@topy-ai/maggie 0.7.52 → 0.7.54

package/bundled-references/maggiedash-booking/PROGRESS.md

@@ -1,279 +0,0 @@
-# MaggieDash Booking task board
-
-This is the executable work breakdown for the first-party `/_maggie/booking`
-workspace. Each task has one repository owner, a concrete output, and a test
-or evidence gate. The detailed leaf-task board is
-[`EXECUTION-BOARD.json`](./EXECUTION-BOARD.json); the required task loop is in
-[`TASK-RUNBOOK.md`](./TASK-RUNBOOK.md). Status is updated in
-[`PROGRESS.md`](./PROGRESS.md).
-
-## Task sequence
-
-| ID | Task | Repository | Depends on | Output | Gate | Status |
-|---|---|---|---|---|---|---|
-| BK-001 | Freeze the implementation contract | both | docs baseline | versioned booking UI, host adapter, auth, payment and error boundaries | JSON contract validation | done |
-| BK-002 | Add the Booking workspace distribution target | MaggieDash | BK-001 | manifest workspace mapping and install-safe source tree | manifest/install validator | done |
-| BK-003 | Add the provider-neutral booking schema | MaggieDash | BK-001 | idempotent PostgreSQL migration with tenancy, lifecycle, overlap, payment, audit and outbox records | schema static gate + migration preflight notes | starter done; host pending |
-| BK-004 | Add Booking host adapter contracts | MaggieDash | BK-001 | endpoint/capability/error contract and TypeScript types | contract validator | done |
-| BK-005 | Build the Booking manager workspace | MaggieDash | BK-002, BK-004 | overview, calendar, bookings, customers, catalogue, staff, resources, payments, settings and audit screens | source gate + browser-ready route contract | UI done; runtime pending |
-| BK-006 | Add stable ai-cmo booking commands | ai-cmo-skills | BK-004 | `maggie booking inspect`, contract validation and release gate | CLI tests | done |
-| BK-007 | Add Maggie booking skill integration | ai-cmo-skills | BK-006 | install/configure/verify workflow with provider and payment boundaries | skill validation | done |
-| BK-008 | Add installer and host integration documentation | both | BK-002..BK-007 | README, Astro adapter guide, host route example and migration instructions | link/checklist validation | done |
-| BK-009 | Run unit/static/contract tests and fix regressions | both | BK-002..BK-008 | repeatable green test commands and sanitized evidence | all repository gates | done (repository gates; host browser/runtime pending) |
-| BK-010 | Record delivery and remaining production work | both | BK-009 | progress log, known limits, release checklist and next phase | docs cross-links | done |
-| BK-011 | Add provider-neutral runtime domain services | MaggieDash | BK-003, BK-004 | availability slot calculator, hold expiry, payment event reconciliation, notification retry rules | deterministic runtime fixture tests | done |
-| BK-012 | Add executable host worker runner | MaggieDash | BK-011 | dry-run/fixture-safe job runner for availability, holds, payments, and notifications | CLI job matrix and redacted reports | done |
-| BK-013 | Add production scheduling templates | MaggieDash | BK-012 | systemd service/timer, cron fallback, environment and locking runbook | template safety validator | done; host wiring pending |
-| BK-014 | Add production browser evidence workflow | MaggieDash | BK-005, BK-012 | Playwright capture contract, validator, protected manual workflow and artifact retention | fixture + workflow YAML validation | workflow done; host evidence pending |
-| BK-015 | Document host wiring and release operations | both | BK-011..BK-014 | adapter module shape, deploy order, rollback, alerts, and incident recovery | docs/link/release checklist | done |
-| BK-016 | Audit Stripe booking and operations surface | both | BK-004, BK-011 | versioned API/event capability matrix, Stripe normalizer, ecosystem boundary, and stale-audit gate | Stripe contract + runtime tests | done; host adapter pending |
-| BK-017 | Create executable Booking delivery board | both | BK-010 | machine-readable leaf tasks and task inspection CLI | board validator and list/show commands | passed |
-| BK-018 | Reconcile host adapter routes with UI and host documentation | MaggieDash | BK-017 | 47-route canonical contract, independent fixture, installed route projection, and validator | `npm test` / host contract validator | passed |
-| BK-019 | Build deterministic reference host adapter | MaggieDash | BK-018 | 47-route fixture host, local server, auth/scope/idempotency checks | reference-host validator, self-test, HTTP smoke | passed |
-| BK-020 | Harden PostgreSQL migration and evidence | MaggieDash | BK-018 | v2 migration, compatibility backfill, schema validator, repeatable migration and overlap evidence | schema validator + PostgreSQL 14 disposable DB | passed |
-| BK-021 | Complete availability, timezone, hold, and booking lifecycle rules | MaggieDash | BK-019, BK-020 | IANA/DST utilities, command layer, multi-segment conflict and idempotent hold/lifecycle operations | domain validator + runtime suite | passed |
-| BK-022 | Implement host adapter service boundaries and safe DTOs | MaggieDash | BK-019, BK-021 | request validation, canonical DTOs, safe errors, canonical list-object handling, transaction-injected service, and reusable 47-route dispatcher | service + route-handler validators + full suite | passed |
-| BK-023 | Implement catalog, staff, resource, schedule, and policy configuration | MaggieDash | BK-020, BK-022 | configuration contract, validation/update layer, readiness and audit | configuration validator + full suite | passed |
-| BK-024 | Implement provider-neutral payment orchestration and fake gateway | MaggieDash | BK-021, BK-022 | payment port, fake modes, reconciliation/refund boundaries and capability checks | payment gateway validator + full suite | passed |
-| BK-025 | Implement host-owned Stripe adapter against the current contract | host-owned with MaggieDash contract | BK-024 | injected official SDK factory, pinned API version, PaymentIntent/Checkout/SetupIntent/Refund/webhook seam | Stripe adapter conformance + full suite | passed |
-| BK-026 | Complete outbox notifications and recovery | both | BK-021, BK-022 | allowlisted templates, recipient hashing, lease/retry/dead-letter/replay and adapter contract | notifications validator + full suite | passed |
-| BK-027 | Finish Booking UI data loading, navigation, forms, and action feedback | MaggieDash | BK-018, BK-022, BK-023 | typed route loading, pagination, dialogs, forms, feedback | UI source gate + esbuild + reference-host Chrome smoke | passed |
-| BK-028 | Finish manager daily operations journeys | MaggieDash | BK-021, BK-023, BK-027 | calendar modes, lifecycle/reschedule, payment operations, audit views | UI source gate + reference-host Chrome interaction smoke | passed |
-| BK-029 | Verify authentication, tenancy, roles, and privacy boundaries | both | BK-019, BK-022, BK-027 | session/role/project checks, staff lifecycle-only mutations, payment/customer denial, and redaction scan | security validator + contract gate | passed |
-| BK-030 | Wire the production worker and operational controls | both | BK-020, BK-021, BK-024, BK-026 | injected PostgreSQL worker adapter, serialized tenant-scoped reads, no-provider dry-run, credential-free `--help`, tenant lock, correlation/health report with a persisted tenant-scoped last-success timestamp, dead-letter policy, ops evidence contract, production fixture guard, executable backup/restore rehearsal, and reviewed systemd/cron schedule generation | adapter/repository/health/ops evidence tests + safe installed `--help` checks + `maggie booking worker-schedule` + real disposable worker cycle/schema/lock + staging no-dispatch preview + backup/restore integration; lock contention skips before state load and provider dispatch; `worker.stale` reads the persisted prior success and the status table is preflighted; ORA staging migration, six-job preview, and real PostgreSQL integration passed; redaction covers customer email and phone numbers; ORA production timer observed active and write-capable; provider activity review, alert routing, backup/restore and recovery evidence pending | needs-evidence |
-| BK-031 | Capture real host conformance and browser evidence | both | BK-019, BK-022, BK-028, BK-029, BK-030 | ORA local Chrome v2 QA now checks all 17 manager routes at 3 viewports (51/51 normalized route/heading/layout passes, zero captured console errors, no horizontal overflow). Failed network requests were not observable and screenshot bitmap dimensions vary, so this local artifact is supplemental only. The ORA repo `.env` has no dedicated HTTPS staging base URL; protected workflow secrets were not inspected. Canonical MaggieDash and ORA root workflows now run the exact environment host-allowlist preflight before protected state writes and pass the allowlist to capture for a second check; regression and contract checks cover workflow ordering. Authenticated HTTPS-host evidence for all 47 endpoints and the canonical 51-screen browser artifact remain open | `npm run booking:runtime:plan:test` + MaggieDash `npm test` + ORA `booking:evidence-target:test`, `contract:check`, Astro check/build + protected-workflow order/allowlist regression + canonical/ORA helper byte parity + ORA local Chrome QA (supplemental only) | needs-evidence |
-| BK-032 | Run release gate, canary, documentation, and feedback closure | both | BK-025, BK-030, BK-031, BK-033, BK-034, BK-035, BK-036, BK-037, BK-038 | final release report, browser artifact parity/layout rejection, and docs | `maggie booking release-gate --require-runtime --require-browser --require-ops --require-board` | needs-evidence |
-| BK-033 | Freeze and validate the public customer booking boundary | both | BK-021, BK-024, BK-026 | public-noindex catalog/availability/hold/checkout/payment-return/cancel contract, redacted DTOs, notification intents, and host safety boundary | `npm run booking:customer-flow:test` + `npm test` | passed |
-| BK-034 | Ship the public customer booking page and pending-payment recovery UI | MaggieDash | BK-033 | installable customer page source, Astro route starter, catalog/availability/hold/checkout/pending-return UI, and noindex/public request checks | `npm run booking:customer-ui:test` + manifest/install validation | passed |
-| BK-035 | Exercise the public customer flow against the reference host | MaggieDash | BK-034 | deterministic public catalog/availability/hold/checkout/payment-return/cancel host and installable validator | `npm run booking:customer-reference-host:test` + `npm test` | passed |
-| BK-036 | Harden customer input validation and mutation replay | both | BK-035 | validated email/consent boundary, stable errors, customer-scoped checkout/cancel replay, and regressions | `npm run booking:customer-flow:test` + `npm run booking:customer-reference-host:test` + `npm test` | passed |
-| BK-037 | Reject public idempotency-key payload mismatches | MaggieDash | BK-036 | normalized request hash, safe 409 conflict, and hold/checkout/cancel mismatch regressions | `npm run booking:customer-reference-host:test` + `npm test` | passed |
-| BK-038 | Run all public customer gates in the runtime workflow | MaggieDash | BK-037 | source/install CI checks for customer flow, reference host, UI, and backend syntax | `npm test` + workflow marker validation | passed |
-| BK-039 | Freeze the complete manager and customer service adapter surface | MaggieDash | BK-022, BK-033, BK-038 | typed repository/service/customer methods, endpoint mappings, and installable drift validator | `npm run booking:service-contract:test` + `npm test` | passed |
-| BK-040 | Expose the service contract through the Booking CLI gates | ai-cmo-skills | BK-039 | compact contract mapping, install inspection, release-gate checks, and regression test | `python3 -m unittest tools.tests.test_maggie_booking -v` + `maggie booking inspect` | passed |
-| BK-041 | Complete the public customer cancellation journey | MaggieDash | BK-035, BK-040 | token-bound cancellation action, idempotent request, bounded UI states, and installable validator coverage | `npm run booking:customer-ui:test` + `npm test` | passed |
-| BK-042 | Implement the tenant-scoped PostgreSQL manager core repository | MaggieDash | BK-020, BK-021, BK-022, BK-039 | parameterized core reads, lifecycle writes, idempotency/event/audit persistence, schema/host seam, and real disposable-DB cycle | `npm run booking:postgres-core-repository:test` + disposable PostgreSQL integration + `npm test` | passed |
-| BK-043 | Complete PostgreSQL manager configuration and operational reads | MaggieDash | BK-042 | tenant-scoped catalog, staff, resource, schedule, closure, settings, health, and payment reads/writes with provider boundary gate | `npm run booking:postgres-manager-methods:test` + disposable PostgreSQL integration + `npm test` | passed |
-| BK-044 | Persist provider-injected payment operations through PostgreSQL | MaggieDash | BK-024, BK-025, BK-043 | payment start/reconcile/refund adapter, outside-transaction provider calls, normalized payment truth, and real integration evidence | `npm run booking:postgres-payment-adapter:test` + service gate + disposable PostgreSQL integration + `npm test` | passed |
-| BK-045 | Persist the public customer Booking journey | MaggieDash | BK-033, BK-034, BK-041, BK-044 | customer token hash/sealed storage, public hold/checkout/payment-return/cancel adapter, mutation idempotency replay, manager transaction seam, and public DTO boundary | `npm run booking:postgres-customer-adapter:test` + customer gates + disposable PostgreSQL hold/checkout/cancel replay + `npm test` | passed |
-| BK-046 | Recover customer checkout after provider failure | MaggieDash | BK-044, BK-045 | replay-safe hold conversion, reusable sealed token, provider idempotency, and retry from pending payment without a duplicate booking | `npm run booking:postgres-customer-adapter:test` + disposable PostgreSQL integration + `npm test` | passed |
-| BK-047 | Fail closed on a non-empty backup restore target | MaggieDash | BK-030 | empty-public-schema preflight before `pg_restore`, refusal without target mutation, matching PostgreSQL client selection, and successful empty-target parity | disposable backup/restore integration with matching `--pg-bin-dir` plus non-empty-target refusal + `npm test` | passed |
-| BK-048 | Add tenant-scoped manager reporting | both | BK-043, BK-027 | period totals and day/service/staff/location breakdowns with permissions, route contract, and dashboard screen | report repository validator + route/reference-host/UI gates | passed |
-| BK-049 | Automate 24-hour booking reminders | both | BK-026 | idempotent reminder enqueue job, Resend outbox persistence, worker contract, and host dispatcher compatibility | runtime/reminder replay tests + worker repository gate + host build | passed |
-| BK-050 | Implement payment policies, deposits, and outstanding balances | both | BK-024, BK-044, BK-045, BK-049 | full/deposit/pay-later/no-payment service policies, payment purposes, captured/refunded projection, checkout due amount, and manager payment controls | gateway/runtime/postgres adapter/reference-host/UI gates + `npm test` + host build | passed locally; host staging pending |
-| BK-051 | Add manager customer history workspace | both | BK-039, BK-045 | searchable customer directory, consent summary, selected customer details, and appointment history backed by the existing customer-detail route | UI source gate + `npm test` + host build | passed locally; host staging pending |
-| BK-052 | Complete schedule rule management without destructive UI writes | both | BK-023, BK-027 | working hours, staff shifts, time off, and location closures with full-snapshot preservation and safe validation | UI validator + `npm test` + host build | passed locally; host staging pending |
-| BK-053 | Merge Maggie rewrites into existing Astro middleware during install | ai-cmo-skills + MaggieDash | BK-006, BK-008 | idempotent middleware merge, unsupported-shape warning, install state evidence, and inspect gate | CLI regression + install projection + inspect | passed |
-| BK-054 | Add editable service and treatment catalogue management | both | BK-023, BK-027 | selectable catalogue rows, stable service/variant edits, payment policy changes, and safe active/inactive control | UI validator + configuration regression + `npm test` + host build | passed locally; host staging pending |
-| BK-055 | Add editable staff and resource management | both | BK-023, BK-027 | selectable staff/resource rows, stable profile edits, assignment updates, bookable state, capacity, and safe active/inactive control | UI validator + configuration regression + `npm test` + host build | passed locally; host staging pending |
-| BK-056 | Add editable schedule-rule management | both | BK-023, BK-027, BK-052 | selectable working-hours, shift, time-off, and closure rows with stable IDs and full-snapshot writes | UI validator + schedule regression + `npm test` + host build | passed locally; host staging pending |
-| BK-057 | Make manager booking creation use live configuration | both | BK-023, BK-027, BK-028 | catalogue, location, staff, and resource selectors with required staff/resource allocation | UI validator + reference-host regression + `npm test` + host build | passed locally; host staging pending |
-| BK-058 | Add safe first-run Booking setup checklist | ai-cmo-skills | BK-006, BK-008 | `maggie booking setup` reports install, middleware, env-key presence, owner/schema/worker next steps without exposing secrets or mutating the host | CLI regression + secret-redaction test + inspect/setup check | passed |
-| BK-059 | Add explicit one-command host bootstrap | ai-cmo-skills | BK-058 | `maggie booking install --confirm --bootstrap` installs the host scaffold and runs the host-provided idempotent schema command only when explicitly requested | CLI bootstrap regression + package smoke + docs/whitespace checks | passed |
-| BK-060 | Add token-bound customer self-service rescheduling | MaggieDash + ai-cmo-skills | BK-033, BK-041, BK-059 | Public customers can choose a future available slot from the payment-return page; the server enforces token, tenant, status, conflict, and idempotency boundaries and queues the existing Resend rescheduled notification | customer-flow + reference-host + PostgreSQL adapter + UI + full suite | passed |
-| BK-061 | Add Resend customer-manage links with separate token lifetimes | MaggieDash + ai-cmo-skills | BK-026, BK-033, BK-060 | Short-lived payment token plus 30-day sealed manage token, idempotent schema migration, and Resend worker link for confirmed/rescheduled/cancelled/reminder emails | adapter/schema validators + full suite + ORA build | passed |
-| BK-062 | Add tenant-scoped waitlist and Resend availability notification | MaggieDash + ai-cmo-skills | BK-033, BK-043, BK-054, BK-061 | Public noindex waitlist join, manager queue/actions, tenant/staff scope, audit/outbox records, and Resend availability notification | full suite + customer/schema/UI/host validators + ORA build | passed |
-| BK-063 | Make waitlist conversion create and link a real booking | MaggieDash + ai-cmo-skills | BK-062 | Transactional booking/segment/allocation creation, converted-booking link, server-side conflict checks, manager conversion form, and confirmation email hand-off | core repository + reference host + ORA host/build gates | passed |
-| BK-064 | Expose first-run payment readiness in the Booking overview | MaggieDash + ai-cmo-skills | BK-058, BK-059, BK-063 | Stripe status/mode, copyable webhook URL, secret-safe setup guidance, explicit API verification, and ORA mirror | full suite + Booking UI validator + ORA build | passed |
-| BK-065 | Fail the Booking setup checklist on invalid secrets | ai-cmo-skills | BK-058, BK-064 | Minimum token length validation, paired Stripe-key detection, secret-safe error state, and regression tests | Python CLI tests + task-board validation | passed |
-| BK-066 | Make installed Booking UI validators resolve the installed workspace | MaggieDash + ORA host | BK-064, BK-065 | Source/installed workspace detection, bounded missing-workspace diagnostic, and host validator regression coverage | central npm test + central UI validator + ORA UI/customer validators | passed |
-| BK-067 | Automatically match newly available slots to the waitlist | MaggieDash + ORA host | BK-062, BK-063, BK-066 | Priority/FIFO matching with service/location/staff/time filters, idempotent Resend outbox notification, offered-slot persistence, and no automatic booking reservation | central npm test + ORA worker/runtime/UI validators | passed |
-| BK-068 | Add customer self-service booking history | MaggieDash + ORA host | BK-061, BK-066 | New token-bound public manage endpoint, tenant/customer-scoped redacted history DTO, customer page history panel, and reference/Postgres regression coverage | central and ORA customer-flow/reference-host/Postgres/UI validators + build | passed |
-| BK-069 | Make reviewed Booking bootstrap provision its implementation secret | ai-cmo-skills | BK-058, BK-059, BK-065 | Generate a cryptographically random `BOOKING_TOKEN_SECRET` only during explicit `--bootstrap`, preserve valid existing values, reject short values, and never print the secret | Python CLI regression + secret-redaction + whitespace checks | passed |
-| BK-070 | Add transactional Booking schema dry-run | MaggieDash + ORA host | BK-059, BK-069 | Validate every additive schema file and PostgreSQL extension permission in one transaction, roll it back, and keep `--apply --confirm` as the only committing path | central/ORA syntax checks + live ORA dry-run + whitespace checks | passed |
-| BK-071 | Accept the existing Resend sender-key convention in the generic host | MaggieDash + ORA host | BK-026, BK-058 | Resolve `EMAIL_FROM` or `RESEND_FROM_EMAIL` consistently in account invitations, worker delivery, and readiness summaries | host bootstrap validator + ORA build + syntax/whitespace checks | passed |
-| BK-072 | Add multi-treatment manager appointments | MaggieDash + ORA host | BK-021, BK-027, BK-057, BK-071 | Create up to 12 service segments with per-segment time, price, staff/resource allocation, same-location/currency validation, transactional persistence, reference-host coverage, and manager UI controls | central/ORA reference-host regression + `npm test` + ORA build + UI markers + `git diff --check` | passed |
-| BK-073 | Add public multi-treatment booking | MaggieDash + ORA host | BK-033, BK-034, BK-045, BK-072 | Let customers choose multiple treatments, see combined availability, hold every segment, and checkout one summed booking while preserving single-treatment compatibility | central/ORA customer-flow/reference-host/Postgres/UI validators + `npm test` + ORA build + schema gate | passed |
-| BK-074 | Make multi-treatment rescheduling segment-safe | MaggieDash + ORA host | BK-072, BK-073 | Preserve segment/allocation identity, shift every segment by one delta, validate per-segment conflicts, and keep single-treatment rescheduling compatible | central/ORA customer reference-host + PostgreSQL repository validators + ORA build | passed |
-| BK-075 | Remove install-time hardcoded Booking IDs | MaggieDash + ORA host | BK-054, BK-055, BK-056, BK-057 | Read tenant locations and live services from catalog/schedule responses, default new forms from bootstrap data, persist resource service assignments, and reject regression to `location-1`/`service-1` UI fallbacks | central/ORA UI validators + reference-host/core tests + ORA build + `git diff --check` | passed |
-| BK-076 | Add install-time location management | MaggieDash + ORA host | BK-023, BK-054, BK-055, BK-075 | Let a blank project create and edit its first tenant location with timezone, locale, address, active state, and online-booking controls before configuring services, staff, resources, and schedules | central/ORA configuration, service, route, reference-host, UI validators + ORA build + `git diff --check` | passed |
-| BK-077 | Synchronize the install-time Booking contract | ai-cmo-skills + MaggieDash | BK-076 | Keep the public ai-cmo-skills contract, detailed MaggieDash contract, CLI count, service-method map, and location endpoints identical | `maggie booking contract` + Python Booking tests + MaggieDash `booking:contract:validate` + task-board validation | passed |
-| BK-078 | Verify and release the public MaggieDash install source | MaggieDash + release owner | BK-077 | Release the manifest host bootstrap, 47-route Booking source, schema, worker, and Astro host scaffold that the default ai-cmo-skills installer fetches | default `maggie booking install --project <disposable> --host astro --dry-run` from GitHub, local-source projection parity, host bootstrap validator, and release tag/commit evidence | passed |
-| BK-079 | Fix npm CLI Booking contract paths | ai-cmo-skills | BK-077 | Make packaged Booking CLI commands resolve bundled contracts and the execution board while preserving source-checkout paths | packaged `maggie booking contract`, `stripe-audit`, `tasks validate`, `setup`, syntax, and whitespace checks | passed |
-| BK-080 | Add tenant-scoped notification delivery management | both | BK-026, BK-077 | Expose redacted Resend delivery state in the manager workspace and allow owner/manager dead-letter replay with required reason, idempotency, tenant scope, event, and audit evidence | MaggieDash `npm test` + ai-cmo CLI contract/test gates + ORA validators/build | passed |
-| BK-081 | Harden first-owner registration | both | BK-058, BK-071 | Serialize first-owner registration, verify existing passwords, and prevent password overwrite or disabled-account reactivation | MaggieDash bootstrap validator + `npm test` + ORA `contract:check`/build + `git diff --check` | passed |
-| BK-082 | Harden Booking access defaults and disabled-account boundary | both | BK-026, BK-081 | Give invited staff/finance accounts safe role defaults, preserve granular permissions, and reject disabled accounts instead of re-enabling them | MaggieDash bootstrap validator + `npm test` + ORA `contract:check`/build + `git diff --check` | passed |
-| BK-083 | Add worker migration preflight | both | BK-030, BK-070 | Check core, Booking, and access tables before worker lock/repository reads and return bounded `needs-migration` JSON without writes or stack traces | worker `node --check` + Astro bootstrap validator + unmigrated ORA worker run + `git diff --check` | passed |
-| BK-084 | Synchronize browser evidence with the complete manager workspace | both | BK-080, BK-083 | Covered the then-current 15 manager routes across mobile, tablet, and desktop; BK-120 extends the evidence set to all 17 current routes | MaggieDash `npm test` + ORA contract/build + ai-cmo Booking tests + packaged task validation + `git diff --check` | passed |
-| BK-085 | Make cancellation and refund policy tenant-configurable and booking-scoped | both | BK-064, BK-084 | Configure cutoff/refund/no-show policy, snapshot it on every booking creation path, and enforce customer cancellation cutoff without pretending provider refunds are automatic | MaggieDash `npm test` + ORA contract/build + policy validators + `git diff --check` | passed |
-| BK-086 | Make calendar day and week views honor their requested venue-local range | both | BK-084, BK-085 | Filter Day/Week queries by the correct venue-local range, keep staff scope, and align reference host/UI behavior with the PostgreSQL contract | MaggieDash `npm test` + calendar/repository validators + ORA contract/build + `git diff --check` | passed |
-| BK-087 | Execute cancellation refunds through the provider boundary and Resend outbox | both | BK-080, BK-085, BK-086 | Allocate policy-safe refunds across captured attempts, call the injected provider after cancellation, expose bounded settlement status, queue payment.refunded only for accepted/pending refunds, and keep generic/ORA Resend workers behaviorally aligned | MaggieDash `npm test` + cancellation/customer settlement validators + Astro bootstrap validator + ORA contract/build + `git diff --check` | passed |
-| BK-088 | Expose no-show fee review without automatic charging | both | BK-087 | Return a policy-derived review_required settlement, never call the refund provider, and show the bounded fee review in manager Booking detail | no-show review validator + reference-host regression + MaggieDash `npm test` + ORA contract/build + `git diff --check` | passed |
-| BK-089 | Make Booking team access an installable and verifiable contract | both | BK-082, BK-084 | Add a versioned access contract, distribution manifest gate, CLI check, and route/UI/schema validator for administrator-managed email/password staff access | `npm run booking:access:test` + MaggieDash `npm test` + `maggie booking access-contract` + packaged checks | passed |
-| BK-090 | Make the reference host exercise Team access CRUD and role denial | MaggieDash | BK-089 | Add owner-only deterministic access CRUD, invitation intent, audit, and staff denial to the reference host | reference-host validator + MaggieDash `npm test` + secret/PII scan | passed |
-| BK-091 | Make fresh Astro Booking installation dependency-complete | ai-cmo-skills | BK-078, BK-089 | Add explicit npm/pnpm/yarn/bun dependency completion that installs only missing Booking host packages, supplies a blank-host SSR adapter/config, preserves existing deployment adapters, and remains read-only-safe | Python Booking CLI tests + public-source fresh `astro build` + packaged task validation + `git diff --check` | passed |
-| BK-092 | Add tenant-scoped Booking email template management | both | BK-080, BK-091 | Add versioned event templates, allowlisted rendering, owner/manager preview-publish-rollback, and Resend-worker resolution while preserving outbox safety | template contract/renderer/permission/worker tests + reference-host and ORA build | passed |
-| BK-093 | Expose complete Booking defaults in manager Settings | both | BK-023, BK-092 | Let an owner/manager edit venue timezone/currency, pause new booking writes, and select automatic/manual payment capture policy through the existing audited settings boundary | central/ORA UI validators, MaggieDash `npm test`, ORA contract/build, and whitespace checks | passed |
-| BK-094 | Add tenant-scoped treatment package catalogue | both | BK-023, BK-093 | Add prepaid treatment package metadata, included variant quantities, price/currency/expiry, active state, manager CRUD, tenant scope, idempotency, audit, and reference/install parity | central/ORA schema, service, route, reference-host, UI, contract, and build gates plus ai-cmo CLI tests | passed |
-| BK-095 | Add customer package balances and redemption | both | BK-094, BK-087 | Add manager-granted customer package entitlements, per-variant balances, expiry enforcement, an auditable redemption ledger, and transactional manager-booking redemption while keeping Stripe purchase/refund provider work separate | central/ORA schema, service, route, reference-host, UI, contract, build gates, and package regression tests | passed |
-
-| BK-096 | Add customer package checkout and refund settlement | both | BK-095, BK-087 | Add a separate package purchase/refund aggregate, public package checkout/payment return, Stripe metadata/webhook/reconciliation fulfillment, manager purchase listing, and redemption-safe refunds | central/ORA schema, payment/service/route/reference-host/UI/contract gates, ai-cmo tests, and ORA build | passed |
-| BK-097 | Add package lifecycle Resend notifications | both | BK-096, BK-092 | Queue idempotent package confirmation/refund emails from verified Stripe state, link notifications to package purchases, and deliver them through the generic/ORA Resend workers without booking-only manage links | central npm test, email-template/notification/worker validators, ORA contract/build, schema mirror, and `git diff --check` | passed |
-| BK-098 | Add public customer package redemption | both | BK-095, BK-096 | Carry a customer-bound package entitlement from the confirmed package return into public hold/checkout, redeem matching treatment credits atomically with booking creation, and expose a safe package summary in the customer response | central/ORA public reference-host regression, PostgreSQL adapter/core syntax and contract gates, UI validator, ORA build, and `git diff --check` | passed |
-| BK-099 | Restore package credits on cancellation | both | BK-095, BK-098 | Reverse active package redemption ledger rows exactly once when a manager or eligible customer cancellation succeeds, restore per-variant balances transactionally, keep no-show/completed visits consumed, and expose an auditable reversal result | central npm/reference-host/customer-flow/schema gates, disposable PostgreSQL integration, ORA contract/build, ai-cmo task validation, and `git diff --check` | passed |
-| BK-100 | Allow secure dashboard-managed Stripe connection | both | BK-064, BK-065 | Owner/manager-only Stripe key-pair form, API verification before persistence, AES-256-GCM ciphertext at rest, deployment-secret precedence, and synchronized generic/ORA/CLI/docs behavior | MaggieDash npm/host/schema gates, ORA contract/build, ai-cmo Booking tests/packaged setup, and `git diff --check` | passed |
-| BK-101 | Complete server-enforced Booking capability permissions | both | BK-089, BK-100 | Reconcile every route capability with the administrator registry, enforce safe role defaults for legacy rows, honor explicitly granted staff reads, and synchronize generic/ORA/reference-host/CLI contracts | MaggieDash npm/access/route-handler gates, ORA contract/build, ai-cmo Booking tests, and `git diff --check` | passed |
-| BK-102 | Persist provider customer identity for real Stripe payments | both | BK-025, BK-100 | Resolve local tenant customer UUIDs to idempotent Stripe Customer objects, persist only the provider reference, and use it for Checkout/PaymentIntent/SetupIntent without leaking credentials or cross-tenant data | Stripe adapter conformance with customer resolver, central/ORA schema validators, ORA contract/build, MaggieDash `npm test`, and `git diff --check` | passed |
-| BK-103 | Add consented Stripe no-show fee charging | both | BK-088, BK-102 | Add an explicit manager/finance action that charges only a policy-derived no-show fee when the customer consented, a saved payment method is available, and Stripe off-session capability is verified; persist adjustment payment/audit state and queue the Resend payment notification | Stripe adapter, payment adapter, route/reference-host, email, UI, central `npm test`, ORA contract/build, and `git diff --check` | passed |
-| BK-104 | Gate public booking exposure on host readiness | both | BK-033, BK-034 | Shared fail-closed readiness gate and test override; gate Astro customer page and new customer creation routes while preserving customer continuations; install the source manifest and reuse route policy in ORA | MaggieDash `npm test` + Astro host-bootstrap gate + direct route guard tests + ORA public-gate/build + source CLI install parity | passed |
-| BK-105 | Synchronize ORA Booking CLI gates with current contracts | both | BK-097, BK-100 | Sync ORA-local inspect/setup validator and source contract with the canonical ten-event template contract, `arrivalNote`, and Stripe key alias behavior while preserving pending-verification semantics | ORA-local inspect/setup/email-template contract + canonical Booking CLI unit tests + byte-parity + whitespace checks | passed |
-| BK-106 | Explain Stripe connection checks in the Booking setup checklist | MaggieDash | BK-100, BK-105 | Show API, webhook, charge and payout check results, with a clear action when the account cannot accept payments | Booking UI validator + MaggieDash `npm test` + task-board validation + `git diff --check` | passed |
-| BK-107 | Derive online-payment capability from verified Stripe charge availability | both | BK-100, BK-104, BK-106 | Keep online/off-session payment disabled until the credential is verified and Stripe reports charges enabled; mirror the rule into ORA | Stripe readiness regression + host-bootstrap + MaggieDash `npm test` + ORA contract/build + byte parity | passed |
-| BK-108 | Fail closed when online-payment capability is missing | both | BK-107 | Missing payment capability in stored settings must not make manager Overview or payment-health report payments ready | PostgreSQL core repository regression + MaggieDash `npm test` + ORA contract/build + source parity | passed |
-
-## Execution rule
-
-| BK-109 | Require explicit online-payment capability in shared payment flows | both | BK-108 | Shared payment starts and reference-host readiness must fail closed unless onlinePayment is an explicit boolean true | focused gateway/reference-host regressions + MaggieDash `npm test` + ORA contract/build + task board | passed |
-
-| BK-110 | Verify current Booking install parity in a disposable Astro host | both | BK-109 | Exercise the current manifest through canonical CLI install; compare every projected file and run installed inspect/bootstrap validators without DB or dependency writes | disposable Astro install + exact parity + inspect + installed validators + source host-bootstrap + board | passed |
-
-| BK-111 | Bind Stripe gateway capabilities to verified account state | both | BK-107, BK-109, BK-110 | Runtime Stripe gateway must use account-verification state, not credential presence or hardcoded true values | readiness matrix + adapter regressions + MaggieDash tests + ORA contract/build + 207-file install parity | passed |
-
-For each leaf task: select it with `maggie booking tasks`, write the plan and
-acceptance checks, implement the smallest complete slice, run its gate, update
-the relevant docs, then append a dated entry to [`PROGRESS.md`](./PROGRESS.md).
-A task is not `passed` because files exist; its gate and documentation must
-pass. Host/runtime tasks additionally require evidence from the real host
-boundary.
-
-## Scope boundary
-
-This delivery implements the MaggieDash manager workspace, the public customer
-boundary contract, tenant-scoped manager and customer persistence for
-configuration, lifecycle, checkout, and token-bound cancellation operations,
-and provider-neutral host-facing runtime primitives. It does not silently
-invent a production provider integration, notification transport, or live
-database migration runner. Those remain explicit Phase 2–6 host work in
-[`CURRENT-STATE.md`](./CURRENT-STATE.md) and are represented by contracts and
-readiness states where the host must own the runtime behavior.
-| BK-112 | Require verified online-payment capability for public exposure | both | BK-104, BK-107, BK-111 | Keep the natural public entry closed unless Stripe is connected in live mode with an explicit onlinePayment capability and verified secret fingerprint; preserve parity with generic Astro | ORA exposure/contract/readiness validators + Astro build + generic host-bootstrap parity + task-board validation | passed |
-| BK-113 | Restrict public force-open override to non-production hosts | both | BK-104, BK-112 | Deny force-open by default; generic Astro and ORA may opt in only outside production, while production force-off remains available and force-on falls back to natural readiness | shared and ORA gate regressions + host-bootstrap parity + ORA contract/build + staging-backed production preview + fresh install parity + task-board validation | passed |
-| BK-114 | Show verified Stripe account reference in Booking setup | both | BK-100, BK-102, BK-111 | Return the tenant-scoped persisted Stripe account ID and show it in the manager checklist to support intended-account confirmation, with no secret/provider payload exposure | PostgreSQL/reference-host/UI validators + MaggieDash npm test + ORA validators/build + fresh install checks + task-board validation | passed |
-| BK-115 | Complete customer payment-return handoff and guest details | both | BK-107, BK-114 | Use the long-lived manage token after verified payment, expose safe guest/pricing details to the customer DTO, and preserve only the suitability-cleared marker in ORA holds | MaggieDash/ORA customer-flow and UI validators + staging PostgreSQL integration + build + install parity + board validation | passed |
-| BK-116 | Fail fast before staging checkout writes when Stripe test charges are disabled | ORA host harness | BK-114, BK-115 | Run a read-only Stripe test-account capability preflight before staging writes; reject disabled charges and live keys without exposing credentials | ORA preflight unit tests + checkout suite fail-fast check + task-board validation | passed |
-| BK-117 | Validate browser screenshot image contents and viewport dimensions | both | BK-031 | Require PNG/JPEG bytes to match the extension and named viewport width, allow full-page height, and reject malformed or oversized artifacts across the canonical gate and ORA mirrors | Python browser-evidence unit tests + MaggieDash npm test + canonical/ORA JS valid and invalid fixture parity + mirror parity + task-board validation | passed |
-| BK-118 | Keep packaged Booking status references link-safe | ai-cmo-skills | BK-091 | Replace a workspace-only relative link in canonical Booking status docs and rebuild the standalone CLI reference bundle | bundled-reference markdown-link test + full AI-CMO Python suite + task-board validation | passed |
-| BK-119 | Verify customer date changes refresh availability and clear stale slots | ORA host harness | BK-115 | Change the date after selecting a public customer slot; prove the new-date availability request and response render, the old selection clears, and the browser submits no hold/checkout | ORA local-staging Playwright UI journey + contract/build + task-board validation + `git diff --check` | passed |
-| BK-120 | Cover every current manager screen in browser evidence | both | BK-117 | Align the evidence contract/capture/validator and ORA mirrors with all 17 current screens, including Packages and Email templates, across three viewports (51 screens) | canonical/ORA accept and missing-route regressions + MaggieDash `npm test` + ORA contract/build + mirror parity + packaged-contract test + task-board validation | passed |
-| BK-121 | Reject browser evidence captured from the wrong manager screen | both | BK-120 | Version the evidence contract to v2 and require each screen’s final pathname and primary heading to match its manager route | canonical/ORA path-heading regressions + MaggieDash `npm test` + AI-CMO browser-evidence tests + ORA contract/build + mirror parity + task-board validation | passed |
-| BK-122 | Test browser capture readiness without requiring a live host | both | BK-121 | Extract and package the pure pathname/readiness helper; cover successful and rejected capture states deterministically | helper condition regressions + MaggieDash `npm test`/manifest + AI-CMO Booking tests + ORA contract/build + mirror parity + task-board validation | passed |
-| BK-123 | Keep Booking inventory and release status docs aligned with contracts | ai-cmo-skills | BK-122 | Align public inventory/current-state docs with v2 routes and latest Stripe/staging evidence; test task counts against the board | docs inventory/status regression + AI-CMO Booking tests + task-board validation + ORA doc checks | passed |
-| BK-124 | Honor scheduled location closures in customer availability | both | BK-052, BK-123 | Load location closure intervals into the shared planner and reject overlapping public slots and holds while preserving exact boundaries | pure planner + PostgreSQL customer-adapter closure regressions + ORA contract/build + task-board validation | passed |
-| BK-125 | Apply dated staff shifts to customer availability | both | BK-052, BK-124 | Load date-scoped shifts and constrain assigned staff to shifts plus recurring venue/staff hours, preserving fallback on dates without shifts | pure planner + PostgreSQL customer-adapter shift regressions + ORA contract/build + task-board validation | passed |
-| BK-126 | Enforce configured availability on manager-created bookings | both | BK-042, BK-052, BK-125 | Apply the shared venue/staff/resource planner to direct manager creation and waitlist conversion; keep active manager-only services bookable; reject schedule-ineligible explicit assignments before booking/queue writes | Canonical and ORA repository regressions + fresh local-source install projection + customer/availability validators + ORA contract/build + docs/board validation | passed |
-| BK-127 | Enforce configured availability on booking reschedules | both | BK-052, BK-125, BK-126 | Apply the shared planner to proposed manager/customer reschedules while excluding the current booking's old allocations | Canonical and ORA repository regressions + fresh local-source install projection + customer/availability validators + ORA contract/build + docs/board validation | passed |
-| BK-128 | Synchronize expired Stripe Checkout reconciliation across hosts | both | BK-025, BK-030 | Normalize `checkout.session.expired` as a cancelled attempt, cancel its pending booking and release its reserved allocation; sync contract/CLI/host mirrors | Runtime regression + PostgreSQL 16 disposable worker integration + MaggieDash npm test + ORA validators/contract + AI-CMO contract/task validation | passed |
-| BK-129 | Route package purchase reads through the payment repository seam | both | BK-096, BK-097 | Keep the payment-owned manager read on the composed payment repository, outside the core-only transaction callback | service regression + MaggieDash npm test + board validation + `git diff --check` | passed |
-| BK-130 | Persist provider references returned by payment reconciliation | both | BK-025, BK-030 | Save a refreshed provider payment reference during payment-attempt or package-purchase reconciliation, preserving the prior reference when omitted | PostgreSQL payment-adapter regression + MaggieDash npm test + board validation + `git diff --check` | passed |
-| BK-131 | Carry hosted Checkout intent through public booking payments | both | BK-107, BK-130 | Preserve hosted intent from customer checkout through payment adapter and include it in request identity so Stripe creates a Checkout Session | customer/payment adapter regressions + Stripe adapter validator + MaggieDash npm test + board validation + `git diff --check` | passed |
-| BK-132 | Reconcile Stripe Checkout Sessions through the generic adapter | both | BK-128, BK-130, BK-131 | Create bounded-lifetime Checkout Sessions and retrieve `cs_` references through Stripe Checkout, mapping open/paid/expired states and provider references | Stripe adapter regressions + MaggieDash npm test + board validation + Booking Python tests + `git diff --check` | passed |
-| BK-133 | Preserve PaymentIntent references from asynchronous Checkout webhooks | both | BK-130, BK-132 | Normalize `checkout.session.async_payment_succeeded/failed` with the PaymentIntent reference when available, retaining the Session ID only as fallback | canonical/ORA runtime projection regression + disposable PostgreSQL 16 worker persistence integration + MaggieDash npm test + ORA contract check + board validation + Booking Python tests + `git diff --check` | passed |
-| BK-134 | Fulfill captured package purchases after sales are disabled | both | BK-096, BK-097 | Do not gate paid package webhook fulfillment on current sale availability; preserve active checks when starting new purchases | canonical Astro bootstrap + ORA contract regression + builds + board validation + Booking Python tests + `git diff --check` | passed |
-| BK-135 | Retry incomplete package fulfillment on duplicate webhooks | both | BK-134 | Re-run idempotent package settlement when a verified provider event is redelivered; only mark package events processed after fulfillment, and propagate failure so the provider retries | canonical/ORA duplicate retry runtime regression + host contract checks + MaggieDash `npm test` + ORA runtime/contract + board/Python validation + `git diff --check` | passed |
-| BK-136 | Require a validated manage token for closed-gate reschedule availability | both | BK-033, BK-113 | Remove raw query-token gate exemptions; permit closed-gate availability only after host validation of a bearer manage token for a reschedulable booking; keep the token out of the URL | canonical/ORA gate, customer-adapter and UI regressions + MaggieDash `npm test` + ORA `contract:check`, Astro check/build + task-board validation + `git diff --check` | passed |
-| BK-137 | Require validated tokens to render the closed-gate customer page | both | BK-104, BK-136 | Remove the raw query-token page exception; when the public gate is closed, render customer continuations only after validating one unexpired, unrevoked booking payment/manage token or package purchase token | canonical/ORA customer-adapter and route checks + MaggieDash `npm test` and host bootstrap + ORA `contract:check`, Astro check/build + task-board validation + `git diff --check` | passed |
-| BK-138 | Require manage-purpose tokens for customer cancellation and rescheduling | both | BK-060, BK-137 | Require an unexpired, unrevoked manage token scoped to the requested booking before cancel/reschedule mutations and before returning an idempotent replay | canonical/ORA customer-adapter regressions for payment, expired, revoked, wrong-booking and revoked replay denial + MaggieDash `npm test` + ORA `contract:check`, Astro check/build + task-board validation + `git diff --check` | passed |
-| BK-139 | Align the reference customer host with payment/manage token boundaries | MaggieDash | BK-035, BK-138 | Issue separate short-lived payment and 30-day manage tokens; expose manage access only after a valid payment return; validate manage purpose, expiry, revocation, and booking scope before mutation replay | reference-host journey covers token purpose/lifetimes, payment-token and wrong-booking denial, revoked replay denial + MaggieDash `npm test` + task-board validation + `git diff --check` | passed |
-| BK-140 | Fail closed on expired package return tokens in reference hosts | both | BK-035, BK-137 | Reject missing, expired, or malformed-expiry package return tokens before purchase reads/reconciliation, and synchronize canonical/ORA manifest-projected fixture host and validator | canonical and ORA customer-reference-host revoked/expiry regressions + byte parity + MaggieDash `npm test` + ORA `contract:check` + AI-CMO Booking tests + task-board validation + `git diff --check` | passed |
-| BK-141 | Use venue-local time throughout manager booking workflows | both | BK-021, BK-028 | Render appointment instants and interpret manager booking and dated schedule datetime-local fields in each selected location timezone; reject DST gaps and expose fold choices | Venue-time conversion/UI regressions + MaggieDash `npm test` + ORA Booking UI/contract/build + Booking Python tests + board validation + `git diff --check` | passed |
-
-## 2026-09-29 — BK-141 plan: manager venue-local booking times
-
-- Current board audit: 124 tasks, 121 passed; BK-030, BK-031, and BK-032 still need host/runtime/browser/operations evidence. No dedicated HTTPS staging URL is available, so this task targets a source-level defect that can be completed and verified locally.
-- Source audit found manager Calendar event labels and Overview/booking list/detail timestamps use the browser timezone, although the Calendar advertises venue timezone. `BookingDetail` and manager booking creation use `datetime-local` values converted by the browser/server local zone; booking DTOs already carry the selected location timezone.
-- Plan: add timezone-explicit UTC/wall-clock helpers with DST-gap rejection and fold candidates, wire Calendar, Overview, booking list/detail, direct creation, waitlist conversion, and reschedule flows to the booking location timezone, add regression coverage, synchronize ORA's manifest-projected workspace, then run canonical/host/docs gates.
-- Task BK-141 is recorded as `in_progress`; no runtime configuration, database, Stripe, email, browser session, or deployment was changed.
-
-## 2026-09-29 — BK-141 completed: manager venue-local times
-
-- Updated the manager workspace so Calendar, Overview, booking list/detail, and waitlist appointment times display in the booking location's IANA timezone, independent of the browser zone. Calendar event labels disambiguate repeated local times and disable nonexistent wall-clock starts during DST gaps.
-- Direct booking creation, waitlist conversion, and booking reschedule fields now convert venue-local `datetime-local` values to UTC. The helper fails closed for DST gaps and exposes both valid fold candidates; forms preserve the existing fold and offer an earlier/later selection when the wall time repeats. UI-only fold fields are removed before manager API writes.
-- Added venue-time conversion and manager-UI regressions; synchronized the manifest-projected ORA booking workspace and validators byte-for-byte.
-- Validation: MaggieDash `npm test`; venue-time regression under `TZ=Pacific/Honolulu` and `TZ=Asia/Tokyo`; ORA `npm run booking:manager-time:test`, `npm run contract:check`, `npm run build` (234 files, 0 diagnostics); `python3 -m unittest tools.tests.test_maggie_booking`; task-board validation (125 tasks, 122 passed, 3 needs-evidence); source parity and `git diff --check`.
-- No dedicated HTTPS staging URL is available, so BK-031 authenticated runtime/browser evidence remains open. This was local-source validation only; no Stripe API, database, email, production, or deployment operation occurred.
-
-
-## 2026-09-29 — BK-141 final verification
-
-- Re-synchronized the final manager UI, venue-time helpers, and validators to the ORA manifest projection after the last source refinements; canonical and ORA files compare byte-for-byte.
-- Final checks passed: MaggieDash `npm test`; venue-time regression under `TZ=Pacific/Honolulu` and `TZ=Asia/Tokyo`; ORA `booking:manager-time:test`, `contract:check`, and Astro check/build (234 files, 0 diagnostics); 38 AI-CMO Booking unit tests; execution-board validation (125 tasks, 122 passed, 3 needs-evidence); both repository `git diff --check` checks.
-- Marked BK-141 `passed`. BK-030/031/032 remain `needs-evidence`; no dedicated HTTPS staging origin is configured, so authenticated hosted evidence is still outstanding. No Stripe API, database write, email, production, or deployment operation occurred.
-
-## 2026-09-29 — BK-141 follow-up: dated schedule rules
-
-- Re-audit found the Schedule editor still initialized and saved shift, time-off, and closure `datetime-local` values in the browser timezone; the schedule list did the same for display. This left BK-141 incomplete for managers using a device zone different from the venue.
-- Extended the shared venue-time helper with fold-aware interval conversion and chronological UTC ordering. The manager Schedule form now displays the selected location zone, initializes existing rows in that zone, offers earlier/later repeated-time choices, rejects DST gaps and reversed instant intervals, and saves UTC values. Schedule rows display in their location zone.
-- Canonical pure/UI regressions pass, including a fold interval whose wall-clock end is earlier but UTC end is later, and rejection for reversed folds and spring gaps. ORA mirror sync and full local verification remain in progress.
-
-## 2026-09-29 — BK-141 dated-schedule follow-up verified
-
-- The schedule helper and UI regressions pass for venue-zone round trips, DST gaps/folds, and UTC chronological interval ordering. Ran the focused manager-time regression with device zones `Pacific/Honolulu` and `Asia/Tokyo` so the expected values do not depend on the browser timezone.
-- Final local evidence: MaggieDash `npm test`; ORA `booking:manager-time:test`; Astro check/build (234 files, zero diagnostics); 38 AI-CMO Booking tests; 125-task execution-board validation (122 passed, BK-030/031/032 need evidence); canonical-to-ORA source parity; and repository diff checks.
-- BK-141 is passed. BK-030/031/032 remain open because authenticated HTTPS browser/runtime and host operations evidence is unavailable; local checks do not substitute for that evidence. No Stripe API, staging data write, email, production, or deployment operation occurred.
-
-
-## 2026-09-29 — BK-030 follow-up plan: staging hygiene audit
-
-- Current task board remains 122 passed and BK-030/031/032 `needs-evidence`. Current read-only ORA staging counts show 3 staff, 6 resources, 7 working-hours rows, and zero bookings/holds; the test Stripe preflight verifies the configured account in test mode with charges and payouts disabled.
-- Gap: the existing staging setup read mode omits owner/session/audit, customer, payment, notification, and event counts, so cleanup claims cannot be independently repeated with one safe command.
-- Plan: add a count-only audit fixed to `orawellness-staging`; require `BOOKING_STAGING_DATABASE_URL` and refuse equality with `DATABASE_URL`; show registration eligibility and preserved staff/schedule/payment configuration as booleans/counts only; add pure regressions for clean/dirty states and URL guards; run it against staging read-only, then update ORA task docs. BK-030 stays open for host alert, provider, and recovery evidence.
-- Safety review addition before implementation: staging launcher, setup, hold-expiry, catalogue-sync, and provider-canary paths need one normalized PostgreSQL target guard; raw URL equality can be bypassed by query-only changes such as `sslmode`. The regression must fail closed without exposing either URL.
-
-
-## 2026-09-29 — BK-030 local staging safety follow-up
-
-- Implemented the planned count-only staging cleanup audit and closed a production-target guard gap: normalized host/port/database identity is now checked by ORA staging serve/setup, hold expiry, catalogue sync, and provider-canary verification. SSL/query/credential variants of the same PostgreSQL target fail before connection.
-- `booking:staging:safety:test`, provider-canary and Stripe-preflight regressions pass. Live `booking:staging:audit` returned `clean: true`, zero owner/session/audit, customer/booking/hold/payment/notification/outbox/event/idempotency residue, first-owner registration open, and preserved 3 staff, 6 resources, 7 working-hour rows and Stripe test configuration. It exposed one synthetic payment-health idempotency record; after exact command/date review, that one staging-only row was removed under the approved cleanup scope.
-- BK-030 remains `needs-evidence` for host alert routing, provider activity review, and recovery evidence. BK-031 remains `needs-evidence` without an authenticated HTTPS staging origin.
-
-- Final gates passed after the implementation: ORA `booking:staging:safety:test`, provider-canary and Stripe-preflight regressions, live `booking:staging:audit` (`clean: true`), `contract:check`, Astro check/build (234 files, 0 diagnostics), MaggieDash `npm test`, AI-CMO Booking tests (38), explicit 125-task board validation, and `git diff --check`. No Stripe write, email, production, or deployment action occurred.
-
-
-## 2026-09-29 — BK-030 follow-up plan: guard ordering and audit minimization
-
-- Rechecked the current staging audit and shared target helper. The normalized guard is present in all five staging entrypoints; next regression hardens ordering so a future refactor cannot connect/spawn before the check. The read-only report must also remain count-only and avoid identity/secret columns. This extends local verification without changing BK-030 external evidence requirements.
-
-
-## 2026-09-29 — BK-030 staging guard verification tightened
-
-- Added regressions proving all five staging entrypoints invoke the normalized database guard before database-client or process/provider boundaries. The audit query is also checked to use only counts/booleans and never read email, phone, password, token, secret, recipient, or provider-payload columns.
-- `npm run booking:staging:safety:test` and ORA `git diff --check` pass. The local staging audit remains clean from the preceding read-only run. BK-030 remains `needs-evidence` for host alert/provider/recovery evidence.
-
-
-## 2026-09-29 — BK-031 follow-up plan: refreshed local manager smoke
-
-- The current local 51-screen artifact was captured at 00:40 BST, while the BK-141 manager venue-time UI was updated after 09:13 BST. It is stale for the newest manager time behavior.
-- Plan: use the user-requested Chrome on the isolated localhost staging app, verify manager route hydration and venue-zone time labels after BK-141, and record only sanitized local evidence. Keep BK-031 `needs-evidence` because local HTTP cannot satisfy authenticated HTTPS host evidence. The synthetic owner/booking cleanup scope was previously authorized; restore zero-owner/zero-booking state after the smoke.
-
-
-## 2026-09-29 — BK-031 runtime bug plan: New booking form
-
-- Chrome smoke of the updated local manager Booking route triggered `ReferenceError: createDirty is not defined` in `BookingsView` when opening New booking. The same canonical and ORA projected source contains the reference.
-- Plan: restore the missing dirty-state hook, extend the canonical Booking UI regression to check the form state is declared and wired, resync the ORA projection, then rerun the local Chrome open/close smoke. No booking has been submitted.
-
-
-## 2026-09-29 — BK-031 hydration follow-up plan
-
-- After fixing the missing dirty-state hook, a direct Chrome load of `bookings?new=1` exposed an SSR/client hydration mismatch: URL-derived modal state is initialized from `window` on the client but false during server rendering.
-- Plan: initialize query/page/modal state deterministically for SSR, apply URL parameters after mount, add a source regression, and retest the direct route and New booking action in Chrome.
-
-## 2026-09-29 — BK-031 local Booking smoke completed
-
-- Fixed the `createDirty` runtime error by declaring and wiring New booking form dirty state, resetting it on close/completion, and keeping the header action compatible with the modal's unsaved-change guard. Added a canonical MaggieDash UI regression and synchronized `booking/src/booking.tsx` to ORA `_maggie/booking/booking.tsx`.
-- Fixed direct-route hydration by giving query, page, and modal state deterministic server/client initial values, then applying URL parameters in a mount effect. The regression requires this pattern.
-- Follow-up dirty-draft smoke verified the accessible confirmation, value preservation on Keep editing, and actual close on Discard draft. Added matching canonical and ORA UI-validator assertions for the alertdialog and both actions.
-- Chrome on local HTTP `127.0.0.1:4403`: direct `/_maggie/booking/bookings?new=1` rendered the dialog, Calendar rendered with `Europe/London`, and the New booking button opened and closed the dialog. A follow-up at `127.0.0.1:4404` tested the dirty form: close prompts for discard, Keep editing preserves the value, and Discard draft closes without creating a booking. No new console errors or warnings after either fix. The first Chrome log still contains earlier pre-fix errors, which are excluded by its timestamp check. Sanitized summary: ORA `.maggie/qa-runs/bk031-local-bookings-followup-2026-09-29/summary.json`.
-- Removed the synthetic QA owner; its membership/session and test actor audit rows were removed. `npm run booking:staging:audit` reports zero owner/membership/session/audit and booking/payment/event/idempotency residue, first-owner registration open, and retained staging configuration. No Stripe API writes, email, production, or deployment activity.
-- This local smoke is supplemental evidence only. BK-031 stays `needs-evidence` until authenticated HTTPS evidence covers all 47 endpoints and the required 51-screen artifact.
-
-## 2026-09-29 — BK-031 malformed pagination follow-up
-
-- Source review found that `Math.max(1, Number(params.get("page") || 1))` still returns `NaN` for values such as `?page=abc`; the resulting list URL could send an invalid page to the manager API.
-- Bookings now uses a shared `booking-url-state.mjs` parser, accepts only positive safe integers, and falls back to page 1 for missing, empty, nonnumeric, zero, negative, fractional, infinite, or unsafe values. Canonical and ORA UI validators require this helper after hydration; dedicated canonical and host unit commands execute the actual helper across nine invalid/valid cases instead of reimplementing its logic in the validator.
-- Added the module and declaration to the MaggieDash install workspace, synced both into ORA, and wired the helper tests into `npm test` and ORA `booking:manager-time:test`. MaggieDash full suite, ORA manager-time/contract/Astro build, AI-CMO Booking/docs tests (41), task-board validation (125), and mirror byte comparisons pass.
-- Local Chrome at `http://127.0.0.1:4405/_maggie/booking/bookings?page=abc` rendered the normal empty state with no visible `NaN`, alert, console errors, or warnings. The synthetic owner/session/audits were removed, and the ORA staging audit returned zero residual test data with owner registration open.
-- Sanitized evidence is in ORA `.maggie/qa-runs/bk031-local-bookings-followup-2026-09-29/summary.json`. MaggieDash full suite and ORA manager-time regression pass. BK-031 remains `needs-evidence` because local HTTP cannot satisfy the authenticated HTTPS host gate.
-
-## 2026-09-29 — Current-state browser wording corrected
-
-- A read-only check of the Chrome control returned no open tabs. Updated `CURRENT-STATE.md` to describe the previously observed production manager dashboard as historical, rather than claiming it is the current Chrome page. No cookies, customer details, or API payloads were read; this observation remains unrelated to authenticated BK-031 evidence.