Phase 4

Seed data extended with a second barber (different hours/services), a beard-trim service + category, breaks, time off, a guest customer, and appointments in all three key states — verified against a live throwaway Postgres.
14 new integration tests (38 total with Phase 3's) covering guest/authenticated booking, any-barber assignment, slot-conflict handling, ownership enforcement, guest-data isolation, and book-again repricing.
Playwright E2E suite for the 6 required customer journeys, with its own global-setup.ts that migrates and seeds a database automatically.
Full verification pass, which caught and fixed three real bugs along the way (not just test-workarounds):
A date off-by-one bug in the calendar picker that made real weekdays show as closed for anyone in a UTC+ timezone (including the business's own).
A dialog that could vanish mid-confirmation on cancellation, before the customer could read the late-cancellation notice.
A silent test-cleanup leak in the Phase 3 fixtures that had been leaking stray businesses since Phase 3.
Plus a baseline desktop-responsive fix (centered max-w-2xl columns) across Home/Appointments/Settings/booking flow, since desktop had been effectively unstyled.
Final state: 90 unit tests, 38 integration tests, and all 6 E2E journeys passing together on a fresh database; clean tsc, eslint, and next build. Full writeup with routes, security model, guest-matching rules, known limitations, and what to check before Phase 5 is in docs/phase-4-summary.md.

src/proxy.ts

@@ -2,7 +2,13 @@ import NextAuth from "next-auth";
 import { NextResponse } from "next/server";
 import { authConfig } from "@/auth.config";
 
-const PROTECTED_PREFIXES = ["/home", "/appointments", "/settings", "/staff", "/owner"];
+// /home, /appointments and /settings are intentionally NOT hard-gated here
+// as of Phase 4 — Home must work for guests (public business browsing +
+// booking), and /appointments and /settings each show their own friendly
+// in-context sign-in prompt for a guest rather than a silent redirect with
+// no explanation. Only /staff and /owner remain hard-gated: those are
+// permission-based tooling with no meaningful "guest" experience at all.
+const PROTECTED_PREFIXES = ["/staff", "/owner"];
 
 // Lightweight instance built from the DB-free config — see auth.config.ts.
 // Next.js 16 renamed this file convention from `middleware` to `proxy`