This isolated source candidate gives web and Business app clients one server authority for provider working-hours rows. It is not deployed and does not establish full setup parity.

An administrator with bookings.manage can configure staff hours in the selected venue. Only delivery-eligible active memberships can receive active hours; generic non-delivering staff are not made providers. Deactivating a row does not remove historical appointments. Times and effective dates are venue-local; invalid calendar dates and overlapping or duplicate rows are refused before dispatch. Failed reads are unavailable rather than an empty calendar. JWT OPTIONS is rate-limited. Idempotent writes keep a known saved result if acknowledgement or cache/audit/track later fails.

Consumers and Branded clients do not gain hours authoring; they continue booking through canonical availability. Published Sites are unchanged. Native hours screens wait on this producer review. Capacity/overlap preflight plus insert is not an atomic reservation.

The web hours card now keeps refused drafts, shows saved warnings and holds
further writes after an uncertain result until explicit reload/review. Invalid
or cleared first dates are refused; one add/remove operation runs at a time.
Same-venue staff-list refreshes do not silently clear recovery. Native setup,
physical-device and final integrated acceptance remain outstanding.
Exact fields and limitations: [provider-hours contract](../api/PROVIDER_WORKING_HOURS_CONTRACT.md).