What we shipped.

The DPA, /security, and the downloadable procurement packet now state identical facts (database region, subprocessors, retention targets), locked by tests so they cannot drift apart. Change receipts, reminders, issues, and document history render in the organization's timezone — a who-saw-what receipt now shows the wall-clock time the change was actually made. Member confirm cards show the exact call time and venue before asking for a commitment.

The operator workspace now has one canonical Home, one Command Center ("Are we ready?"), one Setup path, and one Executive view — the overlapping cockpit pages left the navigation. The production detail page keeps its calm spine at real-orchestra scale: at-risk players surface first, secondary panels (heatmap, history, seating, substitute search) sit one click away, and a 157-assignment week renders without a wall of data.

Cancelling an engagement is refused while its invoice has money outstanding or collected — reconcile first, then cancel — on both the organization and agency paths, race-safe at the database write. Deleting a room or resource with booking history is refused too; retire it instead, so usage reports keep their records. Report exports state plainly when a safety cap trimmed the rows.

Pick the player who dropped out — including whole-production assignments — and the desk finds eligible substitutes with availability conflicts and weekly service counts flagged, hands the substitute production-scoped access that expires after the final service, and logs the whole recovery. Now searchable by name, instrument, or section, grouped by day, and honest when a long list is capped.

The production calendar is a command surface: readiness KPIs, ready-to-high-risk triage, filters, and .ics export. Moving a service runs a guarded commit — permission-checked, staleness-checked, conflict-acknowledged — and cascades the change with an audit trail, so a schedule move never surprises the people it touches.

Organizations get a token-scoped REST API for rosters, productions, services, and resources, with signed webhooks for the events that matter and per-key quotas plus pre-auth rate limits. SCIM 2.0 provisioning is live for enterprise identity providers; per-org OIDC single sign-on ships as a fail-closed, owner-configured foundation.

Per-organization agreement profiles drive weekly service caps, overtime and rest-hour warnings. Compute a period, review flags, lock it, and export payroll-ready CSVs — including custom column headers matching the format your payroll office already uses. An export aid for your process, not a payroll engine, and labeled as such.

/about and /security promised four visibility levels; now they're in the model. ArtistVisibility enum (PUBLIC · PRIVATE_LISTING · STEALTH · WORKSPACE_PRIVATE) + ArtistProfile.visibility field + migration backfills existing rows from isPublic. Default for new artists is PRIVATE_LISTING — matching the market norm (Askonas Holt, IMG, Intermusica) where rosters aren't public by default.

Workspace audit closed every dangling primary-nav link. /dashboard/reports surfaces 20 CSV exports (engagements / money / collections / disputes / roster) gated by CAN_EXPORT_REPORTS. /dashboard/settlements shows the workspace PlatformFee pipeline by status. Eight role-aware routers (requests/holds/quotes/contracts/invoices/roster/presenters/venues) redirect to the correct cockpit.

/dashboard/team consumes the existing /api/invitations endpoints — invite by email + role, send the team-invite template via Resend, revoke pending tokens. Role-gated: OWNER/ADMIN can edit, everyone else sees read-only.

Tenant-scoped view of every AuditLog row touching your workspace — actor, action, entity, timestamp. ILIKE filter on action/entityType/entityId. Cross-tenant superset stays behind admin MFA at /admin/audit.

/integrations lists named third-party vendors by category (Payments / Email / Storage / Hosting / Observability / Calendar) with current status. /migration documents 5 source systems (spreadsheet, Overture, Gigwell, Prism.fm, ABOSS) and the 5-stage 7–14 day import process.

Modal welcome on /dashboard, persisted via localStorage. Each role (artist/agent/presenter/admin) gets a tailored three-step walkthrough with deep-link CTAs. Skip / next / done — never blocks work.

/dashboard/guide is a single in-app reference covering the engagement workflow, every dashboard surface, your live entitlements, approval boundaries, and the full plan catalogue. /dashboard/settings/email-preferences/preview renders your next daily digest before it sends.

/dashboard/search now spans requests, quotes, contracts, invoices, messages, and the public artist catalogue. Results stay tenant-scoped per role — you only see records you already had access to.

Artist workspaces can now upload headshots, riders, repertoire lists, and tax forms inline on /dashboard/documents. Two-step Vercel Blob sign + register, tenant-scoped server-side, 25 MB ceiling, 10 document kinds.

/press now carries a fact sheet, milestones, talking points, and a four-stage press process. /security adds six named subprocessors, five data-retention categories, and a responsible-disclosure timeline.

/about ships a four-card audience map deep-linked to the role landing pages, a 'what we are not' boundary section, and a vertical roadmap timeline of shipped, pilot-target, and next milestones.

Settlement and collection exports now keep operator-confirmed money state visible without implying automated engagement payout.

/dashboard/settings/billing surfaces current plan, status, period, 30-day usage counters, and a role-aware upgrade ladder. /admin/money/workspaces/[id] now exposes Grant/Revoke for every EntitlementKey with full audit logging.

New homepage section moved beyond artist discovery into organization operations: season planning, conductor and soloist pipelines, internal approvals, and emergency replacement workflow. Current public positioning now leads with Production Desk and My Week.

/migration-launch details the launch sequence and done-for-you tiers from $500 artist profile setup to $100,000 institution onboarding. Multi-year orchestra season import scoped at $10k-$50k.

The first public plan catalogue moved pricing into USD and seeded billing rows. It has since been superseded by the OS-first ladder on /pricing: organization subscriptions, Agency OS, artist tools, managed services, and no generic platform tax.

/roster, /agents, /presenters, and /artists/[slug] now distinguish Illustrative cohort rows from Verified entities. Sample profiles disable the request-hold CTAs so engagement requests can't route to non-real artists.

Quote.create and Contract.create now emit matching UsageEvent rows so the admin money dashboard picks up real engagement activity. QUOTE_SENT/CONTRACT_SENT fire only when sendNow flips status to SENT.