guard(epay): force legacy queue for paid CF orders — gis-api has no fulfiller yet

gis-api POST /enrichment/cf only inserts a pending row; no orchestrator
worker executes the ePay purchase, so pilot-flag orders silently never
complete. EPAY_ORDERING_VIA_GIS_AC=false routes all paid orders through
/api/ancpi/order and restores the connected+credits gating on the
per-parcel button. Flip the constant after the orchestrator ePay worker
ships.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

src/modules/parcel-sync/components/cf-api-base.ts

@@ -15,6 +15,15 @@
 
 import type { CfExtractRow } from "@/lib/gis-api-client";
 
+// GUARD (2026-06-04): ePay ordering via gis-api is NOT live yet. gis-api's
+// POST /enrichment/cf only inserts a pending CfExtract row — there is no
+// orchestrator-side worker that executes the paid ePay purchase, so orders
+// placed through /api/cf/order silently never complete (UI even shows
+// "Extras CF valid"). Until that fulfiller ships and is verified, ALL paid
+// ePay orders MUST go through the legacy local queue (/api/ancpi/order).
+// Flip to true only after the orchestrator ePay worker is deployed.
+export const EPAY_ORDERING_VIA_GIS_AC = false;
+
 export function cfApiBase(useGisAc: boolean): string {
   return useGisAc ? "/api/cf" : "/api/ancpi";
 }
@@ -254,7 +263,9 @@ export async function placeCfOrder(
     gisFeatureId?: string;
   },
 ): Promise<{ ok: boolean; error?: string }> {
-  if (useGisAc) {
+  // See EPAY_ORDERING_VIA_GIS_AC — gis-api can't fulfill paid orders yet,
+  // so the pilot flag alone must NOT route ordering away from the queue.
+  if (useGisAc && EPAY_ORDERING_VIA_GIS_AC) {
     try {
       const res = await fetch("/api/cf/order", {
         method: "POST",

src/modules/parcel-sync/components/epay-order-button.tsx

@@ -13,6 +13,7 @@ import {
 import { cn } from "@/shared/lib/utils";
 import type { EpaySessionStatus } from "./epay-connect";
 import {
+  EPAY_ORDERING_VIA_GIS_AC,
   fetchCfHasCompletedForCadastral,
   placeCfOrder,
 } from "./cf-api-base";
@@ -49,6 +50,10 @@ export function EpayOrderButton({
   const useGisAc = Boolean(
     (session as { useGisAc?: boolean } | null)?.useGisAc,
   );
+  // Effective ordering route: even on pilot accounts, paid ePay orders go
+  // through the legacy queue until the gis-api fulfiller ships — see
+  // EPAY_ORDERING_VIA_GIS_AC in cf-api-base.ts.
+  const orderViaGisAc = useGisAc && EPAY_ORDERING_VIA_GIS_AC;
 
   const [ordering, setOrdering] = useState(false);
   const [ordered, setOrdered] = useState(false);
@@ -114,13 +119,13 @@ export function EpayOrderButton({
     }
   }, [nrCadastral, siruta, judetName, uatName, useGisAc]);
 
-  // On the gis.ac path, the orchestrator dispatches ePay calls through
-  // a shared account pool — the user doesn't need a personally-connected
-  // ePay session, and we don't have per-user credit info to gate on.
-  // Legacy path still requires local connection + credits.
+  // On the (future) gis.ac path, the orchestrator dispatches ePay calls
+  // through a shared account pool — no personally-connected ePay session
+  // needed. The legacy queue (current route while the guard is on)
+  // requires local connection + credits.
   const disabled =
     ordering ||
-    (!useGisAc &&
+    (!orderViaGisAc &&
       (!epayStatus.connected ||
         (epayStatus.credits != null && epayStatus.credits < 1)));
 
@@ -131,7 +136,7 @@ export function EpayOrderButton({
     if (error) return error;
     if (ordering) return "Se comanda...";
     if (ordered) return "Extras CF valid";
-    if (!useGisAc) {
+    if (!orderViaGisAc) {
       if (!epayStatus.connected) return "ePay neconectat";
       if (epayStatus.credits != null && epayStatus.credits < 1) return "Credite insuficiente";
     }