studio-os 0.4.0 → 0.5.0

package/src/routes/me.js

@@ -1,9 +1,10 @@
 // Client self-service via signed magic links. No passwords.
 import { Router } from 'express';
-import { verifyMagicToken, makeMagicToken } from '../services/auth.js';
+import { verifyMagicToken } from '../services/auth.js';
 import { cancelBooking, BookingError } from '../services/booking.js';
 import { getSetting, audit } from '../db/index.js';
 import { emails } from '../services/mailer.js';
+import { notifyPromoted } from '../services/notify.js';
 
 export default function meRoutes(services) {
   const { db, mailer } = services;
@@ -76,14 +77,7 @@ export default function meRoutes(services) {
         to: client.email,
         ...emails.cancellation({ studio, clientName: client.name, className: inst.class_name, when, refunded: result.refunded }),
       });
-      if (result.promoted) {
-        const promotedClient = db.prepare('SELECT * FROM clients WHERE id = ?').get(result.promoted.client_id);
-        const magicUrl = `${services.baseUrl(req)}/me?token=${makeMagicToken(db, promotedClient.id)}`;
-        mailer.send({
-          to: promotedClient.email,
-          ...emails.waitlistPromotion({ studio, clientName: promotedClient.name, className: inst.class_name, when, magicUrl }),
-        });
-      }
+      if (result.promoted) notifyPromoted(services, req, res, result.promoted, inst);
       req.session.flash = result.refunded
         ? 'Booking cancelled — your credit has been returned.'
         : (result.late ? 'Booking cancelled. This was a late cancellation, so the credit was not returned.' : 'Booking cancelled.');

package/src/routes/public.js

@@ -8,18 +8,14 @@ import { emails } from '../services/mailer.js';
 
 function findOrCreateClient(db, name, email) {
   const cleanEmail = String(email || '').trim().toLowerCase();
-  let client = db.prepare('SELECT * FROM clients WHERE email = ?').get(cleanEmail);
-  if (!client) {
-    const info = db.prepare(
-      "INSERT INTO clients (name, email, source) VALUES (?, ?, 'self')"
-    ).run(String(name || cleanEmail.split('@')[0]).trim(), cleanEmail);
-    client = db.prepare('SELECT * FROM clients WHERE id = ?').get(info.lastInsertRowid);
-  } else if (name && name.trim() && client.name !== name.trim()) {
-    // keep the freshest name the client typed
-    db.prepare('UPDATE clients SET name = ? WHERE id = ?').run(name.trim(), client.id);
-    client.name = name.trim();
-  }
-  return client;
+  const client = db.prepare('SELECT * FROM clients WHERE email = ?').get(cleanEmail);
+  // An existing client keeps their name. The form proves nothing about who's
+  // typing, so it can't be allowed to rename whoever owns the address.
+  if (client) return client;
+  const info = db.prepare(
+    "INSERT INTO clients (name, email, source) VALUES (?, ?, 'self')"
+  ).run(String(name || cleanEmail.split('@')[0]).trim(), cleanEmail);
+  return db.prepare('SELECT * FROM clients WHERE id = ?').get(info.lastInsertRowid);
 }
 
 function loadInstanceFull(db, id) {
@@ -90,20 +86,10 @@ export default function publicRoutes(services) {
           db.prepare('UPDATE clients SET waiver_signed_at = ? WHERE id = ?')
             .run(new Date().toISOString(), client.id);
         }
-        const booked = book(db, client.id, inst.id);
-        // Drop-in without membership/pack: record the pending manual payment.
-        let payment = null;
-        if (booked.booking.paid_with === 'drop_in_manual' && inst.drop_in_price_cents > 0) {
-          const info = db.prepare(
-            `INSERT INTO payments (client_id, amount_cents, currency, method, reference, what, status)
-             VALUES (?, ?, ?, 'other', ?, 'drop_in', 'pending')`
-          ).run(client.id, inst.drop_in_price_cents, getSetting(db, 'currency', 'HKD'),
-            `Drop-in: ${inst.class_name} ${inst.starts_at}`);
-          payment = info.lastInsertRowid;
-        }
+        const booked = book(db, client.id, inst.id, { recordDue: true });
         audit(db, client.email, booked.waitlisted ? 'waitlist_join' : 'booking_create',
           `instance:${inst.id} booking:${booked.booking.id}`);
-        return { client, ...booked, paymentId: payment };
+        return { client, ...booked };
       })();
 
       const magicUrl = `${services.baseUrl(req)}/me?token=${makeMagicToken(db, result.client.id)}`;

package/src/services/booking.js

@@ -118,6 +118,20 @@ function refund(db, booking, creditsNeeded) {
   }
 }
 
+/** A pay-at-studio drop-in is owed once the client holds a spot. */
+function recordDropInDue(db, booking, inst) {
+  if (booking.paid_with !== 'drop_in_manual' || !(inst.drop_in_price_cents > 0)) return null;
+  return db.prepare(
+    `INSERT INTO payments (client_id, amount_cents, currency, method, reference, what, status, booking_id)
+     VALUES (?, ?, ?, 'other', ?, 'drop_in', 'pending', ?)`
+  ).run(booking.client_id, inst.drop_in_price_cents, getSetting(db, 'currency', 'HKD'),
+    `Drop-in: ${inst.class_name} ${inst.starts_at}`, booking.id).lastInsertRowid;
+}
+
+function dropDropInDue(db, bookingId) {
+  db.prepare("DELETE FROM payments WHERE booking_id = ? AND status = 'pending'").run(bookingId);
+}
+
 function loadInstance(db, instanceId) {
   const inst = db.prepare(
     `SELECT ci.*, ct.credits_required, ct.name AS class_name, ct.drop_in_price_cents
@@ -131,8 +145,9 @@ function loadInstance(db, instanceId) {
 /**
  * Book a client into a class instance.
  * options: { paidWith } to force ('drop_in_online'|'drop_in_manual'|'comp'),
- *          { now } ISO override for tests, { allowPast } for admin walk-ins.
- * Returns the booking row plus { waitlisted: bool }.
+ *          { now } ISO override for tests, { allowPast } for admin walk-ins,
+ *          { recordDue } to record a pending payment for a pay-at-studio drop-in.
+ * Returns the booking row plus { waitlisted: bool, paymentId }.
  */
 export function book(db, clientId, instanceId, options = {}) {
   const nowIso = options.now || new Date().toISOString();
@@ -172,7 +187,8 @@ export function book(db, clientId, instanceId, options = {}) {
       status === 'booked' ? resolution.membershipId ?? null : null,
       nowIso);
     const booking = db.prepare('SELECT * FROM bookings WHERE id = ?').get(info.lastInsertRowid);
-    return { booking, waitlisted: full, instance: inst };
+    const paymentId = options.recordDue && !full ? recordDropInDue(db, booking, inst) : null;
+    return { booking, waitlisted: full, instance: inst, paymentId };
   })();
 }
 
@@ -190,12 +206,16 @@ function promoteNext(db, inst, nowIso) {
   db.prepare(
     'UPDATE bookings SET status = ?, paid_with = ?, pass_id = ?, membership_id = ? WHERE id = ?'
   ).run('booked', resolution.paidWith, resolution.passId ?? null, resolution.membershipId ?? null, next.id);
-  return db.prepare('SELECT * FROM bookings WHERE id = ?').get(next.id);
+  const promoted = db.prepare('SELECT * FROM bookings WHERE id = ?').get(next.id);
+  recordDropInDue(db, promoted, inst);
+  return promoted;
 }
 
 /**
  * Cancel a booking. Within the cancellation window → credit refunded; late →
- * per policy (default forfeit). Auto-promotes the first waitlisted booking.
+ * per policy (default forfeit). Auto-promotes the first waitlisted booking
+ * while the class has yet to start. { allowPast } lets staff tidy a roster
+ * after the fact.
  * Returns { booking, refunded, late, promoted } (promoted = booking row or null).
  */
 export function cancelBooking(db, bookingId, options = {}) {
@@ -207,6 +227,8 @@ export function cancelBooking(db, bookingId, options = {}) {
       throw new BookingError('not_cancellable', `Cannot cancel a ${booking.status} booking`);
     }
     const inst = loadInstance(db, booking.class_instance_id);
+    const started = inst.starts_at <= nowIso;
+    if (started && !options.allowPast) throw new BookingError('in_past', 'Class has already started');
     const windowHours = Number(getSetting(db, 'cancellation_window_hours', '12'));
     const policy = getSetting(db, 'late_cancel_policy', 'forfeit');
     const hoursToStart = hoursBetween(nowIso, inst.starts_at);
@@ -214,23 +236,53 @@ export function cancelBooking(db, bookingId, options = {}) {
     const wasBooked = booking.status === 'booked';
     const creditsNeeded = inst.credits_required ?? 1;
 
+    const excused = !late || policy === 'refund' || options.forceRefund;
     let refunded = false;
-    if (wasBooked && (!late || policy === 'refund' || options.forceRefund)) {
+    if (wasBooked && excused) {
       refund(db, booking, creditsNeeded);
       refunded = booking.paid_with === 'pack' || booking.paid_with === 'membership';
     }
+    // A forfeited late cancel still owes its drop-in, as it would lose a credit.
+    if (excused) dropDropInDue(db, bookingId);
     db.prepare("UPDATE bookings SET status = 'cancelled', cancelled_at = ? WHERE id = ?")
       .run(nowIso, bookingId);
 
-    // A freed confirmed spot promotes the first waitlisted booking.
+    // A freed confirmed spot promotes the first waitlisted booking, but not
+    // into a class that's already running: they'd be charged for missing it.
     let promoted = null;
-    if (wasBooked && bookedCount(db, inst.id) < inst.capacity) {
+    if (wasBooked && !started && bookedCount(db, inst.id) < inst.capacity) {
       promoted = promoteNext(db, inst, nowIso);
     }
     return { booking: { ...booking, status: 'cancelled', cancelled_at: nowIso }, refunded, late, promoted, instance: inst };
   })();
 }
 
+/**
+ * Staff edit of a single class. Extra capacity before the class starts is
+ * filled from the waitlist, first come first served. Lowering it below the
+ * booked count cancels nobody. Returns { instance, promoted } (promoted = rows).
+ */
+export function updateInstance(db, instanceId, changes, options = {}) {
+  const nowIso = options.now || new Date().toISOString();
+  return db.transaction(() => {
+    const inst = { ...loadInstance(db, instanceId), ...changes };
+    if (!Number.isInteger(inst.capacity) || inst.capacity < 1) {
+      throw new BookingError('bad_capacity', 'Capacity must be a whole number, at least 1');
+    }
+    db.prepare('UPDATE class_instances SET capacity = ?, instructor_id = ?, notes = ? WHERE id = ?')
+      .run(inst.capacity, inst.instructor_id, inst.notes, instanceId);
+    const promoted = [];
+    if (inst.status === 'scheduled' && inst.starts_at > nowIso) {
+      while (bookedCount(db, instanceId) < inst.capacity) {
+        const next = promoteNext(db, inst, nowIso);
+        if (!next) break;
+        promoted.push(next);
+      }
+    }
+    return { instance: inst, promoted };
+  })();
+}
+
 /** Staff roster actions. */
 export function markAttendance(db, bookingId, status) {
   if (!['attended', 'no_show', 'booked'].includes(status)) {
@@ -258,6 +310,7 @@ export function cancelClass(db, instanceId, options = {}) {
     ).all(instanceId);
     for (const b of affected) {
       if (b.status === 'booked') refund(db, b, creditsNeeded);
+      dropDropInDue(db, b.id);
       db.prepare("UPDATE bookings SET status = 'cancelled', cancelled_at = ? WHERE id = ?")
         .run(nowIso, b.id);
     }

package/src/services/notify.js

@@ -0,0 +1,19 @@
+// Emails that more than one route sends.
+import { getSetting } from '../db/index.js';
+import { makeMagicToken } from './auth.js';
+import { emails } from './mailer.js';
+
+/** Tell a client they've come off the waitlist, with a link to manage the booking. */
+export function notifyPromoted(services, req, res, booking, inst) {
+  const { db, mailer } = services;
+  const client = db.prepare('SELECT * FROM clients WHERE id = ?').get(booking.client_id);
+  if (!client) return;
+  const magicUrl = `${services.baseUrl(req)}/me?token=${makeMagicToken(db, client.id)}`;
+  mailer.send({
+    to: client.email,
+    ...emails.waitlistPromotion({
+      studio: getSetting(db, 'studio_name', 'the studio'), clientName: client.name,
+      className: inst.class_name, when: res.locals.fmtDt(inst.starts_at), magicUrl,
+    }),
+  });
+}

package/test/booking.test.js

@@ -5,7 +5,7 @@ import {
   getPass, getBooking, getMembership,
 } from './helpers.js';
 import {
-  book, cancelBooking, cancelClass, markAttendance, resolvePayment, BookingError,
+  book, cancelBooking, cancelClass, markAttendance, resolvePayment, updateInstance, BookingError,
 } from '../src/services/booking.js';
 
 test('booking deducts a pack credit at booking time, in the same transaction', () => {
@@ -262,6 +262,58 @@ test('cancelling a waitlist booking does not promote or refund', () => {
   assert.equal(res.promoted, null);
 });
 
+test('once a class has started, clients cannot cancel and nobody is promoted into it', () => {
+  const db = testDb();
+  const now = '2026-10-01T10:00:00Z';
+  const inst = makeInstance(db, makeClassType(db, { capacity: 1 }), { now, hoursFromNow: 2 });
+  const c1 = makeClient(db); const c2 = makeClient(db);
+  const waiting = makePass(db, c2, { total: 5 });
+  const { booking } = book(db, c1, inst, { now });
+  const { booking: wl } = book(db, c2, inst, { now });
+  const afterClass = '2026-10-01T13:30:00Z';
+
+  assert.throws(() => cancelBooking(db, booking.id, { now: afterClass }),
+    (e) => e instanceof BookingError && e.code === 'in_past');
+
+  // Staff tidying the roster afterwards still can, without dragging the
+  // waitlist into a class that's over.
+  const res = cancelBooking(db, booking.id, { now: afterClass, allowPast: true });
+  assert.equal(res.promoted, null);
+  assert.equal(getBooking(db, wl.id).status, 'waitlist');
+  assert.equal(getPass(db, waiting).credits_remaining, 5);
+});
+
+test('a pay-at-studio drop-in is owed only while the client holds a spot', () => {
+  const db = testDb();
+  const inst = makeInstance(db, makeClassType(db, { capacity: 1, price: 15000 }), { hoursFromNow: 48 });
+  const c1 = makeClient(db); const c2 = makeClient(db);
+  const dues = () => db.prepare(
+    "SELECT client_id, amount_cents FROM payments WHERE status = 'pending' ORDER BY id"
+  ).all();
+
+  const first = book(db, c1, inst, { recordDue: true });
+  assert.ok(first.paymentId);
+  const waiting = book(db, c2, inst, { recordDue: true });
+  assert.equal(waiting.paymentId, null, 'the waitlist owes nothing yet');
+  assert.deepEqual(dues(), [{ client_id: c1, amount_cents: 15000 }]);
+
+  // c1 cancels in time: their due goes, and c2 owes from the moment they're promoted.
+  cancelBooking(db, first.booking.id);
+  assert.deepEqual(dues(), [{ client_id: c2, amount_cents: 15000 }]);
+
+  // The studio cancelling the class clears it too.
+  cancelClass(db, inst);
+  assert.deepEqual(dues(), []);
+});
+
+test('a late cancel under the forfeit policy still owes the drop-in', () => {
+  const db = testDb();
+  const inst = makeInstance(db, makeClassType(db, { price: 15000 }), { hoursFromNow: 2 });
+  const { booking } = book(db, makeClient(db), inst, { recordDue: true });
+  cancelBooking(db, booking.id);
+  assert.equal(db.prepare("SELECT COUNT(*) c FROM payments WHERE status = 'pending'").get().c, 1);
+});
+
 test('promotion re-resolves payment if the waitlisted client acquired a membership meanwhile', () => {
   const db = testDb();
   const type = makeClassType(db, { capacity: 1 });
@@ -344,3 +396,30 @@ test('capacity race: concurrent-style bookings never exceed capacity (transactio
   assert.equal(booked, 5);
   assert.equal(wait, 15);
 });
+
+test('raising a class capacity fills the new spots from the waitlist, in order', () => {
+  const db = testDb();
+  const now = '2026-10-01T10:00:00Z';
+  const inst = makeInstance(db, makeClassType(db, { capacity: 1 }), { now, hoursFromNow: 24 });
+  const [c1, c2, c3, c4] = [1, 2, 3, 4].map(() => makeClient(db));
+  const passes = [c2, c3, c4].map((c) => makePass(db, c, { total: 5 }));
+  const [, b2, b3, b4] = [c1, c2, c3, c4].map((c) => book(db, c, inst, { now }).booking);
+
+  const res = updateInstance(db, inst, { capacity: 3 }, { now });
+  assert.deepEqual(res.promoted.map((b) => b.id), [b2.id, b3.id]);
+  assert.equal(getPass(db, passes[0]).credits_remaining, 4);
+  assert.equal(getPass(db, passes[1]).credits_remaining, 4);
+  assert.equal(getBooking(db, b4.id).status, 'waitlist');
+  assert.equal(getPass(db, passes[2]).credits_remaining, 5);
+
+  // Shrinking the room cancels nobody.
+  assert.deepEqual(updateInstance(db, inst, { capacity: 1 }, { now }).promoted, []);
+  assert.equal(db.prepare("SELECT COUNT(*) c FROM bookings WHERE status = 'booked'").get().c, 3);
+
+  // Nor does anyone get pulled into a class that has already started.
+  assert.deepEqual(updateInstance(db, inst, { capacity: 10 }, { now: '2026-10-02T11:00:00Z' }).promoted, []);
+  assert.equal(getBooking(db, b4.id).status, 'waitlist');
+
+  assert.throws(() => updateInstance(db, inst, { capacity: 0 }, { now }),
+    (e) => e instanceof BookingError && e.code === 'bad_capacity');
+});

package/test/web.test.js

@@ -160,7 +160,30 @@ test('returning client with signed waiver books without checkbox, uses pack cred
   const res = await agent.post(`/class/${inst}/book`).type('form')
     .send({ email: 'returning@test.hk', _csrf });
   assert.equal(res.status, 200);
-  assert.match(res.text, /credit deducted from your class pack/);
+  assert.match(res.text, /1 credit deducted from your class pack/);
+});
+
+test('a two-credit class says two credits came off the pack', async () => {
+  const { db, app } = makeApp();
+  const inst = makeInstance(db, makeClassType(db, { credits: 2 }), { hoursFromNow: 48 });
+  makePass(db, makeClient(db, { email: 'double@test.hk', waiver: true }));
+  const agent = request.agent(app);
+  const _csrf = await csrfToken(agent, `/class/${inst}`);
+  const res = await agent.post(`/class/${inst}/book`).type('form').send({ email: 'double@test.hk', _csrf });
+  assert.match(res.text, /2 credits deducted from your class pack/);
+});
+
+test("booking with an existing client's email does not rename them", async () => {
+  const { db, app } = makeApp();
+  const inst = makeInstance(db, makeClassType(db), { hoursFromNow: 48 });
+  const clientId = makeClient(db, { name: 'Mei Chan', email: 'mei@test.hk', waiver: true });
+
+  const agent = request.agent(app);
+  const _csrf = await csrfToken(agent, `/class/${inst}`);
+  const res = await agent.post(`/class/${inst}/book`).type('form')
+    .send({ name: 'Someone Else', email: 'mei@test.hk', _csrf });
+  assert.equal(res.status, 200);
+  assert.equal(db.prepare('SELECT name FROM clients WHERE id = ?').get(clientId).name, 'Mei Chan');
 });
 
 test('full class books to waitlist via HTTP', async () => {
@@ -185,6 +208,54 @@ test('full class books to waitlist via HTTP', async () => {
   assert.match(second.text, /You're #2 in line/);
 });
 
+test('drop-in dues: nothing owed on the waitlist, and a cancelled booking owes nothing', async () => {
+  const { db, app } = makeApp();
+  const inst = makeInstance(db, makeClassType(db, { capacity: 1, price: 15000 }), { hoursFromNow: 48 });
+  const agent = request.agent(app);
+  const _csrf = await csrfToken(agent, `/class/${inst}`);
+  for (const email of ['first@t.hk', 'second@t.hk']) {
+    await agent.post(`/class/${inst}/book`).type('form').send({ email, waiver_agree: '1', _csrf });
+  }
+  const owing = () => db.prepare(
+    `SELECT c.email FROM payments p JOIN clients c ON c.id = p.client_id
+     WHERE p.status = 'pending' ORDER BY p.id`
+  ).all().map((r) => r.email);
+  assert.deepEqual(owing(), ['first@t.hk']);
+
+  const { cancelBooking } = await import('../src/services/booking.js');
+  const first = db.prepare("SELECT id FROM bookings WHERE status = 'booked'").get();
+  cancelBooking(db, first.id);
+  assert.deepEqual(owing(), ['second@t.hk']);
+});
+
+test('admin: editing a class from the roster moves the waitlist up and emails them', async () => {
+  const { db, app } = makeApp();
+  const agent = request.agent(app);
+  const _csrf = await adminLogin(agent);
+  const inst = makeInstance(db, makeClassType(db, { capacity: 1 }), { hoursFromNow: 48 });
+  const kim = db.prepare("INSERT INTO instructors (name) VALUES ('Kim')").run().lastInsertRowid;
+  const { book } = await import('../src/services/booking.js');
+  book(db, makeClient(db, { email: 'first@edit.hk' }), inst);
+  const { booking: wl } = book(db, makeClient(db, { email: 'waiting@edit.hk' }), inst);
+
+  const roster = await agent.get(`/admin/instances/${inst}`);
+  assert.match(roster.text, /Edit class/);
+  const res = await agent.post(`/admin/instances/${inst}/edit`).type('form')
+    .send({ capacity: '2', instructor_id: String(kim), notes: 'Room B', _csrf });
+  assert.equal(res.status, 302);
+  const row = db.prepare('SELECT capacity, instructor_id, notes FROM class_instances WHERE id = ?').get(inst);
+  assert.deepEqual({ ...row }, { capacity: 2, instructor_id: kim, notes: 'Room B' });
+  assert.equal(db.prepare('SELECT status FROM bookings WHERE id = ?').get(wl.id).status, 'booked');
+  await new Promise((r) => setTimeout(r, 100));
+  const mails = fs.readdirSync(OUTBOX).map((f) => fs.readFileSync(path.join(OUTBOX, f), 'utf8'));
+  assert.ok(mails.some((m) => m.includes('To: waiting@edit.hk') && m.includes('/me?token=')));
+
+  const bad = await agent.post(`/admin/instances/${inst}/edit`).type('form')
+    .send({ capacity: '2', instructor_id: '999', _csrf });
+  assert.equal(bad.status, 302, 'an unknown instructor is a flash, not a 500');
+  assert.equal(db.prepare('SELECT instructor_id FROM class_instances WHERE id = ?').get(inst).instructor_id, kim);
+});
+
 test('magic link: verify round-trip, view bookings, cancel within policy', async () => {
   const { db, app } = makeApp();
   const type = makeClassType(db, { name: 'Spin' });
@@ -279,6 +350,42 @@ test('admin: rules CRUD generates instances; roster check-in works over HTTP', a
   assert.equal(db.prepare('SELECT status FROM bookings WHERE id=?').get(booking.id).status, 'attended');
 });
 
+test('admin: editing a rule moves its empty classes instead of adding a second slot', async () => {
+  const { db, app } = makeApp();
+  const agent = request.agent(app);
+  const _csrf = await adminLogin(agent);
+  const { book } = await import('../src/services/booking.js');
+  const { localTimeStr } = await import('../src/lib/time.js');
+
+  const type = makeClassType(db, { name: 'Pilates' });
+  await agent.post('/admin/rules').type('form').send({
+    class_type_id: String(type), weekday: '4', start_time: '18:00', _csrf,
+  });
+  const ruleId = db.prepare('SELECT id FROM schedule_rules').get().id;
+  const nowIso = new Date().toISOString();
+  const future = () => db.prepare(
+    'SELECT starts_at FROM class_instances WHERE rule_id = ? AND starts_at > ? ORDER BY starts_at'
+  ).all(ruleId, nowIso).map((ci) => localTimeStr('Asia/Hong_Kong', ci.starts_at));
+  const slots = future().length;
+  const last = db.prepare('SELECT id FROM class_instances WHERE rule_id = ? ORDER BY starts_at DESC').get(ruleId).id;
+  book(db, makeClient(db), last);
+
+  const edit = await agent.post(`/admin/rules/${ruleId}`).type('form').send({
+    class_type_id: String(type), weekday: '4', start_time: '19:00', _csrf,
+  });
+  assert.equal(edit.status, 302);
+  const times = future();
+  assert.equal(times.filter((t) => t === '18:00').length, 1, 'only the booked class stays at the old time');
+  assert.equal(times.filter((t) => t === '19:00').length, slots);
+  assert.match((await agent.get('/admin/rules')).text, /1 booked class\(es\) are still at the old time/);
+
+  const bad = await agent.post(`/admin/rules/${ruleId}`).type('form').send({
+    class_type_id: String(type), weekday: '4', start_time: 'seven', _csrf,
+  });
+  assert.equal(bad.status, 302);
+  assert.equal(db.prepare('SELECT start_time FROM schedule_rules WHERE id = ?').get(ruleId).start_time, '19:00');
+});
+
 test('admin: manual pass sale + payment, revenue report and CSV export', async () => {
   const { db, app } = makeApp();
   const agent = request.agent(app);

package/views/admin/roster.ejs

@@ -5,6 +5,7 @@
      <% if (inst.instructor_name) { %> · <%= inst.instructor_name %><% } %>
      <% if (inst.status === 'cancelled') { %> · <mark>CANCELLED</mark><% } %></p>
 </hgroup>
+<% if (inst.notes) { %><p><small><%= inst.notes %></small></p><% } %>
 <table>
   <thead><tr><th>Client</th><th>Paid with</th><th>Status</th><th>Actions</th></tr></thead>
   <tbody>
@@ -38,6 +39,24 @@
   <% } %>
   </ol>
 <% } %>
+<% if (inst.status === 'scheduled') { %>
+<details>
+  <summary role="button" class="outline">Edit class</summary>
+  <form method="post" action="/admin/instances/<%= inst.id %>/edit"><input type="hidden" name="_csrf" value="<%= csrfToken %>">
+    <div class="grid">
+      <label>Capacity <input type="number" name="capacity" min="1" required value="<%= inst.capacity %>"></label>
+      <label>Instructor
+        <select name="instructor_id"><option value="">—</option>
+          <% for (const i of instructors) { %><option value="<%= i.id %>" <%= i.id === inst.instructor_id ? 'selected' : '' %>><%= i.name %></option><% } %>
+        </select>
+      </label>
+    </div>
+    <label>Notes <input name="notes" value="<%= inst.notes || '' %>"></label>
+    <small>Extra spots go to the waitlist in order, and they're emailed.</small>
+    <button>Save</button>
+  </form>
+</details>
+<% } %>
 <details>
   <summary role="button" class="outline">Add walk-in</summary>
   <form method="post" action="/admin/instances/<%= inst.id %>/walkin"><input type="hidden" name="_csrf" value="<%= csrfToken %>">

package/views/public/book_result.ejs

@@ -8,7 +8,7 @@
     <h2>You're booked!</h2>
     <p><strong><%= inst.class_name %></strong> · <%= fmtDt(inst.starts_at) %></p>
     <p>Payment:
-      <% if (result.booking.paid_with === 'pack') { %>1 credit deducted from your class pack.
+      <% if (result.booking.paid_with === 'pack') { const n = result.instance.credits_required ?? 1; %><%= n %> credit<%= n === 1 ? '' : 's' %> deducted from your class pack.
       <% } else if (result.booking.paid_with === 'membership') { %>covered by your membership.
       <% } else if (result.paymentId) { %>please pay <%= fmtMoney(inst.drop_in_price_cents) %> at the studio (cash/FPS) before class.
       <% } else { %>drop-in.

package/views/public/buy_thanks.ejs

@@ -1,7 +1,7 @@
 <%- include('../partials/head', { adminNav: false }) %>
 <article>
   <h2>Thank you!</h2>
-  <p>Your payment was received. Your pass or membership is now active on your account — just book with the same email.</p>
+  <p>Your pass or membership goes on your account as soon as Stripe confirms the payment. For cards that's usually within a minute. Some bank payments take a few days. Book with the same email you paid with.</p>
   <p><a href="/" role="button">Browse the schedule</a></p>
 </article>
 <%- include('../partials/foot') %>