M33: enforce booking readiness workflow

backend/app/api/routers/bookings.py

@@ -20,6 +20,7 @@ from app.schemas import (
     CancelBookingRequest,
     CheckoutBookingRequest,
     CheckoutBookingResult,
+    CompleteBookingRequirementsRequest,
     CreateBookingRequest,
     CurrentUser,
     NextBookingRisk,
@@ -342,6 +343,42 @@ def get_booking(
     return _to_out(booking, customer, vehicle)
 
 
+@router.post("/{public_ref}/complete-requirements", response_model=BookingOut)
+def complete_booking_requirements(
+    public_ref: str,
+    body: CompleteBookingRequirementsRequest,
+    db: Session = Depends(get_db),
+    user: CurrentUser = Depends(get_current_user),
+) -> BookingOut:
+    booking = db.scalar(select(Booking).where(Booking.public_ref == public_ref).with_for_update())
+    if booking is None:
+        raise HTTPException(status_code=404, detail="Booking not found")
+    if booking.status != "reserved":
+        raise HTTPException(
+            status_code=409,
+            detail="Requirements can only be confirmed for a reserved booking",
+        )
+    customer = db.get(Customer, booking.customer_id)
+    vehicle = db.get(Vehicle, booking.vehicle_id)
+    if customer is None or vehicle is None:
+        raise HTTPException(status_code=500, detail="Booking references a missing record")
+    if not booking.requirements_complete:
+        booking.requirements_complete = True
+        record_audit_event(
+            db,
+            actor_type="user",
+            actor_label=user.display_name,
+            action="booking_requirements_completed",
+            entity_type="booking",
+            entity_id=booking.id,
+            before={"requirements_complete": False},
+            after={"requirements_complete": True},
+            metadata={"confirmation": body.confirmation.strip()},
+        )
+        db.commit()
+    return _to_out(booking, customer, vehicle)
+
+
 @router.post("/{public_ref}/cancel", response_model=BookingOut)
 def cancel_booking(
     public_ref: str,

backend/app/models/booking.py

@@ -26,4 +26,4 @@ class Booking(UUIDPrimaryKeyMixin, TimestampMixin, Base):
     status: Mapped[str] = mapped_column(String(20), nullable=False)
     start_odometer_km: Mapped[int | None] = mapped_column(Integer)
     end_odometer_km: Mapped[int | None] = mapped_column(Integer)
-    requirements_complete: Mapped[bool] = mapped_column(Boolean, nullable=False, default=True)
+    requirements_complete: Mapped[bool] = mapped_column(Boolean, nullable=False, default=False)

backend/app/schemas.py

@@ -92,7 +92,11 @@ class CreateBookingRequest(BaseModel):
     vehicle_ref: str = Field(min_length=3, max_length=20)
     starts_at: datetime
     ends_at: datetime
-    requirements_complete: bool = True
+    requirements_complete: bool = False
+
+
+class CompleteBookingRequirementsRequest(BaseModel):
+    confirmation: str = Field(min_length=3, max_length=500)
 
 
 class CustomerOptionOut(BaseModel):

backend/tests/test_bookings.py

@@ -73,6 +73,37 @@ def test_create_booking_rejects_overlap_and_audits_valid_booking(ops_client):
     body = created.json()
     assert body["status"] == "reserved"
     assert body["vehicle_ref"] == available_vehicle
+    assert body["requirements_complete"] is False
+
+
+def test_booking_requirements_are_explicit_and_audited(ops_client):
+    window = {"starts_at": "2031-09-01T10:00:00Z", "ends_at": "2031-09-02T12:00:00Z"}
+    vehicle = ops_client.get("/api/v1/bookings/availability", params=window).json()[0]
+    booking = ops_client.post(
+        "/api/v1/bookings",
+        json={"customer_ref": "CUS-0001", "vehicle_ref": vehicle["public_ref"], **window},
+    ).json()
+    checkout = ops_client.post(
+        f"/api/v1/bookings/{booking['public_ref']}/checkout",
+        json={
+            "start_odometer_km": 100000,
+            "fuel_level_percent": 90,
+            "cleanliness_ok": True,
+            "damage_reported": False,
+            "technical_warning": False,
+        },
+    )
+    assert checkout.status_code == 409
+
+    confirmed = ops_client.post(
+        f"/api/v1/bookings/{booking['public_ref']}/complete-requirements",
+        json={"confirmation": "Licence and rental conditions checked"},
+    )
+    assert confirmed.status_code == 200
+    assert confirmed.json()["requirements_complete"] is True
+    audit = ops_client.get("/api/v1/audit", params={"action": "booking_requirements_completed"})
+    assert audit.status_code == 200
+    assert any(item["entity_ref"] == booking["public_ref"] for item in audit.json())
 
 
 def test_customer_search_returns_canonical_customers(ops_client):
@@ -158,7 +189,12 @@ def test_checkout_records_inspection_and_activates_safe_booking(ops_client):
     vehicle = ops_client.get(f"/api/v1/vehicles/{vehicle_option['public_ref']}").json()
     booking = ops_client.post(
         "/api/v1/bookings",
-        json={"customer_ref": "CUS-0001", "vehicle_ref": vehicle["public_ref"], **window},
+        json={
+            "customer_ref": "CUS-0001",
+            "vehicle_ref": vehicle["public_ref"],
+            "requirements_complete": True,
+            **window,
+        },
     ).json()
     response = ops_client.post(
         f"/api/v1/bookings/{booking['public_ref']}/checkout",