phase 7 blockers

mvp/blockers.md

@@ -15,9 +15,6 @@ Effort is a rough size, not a schedule: **S** = small/contained, **M** = a real
 ## A. The product is broken or unusable
 
 ### Payments
-- **A card payment can never actually complete.** The test/demo payment page redirects to a page that
-  doesn't exist. Nothing about the money logic itself is wrong — it's the very last step, handing off to a
-  real payment provider, that isn't connected. *(Effort: M)*
 - **The 30-minute payment countdown can lie.** Booking deadlines are stored without a timezone, so the timer
   a customer sees can silently show hours more time than they actually have, and expire while they still
   think they're fine. *(Effort: S)*

mvp/fix-plan.md

@@ -22,7 +22,7 @@ whatever order you prefer.
 | 04 | [payment-timezone](blocker-phases/04-payment-timezone.md) | The 30-minute payment countdown can lie | — | ✅ Done (follow-up filed below) |
 | 05 | [bnpl-setup](blocker-phases/05-bnpl-setup.md) | Installments (BNPL) don't work at all | — | — |
 | 06 | [catalog-admin-page](blocker-phases/06-catalog-admin-page.md) | No admin page for service categories/pricing | — | — |
-| 07 | [card-payment-redirect](blocker-phases/07-card-payment-redirect.md) | Card payment can never complete | — | — |
+| 07 | [card-payment-redirect](blocker-phases/07-card-payment-redirect.md) | Card payment can never complete | — | ✅ Done (follow-up filed below) |
 | 08 | [refunds-demock](blocker-phases/08-refunds-demock.md) | Refunds are demo-only, off by 100× | — | — |
 | 09 | [nurse-verification-badge](blocker-phases/09-nurse-verification-badge.md) | Verification badge doesn't reflect reality | pairs with 10 | — |
 | 10 | [search-dedup-and-trust](blocker-phases/10-search-dedup-and-trust.md) | Search isn't de-duplicated; trust info hardcoded | pairs with 09 | — |
@@ -52,6 +52,15 @@ whatever order you prefer.
   decision (booking-lifecycle's "today's visits" fix), since both are the same missing
   `Asia/Tehran`/UTC-boundary discipline.
 
+- **ZarinPal-callback translator, latent until a real gateway is switched on.** Phase 07 restored the
+  mock-gateway harness and pointed `MockPaymentProvider.InitPaymentAsync`'s `redirectUrl` at it (relative
+  URL, no more dead `mock-psp.local` host) — the card-payment dead end (blockers.md § "Payments") is closed
+  for the mock path, which is the only path reachable pre-e-namad (§B.5). Once a real acquirer is ever
+  switched on, ZarinPal's callback redirects the browser with its **own** query params (`Authority`,
+  `Status`) — nothing under `Controllers/V1` today translates that into what `checkout/return/page.tsx`
+  expects (`request_id`/`transaction_id`/`outcome`). Needs a translating endpoint/route before the real path
+  can work; deliberately out of scope of the mock fix, and moot until §B.5 clears.
+
 ## Suggested order
 
 1. **01 (admin RBAC)** — unlocks 02, and makes 09/10/11/14 independently testable via the seeded