help wanted: stop silent deposit-auth failure at check-in (desk must see it)

[telivity-otaip]

Why hotels care

Front desk checks a guest in, guest walks to the room, and only at checkout does anyone notice the deposit never authorized. That is how hotels eat minibars, smoking fees, and "I never gave you a card" arguments.

In HAIP check-in, deposit authorization failures are currently swallowed:

// reservation.service.ts check-in path
try {
  depositAuth = await this.paymentService.authorizePayment(...);
} catch {
  // Deposit auth failure does not block check-in
}

Not blocking check-in can be correct (walk-ins, VIP override). Failing silently is not — the desk needs a loud, actionable signal.

Current state (code anchors)

• apps/api/src/modules/reservation/reservation.service.ts — check-in deposit auth try/catch
• Payment authorize path + Stripe Elements tokens (paymentMethodId / gatewayPaymentToken)
• Dashboard front-desk check-in flow
• Related vignette energy: ops/harden/vignettes/base-07-checkout-blocked-balance.md (money integrity at desk)

What we need

1. Check-in API response includes structured depositAuth result: ok | skipped | failed + safe error code/message
2. Dashboard shows a blocking toast/banner when failed (still checked in if product keeps non-blocking)
3. Optional property setting later: requireDepositAuth hard-block — only if operators confirm; default remains non-blocking + loud
4. Staff notification or reservation note on failure for shift handover
5. Tests for success / skip / gateway failure paths

Open questions (front-office managers)

• Default: warn-and-continue, or hard-block until card works / explicit override reason?
• Who may override — any front_desk, or supervisor role?
• Should failed auth create a follow-up task on the reservation?

Acceptance criteria

• No silent catch: failure is visible in API + desk UI
• Skip path still works (skipDepositAuth)
• Multi-tenant + permission checks unchanged
• Vitest + a short ops note in harden vignettes or front-desk docs

How to contribute

Smaller than inventory/GDPR issues — good for a NestJS + React contributor who can wire API → desk UX. Hotel FOMs: please comment your house policy on "check in without auth".

Search keywords: deposit authorization, check-in, silent failure, Stripe authorize, front desk, incidentals hold, hotel PMS