[gniewkob]

Why

Real hosted DEV UAT after exact-SHA V18 release beee6b40e1112765cb07d481bae8f66e72cef543 exposed:

• drag moves a visit into rescheduled_pending and can no longer be re-dragged by the administrator;
• manual 2nd/3rd overlap works inconsistently, while drag refuses all occupied slots;
• concurrent cards visually collide / appear centered rather than in separate columns;
• Calendar V18 was recolored monochrome and had Playfair/Open Sans instead of the already-approved lavender/pastel/Inter Studio V18 dashboard. See apps/panel/src/styles/StudioV18.module.css, source of the existing V18 tokens.

Proposed fix (source only; no DEV/PROD deployment)

• Reuse the approved Studio V18 dashboard palette (#f5f3f8, #d9cdf7, #8069cf, pastel lilac/blush/sage) and Inter typography. Rebind legacy --salon tokens inside V18Foundation only; leave public landing, legacy /calendar and production unchanged. Preserve contrast and non-color status indicators. V18 edit drawer now gets the same appearance as V18 create.
• In V18 FullCalendar only, set slotEventOverlap=false (side-by-side concurrent cards) and 15-minute snap; admin can drag rescheduled_pending to revise the latest proposal.
• Drag to an occupied slot: classify appointment-only vs hard time block; revert optimistic drag; offer explicit admin-only Przenieś mimo to; refresh conflict classification before committing force:true. Never auto-overlap or override an unknown conflict/time block. The ordinary booking drawer continues to offer admin confirmation for a 2nd/3rd appointment.
• Backend: reject non-admin force at controller and service levels; allow admin to re-propose pending time while preserving original prior-accepted slot for client approval; check hard time-block conflicts under the same employee-row lock and transaction as reschedule and create, even under forced overlap. Existing online availability, roles, working-hour and Warsaw DST safeguards remain.
• New regression cases: 3 simultaneous admin bookings, hard block vs forced create/reschedule, controller force permissions, admin pending revision, drag overlap confirmation and hard-block guard, restored V18 palette and font.

Review & release gates

• GitHub CI #43324358523 9/9 PASS on latest PR HEAD 1436076d7e70b487a785370ce3ec44c448e453ee
• API unit, PostgreSQL business flow, Warsaw DST/time-roundtrip and V18 calendar/UI tests PASS; manual risk review of authorization, lock ordering and hard-block invariants completed
• Independent code review of overlaps, role checks and no force bypass of time blocks — BLOCKED: Codex review usage quota reached; not a pass
• Isolated browser real-stack QA #43324350333 PASS, on SAME HEAD: owner/client roles, 390px mobile booking + reschedule + cancel, desktop drag, two simultaneous visits plus a third 15 minutes later, side-by-side geometry, lavender/Inter status cards; synthetic screenshot artifacts. No hosted DEV data or outbound delivery
• Owner review of restored Studio V18 palette and typography on deployed DEV (isolated Chromium palette assertions already PASS)
• Remove or generalize branch-only isolated QA workflow before merge; do not retain a dead push branch filter on master
• Controlled DEV API first then panel deployment of an approved merged SHA; verify health/release, V18 role/UAT. No PROD or landing without separate approval.

Note: existing source master is live on hosted DEV; this PR is review-only until gates pass. Historical #1686 mobile touch gesture is separate and is not claimed as delivered.

Relates to #1531 and #1677.

[gniewkob]

@codex review

Please stress-test the exact PR HEAD for permission escalation on forced reschedule, booking over hard time blocks under Postgres transaction locks, deadlocks/races with time-block writers, pending-reschedule state transitions, third concurrent booking, FullCalendar display behavior, and style isolation vs legacy/production. Report actionable file/line defects; this is DEV UAT follow-up and must not auto-deploy.

[chatgpt-codex-connector]

Codex Review Summary: ❌ Failed

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	❌ Failed 2026-11-12T22:12:59.449692Z We couldn’t complete this review. Comment @codex review to try again.	9307a9a	Manual request

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

[chatgpt-codex-connector]

You have reached your Codex usage limits for code reviews. You can see your limits in the Codex usage dashboard.
To continue using code reviews, you can upgrade your account or add credits to your account and enable them for code reviews in your settings.