Bookable events

The ledger separates what the audit changed, what was kept on purpose, and what has not run in production yet.

1. Fixed in the templates

   • A paid event was free in any currency it had no price in Registration treated a missing or zero price in the chosen currency as "free", and the admin form pre-filled 0 for every enabled currency. Cancelling that free seat then credited the wallet with the price in the default currency: a loop that minted stored credit. Shipped: offeredCurrencies / resolveCharge refuse unpriced currencies; free means free in every currency; refunds use the frozen payment.amount (money-and-time.md). Regression tests in both suites.
   • One declined card attempt deleted the seat payment_intent.payment_failed, sent for each failed attempt while Checkout is still open, deleted the participant. A successful retry then charged the customer for a seat that no longer existed, and the error was swallowed. Shipped: that event is deliberately not handled; only session expiry ends a PENDING registration; late money is refunded (stripe.md).
   • Session expiry was not handled for events The expiry handler covered other payment types only, so abandoned seats waited for the cron. Shipped: checkout.session.expired moves to CHECKOUT_EXPIRED for the participant's current session.
   • Cleanup could delete a participant who had just paid The cron read the status outside the transaction and deleted inside it without re-checking. Shipped: every change is one transaction around the pure state machine; the tick reconciles with Stripe before expiring and fulfils a completed session it finds (participant-lifecycle.md).
   • Refunds were never refunds Card-paid seats were "refunded" as wallet credit at the current price; guests without a wallet got nothing while the response reported a refund; a failed credit was swallowed after the status flipped; Dashboard refunds left the seat confirmed. Shipped: real Stripe refunds of the frozen amount, a durable REFUND_PENDING retried by the tick, charge.refunded handling (registration.md).
   Show 16 moreShow fewer

   • Wallet payments were not atomic Balance check, seat, then debit: three writes; a crash in between left a paid seat unpaid, and the debit had no reference to the seat. Shipped: debit with ref event:<participantId>; the tick settles an interrupted one from the ledger.
   • No webhook idempotency, and errors answered 200 Shipped: event-id claims with stale-claim recovery, no-op transitions, idempotency keys on every Stripe write, and 500 on handler failure so Stripe retries.
   • The admin update wrote the raw request body, without a location check Any field (seat counter, deleted flag, location) could be overwritten, by an admin of any location. Shipped: parseEventInput whitelist, capacity at least seats taken in the transaction, requireStaffForEvent on every [eventId] route (api-routes.md).
   • Cancelling an event refunded nobody A status flip left every participant confirmed and charged. Shipped: a cancel-event action that closes registration, then refunds and releases every seat; the edit form cannot set cancelled.
   • Registration trusted a player id from the request body Anyone could attach a registration to another account, whose owner could then cancel it and collect the refund. Shipped: identity from the session only; guests use an HMAC manage link.
   • Unpaid seats outlived failed session creation The seat was written before Checkout, and a Checkout error (for example a payment method valid for only one currency) left it held for half an hour. Shipped: the seat is released the moment session creation fails; payment methods follow the Dashboard instead of a hard-coded list.
   • "Pay again" could never work The cleanup ran 30 minutes after registration while sessions lived 24 hours, and a new session did not expire the old one, leaving two payable sessions per seat. Shipped: 30-minute sessions, attempt-scoped idempotency keys, old session expired on resume, expiry honoured only for the current session.
   • The cron was open when its secret was unset Shipped: fail closed, constant-time comparison.
   • Times were UTC pretending to be local "Today" was UTC's date; slot instants were built by appending Z to local wall-clock strings. Shipped: IANA zone on every event, zonedToUtc, todayIn (money-and-time.md).
   • Smaller defects A slot-block setting could not be switched off once set (dropped undefined key); the customer lookup for Stripe matched by email only; draft and deleted events were publicly readable; event emails did not exist; the success redirect landed on the home page with a query parameter nothing read; participant lists were hard-coded in one language; the paid amount and currency were not shown to staff. Slot blocking stays with the host's booking module, so the first item is out of scope here; each of the others is addressed in the corresponding reference.
   • An old session's expiry could release a resumed seat Found by the agent eval of 0.1.1, in the templates themselves. "Pay again" expired the old session before the new one was stored, and the webhook compared session ids outside the transaction, so the old session's expired event could release the seat the customer was paying for; the payment then came back as late money. Shipped: resume clears the stored session ids first; CHECKOUT_EXPIRED carries the session it saw and the machine ignores one that is no longer current. A lifecycle test delivers the webhook mid-resume.
   • A second payment for a paid seat was never refunded Found by the same eval. Two Checkout tabs paid for one seat: the second TICKET_PAID failed the transition, the webhook answered 500 until Stripe gave up, and the money stayed. Shipped: it raises LatePaymentError, so the webhook refunds it; a payment already recorded is a no-op in every status. A lifecycle test pays twice.
   • Cancelling an event skipped guests already checked in Found by the same eval. The no-cancel-after-arrival rule applied to every actor, so a cancelled event left arrived guests charged and reported them as failures on every re-run. Shipped: the rule binds the customer only; staff and the event cancel refund arrived guests. A lifecycle test cancels after check-in.
   • The check-in list lacked its own header Found by the same eval. The screen in ui.md shows the event name and times, and the list route returned only capacity and seats taken. Shipped: the route returns name, date, times and zone.
   • A refunded second payment reported the paid seat as refunded Found by the agent eval of 0.1.2, in the fix for entry 17. Refunding the second payment sends charge.refunded for that payment, and the handler applied it to the participant whose seat the first payment holds, releasing it. Shipped: charge.refunded is ignored unless it names the participant's own payment intent. The second-payment lifecycle test delivers that webhook.
   • A guest back from Checkout could not read their status Found by the same eval. The success URL carried only the participant id, and the status route needs the session owner or the manage token, so a guest's "registered" page could not poll. Shipped: urls.success receives the manage token, and the host's URL carries it as t.