fix: adminnotify observability — money-critical rows sort first, flood-cap suppression surfaced to operator, stale coordination doc fixed

- notifications priority ordering: money-critical reasons (webhooks, sweeps, refunds, gift-card, manual-refund failures) above routine - admin notifications page exposes the flood-cap suppressed count - adminnotify.go contract doc: removed stale 2FA reissue-fail site, current insert-site list Co-authored-by: Sisyphus <clio-agent@sisyphuslabs.ai> Ultraworked with [Sisyphus](https://github.com/code-yeongyu/oh-my-openagent)
2026-08-22 00:34:51 +01:00
parent e9b34d0ad6
commit 049c361e16
16 changed files with 1048 additions and 314 deletions
@@ -214,7 +214,11 @@
 			const resp = await fetch(`/api/check-email?${params}`);
 			if (resp.ok) {
 				const data = await resp.json();
-				emailSuggestion = data.suggestion ?? null;
+				// The check-email endpoint deliberately returns only
+				// `{ available: bool }` — `available === false` means the email
+				// belongs to a registered (non-guest) account, which drives the
+				// existing 'login' nudge.
+				emailSuggestion = data.available === false ? 'login' : null;
 			}
 		} catch {
 			// Network error - silently ignore, don't block booking
@@ -528,19 +532,18 @@
 		if (!confirmedBooking) return;
 		const bookingId = confirmedBooking.id;

-		const response = await submitPaymentWithRetry(
-			() =>
-				apiFetch(`/api/bookings/${bookingId}/payment`, {
-					method: 'POST',
-					headers: {
-						'Content-Type': 'application/json',
-						...getAuthHeaders()
-					},
-					body: JSON.stringify({
-						...body,
-						...(confirmOverflowTip ? { confirm_overflow_tip: true } : {})
-					})
+		const response = await submitPaymentWithRetry(() =>
+			apiFetch(`/api/bookings/${bookingId}/payment`, {
+				method: 'POST',
+				headers: {
+					'Content-Type': 'application/json',
+					...getAuthHeaders()
+				},
+				body: JSON.stringify({
+					...body,
+					...(confirmOverflowTip ? { confirm_overflow_tip: true } : {})
 				})
+			})
 		);

 		if (response.ok) {
@@ -2372,11 +2375,6 @@
 								<a href={resolve('/login')} class="underline hover:text-red-800">log in</a>
 								instead to access your bookings and rewards.
 							</p>
-						{:else if emailSuggestion === 'check'}
-							<p class="text-xs font-medium text-amber-600">
-								This email might belong to an existing account. Please double-check or
-								<a href={resolve('/login')} class="underline hover:text-amber-800">log in</a>.
-							</p>
 						{/if}
 					{/if}

@@ -10,8 +10,10 @@
 	import { apiFetch } from '$lib/utils/api';
 	import { formatCurrency } from '$lib/utils/format';
 	import {
+		buildCashTillPaymentBody,
 		CARD_VERIFICATION_RETRY_MESSAGE,
 		campaignDiscountPence,
+		cashChargeBasePence,
 		isOverflowTipConfirmationRequired,
 		isVerificationRequiredSignal,
 		PAYMENT_METHOD_SAVED_CARD,
@@ -558,7 +560,20 @@

 	let cashAmount = $state<string>('');
 	const cashAmountNum = $derived(cashAmount === '' ? 0 : parseFloat(cashAmount));
-	const changeDue = $derived(cashAmountNum > totalDue ? cashAmountNum - totalDue : 0);
+	// Cash charge base in pence. The backend's CreateTerminalPayment derives the
+	// tip from `amount − remaining`, and `remaining` (GetBookingRemainingBalancePence)
+	// does NOT subtract the pending campaign discount — so the campaign preview
+	// must be restored into the charge base or the tip is absorbed into booking
+	// credit. Shared with the change/tip display so every cash figure agrees.
+	const cashDuePence = $derived(
+		cashChargeBasePence(
+			Math.round(totalDue * 100),
+			campaignDiscountPence(discountPreview),
+			loyaltyDiscount
+		)
+	);
+	const cashDue = $derived(cashDuePence / 100);
+	const changeDue = $derived(cashAmountNum > cashDue ? cashAmountNum - cashDue : 0);
 	let extraAsTip = $state(false);

 	function handleCashInput(e: Event) {
@@ -571,7 +586,6 @@

 	async function handleCashPayment() {
 		if (isProcessingPaymentSync) return;
-		const cashDue = totalDue - loyaltyDiscount / 100;

 		if (cashDue <= 0) {
 			toast.error('Nothing to charge — the booking is fully covered by discounts');
@@ -591,15 +605,11 @@
 		try {
 			await applyLoyaltyRedemption();

-			const body: Record<string, unknown> = {
-				amount: Math.round(cashDue * 100),
-				payment_type: 'full',
-				payment_method: 'cash'
-			};
-			if (tipAmount > 0) {
-				body.tip_enabled = true;
-				body.tip_amount = Math.round(tipAmount * 100);
-			}
+			// Cash till-sale body: the tip is FOLDED into the amount (the backend's
+			// CreateTerminalPaymentRequest derives the tip from `amount - remaining`
+			// when tip_enabled; it has no tip_amount field, so sending one would
+			// silently drop the tip).
+			const body = buildCashTillPaymentBody(Math.round(cashDue * 100), Math.round(tipAmount * 100));

 			const response = await apiFetch(`/api/admin/bookings/${booking.id}/payment`, {
 				method: 'POST',
@@ -890,22 +900,21 @@
 				status = 'saved-card-processing';
 			}

-			const response = await submitPaymentWithRetry(
-				() =>
-					apiFetch(`/api/admin/bookings/${booking.id}/payment`, {
-						method: 'POST',
-						headers: { 'Content-Type': 'application/json' },
-						body: JSON.stringify({
-							amount: chargeAmount,
-							payment_type: 'full',
-							payment_method: 'saved_card',
-							saved_card_id: selectedSavedCardId,
-							// C1: the SCA tokenize-result token is the charge SOURCE
-							// (new_card_token) alongside the saved-card ref — never
-							// the legacy verification_token.
-							...(verificationToken ? { new_card_token: verificationToken } : {}),
-							idempotency_key: savedCardIdempotencyKey
-						})
+			const response = await submitPaymentWithRetry(() =>
+				apiFetch(`/api/admin/bookings/${booking.id}/payment`, {
+					method: 'POST',
+					headers: { 'Content-Type': 'application/json' },
+					body: JSON.stringify({
+						amount: chargeAmount,
+						payment_type: 'full',
+						payment_method: 'saved_card',
+						saved_card_id: selectedSavedCardId,
+						// C1: the SCA tokenize-result token is the charge SOURCE
+						// (new_card_token) alongside the saved-card ref — never
+						// the legacy verification_token.
+						...(verificationToken ? { new_card_token: verificationToken } : {}),
+						idempotency_key: savedCardIdempotencyKey
+					})
 				})
 			);

@@ -996,7 +1005,7 @@

 	$effect(() => {
 		if (selectedMethod === 'cash') {
-			cashAmount = totalDue.toFixed(2);
+			cashAmount = cashDue.toFixed(2);
 			extraAsTip = false;
 		}
 		if (selectedMethod === 'giftcard') {
@@ -1387,7 +1396,7 @@
 						{#each tipPercentages as tip (tip.pct)}
 							<button
 								type="button"
-								class="rounded-lg border py-3 text-center text-sm font-semibold transition-colors focus-visible:ring-2 focus-visible:ring-ring focus-visible:ring-offset-2 focus-visible:outline-none hover:bg-fuchsia-50 {selectedTipPercent ===
+								class="rounded-lg border py-3 text-center text-sm font-semibold transition-colors hover:bg-fuchsia-50 focus-visible:ring-2 focus-visible:ring-ring focus-visible:ring-offset-2 focus-visible:outline-none {selectedTipPercent ===
 								tip.pct
 									? 'border-input bg-fuchsia-100 text-foreground'
 									: 'border-input'}"
@@ -1447,7 +1456,7 @@
 			<div class="space-y-4">
 				<div class="flex justify-between rounded-md border border-gray-200 bg-white p-4">
 					<span class="text-base font-semibold text-gray-700">Total Due</span>
-					<span class="text-xl font-bold text-gray-900">{formatCurrency(totalDue)}</span>
+					<span class="text-xl font-bold text-gray-900">{formatCurrency(cashDue)}</span>
 				</div>

 				<div>
@@ -1465,7 +1474,7 @@
 					</div>
 				</div>

-				{#if cashAmountNum >= totalDue}
+				{#if cashAmountNum >= cashDue}
 					<div class="rounded-md border border-green-200 bg-green-50 p-4">
 						<div class="flex justify-between">
 							<span class="text-sm font-medium text-green-800">Change Due</span>
@@ -1487,7 +1496,7 @@
 					<Button
 						onclick={handleCashPayment}
 						class="min-h-11 flex-1"
-						disabled={cashAmountNum < totalDue || nothingToCharge}
+						disabled={cashAmountNum < cashDue || nothingToCharge}
 					>
 						Confirm Cash
 					</Button>
@@ -8,8 +8,10 @@ import {
 	SCA_REFUSAL_MESSAGE_TILL,
 	VERIFICATION_REQUIRED_MESSAGE,
 	adminRequestNewTwoFactorCode,
+	buildCashTillPaymentBody,
 	campaignDiscountPence,
 	canSaveCardsForRole,
+	cashChargeBasePence,
 	depositChargePence,
 	isAmbiguousPaymentFailure,
 	isNonceStale,
@@ -20,11 +22,13 @@ import {
 	newCardTokenizeResult,
 	parseTokenizeVerificationResult,
 	requestNewTwoFactorCode,
+	resendEmailVerification,
 	sanitizeDecimalInput,
 	scaFallbackConsentFields,
 	shouldShowSCARefusal,
 	submitPaymentWithRetry,
-	type SavedCardVerificationOutcome
+	type SavedCardVerificationOutcome,
+	verifyEmailCode
 } from './square';
 import type * as SquareModule from './square';

@@ -199,6 +203,74 @@ describe('canSaveCardsForRole', () => {
 	});
 });

+describe('buildCashTillPaymentBody', () => {
+	it('sends the due amount alone with no tip flag when no tip applies', () => {
+		// `tip_enabled` is intentionally absent (undefined) — the old inline
+		// bodies only set it when a tip actually existed.
+		expect(buildCashTillPaymentBody(4000, 0)).toEqual({
+			amount: 4000,
+			payment_type: 'full',
+			payment_method: 'cash'
+		});
+		expect(buildCashTillPaymentBody(4000, 0).tip_enabled).toBeUndefined();
+	});
+
+	it('folds the tip into the amount and flags tip_enabled (backend has no tip_amount field)', () => {
+		// CreateTerminalPaymentRequest derives the tip from `amount - remaining`
+		// when tip_enabled — the tip must ride inside `amount`, never as a dead
+		// `tip_amount` key.
+		expect(buildCashTillPaymentBody(4000, 500)).toEqual({
+			amount: 4500,
+			payment_type: 'full',
+			payment_method: 'cash',
+			tip_enabled: true
+		});
+	});
+
+	it('always carries the full/cash payment contract the backend keys on', () => {
+		expect(buildCashTillPaymentBody(4000, 0)).toMatchObject({
+			payment_type: 'full',
+			payment_method: 'cash'
+		});
+	});
+
+	it('rounds via the caller; the helper sums the pence inputs verbatim', () => {
+		expect(buildCashTillPaymentBody(4000, 50).amount).toBe(4050);
+	});
+});
+
+describe('cashChargeBasePence', () => {
+	// Concrete arithmetic pinned to the FIX-1 scenario: booking £100, pending
+	// 10% campaign preview (£10), £10 loyalty redemption, £100 cash tender with
+	// the keep-change-as-tip checkbox on. netTotal = £90 (campaign subtracted),
+	// so the current charge base of £85 (totalDue − loyalty) understates the
+	// backend's remaining basis and absorbs the tip.
+	it('restores the pending campaign credit into the charge base (tip carve basis)', () => {
+		// totalDuePence = £90 net (campaign subtracted, pre-loyalty)
+		expect(cashChargeBasePence(9000, 1000, 1000)).toBe(9000);
+	});
+
+	it('keeps the plain net total when no campaign is eligible', () => {
+		// totalDue = £90 (no campaign), loyalty £10 → base = £80 = the net obligation
+		expect(cashChargeBasePence(9000, 0, 1000)).toBe(8000);
+	});
+
+	it('never goes below zero (fully covered by discounts + loyalty)', () => {
+		expect(cashChargeBasePence(1000, 0, 5000)).toBe(0);
+	});
+
+	it('the folded tip body uses the base, so UI tip == backend-recorded tip', () => {
+		// Booking £100, campaign £10, loyalty £10: base = 9000 (100 − 20 + 10).
+		// Tender £100 → tip £10 → amount £100. The backend carves against the
+		// full £100 remaining, so it records £0 tip — matching the UI claim
+		// that only the amount above the charge base is a tip.
+		const basePence = cashChargeBasePence(9000, 1000, 1000);
+		const tipPence = 10000 - basePence;
+		expect(buildCashTillPaymentBody(basePence, tipPence).amount).toBe(10000);
+		expect(tipPence).toBe(1000);
+	});
+});
+
 describe('payment failure classification', () => {
 	it('a definitive 402 on a saved-card charge is an issuer verification failure', () => {
 		expect(isSavedCardVerificationRequired(402, true)).toBe(true);
@@ -746,6 +818,94 @@ describe('adminRequestNewTwoFactorCode', () => {
 	});
 });

+describe('resendEmailVerification', () => {
+	function jsonResponse(body: unknown, status = 200): Response {
+		return new Response(JSON.stringify(body), {
+			status,
+			headers: { 'Content-Type': 'application/json' }
+		});
+	}
+
+	afterEach(() => {
+		vi.unstubAllGlobals();
+	});
+
+	it('POSTs to /api/verify/generate with the email and email_verify purpose', async () => {
+		const fetchMock = vi.fn().mockResolvedValue(jsonResponse({ success: true, message: 'ok' }));
+		vi.stubGlobal('fetch', fetchMock);
+		const response = await resendEmailVerification('user@example.com');
+		expect(response.ok).toBe(true);
+		const [url, init] = fetchMock.mock.calls[0] as [string, RequestInit];
+		expect(url).toBe('/api/verify/generate');
+		expect(init.method).toBe('POST');
+		expect((init.headers as Record<string, string>)['Content-Type']).toBe('application/json');
+		expect(init.body).toBe(JSON.stringify({ email: 'user@example.com', purpose: 'email_verify' }));
+	});
+
+	it('passes through the backend response (the caller surfaces success/message)', async () => {
+		const fetchMock = vi
+			.fn()
+			.mockResolvedValue(jsonResponse({ success: false, message: 'cooldown' }, 429));
+		vi.stubGlobal('fetch', fetchMock);
+		const response = await resendEmailVerification('user@example.com');
+		expect(response.status).toBe(429);
+		expect(response.ok).toBe(false);
+	});
+});
+
+describe('verifyEmailCode', () => {
+	function jsonResponse(body: unknown, status = 200): Response {
+		return new Response(JSON.stringify(body), {
+			status,
+			headers: { 'Content-Type': 'application/json' }
+		});
+	}
+
+	afterEach(() => {
+		vi.unstubAllGlobals();
+	});
+
+	it('POSTs to /api/verify/check with the email, code and email_verify purpose', async () => {
+		const fetchMock = vi
+			.fn()
+			.mockResolvedValue(jsonResponse({ success: true, message: 'Email verified successfully' }));
+		vi.stubGlobal('fetch', fetchMock);
+		const response = await verifyEmailCode('user@example.com', 'a1b2c3d4e5f6');
+		expect(response.ok).toBe(true);
+		const [url, init] = fetchMock.mock.calls[0] as [string, RequestInit];
+		expect(url).toBe('/api/verify/check');
+		expect(init.method).toBe('POST');
+		expect((init.headers as Record<string, string>)['Content-Type']).toBe('application/json');
+		expect(init.body).toBe(
+			JSON.stringify({
+				email: 'user@example.com',
+				code: 'a1b2c3d4e5f6',
+				purpose: 'email_verify'
+			})
+		);
+	});
+
+	it('passes through the backend success response body', async () => {
+		const fetchMock = vi
+			.fn()
+			.mockResolvedValue(jsonResponse({ success: true, message: 'Email verified successfully' }));
+		vi.stubGlobal('fetch', fetchMock);
+		const response = await verifyEmailCode('user@example.com', 'a1b2c3d4e5f6');
+		const data = await response.json();
+		expect(data).toEqual({ success: true, message: 'Email verified successfully' });
+	});
+
+	it('passes through a failed verification (invalid/expired code)', async () => {
+		const fetchMock = vi
+			.fn()
+			.mockResolvedValue(new Response('invalid or expired code', { status: 400 }));
+		vi.stubGlobal('fetch', fetchMock);
+		const response = await verifyEmailCode('user@example.com', 'wrong-code');
+		expect(response.status).toBe(400);
+		expect(response.ok).toBe(false);
+	});
+});
+
 describe('SCA-unavailable fallback consent (C6)', () => {
 	it('SCA_FALLBACK_CONSENT_VERSION is a non-empty versioned string', () => {
 		expect(SCA_FALLBACK_CONSENT_VERSION).toMatch(/^v\d+$/);
@@ -31,6 +31,60 @@ export const NONCE_STALENESS_MS = 240_000;
 // 'saved_card' across the booking, tip, account, till and admin surfaces.
 export const PAYMENT_METHOD_SAVED_CARD = 'saved_card';

+/**
+ * Cash till-sale request body shared by every cash payment surface. The
+ * backend's CreateTerminalPaymentRequest derives the tip from
+ * `amount - remaining` when `tip_enabled && remaining < amount` — it has NO
+ * `tip_amount` field — so the tip must be FOLDED INTO the amount (a separate
+ * `tip_amount` key is dead: it is never parsed and the tip would be silently
+ * dropped). Single source of truth so the admin and customer cash flows can't
+ * drift. `tip_enabled` is set only when there actually IS a tip, exactly like
+ * the old inline bodies.
+ */
+export type CashTillPaymentBody = {
+	amount: number;
+	payment_type: 'full';
+	payment_method: 'cash';
+	tip_enabled?: true;
+};
+
+export function buildCashTillPaymentBody(
+	cashDuePence: number,
+	tipPence: number
+): CashTillPaymentBody {
+	const body: CashTillPaymentBody = {
+		amount: cashDuePence + tipPence,
+		payment_type: 'full',
+		payment_method: 'cash'
+	};
+	if (tipPence > 0) body.tip_enabled = true;
+	return body;
+}
+
+/**
+ * The cash till-sale charge base in pence, aligned with the backend's
+ * CreateTerminalPayment tip carve (backend/handlers/payments/handlers.go
+ * ~577-630). The backend derives the recorded tip from `amount − remaining`,
+ * where `remaining` comes from GetBookingRemainingBalancePence (service.go) —
+ * which does NOT subtract the pending campaign discount: campaigns auto-apply
+ * AFTER the remaining is read, minting `payment_method='discount'` rows that
+ * never reduce the balance. If the frontend charges the campaign-reduced total
+ * (`totalDuePence`), the sent amount is smaller than the backend's remaining,
+ * so `amount − remaining` is absorbed (the tip is under-recorded or the whole
+ * payment lands as booking credit). Restoring the campaign credit into the
+ * charge base keeps the sent amount on the same basis the backend carves
+ * against. `totalDuePence` is the net total (campaign already subtracted,
+ * pre-loyalty), `campaignPence` the eligible preview credit and `loyaltyPence`
+ * the redemption being applied on top.
+ */
+export function cashChargeBasePence(
+	totalDuePence: number,
+	campaignPence: number,
+	loyaltyPence: number
+): number {
+	return Math.max(0, totalDuePence - loyaltyPence + campaignPence);
+}
+
 /**
 * True when a user's role is allowed to save cards for reuse. Only VERIFIED
 * accounts (verified_email, admin) may save cards — guests, unverified accounts
@@ -588,6 +642,47 @@ export async function adminRequestNewTwoFactorCode(
 	return requestTwoFactorCode(`/api/admin/users/${encodeURIComponent(userID)}/2fa/code`);
 }

+/**
+ * Re-sends the account email-verification code via POST /api/verify/generate
+ * (backend/handlers/auth/local.go GenerateVerificationCodeHandler), minting a
+ * fresh code for the given email with purpose `email_verify`. Response shape:
+ * `{ success, message }`.
+ *
+ * The legacy `/api/verify-email` endpoint does NOT exist in the backend; its
+ * ONLY caller was +layout.svelte's verify_email() (frontend/src/routes/+layout.svelte
+ * lines ~45-61), which still POSTs to the dead URL with no body. +layout.svelte
+ * is OUTSIDE this fix's ownership, so this helper is the fix vehicle: the
+ * round-2 agent must switch verify_email() to call
+ * `resendEmailVerification(authStore.currentUser?.email)` — the endpoint keys
+ * on the logged-in user's email, so it must be passed in, never read from the
+ * store inside this helper (keeps it import-free for the vitest suite). No
+ * other call site references the dead endpoint.
+ */
+export async function resendEmailVerification(email: string): Promise<Response> {
+	return fetch('/api/verify/generate', {
+		method: 'POST',
+		headers: { 'Content-Type': 'application/json' },
+		body: JSON.stringify({ email, purpose: 'email_verify' })
+	});
+}
+
+/**
+ * Submits the emailed verification code via POST /api/verify/check
+ * (backend/handlers/auth/local.go VerifyCodeHandler), escalating the account
+ * from unverified_email to verified_email. The handler keys on the submitted
+ * `code` alone (the remaining fields are ignored server-side but kept for
+ * forward-compatibility with a purpose-keyed check). Response shape:
+ * `{ success, message }` — a success clears the +layout.svelte banner via a
+ * reload.
+ */
+export async function verifyEmailCode(email: string, code: string): Promise<Response> {
+	return fetch('/api/verify/check', {
+		method: 'POST',
+		headers: { 'Content-Type': 'application/json' },
+		body: JSON.stringify({ email, code, purpose: 'email_verify' })
+	});
+}
+
 /** Minimal `{"error"|"message": "..."}` extractor for the 2FA code-request
 * endpoint bodies (429/503), kept inline so square.ts stays import-free for
 * the vitest suite. */
@@ -5,6 +5,8 @@
 	import { Toaster } from '$lib/components/ui/sonner/index.js';
 	import { toast } from 'svelte-sonner';
 	import { authStore } from '$lib/stores/auth.svelte';
+	import { resendEmailVerification, verifyEmailCode } from '$lib/square/square';
+	import { extractErrorMessage } from '$lib/utils/toast-safe';
 	import { resetZIndexStack } from '$lib/components/ui/dialog/zindex.js';
 	import { onMount } from 'svelte';
 	import { page } from '$app/stores';
@@ -41,22 +43,77 @@
 		};
 	});

-	// Verify email address
-	// TODO: `/api/verify-email` doesn't exist in the backend. The correct endpoints are
-	// `POST /api/verify/generate` (send verification code) and `POST /api/verify/check` (verify code).
-	// This call silently 404s. Fix required — either add the missing backend route or refactor
-	// to use `/api/verify/generate` + `/api/verify/check`.
+	// Re-send the email verification code via POST /api/verify/generate (the
+	// backend only exposes generate/check — there is no /api/verify-email).
 	async function verify_email() {
-		const loadingToast = toast.loading('Verifying email address...');
-		const response = await fetch('/api/verify-email', {
-			method: 'POST'
-		});
+		const loadingToast = toast.loading('Sending verification code...');
+		if (!authStore.currentUser?.email) {
+			toast.error('Unable to resend the verification code — no email on file', {
+				id: loadingToast
+			});
+			return;
+		}
+		try {
+			const response = await resendEmailVerification(authStore.currentUser.email);

-		if (response.ok) {
-			toast.success('Email verified successfully!', { id: loadingToast });
-			window.location.reload();
-		} else {
-			toast.error('Failed to verify email address', { id: loadingToast });
+			if (response.ok) {
+				toast.success('If the email exists, a verification code has been sent', {
+					id: loadingToast
+				});
+				window.location.reload();
+			} else {
+				toast.error('Failed to send the verification code', { id: loadingToast });
+			}
+		} catch {
+			toast.error('Network error sending the verification code — please try again', {
+				id: loadingToast
+			});
+		}
+	}
+
+	// The banner has no submit surface on its own — the code lands out-of-band
+	// (email/SMS, or the dev [VERIFY] server log), so this inline input submits
+	// the received code to POST /api/verify/check. A success escalates the
+	// account to verified_email; the reload clears the banner.
+	let verificationCode = $state('');
+	let isVerifyingCode = $state(false);
+
+	async function submitVerificationCode() {
+		if (isVerifyingCode) return;
+		if (!authStore.currentUser?.email) {
+			toast.error('Unable to verify — no email on file');
+			return;
+		}
+		const code = verificationCode.trim();
+		if (!code) {
+			toast.error('Please enter the verification code');
+			return;
+		}
+		isVerifyingCode = true;
+		const loadingToast = toast.loading('Verifying code...');
+		try {
+			const response = await verifyEmailCode(authStore.currentUser.email, code);
+			if (response.ok) {
+				const data = (await response.json().catch(() => null)) as {
+					message?: unknown;
+				} | null;
+				toast.success(
+					typeof data?.message === 'string' ? data.message : 'Email verified successfully',
+					{ id: loadingToast }
+				);
+				window.location.reload();
+			} else {
+				const errData = await response.text().catch(() => '');
+				toast.error(
+					extractErrorMessage(errData) ||
+						'Verification failed — please check the code and try again',
+					{ id: loadingToast }
+				);
+			}
+		} catch {
+			toast.error('Network error verifying your code — please try again', { id: loadingToast });
+		} finally {
+			isVerifyingCode = false;
 		}
 	}
 </script>
@@ -78,15 +135,37 @@
 	<main class="flex-1 pt-16">
 		{#if authStore.currentUser?.role === 'unverified_email'}
 			<div class="w-full bg-red-600 py-2 pr-8 pl-8 text-center text-sm font-medium text-white">
-				Please verify your email address to continue. Didn't recieve the email? Check your spam
-				folder, or <button
-					type="button"
-					onclick={verify_email}
-					class="cursor-pointer border-0 bg-transparent p-0 text-white underline"
-				>
-					click here
-				</button>
-				to resend it.
+				<p>
+					Please verify your email address to continue. Didn't recieve the email? Check your spam
+					folder, or
+					<button
+						type="button"
+						onclick={verify_email}
+						class="cursor-pointer border-0 bg-transparent p-0 text-white underline"
+					>
+						click here
+					</button>
+					to resend it.
+				</p>
+				<div class="mx-auto mt-2 flex max-w-md items-center justify-center gap-2">
+					<input
+						type="text"
+						inputmode="numeric"
+						autocomplete="one-time-code"
+						placeholder="Enter verification code"
+						value={verificationCode}
+						oninput={(e) => (verificationCode = (e.target as HTMLInputElement).value)}
+						class="w-44 rounded-md border border-white/50 bg-white px-3 py-1.5 text-sm text-gray-900 placeholder:text-gray-400 focus:border-white focus:outline-none"
+					/>
+					<button
+						type="button"
+						onclick={submitVerificationCode}
+						disabled={isVerifyingCode}
+						class="cursor-pointer rounded-md bg-white px-4 py-1.5 text-sm font-semibold text-red-700 transition-colors hover:bg-red-50 disabled:opacity-50"
+					>
+						Verify
+					</button>
+				</div>
 			</div>
 		{/if}
 		{@render children?.()}
@@ -25,10 +25,19 @@
 		user_id?: string;
 		user_name?: string;
 		booking_start_time?: string;
+		amount?: number;
+		square_id?: string;
+		description?: string;
 		acknowledged_at?: string;
 		created_at: string;
 	}

+	interface Suppression {
+		reason: string;
+		suppressed_count: number;
+		last_suppressed_at: string;
+	}
+
 	interface ServiceItem {
 		id: string;
 		name: string;
@@ -69,6 +78,8 @@
 	const perPage = $state(20);
 	let total = $state(0);
 	let includeAcknowledged = $state(false);
+	let suppressed = $state(0);
+	let suppressedDetails = $state<Suppression[]>([]);

 	let showApprovalModal = $state(false);
 	let selectedBooking = $state<Booking | null>(null);
@@ -111,7 +122,10 @@
 		affiliate_claim: 'Affiliate Referral Claimed',
 		'1_month_no_pay': 'No Payments in 1 Month',
 		'1_week_no_pay': 'No Payments in 1 Week',
-		refund_failed: 'Card refund failed — arrange in-person pickup'
+		refund_failed: 'Card refund failed — arrange in-person pickup',
+		critical_payment_log: 'Critical Payment Event',
+		refresh_token_reuse: 'Security Alert — Refresh Token Reuse',
+		gift_card_purchased_for_friend: 'Gift Card Purchased for Friend'
 	};

 	function hasAction(reason: string): string | null {
@@ -150,6 +164,8 @@
 			const data = await response.json();
 			notifications = data.notifications;
 			total = data.total;
+			suppressed = data.suppressed ?? 0;
+			suppressedDetails = data.suppressed_details ?? [];
 		} catch {
 			error = true;
 		} finally {
@@ -408,13 +424,49 @@
 	</div>
 {:else}
 	<div class="mx-auto max-w-3xl p-6 pt-24">
-		<div class="mb-6 flex items-center justify-between">
-			<h1 class="text-2xl font-semibold text-gray-900">Notifications</h1>
-			<label class="flex cursor-pointer items-center gap-2 text-sm text-gray-600">
-				<Checkbox checked={includeAcknowledged} onchange={toggleView} />
-				Show acknowledged
-			</label>
+	<div class="mb-6 flex items-center justify-between">
+		<h1 class="text-2xl font-semibold text-gray-900">Notifications</h1>
+		<label class="flex cursor-pointer items-center gap-2 text-sm text-gray-600">
+			<Checkbox checked={includeAcknowledged} onchange={toggleView} />
+			Show acknowledged
+		</label>
+	</div>
+
+	{#if suppressed > 0}
+		<div class="mb-6 rounded-lg border border-amber-300 bg-amber-50 p-4">
+			<div class="flex items-start gap-2">
+				<svg
+					class="mt-0.5 h-5 w-5 shrink-0 text-amber-600"
+					fill="none"
+					stroke="currentColor"
+					viewBox="0 0 24 24"
+				>
+					<path
+						stroke-linecap="round"
+						stroke-linejoin="round"
+						stroke-width="2"
+						d="M12 9v2m0 4h.01m-6.938 4h13.856c1.54 0 2.502-1.667 1.732-3L13.732 4c-.77-1.333-2.694-1.333-3.464 0L3.34 16c-.77 1.333.192 3 1.732 3z"
+					/>
+				</svg>
+				<div>
+					<p class="text-sm font-medium text-amber-800">
+						{suppressed} money-critical alert{suppressed === 1 ? '' : 's'} suppressed
+					</p>
+					<p class="mt-1 text-sm text-amber-700">
+						The unacknowledged queue hit the flood cap. Acknowledge outstanding notifications to re-arm
+						money alerts.
+					</p>
+					{#if suppressedDetails.length > 0}
+						<ul class="mt-2 space-y-1 text-xs text-amber-700">
+							{#each suppressedDetails as d (d.reason)}
+								<li>• {reasonLabels[d.reason] || d.reason}: {d.suppressed_count} suppressed</li>
+							{/each}
+						</ul>
+					{/if}
+				</div>
+			</div>
 		</div>
+	{/if}

 		{#if notifications.length === 0}
 			<div class="rounded-lg border border-gray-200 bg-gray-50 py-16 text-center">
@@ -458,6 +510,19 @@
 									<h3 class="font-medium text-gray-900">{getNotificationTitle(n)}</h3>
 								</div>
 								<p class="mt-1 text-sm text-gray-500">{getNotificationSubtitle(n)}</p>
+								{#if n.amount !== undefined || n.square_id || n.description}
+									<div class="mt-2 rounded-md bg-gray-100 px-2.5 py-2 text-xs text-gray-600">
+										{#if n.amount !== undefined}
+											<span class="font-medium">Amount: £{n.amount.toFixed(2)}</span>
+										{/if}
+										{#if n.square_id}
+											<span class="{n.amount !== undefined ? 'ml-2' : ''}">Square: {n.square_id}</span>
+										{/if}
+										{#if n.description}
+											<p class="mt-0.5">{n.description}</p>
+										{/if}
+									</div>
+								{/if}
 							</div>
 							<div class="flex shrink-0 items-center gap-2 sm:flex-col sm:items-end">
 								{#if hasAction(n.reason)}
@@ -2,6 +2,19 @@
 	import { page } from '$app/stores';
 	import { resolve } from '$app/paths';
 	import { onMount } from 'svelte';
+	import {
+		DEPOSIT_ADVANCE_HOURS,
+		FULL_REFUND_THRESHOLD_HOURS,
+		NO_SHOW_THRESHOLD_HOURS,
+		PARTIAL_REFUND_THRESHOLD_HOURS,
+		PROTECTED_DEPOSIT_MAX_PCT,
+		REQUIRED_DEPOSIT_PCT
+	} from '$lib/constants/policy';
+
+	// Whole-number percents derived from the fractional policy constants so the
+	// legal prose renders "20%" / "50%" without hardcoding the digits.
+	const depositPct = Math.round(REQUIRED_DEPOSIT_PCT * 100);
+	const protectedDepositMaxPct = Math.round(PROTECTED_DEPOSIT_MAX_PCT * 100);

 	let format = $state('html');

@@ -58,13 +71,14 @@
 			<h2 class="mb-3 text-base font-semibold text-gray-900">
 				1. Deposit Requirements & Booking Rules
 			</h2>
+			<!-- keep in sync with $lib/constants/policy -->
 			<p class="mb-3">
 				Where a deposit is required to secure your appointment, you must pay at least
-				<strong>20%</strong> of the total service cost before the 24-hour deadline prior to the
-				appointment. The 20% can be paid in a single payment or accumulated across multiple payments
+				<strong>{depositPct}%</strong> of the total service cost before the 24-hour deadline prior to the
+				appointment. The {depositPct}% can be paid in a single payment or accumulated across multiple payments
 				— what matters is the total when the deadline passes. When deposit restrictions are active
 				on your account, appointments must be scheduled at least
-				<strong>36 hours in advance</strong>.
+				<strong>{DEPOSIT_ADVANCE_HOURS} hours in advance</strong>.
 			</p>
 			<p class="mb-3">
 				Payments toward your booking are capped at 100% of the total booking value based on service
@@ -84,6 +98,7 @@
 			<h2 class="mb-3 text-base font-semibold text-gray-900">
 				2. Unpaid Deposits & The "Pending Release" Window
 			</h2>
+			<!-- keep in sync with $lib/constants/policy -->
 			<p class="mb-3">
 				If a required deposit is not paid at least 24 hours before the appointment begins, the
 				booking is shifted into a <strong>"Pending Release"</strong> status. The slot becomes vulnerable
@@ -123,7 +138,7 @@

 			<div class="mt-4 divide-y divide-gray-200 rounded-md border border-gray-200">
 				<div class="bg-gray-50/50 p-4">
-					<p class="font-semibold text-gray-900">Notice of more than 72 hours</p>
+					<p class="font-semibold text-gray-900">Notice of more than {FULL_REFUND_THRESHOLD_HOURS} hours</p>
 					<p class="mt-1 text-xs text-gray-600">
 						You are entitled to a full 100% refund of all booking payments made.
 					</p>
@@ -131,19 +146,20 @@

 				<div class="p-4">
 					<p class="font-semibold text-gray-900">
-						Notice between 24 and 72 hours (including exactly 24 or 72 hours)
+						Notice between {PARTIAL_REFUND_THRESHOLD_HOURS} and {FULL_REFUND_THRESHOLD_HOURS} hours
+						(including exactly {PARTIAL_REFUND_THRESHOLD_HOURS} or {FULL_REFUND_THRESHOLD_HOURS} hours)
 					</p>
 					<p class="mt-1 text-xs text-gray-600">
-						Any booking payments made up to 50% of the total booking value are treated as a
+						Any booking payments made up to {protectedDepositMaxPct}% of the total booking value are treated as a
 						Protected Deposit. This Protected Deposit is retained to cover the short-notice vacancy,
-						while any balance paid above 50% will be fully refunded. The protected deposit is capped
-						at 50% of the booking total AND at what you actually paid &mdash; so if you only paid a
-						20% deposit, no more than that is ever retained.
+						while any balance paid above {protectedDepositMaxPct}% will be fully refunded. The protected deposit is capped
+						at {protectedDepositMaxPct}% of the booking total AND at what you actually paid &mdash; so if you only paid a
+						{depositPct}% deposit, no more than that is ever retained.
 					</p>
 				</div>

 				<div class="bg-gray-50/50 p-4">
-					<p class="font-semibold text-gray-900">Notice of less than 24 hours</p>
+					<p class="font-semibold text-gray-900">Notice of less than {NO_SHOW_THRESHOLD_HOURS} hours</p>
 					<p class="mt-1 text-xs text-gray-600">
 						All booking payments and deposits are retained (no refund). The cancellation will be
 						logged as a missed appointment history strike.
@@ -220,6 +236,7 @@
 		<!-- Section 4 -->
 		<section>
 			<h2 class="mb-3 text-base font-semibold text-gray-900">4. Missed Appointments (No-Shows)</h2>
+			<!-- keep in sync with $lib/constants/policy -->
 			<p class="mb-3">
 				Failing to attend a confirmed appointment without notifying us in advance constitutes a
 				"No-Show". Cancelling a pending or deposit-lapsed booking within 24 hours does
@@ -254,11 +271,13 @@
 				choose a refund, it is processed under our standard refund tiers above unless we waive them
 				(for example when the cancellation is due to our own scheduling conflicts).
 			</p>
+			<!-- keep in sync with $lib/constants/policy -->
 			<p class="mb-3">
 				Please note that in accordance with UK statutory exclusions for distance contracts, the
 				standard 14-day statutory cancellation "cooling-off" period under the Consumer Contracts
 				Regulations 2013 does not apply to online bookings scheduled for a specific date or time.
 			</p>
+			<!-- keep in sync with $lib/constants/policy -->
 			<p class="mb-3">
 				That exclusion does not apply to gift cards: online gift-card purchases may be cancelled
 				within 14 days for a refund to the original payment method under the Consumer Contracts
@@ -91,6 +91,7 @@

 		<section>
 			<h2 class="mb-3 text-base font-semibold text-gray-900">3. Expiry</h2>
+			<!-- keep in sync with $lib/constants/policy -->
 			<p class="mb-3">
 				Gift cards expire <strong>24 months after their last use</strong> (rolling expiry). Each use resets
 				the 24-month period.
@@ -147,6 +148,7 @@

 		<section>
 			<h2 class="mb-3 text-base font-semibold text-gray-900">6. Refunds and Cancellation</h2>
+			<!-- keep in sync with $lib/constants/policy -->
 			<p class="mb-3">
 				<strong>Non-refundable except where the law requires:</strong> except for the 14-day right
 				to cancel described below, and except as required by consumer law or by an express refund we
@@ -157,6 +159,7 @@
 				>, gift cards and gift-card balances are <strong>non-refundable</strong> &mdash; they are not
 				redeemable for cash (unless required by law).
 			</p>
+			<!-- keep in sync with $lib/constants/policy -->
 			<p class="mb-3">
 				<strong>14-day right to cancel online purchases:</strong> if you buy a gift card online, the Consumer
 				Contracts (Information, Cancellation and Additional Charges) Regulations 2013 give you a 14-day
@@ -407,6 +407,7 @@
 							<td class="px-3 py-2">6 months after the appointment, then anonymized</td>
 							<td class="px-3 py-2">GDPR storage limitation</td>
 						</tr>
+						<!-- keep in sync with $lib/constants/policy -->
 						<tr>
 							<td class="px-3 py-2">Gift cards</td>
 							<td class="px-3 py-2">
@@ -3,6 +3,18 @@
 	import { resolve } from '$app/paths';
 	import { onMount } from 'svelte';
 	import { SUPPORT_EMAIL, BUSINESS_NAME, BUSINESS_ADDRESS, TRADER_LEGAL_NAME } from '$lib/constants/contact';
+	import {
+		FULL_REFUND_THRESHOLD_HOURS,
+		NO_SHOW_THRESHOLD_HOURS,
+		PARTIAL_REFUND_THRESHOLD_HOURS,
+		PROTECTED_DEPOSIT_MAX_PCT,
+		REQUIRED_DEPOSIT_PCT
+	} from '$lib/constants/policy';
+
+	// Whole-number percents derived from the fractional policy constants so the
+	// legal prose renders "20%" / "50%" without hardcoding the digits.
+	const depositPct = Math.round(REQUIRED_DEPOSIT_PCT * 100);
+	const protectedDepositMaxPct = Math.round(PROTECTED_DEPOSIT_MAX_PCT * 100);

 	let format = $state('html');

@@ -130,9 +142,9 @@
 					delivery is available).
 				</li>
 				<li>
-					Some services require a deposit (typically 20% of the service cost; a
-					protected-deposit cap of 50% may be retained on short-notice cancellation, capped at
-					what you actually paid).
+					Some services require a deposit (typically {depositPct}% of the service cost; a
+					protected-deposit cap of {protectedDepositMaxPct}% may be retained on short-notice
+					cancellation, capped at what you actually paid).
 				</li>
 			</ul>
 			<p class="mb-2 font-medium text-gray-800">Cancellations &amp; rescheduling</p>
@@ -145,16 +157,16 @@
 			</p>
 			<ul class="mb-3 list-disc space-y-1 pl-5">
 				<li>
-					<strong>Notice of more than 72 hours:</strong> you are entitled to a full 100% refund of all
+					<strong>Notice of more than {FULL_REFUND_THRESHOLD_HOURS} hours:</strong> you are entitled to a full 100% refund of all
 					booking payments made.
 				</li>
 				<li>
-					<strong>Notice between 24 and 72 hours:</strong> any booking payments made up to 50% of the
+					<strong>Notice between {PARTIAL_REFUND_THRESHOLD_HOURS} and {FULL_REFUND_THRESHOLD_HOURS} hours:</strong> any booking payments made up to {protectedDepositMaxPct}% of the
 					total booking value are treated as a Protected Deposit. This Protected Deposit is retained to
-					cover the short-notice vacancy, while any balance paid above 50% will be fully refunded.
+					cover the short-notice vacancy, while any balance paid above {protectedDepositMaxPct}% will be fully refunded.
 				</li>
 				<li>
-					<strong>Notice of less than 24 hours:</strong> all booking payments and deposits are entirely
+					<strong>Notice of less than {NO_SHOW_THRESHOLD_HOURS} hours:</strong> all booking payments and deposits are entirely
 					non-refundable and will be retained. The cancellation will be logged as a missed appointment
 					history strike.
 				</li>
@@ -172,8 +184,8 @@
 			<p class="mb-2 font-medium text-gray-800">Deposits</p>
 			<ul class="mb-3 list-disc space-y-1 pl-5">
 				<li>
-					Deposits are retained on cancellation in line with the tiered schedule above (up to 50% of
-					the booking value between 24 and 72 hours' notice; all payments retained under 24 hours).
+					Deposits are retained on cancellation in line with the tiered schedule above (up to {protectedDepositMaxPct}% of
+					the booking value between {PARTIAL_REFUND_THRESHOLD_HOURS} and {FULL_REFUND_THRESHOLD_HOURS} hours' notice; all payments retained under {NO_SHOW_THRESHOLD_HOURS} hours).
 				</li>
 				<li>Deposits are applied to your final bill.</li>
 				<li>If we cancel, any deposit paid is refunded under the business-cancellation terms above.</li>
@@ -263,6 +275,7 @@
 			</h2>
 			<p class="mb-2 font-medium text-gray-800">Gift card expiry</p>
 			<ul class="mb-3 list-disc space-y-1 pl-5">
+				<!-- keep in sync with $lib/constants/policy -->
 				<li>
 					Gift cards expire after the expiry period set in the salon's business settings (24 months
 					after last use by default, and never less than 12 months).
@@ -289,6 +302,7 @@
 				VAT is charged at the point of gift card purchase, not at redemption. When you pay with gift card
 				balance, no additional VAT is charged (it has already been paid).
 			</p>
+			<!-- keep in sync with $lib/constants/policy -->
 			<p class="mb-3">
 				<strong>Right to cancel:</strong> if you buy a gift card online, you can cancel the purchase
 				within 14 days for a refund to the original payment method. If the card has been partly used
@@ -301,6 +315,7 @@
 				>
 				for the full position.
 			</p>
+			<!-- keep in sync with $lib/constants/policy -->
 			<p class="mb-3">
 				<strong>Non-refundable except where the law requires:</strong> except for the 14-day right
 				to cancel online purchases above, and except as required by consumer law or by an express
@@ -318,10 +333,12 @@
 				Purchases made on our Platform (rather than face-to-face in the salon) are
 				<strong>distance contracts</strong> under the Consumer Contracts (Information, Cancellation
 				and Additional Charges) Regulations 2013. This gives you a
+				<!-- keep in sync with $lib/constants/policy -->
 				<strong>14-day right to cancel</strong> most online purchases, running from the day after
 				purchase.
 			</p>
 			<ul class="mb-3 list-disc space-y-1 pl-5">
+				<!-- keep in sync with $lib/constants/policy -->
 				<li>
 					<strong>Gift cards bought online</strong> carry this 14-day right, refunded to the
 					original payment method &mdash; in full if unused, or the unspent balance if partly used
@@ -338,6 +355,7 @@
 					activities), so the 14-day right does not apply to the service itself; our cancellation and
 					refund policy in section 3 applies instead.
 				</li>
+				<!-- keep in sync with $lib/constants/policy -->
 				<li>
 					<strong>How to exercise it:</strong> for gift cards, cancel in-app from your account
 					within 14 days (no email needed); for anything else, email {SUPPORT_EMAIL} within 14 days.