Note product→profile write-path gap and scope the picker; record red-test + FK decisions

AGENTS.md

@@ -108,13 +108,37 @@ Operator-specific memories at `~/.claude/projects/-Users-macpro-Projects-licensi
   *every* paid purchase) was fixed in daemon `31f4670`; `:53` (version bump
   `8c4bacc`) built, installed to prod, and published to the registry on
   2026-06-13. The live purchase path works again.
-- **Next, in priority order**: (1) resolve the 3 red tests — delete the dead
-  `payment_provider_preference_round_trip`, decide the mock-injection seam for the
-  two `paid_purchase_*` (see `docs/guides/testing.md`);
-  (2) build the 4 deferred UIs + add `unlimited_merchant_profiles` to master
-  Pro/Patron policies; (3) re-register the master Zaprite webhook; (4) optional:
-  run formatters as a standalone commit.
+- **GAP — multi-profile is non-functional end-to-end**: nothing in the shipped
+  app writes `products.merchant_profile_id` (the INSERT in
+  `create_product_with_currency` omits it; `update_product_with_currency` has no
+  field for it; the `Product` struct in `models.rs` doesn't even carry it). So
+  every product created post-migration stays on the default profile, and a Pro
+  operator can create extra profiles + attach providers but cannot route any
+  product's sales to them. The data model + resolver fully support it; only the
+  product→profile **write path** is missing. **This is the gating piece for
+  multi-profile** — see the scoped slice below.
+- **Next, in priority order**:
+  (1) **Product→merchant-profile picker** (gating piece above). Slice:
+  add `merchant_profile_id: Option<String>` to the `Product` model + its SELECT
+  column mapping in `repo.rs`; add a `set_product_merchant_profile` follow-up
+  writer mirroring `set_product_entitlements_catalog`; add the field to
+  `CreateProductReq`/`UpdateProductReq` (`api/admin.rs`) applied as a post-create/
+  update follow-up; add a profile `<select>` (populated from
+  `GET /v1/admin/merchant-profiles`) to the create + edit product forms in
+  `web/index.html`, rendered only when >1 profile exists. No migration (column
+  exists since 0020). Default/None → stays on default profile.
+  (2) resolve the 3 red tests — **delete** the dead
+  `payment_provider_preference_round_trip`; for the two `paid_purchase_*`, add a
+  provider-injection seam (recommended: an always-compiled
+  `Option<Arc<dyn PaymentProvider>>` override on `AppState`, checked first in
+  `resolve_provider_for_profile_rail`; alt: gate a mock behind a `test-mocks`
+  cargo feature). See `docs/guides/testing.md`.
+  (3) build the other 3 deferred UIs (rail picker, per-profile SMTP, rail-pref
+  editor) + add `unlimited_merchant_profiles` to master Pro/Patron policies;
+  (4) re-register the master Zaprite webhook; (5) optional: run formatters as a
+  standalone commit.
 - **Tests/build**: `cargo check` clean (1 intentional deprecation warning); api
   43 pass / 3 known-fail (test-debt), other suites green. No CI; fmt/prettier not
-  enforced or clean. Latent: confirm the sqlx pool sets `PRAGMA foreign_keys = ON`
-  per-connection (else FKs aren't runtime-enforced) — flagged by review, unchecked.
+  enforced or clean. FK enforcement **confirmed** — the sqlx pool sets
+  `foreign_keys(true)` per connection (`db/mod.rs`); the old "latent/unchecked"
+  caveat is resolved.