This isolated source candidate gives web and Business app clients one server authority for assigning professionals to services and managing duration/price variants. It is not deployed and does not establish full setup parity or Nailtech handover readiness.

Staff can read assigned service names with staff.view. Changes require bookings.manage, selected-venue ownership and an active service-delivering membership where applicable. Generic staff access does not grant booking or POS powers. Removing a future assignment does not remove appointment records; variant deletion keeps the existing database reference restrictions, with deactivation available to retain the option record.

Price overrides use the parent service's currency and decimal-major amounts; an explicit zero stays zero and null inherits. Identity, tenant, payout, intake and waiver fields cannot be smuggled into these payloads. Failed reads are unavailable rather than an empty catalogue. Dispatched write uncertainty retains the exact request key; acknowledgement failures do not replace a known result. Cache, audit, analytics and existing webhook effects are attempted independently after persistence.

The new JWT endpoints preserve the existing success shapes and explicit permission boundaries. Consumers and Branded clients do not gain these administration capabilities: they continue booking through the canonical service, availability and appointment engines. Published Sites and Studio/AI continue using those shared records and existing gates; final renderer/tool compatibility checks remain required.

The web service-detail variant and provider panels now inspect returned outcomes. A refused save retains the draft and shows an inline explanation; it does not show success or refresh. An uncertain or legacy outcome requires a full reload and review before another mutation. Add and remove share a synchronous interaction lock, and late responses cannot update a different service or a newly opened instance of the original service. Confirmed saves show any post-save warnings. Variant duration and price remain text drafts until validated; blank price is not free, explicit zero is free, and supported decimal precision follows the parent service currency rather than the venue display currency. Controls have accessible names and 44px minimum targets.

Provider headings, empty states, removal labels and saved feedback use the existing venue terminology resolver, including an owner's Beauty Technician override; labels do not grant service-delivery permissions. Cookie error responses retain their existing error field and add write_state: not_written or unknown. Only the canonical core's preCommit proof produces not_written. No JWT DTO or permission is widened by this web feedback repair. Native Business authoring/recovery remains separately required against the existing JWT contract; clients do not consume cookie action responses.

Remaining requirements include Business authoring/recovery screens, hours/media/policy/readiness authoring companions, offering/paid-plan controls, final combined checks and device evidence. Capacity preflight plus assignment upsert is not an atomic capacity reservation. No hosted configuration, schema, client communication or customer transaction was changed. Native custom terminology remains a separate gap.