fix(billing): reconcile the admin course actions and unblock re-join (#550)

Both found by driving the flows in a browser rather than by reading code.

`archiveCourse` exists twice. `app/actions/teacher/courses.ts` backs the
teacher course card; `app/actions/admin/courses.ts` backs the admin
course-status screen, and that is the one the admin UI actually calls. Only
the first was reconciling, so archiving from the admin screen — the more
likely path for an admin racing a cutoff — left the cutoff in place and the
recovery loop open on exactly the half a reviewer would try first.
`restoreCourse` is the mirror image: it raises the active course count, so it
now reconciles too and schedules the cutoff at the moment the admin causes it,
with the full grace period, instead of whenever a sweep next notices.

The `/join-school` page gated on a `tenant_users` row existing at all, so a
removed member — redirected there by proxy.ts precisely so they could re-join —
was met with "You're Already a Member!" and no way forward. The server action
already handled `status`; the page did not. Both membership reads on that page
now require `status = 'active'`, matching `joinCurrentSchool()`.

Verified end to end against local Supabase, no cron running: admin-screen
archive clears `access_cutoff_at` synchronously and the student's
/access-suspended page redirects them back into the course; Remove from School
clears it on the student limit; re-joining while at the limit is still refused
with "This school has reached its student limit", and re-joining under it
updates the surviving row in place (one row, `active`) rather than inserting a
duplicate. Re-check limits reports "Still over the plan limit" while over and
"Access restored" once under.

Also fixes six pre-existing lint errors in the join-school page, which the
whole-file pre-commit hook makes blocking as soon as the file is touched: five
unescaped apostrophes, and an `any` on the memberships map. Removing that `any`
surfaced a real mismatch — the generated types model the `tenants` embed as an
array while PostgREST returns a bare object — so the row now handles both
shapes instead of casting the discrepancy away.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_015V35rmrQiZCxDJDiXas9GV

Author: guillermoscript

app/[locale]/join-school/page.tsx

@@ -34,7 +34,7 @@ export default async function JoinSchoolPage() {
           <CardHeader>
             <CardTitle className="text-red-900">School Not Found</CardTitle>
             <CardDescription className="text-red-700">
-              The school you're trying to join doesn't exist or is no longer available.
+              The school you&apos;re trying to join doesn&apos;t exist or is no longer available.
             </CardDescription>
           </CardHeader>
           <CardContent>
@@ -47,13 +47,19 @@ export default async function JoinSchoolPage() {
     )
   }
 
-  // Check if user is already a member of this tenant
+  // Check if user is already a member of this tenant. Only an ACTIVE row
+  // counts (#550): a member removed by an admin keeps their row with
+  // `status = 'removed'`, and gating on mere existence would show them
+  // "You're Already a Member!" on the very page they were redirected to in
+  // order to re-join, with no way forward. `joinCurrentSchool()` applies the
+  // same rule and reinstates the row through the normal student-limit check.
   const { data: membership } = await supabase
     .from('tenant_users')
     .select('*')
     .eq('user_id', userId)
     .eq('tenant_id', tenantId)
-    .single()
+    .eq('status', 'active')
+    .maybeSingle()
 
   if (membership) {
     return (
@@ -62,10 +68,10 @@ export default async function JoinSchoolPage() {
           <CardHeader>
             <div className="flex items-center gap-2">
               <CheckCircle className="h-6 w-6 text-green-600" />
-              <CardTitle className="text-green-900">You're Already a Member!</CardTitle>
+              <CardTitle className="text-green-900">You&apos;re Already a Member!</CardTitle>
             </div>
             <CardDescription className="text-green-700">
-              You're already enrolled in {tenant.name}
+              You&apos;re already enrolled in {tenant.name}
             </CardDescription>
           </CardHeader>
           <CardContent className="space-y-4">
@@ -86,11 +92,14 @@ export default async function JoinSchoolPage() {
     )
   }
 
-  // Get user's other school memberships
+  // Get user's other school memberships — active ones only, for the same
+  // reason as above: a school the user was removed from is not somewhere they
+  // can still switch back into.
   const { data: otherMemberships } = await supabase
     .from('tenant_users')
     .select('tenant_id, tenants(name, slug)')
     .eq('user_id', userId)
+    .eq('status', 'active')
     .neq('tenant_id', tenantId)
 
   return (
@@ -111,16 +120,25 @@ export default async function JoinSchoolPage() {
         <Card className="mb-6 border-blue-200 bg-blue-50">
           <CardHeader>
             <CardTitle className="text-sm text-blue-900">
-              You're already a member of:
+              You&apos;re already a member of:
             </CardTitle>
           </CardHeader>
           <CardContent>
             <ul className="space-y-2">
-              {otherMemberships.map((membership: any) => (
-                <li key={membership.tenant_id} className="text-sm text-blue-800">
-                  • {membership.tenants?.name || 'Unknown School'}
-                </li>
-              ))}
+              {otherMemberships.map((membership) => {
+                // The generated types model this to-one embed as an array while
+                // PostgREST returns a bare object; the `any` this replaces was
+                // hiding the mismatch rather than resolving it. Handle both so
+                // the row renders whichever shape actually arrives.
+                const school = Array.isArray(membership.tenants)
+                  ? membership.tenants[0]
+                  : membership.tenants
+                return (
+                  <li key={membership.tenant_id} className="text-sm text-blue-800">
+                    • {school?.name || 'Unknown School'}
+                  </li>
+                )
+              })}
             </ul>
             <p className="text-xs text-blue-700 mt-3">
               You can switch between schools anytime from your dashboard.

app/actions/admin/courses.ts

@@ -4,6 +4,7 @@ import { revalidatePath } from 'next/cache'
 import { verifyAdminAccess, createAdminClient, type ActionResult } from '@/lib/supabase/admin'
 import { getCurrentTenantId } from '@/lib/supabase/tenant'
 import { isSuperAdmin } from '@/lib/supabase/get-user-role'
+import { reconcileAccessCutoffSafely } from '@/lib/billing/access-cutoff'
 
 /**
  * Approves a course (moves from draft to published)
@@ -132,9 +133,16 @@ export async function archiveCourse(
       })
     }
 
+    // This is the *admin* archive path, distinct from `archiveCourse` in
+    // `app/actions/teacher/courses.ts` — the admin course-status screen calls
+    // this one. Both drop the active course count, so both must reconcile, or
+    // the recovery loop stays open on whichever half was missed (#550).
+    await reconcileAccessCutoffSafely(adminClient, tenantId)
+
     revalidatePath('/dashboard/admin/courses')
     revalidatePath(`/dashboard/teacher/courses/${courseId}`)
     revalidatePath('/dashboard/student')
+    revalidatePath('/dashboard/admin/billing')
 
     return { success: true }
   } catch (error) {
@@ -199,9 +207,16 @@ export async function restoreCourse(courseId: number): Promise<ActionResult> {
       })
     }
 
+    // Restoring *raises* the active course count, so it can put the school
+    // back over its limit. Reconciling here schedules the cutoff at the moment
+    // the admin causes it, with the full 14-day grace period, rather than
+    // whenever a sweep next happens to notice.
+    await reconcileAccessCutoffSafely(adminClient, tenantId)
+
     revalidatePath('/dashboard/admin/courses')
     revalidatePath(`/dashboard/teacher/courses/${courseId}`)
     revalidatePath('/dashboard/student')
+    revalidatePath('/dashboard/admin/billing')
 
     return { success: true }
   } catch (error) {