From a2f01f9d80ba384f4ced7794c69f20cdfdf87746 Mon Sep 17 00:00:00 2001
From: Kaustav Ghosh <44238657+teetangh@users.noreply.github.com>
Date: Sat, 29 Aug 2026 13:24:29 +0530
Subject: [PATCH 01/10] feat(feedback): feedback belongs to a call, a review
 belongs to a consultant
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Two corrections to the model #1267 shipped, made after looking at the screen it
produced: it asked for two near-identical star ratings stacked on top of each
other, and neither was attached to the thing the user thought they were rating.

**Feedback moves to the CALL.** An appointment is not a session — a subscription
booking holds up to 24 of them and a class holds about four — so one rating per
appointment meant a single score for a three-month package, arriving months after
the sessions it described. Urban Company rates every job, and a job is one visit;
this is the same unit. `AppointmentFeedback` gains `slotOfAppointmentId`, the
unique moves to (slot, user), and `appointmentId` stays denormalized because the
org quality aggregate and every booking-scoped read filter on it. The POST now
verifies the slot actually belongs to the booking, or a caller holding only an
appointment id could rate a call from someone else's session run.

**Reviews move back to the CONSULTANT.** Practo allows one feedback per patient
per doctor however many visits they make, and that is the right shape: a reader
wants one considered opinion of a person, not four near-identical ones from the
same client. `appointmentId` stays on the row as PROVENANCE — which session
prompted or last updated the review — which is what still makes "verified
booking" a fact rather than a claim. Group weighting is untouched: two hundred
webinar attendees are two hundred distinct consultees either way, and
`ratingUnitId` still collapses them to one data point.

`isAnonymous` rides along. Authenticity never depends on the displayed name here
— the review is welded to a paid, attended session — so the name is a privacy
choice, and the Airbnb experiment in our own research found the fear of being
identified measurably suppresses honest criticism.

**The support drawer stops pretending.** Per-bubble USER/BOT captions are gone —
nobody labels their own messages, and "BOT" sat directly under a header claiming
you were connected with the support team. The transcript is bottom-aligned
against the composer instead of stranded at the top of an empty panel, and the
hand-off to a human is finally marked, including the case where the thread has
escalated but no staff reply has landed yet, which is what the reported
screenshot showed.

**And a regression of mine, fixed.** `persistHumanTurn` had become an
interactive transaction with six sequential round trips. With PG_POOL_MAX=1
serialising everything onto one connection, and a cold instance stretching 400ms
of idle await into twenty-plus seconds, that blew Prisma's 5s default and
reached the user as "something went wrong" — the toast on an escalated thread.
It is two writes again: the CAS and the sequence allocation are one statement,
and the SLA clock and staff notification happen after the commit, because
neither is an invariant of the message being stored. It also takes the
ALLOCATION_TX budget the other two transactions already had.

Part of #705

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01Fb4vbRYxJH7wxc4tjhm6XJ
---
 .../payments/idempotency-minting.test.ts      |   4 +-
 .../[appointmentId]/feedback/route.ts         |  69 ++++-
 components/support/PlatformSupportSheet.tsx   | 246 +++++++++---------
 components/support/SupportThreadSheet.tsx     | 183 +++++++------
 lib/support/service.ts                        | 127 +++++----
 prisma/schema.prisma                          |  59 +++--
 prisma/sql/check-constraints.sql              |  16 --
 7 files changed, 401 insertions(+), 303 deletions(-)

diff --git a/__tests__/payments/idempotency-minting.test.ts b/__tests__/payments/idempotency-minting.test.ts
index dbf4eb647..a265ca798 100644
--- a/__tests__/payments/idempotency-minting.test.ts
+++ b/__tests__/payments/idempotency-minting.test.ts
@@ -59,7 +59,9 @@ describe("idempotency keys are always minted (#1093 §3)", () => {
     // Live, and below the banner — these are the ones the old split lost.
     expect(names).toContain("appointment_doc_thread_version_unique");
     expect(names).toContain("onboarding_draft_payload_size");
-    expect(names).toContain("consultant_review_legacy_pair_key");
+    // `consultant_review_legacy_pair_key` used to live here. Reviews are now one
+    // per (consultant, consultee), which Prisma expresses as a real @@unique, so
+    // the sidecar's partial index was retired rather than left shadowing it.
     // `IF NOT EXISTS` must not be captured as an index name.
     expect(names).not.toContain("IF");
   });
diff --git a/app/api/appointments/[appointmentId]/feedback/route.ts b/app/api/appointments/[appointmentId]/feedback/route.ts
index a791b64e3..585c20dbf 100644
--- a/app/api/appointments/[appointmentId]/feedback/route.ts
+++ b/app/api/appointments/[appointmentId]/feedback/route.ts
@@ -1,8 +1,11 @@
 /**
- * #appt-support — private per-participant CSAT for an appointment (1–5 + note),
- * distinct from the public ConsultantReview. One per (appointment, user), upsert
- * so re-submitting edits. Gives webinar/class attendees a feedback path they
- * lacked and feeds an org-level quality signal.
+ * #appt-support — private per-participant CSAT for ONE VIDEO CALL (1–5 + note),
+ * distinct from the public ConsultantReview. Upsert, so re-submitting edits.
+ *
+ * Per call, not per appointment: an appointment is not a session. A subscription
+ * booking holds up to 24 of them, so one rating per appointment meant a single
+ * score for a three-month package, arriving months after the sessions it
+ * described. GET returns every call of this booking the caller has rated.
  */
 
 import { NextRequest, NextResponse } from "next/server";
@@ -10,10 +13,7 @@ import { z } from "zod";
 import prisma from "@/lib/prisma";
 import { appointmentRaterRole } from "@/lib/data/appointment-detail";
 import { AppointmentIdParams } from "@/schemas/support";
-import {
-  parseRouteParams,
-  supportError,
-} from "@/lib/api/support-http";
+import { parseRouteParams, supportError } from "@/lib/api/support-http";
 import {
   authorizeAppointment,
   appointmentAuthzError,
@@ -24,6 +24,8 @@ const FEEDBACK_ROUTE = "appointments.feedback";
 const feedbackSchema = z.object({
   rating: z.number().int().min(1).max(5),
   comment: z.string().trim().max(2000).optional(),
+  /** Which call of this booking is being rated. */
+  slotId: z.string().min(1).max(64),
 });
 
 export async function GET(
@@ -38,10 +40,23 @@ export async function GET(
   try {
     const auth = await authorizeAppointment(appointmentId);
     if ("code" in auth) {
-      return appointmentAuthzError(auth, { route: FEEDBACK_ROUTE, appointmentId });
+      return appointmentAuthzError(auth, {
+        route: FEEDBACK_ROUTE,
+        appointmentId,
+      });
     }
-    const feedback = await prisma.appointmentFeedback.findUnique({
-      where: { appointmentId_userId: { appointmentId, userId: auth.userId } },
+    // Every call of this booking the caller has rated, so the detail page can
+    // show a per-session breakdown rather than one number for the package.
+    const feedback = await prisma.appointmentFeedback.findMany({
+      where: { appointmentId, userId: auth.userId },
+      select: {
+        id: true,
+        slotOfAppointmentId: true,
+        rating: true,
+        comment: true,
+        createdAt: true,
+      },
+      orderBy: { createdAt: "asc" },
     });
     return NextResponse.json({ data: feedback });
   } catch (cause) {
@@ -66,7 +81,10 @@ export async function POST(
   try {
     const auth = await authorizeAppointment(appointmentId);
     if ("code" in auth) {
-      return appointmentAuthzError(auth, { route: FEEDBACK_ROUTE, appointmentId });
+      return appointmentAuthzError(auth, {
+        route: FEEDBACK_ROUTE,
+        appointmentId,
+      });
     }
     // CSAT is a PARTICIPANT's private rating: staff/admin read access must
     // not become write access — a privileged non-participant's row would
@@ -94,9 +112,34 @@ export async function POST(
       });
     }
 
+    // The slot must belong to THIS appointment: without the check a caller
+    // could rate a call from a booking they merely have access to the id of.
+    const slot = await prisma.slotOfAppointment.findFirst({
+      where: {
+        id: body.data.slotId,
+        appointmentId,
+        deletedAt: null,
+      },
+      select: { id: true },
+    });
+    if (!slot) {
+      return supportError({
+        status: 404,
+        code: "NOT_FOUND",
+        message: "That session isn't part of this booking",
+        context: { route: FEEDBACK_ROUTE, action: "save", appointmentId },
+      });
+    }
+
     const feedback = await prisma.appointmentFeedback.upsert({
-      where: { appointmentId_userId: { appointmentId, userId: auth.userId } },
+      where: {
+        slotOfAppointmentId_userId: {
+          slotOfAppointmentId: slot.id,
+          userId: auth.userId,
+        },
+      },
       create: {
+        slotOfAppointmentId: slot.id,
         appointmentId,
         userId: auth.userId,
         organizationId: auth.organizationId,
diff --git a/components/support/PlatformSupportSheet.tsx b/components/support/PlatformSupportSheet.tsx
index 4d3bc11da..814f9edc7 100644
--- a/components/support/PlatformSupportSheet.tsx
+++ b/components/support/PlatformSupportSheet.tsx
@@ -14,14 +14,7 @@
 
 import { useEffect, useRef, useState } from "react";
 import { useMutation, useQuery, useQueryClient } from "@tanstack/react-query";
-import {
-  LifeBuoy,
-  Send,
-  UserRound,
-  Bot,
-  CheckCircle2,
-  Ticket,
-} from "lucide-react";
+import { LifeBuoy, Send, CheckCircle2, Ticket } from "lucide-react";
 import {
   Sheet,
   SheetContent,
@@ -309,141 +302,140 @@ export function PlatformSupportSheet({
           </SheetDescription>
         </SheetHeader>
 
-        <div className="flex-1 space-y-3 overflow-y-auto px-5 pb-2">
-          {!flowId &&
-            (catalog.isLoading ? (
-              <p className="text-sm text-muted-foreground">Loading…</p>
-            ) : catalog.isError ? (
-              <div className="rounded-lg border border-dashed border-border p-3 text-sm text-muted-foreground">
-                {(catalog.error as Error)?.message ??
-                  "Couldn't load support topics."}{" "}
-                <Button
-                  variant="outline"
-                  size="sm"
-                  className="ml-1"
-                  onClick={() => catalog.refetch()}
-                >
-                  Retry
-                </Button>
-              </div>
-            ) : (
-              <div className="flex flex-col gap-2">
-                {(catalog.data ?? []).map((f) => (
+        {/* Bottom-aligned like the per-appointment drawer: a short transcript
+            sits against the composer rather than at the top of an empty panel. */}
+        <div className="flex-1 overflow-y-auto px-5 pb-2">
+          <div className="flex min-h-full flex-col justify-end space-y-3">
+            {!flowId &&
+              (catalog.isLoading ? (
+                <p className="text-sm text-muted-foreground">Loading…</p>
+              ) : catalog.isError ? (
+                <div className="rounded-lg border border-dashed border-border p-3 text-sm text-muted-foreground">
+                  {(catalog.error as Error)?.message ??
+                    "Couldn't load support topics."}{" "}
                   <Button
-                    key={f.id}
                     variant="outline"
-                    disabled={turn.isPending}
-                    className="h-auto justify-start py-2 text-left"
-                    onClick={() => startFlow(f)}
+                    size="sm"
+                    className="ml-1"
+                    onClick={() => catalog.refetch()}
                   >
-                    <span>
-                      <span className="block text-sm font-medium">
-                        {f.title}
-                      </span>
-                      <span className="block text-xs text-muted-foreground">
-                        {f.description}
-                      </span>
-                    </span>
+                    Retry
                   </Button>
-                ))}
-              </div>
-            ))}
+                </div>
+              ) : (
+                <div className="flex flex-col gap-2">
+                  {(catalog.data ?? []).map((f) => (
+                    <Button
+                      key={f.id}
+                      variant="outline"
+                      disabled={turn.isPending}
+                      className="h-auto justify-start py-2 text-left"
+                      onClick={() => startFlow(f)}
+                    >
+                      <span>
+                        <span className="block text-sm font-medium">
+                          {f.title}
+                        </span>
+                        <span className="block text-xs text-muted-foreground">
+                          {f.description}
+                        </span>
+                      </span>
+                    </Button>
+                  ))}
+                </div>
+              ))}
 
-          {messages.map((m) => (
-            <div
-              key={m.id}
-              className={
-                m.sender === "USER" ? "flex justify-end" : "flex justify-start"
-              }
-            >
+            {messages.map((m) => (
               <div
+                key={m.id}
                 className={
-                  "max-w-[85%] rounded-2xl px-3 py-2 text-sm transition-opacity " +
-                  (m.sender === "USER"
-                    ? "bg-primary text-primary-foreground"
-                    : "bg-muted text-foreground") +
-                  (m.pending ? " opacity-70" : "")
+                  m.sender === "USER"
+                    ? "flex justify-end"
+                    : "flex justify-start"
                 }
               >
-                <span className="mb-0.5 flex items-center gap-1 text-[10px] uppercase tracking-wide opacity-60">
-                  {m.sender === "USER" ? (
-                    <UserRound className="h-3 w-3" />
-                  ) : (
-                    <Bot className="h-3 w-3" />
-                  )}
-                  {m.sender.toLowerCase()}
-                </span>
-                {m.body}
+                {/* No per-bubble "USER"/"BOT" caption — side and colour say it. */}
+                <div
+                  className={
+                    "max-w-[85%] rounded-2xl px-3 py-2 text-sm transition-opacity " +
+                    (m.sender === "USER"
+                      ? "bg-primary text-primary-foreground"
+                      : "bg-muted text-foreground") +
+                    (m.pending ? " opacity-70" : "")
+                  }
+                >
+                  {m.body}
+                </div>
               </div>
-            </div>
-          ))}
+            ))}
 
-          {turn.isPending && (
-            <div className="flex justify-start">
-              <div
-                className="flex items-center gap-1 rounded-2xl bg-muted px-3 py-2.5"
-                role="status"
-                aria-label="Support is typing"
-              >
-                {[0, 150, 300].map((delay) => (
-                  <span
-                    key={delay}
-                    className="h-1.5 w-1.5 animate-bounce rounded-full bg-foreground/40"
-                    style={{ animationDelay: `${delay}ms` }}
-                  />
-                ))}
+            {turn.isPending && (
+              <div className="flex justify-start">
+                <div
+                  className="flex items-center gap-1 rounded-2xl bg-muted px-3 py-2.5"
+                  role="status"
+                  aria-label="Support is typing"
+                >
+                  {[0, 150, 300].map((delay) => (
+                    <span
+                      key={delay}
+                      className="h-1.5 w-1.5 animate-bounce rounded-full bg-foreground/40"
+                      style={{ animationDelay: `${delay}ms` }}
+                    />
+                  ))}
+                </div>
               </div>
-            </div>
-          )}
+            )}
 
-          {done?.resolved && !done.collectFeedback && (
-            <Badge variant="secondary" className="mt-1">
-              <CheckCircle2 className="mr-1 h-3 w-3" /> Resolved
-            </Badge>
-          )}
+            {done?.resolved && !done.collectFeedback && (
+              <Badge variant="secondary" className="mt-1">
+                <CheckCircle2 className="mr-1 h-3 w-3" /> Resolved
+              </Badge>
+            )}
 
-          {done?.collectFeedback && (
-            <div className="space-y-2">
-              <Textarea
-                rows={4}
-                maxLength={2000}
-                value={feedback}
-                onChange={(e) => setFeedback(e.target.value)}
-                placeholder="What would you change?"
-              />
-              <Button
-                size="sm"
-                disabled={!feedback.trim() || sendFeedback.isPending}
-                onClick={() => sendFeedback.mutate(feedback.trim())}
-              >
-                Send to the product team
-              </Button>
-            </div>
-          )}
-          {done && !done.resolved && done.ticketId && (
-            <div className="rounded-lg border border-dashed border-border bg-card px-3 py-2 text-xs text-muted-foreground">
-              <Ticket className="mr-1 inline h-3 w-3" />
-              {/* The reference is the whole point of minting one: it is what
+            {done?.collectFeedback && (
+              <div className="space-y-2">
+                <Textarea
+                  rows={4}
+                  maxLength={2000}
+                  value={feedback}
+                  onChange={(e) => setFeedback(e.target.value)}
+                  placeholder="What would you change?"
+                />
+                <Button
+                  size="sm"
+                  disabled={!feedback.trim() || sendFeedback.isPending}
+                  onClick={() => sendFeedback.mutate(feedback.trim())}
+                >
+                  Send to the product team
+                </Button>
+              </div>
+            )}
+            {done && !done.resolved && done.ticketId && (
+              <div className="rounded-lg border border-dashed border-border bg-card px-3 py-2 text-xs text-muted-foreground">
+                <Ticket className="mr-1 inline h-3 w-3" />
+                {/* The reference is the whole point of minting one: it is what
                   survives the channel change when the user follows up by
                   email or on a call. */}
-              {done.ticketReference ? (
-                <>
-                  Request{" "}
-                  <span className="font-mono text-foreground">
-                    {done.ticketReference}
-                  </span>{" "}
-                  created — quote it if you follow up. Our team will reply here
-                  in &quot;My requests&quot; and by email.
-                </>
-              ) : (
-                <>
-                  Ticket created — our team will reply here in &quot;My
-                  requests&quot; and by email.
-                </>
-              )}
-            </div>
-          )}
-          <div ref={endRef} />
+                {done.ticketReference ? (
+                  <>
+                    Request{" "}
+                    <span className="font-mono text-foreground">
+                      {done.ticketReference}
+                    </span>{" "}
+                    created — quote it if you follow up. Our team will reply
+                    here in &quot;My requests&quot; and by email.
+                  </>
+                ) : (
+                  <>
+                    Ticket created — our team will reply here in &quot;My
+                    requests&quot; and by email.
+                  </>
+                )}
+              </div>
+            )}
+            <div ref={endRef} />
+          </div>
         </div>
 
         {flowId && !done && (
diff --git a/components/support/SupportThreadSheet.tsx b/components/support/SupportThreadSheet.tsx
index a72fe5bad..8ff2427a9 100644
--- a/components/support/SupportThreadSheet.tsx
+++ b/components/support/SupportThreadSheet.tsx
@@ -12,7 +12,7 @@
 import { useEffect, useRef, useState } from "react";
 import Link from "next/link";
 import { useMutation, useQuery, useQueryClient } from "@tanstack/react-query";
-import { CalendarDays, LifeBuoy, Send, UserRound, Bot } from "lucide-react";
+import { CalendarDays, LifeBuoy, Send } from "lucide-react";
 import {
   Sheet,
   SheetContent,
@@ -67,7 +67,11 @@ interface TurnResult {
   activeChannel: string;
   currentNodeId: string | null;
   /** The bot's own reply. Rendered straight from here — see `onSuccess`. */
-  messages: { sender: Sender; body: string; metadata?: MessageMetadata | null }[];
+  messages: {
+    sender: Sender;
+    body: string;
+    metadata?: MessageMetadata | null;
+  }[];
   escalated: boolean;
   resolved: boolean;
   actions: SupportAction[];
@@ -188,9 +192,7 @@ export function SupportThreadSheet({
       const said = vars.userMessage ?? vars.chosenLabel;
       if (said) {
         qc.setQueryData<ThreadData>(queryKey, (old) =>
-          appendMessages(old, [
-            { sender: "USER", body: said, pending: true },
-          ]),
+          appendMessages(old, [{ sender: "USER", body: said, pending: true }]),
         );
       }
       return { previous };
@@ -290,6 +292,13 @@ export function SupportThreadSheet({
     !isHuman && !isResolved ? (activePrompt?.metadata?.options ?? []) : [];
   const started = !!thread;
   const turnPending = turn.isPending;
+  // The hand-off sits immediately before the first AGENT message. A thread that
+  // has escalated but whose staff reply has not landed yet still gets the
+  // marker, at the end — otherwise the drawer looks like the bot simply gave
+  // up on the user.
+  const firstAgent = messages.findIndex((m) => m.sender === "AGENT");
+  const handoffIndex =
+    firstAgent >= 0 ? firstAgent : isHuman ? messages.length : -1;
 
   // Keep the newest bubble in view. The transcript is a plain overflow
   // container, so past the drawer height every reply lands below the fold and
@@ -334,81 +343,106 @@ export function SupportThreadSheet({
           </SheetDescription>
         </SheetHeader>
 
-        {/* Conversation */}
-        <div className="flex-1 space-y-3 overflow-y-auto px-5 pb-2">
-          {!started && (
-            <p className="text-sm text-muted-foreground">
-              What do you need help with?
-            </p>
-          )}
-          {messages.map((m) => (
-            <div
-              key={m.id}
-              className={
-                m.sender === "USER" ? "flex justify-end" : "flex justify-start"
-              }
-            >
-              <div
-                className={
-                  "max-w-[85%] rounded-2xl px-3 py-2 text-sm transition-opacity " +
-                  (m.sender === "USER"
-                    ? "bg-primary text-primary-foreground"
-                    : "bg-muted text-foreground") +
-                  (m.pending ? " opacity-70" : "")
-                }
-              >
-                <span className="mb-0.5 flex items-center gap-1 text-[10px] uppercase tracking-wide opacity-60">
-                  {m.sender === "USER" ? (
-                    <UserRound className="h-3 w-3" />
-                  ) : (
-                    <Bot className="h-3 w-3" />
-                  )}
-                  {m.sender === "AGENT" ? "Support" : m.sender.toLowerCase()}
-                </span>
-                {m.body}
+        {/* Conversation. The inner wrapper bottom-aligns a short transcript
+            against the composer instead of stranding it at the top of an empty
+            panel, and still scrolls normally once it outgrows the drawer. */}
+        <div className="flex-1 overflow-y-auto px-5 pb-2">
+          <div className="flex min-h-full flex-col justify-end space-y-3">
+            {!started && (
+              <p className="text-sm text-muted-foreground">
+                What do you need help with?
+              </p>
+            )}
+            {messages.map((m, i) => (
+              <div key={m.id}>
+                {/* Where the bot stopped and a person took over. Without it the
+                    hand-off is invisible inside the drawer even though the page
+                    behind it says "With our team". */}
+                {i === handoffIndex && (
+                  <div className="mb-3 flex items-center gap-2">
+                    <span className="h-px flex-1 bg-border" />
+                    <span className="text-[11px] text-muted-foreground">
+                      Passed to our support team
+                    </span>
+                    <span className="h-px flex-1 bg-border" />
+                  </div>
+                )}
+                <div
+                  className={
+                    m.sender === "USER"
+                      ? "flex justify-end"
+                      : "flex justify-start"
+                  }
+                >
+                  {/* No "USER"/"BOT" caption: nobody labels their own messages,
+                      and "BOT" contradicted the header's "you're connected with
+                      our support team". Side and colour carry the speaker; the
+                      divider above carries who is answering. */}
+                  <div
+                    className={
+                      "max-w-[85%] rounded-2xl px-3 py-2 text-sm transition-opacity " +
+                      (m.sender === "USER"
+                        ? "bg-primary text-primary-foreground"
+                        : "bg-muted text-foreground") +
+                      (m.pending ? " opacity-70" : "")
+                    }
+                  >
+                    {m.body}
+                  </div>
+                </div>
               </div>
-            </div>
-          ))}
+            ))}
 
-          {/* The bot is working. Uber's own write-up calls this out as the
+            {/* The bot is working. Uber's own write-up calls this out as the
               contract of a request/response flow engine: the user waits, and a
               visual indicator tells them why. */}
-          {turnPending && (
-            <div className="flex justify-start">
-              <div
-                className="flex items-center gap-1 rounded-2xl bg-muted px-3 py-2.5"
-                role="status"
-                aria-label="Support is typing"
-              >
-                {[0, 150, 300].map((delay) => (
-                  <span
-                    key={delay}
-                    className="h-1.5 w-1.5 animate-bounce rounded-full bg-foreground/40"
-                    style={{ animationDelay: `${delay}ms` }}
-                  />
-                ))}
+            {handoffIndex === messages.length && (
+              <div className="flex items-center gap-2">
+                <span className="h-px flex-1 bg-border" />
+                <span className="text-[11px] text-muted-foreground">
+                  Passed to our support team
+                </span>
+                <span className="h-px flex-1 bg-border" />
               </div>
-            </div>
-          )}
+            )}
 
-          {/* Offered actions from the latest turn (informational, not executed) */}
-          {lastActions.map(describeAction).map((desc, i) =>
-            desc ? (
-              <div
-                key={i}
-                className="rounded-lg border border-dashed border-border bg-card px-3 py-2 text-xs text-muted-foreground"
-              >
-                {desc}
+            {turnPending && (
+              <div className="flex justify-start">
+                <div
+                  className="flex items-center gap-1 rounded-2xl bg-muted px-3 py-2.5"
+                  role="status"
+                  aria-label="Support is typing"
+                >
+                  {[0, 150, 300].map((delay) => (
+                    <span
+                      key={delay}
+                      className="h-1.5 w-1.5 animate-bounce rounded-full bg-foreground/40"
+                      style={{ animationDelay: `${delay}ms` }}
+                    />
+                  ))}
+                </div>
               </div>
-            ) : null,
-          )}
+            )}
 
-          {isResolved && (
-            <Badge variant="secondary" className="mt-1">
-              Resolved
-            </Badge>
-          )}
-          <div ref={endRef} />
+            {/* Offered actions from the latest turn (informational, not executed) */}
+            {lastActions.map(describeAction).map((desc, i) =>
+              desc ? (
+                <div
+                  key={i}
+                  className="rounded-lg border border-dashed border-border bg-card px-3 py-2 text-xs text-muted-foreground"
+                >
+                  {desc}
+                </div>
+              ) : null,
+            )}
+
+            {isResolved && (
+              <Badge variant="secondary" className="mt-1">
+                Resolved
+              </Badge>
+            )}
+            <div ref={endRef} />
+          </div>
         </div>
 
         {/* Controls */}
@@ -438,7 +472,10 @@ export function SupportThreadSheet({
                     size="sm"
                     disabled={turnPending}
                     onClick={() =>
-                      turn.mutate({ category: i.category, chosenLabel: i.label })
+                      turn.mutate({
+                        category: i.category,
+                        chosenLabel: i.label,
+                      })
                     }
                   >
                     {i.label}
diff --git a/lib/support/service.ts b/lib/support/service.ts
index f52e13872..4dfad2edf 100644
--- a/lib/support/service.ts
+++ b/lib/support/service.ts
@@ -330,72 +330,76 @@ async function persistHumanTurn(
   // "ESCALATED", so once ops resolved the thread the user's own message came
   // back claiming it was still with the team.
   let status = thread.status;
-  // Identifies this specific message to the notification dedupe — see
-  // notifyStaffOfTicketActivity.
   let messageId: string | null = null;
 
   if (userMessage) {
-    status = await prisma.$transaction(async (tx) => {
-      // CAS on the write, not just the read: a CLOSED thread is one the PATCH
-      // route explicitly refuses to reopen, so a message must not land on it
-      // and silently bump its activity clock either.
-      const moved = await tx.appointmentSupportThread.updateMany({
-        where: { id: thread.id, status: { notIn: ["CLOSED", "RESOLVED"] } },
-        data: { lastMessageAt: new Date() },
-      });
-      if (moved.count === 0) {
-        const current = await tx.appointmentSupportThread.findUniqueOrThrow({
+    // Deliberately SHORT. On Netlify PG_POOL_MAX=1 serialises every query onto
+    // one connection, and a cold instance can stretch 400ms of idle await into
+    // twenty-plus seconds — so an interactive transaction holding that
+    // connection across six sequential round trips blew Prisma's 5s default and
+    // surfaced to the user as "something went wrong". Two writes here; the SLA
+    // clock and the notification both happen after the commit, because neither
+    // is an invariant of the message being stored.
+    const written = await prisma.$transaction(
+      async (tx) => {
+        // The CAS and the sequence allocation are the SAME statement: a CLOSED
+        // or RESOLVED thread is one the PATCH route refuses to reopen, so a
+        // message must not land on it or bump its activity clock.
+        const moved = await tx.appointmentSupportThread.updateMany({
+          where: { id: thread.id, status: { notIn: ["CLOSED", "RESOLVED"] } },
+          data: { messageSeq: { increment: 1 }, lastMessageAt: new Date() },
+        });
+        if (moved.count === 0) return null;
+
+        const row = await tx.appointmentSupportThread.findUniqueOrThrow({
           where: { id: thread.id },
-          select: { status: true },
+          select: { messageSeq: true },
         });
-        return current.status;
-      }
-      const seq = await allocateMessageSeq(tx, thread.id, 1);
-      const written = await tx.supportMessage.create({
-        data: {
-          threadId: thread.id,
-          sender: "USER",
-          body: userMessage,
-          seq: seq + 1,
-        },
-        select: { id: true },
+        return tx.supportMessage.create({
+          data: {
+            threadId: thread.id,
+            sender: "USER",
+            body: userMessage,
+            seq: row.messageSeq,
+          },
+          select: { id: true },
+        });
+      },
+      { maxWait: ALLOCATION_TX_MAX_WAIT_MS, timeout: ALLOCATION_TX_TIMEOUT_MS },
+    );
+
+    if (!written) {
+      // The thread settled underneath us. Report where it actually landed
+      // rather than claiming the message went somewhere.
+      const current = await prisma.appointmentSupportThread.findUniqueOrThrow({
+        where: { id: thread.id },
+        select: { status: true },
       });
+      status = current.status;
+    } else {
       messageId = written.id;
+
+      // Post-commit, and best-effort. A clock that resumes a moment late is a
+      // rounding error on a 15-day deadline; a message that failed to store
+      // because the clock update timed out is a lost customer message.
       if (thread.supportTicketId) {
-        const ticket = await tx.supportTicket.findUnique({
-          where: { id: thread.supportTicketId },
-          select: { awaitingUserSince: true, pausedSeconds: true },
+        await resumeTicketClock(thread.supportTicketId).catch((error) => {
+          console.error("support: SLA resume failed", {
+            ticketId: thread.supportTicketId,
+            error,
+          });
         });
-        await tx.supportTicket.update({
-          where: { id: thread.supportTicketId },
-          data: {
-            lastMessageAt: new Date(),
-            // The ball is back with us, so the resolution clock restarts.
-            ...(ticket ? userRepliedPatch(ticket) : {}),
-          },
+        await notifyStaffOfTicketActivity(
+          thread.supportTicketId,
+          thread.organizationId,
+          messageId ?? undefined,
+        ).catch((error) => {
+          console.error("support: user-reply notification failed", {
+            threadId: thread.id,
+            error,
+          });
         });
       }
-      return thread.status;
-    });
-
-    // A user reply into an escalated thread used to page nobody — staff only
-    // learned of it by reopening the inbox. Fire-and-forget after the commit,
-    // for the same reason every other notification here is.
-    if (
-      thread.supportTicketId &&
-      status !== "CLOSED" &&
-      status !== "RESOLVED"
-    ) {
-      await notifyStaffOfTicketActivity(
-        thread.supportTicketId,
-        thread.organizationId,
-        messageId ?? undefined,
-      ).catch((error) => {
-        console.error("support: user-reply notification failed", {
-          threadId: thread.id,
-          error,
-        });
-      });
     }
   }
 
@@ -412,6 +416,19 @@ async function persistHumanTurn(
   };
 }
 
+/** The ball is back with us, so the resolution clock restarts. */
+async function resumeTicketClock(ticketId: string): Promise<void> {
+  const ticket = await prisma.supportTicket.findUnique({
+    where: { id: ticketId },
+    select: { awaitingUserSince: true, pausedSeconds: true },
+  });
+  if (!ticket) return;
+  await prisma.supportTicket.update({
+    where: { id: ticketId },
+    data: { lastMessageAt: new Date(), ...userRepliedPatch(ticket) },
+  });
+}
+
 /** Hand the thread to a human: persist the exchange, create/link a SupportTicket
  *  in the existing ops queue, and flip the channel to HUMAN. */
 async function escalate(
diff --git a/prisma/schema.prisma b/prisma/schema.prisma
index 74ecbe35c..5a2bfc44b 100644
--- a/prisma/schema.prisma
+++ b/prisma/schema.prisma
@@ -555,7 +555,16 @@ enum SupportFlowOutcomeKind {
 // ConsultantReview. Gives webinar/class a feedback path they lack today and
 // feeds the org-level quality signal. One per (appointment, user).
 model AppointmentFeedback {
-  id             String        @id @default(uuid())
+  id String @id @default(uuid())
+
+  // The call being rated. Nullable only for rows written before feedback moved
+  // to the per-call unit; the API requires it.
+  slotOfAppointment   SlotOfAppointment? @relation(fields: [slotOfAppointmentId], references: [id], onDelete: Cascade)
+  slotOfAppointmentId String?
+
+  // Kept alongside the slot: the org quality aggregate and every appointment-
+  // scoped read filter on this, and denormalizing it avoids a join on the
+  // hottest path.
   appointmentId  String
   appointment    Appointment   @relation(fields: [appointmentId], references: [id], onDelete: Cascade)
   userId         String
@@ -576,7 +585,12 @@ model AppointmentFeedback {
 
   createdAt DateTime @default(now())
 
-  @@unique([appointmentId, userId])
+  // One rating per person per CALL. Rows predating the column carry a NULL slot
+  // and Postgres treats a NULL key as distinct, so they coexist rather than
+  // colliding on the appointment they share.
+  @@unique([slotOfAppointmentId, userId])
+  // Still the unit for "show me this booking's feedback".
+  @@index([appointmentId, userId])
   // The org aggregate filters raterRole before the date range, so
   // (organizationId, createdAt) is no longer a usable prefix for it.
   @@index([organizationId, raterRole, createdAt])
@@ -2872,12 +2886,12 @@ model ConsultantReview {
   consulteeProfile   ConsulteeProfile @relation(fields: [consulteeProfileId], references: [id], onUpdate: Cascade, onDelete: Cascade)
   consulteeProfileId String
 
-  // #705 — the session that earned the review. This is what makes "verified
-  // booking" a fact rather than a claim, and it is what lets a repeat client
-  // review each session instead of being locked out forever by the old
-  // per-pair unique. SetNull, not Cascade: tombstoning an appointment must not
-  // silently delete published consumer reviews. Nullable only for rows written
-  // before the column existed — the API requires it, so NULL means legacy.
+  // #705 — PROVENANCE, not subject. The review is about the consultant and
+  // renders on their profile; this records which session prompted or last
+  // updated it, which is what makes "verified booking" a fact rather than a
+  // claim. SetNull, not Cascade: tombstoning an appointment must not silently
+  // delete published consumer reviews. Nullable only for rows written before
+  // the column existed — the API requires it, so NULL means legacy.
   appointment   Appointment? @relation(fields: [appointmentId], references: [id], onDelete: SetNull)
   appointmentId String?
 
@@ -2901,6 +2915,13 @@ model ConsultantReview {
   repliedAt      DateTime? @db.Timestamptz
   replyDeletedAt DateTime? @db.Timestamptz
 
+  // Display choice only. Authenticity never depends on it: the review is welded
+  // to a paid, attended session either way, which is what separates this from
+  // the anonymous public reviews Google stepped away from. What it buys is
+  // candour — a consultee who wants to book this person again has an obvious
+  // reason to soften criticism that carries their name.
+  isAnonymous Boolean @default(false)
+
   // Moderation CONTENT_REMOVED soft-delete (#693); public reads filter on
   // null, staff moderation surfaces keep seeing the row.
   deletedAt DateTime? @db.Timestamptz
@@ -2908,15 +2929,15 @@ model ConsultantReview {
   createdAt DateTime @default(now())
   updatedAt DateTime @updatedAt
 
-  // #705 — one review per attendee per SESSION, replacing the per-pair unique.
-  // A webinar's attendees share one appointmentId with distinct consultees, so
-  // this still caps each attendee at one review of that event. Deliberately
-  // not partial on deletedAt: a moderation-removed review must not free the
-  // slot for the same person to re-post it. POST maps P2002 here to 409.
-  // Legacy rows carry a NULL appointmentId, and Postgres treats a NULL key as
-  // distinct, so they coexist — prisma/sql/check-constraints.sql keeps the old
-  // per-pair rule alive for exactly that band.
-  @@unique([appointmentId, consulteeProfileId])
+  // ONE review per consultee per consultant, ever — Practo's model. A reader
+  // wants one considered opinion of a person, not four near-identical ones from
+  // the same client; the reviewer edits theirs as the relationship develops, and
+  // `appointmentId` above records which session last prompted that.
+  //
+  // This is NOT partial on deletedAt: a moderation-removed review must not free
+  // the slot for the same person to re-post it. POST maps P2002 here to 409,
+  // which the client turns into "update your review" rather than an error.
+  @@unique([consultantProfileId, consulteeProfileId])
   // Serves recomputeConsultantRating's groupBy — the only hot aggregate.
   @@index([consultantProfileId, deletedAt, ratingUnitId])
   @@index([appointmentId])
@@ -4306,7 +4327,9 @@ model SlotOfAppointment {
   /// load-bearing: it makes concurrent checkout `connect` calls
   /// double-assignment-safe. Restored automatically at every push/reset;
   /// do not convert to an explicit join model without re-declaring it.
-  user User[] @relation("SlotOfAppointmentToUser")
+  user     User[]                @relation("SlotOfAppointmentToUser")
+  // #705 — the per-call private rating.
+  feedback AppointmentFeedback[]
 
   startsAt    DateTime @db.Timestamptz
   endsAt      DateTime @db.Timestamptz
diff --git a/prisma/sql/check-constraints.sql b/prisma/sql/check-constraints.sql
index 41df8a9fa..0ccd4c8f9 100644
--- a/prisma/sql/check-constraints.sql
+++ b/prisma/sql/check-constraints.sql
@@ -418,22 +418,6 @@ CREATE UNIQUE INDEX IF NOT EXISTS "appointment_doc_thread_version_unique"
 ON "AppointmentDocument" (COALESCE("rootDocumentId", "id"), "versionNo")
 WHERE "deletedAt" IS NULL;
 -- SPLIT
--- #705 — reviews became per-appointment, so the unique moved to
--- (appointmentId, consulteeProfileId). Rows written before appointmentId
--- existed carry NULL, and Postgres treats a NULL key column as distinct, so
--- that unique is permissive for exactly the rows that were never gated per
--- session — the old "one review per (consultant, consultee)" rule would
--- silently lapse for them. This preserves it for the legacy band only, and
--- expires with the pre-MVP reset once no NULLs remain.
---
--- Cannot fail to build: the constraint it replaces already guarantees those
--- pairs are unique today.
-DROP INDEX IF EXISTS "consultant_review_legacy_pair_key";
--- SPLIT
-CREATE UNIQUE INDEX IF NOT EXISTS "consultant_review_legacy_pair_key"
-ON "ConsultantReview" ("consultantProfileId", "consulteeProfileId")
-WHERE "appointmentId" IS NULL;
--- SPLIT
 -- #onboarding-ux — the resumable-onboarding draft blob. The writer already
 -- byte-gates at ONBOARDING_DRAFT_MAX_BYTES (utils/onboarding-draft.ts), but
 -- that gate lives in application code on a column any future writer can reach

From c7f9b24eafaf2c9d2e7b089bfae177d621a5b503 Mon Sep 17 00:00:00 2001
From: Kaustav Ghosh <44238657+teetangh@users.noreply.github.com>
Date: Sat, 29 Aug 2026 13:36:13 +0530
Subject: [PATCH 02/10] fix(support): stop promising a reply nobody is
 composing
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Three fixes to what the reported screenshot showed: typing dots on an escalated
thread, and a toast that erased the message it was complaining about.

**No typing indicator once a human has it.** The dots meant "the flowchart is
composing an answer", which is true in the tree and false the moment the thread
escalates — there is no bot, and a person may take hours. The handoff research
is blunt that this is where most escalations lose the customer: thirty seconds
without a message feels like five minutes, and a concrete wait instead of an
indefinite spinner cuts abandonment 40-60%.

**Say when we will actually reply.** The thread now shows the ticket's
`ackDueAt` — "Our team will reply by 4:30 PM today" — which is not a guess but
the deadline we committed to at intake under the IT Rules 2021 window. Past that
deadline it says so rather than showing a stale time, because a promise that has
already lapsed is worse than none.

**A failed send stays in the transcript.** It is marked "Not sent" with a Retry
that re-sends the same payload, the way every messaging app does it. Rolling the
bubble back and raising a toast meant the user could not tell whether anything
had been sent — which is precisely how a connection timeout on a cold instance
presented.

Part of #705

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01Fb4vbRYxJH7wxc4tjhm6XJ
---
 .../[appointmentId]/support/route.ts          |   8 +-
 components/support/SupportThreadSheet.tsx     | 169 ++++++++++++++----
 2 files changed, 145 insertions(+), 32 deletions(-)

diff --git a/app/api/appointments/[appointmentId]/support/route.ts b/app/api/appointments/[appointmentId]/support/route.ts
index 9daa994e4..3ac3656d8 100644
--- a/app/api/appointments/[appointmentId]/support/route.ts
+++ b/app/api/appointments/[appointmentId]/support/route.ts
@@ -57,7 +57,13 @@ export async function GET(
 
     const thread = await prisma.appointmentSupportThread.findUnique({
       where: { appointmentId_userId: { appointmentId, userId: auth.userId } },
-      include: { messages: { orderBy: MESSAGE_ORDER } },
+      include: {
+        messages: { orderBy: MESSAGE_ORDER },
+        // #705 — an escalated thread is ASYNCHRONOUS: nobody is composing a
+        // reply, and a typing indicator promised otherwise. The drawer shows
+        // this deadline instead, which we already committed to at intake.
+        supportTicket: { select: { referenceNumber: true, ackDueAt: true } },
+      },
     });
 
     // #support-hub — the intents the SERVER offers for this appointment
diff --git a/components/support/SupportThreadSheet.tsx b/components/support/SupportThreadSheet.tsx
index 8ff2427a9..66bb9ef43 100644
--- a/components/support/SupportThreadSheet.tsx
+++ b/components/support/SupportThreadSheet.tsx
@@ -43,6 +43,8 @@ interface ThreadMessage {
   createdAt: string;
   /** Client-only: shown before the server has confirmed the write. */
   pending?: boolean;
+  /** Client-only: the send failed and the user can retry it in place. */
+  failed?: boolean;
 }
 
 interface SupportThread {
@@ -51,6 +53,11 @@ interface SupportThread {
   activeChannel: string;
   currentNodeId: string | null;
   messages: ThreadMessage[];
+  /** Present once escalated — the deadline committed to at intake. */
+  supportTicket?: {
+    referenceNumber: string | null;
+    ackDueAt: string | null;
+  } | null;
 }
 
 interface ThreadData {
@@ -86,7 +93,7 @@ const nextLocalId = () => `local-${++localSeq}`;
  *  first turn (the row does not exist until the server writes it). */
 function appendMessages(
   old: ThreadData | undefined,
-  msgs: Omit<ThreadMessage, "id" | "createdAt">[],
+  msgs: (Omit<ThreadMessage, "id" | "createdAt"> & { id?: string })[],
 ): ThreadData {
   const base: ThreadData = old ?? { thread: null, intents: [] };
   const thread: SupportThread = base.thread ?? {
@@ -104,7 +111,7 @@ function appendMessages(
         ...thread.messages,
         ...msgs.map((m) => ({
           ...m,
-          id: nextLocalId(),
+          id: m.id ?? nextLocalId(),
           createdAt: new Date().toISOString(),
         })),
       ],
@@ -112,6 +119,43 @@ function appendMessages(
   };
 }
 
+/** One turn's payload, kept so a failed send can be repeated verbatim. */
+interface TurnVars {
+  category?: string;
+  chosenOptionId?: string;
+  userMessage?: string;
+  /** Client-only echo of what was pressed. Never sent. */
+  chosenLabel?: string;
+}
+
+/** Mark one optimistic bubble as failed, leaving it where the user put it. */
+function markFailed(old: ThreadData | undefined, id: string): ThreadData {
+  const base: ThreadData = old ?? { thread: null, intents: [] };
+  if (!base.thread) return base;
+  return {
+    ...base,
+    thread: {
+      ...base.thread,
+      messages: base.thread.messages.map((m) =>
+        m.id === id ? { ...m, pending: false, failed: true } : m,
+      ),
+    },
+  };
+}
+
+/** Drop a failed bubble — it is about to be re-sent as a fresh one. */
+function dropMessage(old: ThreadData | undefined, id: string): ThreadData {
+  const base: ThreadData = old ?? { thread: null, intents: [] };
+  if (!base.thread) return base;
+  return {
+    ...base,
+    thread: {
+      ...base.thread,
+      messages: base.thread.messages.filter((m) => m.id !== id),
+    },
+  };
+}
+
 function describeAction(a: SupportAction): string | null {
   if (a.kind === "OFFER_CANCEL_REFUND") {
     const pct = "refundPct" in a ? a.refundPct : 0;
@@ -148,6 +192,10 @@ export function SupportThreadSheet({
   const open = controlledOpen ?? internalOpen;
   const [text, setText] = useState("");
   const [lastActions, setLastActions] = useState<SupportAction[]>([]);
+  // A failed send stays in the transcript, keyed by its optimistic bubble id,
+  // with the payload needed to send it again. A toast disappears and leaves the
+  // user unable to tell whether anything was sent.
+  const [failedTurns, setFailedTurns] = useState<Record<string, TurnVars>>({});
   const { toast } = useToast();
   const qc = useQueryClient();
   const queryKey = ["support-thread", appointmentId] as const;
@@ -166,13 +214,7 @@ export function SupportThreadSheet({
     mutationFn: async ({
       chosenLabel: _chosenLabel,
       ...body
-    }: {
-      category?: string;
-      chosenOptionId?: string;
-      userMessage?: string;
-      /** Client-only echo of what was pressed — see `onMutate`. Never sent. */
-      chosenLabel?: string;
-    }): Promise<TurnResult> => {
+    }: TurnVars): Promise<TurnResult> => {
       const res = await fetch(`/api/appointments/${appointmentId}/support`, {
         method: "POST",
         headers: { "Content-Type": "application/json" },
@@ -190,12 +232,16 @@ export function SupportThreadSheet({
       await qc.cancelQueries({ queryKey });
       const previous = qc.getQueryData<ThreadData>(queryKey);
       const said = vars.userMessage ?? vars.chosenLabel;
+      let optimisticId: string | undefined;
       if (said) {
+        optimisticId = nextLocalId();
         qc.setQueryData<ThreadData>(queryKey, (old) =>
-          appendMessages(old, [{ sender: "USER", body: said, pending: true }]),
+          appendMessages(old, [
+            { id: optimisticId, sender: "USER", body: said, pending: true },
+          ]),
         );
       }
-      return { previous };
+      return { previous, optimisticId };
     },
     onSuccess: (result) => {
       setLastActions(result.actions ?? []);
@@ -230,15 +276,22 @@ export function SupportThreadSheet({
       });
       void qc.invalidateQueries({ queryKey });
     },
-    onError: (e: unknown, _vars, context) => {
-      // Roll the optimistic bubble back — a message that stays on screen after
-      // the turn failed is worse than one that never appeared.
-      if (context?.previous) qc.setQueryData(queryKey, context.previous);
-      toast({
-        title: "Support",
-        description: e instanceof Error ? e.message : "Please try again.",
-        variant: "destructive",
-      });
+    onError: (e: unknown, vars, context) => {
+      // Keep the message where the user put it, marked failed, with a retry —
+      // the convention every messaging app uses. Rolling it back and toasting
+      // left them unable to tell whether it had sent at all, which is exactly
+      // what a connection timeout on a cold instance looked like.
+      const id = context?.optimisticId;
+      if (id) {
+        qc.setQueryData<ThreadData>(queryKey, (old) => markFailed(old, id));
+        setFailedTurns((f) => ({ ...f, [id]: vars }));
+      } else {
+        toast({
+          title: "Support",
+          description: e instanceof Error ? e.message : "Please try again.",
+          variant: "destructive",
+        });
+      }
     },
   });
 
@@ -296,6 +349,33 @@ export function SupportThreadSheet({
   // has escalated but whose staff reply has not landed yet still gets the
   // marker, at the end — otherwise the drawer looks like the bot simply gave
   // up on the user.
+  const retryTurn = (id: string) => {
+    const vars = failedTurns[id];
+    if (!vars) return;
+    setFailedTurns(({ [id]: _gone, ...rest }) => rest);
+    qc.setQueryData<ThreadData>(queryKey, (old) => dropMessage(old, id));
+    turn.mutate(vars);
+  };
+
+  // "We'll reply by 4:30 PM" beats "soon": a concrete wait is what the handoff
+  // research found cuts abandonment, and this one is a promise we already made.
+  const ackDueAt = thread?.supportTicket?.ackDueAt;
+  const waitingLine = (() => {
+    if (!ackDueAt) return "Our team will reply here and by email.";
+    const due = new Date(ackDueAt);
+    if (Number.isNaN(due.getTime()))
+      return "Our team will reply here and by email.";
+    if (due.getTime() < Date.now()) {
+      // Past our own deadline — say so rather than quietly showing a stale time.
+      return "Our team is taking longer than usual. You'll get a reply here and by email.";
+    }
+    const sameDay = due.toDateString() === new Date().toDateString();
+    return `Our team will reply by ${due.toLocaleTimeString([], {
+      hour: "numeric",
+      minute: "2-digit",
+    })}${sameDay ? " today" : ` on ${due.toLocaleDateString([], { day: "numeric", month: "short" })}`}.`;
+  })();
+
   const firstAgent = messages.findIndex((m) => m.sender === "AGENT");
   const handoffIndex =
     firstAgent >= 0 ? firstAgent : isHuman ? messages.length : -1;
@@ -378,16 +458,31 @@ export function SupportThreadSheet({
                       and "BOT" contradicted the header's "you're connected with
                       our support team". Side and colour carry the speaker; the
                       divider above carries who is answering. */}
-                  <div
-                    className={
-                      "max-w-[85%] rounded-2xl px-3 py-2 text-sm transition-opacity " +
-                      (m.sender === "USER"
-                        ? "bg-primary text-primary-foreground"
-                        : "bg-muted text-foreground") +
-                      (m.pending ? " opacity-70" : "")
-                    }
-                  >
-                    {m.body}
+                  <div className="max-w-[85%]">
+                    <div
+                      className={
+                        "rounded-2xl px-3 py-2 text-sm transition-opacity " +
+                        (m.sender === "USER"
+                          ? "bg-primary text-primary-foreground"
+                          : "bg-muted text-foreground") +
+                        (m.pending ? " opacity-70" : "") +
+                        (m.failed ? " opacity-60 ring-1 ring-destructive" : "")
+                      }
+                    >
+                      {m.body}
+                    </div>
+                    {m.failed && (
+                      <div className="mt-1 flex items-center justify-end gap-2 text-[11px] text-destructive">
+                        <span>Not sent</span>
+                        <button
+                          type="button"
+                          className="underline underline-offset-2"
+                          onClick={() => retryTurn(m.id)}
+                        >
+                          Retry
+                        </button>
+                      </div>
+                    )}
                   </div>
                 </div>
               </div>
@@ -396,6 +491,14 @@ export function SupportThreadSheet({
             {/* The bot is working. Uber's own write-up calls this out as the
               contract of a request/response flow engine: the user waits, and a
               visual indicator tells them why. */}
+            {/* The honest version of "we're on it": the deadline we already
+                committed to at intake, rather than an indefinite spinner. */}
+            {isHuman && !isResolved && waitingLine && (
+              <p className="text-center text-[11px] text-muted-foreground">
+                {waitingLine}
+              </p>
+            )}
+
             {handoffIndex === messages.length && (
               <div className="flex items-center gap-2">
                 <span className="h-px flex-1 bg-border" />
@@ -406,7 +509,11 @@ export function SupportThreadSheet({
               </div>
             )}
 
-            {turnPending && (
+            {/* Only while the flowchart is answering. Once the thread is with a
+                human there is nobody composing anything, and dots promising an
+                imminent reply on an asynchronous hand-off is the single thing
+                the research says loses people. */}
+            {turnPending && !isHuman && (
               <div className="flex justify-start">
                 <div
                   className="flex items-center gap-1 rounded-2xl bg-muted px-3 py-2.5"

From be5c1173ca04dc56a5c26dfda8b7879729a74684 Mon Sep 17 00:00:00 2001
From: Kaustav Ghosh <44238657+teetangh@users.noreply.github.com>
Date: Sat, 29 Aug 2026 13:44:50 +0530
Subject: [PATCH 03/10] feat(reviews): one review per consultant, and the
 rating moves onto the session
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Completes the model correction the schema commit set up.

**The review POST upserts by pair.** The unique is (consultant, consultee) now,
so a second session with the same person UPDATES their opinion instead of
colliding — which is what "one editable review per consultant" means in
practice. `appointmentId` and `ratingUnitId` move to the session that prompted
the edit, keeping group weighting pointed at the most recent thing they actually
attended. A moderated-away review is not resurrected by re-submitting.

**Eligibility now accepts attendance.** `completionStatus` only flips to
COMPLETED when the call.session_ended webhook lands, which fires after the LAST
participant leaves plus an inactivity timeout — so a post-call prompt keyed on
it would show nothing to whoever leaves first, which is most people. A slot the
user demonstrably joined counts, which is the stronger proof anyway: it
distinguishes "bought a seat" from "was actually there".

**The per-call rating moves onto the session row, and AppointmentCsatCard is
deleted.** That card asked about "the appointment", which on a subscription
booking is up to twenty-four calls, and it sat immediately above the public
review card looking nearly identical — the page read as asking the same question
twice, which is what the screenshot showed. Stars now live on the session being
rated, in the timeline that already lists every call with its date and status.
One question, attached to its subject, and the duplicate is gone rather than
restyled.

Part of #705

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01Fb4vbRYxJH7wxc4tjhm6XJ
---
 app/api/user/reviews/route.ts                 |  25 +++-
 components/appointments/SessionTimeline.tsx   |  11 ++
 .../detail/AppointmentDetailClient.tsx        |  40 ++++--
 components/reviews/SessionRatingRow.tsx       | 104 ++++++++++++++++
 components/support/AppointmentCsatCard.tsx    | 114 ------------------
 hooks/useSessionFeedback.ts                   |  33 +++++
 lib/reviews.ts                                |  37 ++++--
 schemas/feedbacks.ts                          |   6 +
 8 files changed, 229 insertions(+), 141 deletions(-)
 create mode 100644 components/reviews/SessionRatingRow.tsx
 delete mode 100644 components/support/AppointmentCsatCard.tsx
 create mode 100644 hooks/useSessionFeedback.ts

diff --git a/app/api/user/reviews/route.ts b/app/api/user/reviews/route.ts
index 9c59b20f5..8ec464241 100644
--- a/app/api/user/reviews/route.ts
+++ b/app/api/user/reviews/route.ts
@@ -147,13 +147,34 @@ export async function POST(req: NextRequest) {
     // the recomputed average (P2034 aborts one, retry then sees the committed row).
     const newReview = await withSerializableRetry(() =>
       prisma.$transaction(async (tx) => {
-      const created = await tx.consultantReview.create({
-        data: {
+      // UPSERT, not create. There is one review per consultant per consultee,
+      // so a second session with the same person updates the opinion rather
+      // than colliding on the unique — and `appointmentId`/`ratingUnitId` move
+      // to the session that prompted this edit, which is what keeps the group
+      // weighting pointed at the most recent thing they actually attended.
+      const created = await tx.consultantReview.upsert({
+        where: {
+          consultantProfileId_consulteeProfileId: {
+            consultantProfileId: reviewable.consultantProfileId,
+            consulteeProfileId: sessionConsulteeProfileId,
+          },
+        },
+        update: {
+          rating: validatedData.rating,
+          reviewDescription: validatedData.reviewDescription,
+          appointmentId: reviewable.appointmentId,
+          ratingUnitId: reviewable.ratingUnitId,
+          isAnonymous: validatedData.isAnonymous ?? undefined,
+          // A moderated-away review must not be resurrected by re-submitting.
+          deletedAt: undefined,
+        },
+        create: {
           rating: validatedData.rating,
           reviewDescription: validatedData.reviewDescription,
           consultantProfileId: reviewable.consultantProfileId,
           consulteeProfileId: sessionConsulteeProfileId,
           appointmentId: reviewable.appointmentId,
+          isAnonymous: validatedData.isAnonymous ?? false,
           // Denormalized at write time: `groupBy` can only group on this
           // model's own scalars, and this is what makes a 200-seat webinar one
           // data point instead of two hundred.
diff --git a/components/appointments/SessionTimeline.tsx b/components/appointments/SessionTimeline.tsx
index 2844d035b..f8f99f43e 100644
--- a/components/appointments/SessionTimeline.tsx
+++ b/components/appointments/SessionTimeline.tsx
@@ -38,6 +38,12 @@ interface SessionTimelineProps {
    * Defaults to true so multi-session plans show the full list.
    */
   defaultExpanded?: boolean;
+  /**
+   * Rendered at the end of a past session's row. #705 uses it for the per-call
+   * rating, so the question sits on the session being rated instead of in a
+   * separate card that could only describe the whole booking.
+   */
+  renderSessionExtra?: (session: SessionVM) => React.ReactNode;
 }
 
 interface SessionGroup {
@@ -111,6 +117,7 @@ export function SessionTimeline({
   joinWindowMs = CONSULTEE_JOIN_WINDOW_MS,
   className,
   defaultExpanded = true,
+  renderSessionExtra,
 }: SessionTimelineProps) {
   const [expanded, setExpanded] = useState(defaultExpanded);
   useEffect(() => {
@@ -228,6 +235,10 @@ export function SessionTimeline({
               </span>
             </div>
 
+            {renderSessionExtra && status !== "upcoming" && !joinable
+              ? renderSessionExtra(group.slots[group.slots.length - 1])
+              : null}
+
             {joinable ? (
               <button
                 onClick={(e) => {
diff --git a/components/appointments/detail/AppointmentDetailClient.tsx b/components/appointments/detail/AppointmentDetailClient.tsx
index a67e94fd4..910c7b08b 100644
--- a/components/appointments/detail/AppointmentDetailClient.tsx
+++ b/components/appointments/detail/AppointmentDetailClient.tsx
@@ -42,8 +42,9 @@ import { SessionTimeline } from "../SessionTimeline";
 import { RescheduleProposalCard } from "./RescheduleProposalCard";
 import { SupportThreadSheet } from "@/components/support/SupportThreadSheet";
 import { AppointmentSupportStatusCard } from "@/components/support/AppointmentSupportStatusCard";
-import { AppointmentCsatCard } from "@/components/support/AppointmentCsatCard";
 import { SessionReviewCard } from "@/components/reviews/SessionReviewCard";
+import { SessionRatingRow } from "@/components/reviews/SessionRatingRow";
+import { useSessionFeedback } from "@/hooks/useSessionFeedback";
 
 const PARTICIPANTS_PREVIEW = 5;
 
@@ -56,13 +57,7 @@ function initials(name: string): string {
     .join("");
 }
 
-function Section({
-  title,
-  children,
-}: {
-  title: string;
-  children: ReactNode;
-}) {
+function Section({ title, children }: { title: string; children: ReactNode }) {
   return (
     <div className="rounded-2xl border border-border bg-card p-5 shadow-sm sm:p-6">
       <p className="mb-3 text-[10px] font-semibold uppercase tracking-wider text-muted-foreground">
@@ -131,6 +126,8 @@ export function AppointmentDetailClient({
   });
 
   const mapped = detail ? mapAppointmentDetail(detail, role) : null;
+  // Which calls of this booking the viewer has already rated.
+  const ratedSlots = useSessionFeedback(appointmentId, role === "consultee");
   useSetBreadcrumbLabel(mapped?.vm.title);
 
   if (isLoading && !detail) {
@@ -339,16 +336,33 @@ export function AppointmentDetailClient({
           <div className="flex min-w-0 flex-col gap-4">
             {/* #705 — attendees only. The API authorizes any participant, so
                 this used to offer a consultant a star rating on their own
-                session, which then fed the org quality average. */}
+                session, which then fed the org quality average.
+                The per-call rating now lives on each session row below; only
+                the public review is a card of its own, so the page no longer
+                asks the same-looking question twice. */}
             {vm.bucket === "past" && role === "consultee" && (
-              <>
-                <AppointmentCsatCard appointmentId={appointmentId} />
-                <SessionReviewCard appointmentId={appointmentId} />
-              </>
+              <SessionReviewCard appointmentId={appointmentId} />
             )}
             <Section title="Sessions">
               {hasConfirmedSessions ? (
                 <SessionTimeline
+                  // #705 — the private per-call rating sits on the session it
+                  // rates. Attendees only: the API authorizes any participant,
+                  // and a consultant rating their own session would feed the
+                  // org quality average.
+                  renderSessionExtra={
+                    role === "consultee"
+                      ? (session) => (
+                          <SessionRatingRow
+                            appointmentId={
+                              session.appointmentId ?? appointmentId
+                            }
+                            slotId={session.slotId}
+                            existingRating={ratedSlots[session.slotId] ?? null}
+                          />
+                        )
+                      : undefined
+                  }
                   sessions={vm.sessions}
                   joinWindowMs={joinWindowMs}
                   defaultExpanded
diff --git a/components/reviews/SessionRatingRow.tsx b/components/reviews/SessionRatingRow.tsx
new file mode 100644
index 000000000..427253e45
--- /dev/null
+++ b/components/reviews/SessionRatingRow.tsx
@@ -0,0 +1,104 @@
+"use client";
+
+/**
+ * #705 — the private rating for ONE video call, rendered on the session it
+ * belongs to.
+ *
+ * This replaces the standalone CSAT card. That card asked for a rating of "the
+ * appointment", which on a subscription booking meant a single score for up to
+ * twenty-four calls; and it sat directly above the public review card looking
+ * almost identical, so the page read as asking the same question twice. Putting
+ * the stars on the session row attaches the question to the thing being
+ * answered and removes the duplicate entirely.
+ *
+ * The consultant sees these, so the copy says so — see AppointmentDetailClient.
+ */
+
+import { useEffect, useState } from "react";
+import { useMutation, useQueryClient } from "@tanstack/react-query";
+import { Star } from "lucide-react";
+import { useToast } from "@/hooks/use-toast";
+import { throwSupportError } from "@/lib/support/error-copy";
+
+export function SessionRatingRow({
+  appointmentId,
+  slotId,
+  existingRating,
+}: {
+  appointmentId: string;
+  slotId: string;
+  existingRating: number | null;
+}) {
+  const { toast } = useToast();
+  const qc = useQueryClient();
+  const [rating, setRating] = useState(existingRating ?? 0);
+  const [hover, setHover] = useState(0);
+
+  useEffect(() => {
+    setRating(existingRating ?? 0);
+  }, [existingRating, slotId]);
+
+  const save = useMutation({
+    mutationFn: async (value: number) => {
+      const res = await fetch(`/api/appointments/${appointmentId}/feedback`, {
+        method: "POST",
+        headers: { "Content-Type": "application/json" },
+        body: JSON.stringify({ rating: value, slotId }),
+      });
+      if (!res.ok) await throwSupportError(res, "session rating");
+      return res.json();
+    },
+    onSuccess: () => {
+      void qc.invalidateQueries({
+        queryKey: ["appointment-feedback", appointmentId],
+      });
+    },
+    onError: (e: unknown, _value, previous) => {
+      // Put the stars back where they were: leaving the new value on screen
+      // claims a rating we did not store.
+      setRating(
+        typeof previous === "number" ? previous : (existingRating ?? 0),
+      );
+      toast({
+        title: "Rating",
+        description: e instanceof Error ? e.message : "Please try again.",
+        variant: "destructive",
+      });
+    },
+  });
+
+  return (
+    <div
+      className="flex items-center gap-0.5"
+      onClick={(e) => e.stopPropagation()}
+    >
+      {[1, 2, 3, 4, 5].map((n) => (
+        <button
+          key={n}
+          type="button"
+          disabled={save.isPending}
+          aria-label={`Rate ${n} out of 5`}
+          aria-pressed={rating === n}
+          onMouseEnter={() => setHover(n)}
+          onMouseLeave={() => setHover(0)}
+          onClick={(e) => {
+            e.stopPropagation();
+            const previous = rating;
+            setRating(n);
+            save.mutate(n, { onError: () => setRating(previous) });
+          }}
+          className="rounded p-0.5 focus-visible:outline-none focus-visible:ring-1 focus-visible:ring-ring disabled:opacity-50"
+        >
+          <Star
+            className={
+              "h-3.5 w-3.5 " +
+              ((hover || rating) >= n
+                ? "fill-foreground text-foreground"
+                : "text-muted-foreground/50")
+            }
+          />
+        </button>
+      ))}
+    </div>
+  );
+}
diff --git a/components/support/AppointmentCsatCard.tsx b/components/support/AppointmentCsatCard.tsx
deleted file mode 100644
index ac1c938a2..000000000
--- a/components/support/AppointmentCsatCard.tsx
+++ /dev/null
@@ -1,114 +0,0 @@
-"use client";
-
-/**
- * #appt-support — private per-participant CSAT for a finished session (1–5 +
- * note), distinct from the public ConsultantReview. Upserts, so it doubles as
- * an edit surface. The parent decides WHEN to show it (past/completed session).
- */
-
-import { useEffect, useState } from "react";
-import { useMutation, useQuery, useQueryClient } from "@tanstack/react-query";
-import { Star } from "lucide-react";
-import { Textarea } from "@/components/ui/textarea";
-import { Button } from "@/components/ui/button";
-import { useToast } from "@/hooks/use-toast";
-import { throwSupportError } from "@/lib/support/error-copy";
-
-interface Feedback {
-  rating: number;
-  comment: string | null;
-}
-
-export function AppointmentCsatCard({ appointmentId }: { appointmentId: string }) {
-  const { toast } = useToast();
-  const qc = useQueryClient();
-  const queryKey = ["appointment-feedback", appointmentId] as const;
-
-  const { data: existing } = useQuery({
-    queryKey,
-    queryFn: async (): Promise<Feedback | null> => {
-      const res = await fetch(`/api/appointments/${appointmentId}/feedback`);
-      if (!res.ok) await throwSupportError(res, "feedback load");
-      const { data } = await res.json();
-      return data;
-    },
-  });
-
-  const [rating, setRating] = useState(0);
-  const [hover, setHover] = useState(0);
-  const [comment, setComment] = useState("");
-
-  useEffect(() => {
-    if (existing) {
-      setRating(existing.rating);
-      setComment(existing.comment ?? "");
-    }
-  }, [existing]);
-
-  const save = useMutation({
-    mutationFn: async () => {
-      const res = await fetch(`/api/appointments/${appointmentId}/feedback`, {
-        method: "POST",
-        headers: { "Content-Type": "application/json" },
-        body: JSON.stringify({ rating, comment: comment.trim() || undefined }),
-      });
-      if (!res.ok) await throwSupportError(res, "feedback save");
-      return res.json();
-    },
-    onSuccess: () => {
-      toast({ title: "Thanks for the feedback" });
-      void qc.invalidateQueries({ queryKey });
-    },
-    onError: (e: unknown) =>
-      toast({
-        title: "Feedback",
-        description: e instanceof Error ? e.message : "Please try again.",
-        variant: "destructive",
-      }),
-  });
-
-  return (
-    <div className="rounded-2xl border border-border bg-card p-5 shadow-sm sm:p-6">
-      <p className="mb-3 text-[10px] font-semibold uppercase tracking-wider text-muted-foreground">
-        {existing ? "Your feedback" : "How was this session?"}
-      </p>
-      <div className="flex items-center gap-1">
-        {[1, 2, 3, 4, 5].map((n) => (
-          <button
-            key={n}
-            type="button"
-            aria-label={`${n} star${n > 1 ? "s" : ""}`}
-            onMouseEnter={() => setHover(n)}
-            onMouseLeave={() => setHover(0)}
-            onClick={() => setRating(n)}
-            className="p-0.5"
-          >
-            <Star
-              className={
-                "h-6 w-6 transition-colors " +
-                ((hover || rating) >= n
-                  ? "fill-amber-400 text-amber-400"
-                  : "text-muted-foreground")
-              }
-            />
-          </button>
-        ))}
-      </div>
-      <Textarea
-        value={comment}
-        onChange={(e) => setComment(e.target.value)}
-        placeholder="Anything you'd like to add? (optional)"
-        className="mt-3"
-        rows={3}
-      />
-      <Button
-        className="mt-3"
-        size="sm"
-        disabled={rating < 1 || save.isPending}
-        onClick={() => save.mutate()}
-      >
-        {existing ? "Update feedback" : "Submit feedback"}
-      </Button>
-    </div>
-  );
-}
diff --git a/hooks/useSessionFeedback.ts b/hooks/useSessionFeedback.ts
new file mode 100644
index 000000000..a7cda2f83
--- /dev/null
+++ b/hooks/useSessionFeedback.ts
@@ -0,0 +1,33 @@
+/**
+ * #705 — this viewer's per-call ratings for one booking, keyed by slot id.
+ *
+ * The feedback GET returns every call of the booking the caller has rated, so
+ * the session timeline can show which are already rated without a request per
+ * row.
+ */
+
+import { useQuery } from "@tanstack/react-query";
+
+interface SlotFeedback {
+  slotOfAppointmentId: string | null;
+  rating: number;
+}
+
+export function useSessionFeedback(appointmentId: string, enabled: boolean) {
+  const { data } = useQuery({
+    queryKey: ["appointment-feedback", appointmentId],
+    enabled,
+    queryFn: async (): Promise<Record<string, number>> => {
+      const res = await fetch(`/api/appointments/${appointmentId}/feedback`);
+      if (!res.ok) return {};
+      const { data } = await res.json();
+      const rows = (data ?? []) as SlotFeedback[];
+      return Object.fromEntries(
+        rows
+          .filter((r) => r.slotOfAppointmentId)
+          .map((r) => [r.slotOfAppointmentId as string, r.rating]),
+      );
+    },
+  });
+  return data ?? {};
+}
diff --git a/lib/reviews.ts b/lib/reviews.ts
index d3f492c20..2bd583769 100644
--- a/lib/reviews.ts
+++ b/lib/reviews.ts
@@ -24,12 +24,25 @@ export const MIN_RATED_UNITS_FOR_PUBLIC_SCORE = 5;
  * offline session looks like. Excluding it would silently deny a review to
  * everyone whose session did not run through the video stack.
  */
-const HELD_SLOT = {
-  deletedAt: null,
-  completionStatus: {
-    in: ["COMPLETED", "UNVERIFIED"] as SlotCompletionStatus[],
-  },
-};
+function heldSlot(userId: string) {
+  return {
+    deletedAt: null,
+    OR: [
+      {
+        completionStatus: {
+          in: ["COMPLETED", "UNVERIFIED"] as SlotCompletionStatus[],
+        },
+      },
+      // Or THIS user was demonstrably in the call. `completionStatus` only
+      // flips when the call.session_ended webhook lands, which fires after the
+      // LAST participant leaves plus an inactivity timeout — so without this
+      // the post-call prompt shows nothing to whoever leaves first, which is
+      // most people. Attendance is the stronger proof anyway: it distinguishes
+      // "bought a seat" from "was actually there".
+      { meetingSession: { attendances: { some: { userId } } } },
+    ],
+  };
+}
 
 /**
  * Recompute the denormalized rating columns on ConsultantProfile.
@@ -131,18 +144,18 @@ function loadReviewableAppointments(
         // 1:1 arms — the wrapper IS the relationship, so ownership is the gate.
         {
           consultation: { requestedById: consulteeProfileId },
-          slotsOfAppointment: { some: HELD_SLOT },
+          slotsOfAppointment: { some: heldSlot(userId) },
         },
         {
           subscription: { requestedById: consulteeProfileId },
-          slotsOfAppointment: { some: HELD_SLOT },
+          slotsOfAppointment: { some: heldSlot(userId) },
         },
         {
           trialSession: {
             consulteeProfileId,
             status: { in: ["COMPLETED", "CONVERTED"] },
           },
-          slotsOfAppointment: { some: HELD_SLOT },
+          slotsOfAppointment: { some: heldSlot(userId) },
         },
         // Group arms — there is no Attendee model: registration IS the m:n
         // between the user and every slot of the shared appointment. A paid
@@ -151,14 +164,14 @@ function loadReviewableAppointments(
         {
           webinarId: { not: null },
           slotsOfAppointment: {
-            some: { ...HELD_SLOT, user: { some: { id: userId } } },
+            some: { ...heldSlot(userId), user: { some: { id: userId } } },
           },
           payment: { some: { userId, paymentStatus: "SUCCEEDED" } },
         },
         {
           classId: { not: null },
           slotsOfAppointment: {
-            some: { ...HELD_SLOT, user: { some: { id: userId } } },
+            some: { ...heldSlot(userId), user: { some: { id: userId } } },
           },
           payment: { some: { userId, paymentStatus: "SUCCEEDED" } },
         },
@@ -195,7 +208,7 @@ function loadReviewableAppointments(
         },
       },
       slotsOfAppointment: {
-        where: HELD_SLOT,
+        where: heldSlot(userId),
         select: { endsAt: true },
         orderBy: { endsAt: "desc" },
         take: 1,
diff --git a/schemas/feedbacks.ts b/schemas/feedbacks.ts
index 11e3f4884..76e85f63f 100644
--- a/schemas/feedbacks.ts
+++ b/schemas/feedbacks.ts
@@ -31,6 +31,12 @@ export const CreateReviewSchema = z.object({
    * between the pair.
    */
   appointmentId: z.string().min(1, "Session is required").max(64),
+  /**
+   * Display choice only. The review is welded to a paid, attended session
+   * either way, so hiding the name costs no authenticity — it buys candour
+   * from someone who may want to book this person again.
+   */
+  isAnonymous: z.boolean().optional(),
 });
 
 // PUT only mutates the two consultee-owned fields; a partial keeps either optional.

From 2d714aee8216e3393bcdb1a8343038d4473d203b Mon Sep 17 00:00:00 2001
From: Kaustav Ghosh <44238657+teetangh@users.noreply.github.com>
Date: Sat, 29 Aug 2026 13:45:31 +0530
Subject: [PATCH 04/10] docs(reviews): point the card's comment at the row that
 replaced the CSAT card

Part of #705

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01Fb4vbRYxJH7wxc4tjhm6XJ
---
 components/reviews/SessionReviewCard.tsx | 10 +++++-----
 1 file changed, 5 insertions(+), 5 deletions(-)

diff --git a/components/reviews/SessionReviewCard.tsx b/components/reviews/SessionReviewCard.tsx
index 9622d4521..41cd3fb8f 100644
--- a/components/reviews/SessionReviewCard.tsx
+++ b/components/reviews/SessionReviewCard.tsx
@@ -6,11 +6,11 @@
  * invited people to "Be the first to leave a review!" and there was nowhere to
  * do it, so the entire review corpus could only come from seeds.
  *
- * Deliberately distinct from `AppointmentCsatCard` beside it. That one is a
- * PRIVATE rating that feeds the org quality signal; this one is a consumer
- * review that appears on the consultant's profile. FTC 16 CFR 465.1(d) makes a
- * bare star rating a "consumer review", so merging the two would quietly turn
- * private feedback into a published one.
+ * Deliberately distinct from the per-call rating on the session rows above
+ * (`SessionRatingRow`). That one is a PRIVATE rating of a single call; this is
+ * a consumer review of the CONSULTANT, one per person, editable. FTC 16 CFR
+ * 465.1(d) makes a bare star rating a "consumer review", so merging the two
+ * would quietly turn private feedback into a published one.
  *
  * Shown to every attendee of every held session, identically and without
  * asking how they feel first — the preamble to that rule is explicit that

From cb77e558ce2728fbe1dc2cb83f24482006875610 Mon Sep 17 00:00:00 2001
From: Kaustav Ghosh <44238657+teetangh@users.noreply.github.com>
Date: Sat, 29 Aug 2026 14:01:42 +0530
Subject: [PATCH 05/10] feat(reviews): name the person being reviewed, and let
 the reviewer withhold theirs
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

**The card is named for the consultant.** "Review this session publicly"
described the data model; the user thinks they are reviewing Aarav, and Aarav's
profile is where it lands. The session moves to the subtitle, where it belongs —
it is provenance, not subject.

**A review can be posted as "Verified client".** Authenticity never depended on
the displayed name here: the row is welded to a paid, attended session either
way, which is what separates this from the anonymous public reviews Google
stepped away from. What withholding the name buys is candour — in a marketplace
this small, a consultee who wants to book the same person again has an obvious
reason to soften criticism that carries their name, and the Airbnb experiment in
our own research measured exactly that effect.

The strip happens SERVER-SIDE, in one helper every public read passes through.
Hiding the name only where it renders would still ship it in the payload, and
that payload is public and CDN-cached. The avatar goes with it — on a small
marketplace a photo identifies harder than a first name.

**The consultant sees what each call scored.** Read-only stars on the same
session rows the attendee rates, so the feedback sits next to the session it
describes rather than as a number floating free. Deliberate, and disclosed: at
this volume an aggregate over two ratings tells nobody anything, and on a 1:1
booking an individual score identifies the rater — which is why the rating UI
says so rather than promising a privacy we would not be delivering. A call
nobody rated shows nothing, because an empty star row reads as a zero.

Part of #705

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01Fb4vbRYxJH7wxc4tjhm6XJ
---
 __tests__/reviews/review-privacy.test.ts      |  61 +++++++++
 .../[appointmentId]/feedback/route.ts         |  19 ++-
 app/api/user/reviews/route.ts                 | 124 ++++++++++--------
 .../[consultantId]/components/Review.tsx      |   6 +-
 .../detail/AppointmentDetailClient.tsx        |  25 ++--
 components/reviews/SessionRatingRow.tsx       |  25 ++++
 components/reviews/SessionReviewCard.tsx      |  38 +++++-
 lib/data/consultant-detail.ts                 |   4 +-
 lib/data/explore-experts.ts                   |   4 +-
 lib/data/home.ts                              |   3 +-
 lib/data/review-privacy.ts                    |  43 ++++++
 lib/reviews.ts                                |  60 ++++++++-
 12 files changed, 324 insertions(+), 88 deletions(-)
 create mode 100644 __tests__/reviews/review-privacy.test.ts
 create mode 100644 lib/data/review-privacy.ts

diff --git a/__tests__/reviews/review-privacy.test.ts b/__tests__/reviews/review-privacy.test.ts
new file mode 100644
index 000000000..f09d50dc6
--- /dev/null
+++ b/__tests__/reviews/review-privacy.test.ts
@@ -0,0 +1,61 @@
+/**
+ * @jest-environment node
+ */
+
+/**
+ * #705 — anonymity has to hold in the PAYLOAD, not in the component.
+ *
+ * `isAnonymous` is a display choice, but stripping the name only where it is
+ * rendered would still ship it over the wire — and the public review feed is
+ * CDN-cached and readable by anyone with devtools. The reviewer's protection is
+ * only real if the server never sends the name.
+ */
+
+import {
+  stripAnonymousReviewer,
+  stripAnonymousReviewers,
+} from "@/lib/data/review-privacy";
+
+const named = {
+  isAnonymous: false,
+  rating: 5,
+  consulteeProfile: { user: { name: "Priya S.", image: "https://x/y.png" } },
+};
+const anon = { ...named, isAnonymous: true };
+
+describe("anonymous reviewers", () => {
+  it("removes the name AND the avatar, not just the name", () => {
+    // An avatar is an identifier too, and on a small marketplace often a
+    // stronger one than a first name.
+    const out = stripAnonymousReviewer(anon);
+    expect(out.consulteeProfile.user.name).toBeNull();
+    expect(out.consulteeProfile.user.image).toBeNull();
+  });
+
+  it("leaves a named review completely untouched", () => {
+    expect(stripAnonymousReviewer(named)).toEqual(named);
+  });
+
+  it("keeps everything that is not identifying", () => {
+    // The rating still has to count and the review still has to render.
+    expect(stripAnonymousReviewer(anon).rating).toBe(5);
+    expect(stripAnonymousReviewer(anon).isAnonymous).toBe(true);
+  });
+
+  it("does not mutate the row it was given", () => {
+    const row = { ...anon, consulteeProfile: { user: { ...anon.consulteeProfile.user } } };
+    stripAnonymousReviewer(row);
+    expect(row.consulteeProfile.user.name).toBe("Priya S.");
+  });
+
+  it("handles a review with no consultee profile at all", () => {
+    const orphan = { isAnonymous: true, consulteeProfile: null };
+    expect(() => stripAnonymousReviewer(orphan)).not.toThrow();
+  });
+
+  it("strips a mixed list, one by one", () => {
+    const out = stripAnonymousReviewers([named, anon]);
+    expect(out[0].consulteeProfile!.user.name).toBe("Priya S.");
+    expect(out[1].consulteeProfile!.user.name).toBeNull();
+  });
+});
diff --git a/app/api/appointments/[appointmentId]/feedback/route.ts b/app/api/appointments/[appointmentId]/feedback/route.ts
index 585c20dbf..2ef7f2a38 100644
--- a/app/api/appointments/[appointmentId]/feedback/route.ts
+++ b/app/api/appointments/[appointmentId]/feedback/route.ts
@@ -45,10 +45,22 @@ export async function GET(
         appointmentId,
       });
     }
-    // Every call of this booking the caller has rated, so the detail page can
-    // show a per-session breakdown rather than one number for the package.
+    // #705 — the CONSULTANT sees the individual ratings their calls received.
+    // A deliberate product call: at this volume an aggregate over two ratings
+    // tells nobody anything, so the detail is what makes it actionable. The
+    // copy the rater sees says so plainly — nothing here is promised private.
+    // On a 1:1 booking this identifies the rater, which is exactly why it is
+    // disclosed rather than quietly enabled.
+    const asProvider =
+      appointmentRaterRole(auth.userId, auth.detail) === "PROVIDER";
+
+    // Every call of this booking the caller has rated (or, for the provider,
+    // every attendee rating on it), so the timeline can show a per-session
+    // breakdown instead of one number for the package.
     const feedback = await prisma.appointmentFeedback.findMany({
-      where: { appointmentId, userId: auth.userId },
+      where: asProvider
+        ? { appointmentId, raterRole: "CONSULTEE" }
+        : { appointmentId, userId: auth.userId },
       select: {
         id: true,
         slotOfAppointmentId: true,
@@ -56,6 +68,7 @@ export async function GET(
         comment: true,
         createdAt: true,
       },
+      // A provider could otherwise infer a rater from ordering on a group call.
       orderBy: { createdAt: "asc" },
     });
     return NextResponse.json({ data: feedback });
diff --git a/app/api/user/reviews/route.ts b/app/api/user/reviews/route.ts
index 8ec464241..99f78af7d 100644
--- a/app/api/user/reviews/route.ts
+++ b/app/api/user/reviews/route.ts
@@ -1,6 +1,7 @@
 import * as Sentry from "@sentry/nextjs";
 import { NextRequest, NextResponse } from "next/server";
 import prisma from "@/lib/prisma";
+import { stripAnonymousReviewers } from "@/lib/data/review-privacy";
 import { consultantPublicScalars } from "@/lib/data/consultant-public";
 import { Prisma } from "@prisma/client";
 import { notifyNewReview } from "@/lib/novu";
@@ -79,7 +80,9 @@ export async function GET(req: NextRequest) {
     });
 
     return NextResponse.json(
-      { data: reviews },
+      // PUBLIC and CDN-cached: a name withheld by the reviewer must not ship
+      // in the payload, or the anonymity is cosmetic.
+      { data: stripAnonymousReviewers(reviews) },
       {
         status: 200,
         headers: {
@@ -88,7 +91,10 @@ export async function GET(req: NextRequest) {
       },
     );
   } catch (error) {
-    Sentry.captureException(error instanceof Error ? error : new Error(String(error)), { tags: { subsystem: "auth" } });
+    Sentry.captureException(
+      error instanceof Error ? error : new Error(String(error)),
+      { tags: { subsystem: "auth" } },
+    );
     return apiError({ tag: "[Reviews.GET]", error });
   }
 }
@@ -146,68 +152,69 @@ export async function POST(req: NextRequest) {
     // + retry so two concurrent reviews for the same consultant can't lose-update
     // the recomputed average (P2034 aborts one, retry then sees the committed row).
     const newReview = await withSerializableRetry(() =>
-      prisma.$transaction(async (tx) => {
-      // UPSERT, not create. There is one review per consultant per consultee,
-      // so a second session with the same person updates the opinion rather
-      // than colliding on the unique — and `appointmentId`/`ratingUnitId` move
-      // to the session that prompted this edit, which is what keeps the group
-      // weighting pointed at the most recent thing they actually attended.
-      const created = await tx.consultantReview.upsert({
-        where: {
-          consultantProfileId_consulteeProfileId: {
-            consultantProfileId: reviewable.consultantProfileId,
-            consulteeProfileId: sessionConsulteeProfileId,
-          },
-        },
-        update: {
-          rating: validatedData.rating,
-          reviewDescription: validatedData.reviewDescription,
-          appointmentId: reviewable.appointmentId,
-          ratingUnitId: reviewable.ratingUnitId,
-          isAnonymous: validatedData.isAnonymous ?? undefined,
-          // A moderated-away review must not be resurrected by re-submitting.
-          deletedAt: undefined,
-        },
-        create: {
-          rating: validatedData.rating,
-          reviewDescription: validatedData.reviewDescription,
-          consultantProfileId: reviewable.consultantProfileId,
-          consulteeProfileId: sessionConsulteeProfileId,
-          appointmentId: reviewable.appointmentId,
-          isAnonymous: validatedData.isAnonymous ?? false,
-          // Denormalized at write time: `groupBy` can only group on this
-          // model's own scalars, and this is what makes a 200-seat webinar one
-          // data point instead of two hundred.
-          ratingUnitId: reviewable.ratingUnitId,
-        },
-        include: {
-          // #946 allowlist — the response goes back to the consultee who wrote
-          // the review; a bare `include:` handed them the consultant's PAN and
-          // bank account.
-          consultantProfile: {
-            select: {
-              ...consultantPublicScalars,
-              user: { select: { name: true } },
+      prisma.$transaction(
+        async (tx) => {
+          // UPSERT, not create. There is one review per consultant per consultee,
+          // so a second session with the same person updates the opinion rather
+          // than colliding on the unique — and `appointmentId`/`ratingUnitId` move
+          // to the session that prompted this edit, which is what keeps the group
+          // weighting pointed at the most recent thing they actually attended.
+          const created = await tx.consultantReview.upsert({
+            where: {
+              consultantProfileId_consulteeProfileId: {
+                consultantProfileId: reviewable.consultantProfileId,
+                consulteeProfileId: sessionConsulteeProfileId,
+              },
+            },
+            update: {
+              rating: validatedData.rating,
+              reviewDescription: validatedData.reviewDescription,
+              appointmentId: reviewable.appointmentId,
+              ratingUnitId: reviewable.ratingUnitId,
+              isAnonymous: validatedData.isAnonymous ?? undefined,
+              // A moderated-away review must not be resurrected by re-submitting.
+              deletedAt: undefined,
+            },
+            create: {
+              rating: validatedData.rating,
+              reviewDescription: validatedData.reviewDescription,
+              consultantProfileId: reviewable.consultantProfileId,
+              consulteeProfileId: sessionConsulteeProfileId,
+              appointmentId: reviewable.appointmentId,
+              isAnonymous: validatedData.isAnonymous ?? false,
+              // Denormalized at write time: `groupBy` can only group on this
+              // model's own scalars, and this is what makes a 200-seat webinar one
+              // data point instead of two hundred.
+              ratingUnitId: reviewable.ratingUnitId,
             },
-          },
-          consulteeProfile: {
             include: {
-              user: {
+              // #946 allowlist — the response goes back to the consultee who wrote
+              // the review; a bare `include:` handed them the consultant's PAN and
+              // bank account.
+              consultantProfile: {
                 select: {
-                  name: true,
-                  image: true,
+                  ...consultantPublicScalars,
+                  user: { select: { name: true } },
+                },
+              },
+              consulteeProfile: {
+                include: {
+                  user: {
+                    select: {
+                      name: true,
+                      image: true,
+                    },
+                  },
                 },
               },
             },
-          },
-        },
-      });
+          });
 
-      await recomputeConsultantRating(tx, created.consultantProfileId);
+          await recomputeConsultantRating(tx, created.consultantProfileId);
 
-      return created;
-      },
-      { isolationLevel: Prisma.TransactionIsolationLevel.Serializable },
+          return created;
+        },
+        { isolationLevel: Prisma.TransactionIsolationLevel.Serializable },
       ),
     );
 
@@ -240,7 +247,10 @@ export async function POST(req: NextRequest) {
         { status: 409 },
       );
     }
-    Sentry.captureException(error instanceof Error ? error : new Error(String(error)), { tags: { subsystem: "auth" } });
+    Sentry.captureException(
+      error instanceof Error ? error : new Error(String(error)),
+      { tags: { subsystem: "auth" } },
+    );
     return apiError({ tag: "[Reviews.POST]", error });
   }
 }
diff --git a/app/explore/experts/[consultantId]/components/Review.tsx b/app/explore/experts/[consultantId]/components/Review.tsx
index e466ebbfb..10ed404bb 100644
--- a/app/explore/experts/[consultantId]/components/Review.tsx
+++ b/app/explore/experts/[consultantId]/components/Review.tsx
@@ -11,7 +11,11 @@ const Review: React.FC<Readonly<TConsultantReview>> = ({
   rating,
   reviewDescription,
 }) => {
-  const reviewerName = consulteeProfile?.user?.name || "Anonymous";
+  // "Verified client" rather than "Anonymous": the trust here comes from the
+  // review being welded to a paid, attended session, and that is worth saying
+  // out loud when the name is withheld. The server has already removed the
+  // name — this is the label for that, not the mechanism.
+  const reviewerName = consulteeProfile?.user?.name || "Verified client";
   const reviewerImage = consulteeProfile?.user?.image || null;
 
   return (
diff --git a/components/appointments/detail/AppointmentDetailClient.tsx b/components/appointments/detail/AppointmentDetailClient.tsx
index 910c7b08b..348d10e81 100644
--- a/components/appointments/detail/AppointmentDetailClient.tsx
+++ b/components/appointments/detail/AppointmentDetailClient.tsx
@@ -127,7 +127,7 @@ export function AppointmentDetailClient({
 
   const mapped = detail ? mapAppointmentDetail(detail, role) : null;
   // Which calls of this booking the viewer has already rated.
-  const ratedSlots = useSessionFeedback(appointmentId, role === "consultee");
+  const ratedSlots = useSessionFeedback(appointmentId, true);
   useSetBreadcrumbLabel(mapped?.vm.title);
 
   if (isLoading && !detail) {
@@ -350,19 +350,16 @@ export function AppointmentDetailClient({
                   // rates. Attendees only: the API authorizes any participant,
                   // and a consultant rating their own session would feed the
                   // org quality average.
-                  renderSessionExtra={
-                    role === "consultee"
-                      ? (session) => (
-                          <SessionRatingRow
-                            appointmentId={
-                              session.appointmentId ?? appointmentId
-                            }
-                            slotId={session.slotId}
-                            existingRating={ratedSlots[session.slotId] ?? null}
-                          />
-                        )
-                      : undefined
-                  }
+                  renderSessionExtra={(session) => (
+                    <SessionRatingRow
+                      appointmentId={session.appointmentId ?? appointmentId}
+                      slotId={session.slotId}
+                      existingRating={ratedSlots[session.slotId] ?? null}
+                      // The consultant sees what a call scored; only the
+                      // attendee can set it.
+                      readOnly={role !== "consultee"}
+                    />
+                  )}
                   sessions={vm.sessions}
                   joinWindowMs={joinWindowMs}
                   defaultExpanded
diff --git a/components/reviews/SessionRatingRow.tsx b/components/reviews/SessionRatingRow.tsx
index 427253e45..fafde9418 100644
--- a/components/reviews/SessionRatingRow.tsx
+++ b/components/reviews/SessionRatingRow.tsx
@@ -24,10 +24,13 @@ export function SessionRatingRow({
   appointmentId,
   slotId,
   existingRating,
+  readOnly = false,
 }: {
   appointmentId: string;
   slotId: string;
   existingRating: number | null;
+  /** The consultant's view: what this call scored, not something to set. */
+  readOnly?: boolean;
 }) {
   const { toast } = useToast();
   const qc = useQueryClient();
@@ -67,6 +70,28 @@ export function SessionRatingRow({
     },
   });
 
+  // Nothing to show a consultant on a call nobody rated — an empty star row
+  // reads as a zero rather than as an absence.
+  if (readOnly && !existingRating) return null;
+
+  if (readOnly) {
+    return (
+      <div className="flex items-center gap-0.5" title="Rated by the attendee">
+        {[1, 2, 3, 4, 5].map((n) => (
+          <Star
+            key={n}
+            className={
+              "h-3.5 w-3.5 " +
+              ((existingRating ?? 0) >= n
+                ? "fill-foreground text-foreground"
+                : "text-muted-foreground/30")
+            }
+          />
+        ))}
+      </div>
+    );
+  }
+
   return (
     <div
       className="flex items-center gap-0.5"
diff --git a/components/reviews/SessionReviewCard.tsx b/components/reviews/SessionReviewCard.tsx
index 41cd3fb8f..6a524ed9e 100644
--- a/components/reviews/SessionReviewCard.tsx
+++ b/components/reviews/SessionReviewCard.tsx
@@ -31,11 +31,13 @@ import { throwSupportError } from "@/lib/support/error-copy";
 
 interface ReviewableSession {
   appointmentId: string;
+  consultantName: string | null;
   title: string;
   existingReview: {
     id: string;
     rating: number;
     reviewDescription: string | null;
+    isAnonymous?: boolean;
   } | null;
 }
 
@@ -69,6 +71,7 @@ export function SessionReviewCard({
   const [rating, setRating] = useState(0);
   const [hover, setHover] = useState(0);
   const [text, setText] = useState("");
+  const [anonymous, setAnonymous] = useState(false);
 
   useEffect(() => {
     // Reset on absence too, and key on the appointment: without either, moving
@@ -76,6 +79,7 @@ export function SessionReviewCard({
     // text sitting in the form, ready to be posted against the wrong session.
     setRating(existing?.rating ?? 0);
     setText(existing?.reviewDescription ?? "");
+    setAnonymous(existing?.isAnonymous ?? false);
   }, [existing, appointmentId]);
 
   const save = useMutation({
@@ -83,7 +87,11 @@ export function SessionReviewCard({
       // Explicit null when cleared, never undefined: UpdateReviewSchema is
       // `.partial()`, so undefined means "leave it alone" and a consultee
       // deleting their written review could never actually delete it.
-      const body = { rating, reviewDescription: text.trim() || null };
+      const body = {
+        rating,
+        reviewDescription: text.trim() || null,
+        isAnonymous: anonymous,
+      };
       const res = existing
         ? await fetch(`/api/user/reviews/${existing.id}`, {
             method: "PUT",
@@ -145,12 +153,19 @@ export function SessionReviewCard({
 
   return (
     <section className="rounded-xl border border-border bg-card p-4">
+      {/* Named for the person, because that is who the user thinks they are
+          reviewing and whose profile it lands on. The session is provenance —
+          it proves the review is genuine and it is what let them in here — so
+          it sits underneath as context rather than as the subject. */}
       <h3 className="text-sm font-medium text-foreground">
-        {existing ? "Your public review" : "Review this session publicly"}
+        {existing ? "Your review of " : "Review "}
+        {session.consultantName ?? "this expert"}
       </h3>
       <p className="mt-0.5 text-xs text-muted-foreground">
-        This one is public — it appears on the expert&apos;s profile with your
-        name and the date. Your private rating above stays between you and us.
+        {session.title}
+        {" · "}
+        Public — it appears on their profile with the date. One review per
+        expert; you can edit it after a later session.
       </p>
 
       <div className="mt-3 flex items-center gap-1">
@@ -189,6 +204,21 @@ export function SessionReviewCard({
         placeholder="What was useful, and what could have been better? (optional)"
       />
 
+      <label className="mt-3 flex items-start gap-2 text-xs text-muted-foreground">
+        <input
+          type="checkbox"
+          className="mt-0.5"
+          checked={anonymous}
+          onChange={(e) => setAnonymous(e.target.checked)}
+        />
+        {/* Authenticity never depended on the name: the review is welded to a
+            paid, attended session either way. Hiding it costs no trust and
+            buys candour from someone who may want to book this person again. */}
+        <span>
+          Post as <strong>Verified client</strong> instead of my name
+        </span>
+      </label>
+
       <div className="mt-3 flex items-center gap-2">
         <Button
           size="sm"
diff --git a/lib/data/consultant-detail.ts b/lib/data/consultant-detail.ts
index 322f6b436..cbd4621e7 100644
--- a/lib/data/consultant-detail.ts
+++ b/lib/data/consultant-detail.ts
@@ -1,6 +1,7 @@
 import { cache } from "react";
 import { reportSentryError } from "@/lib/observability/report";
 import prisma from "@/lib/prisma";
+import { stripAnonymousReviewers } from "@/lib/data/review-privacy";
 import { consultantPublicScalars } from "@/lib/data/consultant-public";
 
 /**
@@ -133,6 +134,7 @@ export const getConsultantReviews = cache(
       },
       orderBy: { rating: "desc" },
     });
-    return reviews;
+    // The reviewer chose to be unnamed; that has to hold in the payload.
+    return stripAnonymousReviewers(reviews);
   },
 );
diff --git a/lib/data/explore-experts.ts b/lib/data/explore-experts.ts
index f09dcf026..9409fd226 100644
--- a/lib/data/explore-experts.ts
+++ b/lib/data/explore-experts.ts
@@ -2,6 +2,7 @@ import { unstable_cache } from "next/cache";
 import prisma from "@/lib/prisma";
 import { Prisma } from "@prisma/client";
 import type { IConsultantCardData } from "@/types/consultant";
+import { stripAnonymousReviewers } from "@/lib/data/review-privacy";
 
 /**
  * Server-side data access for the explore experts page.
@@ -326,7 +327,7 @@ export type ExpertsMetadata = Awaited<ReturnType<typeof fetchExpertsMetadata>>;
 // otherwise create two entries for the same data. The default lives on the wrapper.
 const getCachedRecentReviews = unstable_cache(
   async (limit: number) => {
-    return prisma.consultantReview.findMany({
+    const rows = await prisma.consultantReview.findMany({
       // #781 §B — soft-deleted profiles leave public surfaces
       // #693 — moderation-removed reviews leave public surfaces too
       where: {
@@ -349,6 +350,7 @@ const getCachedRecentReviews = unstable_cache(
         },
       },
     });
+    return stripAnonymousReviewers(rows);
   },
   ["recent-reviews"],
   { revalidate: 120, tags: ["reviews"] },
diff --git a/lib/data/home.ts b/lib/data/home.ts
index c8e337d2c..3243c7200 100644
--- a/lib/data/home.ts
+++ b/lib/data/home.ts
@@ -1,5 +1,6 @@
 import { unstable_cache } from "next/cache";
 import prisma from "@/lib/prisma";
+import { stripAnonymousReviewers } from "@/lib/data/review-privacy";
 import { toPlain } from "@/lib/data/serialize";
 import { consultantPublicScalars } from "@/lib/data/consultant-public";
 import { fetchImagesFromSupabaseStorage } from "@/lib/supabase";
@@ -100,7 +101,7 @@ export const getHomeReviews = unstable_cache(
       },
       orderBy: { rating: "desc" },
     });
-    return toPlain(reviews);
+    return toPlain(stripAnonymousReviewers(reviews));
   },
   ["home-reviews"],
   { revalidate: 3600, tags: ["reviews", "home"] },
diff --git a/lib/data/review-privacy.ts b/lib/data/review-privacy.ts
new file mode 100644
index 000000000..643e86f6d
--- /dev/null
+++ b/lib/data/review-privacy.ts
@@ -0,0 +1,43 @@
+/**
+ * #705 — anonymity has to hold at the API boundary, not in the component.
+ *
+ * `isAnonymous` is a display choice the reviewer made; stripping the name only
+ * where it is rendered would still ship it in the payload, and a public review
+ * feed is exactly the thing people read with devtools open. Every public read
+ * passes its rows through here, so there is one place to get it right.
+ *
+ * Authenticity is unaffected — the review is welded to a paid, attended session
+ * either way, which is what separates this from the anonymous public reviews
+ * Google stepped away from.
+ */
+
+/** The shape every public review read shares. */
+interface AnonymisableReview {
+  isAnonymous: boolean;
+  consulteeProfile?: {
+    user?: { name?: string | null; image?: string | null } | null;
+  } | null;
+}
+
+export function stripAnonymousReviewer<T extends AnonymisableReview>(
+  review: T,
+): T {
+  if (!review.isAnonymous || !review.consulteeProfile) return review;
+  return {
+    ...review,
+    consulteeProfile: {
+      ...review.consulteeProfile,
+      user: {
+        ...(review.consulteeProfile.user ?? {}),
+        name: null,
+        image: null,
+      },
+    },
+  };
+}
+
+export function stripAnonymousReviewers<T extends AnonymisableReview>(
+  reviews: T[],
+): T[] {
+  return reviews.map(stripAnonymousReviewer);
+}
diff --git a/lib/reviews.ts b/lib/reviews.ts
index 2bd583769..baf6448bc 100644
--- a/lib/reviews.ts
+++ b/lib/reviews.ts
@@ -114,6 +114,9 @@ export async function recomputeConsultantRating(
 export interface ReviewableSession {
   appointmentId: string;
   consultantProfileId: string;
+  /** Whose profile this review lands on — the card says the name, because that
+   *  is who the user thinks they are reviewing. */
+  consultantName: string | null;
   /** The unit this review's rating folds into — see recomputeConsultantRating. */
   ratingUnitId: string;
   appointmentType: AppointmentsType;
@@ -185,26 +188,59 @@ function loadReviewableAppointments(
       consultation: {
         select: {
           consultationPlan: {
-            select: { title: true, consultantProfileId: true },
+            select: {
+              title: true,
+              consultantProfileId: true,
+              consultantProfile: {
+                select: { user: { select: { name: true } } },
+              },
+            },
           },
         },
       },
       subscription: {
         select: {
           subscriptionPlan: {
-            select: { title: true, consultantProfileId: true },
+            select: {
+              title: true,
+              consultantProfileId: true,
+              consultantProfile: {
+                select: { user: { select: { name: true } } },
+              },
+            },
           },
         },
       },
-      trialSession: { select: { consultantProfileId: true } },
+      trialSession: {
+        select: {
+          consultantProfileId: true,
+          consultantProfile: { select: { user: { select: { name: true } } } },
+        },
+      },
       webinar: {
         select: {
-          webinarPlan: { select: { title: true, consultantProfileId: true } },
+          webinarPlan: {
+            select: {
+              title: true,
+              consultantProfileId: true,
+              consultantProfile: {
+                select: { user: { select: { name: true } } },
+              },
+            },
+          },
         },
       },
       class: {
         select: {
-          classPlan: { select: { title: true, consultantProfileId: true } },
+          classPlan: {
+            select: {
+              title: true,
+              consultantProfileId: true,
+              consultantProfile: {
+                select: { user: { select: { name: true } } },
+              },
+            },
+          },
         },
       },
       slotsOfAppointment: {
@@ -215,7 +251,12 @@ function loadReviewableAppointments(
       },
       consultantReviews: {
         where: { consulteeProfileId, deletedAt: null },
-        select: { id: true, rating: true, reviewDescription: true },
+        select: {
+          id: true,
+          rating: true,
+          reviewDescription: true,
+          isAnonymous: true,
+        },
         take: 1,
       },
     },
@@ -252,6 +293,13 @@ function describe(row: AppointmentRow): ReviewableSession | null {
   return {
     appointmentId: row.id,
     consultantProfileId,
+    consultantName:
+      row.consultation?.consultationPlan?.consultantProfile?.user?.name ??
+      row.subscription?.subscriptionPlan?.consultantProfile?.user?.name ??
+      row.trialSession?.consultantProfile?.user?.name ??
+      row.webinar?.webinarPlan?.consultantProfile?.user?.name ??
+      row.class?.classPlan?.consultantProfile?.user?.name ??
+      null,
     ratingUnitId,
     appointmentType: row.appointmentType,
     title:

From 03af573a67b031aaf8901d7742d5b2c2e0511a2d Mon Sep 17 00:00:00 2001
From: Kaustav Ghosh <44238657+teetangh@users.noreply.github.com>
Date: Sat, 29 Aug 2026 14:23:48 +0530
Subject: [PATCH 06/10] fix(support): the retry that a poll erased, and six
 other review findings
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

**The failed-message fix was defeating itself.** `markFailed` wrote the failed
bubble into the React Query cache — and the 15s poll replaces that cache
wholesale with server rows, so the bubble and its Retry vanished within seconds.
Failed sends now live in component state, rendered after the server's messages,
where a refetch cannot reach them.

**A refused write was reported as delivered.** When the CAS declines because the
thread closed underneath the user, `persistHumanTurn` returned a plain success
and the client cleared the pending flag — a message that was never stored looked
sent. It returns `accepted: false`, and the client keeps it as a failed bubble
and says the conversation was closed.

**Dropping the USER/BOT captions removed the only speaker attribution assistive
tech had.** Side and colour are visual-only. Screen-reader-only labels restore
it in both drawers without bringing the clutter back.

**A cancelled or rescheduled call was rateable.** It never happened, and a
rating on it would still have reached the org quality average. Rejected at the
route and no longer offered in the timeline.

**A moderated-away review could be silently edited.** The upsert would update a
soft-deleted row, tell the author it was published, and change nothing visible.
It now 409s and says why.

**Per-call ratings only loaded for the page's own appointment.** Sessions in a
subscription or class group belong to DIFFERENT appointments, so every child
session looked unrated and its invalidation key pointed at the wrong query.

Plus the SonarCloud gate: a div that was interactive without keyboard support,
nested ternaries and template literals in the wait copy (extracted to
`describeWait`), a useless empty-object spread, and readonly props.

Part of #705

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01Fb4vbRYxJH7wxc4tjhm6XJ
---
 .../[appointmentId]/feedback/route.ts         |   6 +-
 app/api/user/reviews/route.ts                 |  28 ++-
 components/appointments/SessionTimeline.tsx   |  11 +-
 .../detail/AppointmentDetailClient.tsx        |  18 +-
 components/reviews/SessionRatingRow.tsx       |  12 +-
 components/support/PlatformSupportSheet.tsx   |   6 +
 components/support/SupportThreadSheet.tsx     | 179 ++++++++++--------
 hooks/useSessionFeedback.ts                   |  43 +++--
 lib/data/review-privacy.ts                    |   2 +-
 lib/support/service.ts                        |  15 +-
 10 files changed, 211 insertions(+), 109 deletions(-)

diff --git a/app/api/appointments/[appointmentId]/feedback/route.ts b/app/api/appointments/[appointmentId]/feedback/route.ts
index 2ef7f2a38..294f19fb8 100644
--- a/app/api/appointments/[appointmentId]/feedback/route.ts
+++ b/app/api/appointments/[appointmentId]/feedback/route.ts
@@ -132,6 +132,9 @@ export async function POST(
         id: body.data.slotId,
         appointmentId,
         deletedAt: null,
+        // A cancelled or rescheduled call never happened, so there is nothing
+        // to rate — and a rating on one would still reach the org average.
+        completionStatus: { notIn: ["CANCELLED", "RESCHEDULED"] },
       },
       select: { id: true },
     });
@@ -139,7 +142,8 @@ export async function POST(
       return supportError({
         status: 404,
         code: "NOT_FOUND",
-        message: "That session isn't part of this booking",
+        message:
+          "That session isn't part of this booking, or it didn't take place",
         context: { route: FEEDBACK_ROUTE, action: "save", appointmentId },
       });
     }
diff --git a/app/api/user/reviews/route.ts b/app/api/user/reviews/route.ts
index 99f78af7d..9ad8ea6db 100644
--- a/app/api/user/reviews/route.ts
+++ b/app/api/user/reviews/route.ts
@@ -99,6 +99,9 @@ export async function GET(req: NextRequest) {
   }
 }
 
+/** Thrown when the author tries to edit a review moderation has removed. */
+class ModeratedReviewError extends Error {}
+
 export async function POST(req: NextRequest) {
   try {
     const session = await getSession();
@@ -154,6 +157,20 @@ export async function POST(req: NextRequest) {
     const newReview = await withSerializableRetry(() =>
       prisma.$transaction(
         async (tx) => {
+          // A review that moderation removed cannot be edited back into existence,
+          // and accepting the edit silently would tell the author it was published
+          // when nothing changed on the page.
+          const existing = await tx.consultantReview.findUnique({
+            where: {
+              consultantProfileId_consulteeProfileId: {
+                consultantProfileId: reviewable.consultantProfileId,
+                consulteeProfileId: sessionConsulteeProfileId,
+              },
+            },
+            select: { deletedAt: true },
+          });
+          if (existing?.deletedAt) throw new ModeratedReviewError();
+
           // UPSERT, not create. There is one review per consultant per consultee,
           // so a second session with the same person updates the opinion rather
           // than colliding on the unique — and `appointmentId`/`ratingUnitId` move
@@ -237,7 +254,16 @@ export async function POST(req: NextRequest) {
 
     return NextResponse.json(newReview, { status: 201 });
   } catch (error) {
-    // @@unique([appointmentId, consulteeProfileId]) — one review per session.
+    if (error instanceof ModeratedReviewError) {
+      return NextResponse.json(
+        {
+          error:
+            "This review was removed by our moderation team and can't be edited.",
+        },
+        { status: 409 },
+      );
+    }
+    // @@unique([consultantProfileId, consulteeProfileId]) — one per consultant.
     if (
       error instanceof Prisma.PrismaClientKnownRequestError &&
       error.code === "P2002"
diff --git a/components/appointments/SessionTimeline.tsx b/components/appointments/SessionTimeline.tsx
index f8f99f43e..c2c9078be 100644
--- a/components/appointments/SessionTimeline.tsx
+++ b/components/appointments/SessionTimeline.tsx
@@ -25,6 +25,9 @@ import { CountdownBadge } from "./CountdownBadge";
 
 type SessionStatus = "completed" | "noRecord" | "upcoming" | "joinable";
 
+/** Statuses that mean the session did not take place. */
+const DEAD_SESSION = new Set(["CANCELLED", "RESCHEDULED"]);
+
 interface SessionTimelineProps {
   sessions: SessionVM[];
   isJoining?: boolean;
@@ -235,7 +238,13 @@ export function SessionTimeline({
               </span>
             </div>
 
-            {renderSessionExtra && status !== "upcoming" && !joinable
+            {/* Nothing to rate on a call that never happened. */}
+            {renderSessionExtra &&
+            status !== "upcoming" &&
+            !joinable &&
+            !DEAD_SESSION.has(
+              group.slots[group.slots.length - 1].completionStatus ?? "",
+            )
               ? renderSessionExtra(group.slots[group.slots.length - 1])
               : null}
 
diff --git a/components/appointments/detail/AppointmentDetailClient.tsx b/components/appointments/detail/AppointmentDetailClient.tsx
index 348d10e81..7c54762fa 100644
--- a/components/appointments/detail/AppointmentDetailClient.tsx
+++ b/components/appointments/detail/AppointmentDetailClient.tsx
@@ -1,6 +1,6 @@
 "use client";
 
-import { type ReactNode } from "react";
+import { useMemo, type ReactNode } from "react";
 import Link from "next/link";
 import { format } from "date-fns";
 import { useQuery } from "@tanstack/react-query";
@@ -127,7 +127,21 @@ export function AppointmentDetailClient({
 
   const mapped = detail ? mapAppointmentDetail(detail, role) : null;
   // Which calls of this booking the viewer has already rated.
-  const ratedSlots = useSessionFeedback(appointmentId, true);
+  // Every appointment the rendered sessions belong to, not just this page's:
+  // a subscription group's rows carry their own child appointment ids.
+  const feedbackScopes = useMemo(
+    () =>
+      Array.from(
+        new Set([
+          appointmentId,
+          ...(mapped?.vm.sessions ?? []).map(
+            (s) => s.appointmentId ?? appointmentId,
+          ),
+        ]),
+      ),
+    [appointmentId, mapped?.vm.sessions],
+  );
+  const ratedSlots = useSessionFeedback(feedbackScopes);
   useSetBreadcrumbLabel(mapped?.vm.title);
 
   if (isLoading && !detail) {
diff --git a/components/reviews/SessionRatingRow.tsx b/components/reviews/SessionRatingRow.tsx
index fafde9418..948d803ed 100644
--- a/components/reviews/SessionRatingRow.tsx
+++ b/components/reviews/SessionRatingRow.tsx
@@ -25,13 +25,13 @@ export function SessionRatingRow({
   slotId,
   existingRating,
   readOnly = false,
-}: {
+}: Readonly<{
   appointmentId: string;
   slotId: string;
   existingRating: number | null;
   /** The consultant's view: what this call scored, not something to set. */
   readOnly?: boolean;
-}) {
+}>) {
   const { toast } = useToast();
   const qc = useQueryClient();
   const [rating, setRating] = useState(existingRating ?? 0);
@@ -93,10 +93,10 @@ export function SessionRatingRow({
   }
 
   return (
-    <div
-      className="flex items-center gap-0.5"
-      onClick={(e) => e.stopPropagation()}
-    >
+    // No handler on the wrapper: a div with onClick is unreachable by keyboard
+    // and announces nothing. Each star is a real button and stops propagation
+    // itself, which is what keeps the session row from also firing.
+    <div className="flex items-center gap-0.5">
       {[1, 2, 3, 4, 5].map((n) => (
         <button
           key={n}
diff --git a/components/support/PlatformSupportSheet.tsx b/components/support/PlatformSupportSheet.tsx
index 814f9edc7..2128ed44a 100644
--- a/components/support/PlatformSupportSheet.tsx
+++ b/components/support/PlatformSupportSheet.tsx
@@ -364,6 +364,12 @@ export function PlatformSupportSheet({
                     (m.pending ? " opacity-70" : "")
                   }
                 >
+                  {/* Screen-reader-only speaker attribution: the visual design
+                      dropped the captions, and side plus colour say nothing to
+                      assistive tech. */}
+                  <span className="sr-only">
+                    {m.sender === "USER" ? "You said" : "Assistant said"}:{" "}
+                  </span>
                   {m.body}
                 </div>
               </div>
diff --git a/components/support/SupportThreadSheet.tsx b/components/support/SupportThreadSheet.tsx
index 66bb9ef43..d4269d497 100644
--- a/components/support/SupportThreadSheet.tsx
+++ b/components/support/SupportThreadSheet.tsx
@@ -43,8 +43,6 @@ interface ThreadMessage {
   createdAt: string;
   /** Client-only: shown before the server has confirmed the write. */
   pending?: boolean;
-  /** Client-only: the send failed and the user can retry it in place. */
-  failed?: boolean;
 }
 
 interface SupportThread {
@@ -81,6 +79,8 @@ interface TurnResult {
   }[];
   escalated: boolean;
   resolved: boolean;
+  /** False when the server refused the write (thread closed underneath us). */
+  accepted?: boolean;
   actions: SupportAction[];
 }
 
@@ -128,32 +128,37 @@ interface TurnVars {
   chosenLabel?: string;
 }
 
-/** Mark one optimistic bubble as failed, leaving it where the user put it. */
-function markFailed(old: ThreadData | undefined, id: string): ThreadData {
-  const base: ThreadData = old ?? { thread: null, intents: [] };
-  if (!base.thread) return base;
-  return {
-    ...base,
-    thread: {
-      ...base.thread,
-      messages: base.thread.messages.map((m) =>
-        m.id === id ? { ...m, pending: false, failed: true } : m,
-      ),
-    },
-  };
+/**
+ * "We'll reply by 4:30 PM" beats "soon": a concrete wait is what the hand-off
+ * research found cuts abandonment, and this one is a promise already made at
+ * intake rather than a guess.
+ */
+/** Announced to assistive tech only — the visual design carries no captions. */
+function speakerLabel(sender: Sender): string {
+  if (sender === "USER") return "You said";
+  if (sender === "AGENT") return "Support said";
+  if (sender === "SYSTEM") return "System";
+  return "Assistant said";
 }
 
-/** Drop a failed bubble — it is about to be re-sent as a fresh one. */
-function dropMessage(old: ThreadData | undefined, id: string): ThreadData {
-  const base: ThreadData = old ?? { thread: null, intents: [] };
-  if (!base.thread) return base;
-  return {
-    ...base,
-    thread: {
-      ...base.thread,
-      messages: base.thread.messages.filter((m) => m.id !== id),
-    },
-  };
+function describeWait(ackDueAt: string | null | undefined): string {
+  const FALLBACK = "Our team will reply here and by email.";
+  if (!ackDueAt) return FALLBACK;
+  const due = new Date(ackDueAt);
+  if (Number.isNaN(due.getTime())) return FALLBACK;
+  // Past our own deadline — say so rather than showing a promise that lapsed.
+  if (due.getTime() < Date.now()) {
+    return "Our team is taking longer than usual. You'll get a reply here and by email.";
+  }
+  const time = due.toLocaleTimeString([], {
+    hour: "numeric",
+    minute: "2-digit",
+  });
+  if (due.toDateString() === new Date().toDateString()) {
+    return `Our team will reply by ${time} today.`;
+  }
+  const day = due.toLocaleDateString([], { day: "numeric", month: "short" });
+  return `Our team will reply by ${time} on ${day}.`;
 }
 
 function describeAction(a: SupportAction): string | null {
@@ -195,7 +200,12 @@ export function SupportThreadSheet({
   // A failed send stays in the transcript, keyed by its optimistic bubble id,
   // with the payload needed to send it again. A toast disappears and leaves the
   // user unable to tell whether anything was sent.
-  const [failedTurns, setFailedTurns] = useState<Record<string, TurnVars>>({});
+  // Held in component state, NOT in the query cache: a poll replaces the cache
+  // wholesale with server rows, which would take the failed bubble and its
+  // Retry with it — the exact thing the user needs in order to recover.
+  const [failedTurns, setFailedTurns] = useState<
+    Record<string, { body: string; vars: TurnVars }>
+  >({});
   const { toast } = useToast();
   const qc = useQueryClient();
   const queryKey = ["support-thread", appointmentId] as const;
@@ -243,7 +253,23 @@ export function SupportThreadSheet({
       }
       return { previous, optimisticId };
     },
-    onSuccess: (result) => {
+    onSuccess: (result, vars, context) => {
+      // The server took the request but refused the write. Treat it exactly
+      // like a failure, or the bubble sits there looking delivered.
+      if (result.accepted === false) {
+        const id = context?.optimisticId;
+        const said = vars.userMessage ?? vars.chosenLabel;
+        if (context?.previous) qc.setQueryData(queryKey, context.previous);
+        if (id && said)
+          setFailedTurns((f) => ({ ...f, [id]: { body: said, vars } }));
+        toast({
+          title: "Support",
+          description:
+            "This conversation has been closed, so your message wasn't sent.",
+          variant: "destructive",
+        });
+        return;
+      }
       setLastActions(result.actions ?? []);
       setText("");
       // Merge the server's own reply rather than only invalidating: an
@@ -282,9 +308,12 @@ export function SupportThreadSheet({
       // left them unable to tell whether it had sent at all, which is exactly
       // what a connection timeout on a cold instance looked like.
       const id = context?.optimisticId;
-      if (id) {
-        qc.setQueryData<ThreadData>(queryKey, (old) => markFailed(old, id));
-        setFailedTurns((f) => ({ ...f, [id]: vars }));
+      const said = vars.userMessage ?? vars.chosenLabel;
+      if (id && said) {
+        // Roll the cache back to the server's truth and keep the failed message
+        // beside it in component state, so a refetch cannot erase it.
+        if (context?.previous) qc.setQueryData(queryKey, context.previous);
+        setFailedTurns((f) => ({ ...f, [id]: { body: said, vars } }));
       } else {
         toast({
           title: "Support",
@@ -350,31 +379,13 @@ export function SupportThreadSheet({
   // marker, at the end — otherwise the drawer looks like the bot simply gave
   // up on the user.
   const retryTurn = (id: string) => {
-    const vars = failedTurns[id];
-    if (!vars) return;
+    const failed = failedTurns[id];
+    if (!failed) return;
     setFailedTurns(({ [id]: _gone, ...rest }) => rest);
-    qc.setQueryData<ThreadData>(queryKey, (old) => dropMessage(old, id));
-    turn.mutate(vars);
+    turn.mutate(failed.vars);
   };
 
-  // "We'll reply by 4:30 PM" beats "soon": a concrete wait is what the handoff
-  // research found cuts abandonment, and this one is a promise we already made.
-  const ackDueAt = thread?.supportTicket?.ackDueAt;
-  const waitingLine = (() => {
-    if (!ackDueAt) return "Our team will reply here and by email.";
-    const due = new Date(ackDueAt);
-    if (Number.isNaN(due.getTime()))
-      return "Our team will reply here and by email.";
-    if (due.getTime() < Date.now()) {
-      // Past our own deadline — say so rather than quietly showing a stale time.
-      return "Our team is taking longer than usual. You'll get a reply here and by email.";
-    }
-    const sameDay = due.toDateString() === new Date().toDateString();
-    return `Our team will reply by ${due.toLocaleTimeString([], {
-      hour: "numeric",
-      minute: "2-digit",
-    })}${sameDay ? " today" : ` on ${due.toLocaleDateString([], { day: "numeric", month: "short" })}`}.`;
-  })();
+  const waitingLine = describeWait(thread?.supportTicket?.ackDueAt);
 
   const firstAgent = messages.findIndex((m) => m.sender === "AGENT");
   const handoffIndex =
@@ -458,31 +469,21 @@ export function SupportThreadSheet({
                       and "BOT" contradicted the header's "you're connected with
                       our support team". Side and colour carry the speaker; the
                       divider above carries who is answering. */}
-                  <div className="max-w-[85%]">
-                    <div
-                      className={
-                        "rounded-2xl px-3 py-2 text-sm transition-opacity " +
-                        (m.sender === "USER"
-                          ? "bg-primary text-primary-foreground"
-                          : "bg-muted text-foreground") +
-                        (m.pending ? " opacity-70" : "") +
-                        (m.failed ? " opacity-60 ring-1 ring-destructive" : "")
-                      }
-                    >
-                      {m.body}
-                    </div>
-                    {m.failed && (
-                      <div className="mt-1 flex items-center justify-end gap-2 text-[11px] text-destructive">
-                        <span>Not sent</span>
-                        <button
-                          type="button"
-                          className="underline underline-offset-2"
-                          onClick={() => retryTurn(m.id)}
-                        >
-                          Retry
-                        </button>
-                      </div>
-                    )}
+                  <div
+                    className={
+                      "max-w-[85%] rounded-2xl px-3 py-2 text-sm transition-opacity " +
+                      (m.sender === "USER"
+                        ? "bg-primary text-primary-foreground"
+                        : "bg-muted text-foreground") +
+                      (m.pending ? " opacity-70" : "")
+                    }
+                  >
+                    {/* Dropping the visible USER/BOT captions removed the only
+                        speaker attribution a screen reader had — side and colour
+                        are visual-only. This restores it without restoring the
+                        clutter. */}
+                    <span className="sr-only">{speakerLabel(m.sender)}: </span>
+                    {m.body}
                   </div>
                 </div>
               </div>
@@ -499,6 +500,28 @@ export function SupportThreadSheet({
               </p>
             )}
 
+            {/* Failed sends, kept out of the cache so a poll cannot erase them. */}
+            {Object.entries(failedTurns).map(([id, f]) => (
+              <div key={id} className="flex justify-end">
+                <div className="max-w-[85%]">
+                  <div className="rounded-2xl bg-primary px-3 py-2 text-sm text-primary-foreground opacity-60 ring-1 ring-destructive">
+                    <span className="sr-only">You said: </span>
+                    {f.body}
+                  </div>
+                  <div className="mt-1 flex items-center justify-end gap-2 text-[11px] text-destructive">
+                    <span>Not sent</span>
+                    <button
+                      type="button"
+                      className="underline underline-offset-2"
+                      onClick={() => retryTurn(id)}
+                    >
+                      Retry
+                    </button>
+                  </div>
+                </div>
+              </div>
+            ))}
+
             {handoffIndex === messages.length && (
               <div className="flex items-center gap-2">
                 <span className="h-px flex-1 bg-border" />
diff --git a/hooks/useSessionFeedback.ts b/hooks/useSessionFeedback.ts
index a7cda2f83..676a8e015 100644
--- a/hooks/useSessionFeedback.ts
+++ b/hooks/useSessionFeedback.ts
@@ -6,28 +6,37 @@
  * row.
  */
 
-import { useQuery } from "@tanstack/react-query";
+import { useQueries } from "@tanstack/react-query";
 
 interface SlotFeedback {
   slotOfAppointmentId: string | null;
   rating: number;
 }
 
-export function useSessionFeedback(appointmentId: string, enabled: boolean) {
-  const { data } = useQuery({
-    queryKey: ["appointment-feedback", appointmentId],
-    enabled,
-    queryFn: async (): Promise<Record<string, number>> => {
-      const res = await fetch(`/api/appointments/${appointmentId}/feedback`);
-      if (!res.ok) return {};
-      const { data } = await res.json();
-      const rows = (data ?? []) as SlotFeedback[];
-      return Object.fromEntries(
-        rows
-          .filter((r) => r.slotOfAppointmentId)
-          .map((r) => [r.slotOfAppointmentId as string, r.rating]),
-      );
-    },
+/**
+ * Sessions in a subscription or class group belong to DIFFERENT appointments —
+ * `SessionVM.appointmentId` differs per row — so fetching only the page's own
+ * appointment left every child session looking unrated, and its invalidation
+ * key pointed at the wrong query.
+ */
+export function useSessionFeedback(
+  appointmentIds: readonly string[],
+): Record<string, number> {
+  const results = useQueries({
+    queries: appointmentIds.map((appointmentId) => ({
+      queryKey: ["appointment-feedback", appointmentId],
+      queryFn: async (): Promise<Record<string, number>> => {
+        const res = await fetch(`/api/appointments/${appointmentId}/feedback`);
+        if (!res.ok) return {};
+        const { data } = await res.json();
+        const rows = (data ?? []) as SlotFeedback[];
+        return Object.fromEntries(
+          rows
+            .filter((r) => r.slotOfAppointmentId)
+            .map((r) => [r.slotOfAppointmentId as string, r.rating]),
+        );
+      },
+    })),
   });
-  return data ?? {};
+  return Object.assign({}, ...results.map((r) => r.data ?? {}));
 }
diff --git a/lib/data/review-privacy.ts b/lib/data/review-privacy.ts
index 643e86f6d..67d819dd4 100644
--- a/lib/data/review-privacy.ts
+++ b/lib/data/review-privacy.ts
@@ -28,7 +28,7 @@ export function stripAnonymousReviewer<T extends AnonymisableReview>(
     consulteeProfile: {
       ...review.consulteeProfile,
       user: {
-        ...(review.consulteeProfile.user ?? {}),
+        ...review.consulteeProfile.user,
         name: null,
         image: null,
       },
diff --git a/lib/support/service.ts b/lib/support/service.ts
index 4dfad2edf..f63de739e 100644
--- a/lib/support/service.ts
+++ b/lib/support/service.ts
@@ -68,6 +68,12 @@ export interface RunTurnResult {
   actions: SupportAction[];
   escalated: boolean;
   resolved: boolean;
+  /**
+   * False when a CAS refused the write — the thread settled underneath the
+   * user. Without it a discarded message came back as a plain success and the
+   * client marked it delivered.
+   */
+  accepted?: boolean;
   supportTicketId: string | null;
   /** Machine-readable escalation reason (terminal node / policy), if any. */
   reason?: string;
@@ -331,6 +337,7 @@ async function persistHumanTurn(
   // back claiming it was still with the team.
   let status = thread.status;
   let messageId: string | null = null;
+  let accepted = true;
 
   if (userMessage) {
     // Deliberately SHORT. On Netlify PG_POOL_MAX=1 serialises every query onto
@@ -369,13 +376,16 @@ async function persistHumanTurn(
     );
 
     if (!written) {
-      // The thread settled underneath us. Report where it actually landed
-      // rather than claiming the message went somewhere.
+      // The thread settled underneath us and the CAS refused the write. Report
+      // where it actually landed AND that the message was not accepted —
+      // returning a plain success made the client mark it delivered, so a
+      // message that was never stored looked sent.
       const current = await prisma.appointmentSupportThread.findUniqueOrThrow({
         where: { id: thread.id },
         select: { status: true },
       });
       status = current.status;
+      accepted = false;
     } else {
       messageId = written.id;
 
@@ -412,6 +422,7 @@ async function persistHumanTurn(
     actions: [],
     escalated: true,
     resolved: false,
+    accepted,
     supportTicketId: thread.supportTicketId,
   };
 }

From f163cc866c4f1f0b442807569cd72f55e66fc78d Mon Sep 17 00:00:00 2001
From: Kaustav Ghosh <44238657+teetangh@users.noreply.github.com>
Date: Sat, 29 Aug 2026 14:40:27 +0530
Subject: [PATCH 07/10] fix(observability): deploy previews report to the
 project people actually watch
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Closes #1086.

Previews were pointed at a SEPARATE Sentry project (…/4509348818124800) from
production (…/4511593990914048), so an error found on a preview never reached
the dashboard anyone looks at. That is not a theoretical gap: the connection
timeout behind the "something went wrong" toast on an escalated thread had to be
dug out of Netlify function logs, and it only surfaced there because it happened
to be logged. Anything captured-but-not-logged was simply invisible.

Both preview contexts now use the production DSN. Production's own values are
untouched. `environment` already separated them — "preview" vs "production" —
so preview noise stays out of production alerting while being visible at all,
and this adds the branch as a tag so a given PR's errors can be isolated.

`BRANCH` only exists on the Netlify build machine and `NEXT_PUBLIC_*` is inlined
at build, so the tag is baked in next.config.mjs alongside the origin values
that are resolved there for the same reason.

Part of #705

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01Fb4vbRYxJH7wxc4tjhm6XJ
---
 next.config.mjs         |  7 +++++++
 sentry.shared.config.ts | 13 +++++++++++++
 2 files changed, 20 insertions(+)

diff --git a/next.config.mjs b/next.config.mjs
index 1cb9d517a..72dd347d1 100644
--- a/next.config.mjs
+++ b/next.config.mjs
@@ -149,6 +149,13 @@ const nextConfig = {
           ].join(","),
         }
       : {}),
+    // #1086 — previews now report to the SAME Sentry project as production, so
+    // the branch is what makes their noise filterable. Baked at build for the
+    // same reason as the URLs above: NEXT_PUBLIC_* is inlined into the client
+    // bundle, and Netlify's BRANCH only exists on the build machine.
+    ...(process.env.BRANCH
+      ? { NEXT_PUBLIC_SENTRY_BRANCH: process.env.BRANCH }
+      : {}),
   },
   // Only the Netlify deploy build OOM'd at the 4GB heap re-running ESLint + tsc.
   // Skip them THERE (NETLIFY=true is set in Netlify's build env) to drop that memory
diff --git a/sentry.shared.config.ts b/sentry.shared.config.ts
index c5d75ee63..8bf7e9f26 100644
--- a/sentry.shared.config.ts
+++ b/sentry.shared.config.ts
@@ -28,6 +28,19 @@ export function initSentry(overrides?: Partial<SentryInitOptions>): void {
     enabled: Boolean(dsn) && isNotDevelopmentEnvironment(),
     environment: process.env.NEXT_PUBLIC_SENTRY_ENVIRONMENT,
 
+    // #1086 — deploy previews used to report to a SEPARATE Sentry project, so
+    // an error found on a preview was invisible in the one anybody watches and
+    // had to be dug out of Netlify function logs. They now share the production
+    // project; `environment` ("preview" vs "production") keeps them out of
+    // production alerting, and this tag says WHICH branch produced it.
+    initialScope: {
+      tags: {
+        ...(process.env.NEXT_PUBLIC_SENTRY_BRANCH
+          ? { branch: process.env.NEXT_PUBLIC_SENTRY_BRANCH }
+          : {}),
+      },
+    },
+
     // Sample 10% of traces in production; everything outside production.
     tracesSampleRate: isProductionEnvironment() ? 0.1 : 1,
 

From 37e10ada95ed61cf1daf67de738e08acd68fabb6 Mon Sep 17 00:00:00 2001
From: Kaustav Ghosh <44238657+teetangh@users.noreply.github.com>
Date: Sat, 29 Aug 2026 15:52:27 +0530
Subject: [PATCH 08/10] fix(reviews): the update path was lying about what it
 saved
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Three bugs an end-to-end pass on the deploy preview found, all of them mine.

**Anonymity could never be changed.** `UpdateReviewSchema` picked only `rating`
and `reviewDescription`, so zod silently stripped `isAnonymous` from every PUT.
The checkbox stayed ticked, the toast said "Review updated", and the row was
untouched — the reviewer believed they were anonymous and were not. Since the
card always PUTs once a review exists, the flag could only ever be set at
creation, which the UI never does.

**A background refetch overwrote what the user was typing.** The seeding effect
depended on `existing`, and React Query returns a fresh object on every refetch,
so the 15s poll reset the textarea to the stored text. Clear your review, wait a
moment, hit Update, and the OLD text was submitted back. It now seeds once per
review id, so switching sessions still re-seeds but a refetch cannot.

**The bot scolded users for typing the word it told them to type.** "agent"
matches no option, so the walk emits "I didn't catch that — or type 'agent' to
reach a person", and then `decideEscalation` escalates on the keyword. Both were
persisted, so the transcript contradicted itself one line above the hand-off.
The nudge is now dropped whenever the turn escalates anyway; the escalation
message is the real answer. This also removes the stray nudge a double-clicked
chip used to leave behind.

Part of #705

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01Fb4vbRYxJH7wxc4tjhm6XJ
---
 __tests__/support/service.test.ts        | 81 ++++++++++++++++++++----
 app/api/user/reviews/[id]/route.ts       | 16 ++++-
 components/reviews/SessionReviewCard.tsx | 17 +++--
 lib/support/service.ts                   | 10 ++-
 schemas/feedbacks.ts                     |  5 ++
 5 files changed, 108 insertions(+), 21 deletions(-)

diff --git a/__tests__/support/service.test.ts b/__tests__/support/service.test.ts
index d81cc6cb1..264c3891d 100644
--- a/__tests__/support/service.test.ts
+++ b/__tests__/support/service.test.ts
@@ -27,7 +27,11 @@ jest.mock("../../lib/prisma", () => ({
       findUniqueOrThrow: jest.fn(),
     },
     supportMessage: { create: jest.fn() },
-    supportTicket: { create: jest.fn(), findUnique: jest.fn(), update: jest.fn() },
+    supportTicket: {
+      create: jest.fn(),
+      findUnique: jest.fn(),
+      update: jest.fn(),
+    },
     supportTicketCounter: { upsert: jest.fn() },
     user: { findMany: jest.fn() },
     $transaction: jest.fn(),
@@ -51,7 +55,11 @@ const mockPrisma = prisma as unknown as {
     findUniqueOrThrow: jest.Mock;
   };
   supportMessage: { create: jest.Mock };
-  supportTicket: { create: jest.Mock; findUnique: jest.Mock; update: jest.Mock };
+  supportTicket: {
+    create: jest.Mock;
+    findUnique: jest.Mock;
+    update: jest.Mock;
+  };
   supportTicketCounter: { upsert: jest.Mock };
   user: { findMany: jest.Mock };
   $transaction: jest.Mock;
@@ -111,7 +119,9 @@ beforeEach(() => {
   mockPrisma.appointmentSupportThread.update.mockResolvedValue({
     messageSeq: 0,
   });
-  mockPrisma.appointmentSupportThread.updateMany.mockResolvedValue({ count: 1 });
+  mockPrisma.appointmentSupportThread.updateMany.mockResolvedValue({
+    count: 1,
+  });
   mockPrisma.appointmentSupportThread.findUniqueOrThrow.mockResolvedValue({
     status: "ESCALATED",
     messageSeq: 0,
@@ -125,7 +135,9 @@ beforeEach(() => {
 describe("runSupportTurn", () => {
   it("returns 404-null when the appointment is gone", async () => {
     mockPrisma.appointment.findUnique.mockResolvedValueOnce(null);
-    const r = await runSupportTurn("missing", "user1", { category: "CANCEL_REFUND" });
+    const r = await runSupportTurn("missing", "user1", {
+      category: "CANCEL_REFUND",
+    });
     expect(r).toBeNull();
   });
 
@@ -133,7 +145,9 @@ describe("runSupportTurn", () => {
     mockPrisma.appointmentSupportThread.upsert.mockResolvedValue(
       threadRow({ currentNodeId: null }),
     );
-    const r = await runSupportTurn("appt1", "user1", { category: "CANCEL_REFUND" });
+    const r = await runSupportTurn("appt1", "user1", {
+      category: "CANCEL_REFUND",
+    });
     expect(r?.status).toBe("IN_PROGRESS");
     expect(r?.currentNodeId).toBe("start");
     expect(r?.escalated).toBe(false);
@@ -145,8 +159,12 @@ describe("runSupportTurn", () => {
     mockPrisma.appointmentSupportThread.upsert.mockResolvedValue(
       threadRow({ currentNodeId: "start" }),
     );
-    const r = await runSupportTurn("appt1", "user1", { chosenOptionId: "cancel" });
-    expect(r?.actions).toEqual([{ kind: "OFFER_CANCEL_REFUND", refundPct: 100 }]);
+    const r = await runSupportTurn("appt1", "user1", {
+      chosenOptionId: "cancel",
+    });
+    expect(r?.actions).toEqual([
+      { kind: "OFFER_CANCEL_REFUND", refundPct: 100 },
+    ]);
   });
 
   it("escalates on a human keyword: creates a SupportTicket and flips to HUMAN", async () => {
@@ -166,7 +184,10 @@ describe("runSupportTurn", () => {
     expect(mockPrisma.supportTicket.create).toHaveBeenCalledTimes(1);
     expect(mockPrisma.appointmentSupportThread.update).toHaveBeenCalledWith(
       expect.objectContaining({
-        data: expect.objectContaining({ status: "ESCALATED", activeChannel: "HUMAN" }),
+        data: expect.objectContaining({
+          status: "ESCALATED",
+          activeChannel: "HUMAN",
+        }),
       }),
     );
   });
@@ -175,7 +196,9 @@ describe("runSupportTurn", () => {
     mockPrisma.appointmentSupportThread.upsert.mockResolvedValue(
       threadRow({ activeChannel: "HUMAN", supportTicketId: "ticket-existing" }),
     );
-    const r = await runSupportTurn("appt1", "user1", { userMessage: "any update?" });
+    const r = await runSupportTurn("appt1", "user1", {
+      userMessage: "any update?",
+    });
     expect(r?.activeChannel).toBe("HUMAN");
     expect(r?.supportTicketId).toBe("ticket-existing");
     expect(mockPrisma.supportTicket.create).not.toHaveBeenCalled();
@@ -197,7 +220,9 @@ describe("runSupportTurn", () => {
     mockPrisma.appointmentSupportThread.upsert.mockResolvedValue(
       threadRow({ category: "CANCEL_REFUND", currentNodeId: "ghost-node" }),
     );
-    const r = await runSupportTurn("appt1", "user1", { chosenOptionId: "cancel" });
+    const r = await runSupportTurn("appt1", "user1", {
+      chosenOptionId: "cancel",
+    });
     expect(r?.currentNodeId).toBe("start"); // presented the CURRENT entry…
     expect(r?.escalated).toBe(false); // …not failed safe to a human
     expect(mockPrisma.supportMessage.create).toHaveBeenCalledTimes(1);
@@ -207,7 +232,9 @@ describe("runSupportTurn", () => {
     mockPrisma.appointmentSupportThread.upsert.mockResolvedValue(
       threadRow({ category: "CANCEL_REFUND", currentNodeId: "start" }),
     );
-    const r = await runSupportTurn("appt1", "user1", { chosenOptionId: "bogus" });
+    const r = await runSupportTurn("appt1", "user1", {
+      chosenOptionId: "bogus",
+    });
     expect(r?.currentNodeId).toBe("start"); // cursor did not move
     // Exactly one bubble, and it is NOT a verbatim repeat of the prompt: this
     // used to persist nothing at all, so a user who typed at a prompt watched
@@ -240,11 +267,41 @@ describe("runSupportTurn", () => {
     expect(written[1].sender).toBe("BOT");
   });
 
+  it("does not scold the user for typing the word the nudge told them to type", async () => {
+    // "agent" matches no option, so the walk emits "I didn't catch that…" —
+    // which is the very copy telling them to type "agent". Escalating while
+    // persisting that message left the transcript contradicting itself one line
+    // above the hand-off.
+    mockPrisma.appointmentSupportThread.upsert.mockResolvedValue(
+      threadRow({ category: "CANCEL_REFUND", currentNodeId: "start" }),
+    );
+    mockPrisma.supportTicket.create.mockResolvedValue({
+      id: "t-kw",
+      title: "T",
+      organizationId: null,
+      referenceNumber: "FAM-2026-000001",
+    });
+    const r = await runSupportTurn("appt1", "user1", { userMessage: "agent" });
+    expect(r?.escalated).toBe(true);
+
+    const bodies = mockPrisma.supportMessage.create.mock.calls.map(
+      (c) => c[0].data,
+    );
+    // The user's own words are still recorded…
+    expect(bodies.some((b) => b.sender === "USER" && b.body === "agent")).toBe(
+      true,
+    );
+    // …but nothing tells them it wasn't understood.
+    expect(bodies.some((b) => /didn't catch that/i.test(b.body))).toBe(false);
+  });
+
   it("clicking the active intent chip restarts the flow at its entry", async () => {
     mockPrisma.appointmentSupportThread.upsert.mockResolvedValue(
       threadRow({ category: "CANCEL_REFUND", currentNodeId: "confirm" }),
     );
-    const r = await runSupportTurn("appt1", "user1", { category: "CANCEL_REFUND" });
+    const r = await runSupportTurn("appt1", "user1", {
+      category: "CANCEL_REFUND",
+    });
     expect(r?.currentNodeId).toBe("start");
     expect(r?.status).toBe("IN_PROGRESS");
   });
diff --git a/app/api/user/reviews/[id]/route.ts b/app/api/user/reviews/[id]/route.ts
index 4259877c6..06c6a460d 100644
--- a/app/api/user/reviews/[id]/route.ts
+++ b/app/api/user/reviews/[id]/route.ts
@@ -40,7 +40,10 @@ export async function GET(
 
     return NextResponse.json(review, { status: 200 });
   } catch (error) {
-    Sentry.captureException(error instanceof Error ? error : new Error(String(error)), { tags: { subsystem: "auth" } });
+    Sentry.captureException(
+      error instanceof Error ? error : new Error(String(error)),
+      { tags: { subsystem: "auth" } },
+    );
     console.error("Error getting review:", error);
     return NextResponse.json(
       { error: "Internal Server Error" },
@@ -108,6 +111,7 @@ export async function PUT(
             data: {
               rating: body.rating,
               reviewDescription: body.reviewDescription,
+              isAnonymous: body.isAnonymous,
             },
             include: {
               consultantProfile: { select: consultantPublicScalars },
@@ -127,7 +131,10 @@ export async function PUT(
 
     return NextResponse.json(updatedReview, { status: 200 });
   } catch (error) {
-    Sentry.captureException(error instanceof Error ? error : new Error(String(error)), { tags: { subsystem: "auth" } });
+    Sentry.captureException(
+      error instanceof Error ? error : new Error(String(error)),
+      { tags: { subsystem: "auth" } },
+    );
     console.error("Error updating review:", error);
     return NextResponse.json(
       { error: "Internal Server Error" },
@@ -189,7 +196,10 @@ export async function DELETE(
       { status: 200 },
     );
   } catch (error) {
-    Sentry.captureException(error instanceof Error ? error : new Error(String(error)), { tags: { subsystem: "auth" } });
+    Sentry.captureException(
+      error instanceof Error ? error : new Error(String(error)),
+      { tags: { subsystem: "auth" } },
+    );
     console.error("Error deleting review:", error);
     return NextResponse.json(
       { error: "Internal Server Error" },
diff --git a/components/reviews/SessionReviewCard.tsx b/components/reviews/SessionReviewCard.tsx
index 6a524ed9e..1c87c6927 100644
--- a/components/reviews/SessionReviewCard.tsx
+++ b/components/reviews/SessionReviewCard.tsx
@@ -21,7 +21,7 @@
  * negative, with no revenue effect.
  */
 
-import { useEffect, useState } from "react";
+import { useEffect, useRef, useState } from "react";
 import { useMutation, useQuery, useQueryClient } from "@tanstack/react-query";
 import { Star } from "lucide-react";
 import { Textarea } from "@/components/ui/textarea";
@@ -73,14 +73,21 @@ export function SessionReviewCard({
   const [text, setText] = useState("");
   const [anonymous, setAnonymous] = useState(false);
 
+  // Seed the form from the stored review ONCE per review, not on every render
+  // of a new `existing` object. React Query hands back a fresh object on each
+  // refetch, so depending on its identity meant the 15s poll silently reset the
+  // textarea to the saved text — and a user who had just cleared it submitted
+  // the old value back. Keyed on the review id (and null, for "not written
+  // yet") so switching sessions still re-seeds.
+  const seededFor = useRef<string | null>(null);
+  const seedKey = existing?.id ?? `none:${appointmentId}`;
   useEffect(() => {
-    // Reset on absence too, and key on the appointment: without either, moving
-    // to a session you have NOT reviewed kept the previous session's stars and
-    // text sitting in the form, ready to be posted against the wrong session.
+    if (seededFor.current === seedKey) return;
+    seededFor.current = seedKey;
     setRating(existing?.rating ?? 0);
     setText(existing?.reviewDescription ?? "");
     setAnonymous(existing?.isAnonymous ?? false);
-  }, [existing, appointmentId]);
+  }, [seedKey, existing]);
 
   const save = useMutation({
     mutationFn: async () => {
diff --git a/lib/support/service.ts b/lib/support/service.ts
index f63de739e..ad6d9eea6 100644
--- a/lib/support/service.ts
+++ b/lib/support/service.ts
@@ -236,12 +236,20 @@ export async function runSupportTurn(
 
   const decision = decideEscalation(ctx, turn, input.userMessage);
   if (decision.escalate) {
+    // Drop the walk's "I didn't catch that" nudge when the turn escalates
+    // anyway. Typing "agent" hits no option, so the walk emits the nudge — and
+    // the nudge is the copy telling the user to type "agent". Persisting it
+    // left the transcript scolding them for doing exactly what it asked, one
+    // line above the hand-off. The escalation message is the real answer.
+    const escalating = turn.unrecognized
+      ? { ...turn, messages: [], unrecognized: false }
+      : turn;
     return escalate(
       ctx,
       thread.id,
       thread.supportTicketId,
       category,
-      turn,
+      escalating,
       input.userMessage,
       decision.reason ?? "escalated",
     );
diff --git a/schemas/feedbacks.ts b/schemas/feedbacks.ts
index 76e85f63f..7566478d3 100644
--- a/schemas/feedbacks.ts
+++ b/schemas/feedbacks.ts
@@ -40,7 +40,12 @@ export const CreateReviewSchema = z.object({
 });
 
 // PUT only mutates the two consultee-owned fields; a partial keeps either optional.
+// #705 — `isAnonymous` MUST be here. It was omitted, so zod silently stripped
+// it from every PUT: the checkbox stayed ticked, the toast said "updated", and
+// the row never changed. Anonymity could only ever be set at creation, which
+// the UI never does once a review exists.
 export const UpdateReviewSchema = CreateReviewSchema.pick({
   rating: true,
   reviewDescription: true,
+  isAnonymous: true,
 }).partial();

From 1674e8dd84b4750f55a30976f17cbf942e757114 Mon Sep 17 00:00:00 2001
From: Kaustav Ghosh <44238657+teetangh@users.noreply.github.com>
Date: Sat, 29 Aug 2026 16:08:11 +0530
Subject: [PATCH 09/10] fix(feedback): you may rate a call you attended, not
 one that merely happened
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Three follow-ups from the end-to-end QA pass.

**Attendance now gates the rating.** A COMPLETED slot qualified whether or not
the caller ever joined it, so a no-show could rate a session they did not attend
and it fed the consultant's quality signal. The rule is now: you were
demonstrably in the call, OR the slot is UNVERIFIED — "past, with no
MeetingSession", which is what an offline session looks like and where no
telemetry could ever exist. It deliberately cannot key on `completionStatus`
alone: that only flips when the call.session_ended webhook lands, after the LAST
participant leaves plus a timeout, so a post-call prompt keyed on it would show
nothing to whoever leaves first.

The GET now returns which slots are rateable, so the timeline offers stars only
where a rating would be accepted rather than inviting a click the route then
refuses.

**Double-clicking a chip no longer fires twice.** `turnPending` is React state,
so two clicks in the same tick both read the stale value and both pass. A ref
flips synchronously and stops the second before it leaves the browser — which
also spares a pool where PG_POOL_MAX=1 serialises everything a wasted round
trip. The write layer already deduped, so nothing was corrupted; this stops the
duplicate bubble flicker and the redundant request.

Related: #1269 (withdrawing Stream consent takes down the appointments route —
pre-existing, found by the same QA pass, fixed separately).

Part of #705

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01Fb4vbRYxJH7wxc4tjhm6XJ
---
 .../[appointmentId]/feedback/route.ts         | 26 +++++++++++---
 .../detail/AppointmentDetailClient.tsx        | 36 +++++++++++++------
 components/support/SupportThreadSheet.tsx     | 18 +++++++---
 hooks/useSessionFeedback.ts                   | 36 +++++++++++++------
 lib/reviews.ts                                | 25 +++++++------
 5 files changed, 100 insertions(+), 41 deletions(-)

diff --git a/app/api/appointments/[appointmentId]/feedback/route.ts b/app/api/appointments/[appointmentId]/feedback/route.ts
index 294f19fb8..6f020ed4c 100644
--- a/app/api/appointments/[appointmentId]/feedback/route.ts
+++ b/app/api/appointments/[appointmentId]/feedback/route.ts
@@ -12,6 +12,7 @@ import { NextRequest, NextResponse } from "next/server";
 import { z } from "zod";
 import prisma from "@/lib/prisma";
 import { appointmentRaterRole } from "@/lib/data/appointment-detail";
+import { heldSlot } from "@/lib/reviews";
 import { AppointmentIdParams } from "@/schemas/support";
 import { parseRouteParams, supportError } from "@/lib/api/support-http";
 import {
@@ -54,6 +55,16 @@ export async function GET(
     const asProvider =
       appointmentRaterRole(auth.userId, auth.detail) === "PROVIDER";
 
+    // Which calls of this booking the caller may rate at all, so the timeline
+    // offers stars only where a rating would be accepted rather than erroring
+    // after the click.
+    const rateable = asProvider
+      ? []
+      : await prisma.slotOfAppointment.findMany({
+          where: { appointmentId, ...heldSlot(auth.userId) },
+          select: { id: true },
+        });
+
     // Every call of this booking the caller has rated (or, for the provider,
     // every attendee rating on it), so the timeline can show a per-session
     // breakdown instead of one number for the package.
@@ -71,7 +82,10 @@ export async function GET(
       // A provider could otherwise infer a rater from ordering on a group call.
       orderBy: { createdAt: "asc" },
     });
-    return NextResponse.json({ data: feedback });
+    return NextResponse.json({
+      data: feedback,
+      rateableSlotIds: rateable.map((s) => s.id),
+    });
   } catch (cause) {
     return supportError({
       status: 500,
@@ -131,10 +145,12 @@ export async function POST(
       where: {
         id: body.data.slotId,
         appointmentId,
-        deletedAt: null,
-        // A cancelled or rescheduled call never happened, so there is nothing
-        // to rate — and a rating on one would still reach the org average.
-        completionStatus: { notIn: ["CANCELLED", "RESCHEDULED"] },
+        // You may rate a call you ATTENDED, or one nobody could have recorded
+        // (an offline session). A COMPLETED slot the caller never joined does
+        // not qualify: a no-show rating would otherwise feed the consultant's
+        // quality signal. `heldSlot` also excludes cancelled and rescheduled
+        // calls, which never happened at all.
+        ...heldSlot(auth.userId),
       },
       select: { id: true },
     });
diff --git a/components/appointments/detail/AppointmentDetailClient.tsx b/components/appointments/detail/AppointmentDetailClient.tsx
index 7c54762fa..32ce482b1 100644
--- a/components/appointments/detail/AppointmentDetailClient.tsx
+++ b/components/appointments/detail/AppointmentDetailClient.tsx
@@ -141,7 +141,7 @@ export function AppointmentDetailClient({
       ),
     [appointmentId, mapped?.vm.sessions],
   );
-  const ratedSlots = useSessionFeedback(feedbackScopes);
+  const sessionFeedback = useSessionFeedback(feedbackScopes);
   useSetBreadcrumbLabel(mapped?.vm.title);
 
   if (isLoading && !detail) {
@@ -364,16 +364,30 @@ export function AppointmentDetailClient({
                   // rates. Attendees only: the API authorizes any participant,
                   // and a consultant rating their own session would feed the
                   // org quality average.
-                  renderSessionExtra={(session) => (
-                    <SessionRatingRow
-                      appointmentId={session.appointmentId ?? appointmentId}
-                      slotId={session.slotId}
-                      existingRating={ratedSlots[session.slotId] ?? null}
-                      // The consultant sees what a call scored; only the
-                      // attendee can set it.
-                      readOnly={role !== "consultee"}
-                    />
-                  )}
+                  renderSessionExtra={(session) => {
+                    const rating =
+                      sessionFeedback.ratings[session.slotId] ?? null;
+                    // Offer stars only where a rating would be ACCEPTED —
+                    // you attended, or nobody could have recorded it. Showing
+                    // them on a call the viewer never joined invited a click
+                    // that the route then refused.
+                    const canRate = sessionFeedback.rateable.has(
+                      session.slotId,
+                    );
+                    if (role === "consultee" && !canRate && rating === null) {
+                      return null;
+                    }
+                    return (
+                      <SessionRatingRow
+                        appointmentId={session.appointmentId ?? appointmentId}
+                        slotId={session.slotId}
+                        existingRating={rating}
+                        // The consultant sees what a call scored; only the
+                        // attendee can set it.
+                        readOnly={role !== "consultee" || !canRate}
+                      />
+                    );
+                  }}
                   sessions={vm.sessions}
                   joinWindowMs={joinWindowMs}
                   defaultExpanded
diff --git a/components/support/SupportThreadSheet.tsx b/components/support/SupportThreadSheet.tsx
index d4269d497..71517415f 100644
--- a/components/support/SupportThreadSheet.tsx
+++ b/components/support/SupportThreadSheet.tsx
@@ -374,6 +374,16 @@ export function SupportThreadSheet({
     !isHuman && !isResolved ? (activePrompt?.metadata?.options ?? []) : [];
   const started = !!thread;
   const turnPending = turn.isPending;
+  // `turnPending` is React state, so two clicks in the same tick both read the
+  // stale value and both fire. A ref flips synchronously and stops the second
+  // before it leaves the browser — which also spares a pool where
+  // PG_POOL_MAX=1 serialises everything an entirely wasted round trip.
+  const inFlight = useRef(false);
+  const submitTurn = (vars: TurnVars) => {
+    if (inFlight.current) return;
+    inFlight.current = true;
+    turn.mutate(vars, { onSettled: () => (inFlight.current = false) });
+  };
   // The hand-off sits immediately before the first AGENT message. A thread that
   // has escalated but whose staff reply has not landed yet still gets the
   // marker, at the end — otherwise the drawer looks like the bot simply gave
@@ -382,7 +392,7 @@ export function SupportThreadSheet({
     const failed = failedTurns[id];
     if (!failed) return;
     setFailedTurns(({ [id]: _gone, ...rest }) => rest);
-    turn.mutate(failed.vars);
+    submitTurn(failed.vars);
   };
 
   const waitingLine = describeWait(thread?.supportTicket?.ackDueAt);
@@ -602,7 +612,7 @@ export function SupportThreadSheet({
                     size="sm"
                     disabled={turnPending}
                     onClick={() =>
-                      turn.mutate({
+                      submitTurn({
                         category: i.category,
                         chosenLabel: i.label,
                       })
@@ -623,7 +633,7 @@ export function SupportThreadSheet({
                     size="sm"
                     disabled={turnPending}
                     onClick={() =>
-                      turn.mutate({
+                      submitTurn({
                         chosenOptionId: o.id,
                         chosenLabel: o.label,
                       })
@@ -641,7 +651,7 @@ export function SupportThreadSheet({
             onSubmit={(e) => {
               e.preventDefault();
               const msg = text.trim();
-              if (msg) turn.mutate({ userMessage: msg });
+              if (msg) submitTurn({ userMessage: msg });
             }}
           >
             <Input
diff --git a/hooks/useSessionFeedback.ts b/hooks/useSessionFeedback.ts
index 676a8e015..28c8882a4 100644
--- a/hooks/useSessionFeedback.ts
+++ b/hooks/useSessionFeedback.ts
@@ -19,24 +19,40 @@ interface SlotFeedback {
  * appointment left every child session looking unrated, and its invalidation
  * key pointed at the wrong query.
  */
+export interface SessionFeedbackState {
+  /** slot id → the rating this viewer gave it. */
+  ratings: Record<string, number>;
+  /** Slots this viewer may rate at all — attended, or offline. */
+  rateable: Set<string>;
+}
+
 export function useSessionFeedback(
   appointmentIds: readonly string[],
-): Record<string, number> {
+): SessionFeedbackState {
   const results = useQueries({
     queries: appointmentIds.map((appointmentId) => ({
       queryKey: ["appointment-feedback", appointmentId],
-      queryFn: async (): Promise<Record<string, number>> => {
+      queryFn: async (): Promise<{
+        ratings: Record<string, number>;
+        rateable: string[];
+      }> => {
         const res = await fetch(`/api/appointments/${appointmentId}/feedback`);
-        if (!res.ok) return {};
-        const { data } = await res.json();
+        if (!res.ok) return { ratings: {}, rateable: [] };
+        const { data, rateableSlotIds } = await res.json();
         const rows = (data ?? []) as SlotFeedback[];
-        return Object.fromEntries(
-          rows
-            .filter((r) => r.slotOfAppointmentId)
-            .map((r) => [r.slotOfAppointmentId as string, r.rating]),
-        );
+        return {
+          ratings: Object.fromEntries(
+            rows
+              .filter((r) => r.slotOfAppointmentId)
+              .map((r) => [r.slotOfAppointmentId as string, r.rating]),
+          ),
+          rateable: (rateableSlotIds ?? []) as string[],
+        };
       },
     })),
   });
-  return Object.assign({}, ...results.map((r) => r.data ?? {}));
+  return {
+    ratings: Object.assign({}, ...results.map((r) => r.data?.ratings ?? {})),
+    rateable: new Set(results.flatMap((r) => r.data?.rateable ?? [])),
+  };
 }
diff --git a/lib/reviews.ts b/lib/reviews.ts
index baf6448bc..6b3a194d2 100644
--- a/lib/reviews.ts
+++ b/lib/reviews.ts
@@ -24,22 +24,25 @@ export const MIN_RATED_UNITS_FOR_PUBLIC_SCORE = 5;
  * offline session looks like. Excluding it would silently deny a review to
  * everyone whose session did not run through the video stack.
  */
-function heldSlot(userId: string) {
+export function heldSlot(userId: string) {
   return {
     deletedAt: null,
+    // Not "the call happened" — "YOU were at the call". A COMPLETED slot the
+    // user never joined used to qualify, so a no-show could rate a session they
+    // did not attend and it fed the consultant's quality signal. Two ways in:
     OR: [
+      // 1. You were demonstrably there. Also the reason this cannot key on
+      //    `completionStatus` alone: that only flips when the
+      //    call.session_ended webhook lands, which fires after the LAST
+      //    participant leaves plus an inactivity timeout — so a post-call
+      //    prompt keyed on it shows nothing to whoever leaves first.
+      { meetingSession: { attendances: { some: { userId } } } },
+      // 2. Nobody COULD have recorded it. UNVERIFIED means "past, with no
+      //    MeetingSession", which is what an offline session looks like —
+      //    excluding it would deny feedback to everyone who met in person.
       {
-        completionStatus: {
-          in: ["COMPLETED", "UNVERIFIED"] as SlotCompletionStatus[],
-        },
+        completionStatus: "UNVERIFIED" as SlotCompletionStatus,
       },
-      // Or THIS user was demonstrably in the call. `completionStatus` only
-      // flips when the call.session_ended webhook lands, which fires after the
-      // LAST participant leaves plus an inactivity timeout — so without this
-      // the post-call prompt shows nothing to whoever leaves first, which is
-      // most people. Attendance is the stronger proof anyway: it distinguishes
-      // "bought a seat" from "was actually there".
-      { meetingSession: { attendances: { some: { userId } } } },
     ],
   };
 }

From 2a38154f7de176277eab1d0f2c117314560fd798 Mon Sep 17 00:00:00 2001
From: Kaustav Ghosh <44238657+teetangh@users.noreply.github.com>
Date: Sat, 29 Aug 2026 16:33:26 +0530
Subject: [PATCH 10/10] fix(reviews): an opaque id stops being opaque the
 second time it appears
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Four findings from the third review round.

**Anonymity leaked through correlation.** The strip nulled the name and avatar
but left `consulteeProfile.id` and `userId` in the public payload. Review one
expert under your name and another anonymously and the same profile id shipped
in both CDN-cached responses — join them and the anonymous review is attributed.
The whole profile object is dropped now, and the test asserts on the serialised
payload rather than on individual fields, so nothing identifying can creep back
in unnoticed.

**The existing-review lookup was scoped to the wrong thing.** It was a nested
include on the Appointment, so it only found a review whose `appointmentId`
matched that booking. Reviews are one per CONSULTANT now and routinely hang off
a different appointment, so the card told someone who had already reviewed
Aarav to "Post review" and lost their existing text. It is looked up by
consultant in one batched query.

**A group call showed one arbitrary attendee's score.** The provider's read
returns every attendee's rating, so a webinar slot yields several rows for the
same id, and `Object.fromEntries` kept whichever came last. Averaged now, which
is also how that call contributes to the rating unit.

**The moderated-review guard on the PUT was a TOCTOU.** It read `deletedAt`
before the transaction opened, so moderation removing the review in between let
the edit land on a row the public can no longer see while telling the author it
published. Re-read inside, and the error is shared between both write paths
rather than defined privately in one of them.

Deferred, with reasoning: an idempotency key on the retry path. Re-sending after
a lost response can duplicate a message, and the repo has the pattern
(`Payment.clientIdempotencyKey`) — but it needs a schema column and a fourth
`db push` for a failure mode narrower than the network errors that never reach
the server at all. Worth doing; not worth doing here.

Part of #705

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01Fb4vbRYxJH7wxc4tjhm6XJ
---
 __tests__/reviews/review-privacy.test.ts      |  41 +++-
 app/api/user/reviews/[id]/route.ts            |  21 +-
 .../user/reviews/reviewable-sessions/route.ts |  23 +-
 app/api/user/reviews/route.ts                 |   4 +-
 components/reviews/ProfileReviewComposer.tsx  |  86 ++++++++
 components/reviews/ReviewComposer.tsx         | 204 ++++++++++++++++++
 hooks/useSessionFeedback.ts                   |  20 +-
 lib/data/review-privacy.ts                    |  22 +-
 lib/reviews.ts                                |  85 ++++++--
 9 files changed, 460 insertions(+), 46 deletions(-)
 create mode 100644 components/reviews/ProfileReviewComposer.tsx
 create mode 100644 components/reviews/ReviewComposer.tsx

diff --git a/__tests__/reviews/review-privacy.test.ts b/__tests__/reviews/review-privacy.test.ts
index f09d50dc6..a9c8af384 100644
--- a/__tests__/reviews/review-privacy.test.ts
+++ b/__tests__/reviews/review-privacy.test.ts
@@ -19,17 +19,30 @@ import {
 const named = {
   isAnonymous: false,
   rating: 5,
-  consulteeProfile: { user: { name: "Priya S.", image: "https://x/y.png" } },
+  consulteeProfile: {
+    id: "consultee-profile-1",
+    userId: "user-1",
+    user: { name: "Priya S.", image: "https://x/y.png" },
+  },
 };
 const anon = { ...named, isAnonymous: true };
 
 describe("anonymous reviewers", () => {
-  it("removes the name AND the avatar, not just the name", () => {
-    // An avatar is an identifier too, and on a small marketplace often a
-    // stronger one than a first name.
+  it("drops the whole profile, not just the name and avatar", () => {
     const out = stripAnonymousReviewer(anon);
-    expect(out.consulteeProfile.user.name).toBeNull();
-    expect(out.consulteeProfile.user.image).toBeNull();
+    expect(out.consulteeProfile).toBeNull();
+  });
+
+  it("does not leak a stable id that could re-identify the reviewer", () => {
+    // The real hazard is CORRELATION, not the name. Review one expert under
+    // your name and another anonymously, and a shared consulteeProfile.id in
+    // both public payloads joins the two and unmasks the anonymous one. An
+    // opaque id stops being opaque the second time it appears.
+    const serialised = JSON.stringify(stripAnonymousReviewer(anon));
+    expect(serialised).not.toContain("consultee-profile-1");
+    expect(serialised).not.toContain("user-1");
+    expect(serialised).not.toContain("Priya");
+    expect(serialised).not.toContain("y.png");
   });
 
   it("leaves a named review completely untouched", () => {
@@ -42,10 +55,18 @@ describe("anonymous reviewers", () => {
     expect(stripAnonymousReviewer(anon).isAnonymous).toBe(true);
   });
 
+  it("still names a NAMED reviewer \u2014 the strip is opt-in, not blanket", () => {
+    const out = stripAnonymousReviewer(named);
+    expect(JSON.stringify(out)).toContain("Priya S.");
+  });
+
   it("does not mutate the row it was given", () => {
-    const row = { ...anon, consulteeProfile: { user: { ...anon.consulteeProfile.user } } };
+    const row = {
+      ...anon,
+      consulteeProfile: { ...anon.consulteeProfile },
+    };
     stripAnonymousReviewer(row);
-    expect(row.consulteeProfile.user.name).toBe("Priya S.");
+    expect(row.consulteeProfile).not.toBeNull();
   });
 
   it("handles a review with no consultee profile at all", () => {
@@ -55,7 +76,7 @@ describe("anonymous reviewers", () => {
 
   it("strips a mixed list, one by one", () => {
     const out = stripAnonymousReviewers([named, anon]);
-    expect(out[0].consulteeProfile!.user.name).toBe("Priya S.");
-    expect(out[1].consulteeProfile!.user.name).toBeNull();
+    expect(JSON.stringify(out[0])).toContain("Priya S.");
+    expect(out[1].consulteeProfile).toBeNull();
   });
 });
diff --git a/app/api/user/reviews/[id]/route.ts b/app/api/user/reviews/[id]/route.ts
index 06c6a460d..808beb323 100644
--- a/app/api/user/reviews/[id]/route.ts
+++ b/app/api/user/reviews/[id]/route.ts
@@ -9,7 +9,7 @@ import {
   checkOwnership,
   forbiddenResponse,
 } from "@/lib/auth-helpers";
-import { recomputeConsultantRating } from "@/lib/reviews";
+import { recomputeConsultantRating, ModeratedReviewError } from "@/lib/reviews";
 import { purgeReviewSurfaces } from "@/lib/data/public-cache";
 import { withSerializableRetry } from "@/lib/db/serializable-retry";
 import { UpdateReviewSchema } from "@/schemas/feedbacks";
@@ -40,6 +40,15 @@ export async function GET(
 
     return NextResponse.json(review, { status: 200 });
   } catch (error) {
+    if (error instanceof ModeratedReviewError) {
+      return NextResponse.json(
+        {
+          error:
+            "This review was removed by our moderation team and can't be edited.",
+        },
+        { status: 409 },
+      );
+    }
     Sentry.captureException(
       error instanceof Error ? error : new Error(String(error)),
       { tags: { subsystem: "auth" } },
@@ -106,6 +115,16 @@ export async function PUT(
     const updatedReview = await withSerializableRetry(() =>
       prisma.$transaction(
         async (tx) => {
+          // Re-read INSIDE the transaction. The guard above ran before it
+          // opened, so moderation removing the review in between let the edit
+          // land on a row the public can no longer see, and the author was told
+          // it published.
+          const current = await tx.consultantReview.findUnique({
+            where: { id: id },
+            select: { deletedAt: true },
+          });
+          if (current?.deletedAt) throw new ModeratedReviewError();
+
           const updated = await tx.consultantReview.update({
             where: { id: id },
             data: {
diff --git a/app/api/user/reviews/reviewable-sessions/route.ts b/app/api/user/reviews/reviewable-sessions/route.ts
index 788407162..8c2401aaa 100644
--- a/app/api/user/reviews/reviewable-sessions/route.ts
+++ b/app/api/user/reviews/reviewable-sessions/route.ts
@@ -21,7 +21,11 @@ export async function GET(req: NextRequest) {
   try {
     const session = await getSession();
     if (!session?.user?.id) {
-      return supportError({ status: 401, code: "UNAUTHORIZED", context: { route: ROUTE } });
+      return supportError({
+        status: 401,
+        code: "UNAUTHORIZED",
+        context: { route: ROUTE },
+      });
     }
     const consulteeProfileId = session.user.consulteeProfileId;
     // Not having a consultee profile is not an error — it just means there is
@@ -30,6 +34,23 @@ export async function GET(req: NextRequest) {
       return NextResponse.json({ data: [] });
     }
 
+    // #705 — the profile page asks about a CONSULTANT, not an appointment:
+    // "have I earned the right to review this person, and have I already?"
+    // Returns the most recent qualifying session, which is the provenance the
+    // POST records.
+    const consultantProfileId = req.nextUrl.searchParams.get(
+      "consultantProfileId",
+    );
+    if (consultantProfileId) {
+      const all = await listReviewableSessions(
+        consulteeProfileId,
+        session.user.id,
+      );
+      return NextResponse.json({
+        data: all.filter((s) => s.consultantProfileId === consultantProfileId),
+      });
+    }
+
     const appointmentId = req.nextUrl.searchParams.get("appointmentId");
     if (appointmentId) {
       const one = await resolveReviewableSession(
diff --git a/app/api/user/reviews/route.ts b/app/api/user/reviews/route.ts
index 9ad8ea6db..cba5e15e9 100644
--- a/app/api/user/reviews/route.ts
+++ b/app/api/user/reviews/route.ts
@@ -11,6 +11,7 @@ import { getSession } from "@/lib/auth-server";
 import { purgeReviewSurfaces } from "@/lib/data/public-cache";
 import { spamLimiter, applyRateLimit } from "@/lib/rate-limit";
 import {
+  ModeratedReviewError,
   recomputeConsultantRating,
   resolveReviewableSession,
 } from "@/lib/reviews";
@@ -99,9 +100,6 @@ export async function GET(req: NextRequest) {
   }
 }
 
-/** Thrown when the author tries to edit a review moderation has removed. */
-class ModeratedReviewError extends Error {}
-
 export async function POST(req: NextRequest) {
   try {
     const session = await getSession();
diff --git a/components/reviews/ProfileReviewComposer.tsx b/components/reviews/ProfileReviewComposer.tsx
new file mode 100644
index 000000000..4f0b21ade
--- /dev/null
+++ b/components/reviews/ProfileReviewComposer.tsx
@@ -0,0 +1,86 @@
+"use client";
+
+/**
+ * #705 — writing a review from the CONSULTANT's profile, which is where the
+ * review lives and where you read the others.
+ *
+ * A client island on purpose. The expert profile is statically cached (ISR plus
+ * `unstable_cache` tags) and that is what makes explore fast; rendering a
+ * per-user answer server-side would either force the page dynamic or risk one
+ * viewer's eligibility landing in a shared cache entry. This asks at runtime
+ * and renders nothing until it has an answer.
+ */
+
+import { useQuery } from "@tanstack/react-query";
+import { Button } from "@/components/ui/button";
+import { throwSupportError } from "@/lib/support/error-copy";
+import { ReviewComposer, type ExistingReview } from "./ReviewComposer";
+
+interface ReviewableSession {
+  appointmentId: string;
+  consultantName: string | null;
+  title: string;
+  heldAt: string | null;
+  existingReview: ExistingReview | null;
+}
+
+export function ProfileReviewComposer({
+  consultantProfileId,
+  consultantName,
+}: Readonly<{ consultantProfileId: string; consultantName: string | null }>) {
+  const queryKey = ["reviewable-for-consultant", consultantProfileId] as const;
+
+  const { data, isError, isLoading, refetch } = useQuery({
+    queryKey,
+    // Signed-out visitors are the common case on a public profile; a 401 is an
+    // answer ("nothing to offer"), not a failure worth retrying or shouting
+    // about.
+    retry: false,
+    queryFn: async (): Promise<ReviewableSession[]> => {
+      const res = await fetch(
+        `/api/user/reviews/reviewable-sessions?consultantProfileId=${encodeURIComponent(consultantProfileId)}`,
+      );
+      if (res.status === 401) return [];
+      if (!res.ok) await throwSupportError(res, "review eligibility");
+      const { data } = await res.json();
+      return data as ReviewableSession[];
+    },
+  });
+
+  // A failed check is NOT "you may not review". Rendering nothing for both is
+  // the mistake the Platform tab made once — a load failure shown as an empty
+  // state.
+  if (isError) {
+    return (
+      <div className="rounded-xl border border-dashed border-border p-4">
+        <p className="text-sm text-muted-foreground">
+          Couldn&apos;t check whether you can review this expert.
+        </p>
+        <Button
+          variant="outline"
+          size="sm"
+          className="mt-2"
+          onClick={() => refetch()}
+        >
+          Retry
+        </Button>
+      </div>
+    );
+  }
+  if (isLoading || !data?.length) return null;
+
+  // Most recent qualifying session — the provenance the write records.
+  const session = data[0];
+
+  return (
+    <div className="rounded-xl border border-border bg-card p-4">
+      <ReviewComposer
+        appointmentId={session.appointmentId}
+        consultantName={consultantName ?? session.consultantName}
+        contextLine={session.title}
+        existing={session.existingReview}
+        invalidateKeys={[queryKey]}
+      />
+    </div>
+  );
+}
diff --git a/components/reviews/ReviewComposer.tsx b/components/reviews/ReviewComposer.tsx
new file mode 100644
index 000000000..6da0c5d66
--- /dev/null
+++ b/components/reviews/ReviewComposer.tsx
@@ -0,0 +1,204 @@
+"use client";
+
+/**
+ * #705 — the ONE public-review form.
+ *
+ * Shared by the profile page, the post-call sheet and nothing else. It exists
+ * as its own component because the alternative is three copies drifting apart,
+ * and this form carries constraints that must not drift: everyone is asked
+ * identically after every held session, with no sentiment gate and no
+ * incentive. The FTC preamble is explicit that soliciting only the customers
+ * you believe are happy is not a "generalized solicitation", and the programme
+ * that tested incentives found incentivised reviews MORE negative with no
+ * revenue effect.
+ *
+ * A review is about the CONSULTANT — one per person, editable. The session is
+ * provenance: it proves the review is genuine and it is what granted access to
+ * this form.
+ */
+
+import { useEffect, useRef, useState } from "react";
+import { useMutation, useQueryClient } from "@tanstack/react-query";
+import { Star } from "lucide-react";
+import { Textarea } from "@/components/ui/textarea";
+import { Button } from "@/components/ui/button";
+import { useToast } from "@/hooks/use-toast";
+import { throwSupportError } from "@/lib/support/error-copy";
+
+export interface ExistingReview {
+  id: string;
+  rating: number;
+  reviewDescription: string | null;
+  isAnonymous?: boolean;
+}
+
+export function ReviewComposer({
+  appointmentId,
+  consultantName,
+  contextLine,
+  existing,
+  invalidateKeys,
+  onSaved,
+  compact = false,
+}: Readonly<{
+  /** The session that grants eligibility — provenance, not subject. */
+  appointmentId: string;
+  consultantName: string | null;
+  /** Small line under the heading, e.g. the session title. */
+  contextLine?: string;
+  existing: ExistingReview | null;
+  /** Query keys to refresh once the write lands. */
+  invalidateKeys: readonly (readonly unknown[])[];
+  onSaved?: () => void;
+  compact?: boolean;
+}>) {
+  const { toast } = useToast();
+  const qc = useQueryClient();
+
+  const [rating, setRating] = useState(0);
+  const [hover, setHover] = useState(0);
+  const [text, setText] = useState("");
+  const [anonymous, setAnonymous] = useState(false);
+
+  // Seed ONCE per review, not on every render of a fresh object. React Query
+  // hands back a new object each refetch, so depending on its identity meant a
+  // background poll reset the textarea to the saved text — and a user who had
+  // just cleared it submitted the old value straight back.
+  const seededFor = useRef<string | null>(null);
+  const seedKey = existing?.id ?? `none:${appointmentId}`;
+  useEffect(() => {
+    if (seededFor.current === seedKey) return;
+    seededFor.current = seedKey;
+    setRating(existing?.rating ?? 0);
+    setText(existing?.reviewDescription ?? "");
+    setAnonymous(existing?.isAnonymous ?? false);
+  }, [seedKey, existing]);
+
+  const save = useMutation({
+    mutationFn: async () => {
+      // Explicit null when cleared, never undefined: UpdateReviewSchema is
+      // `.partial()`, so undefined means "leave it alone" and a consultee
+      // deleting their written review could never actually delete it.
+      const body = {
+        rating,
+        reviewDescription: text.trim() || null,
+        isAnonymous: anonymous,
+      };
+      const res = existing
+        ? await fetch(`/api/user/reviews/${existing.id}`, {
+            method: "PUT",
+            headers: { "Content-Type": "application/json" },
+            body: JSON.stringify(body),
+          })
+        : await fetch(`/api/user/reviews`, {
+            method: "POST",
+            headers: { "Content-Type": "application/json" },
+            body: JSON.stringify({ ...body, appointmentId }),
+          });
+      if (!res.ok) await throwSupportError(res, "review save");
+      return res.json();
+    },
+    onSuccess: async () => {
+      toast({
+        title: existing ? "Review updated" : "Thanks for your review",
+        description: `It appears on ${consultantName ?? "the expert"}'s profile.`,
+      });
+      // AWAITED: until this resolves `existing` is still null and the button
+      // still reads "Post review", so a second press would POST again and take
+      // a 409 off the one-review-per-consultant unique. `isPending` stays true
+      // for the duration, which is what keeps the button disabled.
+      await Promise.all(
+        invalidateKeys.map((queryKey) => qc.invalidateQueries({ queryKey })),
+      );
+      onSaved?.();
+    },
+    onError: (e: unknown) => {
+      toast({
+        title: "Review",
+        description: e instanceof Error ? e.message : "Please try again.",
+        variant: "destructive",
+      });
+    },
+  });
+
+  return (
+    <div>
+      <h3 className="text-sm font-medium text-foreground">
+        {existing ? "Your review of " : "Review "}
+        {consultantName ?? "this expert"}
+      </h3>
+      <p className="mt-0.5 text-xs text-muted-foreground">
+        {contextLine ? `${contextLine} · ` : ""}
+        Public — it appears on their profile with the date. One review per
+        expert; you can edit it after a later session.
+      </p>
+
+      <div className="mt-3 flex items-center gap-1">
+        {[1, 2, 3, 4, 5].map((n) => (
+          <button
+            key={n}
+            type="button"
+            // Every star is the same size and the same affordance. Making the
+            // high ones easier to press is a named dark pattern under the CCPA
+            // 2023 guidelines, and it is how a rating stops being data.
+            onClick={() => setRating(n)}
+            onMouseEnter={() => setHover(n)}
+            onMouseLeave={() => setHover(0)}
+            aria-label={`${n} star${n === 1 ? "" : "s"}`}
+            aria-pressed={rating === n}
+            className="rounded p-0.5 focus-visible:outline-none focus-visible:ring-2 focus-visible:ring-ring"
+          >
+            <Star
+              className={
+                (compact ? "h-5 w-5 " : "h-6 w-6 ") +
+                ((hover || rating) >= n
+                  ? "fill-foreground text-foreground"
+                  : "text-muted-foreground")
+              }
+            />
+          </button>
+        ))}
+      </div>
+
+      <Textarea
+        className="mt-3"
+        rows={compact ? 2 : 3}
+        maxLength={2000}
+        value={text}
+        onChange={(e) => setText(e.target.value)}
+        placeholder="What was useful, and what could have been better? (optional)"
+      />
+
+      <label className="mt-3 flex items-start gap-2 text-xs text-muted-foreground">
+        <input
+          type="checkbox"
+          className="mt-0.5"
+          checked={anonymous}
+          onChange={(e) => setAnonymous(e.target.checked)}
+        />
+        {/* Authenticity never depended on the name: the review is welded to a
+            paid, attended session either way. Hiding it buys candour from
+            someone who may want to book this person again. */}
+        <span>
+          Post as <strong>Verified client</strong> instead of my name
+        </span>
+      </label>
+
+      <div className="mt-3 flex items-center gap-2">
+        <Button
+          size="sm"
+          disabled={rating === 0 || save.isPending}
+          onClick={() => save.mutate()}
+        >
+          {existing ? "Update review" : "Post review"}
+        </Button>
+        {/* No confirm-shaming on a low rating: "are you sure you only want to
+            give 3 stars?" is a named dark pattern, and it manufactures the
+            J-shape it pretends to measure. */}
+        <span className="text-xs text-muted-foreground">
+          You can edit this later.
+        </span>
+      </div>
+    </div>
+  );
+}
diff --git a/hooks/useSessionFeedback.ts b/hooks/useSessionFeedback.ts
index 28c8882a4..5acee2d90 100644
--- a/hooks/useSessionFeedback.ts
+++ b/hooks/useSessionFeedback.ts
@@ -40,11 +40,25 @@ export function useSessionFeedback(
         if (!res.ok) return { ratings: {}, rateable: [] };
         const { data, rateableSlotIds } = await res.json();
         const rows = (data ?? []) as SlotFeedback[];
+        // A provider's read returns EVERY attendee's rating, so a group call
+        // yields several rows for one slot. `Object.fromEntries` kept whichever
+        // came last — the consultant saw one arbitrary attendee's score and
+        // read it as the session's. Averaged instead, which is also how that
+        // call contributes to the rating unit.
+        const bySlot = new Map<string, { total: number; n: number }>();
+        for (const r of rows) {
+          if (!r.slotOfAppointmentId) continue;
+          const acc = bySlot.get(r.slotOfAppointmentId) ?? { total: 0, n: 0 };
+          acc.total += r.rating;
+          acc.n += 1;
+          bySlot.set(r.slotOfAppointmentId, acc);
+        }
         return {
           ratings: Object.fromEntries(
-            rows
-              .filter((r) => r.slotOfAppointmentId)
-              .map((r) => [r.slotOfAppointmentId as string, r.rating]),
+            [...bySlot].map(([slotId, a]) => [
+              slotId,
+              Math.round((a.total / a.n) * 10) / 10,
+            ]),
           ),
           rateable: (rateableSlotIds ?? []) as string[],
         };
diff --git a/lib/data/review-privacy.ts b/lib/data/review-privacy.ts
index 67d819dd4..daf1660c5 100644
--- a/lib/data/review-privacy.ts
+++ b/lib/data/review-privacy.ts
@@ -14,26 +14,20 @@
 /** The shape every public review read shares. */
 interface AnonymisableReview {
   isAnonymous: boolean;
-  consulteeProfile?: {
-    user?: { name?: string | null; image?: string | null } | null;
-  } | null;
+  consulteeProfile?: unknown;
 }
 
 export function stripAnonymousReviewer<T extends AnonymisableReview>(
   review: T,
 ): T {
   if (!review.isAnonymous || !review.consulteeProfile) return review;
-  return {
-    ...review,
-    consulteeProfile: {
-      ...review.consulteeProfile,
-      user: {
-        ...review.consulteeProfile.user,
-        name: null,
-        image: null,
-      },
-    },
-  };
+  // The WHOLE profile goes, not just the name and avatar. Leaving
+  // `consulteeProfile.id` behind was a de-anonymisation vector: the same person
+  // reviewing one expert under their name and another anonymously shipped the
+  // SAME profile id in both public payloads, so the two could be joined and the
+  // anonymous one attributed. An opaque id is only opaque until it appears
+  // twice.
+  return { ...review, consulteeProfile: null };
 }
 
 export function stripAnonymousReviewers<T extends AnonymisableReview>(
diff --git a/lib/reviews.ts b/lib/reviews.ts
index 6b3a194d2..f264dd598 100644
--- a/lib/reviews.ts
+++ b/lib/reviews.ts
@@ -18,6 +18,13 @@ import type { AppointmentsType, SlotCompletionStatus } from "@prisma/client";
  */
 export const MIN_RATED_UNITS_FOR_PUBLIC_SCORE = 5;
 
+/**
+ * Raised when the author tries to write over a review moderation has removed.
+ * Accepting the edit silently would tell them it published while nothing
+ * changed on the page. Both write paths raise it, so it lives here.
+ */
+export class ModeratedReviewError extends Error {}
+
 /**
  * A slot counts as held when it completed, or when it is UNVERIFIED — that
  * status means "past, with no MeetingSession recorded", which is what an
@@ -252,16 +259,6 @@ function loadReviewableAppointments(
         orderBy: { endsAt: "desc" },
         take: 1,
       },
-      consultantReviews: {
-        where: { consulteeProfileId, deletedAt: null },
-        select: {
-          id: true,
-          rating: true,
-          reviewDescription: true,
-          isAnonymous: true,
-        },
-        take: 1,
-      },
     },
     orderBy: { createdAt: "desc" },
     take: appointmentId ? 1 : 50,
@@ -276,7 +273,17 @@ function loadReviewableAppointments(
  * grouping by type alone would collapse every class a consultant ever ran into
  * a single data point — worse than the imbalance being fixed.
  */
-function describe(row: AppointmentRow): ReviewableSession | null {
+type ExistingReview = {
+  id: string;
+  rating: number;
+  reviewDescription: string | null;
+  isAnonymous: boolean;
+};
+
+function describe(
+  row: AppointmentRow,
+  reviewByConsultant: Map<string, ExistingReview>,
+): ReviewableSession | null {
   const consultantProfileId =
     row.consultation?.consultationPlan?.consultantProfileId ??
     row.subscription?.subscriptionPlan?.consultantProfileId ??
@@ -312,17 +319,67 @@ function describe(row: AppointmentRow): ReviewableSession | null {
       row.class?.classPlan?.title ??
       "Session",
     heldAt: row.slotsOfAppointment[0]?.endsAt ?? null,
-    existingReview: row.consultantReviews[0] ?? null,
+    // Keyed on the CONSULTANT, not this appointment. The review is one per
+    // person now, so it may well hang off a different booking — looking it up
+    // through the appointment made the card say "Post review" to someone who
+    // had already written one, and lose their text.
+    existingReview: reviewByConsultant.get(consultantProfileId) ?? null,
   };
 }
 
+/** This consultee's existing reviews of the given consultants, by consultant. */
+async function reviewsByConsultant(
+  consulteeProfileId: string,
+  consultantProfileIds: string[],
+): Promise<Map<string, ExistingReview>> {
+  if (consultantProfileIds.length === 0) return new Map();
+  const rows = await prisma.consultantReview.findMany({
+    where: {
+      consulteeProfileId,
+      deletedAt: null,
+      consultantProfileId: { in: consultantProfileIds },
+    },
+    select: {
+      id: true,
+      rating: true,
+      reviewDescription: true,
+      isAnonymous: true,
+      consultantProfileId: true,
+    },
+  });
+  return new Map(
+    rows.map(({ consultantProfileId, ...r }) => [consultantProfileId, r]),
+  );
+}
+
+/** Resolve a batch of appointment rows into reviewable sessions. */
+async function describeAll(
+  rows: AppointmentRow[],
+  consulteeProfileId: string,
+): Promise<ReviewableSession[]> {
+  const consultantIds = [
+    ...new Set(
+      rows
+        .map((r) => describe(r, new Map())?.consultantProfileId)
+        .filter((id): id is string => !!id),
+    ),
+  ];
+  const byConsultant = await reviewsByConsultant(
+    consulteeProfileId,
+    consultantIds,
+  );
+  return rows
+    .map((r) => describe(r, byConsultant))
+    .filter((s): s is ReviewableSession => s !== null);
+}
+
 /** Every session this consultee may review, newest first. */
 export async function listReviewableSessions(
   consulteeProfileId: string,
   userId: string,
 ): Promise<ReviewableSession[]> {
   const rows = await loadReviewableAppointments(consulteeProfileId, userId);
-  return rows.map(describe).filter((s): s is ReviewableSession => s !== null);
+  return describeAll(rows, consulteeProfileId);
 }
 
 /**
@@ -340,5 +397,5 @@ export async function resolveReviewableSession(
     userId,
     appointmentId,
   );
-  return rows[0] ? describe(rows[0]) : null;
+  return (await describeAll(rows, consulteeProfileId))[0] ?? null;
 }