batch(baseball): 22 fixes — single-deploy batch

src/app/baseball/(dashboard)/dashboard/activate/page.tsx

@@ -9,7 +9,7 @@ import { Badge } from '@/components/ui/badge';
 import { PageLoading } from '@/components/ui/loading';
 import { IconTarget, IconUsers, IconChart, IconCheck, IconEye, IconLock } from '@/components/icons';
 import { useAuth } from '@/hooks/use-auth';
-import { createClient } from '@/lib/supabase/client';
+import { activateRecruitingExposure } from '@/app/baseball/actions/player-access';
 
 export default function ActivateRecruitingPage() {
   const { user, player, loading: authLoading, updatePlayer } = useAuth();
@@ -58,21 +58,11 @@ export default function ActivateRecruitingPage() {
     setError(null);
 
     try {
-      const supabase = createClient();
-
-      const { error: updateError } = await supabase
-        .from('baseball_players')
-        .update({
-          recruiting_activated: true,
-          recruiting_activated_at: new Date().toISOString(),
-        })
-        .eq('id', player.id);
-
-      if (updateError) {
-        setError(updateError.message);
-        setActivating(false);
-        return;
-      }
+      // Go through the gated server action so the team's
+      // recruiting_exposure_enabled toggle is enforced. The old raw client-side
+      // update bypassed it — a program with exposure disabled could still be
+      // activated from this page if RLS permitted the write.
+      await activateRecruitingExposure();
 
       // Update local state
       await updatePlayer?.({
@@ -81,8 +71,8 @@ export default function ActivateRecruitingPage() {
       });
 
       router.push('/baseball/player/today');
-    } catch {
-      setError('An error occurred. Please try again.');
+    } catch (err) {
+      setError(err instanceof Error ? err.message : 'An error occurred. Please try again.');
       setActivating(false);
     }
   };

src/app/baseball/(dashboard)/dashboard/pipeline/PipelineClient.tsx

@@ -42,6 +42,11 @@ const gradYearOptions = [
 
 const statusOptions = PIPELINE_STAGES.map((s) => ({ value: s.id, label: s.label }));
 
+// Droppable columns use the stage id; draggable cards use the watchlist-row
+// UUID. This set lets the drag handler tell a real drop-target column apart
+// from a card that `closestCorners` happened to land on.
+const PIPELINE_STAGE_IDS = new Set<PipelineStage>(PIPELINE_STAGES.map((s) => s.id));
+
 const filterTabs = [
   { value: 'all', label: 'All' },
   ...PIPELINE_STAGES.map((s) => ({ value: s.id, label: s.label })),
@@ -243,20 +248,23 @@ export default function PipelinePage() {
       return;
     }
 
-    const activeItem = filteredByGradYear.find((item) => item.id === active.id);
-    const newStage = over.id as PipelineStage;
-
-    if (activeItem && activeItem.pipeline_stage !== newStage) {
-      try {
-        await updateStage(activeItem.player_id, newStage);
-        setError(null);
-        const playerName = getFullName(activeItem.player?.first_name, activeItem.player?.last_name);
-        const stageLabel = statusOptions.find(o => o.value === newStage)?.label || newStage;
-        showToast(`${playerName} moved to ${stageLabel}`, 'success');
-      } catch (err) {
-        console.error('Error updating pipeline stage:', err);
-        setError('Failed to update player stage. Please try again.');
-      }
+    const draggedItem = filteredByGradYear.find((item) => item.id === active.id);
+
+    // With closestCorners, `over` is often another card (a watchlist UUID),
+    // not a column. Resolve the target stage from the column id, falling back
+    // to the stage of the card being hovered; anything else is an invalid drop
+    // and must be a no-op (no DB write).
+    const overId = over.id as string;
+    const newStage: PipelineStage | null = PIPELINE_STAGE_IDS.has(overId as PipelineStage)
+      ? (overId as PipelineStage)
+      : (filteredByGradYear.find((item) => item.id === overId)?.pipeline_stage ?? null);
+
+    if (draggedItem && newStage && draggedItem.pipeline_stage !== newStage) {
+      // updateStage shows its own success/error toast and only refetches on
+      // success (so the card reverts to its column on failure). Just reflect
+      // the boolean return — never a second, unconditional success toast.
+      const ok = await updateStage(draggedItem.player_id, newStage);
+      setError(ok ? null : 'Failed to update player stage. Please try again.');
     }
 
     setActiveId(null);
@@ -265,7 +273,11 @@ export default function PipelinePage() {
   // Watchlist handlers
   async function handleStatusChange(watchlistId: string, newStatus: PipelineStage) {
     try {
-      await updateWatchlistStatus(watchlistId, newStatus);
+      const result = await updateWatchlistStatus(watchlistId, newStatus);
+      if (!result.success) {
+        showToast(result.error || 'Failed to update status', 'error');
+        return;
+      }
       refetch();
     } catch {
       showToast('Failed to update status', 'error');
@@ -336,11 +348,15 @@ export default function PipelinePage() {
     if (selectedPlayers.size === 0) return;
 
     try {
-      await Promise.all(
+      const results = await Promise.all(
         Array.from(selectedPlayers).map(watchlistId =>
           updateWatchlistStatus(watchlistId, newStatus)
         )
       );
+      const failed = results.filter(r => !r.success).length;
+      if (failed > 0) {
+        showToast(`Failed to update ${failed} player${failed !== 1 ? 's' : ''}`, 'error');
+      }
       refetch();
       setSelectedPlayers(new Set());
     } catch {
@@ -547,7 +563,7 @@ export default function PipelinePage() {
             onDragStart={handleDragStart}
             onDragEnd={handleDragEnd}
           >
-            <div className="flex lg:grid lg:grid-cols-7 gap-4 overflow-x-auto pb-4 -mx-6 px-6 lg:mx-0 lg:px-0 lg:overflow-visible snap-x snap-mandatory lg:snap-none scroll-smooth">
+            <div className="flex lg:grid lg:grid-cols-5 gap-4 overflow-x-auto pb-4 -mx-6 px-6 lg:mx-0 lg:px-0 lg:overflow-visible snap-x snap-mandatory lg:snap-none scroll-smooth">
               {PIPELINE_STAGES.map((s) => (
                 <PipelineColumn
                   key={s.id}

src/app/baseball/(dashboard)/dashboard/profile/page.tsx

@@ -29,8 +29,10 @@ export default function ProfilePage() {
     await updatePlayer(updates);
   };
 
-  // Use CollegeProfileEditor for college/juco players
-  const isCollegePlayer = player.player_type === 'college' || player.player_type === 'juco';
+  // Only true college players get the team-only editor. JUCO players are
+  // transfer-recruiting-eligible (opt-in activation), so they need the
+  // recruiting ProfileEditor with showcase fields like videos — same as HS.
+  const isCollegePlayer = player.player_type === 'college';
 
   return (
     <>

src/app/baseball/(dashboard)/dashboard/roster/RosterClient.tsx

@@ -1016,12 +1016,19 @@ export function RosterClient({ teamId: serverTeamId, initialModel }: RosterClien
 
               setSavingLineup(true);
               try {
-                await saveLineup({
+                // saveLineup returns { success: false, error } for validation
+                // failures (duplicate orders, > 9 players, missing coach) without
+                // throwing, so check the result before claiming success.
+                const result = await saveLineup({
                   teamId: resolvedTeamId,
                   name: name || 'Untitled Lineup',
                   positions,
                 });
-                showToast('Lineup saved successfully', 'success');
+                if (result.success) {
+                  showToast('Lineup saved successfully', 'success');
+                } else {
+                  showToast(result.error || 'Failed to save lineup', 'error');
+                }
               } catch (error) {
                 showToast(
                   error instanceof Error ? error.message : 'Failed to save lineup',

src/app/baseball/(dashboard)/dashboard/settings/demo-mode/page.tsx

@@ -3,20 +3,19 @@
 //
 // Wave 4 / packet: qa-screens (Settings routes coverage completeness)
 //
-// Demo Mode Settings is an ACCEPTED consolidation: its controls live as a section of the
-// single Program Settings page (one save surface, one capability gate). This
-// dedicated spec route (v4 §Settings Architecture) resolves by redirecting to
-// that section's anchor, so every route in the spec route map is reachable and
-// deep-linkable without duplicating the editor or its server enforcement.
+// The Demo Mode section was removed from the consolidated Program Settings page
+// (PKT-12) and has no controls yet, so there is no `#demo-mode` anchor to
+// deep-link to. This spec route stays reachable (v4 §Settings Architecture) by
+// redirecting to the Program Settings page itself rather than a dead anchor.
 // =============================================================================
 
 import { permanentRedirect } from 'next/navigation';
-import { getBaseballSettingsAliasHref } from '@/lib/baseball/settings-route-aliases';
+import { BASEBALL_PROGRAM_SETTINGS_PATH } from '@/lib/baseball/settings-route-aliases';
 
 export const metadata = {
   title: 'Demo Mode Settings | Helm Baseball',
 };
 
 export default function Page() {
-  permanentRedirect(getBaseballSettingsAliasHref('demo-mode'));
+  permanentRedirect(BASEBALL_PROGRAM_SETTINGS_PATH);
 }

src/app/baseball/(dashboard)/dashboard/settings/privacy/page.tsx

@@ -25,31 +25,16 @@ export default async function PrivacySettingsPage() {
     .eq('player_id', player.id)
     .maybeSingle();
 
-  // Transform database settings to component format
-  // Map database fields to component expected fields (use defaults for missing fields)
-  // Database columns: show_contact_info, show_academics, show_dream_schools, profile_visibility
-  const transformedSettings = settings ? {
-    id: settings.id,
-    player_id: settings.player_id,
-    // Map database fields that exist
-    show_contact_email: settings.show_contact_info ?? undefined,
-    show_academics: settings.show_academics ?? undefined,
-    show_dream_schools: settings.show_dream_schools ?? undefined,
-    profile_visibility: settings.profile_visibility ?? undefined,
-    // Default values for fields not in database
-    show_full_name: true,
-    show_school: true,
-    show_phone: settings.show_contact_info ?? undefined,
-    show_social_links: true,
-    show_height_weight: true,
-    show_position: true,
-    show_grad_year: true,
-    show_bats_throws: true,
-    show_videos: true,
-    show_calendar: true,
-    show_stats: true,
-    allow_messages: true,
-  } : undefined;
+  // Map the real baseball_player_settings privacy columns to the form. Only
+  // show_contact_info, show_academics, and show_dream_schools are editable
+  // toggles; profile_visibility is managed elsewhere and left untouched.
+  const transformedSettings = settings
+    ? {
+        show_contact_info: settings.show_contact_info ?? undefined,
+        show_academics: settings.show_academics ?? undefined,
+        show_dream_schools: settings.show_dream_schools ?? undefined,
+      }
+    : undefined;
 
   return (
     <div className="min-h-dvh bg-[#FAF6F1]">

src/app/baseball/(public)/packet/[token]/csv/route.ts

@@ -31,7 +31,8 @@ function fileName(name: string | null): string {
 
 export async function GET(_req: Request, { params }: RouteParams): Promise<Response> {
   const { token } = await params;
-  const model = await resolveScoutPacketByToken(token ?? '');
+  // A CSV download isn't a packet "view" — don't bump view_count/last_viewed_at.
+  const model = await resolveScoutPacketByToken(token ?? '', { trackView: false });
   const csv = scoutPacketToCsv(model);
   const status = model.ok ? 200 : model.reason === 'not_found' ? 404 : 403;
   return new Response(csv, {

src/app/baseball/actions/postgame.ts

@@ -176,9 +176,30 @@ export const generatePostgameReview = withBaseballAction(
     //    overwrite content + re-open NEW items; never clobber a coach conversion.
     // -------------------------------------------------------------------------
     const emittedKeys = new Set<string>();
+
+    // Preserve any coach disposition (converted_to_timeline/converted_to_task/
+    // dismissed/resolved) across re-runs. The upsert below (ignoreDuplicates:
+    // false) would otherwise reset every conflicting row's disposition to
+    // mapItem's default 'new', re-opening items the coach already actioned.
+    // eslint-disable-next-line @typescript-eslint/no-explicit-any
+    const { data: priorItems } = await (supabase as any)
+      .from('baseball_postgame_review_items')
+      .select('dedupe_key, disposition')
+      .eq('review_id', reviewId);
+    const priorDisposition = new Map<string, string>(
+      ((priorItems ?? []) as { dedupe_key: string; disposition: string }[]).map(
+        (r) => [r.dedupe_key, r.disposition],
+      ),
+    );
+
     const itemRows: BaseballPostgameReviewItemInsert[] = built.items.map((c) => {
       emittedKeys.add(c.dedupeKey);
-      return mapItem(c, teamId, reviewId);
+      const row = mapItem(c, teamId, reviewId);
+      const prior = priorDisposition.get(c.dedupeKey);
+      if (prior && prior !== 'new') {
+        row.disposition = prior as BaseballPostgameReviewItemInsert['disposition'];
+      }
+      return row;
     });
 
     let itemsGenerated = 0;

src/app/baseball/actions/scout-packet.ts

@@ -385,7 +385,13 @@ export const getScoutPacketPreview = withBaseballAction(
  * Side effect: a successful, live resolution bumps the token's view telemetry
  * (best-effort; never blocks the packet).
  */
-export async function resolveScoutPacketByToken(token: string): Promise<ScoutPacketModel> {
+export async function resolveScoutPacketByToken(
+  token: string,
+  options: { trackView?: boolean } = {},
+): Promise<ScoutPacketModel> {
+  // A CSV export is data retrieval, not a human "view" of the packet, so callers
+  // like the CSV route pass trackView: false to avoid inflating view_count.
+  const { trackView = true } = options;
   const generatedAt = new Date().toISOString();
   const fail = (reason: ScoutPacketModel['reason']): ScoutPacketModel => ({
     ok: false,
@@ -439,8 +445,8 @@ export async function resolveScoutPacketByToken(token: string): Promise<ScoutPac
     recipientLabel: (row.recipient_label as string | null) ?? null,
   });
 
-  // Telemetry: only count a live, exposed open.
-  if (packet.ok) {
+  // Telemetry: only count a live, exposed open — and never for CSV exports.
+  if (packet.ok && trackView) {
     try {
       await fromUntyped(admin, 'baseball_player_passport_share_tokens')
         .update({

src/components/baseball/player-profile/PlayerProfileClient.tsx

@@ -39,6 +39,7 @@ import {
   IconCheck,
 } from '@/components/icons';
 import type { BaseballPlayerStats, BaseballPlayerAggregates, BaseballCoachInsight } from '@/lib/types';
+import type { BaseballNoteScope } from '@/lib/types/baseball-extended';
 import type { SnapshotHeader } from '@/lib/baseball/read-models/player-snapshot-cards';
 import type { TimelineEventView } from '@/lib/baseball/read-models/timeline';
 import { PlayerInsightsPanel } from './PlayerInsightsPanel';
@@ -47,6 +48,7 @@ import { ProfileTimeline } from './ProfileTimeline';
 import { SnapshotHeaderBand } from './snapshot-cards';
 import { Button, IconButton } from '@/components/ui/button';
 import { Textarea } from '@/components/ui/textarea';
+import { NativeSelect } from '@/components/ui/select';
 import { PlayerPerformanceTab } from '@/components/lifting/performance/PlayerPerformanceTab';
 import { createCoachNote } from '@/app/baseball/actions/coach-notes';
 
@@ -269,6 +271,9 @@ export function PlayerProfileClient({
   const [activeTab, setActiveTab] = useState<MainTab>('overview');
   // ── Note add form state ────────────────────────────────────────────────────
   const [noteBody, setNoteBody] = useState('');
+  // Both scopes are authorable by any staff member (canAuthorScope), so no
+  // capability data is needed to offer this choice; the server still enforces it.
+  const [noteScope, setNoteScope] = useState<BaseballNoteScope>('staff_public');
   const [noteError, setNoteError] = useState<string | null>(null);
   const [noteSuccess, setNoteSuccess] = useState(false);
   const [isPendingNote, startNoteTransition] = useTransition();
@@ -409,7 +414,7 @@ export function PlayerProfileClient({
     setNoteError(null);
     setNoteSuccess(false);
     startNoteTransition(async () => {
-      const result = await createCoachNote({ playerId: player.id, body, scope: 'staff_public' });
+      const result = await createCoachNote({ playerId: player.id, body, scope: noteScope });
       if (result.success) {
         setNoteBody('');
         setNoteSuccess(true);
@@ -1376,6 +1381,28 @@ export function PlayerProfileClient({
                   rows={4}
                   disabled={isPendingNote}
                 />
+                {/* Visibility scope — staff-only vs. shared with the player. A
+                    player_visible note surfaces on the player's Today + timeline. */}
+                <div className="mt-3">
+                  <label htmlFor="note-visibility" className="block text-xs font-medium text-warm-500 mb-1.5">
+                    Visibility
+                  </label>
+                  <NativeSelect
+                    id="note-visibility"
+                    value={noteScope}
+                    onChange={(e) => setNoteScope(e.target.value as BaseballNoteScope)}
+                    disabled={isPendingNote}
+                    className="w-56 text-sm"
+                  >
+                    <option value="staff_public">Staff only</option>
+                    <option value="player_visible">Visible to player</option>
+                  </NativeSelect>
+                  <p className="text-xs text-warm-400 mt-1.5">
+                    {noteScope === 'player_visible'
+                      ? 'The player will see this note on their Today and timeline.'
+                      : 'Only staff can see this note.'}
+                  </p>
+                </div>
                 <div className="flex items-center justify-between mt-3">
                   <div>
                     {noteError && (

src/components/baseball/position-planner/PlayerQuickView.tsx

@@ -351,7 +351,7 @@ export function PlayerQuickView({ player, watchlistItem, onClose }: PlayerQuickV
             'backdrop-blur-sm'
           )}
         >
-          <Link href={`/baseball/dashboard/players/${player.id}`} className="block">
+          <Link href={`/baseball/player/${player.id}`} className="block">
             <Button
               variant="primary"
               className={cn(

src/components/baseball/settings/ProgramSettingsClient.tsx

@@ -145,7 +145,7 @@ function SectionCard({
   /**
    * Optional stable anchor so the dedicated spec routes that fold into this page
    * (player-access, guardian-access, showcase-profile, ai, notifications,
-   * data-retention, demo-mode) can deep-link to their section via #anchor.
+   * data-retention) can deep-link to their section via #anchor.
    * scroll-mt keeps the section clear of the sticky header on jump.
    */
   anchorId?: string;

src/components/coach/PlayerDetailModal.tsx

@@ -50,7 +50,7 @@ export function PlayerDetailModal({ player, coachId, onClose }: PlayerDetailModa
     setMessaging(true);
     try {
       const result = await createConversation([player.user_id]);
-      router.push(`/dashboard/messages/${result.conversationId}`);
+      router.push(`/baseball/dashboard/messages/${result.conversationId}`);
     } catch (error) {
       console.error('Error creating conversation:', error);
       showToast('Failed to create conversation', 'error');