-    return upsertPerson(deps2, { email: applicant.email, input: base, mutationId });
+    return upsertPerson(deps, { email: applicant.email, input: base, mutationId });
   }
 }
 
@@ -1335,24 +1413,24 @@ function sharedRecordFromCrm(crm, record4, target, sourceId) {
   if (input[nameField] === void 0) input[nameField] = record4.name;
   return sourceId ? { version: 2, source: { siteId: sourceId, recordId: record4.id }, type: record4.type, input } : { version: 1, type: record4.type, hubRecordId: record4.id, input };
 }
-async function findSharedRecord(deps2, record4, tag) {
+async function findSharedRecord(deps, record4, tag) {
   const structured = await getRecordByOrigin(
-    { crm: deps2.crm, db: deps2.db, now: deps2.now, newId: deps2.newId },
+    { crm: deps.crm, db: deps.db, now: deps.now, newId: deps.newId },
     record4.sourceId,
     record4.sourceRecordId
   );
   if (structured) return structured;
-  const mapped = await deps2.db.query({ crm_tag: { $: { where: { tag }, limit: 1 } } });
+  const mapped = await deps.db.query({ crm_tag: { $: { where: { tag }, limit: 1 } } });
   const mappedId = mapped.crm_tag?.[0]?.recordId;
   if (typeof mappedId === "string") {
-    const found = await deps2.db.query({ crm_record: { $: { where: { id: mappedId }, limit: 1 } } });
+    const found = await deps.db.query({ crm_record: { $: { where: { id: mappedId }, limit: 1 } } });
     if (found.crm_record?.[0]) return found.crm_record[0];
   }
-  const def = deps2.crm.type(record4.type);
+  const def = deps.crm.type(record4.type);
   const emailField = def.emailField;
   if (emailField && typeof record4.input[emailField] === "string") {
     const primaryEmail = record4.input[emailField].toLowerCase();
-    const found = await deps2.db.query({
+    const found = await deps.db.query({
       crm_record: { $: { where: { type: record4.type, primaryEmail }, limit: 1 } }
     });
     if (found.crm_record?.[0]) return found.crm_record[0];
@@ -1360,7 +1438,7 @@ async function findSharedRecord(deps2, record4, tag) {
   const domain = record4.input.domain;
   const domainSlot = def.fields.domain?.slot;
   if (typeof domain === "string" && domainSlot) {
-    const found = await deps2.db.query({
+    const found = await deps.db.query({
       crm_record: { $: { where: { type: record4.type, [domainSlot]: domain }, limit: 1 } }
     });
     if (found.crm_record?.[0]) return found.crm_record[0];
@@ -1368,14 +1446,14 @@ async function findSharedRecord(deps2, record4, tag) {
   const nameField = def.nameField ?? "name";
   const name = record4.input[nameField];
   if (record4.type === "company" && typeof name === "string" && name.trim()) {
-    const found = await deps2.db.query({
+    const found = await deps.db.query({
       crm_record: { $: { where: { type: record4.type, name: name.trim() }, limit: 1 } }
     });
     if (found.crm_record?.[0]) return found.crm_record[0];
   }
   return void 0;
 }
-async function projectSharedRecord(deps2, shared, options = {}) {
+async function projectSharedRecord(deps, shared, options = {}) {
   const record4 = normalizeSharedRecord(shared, options.sourceId);
   if (!record4.type.trim() || !record4.sourceId.trim() || !record4.sourceRecordId.trim()) {
     throw new Error("type, source site id, and source record id must be non-empty");
@@ -1384,14 +1462,14 @@ async function projectSharedRecord(deps2, shared, options = {}) {
     throw new Error("signed sender does not match payload source");
   }
   const tag = networkSourceTag(record4.type, record4.sourceRecordId, record4.version === 2 ? record4.sourceId : void 0);
-  const crmDeps3 = { crm: deps2.crm, db: deps2.db, now: deps2.now, newId: deps2.newId };
-  const existing = await findSharedRecord(deps2, record4, tag);
+  const crmDeps3 = { crm: deps.crm, db: deps.db, now: deps.now, newId: deps.newId };
+  const existing = await findSharedRecord(deps, record4, tag);
   let recordId;
   if (existing && typeof existing.id === "string") {
     await updateRecord2(crmDeps3, { id: existing.id, input: record4.input });
     recordId = existing.id;
   } else if (record4.type === "person" && typeof record4.input.email === "string") {
-    const projected = await ensureProjectedPerson(deps2, record4.input);
+    const projected = await ensureProjectedPerson(deps, record4.input);
     recordId = String(projected.record.id);
     if (!projected.created) await updateRecord2(crmDeps3, { id: recordId, input: record4.input });
   } else {
@@ -1402,8 +1480,8 @@ async function projectSharedRecord(deps2, shared, options = {}) {
       mutationId: `share-create:${tag}`
     });
   }
-  await deps2.db.transact(
-    [{ t: "update", ns: "crm_tag", id: tag, attrs: { key: `${recordId}:${tag}`, recordId, tag, createdAt: deps2.now() } }],
+  await deps.db.transact(
+    [{ t: "update", ns: "crm_tag", id: tag, attrs: { key: `${recordId}:${tag}`, recordId, tag, createdAt: deps.now() } }],
     { mutationId: `share-map:${tag}:${recordId}` }
   );
   await upsertRecordOrigin(crmDeps3, {
@@ -1451,21 +1529,21 @@ function billingColumns(app) {
   if (billingStatus !== "canceled" && billingStatus !== "refunded" && Number.isFinite(renewal) && renewal > 0) cols.renewalAt = renewal;
   return cols;
 }
-async function syncApplicationToCrm(deps2, opts) {
+async function syncApplicationToCrm(deps, opts) {
   if (!opts.app.id) throw new Error("crm_application_id_required");
   const emailKey = str(opts.app.email).toLowerCase();
   if (!emailKey) return null;
-  const recordDeps = { crm: deps2.crm, db: deps2.db, now: deps2.now, newId: deps2.newId };
-  const input = personInputFromApp(deps2.chapter, opts.app);
+  const recordDeps = { crm: deps.crm, db: deps.db, now: deps.now, newId: deps.newId };
+  const input = personInputFromApp(deps.chapter, opts.app);
   const stage = opts.stage || void 0;
-  const { record: existing, created } = await ensureProjectedPerson(deps2, input, { stage });
+  const { record: existing, created } = await ensureProjectedPerson(deps, input, { stage });
   const recordId = String(existing.id);
   if (!created) await updateRecord3(recordDeps, { id: recordId, input });
   if (!created && stage && existing.stage !== stage) {
     await setStage2(recordDeps, { id: recordId, to: stage, authorId: "system", mutationId: `crm:stage:${recordId}:${existing.updatedAt}:${stage}` });
   }
   const billing = billingColumns(opts.app);
-  await deps2.db.transact([
+  await deps.db.transact([
     { t: "update", ns: "crm_record", id: recordId, attrs: billing },
     // Optional typed dates are removed with a retract, never an invalid null.
     ...!("renewalAt" in billing) ? [{ t: "retract", ns: "crm_record", id: recordId, attrs: ["renewalAt"] }] : []
@@ -1473,8 +1551,8 @@ async function syncApplicationToCrm(deps2, opts) {
   await linkIdentity(recordDeps, { recordId, email: emailKey, mutationId: `crm:link:${recordId}:${emailKey}` }).catch(() => void 0);
   return recordId;
 }
-async function backfillCrm(deps2) {
-  const data = await deps2.db.query({
+async function backfillCrm(deps) {
+  const data = await deps.db.query({
     applications: { $: { order: { createdAt: "desc" }, limit: 1e3 } }
   });
   const seen = /* @__PURE__ */ new Set();
@@ -1485,7 +1563,7 @@ async function backfillCrm(deps2) {
     if (!key3 || seen.has(key3)) return;
     seen.add(key3);
     try {
-      await syncApplicationToCrm(deps2, { app, stage });
+      await syncApplicationToCrm(deps, { app, stage });
       synced += 1;
     } catch (err) {
       errors.push({ email: key3, error: err instanceof Error ? err.message : String(err) });
@@ -1493,10 +1571,10 @@ async function backfillCrm(deps2) {
   };
   for (const a of data.applications ?? []) await run(a, str(a.status));
   for (let offset = 0; ; offset += 200) {
-    const users = (await deps2.db.query({ $users: { $: { order: { id: "asc" }, limit: 200, offset } } })).$users ?? [];
+    const users = (await deps.db.query({ $users: { $: { order: { id: "asc" }, limit: 200, offset } } })).$users ?? [];
     for (const u of users) {
       try {
-        if (await syncAccountToCrm(deps2, String(u.id))) synced += 1;
+        if (await syncAccountToCrm(deps, String(u.id))) synced += 1;
       } catch (err) {
         errors.push({ email: str(u.email), error: err instanceof Error ? err.message : String(err) });
       }
@@ -1536,26 +1614,32 @@ function planDelivery(input) {
   const transport = !isProd && !redirect ? "log-only" : input.cloudflareReady ? "cloudflare" : "log-only";
   const to = redirect ? input.group.debugEmail : input.to;
   const subject = (redirect ? "[dev] " : "") + render(tpl.subject, vars);
-  const text6 = redirect ? `(dev redirect; original recipient: ${input.to})
+  const text8 = redirect ? `(dev redirect; original recipient: ${input.to})
 
 ` + render(tpl.text, vars) : render(tpl.text, vars);
-  return { deliver: true, transport, to, subject, text: text6, redirected: redirect };
+  return { deliver: true, transport, to, subject, text: text8, redirected: redirect };
 }
 
 // src/notify.ts
-var EMAIL_TEMPLATE_NAMES = ["adminNotification", "paymentConfirmation", "prepEmail", "onboardingInvite"];
-async function sendTemplated(deps2, input) {
-  const { emailLog } = await deps2.db.query({ emailLog: { $: { where: { dedupeKey: input.dedupeKey } } } });
+var EMAIL_TEMPLATE_NAMES = ["adminNotification", "submitConfirmation", "paymentConfirmation", "prepEmail", "onboardingInvite"];
+function fromAddress(configured, name) {
+  const display = name?.trim();
+  if (!display) return configured;
+  const angled = configured.match(/<([^>]+)>/);
+  return { name: display, email: (angled ? angled[1] : configured).trim() };
+}
+async function sendTemplated(deps, input) {
+  const { emailLog } = await deps.db.query({ emailLog: { $: { where: { dedupeKey: input.dedupeKey } } } });
   const prior = Array.isArray(emailLog) ? emailLog : [];
   if (isAlreadySent(prior)) return { sent: true, reason: "already-sent" };
   if (prior.length > 1 || prior.length === 1 && prior[0].deliveryState !== "retry_ready") {
     return { sent: false, reason: "delivery-uncertain" };
   }
-  const cloudflareReady = Boolean(deps2.sender && deps2.from);
-  const override = deps2.debugEmail?.trim();
-  const group = deps2.envName !== "prod" && deps2.debugEmail !== void 0 ? { ...input.group, debugEmail: override && /^[^\s@,;<>]+@[^\s@,;<>]+\.[^\s@,;<>]+$/.test(override) ? override : void 0 } : input.group;
+  const cloudflareReady = Boolean(deps.sender && deps.from);
+  const override = deps.debugEmail?.trim();
+  const group = deps.envName !== "prod" && deps.debugEmail !== void 0 ? { ...input.group, debugEmail: override && /^[^\s@,;<>]+@[^\s@,;<>]+\.[^\s@,;<>]+$/.test(override) ? override : void 0 } : input.group;
   const decision = planDelivery({
-    envName: deps2.envName,
+    envName: deps.envName,
     group,
     template: input.template,
     to: input.to,
@@ -1580,14 +1664,14 @@ async function sendTemplated(deps2, input) {
     transport: decision.transport,
     redirected: decision.redirected,
     dedupeKey: input.dedupeKey,
-    sentAt: deps2.now(),
+    sentAt: deps.now(),
     deliveryState: decision.transport === "log-only" ? "sent" : "sending",
     deliveryAttempt: attempt,
     error: decision.transport === "log-only" ? "" : "delivery-pending",
     ...input.applicationId ? { applicationId: input.applicationId } : {}
   };
   try {
-    const claim = await deps2.db.transact([{ t: "update", ns: "emailLog", id: id6, attrs: row2 }], {
+    const claim = await deps.db.transact([{ t: "update", ns: "emailLog", id: id6, attrs: row2 }], {
       mutationId: `email-claim:${id6}:${attempt}`,
       guards: [previous ? {
         ns: "emailLog",
@@ -1605,8 +1689,8 @@ async function sendTemplated(deps2, input) {
   if (decision.transport === "log-only") return { sent: true };
   let messageId;
   try {
-    const response = await deps2.sender.send({
-      from: deps2.from,
+    const response = await deps.sender.send({
+      from: fromAddress(deps.from, input.group.fromName),
       to: [decision.to],
       subject: String(row2.subject),
       text: String(row2.body),
@@ -1615,12 +1699,12 @@ async function sendTemplated(deps2, input) {
     if (!response || typeof response.messageId !== "string" || !response.messageId) throw new Error("missing delivery receipt");
     messageId = response.messageId;
   } catch {
-    await deps2.db.transact([{ t: "update", ns: "emailLog", id: id6, attrs: { deliveryState: "uncertain", error: "delivery-uncertain" } }], {
+    await deps.db.transact([{ t: "update", ns: "emailLog", id: id6, attrs: { deliveryState: "uncertain", error: "delivery-uncertain" } }], {
       guards: [{ ns: "emailLog", id: id6, exists: true, equals: { deliveryState: "sending", deliveryAttempt: attempt } }]
     });
     return { sent: false, reason: "delivery-uncertain" };
   }
-  await deps2.db.transact([{ t: "update", ns: "emailLog", id: id6, attrs: { deliveryState: "sent", error: "", messageId, sentAt: deps2.now() } }], {
+  await deps.db.transact([{ t: "update", ns: "emailLog", id: id6, attrs: { deliveryState: "sent", error: "", messageId, sentAt: deps.now() } }], {
     mutationId: `email-confirmed:${id6}:${attempt}`,
     guards: [{
       ns: "emailLog",
@@ -1639,6 +1723,7 @@ function emailGroupFrom(row2) {
     name: String(row2.name ?? ""),
     replyTo: str3(row2.replyTo) ?? "",
     debugEmail: str3(row2.debugEmail),
+    fromName: str3(row2.fromName),
     refundPolicyText: str3(row2.refundPolicyText),
     commitmentText: str3(row2.commitmentText),
     normsText: str3(row2.normsText),
@@ -1660,6 +1745,11 @@ function canApprove(status2, p) {
 }
 
 // src/membership-policy.ts
+function seatPurchaseDeadline(offering, member) {
+  if (offering.seatPurchaseWindowCalendarMonths === void 0) return Number(member.termEndsAt);
+  if (Number.isSafeInteger(member.seatPurchaseEndsAt)) return Number(member.seatPurchaseEndsAt);
+  return addMembershipCalendarMonths(Number(member.initialTermStartedAt ?? member.termStartedAt), offering.seatPurchaseWindowCalendarMonths);
+}
 var fail2 = (field) => {
   throw new TypeError(`invalid membership policy: ${field}`);
 };
@@ -1716,7 +1806,7 @@ function membershipOfferingVersion(value) {
     autoRenew: true,
     paymentGraceDays: integer2(input.paymentGraceDays, 0, 60),
     seatPriceCents: integer2(input.seatPriceCents, 1, Number.MAX_SAFE_INTEGER),
-    seatPurchaseWindowCalendarMonths: integer2(input.seatPurchaseWindowCalendarMonths, 1, 120),
+    ...input.seatPurchaseWindowCalendarMonths === void 0 || input.seatPurchaseWindowCalendarMonths === null ? {} : { seatPurchaseWindowCalendarMonths: integer2(input.seatPurchaseWindowCalendarMonths, 1, 120) },
     requiredDisclosures: ids(input.requiredDisclosures)
   };
 }
@@ -2107,7 +2197,7 @@ async function confirmMembershipPayment(db, input, now) {
       initialTermEndsAt: endsAt,
       termStartedAt: paidAt,
       termEndsAt: endsAt,
-      seatPurchaseEndsAt: addMembershipCalendarMonths(Number(paidAt), offering.seatPurchaseWindowCalendarMonths),
+      seatPurchaseEndsAt: seatPurchaseDeadline(offering, { initialTermStartedAt: paidAt, termEndsAt: endsAt }),
       autoRenew: true,
       refundedCents: 0,
       revision: 1,
@@ -2764,24 +2854,22 @@ async function revokeRefundedApplicationRole(db, env, ctx, applicationId) {
   }
 }
 
-// src/payment-notifications.ts
-var groupFor = async (db, app) => {
-  const result = await db.query({ groups: { $: { where: { id: String(app.groupId ?? "") }, limit: 1 } } });
-  return result.groups?.[0];
-};
-var deps = (db, env) => ({
-  db,
-  envName: env.ODLA_ENV,
-  sender: env.SEND_EMAIL,
-  from: env.EMAIL_FROM,
-  debugEmail: env.ODLA_DEBUG_EMAIL,
-  now: () => Date.now(),
-  newId: () => crypto.randomUUID()
-});
-async function paymentConfirmationVariables(db, app) {
+// src/notification-variables.ts
+function lifecycleNotifyDeps(db, env) {
+  return {
+    db,
+    envName: env.ODLA_ENV,
+    sender: env.SEND_EMAIL,
+    from: env.EMAIL_FROM,
+    debugEmail: env.ODLA_DEBUG_EMAIL,
+    now: () => Date.now(),
+    newId: () => crypto.randomUUID()
+  };
+}
+async function frozenCheckoutVariables(db, app) {
   const intent = (await db.query({ subscriptionCheckoutIntents: { $: { where: { id: String(app.id) }, limit: 1 } } })).subscriptionCheckoutIntents?.[0];
   const offer = intent?.membershipOffer, contract = offer?.contract;
-  const offering = contract?.offering;
+  const offering = contract?.offering, quote = intent?.paymentQuote;
   const amount = contract?.dueTodayCents ?? intent?.priceCents;
   const currency = offering?.currency ?? intent?.currency;
   let formatted = "";
@@ -2789,9 +2877,75 @@ async function paymentConfirmationVariables(db, app) {
     formatted = new Intl.NumberFormat("en-US", { style: "currency", currency: currency.toUpperCase() }).format(Number(amount) / 100);
   }
   return {
-    firstName: typeof app.firstName === "string" ? app.firstName : "",
     paymentAmount: formatted,
     paymentAmountSummary: formatted ? ` of ${formatted}` : "",
+    tierName: typeof quote?.tierName === "string" ? quote.tierName : ""
+  };
+}
+async function catalogTierName(db, group, app) {
+  try {
+    return findTier(await loadTiers(db, group), typeof app.tierId === "string" ? app.tierId : null)?.name ?? "";
+  } catch {
+    return "";
+  }
+}
+async function checkoutVariables(db, group, app) {
+  const frozen = await frozenCheckoutVariables(db, app);
+  return frozen.tierName ? frozen : { ...frozen, tierName: await catalogTierName(db, group, app) };
+}
+function formatInstant(at, timeZone) {
+  return new Intl.DateTimeFormat("en-US", {
+    weekday: "long",
+    month: "long",
+    day: "numeric",
+    year: "numeric",
+    hour: "numeric",
+    minute: "2-digit",
+    timeZoneName: "short",
+    timeZone
+  }).format(new Date(at));
+}
+var adminUrlFor = (origin) => `${origin}/admin/`;
+var membersUrlFor = (origin) => `${origin}/members/`;
+function applicantVariables(app) {
+  const text8 = (v) => typeof v === "string" ? v : "";
+  return { firstName: text8(app.firstName), lastName: text8(app.lastName), email: text8(app.email), phone: text8(app.phone), state: text8(app.state) };
+}
+function sampleVariables(origin, timeZone, now = Date.now()) {
+  const startAt = formatInstant(now + 864e5, timeZone);
+  return {
+    firstName: "Sample",
+    lastName: "Person",
+    email: "sample@example.com",
+    phone: "(555) 010-0100",
+    state: "CA",
+    tier: "Membership",
+    tierName: "Membership",
+    paymentAmount: "$100.00",
+    paymentAmountSummary: " of $100.00",
+    paymentNextStep: "Next, schedule your introduction call.",
+    submitNextStep: "Next, schedule your introduction call.",
+    startAt,
+    endAt: formatInstant(now + 864e5 + 45 * 6e4, timeZone),
+    timezone: timeZone,
+    meetUrl: "https://meet.google.com/sample",
+    htmlLink: "https://calendar.google.com/event?eid=sample",
+    meetingTime: startAt,
+    meetingLink: "https://meet.google.com/sample",
+    adminUrl: adminUrlFor(origin),
+    membersUrl: membersUrlFor(origin)
+  };
+}
+
+// src/payment-notifications.ts
+var groupFor = async (db, app) => {
+  const result = await db.query({ groups: { $: { where: { id: String(app.groupId ?? "") }, limit: 1 } } });
+  return result.groups?.[0];
+};
+async function paymentConfirmationVariables(db, app) {
+  return {
+    firstName: typeof app.firstName === "string" ? app.firstName : "",
+    ...await frozenCheckoutVariables(db, app),
     paymentNextStep: app.status === "approved" ? "Your membership is approved." : typeof app.interviewWaivedAt === "number" ? "Your interview is waived. We are completing your membership approval." : "Next, schedule your introduction call."
   };
 }
@@ -2799,7 +2953,7 @@ async function notifyPaymentConfirmed(db, env, eventId, app) {
   if (typeof app.email !== "string" || !app.email) throw new Error("payment notice recipient missing");
   const group = await groupFor(db, app);
   if (!group) throw new Error("payment notice configuration missing");
-  const result = await sendTemplated(deps(db, env), {
+  const result = await sendTemplated(lifecycleNotifyDeps(db, env), {
     group: emailGroupFrom(group),
     template: "paymentConfirmation",
     to: app.email,
@@ -2809,21 +2963,20 @@ async function notifyPaymentConfirmed(db, env, eventId, app) {
   });
   if (!result.sent && !["disabled", "template-missing"].includes(result.reason ?? "")) throw new Error("payment notice reconciliation pending");
 }
-async function notifyAdminOfPayment(db, env, eventId, app) {
+async function notifyAdminOfPayment(db, env, eventId, app, origin = "") {
   try {
     const group = await groupFor(db, app);
     if (!group || typeof group.notificationEmail !== "string" || !group.notificationEmail) return;
-    const text6 = (value) => typeof value === "string" ? value : "";
-    await sendTemplated(deps(db, env), {
+    const { tierName: tierName2 } = await frozenCheckoutVariables(db, app);
+    await sendTemplated(lifecycleNotifyDeps(db, env), {
       group: emailGroupFrom(group),
       template: "adminNotification",
       to: group.notificationEmail,
       vars: {
-        firstName: text6(app.firstName),
-        lastName: text6(app.lastName),
-        email: text6(app.email),
-        phone: text6(app.phone),
-        state: text6(app.state)
+        ...applicantVariables(app),
+        tier: tierName2,
+        tierName: tierName2,
+        ...origin ? { adminUrl: adminUrlFor(origin), membersUrl: membersUrlFor(origin) } : {}
       },
       dedupeKey: `${eventId}:admin`,
       applicationId: String(app.id)
@@ -3143,6 +3296,26 @@ function reportStripePartition(level, eventId, event, disposition) {
     ...stripeEventIdentity(event)
   }));
 }
+var QUARANTINE_DISPOSITIONS = ["quarantine_unmatched", "quarantine_collision"];
+var QUEUE_LIMIT = 500;
+var QUEUE_IDS = 50;
+async function alertStripeQuarantine(db, ctx, eventId, disposition) {
+  const pages = await Promise.all(QUARANTINE_DISPOSITIONS.map(async (value) => (await db.query({ stripeEventReceipts: { $: { where: { disposition: value }, limit: QUEUE_LIMIT } } })).stripeEventReceipts ?? []));
+  const queued = pages.flat();
+  reportChapterAlert(ctx, new Error("stripe webhook quarantined"), {
+    code: "stripe_webhook_quarantined",
+    attributes: {
+      "odla.stripe.disposition": disposition,
+      "odla.stripe.quarantined_count": queued.length,
+      "odla.stripe.queue_truncated": pages.some((page) => page.length >= QUEUE_LIMIT)
+    },
+    artifacts: { eventId, eventIds: queued.slice(0, QUEUE_IDS).map((row2) => String(row2.eventId)) }
+  });
+}
+async function reportStripeCollision(db, ctx, eventId, event) {
+  reportStripePartition("error", eventId, event, "quarantine_collision");
+  await alertStripeQuarantine(db, ctx, eventId, "quarantine_collision");
+}
 async function storeStripeReceipt(db, input) {
   const existing = await receiptFor(db, input.eventId);
   if (existing?.retryReady === true && existing.reviewedDigest === input.digest) {
@@ -3175,17 +3348,18 @@ async function storeStripeReceipt(db, input) {
   const raced = await receiptFor(db, input.eventId);
   return raced?.digest === input.digest || raced?.digest === input.legacyDigest ? "replayed" : "collision";
 }
-async function quarantineStripeEvent(db, eventId, digest, event) {
+async function quarantineStripeEvent(db, eventId, digest, event, ctx) {
   const disposition = "quarantine_unmatched";
   const stored = await storeStripeReceipt(db, { eventId, digest, event, disposition, matched: false });
   if (stored === "collision") {
-    reportStripePartition("error", eventId, event, "quarantine_collision");
+    await reportStripeCollision(db, ctx, eventId, event);
     return json({ ok: true, matched: false, collision: true });
   }
   reportStripePartition("warn", eventId, event, disposition);
+  if (stored === "stored") await alertStripeQuarantine(db, ctx, eventId, disposition);
   return json({ ok: true, matched: false, disposition, ...stored === "replayed" ? { replayed: true } : {} });
 }
-async function replayedStripeReceipt(db, eventId, digest, event, legacyDigest) {
+async function replayedStripeReceipt(db, eventId, digest, event, legacyDigest, ctx) {
   const existing = await receiptFor(db, eventId);
   if (!existing) return null;
   if (existing.retryReady === true && existing.reviewedDigest === digest) return null;
@@ -3195,7 +3369,7 @@ async function replayedStripeReceipt(db, eventId, digest, event, legacyDigest) {
       collisionDigest: digest,
       retryReady: false
     } }], { guards: [{ ns: "stripeEventReceipts", id: String(existing.id), exists: true, equals: { digest: existing.digest } }] });
-    reportStripePartition("error", eventId, event, "quarantine_collision");
+    await reportStripeCollision(db, ctx, eventId, event);
     return json({ ok: true, matched: false, collision: true });
   }
   return json({ ok: true, matched: existing.matched === true, replayed: true });
@@ -3226,16 +3400,16 @@ async function reconcileChapterStripeEvent(input, env, ctx) {
       reportStripePartition("warn", eventId, event, "ignore_sibling");
       return json({ ok: true, matched: false, disposition: "ignore_sibling" });
     }
-    const replay2 = await replayedStripeReceipt(db, eventId, digest, event, legacyDigest);
+    const replay2 = await replayedStripeReceipt(db, eventId, digest, event, legacyDigest, ctx);
     if (replay2) return replay2;
     const localIntent = Boolean(intent && intent.chapterId === ctx.chapter.id && intent.environment === env.ODLA_ENV && (typeof intent.runtime !== "string" || intent.runtime === target.runtime));
     const disposition2 = classifyMemberStripeEvent(identity, target, localIntent);
     if (!localIntent || disposition2 === "quarantine_unmatched") {
-      return quarantineStripeEvent(db, eventId, digest, event);
+      return quarantineStripeEvent(db, eventId, digest, event, ctx);
     }
     if (event.kind === "gift_paid") {
       if (intent.providerObjectId !== event.providerObjectId || intent.status === "refunded" || intent.status === "canceled") {
-        return quarantineStripeEvent(db, eventId, digest, event);
+        return quarantineStripeEvent(db, eventId, digest, event, ctx);
       }
       try {
         const issued = await issueGiftClaim(db, intent, {
@@ -3244,7 +3418,7 @@ async function reconcileChapterStripeEvent(input, env, ctx) {
         }, Date.now());
         const stored3 = await storeStripeReceipt(db, { eventId, digest, legacyDigest, event, disposition: disposition2, matched: true });
         if (stored3 === "collision") {
-          reportStripePartition("error", eventId, event, "quarantine_collision");
+          await reportStripeCollision(db, ctx, eventId, event);
           return json({ ok: true, matched: false, collision: true });
         }
         return json({ ok: true, matched: true, claimId: issued.claimId });
@@ -3260,7 +3434,7 @@ async function reconcileChapterStripeEvent(input, env, ctx) {
     if (claim) await revokeGiftClaim(db, claim, event.reason, Date.now());
     const stored2 = await storeStripeReceipt(db, { eventId, digest, legacyDigest, event, disposition: disposition2, matched: Boolean(claim) });
     if (stored2 === "collision") {
-      reportStripePartition("error", eventId, event, "quarantine_collision");
+      await reportStripeCollision(db, ctx, eventId, event);
       return json({ ok: true, matched: false, collision: true });
     }
     return json({ ok: true, matched: Boolean(claim) });
@@ -3270,12 +3444,12 @@ async function reconcileChapterStripeEvent(input, env, ctx) {
     reportStripePartition("warn", eventId, event, "ignore_sibling");
     return json({ ok: true, matched: false, disposition: "ignore_sibling" });
   }
-  const replay = await replayedStripeReceipt(db, eventId, digest, event, legacyDigest);
+  const replay = await replayedStripeReceipt(db, eventId, digest, event, legacyDigest, ctx);
   if (replay) return replay;
   const localApplication = Boolean(app && String(app.groupId ?? ctx.chapter.id) === ctx.chapter.id && (typeof app.stripeRuntime !== "string" || app.stripeRuntime === target.runtime));
   const disposition = classifyMemberStripeEvent(identity, target, localApplication);
   if (!localApplication || disposition === "quarantine_unmatched") {
-    return quarantineStripeEvent(db, eventId, digest, event);
+    return quarantineStripeEvent(db, eventId, digest, event, ctx);
   }
   if (await archivedChapterMembershipEvent(db, rawBody, app, env, ctx)) {
     await storeStripeReceipt(db, { eventId, digest, legacyDigest, event, disposition, matched: true });
@@ -3292,7 +3466,7 @@ async function reconcileChapterStripeEvent(input, env, ctx) {
       if (receipt.seatId !== event.seatId || receipt.reconciled !== true) throw new Error("invalid seat receipt");
       const stored2 = await storeStripeReceipt(db, { eventId, digest, legacyDigest, event, disposition, matched: true });
       if (stored2 === "collision") {
-        reportStripePartition("error", eventId, event, "quarantine_collision");
+        await reportStripeCollision(db, ctx, eventId, event);
         return json({ ok: true, matched: false, collision: true });
       }
       return json({ ok: true, seatId: event.seatId });
@@ -3316,7 +3490,7 @@ async function reconcileChapterStripeEvent(input, env, ctx) {
     if (intent) {
       const evidence = verifyInitialMembershipInvoice(intent, event.invoice);
       if (evidence.status === "retry") return json({ error: "checkout reconciliation pending" }, 503);
-      if (evidence.status === "mismatch") return quarantineStripeEvent(db, eventId, digest, event);
+      if (evidence.status === "mismatch") return quarantineStripeEvent(db, eventId, digest, event, ctx);
       if (evidence.renewalAt !== void 0) authoritativeEvent = { ...event, renewalAt: evidence.renewalAt };
     }
     if (app.canceled !== true && !["refunded", "declined", "canceled"].includes(String(app.status))) {
@@ -3367,7 +3541,7 @@ async function reconcileChapterStripeEvent(input, env, ctx) {
     } catch {
       return json({ error: "payment notice reconciliation pending" }, 503);
     }
-    if (ctx.chapter.sends.adminNotification === "payment") await notifyAdminOfPayment(db, env, eventId, app);
+    if (ctx.chapter.sends.adminNotification === "payment") await notifyAdminOfPayment(db, env, eventId, app, input.origin);
     if (typeof next.interviewWaivedAt === "number") {
       const approval = await approveApplication({
         db,
@@ -3382,15 +3556,132 @@ async function reconcileChapterStripeEvent(input, env, ctx) {
   }
   const stored = await storeStripeReceipt(db, { eventId, digest, legacyDigest, event, disposition, matched: true });
   if (stored === "collision") {
-    reportStripePartition("error", eventId, event, "quarantine_collision");
+    await reportStripeCollision(db, ctx, eventId, event);
     return json({ ok: true, matched: false, collision: true });
   }
   return json({ ok: true });
 }
 
+// src/network-commercial-resolve.ts
+var EVENT_ID = /^evt_[A-Za-z0-9_]{1,150}$/;
+var fail3 = (message, code) => Object.assign(new Error(message), { code });
+async function resolveNetworkCommercialCollision(db, sources, input, now = Date.now(), alerts) {
+  if (!EVENT_ID.test(input.eventId)) throw fail3("invalid event reference", "invalid_event");
+  const id6 = exceptionId(input.eventId, "collision"), reviewId = `resolve:${input.mutationId}`;
+  const found = await db.query({
+    networkCommercialExceptions: { $: { where: { id: id6 }, limit: 1 } },
+    networkCommercialEvents: { $: { where: { eventId: input.eventId }, limit: 1 } }
+  });
+  const exception = found.networkCommercialExceptions?.[0], stored = found.networkCommercialEvents?.[0];
+  if (exception?.status === "resolved" && exception.reviewId === reviewId) {
+    return { eventId: input.eventId, reviewId, projection: await loadNetworkCommercialProjection(db, sources) };
+  }
+  if (!exception || exception.status !== "active") throw fail3("no active collision for this event", "collision_not_active");
+  if (!stored) throw fail3("stored event not found", "event_not_found");
+  const dismissed = typeof exception.incomingDigest === "string" ? exception.incomingDigest : void 0;
+  const write = await db.transact([
+    { t: "update", ns: "paymentRecoveryReviews", id: reviewId, attrs: {
+      id: reviewId,
+      eventId: input.eventId,
+      actorUserId: input.actorUserId,
+      reviewedAt: now,
+      previousDigest: String(stored.digest),
+      providerDigest: dismissed ?? "",
+      scope: "network",
+      previousState: exception,
+      action: "resolve",
+      reason: input.reason
+    } },
+    { t: "update", ns: "networkCommercialExceptions", id: id6, attrs: {
+      status: "resolved",
+      resolvedDigest: stored.digest,
+      ...dismissed ? { reviewedDigest: dismissed } : {},
+      resolvedBy: input.actorUserId,
+      reviewId,
+      updatedAt: now
+    } }
+  ], { mutationId: input.mutationId, guards: [
+    { ns: "networkCommercialExceptions", id: id6, exists: true, equals: { status: "active", updatedAt: exception.updatedAt } }
+  ] });
+  if (write.duplicate) throw fail3("mutationId was already used for another change", "mutation_reused");
+  const projection = await rebuildNetworkCommercialProjection(db, sources, `${input.mutationId}:rebuild`, now, alerts);
+  return { eventId: input.eventId, reviewId, projection };
+}
+async function retryNetworkCommercialEvent(db, sources, eventId, actorUserId, now = Date.now(), alerts) {
+  if (!EVENT_ID.test(eventId)) throw fail3("invalid event reference", "invalid_event");
+  const active = (await loadNetworkCommercialProjection(db, sources)).exceptions.filter((item) => item.eventId === eventId);
+  if (active.length === 0) throw fail3("event has no active exception", "exception_not_active");
+  const provider = await readStripeRecoveryEvent(db, eventId);
+  const stored = (await db.query({ networkCommercialEvents: { $: { where: { eventId }, limit: 1 } } })).networkCommercialEvents?.[0];
+  const reviewId = crypto.randomUUID();
+  await db.transact([{ t: "update", ns: "paymentRecoveryReviews", id: reviewId, attrs: {
+    id: reviewId,
+    eventId,
+    actorUserId,
+    reviewedAt: now,
+    previousDigest: String(stored?.digest ?? ""),
+    providerDigest: provider.digest,
+    scope: "network",
+    previousState: { exceptions: active },
+    action: "retry"
+  } }], { mutationId: `payment-recovery:${reviewId}` });
+  const fact = normalizeNetworkCommercialStripeEvent(provider.event, provider.digest);
+  const result = await ingestNetworkCommercialFact(db, sources, fact, now, await stripePayloadDigest(provider.rawBody), alerts);
+  return {
+    eventId,
+    reviewId,
+    status: result.status,
+    resolvedCollision: result.status === "replayed" && result.resolvedCollision === true,
+    exceptions: result.projection.exceptions.length
+  };
+}
+
+// src/worker-routes-network-commercial-recovery.ts
+var PATH = "/api/admin/payment-recovery";
+var handleNetworkCommercialRecovery = async (req, url, env, ctx) => {
+  const model = ctx.chapter.networkCommercialReadModel;
+  if (url.pathname !== PATH || !model) return null;
+  if (req.method !== "GET" && req.method !== "POST") return json({ error: "method not allowed" }, 405);
+  const raw2 = ctx.makeDb(env), user = await ctx.verifyUser(req, env);
+  if (!user) return json({ error: "unauthorized" }, 401);
+  if (!await ctx.isSuperAdminEmail(raw2, user.email, user.userId)) return json({ error: "forbidden" }, 403);
+  const db = raw2;
+  if (req.method === "GET") {
+    const { exceptions } = await loadNetworkCommercialProjection(db, model.sources);
+    return json({
+      scope: "network",
+      count: exceptions.length,
+      truncated: false,
+      rows: exceptions.map((item) => ({
+        eventId: item.eventId,
+        kind: item.detail.eventType,
+        disposition: item.kind,
+        sourceKey: item.sourceKey ?? null,
+        retryReady: /^evt_/.test(item.eventId)
+      }))
+    });
+  }
+  let eventId;
+  try {
+    eventId = String((await req.json()).eventId ?? "");
+  } catch {
+    return json({ error: "eventId required" }, 400);
+  }
+  try {
+    const retried = await retryNetworkCommercialEvent(db, model.sources, eventId, user.userId, Date.now(), networkCommercialAlerts(ctx, PATH));
+    return json({ ok: true, ...retried });
+  } catch (error) {
+    const code = error.code;
+    if (code === "invalid_event") return json({ error: "invalid event reference" }, 400);
+    if (code === "exception_not_active") return json({ error: "event has no active exception" }, 409);
+    return json({ error: "Event recovery is pending. Check its provider evidence and retry." }, 503);
+  }
+};
+
 // src/worker-routes-payment-recovery.ts
 var handlePaymentRecovery = async (req, url, env, ctx) => {
-  if (url.pathname !== "/api/admin/payment-recovery" || ctx.chapter.mode !== "chapter") return null;
+  if (url.pathname !== "/api/admin/payment-recovery") return null;
+  if (ctx.chapter.mode !== "chapter") return handleNetworkCommercialRecovery(req, url, env, ctx);
   if (!["GET", "POST"].includes(req.method)) return json({ error: "method not allowed" }, 405);
   const raw2 = ctx.makeDb(env), user = await ctx.verifyUser(req, env);
   if (!user) return json({ error: "unauthorized" }, 401);
@@ -3452,10 +3743,10 @@ var handlePaymentRecovery = async (req, url, env, ctx) => {
 };
 
 // src/worker-routes-admin-named-seat.ts
-var PATH = /^\/api\/admin\/applications\/([0-9a-f-]+)\/named-seat(\/refund)?$/;
+var PATH2 = /^\/api\/admin\/applications\/([0-9a-f-]+)\/named-seat(\/refund)?$/;
 var REFUNDABLE = /* @__PURE__ */ new Set(["renewal_pending", "pending_acceptance", "pending_approval", "pending_primary", "active"]);
 var handleAdminNamedSeat = async (req, url, env, ctx) => {
-  const match = url.pathname.match(PATH);
+  const match = url.pathname.match(PATH2);
   if (!match) return null;
   const seats = ctx.membershipAuthority?.namedSeats;
   if (ctx.chapter.mode !== "chapter" || !seats) return json({ error: "named seats are not configured" }, 404);
@@ -3508,42 +3799,42 @@ async function closeRecipientApplication(db, env, ctx, seatId) {
 
 // src/membership-seat-refund-stripe.ts
 import { stripeRequest as stripeRequest4 } from "@odla-ai/stripe";
-var fail3 = (code = "named_seat_refund_mismatch") => {
+var fail4 = (code = "named_seat_refund_mismatch") => {
   throw Object.assign(new Error(code), { code });
 };
 async function refundNamedSeatStripePayment(secretKey, seat) {
-  if (!seat.providerPaymentIntentId || seat.status !== "refund_pending") fail3();
+  if (!seat.providerPaymentIntentId || seat.status !== "refund_pending") fail4();
   const call = async (method, path, params, idempotencyKey) => {
     const result = await stripeRequest4({ secretKey }, method, path, params, idempotencyKey ? { idempotencyKey } : {});
-    if (!result.ok || !result.body) return fail3("named_seat_refund_provider_unavailable");
+    if (!result.ok || !result.body) return fail4("named_seat_refund_provider_unavailable");
     return result.body;
   };
   const metadata = { ...stripePartitionMetadata(seat), applicationId: seat.applicationId, membershipId: seat.primaryMembershipId, seatId: seat.id };
   const payment = await call("GET", `/v1/payment_intents/${encodeURIComponent(seat.providerPaymentIntentId)}`);
-  if (payment.id !== seat.providerPaymentIntentId || payment.customer !== seat.providerCustomerId || payment.amount !== seat.amountCents || payment.amount_received !== seat.amountCents || payment.currency !== seat.currency || payment.livemode !== (seat.environment === "prod") || payment.status !== "succeeded" || !Object.entries(metadata).every(([key3, value]) => payment.metadata?.[key3] === value)) fail3();
+  if (payment.id !== seat.providerPaymentIntentId || payment.customer !== seat.providerCustomerId || payment.amount !== seat.amountCents || payment.amount_received !== seat.amountCents || payment.currency !== seat.currency || payment.livemode !== (seat.environment === "prod") || payment.status !== "succeeded" || !Object.entries(metadata).every(([key3, value]) => payment.metadata?.[key3] === value)) fail4();
   const sub = await call("GET", `/v1/subscriptions/${encodeURIComponent(seat.providerSubscriptionId)}`);
-  if (sub.id !== seat.providerSubscriptionId || sub.customer !== seat.providerCustomerId || sub.livemode !== (seat.environment === "prod") || !Object.entries({ ...stripePartitionMetadata(seat), applicationId: seat.applicationId }).every(([key3, value]) => sub.metadata?.[key3] === value) || sub.items?.has_more !== false || !Array.isArray(sub.items?.data)) fail3();
+  if (sub.id !== seat.providerSubscriptionId || sub.customer !== seat.providerCustomerId || sub.livemode !== (seat.environment === "prod") || !Object.entries({ ...stripePartitionMetadata(seat), applicationId: seat.applicationId }).every(([key3, value]) => sub.metadata?.[key3] === value) || sub.items?.has_more !== false || !Array.isArray(sub.items?.data)) fail4();
   const items = sub.items.data.filter((item) => item.metadata?.seatId === seat.id);
-  if (items.length > 1) fail3();
+  if (items.length > 1) fail4();
   if (items.length && sub.status !== "canceled") {
     const item = items[0];
-    if (!/^si_[A-Za-z0-9_]+$/.test(item.id) || item.price?.id !== seat.priceId || item.quantity !== 1) fail3();
+    if (!/^si_[A-Za-z0-9_]+$/.test(item.id) || item.price?.id !== seat.priceId || item.quantity !== 1) fail4();
     const removed = await call("DELETE", `/v1/subscription_items/${encodeURIComponent(item.id)}`, { proration_behavior: "none" });
-    if (removed.id !== item.id || removed.deleted !== true) fail3("named_seat_renewal_removal_unconfirmed");
+    if (removed.id !== item.id || removed.deleted !== true) fail4("named_seat_renewal_removal_unconfirmed");
   }
   const list = await call("GET", "/v1/refunds", { payment_intent: seat.providerPaymentIntentId, limit: 100 });
-  if (!Array.isArray(list.data) || list.has_more !== false || list.data.length >= 100) fail3("named_seat_refund_history_incomplete");
+  if (!Array.isArray(list.data) || list.has_more !== false || list.data.length >= 100) fail4("named_seat_refund_history_incomplete");
   let refundedCents = 0, pendingCents = 0;
   const refundIds = [];
   for (const refund of list.data) {
-    if (!/^re_[A-Za-z0-9_]+$/.test(refund.id) || refund.payment_intent !== seat.providerPaymentIntentId || refund.currency !== seat.currency || !Number.isSafeInteger(refund.amount) || refund.amount <= 0 || !["succeeded", "pending", "requires_action", "failed", "canceled"].includes(refund.status)) fail3();
+    if (!/^re_[A-Za-z0-9_]+$/.test(refund.id) || refund.payment_intent !== seat.providerPaymentIntentId || refund.currency !== seat.currency || !Number.isSafeInteger(refund.amount) || refund.amount <= 0 || !["succeeded", "pending", "requires_action", "failed", "canceled"].includes(refund.status)) fail4();
     if (refund.status === "succeeded") {
       refundedCents += refund.amount;
       refundIds.push(refund.id);
     } else if (refund.status === "pending" || refund.status === "requires_action") pendingCents += refund.amount;
   }
-  if (refundedCents + pendingCents > seat.amountCents) fail3();
-  if (pendingCents) fail3("named_seat_refund_pending");
+  if (refundedCents + pendingCents > seat.amountCents) fail4();
+  if (pendingCents) fail4("named_seat_refund_pending");
   if (refundedCents < seat.amountCents) {
     const remaining = seat.amountCents - refundedCents;
     const refund = await call("POST", "/v1/refunds", {
@@ -3552,8 +3843,8 @@ async function refundNamedSeatStripePayment(secretKey, seat) {
       reason: "requested_by_customer",
       metadata
     }, `named-seat-refund:${seat.id}:${remaining}`);
-    if (refund.payment_intent !== seat.providerPaymentIntentId || refund.amount !== remaining || refund.currency !== seat.currency || !/^re_[A-Za-z0-9_]+$/.test(refund.id)) fail3();
-    if (refund.status !== "succeeded") fail3("named_seat_refund_pending");
+    if (refund.payment_intent !== seat.providerPaymentIntentId || refund.amount !== remaining || refund.currency !== seat.currency || !/^re_[A-Za-z0-9_]+$/.test(refund.id)) fail4();
+    if (refund.status !== "succeeded") fail4("named_seat_refund_pending");
     refundedCents += remaining;
     refundIds.push(refund.id);
   }
@@ -3642,9 +3933,37 @@ async function refundNamedSeatByOperator(db, input, stripeSecretKey, now) {
   return { seatId: String(seat.id), status: "refunded", refundedCents: Number(refunded.refundedCents), subscriptionCanceled: false };
 }
 
+// src/membership-seat-window.ts
+async function liftSeatPurchaseWindow(db, scope2, now, limit = 100) {
+  membershipClock(now);
+  if (!Number.isSafeInteger(limit) || limit < 1 || limit > 200) throw new TypeError("invalid lift limit");
+  const state = await loadMembershipAuthorityState(db, scope2);
+  const rows5 = (await db.query({ networkMembership: { $: { where: { ...scope2 }, order: { updatedAt: "asc" }, limit: limit + 1 } } })).networkMembership ?? [];
+  let lifted = 0;
+  for (const member of rows5.slice(0, limit)) {
+    if (Object.entries(scope2).some(([key3, value]) => member[key3] !== value)) throw new Error("membership lift scope mismatch");
+    const offering = membershipOfferingVersion(member.offeringSnapshot);
+    if (offering.seatPurchaseWindowCalendarMonths === void 0) continue;
+    const { seatPurchaseWindowCalendarMonths: _window, ...windowless } = offering;
+    await db.transact([membershipUpdate("networkMembership", String(member.id), {
+      offeringSnapshot: windowless,
+      seatPurchaseEndsAt: Number(member.termEndsAt),
+      revision: Number(member.revision) + 1,
+      updatedAt: now
+    })], { mutationId: `seat-window-lift:${member.id}:${member.revision}`, guards: [
+      { ns: "networkMembership", id: String(member.id), exists: true, equals: { revision: member.revision } },
+      { ns: "membershipAuthorityState", id: String(state.id), exists: true, equals: { mode: "authoritative" } }
+    ] });
+    lifted++;
+  }
+  return { lifted, more: rows5.length > limit };
+}
+
 // src/worker-routes-admin-membership-seats.ts
 var LIST = "/api/admin/membership-seats";
+var LIFT = "/api/admin/membership-seats/lift-purchase-window";
 var ONE = /^\/api\/admin\/membership-seats\/([A-Za-z0-9][A-Za-z0-9_.:-]{2,159})\/refund$/;
+var SCOPE = /^[a-z0-9][a-z0-9-]{1,62}$/;
 var PUBLIC = [
   "id",
   "appId",
@@ -3669,11 +3988,11 @@ var PUBLIC = [
 ];
 var project = (row2) => Object.fromEntries(PUBLIC.filter((key3) => row2[key3] !== void 0).map((key3) => [key3, row2[key3]]));
 var handleAdminMembershipSeats = async (req, url, env, ctx) => {
-  const one = url.pathname.match(ONE);
-  if (url.pathname !== LIST && !one) return null;
+  const one = url.pathname.match(ONE), lift = url.pathname === LIFT;
+  if (url.pathname !== LIST && !one && !lift) return null;
   const operator = ctx.membershipAuthorityOperator;
   if (!operator) return json({ error: "not found" }, 404);
-  if (req.method !== (one ? "POST" : "GET")) return json({ error: "method not allowed" }, 405);
+  if (req.method !== (one || lift ? "POST" : "GET")) return json({ error: "method not allowed" }, 405);
   const raw2 = ctx.makeDb(env), user = await ctx.verifyUser(req, env);
   if (!user) return json({ error: "unauthorized" }, 401);
   if (!await ctx.isSuperAdminEmail(raw2, user.email, user.userId)) return json({ error: "super-admin required", code: "super_admin_required" }, 403);
@@ -3683,6 +4002,24 @@ var handleAdminMembershipSeats = async (req, url, env, ctx) => {
   } catch {
     return json({ error: "the membership authority is not hosted by this deployment" }, 404);
   }
+  if (lift) {
+    let body;
+    try {
+      body = await req.json();
+    } catch {
+      return json({ error: "chapterId and runtime are required" }, 400);
+    }
+    const appId = body.appId ?? body.chapterId;
+    if (typeof body.chapterId !== "string" || !SCOPE.test(body.chapterId) || typeof appId !== "string" || !SCOPE.test(appId) || typeof body.runtime !== "string" || !/^[a-z0-9]{2,12}$/.test(body.runtime)) {
+      return json({ error: "chapterId and runtime are required" }, 400);
+    }
+    try {
+      return json({ ok: true, ...await liftSeatPurchaseWindow(db, { appId, chapterId: body.chapterId, environment: env.ODLA_ENV, runtime: body.runtime }, Date.now()) });
+    } catch (error) {
+      const code = error.code;
+      return json({ error: "purchase window lift is pending; retry to confirm", ...code ? { code } : {} }, code ? 409 : 503);
+    }
+  }
   if (!one) {
     const rows5 = (await db.query({ networkSeat: { $: { where: { environment: env.ODLA_ENV }, order: { updatedAt: "desc" }, limit: 201 } } })).networkSeat ?? [];
     return json({ seats: rows5.slice(0, 200).map(project), truncated: rows5.length > 200 });
@@ -3712,6 +4049,107 @@ var handleAdminMembershipSeats = async (req, url, env, ctx) => {
   }
 };
 
+// src/membership-policy-versions.ts
+var LIMIT = 200;
+var text2 = (value) => typeof value === "string" && value.length > 0 && value.length <= 200 ? value : void 0;
+var instant = (value) => {
+  const at = typeof value === "number" ? value : typeof value === "string" ? Date.parse(value) : NaN;
+  return Number.isSafeInteger(at) && at >= 0 ? at : void 0;
+};
+function provenance(row2) {
+  const source = text2(row2.source), actor = text2(row2.actor ?? row2.$createdBy), recordedAt = instant(row2.recordedAt ?? row2.createdAt ?? row2.$createdAt);
+  return { ...source ? { source } : {}, ...actor ? { actor } : {}, ...recordedAt !== void 0 ? { recordedAt } : {} };
+}
+var live = (w, now) => w.from <= now && (w.until === void 0 || now < w.until);
+function stateOf(item, all, now, window, rivals) {
+  if (item.status !== "published") return { state: item.status };
+  const mine = window(item);
+  if (now < mine.from) return { state: "scheduled" };
+  const closed = mine.until !== void 0 && mine.until <= now;
+  const higher = all.filter((other) => other.id !== item.id && other.status === "published" && other.version > item.version && rivals(item, other)).map(window).filter((w) => w.from <= now && (w.until === void 0 || w.until > mine.from));
+  if (!closed && !higher.some((w) => live(w, now))) return { state: "active" };
+  const dates = higher.map((w) => Math.max(w.from, mine.from));
+  if (closed) dates.push(mine.until);
+  return { state: "superseded", supersededAt: Math.min(...dates) };
+}
+var mechanism = (policy) => policy.percentOffBps === 0 || policy.discountEligibleSkuIds.length === 0 ? "none" : policy.benefitDuration.kind === "while_active" ? "stripe_coupon_forever" : policy.benefitDuration.kind === "first_term" ? "stripe_coupon_once" : "stripe_coupon_term_bound";
+var sharesSku = (a, b) => a.cohortEligibleSkuIds.some((sku) => b.cohortEligibleSkuIds.includes(sku));
+var byChapter = (a, b) => a.chapterId.localeCompare(b.chapterId);
+function normalize(rows5, collection, parse, invalid2) {
+  const out = [];
+  for (const row2 of rows5) {
+    try {
+      out.push({ value: parse(row2.snapshot), row: row2 });
+    } catch (error) {
+      invalid2.push({ collection, id: String(row2.id ?? ""), error: error instanceof Error ? error.message : String(error) });
+    }
+  }
+  return out;
+}
+async function listMembershipPolicyVersions(db, input) {
+  const where = input.chapterId ? { chapterId: input.chapterId } : {};
+  const rows5 = await db.query({
+    membershipOfferingVersion: { $: { where, limit: LIMIT } },
+    discountPolicyVersion: { $: { where, limit: LIMIT } }
+  });
+  const offeringRows = rows5.membershipOfferingVersion ?? [], policyRows = rows5.discountPolicyVersion ?? [];
+  const invalid2 = [];
+  const offerings = normalize(offeringRows, "membershipOfferingVersion", membershipOfferingVersion, invalid2);
+  const policies = normalize(policyRows, "discountPolicyVersion", membershipDiscountPolicyVersion, invalid2);
+  const offeringValues = offerings.map((item) => item.value), policyValues = policies.map((item) => item.value);
+  return {
+    now: input.now,
+    chapterId: input.chapterId ?? null,
+    offerings: offerings.map(({ value, row: row2 }) => ({
+      ...value,
+      ...provenance(row2),
+      ...stateOf(
+        value,
+        offeringValues,
+        input.now,
+        (v) => ({ from: v.effectiveFrom, ...v.effectiveUntil !== void 0 ? { until: v.effectiveUntil } : {} }),
+        (a, b) => a.chapterId === b.chapterId && a.baseSkuId === b.baseSkuId
+      )
+    })).sort((a, b) => byChapter(a, b) || a.baseSkuId.localeCompare(b.baseSkuId) || b.version - a.version),
+    discountPolicies: policies.map(({ value, row: row2 }) => ({
+      ...value,
+      ...provenance(row2),
+      mechanism: mechanism(value),
+      ...stateOf(
+        value,
+        policyValues,
+        input.now,
+        (v) => ({ from: v.qualifyingStartsAt, until: v.qualifyingEndsAt }),
+        (a, b) => a.chapterId === b.chapterId && sharesSku(a, b)
+      )
+    })).sort((a, b) => byChapter(a, b) || b.version - a.version),
+    invalid: invalid2,
+    truncated: offeringRows.length >= LIMIT || policyRows.length >= LIMIT
+  };
+}
+
+// src/worker-routes-admin-membership-policy.ts
+var PATH3 = "/api/admin/membership-policy-versions";
+var SCOPE2 = /^[a-z0-9][a-z0-9-]{1,62}$/;
+var handleAdminMembershipPolicyVersions = async (req, url, env, ctx) => {
+  if (url.pathname !== PATH3) return null;
+  const operator = ctx.membershipAuthorityOperator;
+  if (!operator) return json({ error: "not found" }, 404);
+  if (req.method !== "GET") return json({ error: "method not allowed" }, 405);
+  const raw2 = ctx.makeDb(env), user = await ctx.verifyUser(req, env);
+  if (!user) return json({ error: "unauthorized" }, 401);
+  if (!await ctx.isSuperAdminEmail(raw2, user.email, user.userId)) return json({ error: "super-admin required", code: "super_admin_required" }, 403);
+  const chapterId = url.searchParams.get("chapterId");
+  if (chapterId !== null && !SCOPE2.test(chapterId)) return json({ error: "chapterId is invalid" }, 400);
+  let db;
+  try {
+    db = operator.makeDb(env);
+  } catch {
+    return json({ error: "the membership authority is not hosted by this deployment" }, 404);
+  }
+  return json(await listMembershipPolicyVersions(db, { chapterId, now: Date.now() }));
+};
+
 // src/worker-routes-membership-cancel.ts
 var handleMembershipCancellation = async (req, url, env, ctx) => {
   const match = url.pathname.match(/^\/api\/admin\/applications\/([0-9a-f-]+)\/cancel-renewal$/);
@@ -4564,8 +5002,8 @@ var APPLICATION_LABELS = {
   state: "State"
 };
 function humanize(id6) {
-  const text6 = id6.replace(/([a-z0-9])([A-Z])/g, "$1 $2").replace(/[_-]+/g, " ").trim();
-  return text6 ? `${text6[0].toUpperCase()}${text6.slice(1)}` : id6;
+  const text8 = id6.replace(/([a-z0-9])([A-Z])/g, "$1 $2").replace(/[_-]+/g, " ").trim();
+  return text8 ? `${text8[0].toUpperCase()}${text8.slice(1)}` : id6;
 }
 function applicationDefs(chapter) {
   try {
@@ -4632,7 +5070,7 @@ var ID2 = /^[a-z][a-z0-9-]{1,79}$/;
 var PRICE = /^price_[A-Za-z0-9]{12,}$/;
 var CURRENCY = /^[a-z]{3}$/;
 var record = (value) => value && typeof value === "object" && !Array.isArray(value) ? value : null;
-var text2 = (value, path, errors, max) => {
+var text3 = (value, path, errors, max) => {
   if (typeof value !== "string" || !value.trim()) {
     errors.push(`${path} is required`);
     return "";
@@ -4660,23 +5098,23 @@ function validateGiftOfferCatalog(input, tierIds) {
     }
     const allowed2 = /* @__PURE__ */ new Set(["id", "target", "billingMode", "stripePriceId", "priceCents", "currency", "redemptionLifetimeHours", "activeFrom", "activeUntil", "title", "description", "ctaLabel"]);
     for (const key3 of Object.keys(item)) if (!allowed2.has(key3)) errors.push(`${path}.${key3} is not supported`);
-    const id6 = text2(item.id, `${path}.id`, errors, 80);
+    const id6 = text3(item.id, `${path}.id`, errors, 80);
     if (id6 && !ID2.test(id6)) errors.push(`${path}.id must be a lowercase kebab-case id`);
     if (ids2.has(id6)) errors.push(`${path}.id duplicates "${id6}"`);
     ids2.add(id6);
     const targetRaw = record(item.target);
     let target = { type: "entitlement", entitlementKey: "invalid" };
     if (targetRaw?.type === "tier") {
-      const tierId = text2(targetRaw.tierId, `${path}.target.tierId`, errors, 80);
+      const tierId = text3(targetRaw.tierId, `${path}.target.tierId`, errors, 80);
       if (!tierIds.has(tierId)) errors.push(`${path}.target.tierId must reference a declared tier`);
       target = { type: "tier", tierId };
     } else if (targetRaw?.type === "entitlement") {
-      const entitlementKey = text2(targetRaw.entitlementKey, `${path}.target.entitlementKey`, errors, 80);
+      const entitlementKey = text3(targetRaw.entitlementKey, `${path}.target.entitlementKey`, errors, 80);
       if (entitlementKey && !ID2.test(entitlementKey)) errors.push(`${path}.target.entitlementKey must be a lowercase kebab-case id`);
       target = { type: "entitlement", entitlementKey };
     } else errors.push(`${path}.target.type must be tier or entitlement`);
     if (item.billingMode !== "one_time" && item.billingMode !== "subscription") errors.push(`${path}.billingMode must be one_time or subscription`);
-    const stripePriceId = text2(item.stripePriceId, `${path}.stripePriceId`, errors, 128);
+    const stripePriceId = text3(item.stripePriceId, `${path}.stripePriceId`, errors, 128);
     if (stripePriceId && !PRICE.test(stripePriceId)) errors.push(`${path}.stripePriceId must be a real Stripe Price id`);
     if (!Number.isSafeInteger(item.priceCents) || Number(item.priceCents) < 1 || Number(item.priceCents) > 1e8) errors.push(`${path}.priceCents must be an integer from 1 to 100,000,000`);
     const currency = typeof item.currency === "string" ? item.currency.trim().toLowerCase() : "";
@@ -4698,9 +5136,9 @@ function validateGiftOfferCatalog(input, tierIds) {
       redemptionLifetimeHours: lifetime,
       ...activeFrom !== void 0 ? { activeFrom } : {},
       ...activeUntil !== void 0 ? { activeUntil } : {},
-      title: text2(item.title, `${path}.title`, errors, 160),
-      description: text2(item.description, `${path}.description`, errors, 2e3),
-      ctaLabel: text2(item.ctaLabel, `${path}.ctaLabel`, errors, 120)
+      title: text3(item.title, `${path}.title`, errors, 160),
+      description: text3(item.description, `${path}.description`, errors, 2e3),
+      ctaLabel: text3(item.ctaLabel, `${path}.ctaLabel`, errors, 120)
     });
   }
   return errors.length ? { ok: false, errors } : { ok: true, value: { schemaVersion: 1, offers } };
@@ -4918,22 +5356,22 @@ async function createPaymentQuote(input) {
 // src/membership-quote-projection.ts
 var MEMBERSHIP_QUOTE_NAMESPACE = "membershipQuoteProjections";
 var keys2 = ["appId", "chapterId", "environment", "runtime", "applicationId", "skuId"];
-var fail4 = (code) => {
+var fail5 = (code) => {
   throw Object.assign(new Error(code), { code });
 };
 var load3 = async (db, ns, id6) => (await db.query({ [ns]: { $: { where: { id: id6 }, limit: 1 } } }))[ns]?.[0];
 async function restore2(row2, target, now, allowExpired = false) {
-  if (!row2 || keys2.some((key3) => row2[key3] !== target[key3]) || !Number.isSafeInteger(row2.revision) || Number(row2.revision) < 1 || typeof row2.requestId !== "string") return fail4("membership_quote_unavailable");
-  if (row2.status !== "ready") return fail4("membership_quote_pending");
+  if (!row2 || keys2.some((key3) => row2[key3] !== target[key3]) || !Number.isSafeInteger(row2.revision) || Number(row2.revision) < 1 || typeof row2.requestId !== "string") return fail5("membership_quote_unavailable");
+  if (row2.status !== "ready") return fail5("membership_quote_pending");
   const offer = await verifyIssuedMembershipOffer(row2.offer, { ...target, offerId: await membershipOfferIdForRequest({
     ...target,
     requestId: row2.requestId
   }), now, lifetimeMs: 6e4 });
-  if (offer.issuedAt > now + 3e4 || !allowExpired && offer.expiresAt <= now) return fail4("membership_quote_expired");
+  if (offer.issuedAt > now + 3e4 || !allowExpired && offer.expiresAt <= now) return fail5("membership_quote_expired");
   const tier = row2.tier, quote = row2.quote;
   const offering = offer.contract.offering;
   if (!tier || tier.id !== target.skuId || tier.groupId !== target.chapterId || !tier.stripePriceId || tier.priceCents !== offering.basePriceCents || tier.currency !== offering.currency || tier.interval !== offering.interval || !quote) {
-    return fail4("membership_catalog_mismatch");
+    return fail5("membership_catalog_mismatch");
   }
   const expected = await createPaymentQuote({
     ...target,
@@ -4944,7 +5382,7 @@ async function restore2(row2, target, now, allowExpired = false) {
     presentation: quote.presentation,
     founding: foundingOf(offer)
   });
-  if (quote.digest !== expected.digest) return fail4("membership_quote_conflict");
+  if (quote.digest !== expected.digest) return fail5("membership_quote_conflict");
   return { tier, quote: expected, billingTerms: offer.contract.billingTerms, membershipOffer: offer, projectionRevision: Number(row2.revision) };
 }
 async function readMembershipQuote(db, target, now) {
@@ -4952,9 +5390,9 @@ async function readMembershipQuote(db, target, now) {
 }
 async function prepareMembershipQuote(db, input, issue) {
   const { applicationId: id6, now, app } = input;
-  if (app.id !== id6 || app.groupId !== input.chapterId || app.tierId !== input.skuId || app.stripeRuntime !== input.runtime || app.status !== "submitted" || app.canceled === true || app.giftOfferId || app.giftClaimId || app.namedSeatId || app.namedSeatClaimPending) return fail4("membership_quote_unavailable");
+  if (app.id !== id6 || app.groupId !== input.chapterId || app.tierId !== input.skuId || app.stripeRuntime !== input.runtime || app.status !== "submitted" || app.canceled === true || app.giftOfferId || app.giftClaimId || app.namedSeatId || app.namedSeatClaimPending) return fail5("membership_quote_unavailable");
   let row2 = await load3(db, MEMBERSHIP_QUOTE_NAMESPACE, id6);
-  if (row2 && keys2.some((key3) => row2[key3] !== input[key3])) return fail4("membership_quote_conflict");
+  if (row2 && keys2.some((key3) => row2[key3] !== input[key3])) return fail5("membership_quote_conflict");
   if (row2?.status === "ready") {
     try {
       return await restore2(row2, input, now);
@@ -4999,7 +5437,7 @@ async function prepareMembershipQuote(db, input, issue) {
   }
   if (row2?.status === "ready") return restore2(row2, input, now);
   if (!row2 || row2.status !== "pending" || keys2.some((key3) => row2[key3] !== input[key3]) || typeof row2.requestId !== "string") {
-    return fail4("membership_quote_pending");
+    return fail5("membership_quote_pending");
   }
   const target = Object.fromEntries(keys2.map((key3) => [key3, input[key3]]));
   const offer = await verifyIssuedMembershipOffer(await issue({ ...target, requestId: row2.requestId }), {
@@ -5263,17 +5701,17 @@ async function readBoundedRequestText(req, maxBytes) {
     if (!reader) return "";
     const decoder = new TextDecoder();
     let bytes = 0;
-    let text6 = "";
+    let text8 = "";
     for (; ; ) {
       const { done, value } = await reader.read();
       if (req.signal.aborted) return invalid2();
       if (done) {
         complete = true;
-        return text6 + decoder.decode();
+        return text8 + decoder.decode();
       }
       bytes += value.byteLength;
       if (bytes > maxBytes) return json({ error: "request body too large" }, 413);
-      text6 += decoder.decode(value, { stream: true });
+      text8 += decoder.decode(value, { stream: true });
     }
   } catch {
     return invalid2();
@@ -5626,37 +6064,61 @@ async function provisionApplicant(db, chapter, applicationId, fields) {
   } catch {
   }
 }
-async function notifyAdminOfApplication(db, env, chapterId, applicationId, fields) {
+
+// src/submit-notifications.ts
+async function notifyAdminOfApplication(db, env, notice) {
   try {
-    const groups = (await db.query({ groups: { $: { where: { id: chapterId }, limit: 1 } } })).groups;
-    const group = Array.isArray(groups) ? groups[0] : void 0;
-    if (!group || typeof group.notificationEmail !== "string" || !group.notificationEmail) return;
-    const stringValue = (value) => typeof value === "string" ? value : "";
-    await sendTemplated(
-      {
-        db,
-        envName: env.ODLA_ENV,
-        debugEmail: env.ODLA_DEBUG_EMAIL,
-        sender: env.SEND_EMAIL,
-        from: env.EMAIL_FROM,
-        now: () => Date.now(),
-        newId: () => crypto.randomUUID()
+    const { group, application: app } = notice;
+    if (typeof group.notificationEmail !== "string" || !group.notificationEmail) return;
+    const { tierName: tierName2 } = await checkoutVariables(db, group, app);
+    await sendTemplated(lifecycleNotifyDeps(db, env), {
+      group: emailGroupFrom(group),
+      template: "adminNotification",
+      to: group.notificationEmail,
+      vars: { ...applicantVariables(app), tier: tierName2, tierName: tierName2, adminUrl: adminUrlFor(notice.origin), membersUrl: membersUrlFor(notice.origin) },
+      dedupeKey: `apply:${String(app.id)}:admin`,
+      applicationId: String(app.id)
+    });
+  } catch {
+  }
+}
+var FREE_CONTINUATIONS = /* @__PURE__ */ new Set(["booking", "accepted", "approve"]);
+function shouldConfirmSubmit(state, group) {
+  if (state !== null && FREE_CONTINUATIONS.has(state)) return true;
+  const templates = group.emailTemplates;
+  return templates?.paymentConfirmation?.enabled === false;
+}
+function submitNextStep(state) {
+  switch (state) {
+    case "accepted":
+      return "Your membership is approved.";
+    case "booking":
+      return "Next, schedule your introduction call.";
+    case "payment":
+    case "paymentPending":
+    case "gift":
+      return "Next, complete your membership payment.";
+    default:
+      return "";
+  }
+}
+async function notifySubmitConfirmed(db, env, notice) {
+  try {
+    const { group, application: app } = notice;
+    if (typeof app.email !== "string" || !app.email || !shouldConfirmSubmit(notice.state, group)) return;
+    await sendTemplated(lifecycleNotifyDeps(db, env), {
+      group: emailGroupFrom(group),
+      template: "submitConfirmation",
+      to: app.email,
+      vars: {
+        ...applicantVariables(app),
+        ...await checkoutVariables(db, group, app),
+        submitNextStep: submitNextStep(notice.state),
+        membersUrl: membersUrlFor(notice.origin)
       },
-      {
-        group: emailGroupFrom(group),
-        template: "adminNotification",
-        to: group.notificationEmail,
-        vars: {
-          firstName: stringValue(fields.firstName),
-          lastName: stringValue(fields.lastName),
-          email: stringValue(fields.email),
-          phone: stringValue(fields.phone),
-          state: stringValue(fields.state)
-        },
-        dedupeKey: `apply:${applicationId}:admin`,
-        applicationId
-      }
-    );
+      dedupeKey: `apply:${String(app.id)}:confirm`,
+      applicationId: String(app.id)
+    });
   } catch {
   }
 }
@@ -5854,17 +6316,17 @@ var handleMember = async (req, url, env, ctx) => {
       if (provisioningFailure.status === 409) await rejectUnprovisionedSignup(db, result.id, canonical3.status);
       return json(provisioningFailure.body, provisioningFailure.status);
     }
-    if (!result.duplicate && effectiveChapter.sends.adminNotification === "submit") {
-      await notifyAdminOfApplication(db, env, chapter.id, result.id, canonical3);
-    }
     const groups = (await db.query({ groups: { $: { where: { id: chapter.id }, limit: 1 } } })).groups;
     const group = Array.isArray(groups) ? groups[0] : void 0;
-    const state = canonical3 && group ? await continueJoin(db, ctx, env, url.origin, canonical3, group) : null;
+    const notice = group ? { group, application: canonical3, origin: url.origin } : null;
+    if (notice && !result.duplicate && effectiveChapter.sends.adminNotification === "submit") await notifyAdminOfApplication(db, env, notice);
+    const state = notice ? await continueJoin(db, ctx, env, url.origin, canonical3, notice.group) : null;
     if (!state) return json({
       error: "Application saved; its next step is temporarily unavailable. Retry this submission.",
       code: "application_continuation_unavailable",
       id: result.id
     }, 503);
+    if (notice && !result.duplicate) await notifySubmitConfirmed(db, env, { ...notice, state });
     const final = (await db.query({ applications: { $: { where: { id: result.id }, limit: 1 } } })).applications?.[0];
     if (!final || final.groupId !== chapter.id || state === "accepted" && final.status !== "approved") {
       return json({ error: "application changed; reload its current state" }, 409);
@@ -5984,10 +6446,10 @@ function boundedString(value, path, errors, max, required = false) {
     errors.push(`${path} must be a string`);
     return void 0;
   }
-  const text6 = value.trim();
-  if (required && !text6) errors.push(`${path} is required`);
-  if (text6.length > max) errors.push(`${path} must be at most ${max.toLocaleString("en-US")} characters`);
-  return text6;
+  const text8 = value.trim();
+  if (required && !text8) errors.push(`${path} is required`);
+  if (text8.length > max) errors.push(`${path} must be at most ${max.toLocaleString("en-US")} characters`);
+  return text8;
 }
 function validateMembershipPageDocument(input, options = {}) {
   const errors = [];
@@ -6036,8 +6498,8 @@ function validateMembershipPageDocument(input, options = {}) {
       else {
         if (item.benefits.length > MAX_BENEFITS) errors.push(`${path}.benefits supports at most ${MAX_BENEFITS} entries`);
         benefits = item.benefits.slice(0, MAX_BENEFITS).flatMap((benefit, benefitIndex) => {
-          const text6 = boundedString(benefit, `${path}.benefits[${benefitIndex}]`, errors, 2e3, true);
-          return text6 ? [text6] : [];
+          const text8 = boundedString(benefit, `${path}.benefits[${benefitIndex}]`, errors, 2e3, true);
+          return text8 ? [text8] : [];
         });
       }
     }
@@ -6131,7 +6593,7 @@ var recordOf = (value) => value !== null && typeof value === "object" && !Array.
 function unknownKeys(value, allowed2, path, errors) {
   for (const key3 of Object.keys(value)) if (!allowed2.has(key3)) errors.push(`${path}.${key3} is not supported`);
 }
-function text3(value, path, errors, max = 65536) {
+function text4(value, path, errors, max = 65536) {
   if (typeof value !== "string" || !value.trim()) {
     errors.push(`${path} is required`);
     return "";
@@ -6154,11 +6616,11 @@ function tiersOf(value, errors) {
       return [];
     }
     unknownKeys(item, TIER_KEYS2, path, errors);
-    const id6 = text3(item.id, `${path}.id`, errors, 80);
+    const id6 = text4(item.id, `${path}.id`, errors, 80);
     if (id6 && !TIER.test(id6)) errors.push(`${path}.id must be a lowercase kebab-case id`);
     if (seen.has(id6)) errors.push(`${path}.id duplicates "${id6}"`);
     seen.add(id6);
-    const name = text3(item.name, `${path}.name`, errors, 160);
+    const name = text4(item.name, `${path}.name`, errors, 160);
     if (typeof item.available !== "boolean") errors.push(`${path}.available must be boolean`);
     if (!Number.isInteger(item.sortOrder) || Number(item.sortOrder) < 0) errors.push(`${path}.sortOrder must be a non-negative integer`);
     if (!Number.isInteger(item.priceCents) || Number(item.priceCents) < 0 || Number(item.priceCents) > 1e8) {
@@ -6176,7 +6638,7 @@ function tiersOf(value, errors) {
     if (item.interval !== void 0 && item.interval !== "year" && item.interval !== "month") {
       errors.push(`${path}.interval must be year or month`);
     }
-    const blurb = item.blurb === void 0 ? void 0 : text3(item.blurb, `${path}.blurb`, errors, 4e3);
+    const blurb = item.blurb === void 0 ? void 0 : text4(item.blurb, `${path}.blurb`, errors, 4e3);
     return [{
       id: id6,
       name,
@@ -6234,7 +6696,7 @@ function policyOf(value, errors, tiers) {
   const result = {};
   for (const key3 of allowed2) {
     if (input[key3] === void 0 && key3 !== "disclaimerText" && key3 !== "refundPolicyText") continue;
-    result[key3] = text3(input[key3], `document.policy.${key3}`, errors);
+    result[key3] = text4(input[key3], `document.policy.${key3}`, errors);
   }
   const tierPolicies = {};
   if (input.tierPolicies !== void 0) {
@@ -6249,8 +6711,8 @@ function policyOf(value, errors, tiers) {
       }
       unknownKeys(policy, /* @__PURE__ */ new Set(["refundPolicyText", "trustCopy"]), path, errors);
       tierPolicies[id6] = {
-        refundPolicyText: text3(policy.refundPolicyText, `${path}.refundPolicyText`, errors),
-        ...policy.trustCopy !== void 0 ? { trustCopy: text3(policy.trustCopy, `${path}.trustCopy`, errors) } : {}
+        refundPolicyText: text4(policy.refundPolicyText, `${path}.refundPolicyText`, errors),
+        ...policy.trustCopy !== void 0 ? { trustCopy: text4(policy.trustCopy, `${path}.trustCopy`, errors) } : {}
       };
     }
   }
@@ -6290,9 +6752,9 @@ function validateSignupControlDocument(input) {
   if (!Number.isSafeInteger(root.generatedAt) || Number(root.generatedAt) < 1) errors.push("document.generatedAt must be epoch milliseconds");
   const source = recordOf(root.source);
   const target = recordOf(root.target);
-  const appId = text3(source?.appId, "document.source.appId", errors, 63);
-  const chapterId = text3(target?.chapterId, "document.target.chapterId", errors, 63);
-  const environment = text3(target?.environment, "document.target.environment", errors, 63);
+  const appId = text4(source?.appId, "document.source.appId", errors, 63);
+  const chapterId = text4(target?.chapterId, "document.target.chapterId", errors, 63);
+  const environment = text4(target?.environment, "document.target.environment", errors, 63);
   if (appId && !SLUG.test(appId)) errors.push("document.source.appId must be a lowercase app slug");
   if (chapterId && !SLUG.test(chapterId)) errors.push("document.target.chapterId must be a lowercase app slug");
   if (environment && !ENVIRONMENT.test(environment)) errors.push("document.target.environment is invalid");
@@ -7471,7 +7933,7 @@ async function deliverAdmissionGrants(options) {
 }
 
 // src/worker-routes-network-admission.ts
-var PATH2 = "/api/admin/network/admissions";
+var PATH4 = "/api/admin/network/admissions";
 var RETRY_PATH = "/api/admin/network/admissions/retry";
 var REVOKE_PATH = "/api/admin/network/admissions/revoke";
 var MUTATION_ID2 = /^[A-Za-z0-9_-]{16,128}$/;
@@ -7551,11 +8013,11 @@ async function parseBody(req) {
   }
 }
 var handleAdminNetworkAdmissions = async (req, url, env, ctx) => {
-  if (![PATH2, RETRY_PATH, REVOKE_PATH].includes(url.pathname)) return null;
+  if (![PATH4, RETRY_PATH, REVOKE_PATH].includes(url.pathname)) return null;
   const auth = await gate2(req, env, ctx);
   if ("response" in auth) return auth.response;
   const db = auth.db;
-  if (url.pathname === PATH2 && req.method === "GET") {
+  if (url.pathname === PATH4 && req.method === "GET") {
     const targetId2 = url.searchParams.get("targetId") ?? "";
     const target2 = targetFor(ctx, targetId2);
     if (!target2) return reject6(404, "unknown_target", "admission target is not configured");
@@ -7656,6 +8118,41 @@ async function retryLeaderAdmissionDeliveries(env, ctx, limit = 100) {
 
 // src/worker-routes-schedule.ts
 import { computeBookableSlots, initCalendar } from "@odla-ai/calendar";
+
+// src/booking-notifications.ts
+async function bookingConfirmationVariables(db, group, app, meeting) {
+  const startAt = formatInstant(meeting.startAt, meeting.timezone);
+  const meetUrl = meeting.meetUrl ?? "", htmlLink = meeting.htmlLink ?? "";
+  return {
+    ...applicantVariables(app),
+    ...await checkoutVariables(db, group, app),
+    startAt,
+    endAt: formatInstant(meeting.endAt, meeting.timezone),
+    timezone: meeting.timezone,
+    meetUrl,
+    htmlLink,
+    // The placeholders the seeded template used before these variables existed.
+    meetingTime: startAt,
+    meetingLink: meetUrl || htmlLink
+  };
+}
+async function notifyBookingConfirmed(db, env, input) {
+  const app = input.application;
+  if (typeof app.email !== "string" || !app.email) return;
+  try {
+    await sendTemplated(lifecycleNotifyDeps(db, env), {
+      group: emailGroupFrom(input.group),
+      template: "prepEmail",
+      to: app.email,
+      vars: await bookingConfirmationVariables(db, input.group, app, input.meeting),
+      dedupeKey: `prep:${String(app.id)}`,
+      applicationId: String(app.id)
+    });
+  } catch {
+  }
+}
+
+// src/worker-routes-schedule.ts
 function errCode(err) {
   if (err && typeof err === "object") {
     const code = err.code;
@@ -7770,12 +8267,7 @@ async function bookSlot(req, env, ctx) {
   await db.transact([meetingOp, appOp]);
   const booked = { ...app, ...bookingAttrs };
   await syncApplicationToCrm(crmDeps(db, ctx), { app: booked, stage: String(booked.status ?? "") }).catch(() => void 0);
-  if (typeof app.email === "string" && app.email) {
-    await sendTemplated(
-      { db, envName: env.ODLA_ENV, sender: env.SEND_EMAIL, from: env.EMAIL_FROM, debugEmail: env.ODLA_DEBUG_EMAIL, now: () => Date.now(), newId: () => crypto.randomUUID() },
-      { group: emailGroupFrom(group), template: "prepEmail", to: app.email, vars: { firstName: String(app.firstName ?? "") }, dedupeKey: `prep:${applicationId}`, applicationId }
-    ).catch(() => void 0);
-  }
+  await notifyBookingConfirmed(db, env, { group, application: app, meeting: { startAt, endAt, timezone: cfg.timezone, meetUrl, htmlLink } });
   return json({ ok: true, startAt, endAt, meetUrl, rescheduled: decision.reschedule });
 }
 var handleSchedule = async (req, url, env, ctx) => {
@@ -7806,21 +8298,21 @@ import { stripeRequest as stripeRequest5 } from "@odla-ai/stripe";
 var row = (value) => value && typeof value === "object" && !Array.isArray(value) ? value : {};
 var id2 = (value) => typeof value === "string" ? value : String(row(value).id ?? "");
 var providerId2 = (value, prefix) => new RegExp(`^${prefix}_[A-Za-z0-9]+$`).test(value);
-function fail5(code = "refund_target_mismatch") {
+function fail6(code = "refund_target_mismatch") {
   throw Object.assign(new Error(code), { code });
 }
 async function refundSubscriptionPayment(secretKey, input) {
-  if (!providerId2(input.customerId, "cus") || !providerId2(input.subscriptionId, "sub")) fail5();
+  if (!providerId2(input.customerId, "cus") || !providerId2(input.subscriptionId, "sub")) fail6();
   const call = async (method, path, params, key3) => {
     const result = await stripeRequest5({ secretKey }, method, path, params, key3 ? { idempotencyKey: key3 } : {});
-    if (!result.ok) fail5("stripe_error");
-    if (!result.body || typeof result.body !== "object" || Array.isArray(result.body)) fail5("stripe_invalid_response");
+    if (!result.ok) fail6("stripe_error");
+    if (!result.body || typeof result.body !== "object" || Array.isArray(result.body)) fail6("stripe_invalid_response");
     return result.body;
   };
   const sub = await call("GET", `/v1/subscriptions/${input.subscriptionId}`);
-  if (id2(sub) !== input.subscriptionId || id2(sub.customer) !== input.customerId) fail5();
+  if (id2(sub) !== input.subscriptionId || id2(sub.customer) !== input.customerId) fail6();
   for (const [key3, value] of Object.entries(input.metadata ?? {})) {
-    if (row(sub.metadata)[key3] !== value) fail5();
+    if (row(sub.metadata)[key3] !== value) fail6();
   }
   let cursor;
   let earliest;
@@ -7833,55 +8325,55 @@ async function refundSubscriptionPayment(secretKey, input) {
       limit: 100,
       ...cursor ? { starting_after: cursor } : {}
     });
-    if (!Array.isArray(list.data) || typeof list.has_more !== "boolean") fail5("stripe_invalid_response");
+    if (!Array.isArray(list.data) || typeof list.has_more !== "boolean") fail6("stripe_invalid_response");
     for (const value of list.data) {
       const invoice2 = row(value);
       const subscription = invoice2.subscription ?? row(row(invoice2.parent).subscription_details).subscription;
-      if (!providerId2(id2(invoice2), "in") || seen.has(id2(invoice2)) || id2(subscription) !== input.subscriptionId || id2(invoice2.customer) !== input.customerId || invoice2.status !== "paid" || !Number.isSafeInteger(invoice2.created) || !Number.isSafeInteger(invoice2.amount_paid) || Number(invoice2.amount_paid) < 0) fail5();
+      if (!providerId2(id2(invoice2), "in") || seen.has(id2(invoice2)) || id2(subscription) !== input.subscriptionId || id2(invoice2.customer) !== input.customerId || invoice2.status !== "paid" || !Number.isSafeInteger(invoice2.created) || !Number.isSafeInteger(invoice2.amount_paid) || Number(invoice2.amount_paid) < 0) fail6();
       seen.add(id2(invoice2));
       if (Number(invoice2.amount_paid) > 0 && (!earliest || Number(invoice2.created) < Number(earliest.created))) earliest = invoice2;
     }
     if (!list.has_more) break;
-    if (!list.data.length || page === 9) fail5("refund_history_incomplete");
+    if (!list.data.length || page === 9) fail6("refund_history_incomplete");
     cursor = id2(list.data[list.data.length - 1]);
   }
-  if (!earliest) fail5("no_charge");
+  if (!earliest) fail6("no_charge");
   const invoice = earliest;
-  if (input.expectedInvoiceId !== void 0 && id2(invoice) !== input.expectedInvoiceId || input.expectedAmountCents !== void 0 && invoice.amount_paid !== input.expectedAmountCents) fail5();
+  if (input.expectedInvoiceId !== void 0 && id2(invoice) !== input.expectedInvoiceId || input.expectedAmountCents !== void 0 && invoice.amount_paid !== input.expectedAmountCents) fail6();
   let chargeId = id2(invoice.charge);
   let paymentIntentId = id2(invoice.payment_intent);
   if (!chargeId && !paymentIntentId) {
     const payments = await call("GET", "/v1/invoice_payments", { invoice: id2(invoice), status: "paid", limit: 100 });
-    if (payments.has_more !== false || !Array.isArray(payments.data) || payments.data.length !== 1) fail5("refund_payment_ambiguous");
+    if (payments.has_more !== false || !Array.isArray(payments.data) || payments.data.length !== 1) fail6("refund_payment_ambiguous");
     const payment = row(payments.data[0]);
-    if (id2(payment.invoice) !== id2(invoice) || payment.status !== "paid" || row(payment.payment).type !== "payment_intent") fail5();
+    if (id2(payment.invoice) !== id2(invoice) || payment.status !== "paid" || row(payment.payment).type !== "payment_intent") fail6();
     paymentIntentId = id2(row(payment.payment).payment_intent);
   }
   if (!chargeId) {
-    if (!providerId2(paymentIntentId, "pi")) fail5();
+    if (!providerId2(paymentIntentId, "pi")) fail6();
     const payment = await call("GET", `/v1/payment_intents/${paymentIntentId}`);
-    if (id2(payment) !== paymentIntentId || id2(payment.customer) !== input.customerId || payment.status !== "succeeded") fail5();
+    if (id2(payment) !== paymentIntentId || id2(payment.customer) !== input.customerId || payment.status !== "succeeded") fail6();
     chargeId = id2(payment.latest_charge);
   }
-  if (!providerId2(chargeId, "ch")) fail5();
+  if (!providerId2(chargeId, "ch")) fail6();
   const charge = await call("GET", `/v1/charges/${chargeId}`);
-  if (id2(charge) !== chargeId || id2(charge.customer) !== input.customerId || charge.status !== "succeeded" || charge.invoice != null && id2(charge.invoice) !== id2(invoice) || paymentIntentId && id2(charge.payment_intent) !== paymentIntentId || !Number.isSafeInteger(charge.amount) || Number(charge.amount) <= 0 || !Number.isSafeInteger(charge.amount_refunded) || Number(charge.amount_refunded) < 0 || Number(charge.amount_refunded) > Number(charge.amount) || charge.currency !== invoice.currency || Number(charge.amount) !== Number(invoice.amount_paid)) fail5();
-  if (input.alreadyRefundedChargeId !== void 0 && (chargeId !== input.alreadyRefundedChargeId || charge.amount_refunded !== charge.amount || charge.refunded !== true)) fail5();
+  if (id2(charge) !== chargeId || id2(charge.customer) !== input.customerId || charge.status !== "succeeded" || charge.invoice != null && id2(charge.invoice) !== id2(invoice) || paymentIntentId && id2(charge.payment_intent) !== paymentIntentId || !Number.isSafeInteger(charge.amount) || Number(charge.amount) <= 0 || !Number.isSafeInteger(charge.amount_refunded) || Number(charge.amount_refunded) < 0 || Number(charge.amount_refunded) > Number(charge.amount) || charge.currency !== invoice.currency || Number(charge.amount) !== Number(invoice.amount_paid)) fail6();
+  if (input.alreadyRefundedChargeId !== void 0 && (chargeId !== input.alreadyRefundedChargeId || charge.amount_refunded !== charge.amount || charge.refunded !== true)) fail6();
   if (charge.amount_refunded !== charge.amount) {
     const refund = await call("POST", "/v1/refunds", {
       charge: chargeId,
       ...input.metadata ? { metadata: input.metadata } : {}
     }, `chapter-initial-refund:${input.subscriptionId}:${chargeId}`);
-    if (id2(refund.charge) !== chargeId || !["succeeded", "pending"].includes(String(refund.status)) || !Number.isSafeInteger(refund.amount) || Number(refund.amount) !== Number(charge.amount) - Number(charge.amount_refunded)) fail5("refund_not_confirmed");
+    if (id2(refund.charge) !== chargeId || !["succeeded", "pending"].includes(String(refund.status)) || !Number.isSafeInteger(refund.amount) || Number(refund.amount) !== Number(charge.amount) - Number(charge.amount_refunded)) fail6("refund_not_confirmed");
   }
   let subscriptionCanceled = sub.status === "canceled";
   if (input.cancelSubscription !== false && !subscriptionCanceled) {
     const canceled = await call("DELETE", `/v1/subscriptions/${input.subscriptionId}`);
-    if (id2(canceled) !== input.subscriptionId || canceled.status !== "canceled") fail5("refund_cancel_incomplete");
+    if (id2(canceled) !== input.subscriptionId || canceled.status !== "canceled") fail6("refund_cancel_incomplete");
     subscriptionCanceled = true;
   }
   const confirmed = await call("GET", `/v1/charges/${chargeId}`);
-  if (id2(confirmed) !== chargeId || id2(confirmed.customer) !== input.customerId || confirmed.amount !== charge.amount || confirmed.currency !== charge.currency || confirmed.amount_refunded !== charge.amount || confirmed.refunded !== true) fail5("refund_not_confirmed");
+  if (id2(confirmed) !== chargeId || id2(confirmed.customer) !== input.customerId || confirmed.amount !== charge.amount || confirmed.currency !== charge.currency || confirmed.amount_refunded !== charge.amount || confirmed.refunded !== true) fail6("refund_not_confirmed");
   return { refundedCents: Number(charge.amount), subscriptionCanceled };
 }
 
@@ -7947,7 +8439,7 @@ async function stripeCall(sk, method, path, params, idempotencyKey) {
     idempotencyKey ? { idempotencyKey } : {}
   );
 }
-function fail6(op, r) {
+function fail7(op, r) {
   const err = new Error(`stripe ${op} failed: ${r.status}`);
   err.code = "stripe_error";
   throw err;
@@ -7997,7 +8489,7 @@ function createStripeProvider(config) {
           { email: input.email, name: input.name, metadata: meta },
           `cus:${input.applicationId}`
         );
-        if (!cust.ok) fail6("customer create", cust);
+        if (!cust.ok) fail7("customer create", cust);
         if (typeof cust.body.id !== "string" || !/^cus_[A-Za-z0-9]+$/.test(cust.body.id)) subscriptionContractMismatch();
         customerId = cust.body.id;
       }
@@ -8029,7 +8521,7 @@ function createStripeProvider(config) {
         // retry between create and the db write can't orphan a second one.
         `sub:${input.applicationId}${input.purchaseAttemptId ? `:${input.purchaseAttemptId}` : ""}`
       );
-      if (!sub.ok) fail6("subscription create", sub);
+      if (!sub.ok) fail7("subscription create", sub);
       if (input.billingTerms?.discount?.duration === "once" && Array.isArray(sub.body.discounts) && sub.body.discounts.length === 0) {
         const subscriptionId = sub.body.id;
         if (typeof subscriptionId !== "string" || !/^sub_[A-Za-z0-9]+$/.test(subscriptionId)) subscriptionContractMismatch();
@@ -8039,14 +8531,14 @@ function createStripeProvider(config) {
           "expand[2]": "discounts",
           "expand[3]": "latest_invoice.discounts"
         });
-        if (!expanded.ok) fail6("subscription invoice evidence", expanded);
+        if (!expanded.ok) fail7("subscription invoice evidence", expanded);
         if (expanded.body.id !== subscriptionId) subscriptionContractMismatch();
         sub = expanded;
       }
       verifySubscriptionResult(sub.body, input, customerId, meta);
       const invoice = sub.body.latest_invoice;
       const clientSecret2 = clientSecretOf(sub.body);
-      if (!clientSecret2) fail6("subscription confirmation-secret missing", sub);
+      if (!clientSecret2) fail7("subscription confirmation-secret missing", sub);
       await tagSubscriptionPayment(
         sk,
         invoice,
@@ -8730,15 +9222,16 @@ async function readNamedSeatOffer(db, input, now) {
   const offering = membershipOfferingVersion(member.offeringSnapshot);
   const seat = member.namedSeatId ? await membershipLoad(db, "networkSeat", String(member.namedSeatId)) : void 0;
   if (seat) requireMembershipScope(seat, input);
+  const purchaseEndsAt = seatPurchaseDeadline(offering, member);
   const offer = {
     membershipId: id6,
     amountCents: offering.seatPriceCents,
     currency: offering.currency,
     interval: offering.interval,
     termEndsAt: Number(member.termEndsAt),
-    purchaseEndsAt: Number(member.seatPurchaseEndsAt),
+    purchaseEndsAt,
     autoRenew: member.autoRenew === true,
-    eligible: ["paid_pending_approval", "active", "cancel_at_term_end"].includes(String(member.status)) && member.refundedCents === 0 && now >= Number(member.initialTermStartedAt) && now < Number(member.termEndsAt) && now <= Number(member.seatPurchaseEndsAt) && (!seat || ["payment_pending", "payment_processing"].includes(String(seat.status))),
+    eligible: ["paid_pending_approval", "active", "cancel_at_term_end"].includes(String(member.status)) && member.refundedCents === 0 && now >= Number(member.initialTermStartedAt) && now < Number(member.termEndsAt) && now <= purchaseEndsAt && (!seat || ["payment_pending", "payment_processing"].includes(String(seat.status))),
     ...seat ? { seat: {
       seatId: String(seat.id),
       status: String(seat.status),
@@ -8746,7 +9239,7 @@ async function readNamedSeatOffer(db, input, now) {
       recipientEmail: String(seat.recipientEmailNormalized)
     } } : {}
   };
-  return { ...offer, digest: await namedSeatOfferDigest(offer) };
+  return { ...offer, digest: await namedSeatOfferDigest(offer), purchaseWindowed: offering.seatPurchaseWindowCalendarMonths !== void 0 };
 }
 
 // src/named-seat-request.ts
@@ -8870,6 +9363,58 @@ var handleNamedSeat = async (req, url, env, ctx) => {
   }
 };
 
+// src/named-seat-accepted-template.ts
+var SEAT_ACCEPTED_TEMPLATE = {
+  enabled: true,
+  subject: "{{recipientName}} accepted your {{chapterName}} seat",
+  text: "Hi {{firstName}},\n\n{{recipientName}} has accepted the {{tierName}} seat you purchased at {{chapterName}}. They will complete their own application and any membership requirements from here; nothing more is needed from you.\n\nWarmly,\n{{chapterName}}"
+};
+
+// src/named-seat-accepted-notice.ts
+var text5 = (value) => typeof value === "string" ? value : "";
+async function notifyNamedSeatAccepted(db, env, ctx, input) {
+  const purchaser = await membershipLoad(db, "applications", input.primaryApplicationId);
+  if (!purchaser || !chapterBillingApplication(purchaser, ctx.chapter.id, env.ODLA_RUNTIME) || !text5(purchaser.email)) {
+    return { sent: false, reason: "purchaser-missing" };
+  }
+  const group = await membershipLoad(db, "groups", ctx.chapter.id);
+  if (!group) return { sent: false, reason: "group-missing" };
+  const config = emailGroupFrom(group);
+  config.emailTemplates = { seatAccepted: SEAT_ACCEPTED_TEMPLATE, ...config.emailTemplates };
+  const purchaserName = [purchaser.firstName, purchaser.lastName].map(text5).join(" ").replace(/\s+/g, " ").trim();
+  return sendTemplated({
+    db,
+    envName: env.ODLA_ENV,
+    sender: env.SEND_EMAIL,
+    from: env.EMAIL_FROM,
+    debugEmail: env.ODLA_DEBUG_EMAIL,
+    now: () => Date.now(),
+    newId: () => crypto.randomUUID()
+  }, {
+    group: config,
+    template: "seatAccepted",
+    to: text5(purchaser.email),
+    dedupeKey: `named-seat-accepted:${input.seatId}`,
+    applicationId: input.primaryApplicationId,
+    vars: {
+      firstName: text5(purchaser.firstName),
+      purchaserName,
+      recipientName: input.recipientName,
+      tierName: await tierName(db, group, input.skuId),
+      chapterName: ctx.chapter.name,
+      membersUrl: `${input.origin}/members/`
+    }
+  });
+}
+async function tierName(db, group, skuId) {
+  try {
+    const tier = (await loadTiers(db, group)).find((candidate) => candidate.id === skuId);
+    if (tier) return tier.name;
+  } catch {
+  }
+  return skuId;
+}
+
 // src/worker-routes-named-seat-recipient.ts
 var handleNamedSeatRecipient = async (req, url, env, ctx) => {
   if (url.pathname === "/api/named-seat/invitation") {
@@ -8987,6 +9532,13 @@ var handleNamedSeatRecipient = async (req, url, env, ctx) => {
     const current = await membershipLoad(db, "applications", body.applicationId), group = await membershipLoad(db, "groups", ctx.chapter.id);
     if (!current || current.namedSeatClaimPending !== false || !current.namedSeatAcceptedAt || !group) throw new Error("seat application reconciliation pending");
     if (current.clerkUserId !== user.userId || current.groupId !== ctx.chapter.id || current.tierId !== invitation.skuId || stripeRuntimeIdentity(current.stripeRuntime) !== runtime) throw new Error("seat application identity changed");
+    await notifyNamedSeatAccepted(db, env, ctx, {
+      seatId: body.seatId,
+      primaryApplicationId: invitation.primaryApplicationId,
+      recipientName: invitation.recipientName,
+      skuId: invitation.skuId,
+      origin: url.origin
+    }).catch(() => console.warn("named_seat_accepted_notice_incomplete", { seatId: body.seatId }));
     await syncApplicationToCrm(crmDeps(db, ctx), { app: current, stage: String(current.status) }).catch(() => void 0);
     const state = await continueJoin(db, ctx, env, url.origin, current, group);
     if (!state) throw new Error("seat Journey reconciliation pending");
@@ -9347,8 +9899,8 @@ var handleAdminMeetings = async (req, url, env, ctx) => {
 };
 
 // src/crm-account-repair.ts
-async function repairAccountPeoplePage(deps2, after) {
-  const users = (await deps2.db.query({ $users: { $: {
+async function repairAccountPeoplePage(deps, after) {
+  const users = (await deps.db.query({ $users: { $: {
     ...after ? { where: { id: { $gt: after } } } : {},
     order: { id: "asc" },
     limit: 50
@@ -9357,7 +9909,7 @@ async function repairAccountPeoplePage(deps2, after) {
   const errors = [];
   for (const user of users) {
     try {
-      if (await syncAccountToCrm(deps2, String(user.id))) synced++;
+      if (await syncAccountToCrm(deps, String(user.id))) synced++;
     } catch (error) {
       const message = error instanceof Error ? error.message : "";
       errors.push({ userId: String(user.id), code: /^crm_projection_identity_(ambiguous|archived|conflict)$/.test(message) ? message : "crm_projection_unavailable" });
@@ -9369,8 +9921,8 @@ async function repairAccountPeoplePage(deps2, after) {
 // src/crm-application-repair.ts
 import { getRecord as getRecord4, updateRecord as updateRecord5 } from "@odla-ai/crm";
 async function repairApplicationLink(db, chapter, recordId, actorId) {
-  const deps2 = { crm: chapter.crm, db };
-  const record4 = await getRecord4(deps2, recordId);
+  const deps = { crm: chapter.crm, db };
+  const record4 = await getRecord4(deps, recordId);
   if (!record4 || record4.type !== "person" || record4.archived === true) return { status: 404, error: "person_not_found" };
   if (!chapter.crm.type("person").fields.applicationId) return { status: 409, error: "application_link_field_not_configured" };
   const fields = record4.fields;
@@ -9388,7 +9940,7 @@ async function repairApplicationLink(db, chapter, recordId, actorId) {
   }
   const app = [...applications.values()][0];
   if (!app || typeof app.id !== "string" || typeof record4.updatedAt !== "number") return { status: 409, error: "application_link_evidence_incomplete" };
-  await updateRecord5(deps2, {
+  await updateRecord5(deps, {
     id: recordId,
     input: applicationCrmFields(chapter.crm, { applicationId: app.id, tierId: app.tierId }),
     expectedUpdatedAt: record4.updatedAt,
@@ -10086,15 +10638,6 @@ async function loadGroup2(db, id6) {
   return groups?.[0] ?? null;
 }
 var str2 = (v, d = "") => typeof v === "string" ? v : d;
-var notifyDeps = (db, env) => ({
-  db,
-  debugEmail: env.ODLA_DEBUG_EMAIL,
-  envName: env.ODLA_ENV,
-  sender: env.SEND_EMAIL,
-  from: env.EMAIL_FROM,
-  now: () => Date.now(),
-  newId: () => crypto.randomUUID()
-});
 var handleAdminGroupEmail = async (req, url, env, ctx) => {
   if (url.pathname !== "/api/admin/group/email" || req.method !== "GET" && req.method !== "PUT") return null;
   const got = await gate5(req, env, ctx);
@@ -10113,6 +10656,7 @@ var handleAdminGroupEmail = async (req, url, env, ctx) => {
       groupId: group.id,
       name: group.name,
       replyTo: str2(group.replyTo),
+      fromName: str2(group.fromName),
       notificationEmail: str2(group.notificationEmail),
       debugEmail: str2(group.debugEmail),
       emailTemplates,
@@ -10139,11 +10683,11 @@ var handleAdminGroupEmail = async (req, url, env, ctx) => {
   for (const key3 of EMAIL_TEMPLATE_NAMES) {
     const t = templates[key3];
     const subject = typeof t?.subject === "string" ? t.subject.trim() : "";
-    const text6 = typeof t?.text === "string" ? t.text : "";
-    if (!subject || !text6.trim()) return json({ error: `template "${key3}" needs a subject and a body` }, 400);
+    const text8 = typeof t?.text === "string" ? t.text : "";
+    if (!subject || !text8.trim()) return json({ error: `template "${key3}" needs a subject and a body` }, 400);
     if (/[\r\n]/.test(subject) || subject.length > 200) return json({ error: `template "${key3}" subject must be a single line under 200 characters` }, 400);
-    if (text6.length > 1e4) return json({ error: `template "${key3}" body is too long` }, 400);
-    clean[key3] = { subject, text: text6, enabled: t?.enabled !== false };
+    if (text8.length > 1e4) return json({ error: `template "${key3}" body is too long` }, 400);
+    clean[key3] = { subject, text: text8, enabled: t?.enabled !== false };
   }
   const emailish = /^[^\s@]+@[^\s@]+\.[^\s@]+$/;
   const notificationEmail = str2(body.notificationEmail).trim();
@@ -10152,13 +10696,15 @@ var handleAdminGroupEmail = async (req, url, env, ctx) => {
   if (!emailish.test(notificationEmail)) return json({ error: "notification address must be a valid email" }, 400);
   if (!emailish.test(replyTo)) return json({ error: "reply-to address must be a valid email" }, 400);
   if (debugEmail && !emailish.test(debugEmail)) return json({ error: "debug address must be a valid email" }, 400);
+  const fromName = str2(body.fromName).trim();
+  if (/[\r\n<>]/.test(fromName) || fromName.length > 100) return json({ error: "from name must be one line of at most 100 characters with no angle brackets" }, 400);
   const commitmentText = str2(body.commitmentText);
   const normsText = str2(body.normsText);
   if (commitmentText.length > 5e3 || normsText.length > 5e3) return json({ error: "commitment/norms text is too long" }, 400);
   const id6 = { ns: "groups", attr: "id", value: ctx.chapter.id };
   await db.transact([
     { t: "merge", ns: "groups", id: id6, attrs: { emailTemplates: clean } },
-    { t: "update", ns: "groups", id: id6, attrs: { commitmentText, normsText, notificationEmail, replyTo, debugEmail } }
+    { t: "update", ns: "groups", id: id6, attrs: { commitmentText, normsText, notificationEmail, replyTo, debugEmail, fromName } }
   ]);
   return json({ ok: true });
 };
@@ -10207,11 +10753,11 @@ var handleAdminEmailTest = async (req, url, env, ctx) => {
   }
   const group = await loadGroup2(db, ctx.chapter.id);
   if (!group) return json({ error: "not found" }, 404);
-  const res = await sendTemplated(notifyDeps(db, env), {
+  const res = await sendTemplated(lifecycleNotifyDeps(db, env), {
     group: emailGroupFrom(group),
     template,
     to: str2(group.notificationEmail),
-    vars: { firstName: "Sample", lastName: "Person", email: "sample@example.com", phone: "(555) 010-0100", state: "CA", adminUrl: `${url.origin}/admin/`, membersUrl: `${url.origin}/members/` },
+    vars: sampleVariables(url.origin, resolveScheduling(group.schedulingJson).timezone),
     dedupeKey: `test:${template}:${Date.now()}`,
     force: true
   });
@@ -10238,7 +10784,7 @@ var handleAdminComms = async (req, url, env, ctx) => {
   const app = data.applications?.[0] ?? null;
   if (!app || !chapterBillingApplication(app, ctx.chapter.id, env.ODLA_RUNTIME)) return json({ error: "not found" }, 404);
   const group = await loadGroup2(db, str2(app?.groupId, ctx.chapter.id));
-  const vars = app ? { firstName: str2(app.firstName), lastName: str2(app.lastName), email: str2(app.email), phone: str2(app.phone), state: str2(app.state), adminUrl: `${url.origin}/admin/`, membersUrl: `${url.origin}/members/` } : null;
+  const vars = app ? { firstName: str2(app.firstName), lastName: str2(app.lastName), email: str2(app.email), phone: str2(app.phone), state: str2(app.state), adminUrl: adminUrlFor(url.origin), membersUrl: membersUrlFor(url.origin) } : null;
   const emails = (data.emailLog ?? []).filter((r) => r.template !== "adminNotification").map((r) => {
     let mailBody = typeof r.body === "string" ? r.body : null;
     if (!mailBody && group && vars) mailBody = renderTemplateBody(emailGroupFrom(group), String(r.template), vars);
@@ -10262,6 +10808,28 @@ var handleAdminComms = async (req, url, env, ctx) => {
 import { getRecord as getRecord5, typeSummary } from "@odla-ai/crm";
 import { signFederatedRequest as signFederatedRequest4, verifyFederatedRequest as verifyFederatedRequest5 } from "@odla-ai/db";
 
+// src/network-edge.ts
+var EDGE_UNPAIRED = "edge_unpaired";
+function pairingCommand(leaderId, targetId, env) {
+  const scope2 = env ? ` --env ${env}` : "";
+  return `odla-ai chapter edge pair --leader ${leaderId} --follower ${targetId}${scope2}`;
+}
+function edgeUnpaired(leaderId, target, env) {
+  return {
+    code: EDGE_UNPAIRED,
+    target: target.id,
+    secretName: target.secretName,
+    message: `edge to "${target.id}" is unpaired: leader vault slot "${target.secretName}" is empty`,
+    hint: pairingCommand(leaderId, target.id, env)
+  };
+}
+function unpairedResponse(unpaired) {
+  return new Response(JSON.stringify({ error: unpaired.message, ...unpaired }), {
+    status: 502,
+    headers: { "content-type": "application/json" }
+  });
+}
+
 // src/worker-network-push.ts
 import { recordDeliveryAttempt } from "@odla-ai/crm";
 import { signFederatedRequest as signFederatedRequest3 } from "@odla-ai/db";
@@ -10274,15 +10842,15 @@ async function pushNetworkRecord(db, env, ctx, target, record4) {
     newId: () => crypto.randomUUID()
   };
   if (!secret) {
-    const error = `vault secret "${target.secretName}" is missing`;
+    const unpaired = edgeUnpaired(ctx.chapter.id, target, env.ODLA_ENV);
     await recordDeliveryAttempt(crmDeps3, {
       recordId: record4.id,
       targetId: target.id,
       status: "failed",
       payloadVersion: 2,
-      error
+      error: unpaired.message
     });
-    return { id: target.id, name: target.name, ok: false, error };
+    return { id: target.id, name: target.name, ok: false, error: unpaired.message, code: unpaired.code, hint: unpaired.hint };
   }
   let payload;
   try {
@@ -10423,17 +10991,20 @@ async function snapshotOne(db, env, ctx, target) {
     publicSite: { available: null }
   };
   const secret = await getVaultSecret(db, target.secretName);
-  if (!secret) return {
-    ...base,
-    available: false,
-    transport: {
-      kind: transportKind,
-      ...target.binding ? { binding: target.binding } : {},
-      reachable: null,
-      error: { code: "edge_secret_missing", message: "edge secret is missing" }
-    },
-    error: "edge secret is missing"
-  };
+  if (!secret) {
+    const unpaired = edgeUnpaired(ctx.chapter.id, target, env.ODLA_ENV);
+    return {
+      ...base,
+      available: false,
+      transport: {
+        kind: transportKind,
+        ...target.binding ? { binding: target.binding } : {},
+        reachable: null,
+        error: unpaired
+      },
+      error: unpaired.message
+    };
+  }
   const destination = new URL("/api/network/snapshot", target.url);
   try {
     const transport = resolveNetworkTargetTransport(env, target);
@@ -10913,7 +11484,7 @@ var handleNetworkRecords = async (req, url, env, ctx) => {
       if (hasFields && Object.keys(fields).some((name) => !capabilities.edit?.fields.some((field) => field.id === name))) {
         return json({ error: "use the verified identity or application workflow for these fields", code: "field_forbidden" }, 403);
       }
-      const deps2 = { crm: ctx.chapter.crm, db };
+      const deps = { crm: ctx.chapter.crm, db };
       if (hasFields && ctx.chapter.mode === "chapter" && record4.type === "person") {
         const updated2 = await updateChapterPerson({
           db,
@@ -10932,7 +11503,7 @@ var handleNetworkRecords = async (req, url, env, ctx) => {
           record: await operationalReaderRecord(updated2.record, reader, db, env, ctx)
         });
       }
-      const updated = hasFields ? await updateRecord6(deps2, {
+      const updated = hasFields ? await updateRecord6(deps, {
         id: record4.id,
         input: fields,
         mutationId: activityId,
@@ -10943,7 +11514,7 @@ var handleNetworkRecords = async (req, url, env, ctx) => {
           authorId: `network:${verified.sender}`,
           meta: auditMeta
         }
-      }) : await setStage3(deps2, {
+      }) : await setStage3(deps, {
         id: record4.id,
         to: input.stage,
         authorId: `network:${verified.sender}`,
@@ -11043,7 +11614,10 @@ function targetFor2(ctx, id6) {
 }
 async function readTargetRecords(db, env, ctx, target, query) {
   const secret = await getVaultSecret(db, target.secretName);
-  if (!secret) return { ok: false, error: "edge secret is missing" };
+  if (!secret) {
+    const unpaired = edgeUnpaired(ctx.chapter.id, target, env.ODLA_ENV);
+    return { ok: false, error: unpaired.message, unpaired };
+  }
   const destination = new URL("/api/network/records", target.url);
   destination.search = query.toString();
   try {
@@ -11080,7 +11654,7 @@ async function mutateTargetRecord(db, env, ctx, target, input) {
     return json({ error: "stage transitions are not enabled for this target", code: "stage_forbidden" }, 403);
   }
   const secret = await getVaultSecret(db, target.secretName);
-  if (!secret) return json({ error: "edge secret is missing", code: "edge_unavailable" }, 502);
+  if (!secret) return unpairedResponse(edgeUnpaired(ctx.chapter.id, target, env.ODLA_ENV));
   const destination = new URL("/api/network/records", target.url);
   const body = JSON.stringify(input);
   try {
@@ -11162,7 +11736,9 @@ var handleAdminNetworkRecords = async (req, url, env, ctx) => {
   if (window.search) query.set("search", window.search);
   if (window.stage) query.set("stage", window.stage);
   const result = await readTargetRecords(got.db, env, ctx, target, query);
-  if (!result.ok) return json({ error: result.error }, result.status ?? 502);
+  if (!result.ok) {
+    return result.unpaired ? unpairedResponse(result.unpaired) : json({ error: result.error }, result.status ?? 502);
+  }
   if ((window.stage || url.searchParams.has("sort")) && (!result.page.appliedQuery || result.page.appliedQuery.sort !== window.sortId || result.page.appliedQuery.stage !== window.stage)) {
     return json({ error: "follower did not apply the requested record query" }, 502);
   }
@@ -11418,7 +11994,7 @@ var handleAdminNetworkSharedNotes = async (req, url, env, ctx) => {
     body = JSON.stringify({ body: note, mutationId: crypto.randomUUID() });
   }
   const secret = await getVaultSecret(got.db, target.secretName);
-  if (!secret) return json({ error: "edge secret is missing" }, 502);
+  if (!secret) return unpairedResponse(edgeUnpaired(ctx.chapter.id, target, env.ODLA_ENV));
   const destination = new URL("/api/network/shared-notes", target.url);
   destination.search = new URLSearchParams({ type: recordType, recordId }).toString();
   try {
@@ -11472,11 +12048,11 @@ function validateNetworkPersonImport(input, allowedChapterIds) {
   if (raw2.approved !== true || raw2.isRealPerson !== true) errors.push("import must be approved and identify a real person");
   const sourceSystem = typeof raw2.sourceSystem === "string" ? raw2.sourceSystem.trim().toLowerCase() : "";
   const sourceRecordId = typeof raw2.sourceRecordId === "string" ? raw2.sourceRecordId.trim() : "";
-  const provenance = typeof raw2.provenance === "string" ? raw2.provenance.trim() : "";
+  const provenance2 = typeof raw2.provenance === "string" ? raw2.provenance.trim() : "";
   const displayName = typeof raw2.displayName === "string" ? raw2.displayName.trim() : "";
   if (!TOKEN.test(sourceSystem) || /(?:^|[._:-])(fixture|test|development|dev)(?:$|[._:-])/.test(sourceSystem)) errors.push("sourceSystem must name an approved non-development external system");
   if (!sourceRecordId || sourceRecordId.length > 200) errors.push("sourceRecordId is required and bounded");
-  if (!provenance || provenance.length > 500) errors.push("provenance is required and bounded");
+  if (!provenance2 || provenance2.length > 500) errors.push("provenance is required and bounded");
   if (!displayName || displayName.length > 200) errors.push("displayName is required and bounded");
   if (FIXTURE_MARKER.test(sourceRecordId) || FIXTURE_MARKER.test(displayName)) {
     errors.push("fixture, test, sample, and dummy rows cannot become network Persons");
@@ -11544,7 +12120,7 @@ function validateNetworkPersonImport(input, allowedChapterIds) {
     sourceKind: "external_reimport",
     sourceSystem,
     sourceRecordId,
-    provenance,
+    provenance: provenance2,
     approved: true,
     isRealPerson: true,
     displayName,
@@ -12249,7 +12825,7 @@ async function revealNetworkPersonRegistryRecord(db, input, mutationId, actor, n
 }
 
 // src/worker-routes-network-person-registry.ts
-var PATH3 = "/api/admin/network-person-registry";
+var PATH5 = "/api/admin/network-person-registry";
 var MAX_BODY2 = 8 * 1024 * 1024;
 var MUTATION_ID4 = /^[A-Za-z0-9_-]{16,128}$/;
 var positiveRevision = (value) => {
@@ -12274,7 +12850,7 @@ function registryError(error) {
   return null;
 }
 var handleAdminNetworkPersonRegistry = async (req, url, env, ctx) => {
-  if (url.pathname !== PATH3) return null;
+  if (url.pathname !== PATH5) return null;
   if (!ctx.chapter.networkPersonRegistry) return json({ error: "not found" }, 404);
   if (req.method !== "GET" && req.method !== "POST") return json({ error: "method not allowed" }, 405);
   if (req.method === "POST" && Number(req.headers.get("content-length") ?? 0) > MAX_BODY2) {
@@ -12286,9 +12862,9 @@ var handleAdminNetworkPersonRegistry = async (req, url, env, ctx) => {
   if (req.method === "POST") {
     let body;
     try {
-      const text6 = await req.text();
-      if (new TextEncoder().encode(text6).byteLength > MAX_BODY2) return json({ error: "request is too large" }, 413);
-      const parsed = JSON.parse(text6);
+      const text8 = await req.text();
+      if (new TextEncoder().encode(text8).byteLength > MAX_BODY2) return json({ error: "request is too large" }, 413);
+      const parsed = JSON.parse(text8);
       if (!parsed || typeof parsed !== "object" || Array.isArray(parsed)) throw new Error("invalid");
       body = parsed;
     } catch {
@@ -12457,7 +13033,7 @@ import { signFederatedRequest as signFederatedRequest7, verifyFederatedRequest a
 // src/network-commercial-parity.ts
 var DIGEST = /^[0-9a-f]{64}$/;
 var MAX_RECORDS = 500;
-var text4 = (value, max = 255) => typeof value === "string" && value.length > 0 && value.length <= max ? value : null;
+var text6 = (value, max = 255) => typeof value === "string" && value.length > 0 && value.length <= max ? value : null;
 function parityMessage(partition, kind, value) {
   return [
     "chapter-commercial-parity",
@@ -12489,18 +13065,18 @@ async function digestWithKey(key3, partition, kind, value) {
 async function buildChapterCommercialParitySnapshot(input) {
   const requestedMax = input.maxRecords ?? MAX_RECORDS;
   const maxRecords = Number.isSafeInteger(requestedMax) ? Math.max(0, Math.min(requestedMax, MAX_RECORDS)) : MAX_RECORDS;
-  const eligible = input.rows.filter((row2) => text4(row2.id) && (text4(row2.stripeCustomerId) || text4(row2.stripeSubscriptionId)));
+  const eligible = input.rows.filter((row2) => text6(row2.id) && (text6(row2.stripeCustomerId) || text6(row2.stripeSubscriptionId)));
   const selected2 = eligible.slice(0, maxRecords);
   const key3 = await parityKey(input.secret);
   const records = await Promise.all(selected2.map(async (row2) => {
-    const applicationId = text4(row2.id);
-    const customerId = text4(row2.stripeCustomerId);
-    const subscriptionId = text4(row2.stripeSubscriptionId);
+    const applicationId = text6(row2.id);
+    const customerId = text6(row2.stripeCustomerId);
+    const subscriptionId = text6(row2.stripeSubscriptionId);
     return {
       applicationDigest: await digestWithKey(key3, input.partition, "application", applicationId),
       customerDigest: customerId ? await digestWithKey(key3, input.partition, "customer", customerId) : null,
       subscriptionDigest: subscriptionId ? await digestWithKey(key3, input.partition, "subscription", subscriptionId) : null,
-      status: text4(row2.status, 64),
+      status: text6(row2.status, 64),
       canceled: row2.canceled === true
     };
   }));
@@ -12526,7 +13102,7 @@ function validSnapshot(snapshot, source) {
   if (snapshot?.version !== 1 || snapshot.site?.id !== source.chapterId || !partition || !Array.isArray(records) || records.length > MAX_RECORDS || partition.appId !== source.appId || partition.chapterId !== source.chapterId || partition.environment !== source.environment || partition.dataEnvironment !== source.dataEnvironment || partition.runtime !== source.runtime || typeof snapshot.complete !== "boolean" || typeof snapshot.truncated !== "boolean" || !snapshot.counts) return false;
   const seen = /* @__PURE__ */ new Set();
   for (const record4 of records) {
-    if (!DIGEST.test(record4.applicationDigest) || record4.customerDigest !== null && !DIGEST.test(record4.customerDigest) || record4.subscriptionDigest !== null && !DIGEST.test(record4.subscriptionDigest) || record4.status !== null && text4(record4.status, 64) === null || typeof record4.canceled !== "boolean") return false;
+    if (!DIGEST.test(record4.applicationDigest) || record4.customerDigest !== null && !DIGEST.test(record4.customerDigest) || record4.subscriptionDigest !== null && !DIGEST.test(record4.subscriptionDigest) || record4.status !== null && text6(record4.status, 64) === null || typeof record4.canceled !== "boolean") return false;
     const key3 = recordKey(record4);
     if (seen.has(key3)) return false;
     seen.add(key3);
@@ -12537,16 +13113,16 @@ async function reconcileCommercialParitySnapshot(input) {
   if (!validSnapshot(input.snapshot, input.source)) throw new Error("invalid chapter commercial parity snapshot");
   const sourceKey = networkCommercialSourceKey(input.source);
   const key3 = await parityKey(input.secret);
-  const shadow = await Promise.all(input.projection.subscriptions.filter((row2) => row2.sourceKey === sourceKey && text4(row2.applicationId) && text4(row2.objectId)).map(async (row2) => {
-    const customerId = text4(row2.customerId);
-    const subscriptionId = text4(row2.subscriptionId) ?? text4(row2.objectId);
+  const shadow = await Promise.all(input.projection.subscriptions.filter((row2) => row2.sourceKey === sourceKey && text6(row2.applicationId) && text6(row2.objectId)).map(async (row2) => {
+    const customerId = text6(row2.customerId);
+    const subscriptionId = text6(row2.subscriptionId) ?? text6(row2.objectId);
     return {
       applicationDigest: await digestWithKey(key3, input.snapshot.partition, "application", row2.applicationId),
       customerDigest: customerId ? await digestWithKey(key3, input.snapshot.partition, "customer", customerId) : null,
       subscriptionDigest: subscriptionId ? await digestWithKey(key3, input.snapshot.partition, "subscription", subscriptionId) : null,
       status: null,
       canceled: false,
-      stripeStatus: text4(row2.status, 64),
+      stripeStatus: text6(row2.status, 64),
       stripeCanceled: row2.status === "canceled"
     };
   }));
@@ -12672,7 +13248,7 @@ var handleNetworkCommercialParity = async (req, url, env, ctx) => {
 async function reconcileTarget(db, env, ctx, target, projection) {
   const base = { targetId: target.id, name: target.name, url: target.url };
   const secret = await getVaultSecret(db, target.secretName);
-  if (!secret) return { ...base, available: false, ok: false, error: { code: "edge_secret_missing" } };
+  if (!secret) return { ...base, available: false, ok: false, error: edgeUnpaired(ctx.chapter.id, target, env.ODLA_ENV) };
   const destination = new URL(PARITY_PATH, target.url);
   try {
     const transport = resolveNetworkTargetTransport(env, target);
@@ -12828,11 +13404,23 @@ var handleNetworkCommercialStripeWebhook = async (req, url, env, ctx) => {
     const event = await constructStripeEvent(body, signature, secret);
     const fact = normalizeNetworkCommercialStripeEvent(event, await stripeEventDigest(body));
     if (!fact.eventId || !fact.eventType || !fact.objectId) return json({ error: "Stripe event identity is invalid" }, 400);
-    const result = await ingestNetworkCommercialFact(db, ctx.chapter.networkCommercialReadModel.sources, fact, Date.now(), await stripePayloadDigest(body));
+    const result = await ingestNetworkCommercialFact(
+      db,
+      ctx.chapter.networkCommercialReadModel.sources,
+      fact,
+      Date.now(),
+      await stripePayloadDigest(body),
+      networkCommercialAlerts(ctx, WEBHOOK_PATH)
+    );
     if (result.status === "collision") {
       console.error("network commercial event collision", JSON.stringify({ eventId: fact.eventId, eventType: fact.eventType }));
     }
-    return json({ ok: true, status: result.status, eventId: fact.eventId });
+    return json({
+      ok: true,
+      status: result.status,
+      eventId: fact.eventId,
+      ...result.status === "replayed" && result.resolvedCollision ? { resolvedCollision: true } : {}
+    });
   } catch (error) {
     if (error instanceof StripeError) return json({ error: error.message, code: error.code }, 400);
     throw error;
@@ -12856,18 +13444,39 @@ var handleAdminNetworkCommercialReadModel = async (req, url, env, ctx) => {
     } catch {
       return json({ error: "invalid JSON body" }, 400);
     }
+    const alerts = networkCommercialAlerts(ctx, ADMIN_PATH2);
     if (parsed.command === "recover-event") {
       try {
         return json(await recoverNetworkCommercialEvent(
           db,
           ctx.chapter.networkCommercialReadModel.sources,
           String(parsed.eventId ?? ""),
-          got.user.userId
+          got.user.userId,
+          Date.now(),
+          alerts
         ));
       } catch (error) {
         return json({ error: error instanceof Error ? error.message : "event recovery failed" }, 409);
       }
     }
+    if (parsed.command === "resolve") {
+      if (typeof parsed.mutationId !== "string" || !MUTATION_ID5.test(parsed.mutationId)) return json({ error: "resolve requires a valid mutationId" }, 400);
+      const reason = typeof parsed.reason === "string" ? parsed.reason.trim() : "";
+      if (!reason || reason.length > 500) return json({ error: "resolve requires a reason of at most 500 characters" }, 400);
+      try {
+        const result = await resolveNetworkCommercialCollision(
+          db,
+          ctx.chapter.networkCommercialReadModel.sources,
+          { eventId: String(parsed.eventId ?? ""), mutationId: parsed.mutationId, actorUserId: got.user.userId, reason },
+          Date.now(),
+          alerts
+        );
+        return json({ resolved: true, eventId: result.eventId, reviewId: result.reviewId, ...safeProjection(result.projection) });
+      } catch (error) {
+        const code = error.code;
+        return json({ error: error instanceof Error ? error.message : "resolve failed", code }, code === "invalid_event" ? 400 : 409);
+      }
+    }
     if (parsed.command === "reconcile-chapters") {
       const projection2 = await loadNetworkCommercialProjection(db, ctx.chapter.networkCommercialReadModel.sources);
       return json(await reconcileChapterCommercialTargets(db, env, ctx, projection2));
@@ -12895,9 +13504,9 @@ var handleAdminNetworkCommercialReadModel = async (req, url, env, ctx) => {
       }
     }
     if (parsed.command !== "rebuild" || typeof parsed.mutationId !== "string" || !MUTATION_ID5.test(parsed.mutationId)) {
-      return json({ error: "rebuild, reconcile-stripe, or reconcile-chapters command is required; rebuild also requires a valid mutationId" }, 400);
+      return json({ error: "rebuild, resolve, recover-event, reconcile-stripe, or reconcile-chapters command is required; rebuild and resolve also require a valid mutationId" }, 400);
     }
-    const projection = await rebuildNetworkCommercialProjection(db, ctx.chapter.networkCommercialReadModel.sources, parsed.mutationId);
+    const projection = await rebuildNetworkCommercialProjection(db, ctx.chapter.networkCommercialReadModel.sources, parsed.mutationId, Date.now(), alerts);
     return json({ rebuilt: true, ...safeProjection(projection) });
   }
   return json(safeProjection(await loadNetworkCommercialProjection(db, ctx.chapter.networkCommercialReadModel.sources)));
@@ -13007,7 +13616,7 @@ var record3 = (value) => value !== null && typeof value === "object" && !Array.i
 function unknownKeys3(value, allowed2, path, errors) {
   for (const key3 of Object.keys(value)) if (!allowed2.has(key3)) errors.push(`${path}.${key3} is not supported`);
 }
-function text5(value, path, errors, max = MAX_TEXT2, required = true) {
+function text7(value, path, errors, max = MAX_TEXT2, required = true) {
   if (value === void 0 && !required) return void 0;
   if (typeof value !== "string" || required && !value.trim()) {
     errors.push(`${path} must be a non-empty string`);
@@ -13033,7 +13642,7 @@ function scopeValue(value, path, errors) {
     return { kind: raw2.kind };
   }
   if (raw2.kind === "chapter") {
-    const chapterId = text5(raw2.chapterId, `${path}.chapterId`, errors, 63) ?? "";
+    const chapterId = text7(raw2.chapterId, `${path}.chapterId`, errors, 63) ?? "";
     if (chapterId && !APP_ID.test(chapterId)) errors.push(`${path}.chapterId must be a lowercase app slug`);
     return { kind: "chapter", chapterId };
   }
@@ -13047,22 +13656,22 @@ function resourceValue(value, path, errors) {
     return null;
   }
   unknownKeys3(raw2, RESOURCE_KEYS, path, errors);
-  const id6 = text5(raw2.id, `${path}.id`, errors, 80) ?? "";
+  const id6 = text7(raw2.id, `${path}.id`, errors, 80) ?? "";
   if (id6 && !ID4.test(id6)) errors.push(`${path}.id must be lowercase kebab-case`);
-  const kind = text5(raw2.kind, `${path}.kind`, errors) ?? "";
+  const kind = text7(raw2.kind, `${path}.kind`, errors) ?? "";
   if (!KINDS.has(kind)) errors.push(`${path}.kind is unsupported`);
-  const title = text5(raw2.title, `${path}.title`, errors, 240) ?? "";
-  const summary = text5(raw2.summary, `${path}.summary`, errors, 1e3, false);
-  const status2 = text5(raw2.status, `${path}.status`, errors) ?? "";
+  const title = text7(raw2.title, `${path}.title`, errors, 240) ?? "";
+  const summary = text7(raw2.summary, `${path}.summary`, errors, 1e3, false);
+  const status2 = text7(raw2.status, `${path}.status`, errors) ?? "";
   if (!STATUSES.has(status2)) errors.push(`${path}.status must be draft, published, or archived`);
   const revision = integer4(raw2.revision, `${path}.revision`, errors);
   const scope2 = scopeValue(raw2.scope, `${path}.scope`, errors) ?? { kind: "global" };
-  const tags = Array.isArray(raw2.tags) ? raw2.tags.map((tag, index2) => text5(tag, `${path}.tags[${index2}]`, errors, 80) ?? "") : [];
+  const tags = Array.isArray(raw2.tags) ? raw2.tags.map((tag, index2) => text7(tag, `${path}.tags[${index2}]`, errors, 80) ?? "") : [];
   if (!Array.isArray(raw2.tags)) errors.push(`${path}.tags must be an array`);
   if (tags.length > MAX_TAGS) errors.push(`${path}.tags may contain at most ${MAX_TAGS} items`);
   if (new Set(tags).size !== tags.length) errors.push(`${path}.tags must be unique`);
-  const bodyMarkdown = text5(raw2.bodyMarkdown, `${path}.bodyMarkdown`, errors, MAX_MARKDOWN3, false);
-  const url = text5(raw2.url, `${path}.url`, errors, 2048, false);
+  const bodyMarkdown = text7(raw2.bodyMarkdown, `${path}.bodyMarkdown`, errors, MAX_MARKDOWN3, false);
+  const url = text7(raw2.url, `${path}.url`, errors, 2048, false);
   if (url) {
     try {
       if (new URL(url).protocol !== "https:") errors.push(`${path}.url must use https`);
@@ -13074,9 +13683,9 @@ function resourceValue(value, path, errors) {
   if (raw2.brandAsset !== void 0 && !asset) errors.push(`${path}.brandAsset must be an object`);
   if (asset) unknownKeys3(asset, ASSET_KEYS, `${path}.brandAsset`, errors);
   const brandAsset = asset ? {
-    bookId: text5(asset.bookId, `${path}.brandAsset.bookId`, errors, 160) ?? "",
-    assetId: text5(asset.assetId, `${path}.brandAsset.assetId`, errors, 160) ?? "",
-    ...asset.filename === void 0 ? {} : { filename: text5(asset.filename, `${path}.brandAsset.filename`, errors, 240) ?? "" }
+    bookId: text7(asset.bookId, `${path}.brandAsset.bookId`, errors, 160) ?? "",
+    assetId: text7(asset.assetId, `${path}.brandAsset.assetId`, errors, 160) ?? "",
+    ...asset.filename === void 0 ? {} : { filename: text7(asset.filename, `${path}.brandAsset.filename`, errors, 240) ?? "" }
   } : void 0;
   if ((kind === "document" || kind === "note") && !bodyMarkdown) errors.push(`${path}.bodyMarkdown is required for ${kind}`);
   if ((kind === "link" || kind === "inspiration") && !url) errors.push(`${path}.url is required for ${kind}`);
@@ -13091,21 +13700,21 @@ function resourceValue(value, path, errors) {
   if (provenanceRaw?.promotedFrom !== void 0 && !promotedRaw) errors.push(`${path}.provenance.promotedFrom must be an object`);
   if (promotedRaw) unknownKeys3(promotedRaw, PROMOTION_KEYS, `${path}.provenance.promotedFrom`, errors);
   const promotedFrom = promotedRaw ? {
-    chapterId: text5(promotedRaw.chapterId, `${path}.provenance.promotedFrom.chapterId`, errors, 63) ?? "",
-    resourceId: text5(promotedRaw.resourceId, `${path}.provenance.promotedFrom.resourceId`, errors, 80) ?? "",
+    chapterId: text7(promotedRaw.chapterId, `${path}.provenance.promotedFrom.chapterId`, errors, 63) ?? "",
+    resourceId: text7(promotedRaw.resourceId, `${path}.provenance.promotedFrom.resourceId`, errors, 80) ?? "",
     resourceRevision: integer4(promotedRaw.resourceRevision, `${path}.provenance.promotedFrom.resourceRevision`, errors),
     documentRevision: integer4(promotedRaw.documentRevision, `${path}.provenance.promotedFrom.documentRevision`, errors),
-    promotedBy: text5(promotedRaw.promotedBy, `${path}.provenance.promotedFrom.promotedBy`, errors, 320) ?? "",
+    promotedBy: text7(promotedRaw.promotedBy, `${path}.provenance.promotedFrom.promotedBy`, errors, 320) ?? "",
     promotedAt: integer4(promotedRaw.promotedAt, `${path}.provenance.promotedFrom.promotedAt`, errors, 0)
   } : void 0;
-  const provenance = {
-    createdBy: text5(provenanceRaw?.createdBy, `${path}.provenance.createdBy`, errors, 320) ?? "",
+  const provenance2 = {
+    createdBy: text7(provenanceRaw?.createdBy, `${path}.provenance.createdBy`, errors, 320) ?? "",
     createdAt: integer4(provenanceRaw?.createdAt, `${path}.provenance.createdAt`, errors, 0),
-    updatedBy: text5(provenanceRaw?.updatedBy, `${path}.provenance.updatedBy`, errors, 320) ?? "",
+    updatedBy: text7(provenanceRaw?.updatedBy, `${path}.provenance.updatedBy`, errors, 320) ?? "",
     updatedAt: integer4(provenanceRaw?.updatedAt, `${path}.provenance.updatedAt`, errors, 0),
     ...promotedFrom ? { promotedFrom } : {}
   };
-  return { id: id6, kind, title, ...summary ? { summary } : {}, tags, scope: scope2, status: status2, revision, ...bodyMarkdown ? { bodyMarkdown } : {}, ...url ? { url } : {}, ...brandAsset ? { brandAsset } : {}, provenance };
+  return { id: id6, kind, title, ...summary ? { summary } : {}, tags, scope: scope2, status: status2, revision, ...bodyMarkdown ? { bodyMarkdown } : {}, ...url ? { url } : {}, ...brandAsset ? { brandAsset } : {}, provenance: provenance2 };
 }
 function validateBuilderLibraryDocument(value, options = {}) {
   const errors = [];
@@ -13120,7 +13729,7 @@ function validateBuilderLibraryDocument(value, options = {}) {
   if (sourceRaw) unknownKeys3(sourceRaw, SOURCE_KEYS2, "document.source", errors);
   const sourceType = sourceRaw?.type;
   if (sourceType !== "chapter" && sourceType !== "built_not_found") errors.push("document.source.type must be chapter or built_not_found");
-  const sourceAppId = text5(sourceRaw?.appId, "document.source.appId", errors, 63) ?? "";
+  const sourceAppId = text7(sourceRaw?.appId, "document.source.appId", errors, 63) ?? "";
   if (sourceAppId && !APP_ID.test(sourceAppId)) errors.push("document.source.appId must be a lowercase app slug");
   if (options.sourceType && sourceType !== options.sourceType) errors.push(`document.source.type must be ${options.sourceType}`);
   if (options.sourceAppId && sourceAppId !== options.sourceAppId) errors.push(`document.source.appId must be ${options.sourceAppId}`);
@@ -13128,8 +13737,8 @@ function validateBuilderLibraryDocument(value, options = {}) {
   if (raw2.target !== void 0 && !targetRaw) errors.push("document.target must be an object");
   if (targetRaw) unknownKeys3(targetRaw, TARGET_KEYS2, "document.target", errors);
   const target = targetRaw ? {
-    appId: text5(targetRaw.appId, "document.target.appId", errors, 63) ?? "",
-    environment: text5(targetRaw.environment, "document.target.environment", errors, 80) ?? ""
+    appId: text7(targetRaw.appId, "document.target.appId", errors, 63) ?? "",
+    environment: text7(targetRaw.environment, "document.target.environment", errors, 80) ?? ""
   } : void 0;
   if (options.targetAppId && target?.appId !== options.targetAppId) errors.push(`document.target.appId must be ${options.targetAppId}`);
   if (!Array.isArray(raw2.resources)) errors.push("document.resources must be an array");
@@ -13763,7 +14372,11 @@ async function reconcileMembershipRenewal(db, input, now) {
       membershipUpdate("networkMembership", id6, {
         status: status2,
         graceEndsAt,
-        ...paid ? { termStartedAt: start, termEndsAt: end } : {},
+        ...paid ? {
+          termStartedAt: start,
+          termEndsAt: end,
+          ...membershipOfferingVersion(member.offeringSnapshot).seatPurchaseWindowCalendarMonths === void 0 ? { seatPurchaseEndsAt: end } : {}
+        } : {},
         revision: Number(member.revision) + 1,
         updatedAt: now
       }),
@@ -13923,10 +14536,11 @@ async function reserveNamedMembershipSeat(db, input, now) {
   const id6 = (await membershipOfferIdForRequest({ ...input, requestId: "named_seat" })).replace(/^offer_/, "seat_");
   let seat = await membershipLoad(db, "networkSeat", id6);
   if (!seat) {
-    if (!["paid_pending_approval", "active", "cancel_at_term_end"].includes(String(member.status)) || Number(member.refundedCents) !== 0 || now < Number(member.initialTermStartedAt) || now >= Number(member.termEndsAt) || now > Number(member.seatPurchaseEndsAt) || !Number.isSafeInteger(member.seatPurchaseEndsAt) || member.namedSeatId !== void 0) {
+    const offering = membershipOfferingVersion(member.offeringSnapshot), claimId = await recipientKey(input, email);
+    const purchaseEndsAt = seatPurchaseDeadline(offering, member);
+    if (!["paid_pending_approval", "active", "cancel_at_term_end"].includes(String(member.status)) || Number(member.refundedCents) !== 0 || now < Number(member.initialTermStartedAt) || now >= Number(member.termEndsAt) || now > purchaseEndsAt || !Number.isSafeInteger(purchaseEndsAt) || member.namedSeatId !== void 0) {
       membershipFail("named_seat_purchase_unavailable");
     }
-    const offering = membershipOfferingVersion(member.offeringSnapshot), claimId = await recipientKey(input, email);
     const attrs = {
       id: id6,
       ...membershipScope(input),
@@ -13945,7 +14559,7 @@ async function reserveNamedMembershipSeat(db, input, now) {
       status: "payment_pending",
       preparedAt: now,
       termEndsAt: member.termEndsAt,
-      seatPurchaseEndsAt: member.seatPurchaseEndsAt,
+      seatPurchaseEndsAt: purchaseEndsAt,
       offeringSnapshot: offering,
       revision: 1,
       createdAt: now,
@@ -14147,7 +14761,7 @@ async function confirmNamedMembershipSeatPayment(db, input, now) {
   }
   if (seat.purchasedAt === void 0) {
     if (!["payment_processing", "payment_canceling"].includes(String(seat.status))) membershipFail("named_seat_payment_not_expected");
-    const eligible = seat.status !== "payment_canceling" && ["paid_pending_approval", "active", "cancel_at_term_end"].includes(String(member.status)) && Number(member.refundedCents) === 0 && paidAt <= Number(member.seatPurchaseEndsAt) && now < Number(member.termEndsAt);
+    const eligible = seat.status !== "payment_canceling" && ["paid_pending_approval", "active", "cancel_at_term_end"].includes(String(member.status)) && Number(member.refundedCents) === 0 && paidAt <= seatPurchaseDeadline(membershipOfferingVersion(member.offeringSnapshot), member) && now < Number(member.termEndsAt);
     const status2 = eligible ? "renewal_pending" : "refund_pending", effectId = `${seat.id}:${eligible ? "attach-renewal" : "refund"}`;
     try {
       await db.transact([
@@ -15136,7 +15750,7 @@ async function readBoundedJson(response, signal, maxBytes, label) {
   };
   signal.addEventListener("abort", cancel, { once: true });
   let size = 0;
-  let text6 = "";
+  let text8 = "";
   const decoder = new TextDecoder();
   try {
     while (true) {
@@ -15146,10 +15760,10 @@ async function readBoundedJson(response, signal, maxBytes, label) {
       if (done) break;
       size += value.byteLength;
       if (size > maxBytes) throw new TypeError(`${label} exceeds limit`);
-      text6 += decoder.decode(value, { stream: true });
+      text8 += decoder.decode(value, { stream: true });
     }
     try {
-      return JSON.parse(text6 + decoder.decode());
+      return JSON.parse(text8 + decoder.decode());
     } catch {
       throw new TypeError(`invalid ${label}`);
     }
@@ -15366,7 +15980,7 @@ async function requestNamedSeatReservation(options) {
 async function requestNamedSeatOffer(options) {
   const result = await requestAuthority(options, "seat-offer", { applicationId: options.applicationId, skuId: options.skuId });
   const offer = result.seat;
-  if (!offer || offer.membershipId !== await networkMembershipId(options) || !Number.isSafeInteger(offer.amountCents) || offer.amountCents <= 0 || !/^[a-z]{3}$/.test(offer.currency) || !["month", "year"].includes(offer.interval) || typeof offer.eligible !== "boolean" || typeof offer.autoRenew !== "boolean" || !Number.isSafeInteger(offer.termEndsAt) || !Number.isSafeInteger(offer.purchaseEndsAt) || offer.digest !== await namedSeatOfferDigest(offer)) throw new Error("invalid named seat offer");
+  if (!offer || offer.membershipId !== await networkMembershipId(options) || !Number.isSafeInteger(offer.amountCents) || offer.amountCents <= 0 || !/^[a-z]{3}$/.test(offer.currency) || !["month", "year"].includes(offer.interval) || typeof offer.eligible !== "boolean" || typeof offer.autoRenew !== "boolean" || !Number.isSafeInteger(offer.termEndsAt) || !Number.isSafeInteger(offer.purchaseEndsAt) || offer.purchaseWindowed !== void 0 && typeof offer.purchaseWindowed !== "boolean" || offer.digest !== await namedSeatOfferDigest(offer)) throw new Error("invalid named seat offer");
   return offer;
 }
 async function requestNamedSeatInvitation(options) {
@@ -15811,6 +16425,7 @@ var BUILTIN_ROUTES = [
   handlePaymentRecovery,
   handleAdminNamedSeat,
   handleAdminMembershipSeats,
+  handleAdminMembershipPolicyVersions,
   handleAdminMeetings,
   handleAdminScheduling,
   // Roster + identity