feat/subscription-gating

GET /v1/jobs/:id missing 500 in contract responses

apps/platform/src/api/contracts/public-v1/jobs.contract.ts

Handler catch block returns 500 via InternalError but detail route only declares 200/400/401/403/404. Add 500: PublicApiErrorResponseSchema.

Batch serviceNameMap active-first bypassed for blank active serviceName

apps/platform/src/api/handlers/cfe-jobs.handler.ts:690

When active contract has serviceName='' and terminated contract has a real name, the blank active skips the loop guard and terminated name wins. Contradicts active-first invariant.

Analytics rpu_count should use dispatch.length not insertedJobs.length

apps/platform/src/api/handlers/cfe-jobs.handler.ts:942

dispatch.length is the count of jobs actually sent to the pipeline post-pairing. insertedJobs.length could diverge in edge cases.

Fail-open subscription gate on DB transient failures

packages/api/src/middleware/require-active-subscription.ts

requireActiveSubscription returns ok() when findById returns null — a canceled org bypasses the 402 gate on any DB connection fault. Documented design choice, not a bug.

Subscription gate fires after context resolution in createCfeJobHandler

apps/platform/src/api/handlers/cfe-jobs.handler.ts:217

A canceled org completes contract + secret lookups before receiving 402 — timing-only leakage, no data returned.

Internal cfe-jobs contract missing 403 on create/retry/batch

apps/platform/src/api/contracts/cfe-jobs.contract.ts

If scope enforcement lands on internal routes, undeclared 403 collapses to 500 from client view.

403 in public-v1 contract emitted by middleware not handler

apps/platform/src/api/contracts/public-v1/jobs.contract.ts

Handler error mapper union has no 403 branch — 403 is produced by withMetaGate middleware. Contract is technically accurate but misleading.

No handler-level test for dispatch.length > 0 SFN guard

apps/platform/src/api/handlers/__tests__/

pairBatchInsertResults unit tests verify empty dispatch on all-conflict input but there's no handler test that sfnClient.send is NOT called when dispatch is empty.

SoftLaunchGuard tri-state has no component test

apps/platform/src/components/__tests__/SoftLaunchGuard.test.tsx

undefined (loading), [] (error/fail-closed), populated array — three states, zero component test coverage.

latest_total mapper mapping not covered in mapper tests

apps/platform/src/api/mappers/public-v1/__tests__/jobs.mapper.test.ts

No test passes latest_total through toCfeJobConfig to assert it maps to latestTotal.

API_KEY_LIMIT_REACHED has no enforcement test

apps/platform/src/api/handlers/__tests__/

Neither old nor new error code name appears in any test.

Retry handler returns 422 not declared in cfe-jobs contract

apps/platform/src/api/contracts/cfe-jobs.contract.ts

retryCfeJobHandler emits 422 (ServiceNameMissing) but the retry contract only lists 200/401/402/404/409. ts-rest collapses undeclared statuses to 500. Add 422 to the retry contract responses.

subscriptionInactiveResponse uses hardcoded error string

apps/platform/src/api/handlers/cfe-jobs.handler.ts

error: "SUBSCRIPTION_INACTIVE" is a bare string literal. Use the typed catalog constant from packages/api/src/responses/codes.ts for compile-time safety.

Sidebar enabledModules ?? [] masks the tri-state loading signal

apps/platform/src/app/[locale]/(dashboard)/layout.tsx:162

Sidebar gets [] during org fetch flight, showing no enabled modules briefly. Pass raw tri-state and handle undefined inside DashboardSidebar to match SoftLaunchGuard.

Batch handler step comment numbering is stale

apps/platform/src/api/handlers/cfe-jobs.handler.ts

Analytics block labeled '// 7. Analytics' but follows step 8 (SFN dispatch). Should be '// 9.' or scheme consolidated.