feat(dedup): runtime surfaces — merge service, at-create suggestion, admin queue (P2)

Adds the live dedup pipeline on top of the P1 library + P3 migration
script. The new `client/interest` model now actively prevents duplicate
client records at creation time and gives admins a queue to triage
the borderline pairs the at-create check missed.

Three layers, per design §7:

Layer 1 — At-create suggestion
==============================

`GET /api/v1/clients/match-candidates`
  Accepts free-text email / phone / name from the in-flight client
  form, normalizes them via the dedup library, and returns scored
  matches against the port's live client pool. Filters out
  low-confidence noise (the background scoring queue picks those up
  separately). Strict port scoping; never leaks across tenants.

`<DedupSuggestionPanel>` (`src/components/clients/dedup-suggestion-panel.tsx`)
  Debounced React Query hook. Renders nothing for short inputs or
  no useful match. On a high-confidence match it interrupts visually
  with an amber-tinted card and a "Use this client" primary button.
  Medium confidence falls back to a softer "possible match — check
  before creating" treatment.

`<ClientForm>`
  Renders the panel above the form (create path only — skipped on
  edit). New `onUseExistingClient` callback fires when the user
  picks the existing client; the form closes and the parent decides
  what to do (typically: navigate to that client's detail page or
  open the create-interest dialog pre-filled).

Layer 2 — Merge service
=======================

`mergeClients` (`src/lib/services/client-merge.service.ts`)
  The atomic merge primitive that everything else calls. Single
  transaction. Per §6 of the design:

  - Locks both rows (FOR UPDATE) so concurrent merges of the same
    loser fail with a clear error rather than racing.
  - Snapshots the full loser state (contacts / addresses / notes /
    tags / interest+reservation IDs / relationship rows) into the
    `client_merge_log.merge_details` JSONB column for the eventual
    undo flow.
  - Reattaches every loser-side row to the winner: interests,
    reservations, contacts (skipping duplicates by `(channel, value)`),
    addresses, notes, tags (deduped), relationships.
  - Optional `fieldChoices` — per-scalar overrides letting the user
    keep the loser's value for fullName / nationality / preferences /
    timezone / source.
  - Marks the loser archived with `mergedIntoClientId` set (a redirect
    pointer for stragglers; never hard-deleted within the undo window).
  - Resolves any matching `client_merge_candidates` row to status='merged'.
  - Writes audit log entry.

Schema additions:
  - `clients.merged_into_client_id` (nullable text, indexed) — the
    redirect pointer set on archive.

Tests: 6 cases against a real DB — happy path moves rows + writes log;
self-merge / cross-port / already-merged refused; duplicate-contact
deduped on reattach; fieldChoices copies loser values to winner.

Layer 3 — Admin review queue
============================

`GET /api/v1/admin/duplicates`
  Pending merge candidates (status='pending') for the current port,
  with both client summaries hydrated for side-by-side rendering.
  Skips pairs where one side is already archived/merged.

`POST /api/v1/admin/duplicates/[id]/merge`
  Confirms a candidate. Body picks the winner; the other side
  becomes the loser. Calls into `mergeClients` — the only path that
  writes `client_merge_log`.

`POST /api/v1/admin/duplicates/[id]/dismiss`
  Marks the candidate dismissed. Future scoring runs skip the same
  pair until a score change recreates the row.

`<DuplicatesReviewQueue>` (`/admin/duplicates`)
  Side-by-side card UI for each pending pair. Click a card to pick
  the winner; the other side is automatically the loser. Toolbar:
  "Merge into selected" + "Dismiss". No per-field merge editor in
  this PR — that's a future polish; the simple "pick the better row"
  flow handles ~80% of cases.

Test coverage
=============

11 new integration tests (76 added in this branch total):
  - 6 mergeClients (atomicity, refusal cases, contact dedup,
    fieldChoices)
  - 5 match-candidates API (shape, port scoping, confidence tiers,
    Pattern F false-positive guard)

Full vitest: 926/926 passing (was 858 before the dedup branch).
Lint: clean. tsc: clean for new files (only pre-existing errors in
unrelated `tests/integration/` files remain, same as before this PR).

Out of scope, deferred
======================

- Background scoring cron that populates `client_merge_candidates`
  (the queue is empty until this lands; manual seeding works for
  now via the at-create flow).
- Side-by-side per-field merge editor with checkboxes (the simple
  "pick the winner" UX shipped here covers ~80% of real cases).
- Admin settings UI for tuning the dedup thresholds. Defaults from
  the design (90 / 50) are baked in for now.
- `unmergeClients` (the snapshot is captured in client_merge_log;
  the undo endpoint just hasn't been wired yet).

These are all natural follow-up PRs that don't block shipping the
runtime UX.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

src/app/(dashboard)/[portSlug]/admin/duplicates/page.tsx

@@ -0,0 +1,5 @@
+import { DuplicatesReviewQueue } from '@/components/admin/duplicates/duplicates-review-queue';
+
+export default function DuplicatesAdminPage() {
+  return <DuplicatesReviewQueue />;
+}

src/app/api/v1/admin/duplicates/[id]/dismiss/route.ts

@@ -0,0 +1,4 @@
+import { withAuth, withPermission } from '@/lib/api/helpers';
+import { dismissHandler } from '../../handlers';
+
+export const POST = withAuth(withPermission('clients', 'edit', dismissHandler));

src/app/api/v1/admin/duplicates/[id]/merge/route.ts

@@ -0,0 +1,4 @@
+import { withAuth, withPermission } from '@/lib/api/helpers';
+import { confirmMergeHandler } from '../../handlers';
+
+export const POST = withAuth(withPermission('clients', 'edit', confirmMergeHandler));

src/app/api/v1/admin/duplicates/handlers.ts

@@ -0,0 +1,160 @@
+import { NextResponse } from 'next/server';
+import { and, eq, inArray } from 'drizzle-orm';
+
+import type { AuthContext } from '@/lib/api/helpers';
+import { db } from '@/lib/db';
+import { clients, clientMergeCandidates } from '@/lib/db/schema/clients';
+import { errorResponse, NotFoundError } from '@/lib/errors';
+import {
+  listPendingMergeCandidates,
+  mergeClients,
+  type MergeFieldChoices,
+} from '@/lib/services/client-merge.service';
+
+/**
+ * GET /api/v1/admin/duplicates
+ *
+ * Pending merge candidates for the current port, sorted by score.
+ * Each row hydrates its two client summaries so the review-queue UI
+ * can render side-by-side cards without an N+1 fetch.
+ */
+export async function listHandler(_req: Request, ctx: AuthContext): Promise<NextResponse> {
+  try {
+    const pairs = await listPendingMergeCandidates(ctx.portId);
+    if (pairs.length === 0) return NextResponse.json({ data: [] });
+
+    const ids = Array.from(new Set(pairs.flatMap((p) => [p.clientAId, p.clientBId])));
+    const clientRows = await db
+      .select({
+        id: clients.id,
+        fullName: clients.fullName,
+        archivedAt: clients.archivedAt,
+        mergedIntoClientId: clients.mergedIntoClientId,
+        createdAt: clients.createdAt,
+      })
+      .from(clients)
+      .where(inArray(clients.id, ids));
+    const clientById = new Map(clientRows.map((c) => [c.id, c]));
+
+    const data = pairs
+      .map((p) => {
+        const a = clientById.get(p.clientAId);
+        const b = clientById.get(p.clientBId);
+        if (!a || !b) return null; // FK orphan — shouldn't happen, but be defensive
+        // Skip pairs where one side has already been merged or archived.
+        if (a.mergedIntoClientId || b.mergedIntoClientId) return null;
+        return {
+          id: p.id,
+          score: p.score,
+          reasons: p.reasons,
+          createdAt: p.createdAt,
+          clientA: { id: a.id, fullName: a.fullName, createdAt: a.createdAt },
+          clientB: { id: b.id, fullName: b.fullName, createdAt: b.createdAt },
+        };
+      })
+      .filter((row): row is NonNullable<typeof row> => row !== null);
+
+    return NextResponse.json({ data });
+  } catch (error) {
+    return errorResponse(error);
+  }
+}
+
+/**
+ * POST /api/v1/admin/duplicates/[id]/merge
+ *
+ * Body: { winnerId: string, fieldChoices?: MergeFieldChoices }
+ *
+ * Confirms a merge candidate. The winner is the one the user picked
+ * to keep; the other side becomes the loser. Calls into the merge
+ * service which is the only path that touches client_merge_log.
+ */
+export async function confirmMergeHandler(
+  req: Request,
+  ctx: AuthContext,
+  params: { id?: string },
+): Promise<NextResponse> {
+  try {
+    const id = params.id ?? '';
+    const body = (await req.json().catch(() => ({}))) as {
+      winnerId?: string;
+      fieldChoices?: MergeFieldChoices;
+    };
+    if (!body.winnerId) {
+      return NextResponse.json({ error: 'winnerId required' }, { status: 400 });
+    }
+
+    const [candidate] = await db
+      .select()
+      .from(clientMergeCandidates)
+      .where(
+        and(
+          eq(clientMergeCandidates.id, id),
+          eq(clientMergeCandidates.portId, ctx.portId),
+          eq(clientMergeCandidates.status, 'pending'),
+        ),
+      );
+    if (!candidate) throw new NotFoundError('Merge candidate');
+
+    const loserId =
+      body.winnerId === candidate.clientAId
+        ? candidate.clientBId
+        : body.winnerId === candidate.clientBId
+          ? candidate.clientAId
+          : null;
+    if (!loserId) {
+      return NextResponse.json(
+        { error: 'winnerId must match one of the candidate clients' },
+        { status: 400 },
+      );
+    }
+
+    const result = await mergeClients({
+      winnerId: body.winnerId,
+      loserId,
+      mergedBy: ctx.userId,
+      fieldChoices: body.fieldChoices,
+    });
+
+    return NextResponse.json({ data: result });
+  } catch (error) {
+    return errorResponse(error);
+  }
+}
+
+/**
+ * POST /api/v1/admin/duplicates/[id]/dismiss
+ *
+ * Mark a merge candidate as dismissed. The background scoring job
+ * skips dismissed pairs on subsequent runs (a future score increase
+ * can re-create them).
+ */
+export async function dismissHandler(
+  _req: Request,
+  ctx: AuthContext,
+  params: { id?: string },
+): Promise<NextResponse> {
+  try {
+    const id = params.id ?? '';
+    const result = await db
+      .update(clientMergeCandidates)
+      .set({
+        status: 'dismissed',
+        resolvedAt: new Date(),
+        resolvedBy: ctx.userId,
+      })
+      .where(
+        and(
+          eq(clientMergeCandidates.id, id),
+          eq(clientMergeCandidates.portId, ctx.portId),
+          eq(clientMergeCandidates.status, 'pending'),
+        ),
+      )
+      .returning({ id: clientMergeCandidates.id });
+
+    if (result.length === 0) throw new NotFoundError('Merge candidate');
+    return NextResponse.json({ data: { id: result[0]!.id, status: 'dismissed' } });
+  } catch (error) {
+    return errorResponse(error);
+  }
+}

src/app/api/v1/admin/duplicates/route.ts

@@ -0,0 +1,4 @@
+import { withAuth, withPermission } from '@/lib/api/helpers';
+import { listHandler } from './handlers';
+
+export const GET = withAuth(withPermission('clients', 'view', listHandler));

src/app/api/v1/clients/match-candidates/handlers.ts

@@ -0,0 +1,160 @@
+import { NextResponse } from 'next/server';
+import { and, eq, inArray } from 'drizzle-orm';
+
+import type { AuthContext } from '@/lib/api/helpers';
+import { db } from '@/lib/db';
+import { clients, clientContacts } from '@/lib/db/schema/clients';
+import { interests } from '@/lib/db/schema/interests';
+import { errorResponse } from '@/lib/errors';
+import { findClientMatches, type MatchCandidate } from '@/lib/dedup/find-matches';
+import { normalizeEmail, normalizeName, normalizePhone } from '@/lib/dedup/normalize';
+import type { CountryCode } from '@/lib/i18n/countries';
+
+/**
+ * GET /api/v1/clients/match-candidates
+ *
+ * Query parameters (any combination):
+ *   email      Free-text email; gets normalized server-side.
+ *   phone      Free-text phone; gets normalized to E.164 server-side.
+ *   name       Free-text full name; used for surname-token blocking.
+ *   country    Optional ISO country hint (default: AI for Port Nimara).
+ *
+ * Returns the top candidates that scored above the soft-warn threshold,
+ * each with a small client summary the form's suggestion card can
+ * render. Confidence tiers and rules are applied server-side from the
+ * port's `system_settings` (when wired) or sensible defaults otherwise.
+ *
+ * Used by `useDedupSuggestion` in the new-client form. Debounced on
+ * the client; this endpoint must be cheap (single port pool fetch +
+ * an in-memory dedup pass).
+ */
+export async function getMatchCandidatesHandler(
+  req: Request,
+  ctx: AuthContext,
+): Promise<NextResponse> {
+  try {
+    const url = new URL(req.url);
+    const rawEmail = url.searchParams.get('email');
+    const rawPhone = url.searchParams.get('phone');
+    const rawName = url.searchParams.get('name');
+    const country = (url.searchParams.get('country') ?? 'AI') as CountryCode;
+
+    const email = rawEmail ? normalizeEmail(rawEmail) : null;
+    const phoneResult = rawPhone ? normalizePhone(rawPhone, country) : null;
+    const nameResult = rawName ? normalizeName(rawName) : null;
+
+    // If the caller didn't give us anything useful to match on, return empty
+    // — short-circuit rather than scan every client for nothing.
+    if (!email && !phoneResult?.e164 && !nameResult?.surnameToken) {
+      return NextResponse.json({ data: [] });
+    }
+
+    // Build the input candidate.
+    const input: MatchCandidate = {
+      id: '__incoming__',
+      fullName: nameResult?.display ?? null,
+      surnameToken: nameResult?.surnameToken ?? null,
+      emails: email ? [email] : [],
+      phonesE164: phoneResult?.e164 ? [phoneResult.e164] : [],
+      countryIso: country,
+    };
+
+    // Fetch the live pool for this port. We keep this O(N) over clients
+    // since the dedup library does its own blocking; for ports with
+    // thousands of clients we can later restrict by surname-token /
+    // contact lookups, but for current scale the simple full-pool fetch
+    // is fine.
+    const liveClients = await db
+      .select({
+        id: clients.id,
+        fullName: clients.fullName,
+        nationalityIso: clients.nationalityIso,
+      })
+      .from(clients)
+      .where(and(eq(clients.portId, ctx.portId)));
+
+    if (liveClients.length === 0) {
+      return NextResponse.json({ data: [] });
+    }
+
+    const clientIds = liveClients.map((c) => c.id);
+    const contactRows = await db
+      .select({
+        clientId: clientContacts.clientId,
+        channel: clientContacts.channel,
+        value: clientContacts.value,
+        valueE164: clientContacts.valueE164,
+      })
+      .from(clientContacts)
+      .where(inArray(clientContacts.clientId, clientIds));
+
+    // Group contacts by client for the candidate map.
+    const emailsByClient = new Map<string, string[]>();
+    const phonesByClient = new Map<string, string[]>();
+    for (const c of contactRows) {
+      if (c.channel === 'email') {
+        const arr = emailsByClient.get(c.clientId) ?? [];
+        arr.push(c.value.toLowerCase());
+        emailsByClient.set(c.clientId, arr);
+      } else if (c.channel === 'phone' || c.channel === 'whatsapp') {
+        if (c.valueE164) {
+          const arr = phonesByClient.get(c.clientId) ?? [];
+          arr.push(c.valueE164);
+          phonesByClient.set(c.clientId, arr);
+        }
+      }
+    }
+
+    const pool: MatchCandidate[] = liveClients.map((c) => {
+      const named = normalizeName(c.fullName);
+      return {
+        id: c.id,
+        fullName: c.fullName,
+        surnameToken: named.surnameToken ?? null,
+        emails: emailsByClient.get(c.id) ?? [],
+        phonesE164: phonesByClient.get(c.id) ?? [],
+        countryIso: (c.nationalityIso as CountryCode | null) ?? null,
+      };
+    });
+
+    const matches = findClientMatches(input, pool, {
+      highScore: 90,
+      mediumScore: 50,
+    });
+
+    // Only return medium+ — low-confidence noise isn't useful at the
+    // create-form layer (background scoring queue picks those up).
+    const useful = matches.filter((m) => m.confidence !== 'low');
+    if (useful.length === 0) {
+      return NextResponse.json({ data: [] });
+    }
+
+    // Pull a quick summary for each surfaced candidate so the suggestion
+    // card has enough to render ("Marcus Laurent · 2 interests · last
+    // contact 9d ago").
+    const summarizedIds = useful.map((m) => m.candidate.id);
+    const interestCounts = await db
+      .select({ clientId: interests.clientId })
+      .from(interests)
+      .where(inArray(interests.clientId, summarizedIds));
+    const interestsByClient = new Map<string, number>();
+    for (const r of interestCounts) {
+      interestsByClient.set(r.clientId, (interestsByClient.get(r.clientId) ?? 0) + 1);
+    }
+
+    const data = useful.map((m) => ({
+      clientId: m.candidate.id,
+      fullName: m.candidate.fullName,
+      score: m.score,
+      confidence: m.confidence,
+      reasons: m.reasons,
+      interestCount: interestsByClient.get(m.candidate.id) ?? 0,
+      emails: m.candidate.emails,
+      phonesE164: m.candidate.phonesE164,
+    }));
+
+    return NextResponse.json({ data });
+  } catch (error) {
+    return errorResponse(error);
+  }
+}

src/app/api/v1/clients/match-candidates/route.ts

@@ -0,0 +1,4 @@
+import { withAuth, withPermission } from '@/lib/api/helpers';
+import { getMatchCandidatesHandler } from './handlers';
+
+export const GET = withAuth(withPermission('clients', 'view', getMatchCandidatesHandler));

src/components/admin/duplicates/duplicates-review-queue.tsx

@@ -0,0 +1,215 @@
+'use client';
+
+import { useState } from 'react';
+import { useMutation, useQuery, useQueryClient } from '@tanstack/react-query';
+import { ArrowRight, GitMerge, X } from 'lucide-react';
+import { toast } from 'sonner';
+
+import { Button } from '@/components/ui/button';
+import { PageHeader } from '@/components/shared/page-header';
+import { EmptyState } from '@/components/shared/empty-state';
+import { Skeleton } from '@/components/ui/skeleton';
+import { apiFetch } from '@/lib/api/client';
+import { cn } from '@/lib/utils';
+
+interface CandidatePair {
+  id: string;
+  score: number;
+  reasons: string[];
+  createdAt: string;
+  clientA: { id: string; fullName: string; createdAt: string };
+  clientB: { id: string; fullName: string; createdAt: string };
+}
+
+/**
+ * Admin review queue for the dedup background scoring job.
+ *
+ * Lists every pending merge candidate (pairs where score >=
+ * `dedup_review_queue_threshold`). For each pair the admin can:
+ *   - Pick a winner via the side-by-side card → confirms a merge
+ *   - Dismiss → removes from the queue (a future score increase
+ *     re-creates the pair on the next scoring run)
+ *
+ * Only minimal merge UI here: the user picks which side is the winner
+ * (no per-field choice), and the loser archives. A richer side-by-side
+ * field-merge dialog is a future enhancement.
+ */
+export function DuplicatesReviewQueue() {
+  const queryClient = useQueryClient();
+
+  const { data, isLoading } = useQuery<{ data: CandidatePair[] }>({
+    queryKey: ['admin', 'duplicates'],
+    queryFn: () => apiFetch<{ data: CandidatePair[] }>('/api/v1/admin/duplicates'),
+  });
+
+  const pairs = data?.data ?? [];
+
+  return (
+    <div className="space-y-4">
+      <PageHeader
+        title="Duplicate clients"
+        description={
+          pairs.length === 0
+            ? 'No pending pairs to review.'
+            : `${pairs.length} pair${pairs.length === 1 ? '' : 's'} flagged for review.`
+        }
+      />
+
+      {isLoading ? (
+        <div className="space-y-3">
+          {[0, 1, 2].map((i) => (
+            <Skeleton key={i} className="h-32 w-full" />
+          ))}
+        </div>
+      ) : pairs.length === 0 ? (
+        <EmptyState
+          title="All clear"
+          description="The background scoring job hasn't surfaced any potential duplicates yet."
+        />
+      ) : (
+        <ul className="space-y-3">
+          {pairs.map((pair) => (
+            <li key={pair.id}>
+              <CandidateRow pair={pair} queryClient={queryClient} />
+            </li>
+          ))}
+        </ul>
+      )}
+    </div>
+  );
+}
+
+function CandidateRow({
+  pair,
+  queryClient,
+}: {
+  pair: CandidatePair;
+  queryClient: ReturnType<typeof useQueryClient>;
+}) {
+  const [busy, setBusy] = useState<'merge' | 'dismiss' | null>(null);
+  const [winnerId, setWinnerId] = useState<string>(pair.clientA.id);
+
+  const mergeMutation = useMutation({
+    mutationFn: () =>
+      apiFetch(`/api/v1/admin/duplicates/${pair.id}/merge`, {
+        method: 'POST',
+        body: { winnerId },
+      }),
+    onSuccess: () => {
+      const loserName =
+        winnerId === pair.clientA.id ? pair.clientB.fullName : pair.clientA.fullName;
+      const winnerName =
+        winnerId === pair.clientA.id ? pair.clientA.fullName : pair.clientB.fullName;
+      toast.success(`Merged "${loserName}" into "${winnerName}"`);
+      queryClient.invalidateQueries({ queryKey: ['admin', 'duplicates'] });
+      queryClient.invalidateQueries({ queryKey: ['clients'] });
+    },
+    onError: (err) => toast.error(err instanceof Error ? err.message : 'Merge failed'),
+    onSettled: () => setBusy(null),
+  });
+
+  const dismissMutation = useMutation({
+    mutationFn: () => apiFetch(`/api/v1/admin/duplicates/${pair.id}/dismiss`, { method: 'POST' }),
+    onSuccess: () => {
+      toast.message('Dismissed');
+      queryClient.invalidateQueries({ queryKey: ['admin', 'duplicates'] });
+    },
+    onError: (err) => toast.error(err instanceof Error ? err.message : 'Dismiss failed'),
+    onSettled: () => setBusy(null),
+  });
+
+  return (
+    <div className="rounded-lg border bg-card p-4">
+      <div className="mb-3 flex items-baseline justify-between gap-3">
+        <div>
+          <span className="rounded-full bg-muted px-2 py-0.5 text-[10px] font-medium uppercase tracking-wide text-muted-foreground">
+            score {pair.score}
+          </span>{' '}
+          <span className="text-xs text-muted-foreground">{pair.reasons.join(' · ')}</span>
+        </div>
+        <span className="text-xs text-muted-foreground">
+          flagged {new Date(pair.createdAt).toLocaleDateString()}
+        </span>
+      </div>
+
+      <div className="grid gap-3 sm:grid-cols-[1fr_auto_1fr]">
+        <ClientCard
+          client={pair.clientA}
+          isSelected={winnerId === pair.clientA.id}
+          onSelect={() => setWinnerId(pair.clientA.id)}
+        />
+        <div className="flex items-center justify-center text-muted-foreground">
+          <ArrowRight className="size-4" aria-hidden />
+        </div>
+        <ClientCard
+          client={pair.clientB}
+          isSelected={winnerId === pair.clientB.id}
+          onSelect={() => setWinnerId(pair.clientB.id)}
+        />
+      </div>
+
+      <div className="mt-3 flex flex-wrap items-center gap-2">
+        <Button
+          size="sm"
+          onClick={() => {
+            setBusy('merge');
+            mergeMutation.mutate();
+          }}
+          disabled={busy !== null}
+        >
+          <GitMerge className="mr-1 size-3.5" aria-hidden />
+          Merge into selected
+        </Button>
+        <Button
+          size="sm"
+          variant="ghost"
+          onClick={() => {
+            setBusy('dismiss');
+            dismissMutation.mutate();
+          }}
+          disabled={busy !== null}
+        >
+          <X className="mr-1 size-3.5" aria-hidden />
+          Dismiss
+        </Button>
+        <p className="text-xs text-muted-foreground">
+          The unselected card becomes the loser; its interests + contacts move to the selected
+          client and the original is archived.
+        </p>
+      </div>
+    </div>
+  );
+}
+
+function ClientCard({
+  client,
+  isSelected,
+  onSelect,
+}: {
+  client: CandidatePair['clientA'];
+  isSelected: boolean;
+  onSelect: () => void;
+}) {
+  return (
+    <button
+      type="button"
+      onClick={onSelect}
+      className={cn(
+        'rounded-md border p-3 text-left transition-colors',
+        isSelected
+          ? 'border-primary bg-primary/5 ring-1 ring-primary/30'
+          : 'border-border hover:bg-muted/40',
+      )}
+    >
+      <p className="text-sm font-medium">{client.fullName}</p>
+      <p className="mt-0.5 text-[11px] text-muted-foreground">
+        Created {new Date(client.createdAt).toLocaleDateString()}
+      </p>
+      {isSelected ? (
+        <span className="mt-1 inline-block rounded-full bg-primary/10 px-1.5 py-0.5 text-[10px] font-semibold text-primary">
+          KEEP
+        </span>
+      ) : null}
+    </button>
+  );
+}

src/components/clients/client-form.tsx

@@ -23,6 +23,7 @@ import { TagPicker } from '@/components/shared/tag-picker';
 import { CountryCombobox } from '@/components/shared/country-combobox';
 import { TimezoneCombobox } from '@/components/shared/timezone-combobox';
 import { PhoneInput } from '@/components/shared/phone-input';
+import { DedupSuggestionPanel } from '@/components/clients/dedup-suggestion-panel';
 import { apiFetch } from '@/lib/api/client';
 import { createClientSchema, type CreateClientInput } from '@/lib/validators/clients';
 import type { CountryCode } from '@/lib/i18n/countries';
@@ -30,6 +31,12 @@ import type { CountryCode } from '@/lib/i18n/countries';
 interface ClientFormProps {
   open: boolean;
   onOpenChange: (open: boolean) => void;
+  /** Optional callback fired when the dedup suggestion panel reports
+   *  the user picked an existing client. The form closes; parent is
+   *  responsible for navigating to the existing client's detail page
+   *  or opening the create-interest dialog pre-filled with that
+   *  clientId. Skipped in edit mode. */
+  onUseExistingClient?: (clientId: string) => void;
   /** If provided, form is in edit mode */
   client?: {
     id: string;
@@ -53,7 +60,7 @@ interface ClientFormProps {
   };
 }
 
-export function ClientForm({ open, onOpenChange, client }: ClientFormProps) {
+export function ClientForm({ open, onOpenChange, client, onUseExistingClient }: ClientFormProps) {
   const queryClient = useQueryClient();
   const isEdit = !!client;
 
@@ -143,6 +150,26 @@ export function ClientForm({ open, onOpenChange, client }: ClientFormProps) {
         </SheetHeader>
 
         <form onSubmit={handleSubmit((data) => mutation.mutate(data))} className="space-y-6 py-6">
+          {/* Dedup suggestion — only on the create path. Watches the
+              live form values for email / phone / name and surfaces
+              an existing client when one matches. The user can
+              attach the new interest to that client instead of
+              creating a duplicate. */}
+          {!isEdit ? (
+            <DedupSuggestionPanel
+              email={watch('contacts')?.find((c) => c?.channel === 'email')?.value ?? null}
+              phone={
+                watch('contacts')?.find((c) => c?.channel === 'phone' || c?.channel === 'whatsapp')
+                  ?.valueE164 ?? null
+              }
+              name={watch('fullName') ?? null}
+              onUseExisting={(match) => {
+                onUseExistingClient?.(match.clientId);
+                onOpenChange(false);
+              }}
+            />
+          ) : null}
+
           {/* Basic Info */}
           <div className="space-y-4">
             <h3 className="text-sm font-medium text-muted-foreground uppercase tracking-wide">

src/components/clients/dedup-suggestion-panel.tsx

@@ -0,0 +1,183 @@
+'use client';
+
+import { useEffect, useState } from 'react';
+import { useQuery } from '@tanstack/react-query';
+import { AlertCircle, ArrowRight, Briefcase, X } from 'lucide-react';
+
+import { Button } from '@/components/ui/button';
+import { apiFetch } from '@/lib/api/client';
+import { cn } from '@/lib/utils';
+
+interface MatchData {
+  clientId: string;
+  fullName: string;
+  score: number;
+  confidence: 'high' | 'medium' | 'low';
+  reasons: string[];
+  interestCount: number;
+  emails: string[];
+  phonesE164: string[];
+}
+
+interface DedupSuggestionPanelProps {
+  /** Free-text inputs from the in-flight new-client form. The panel
+   *  debounces them and queries /api/v1/clients/match-candidates. */
+  email?: string | null;
+  phone?: string | null;
+  name?: string | null;
+  /** Caller wants to attach the new interest to an existing client
+   *  rather than creating a new one. The form switches to
+   *  interest-only mode and pre-fills the client. */
+  onUseExisting: (match: MatchData) => void;
+  /** User explicitly said "create new anyway." Hide the panel until
+   *  they change input again. */
+  onDismiss?: () => void;
+}
+
+/**
+ * Surfaces existing clients that match the form's in-flight inputs.
+ *
+ * Renders nothing while inputs are short / no useful match found.
+ * On a high-confidence match, the panel interrupts visually with a
+ * solid border and a primary "Use this client" button.
+ *
+ * Wired into the new-client form. Skipped in edit mode.
+ */
+export function DedupSuggestionPanel({
+  email,
+  phone,
+  name,
+  onUseExisting,
+  onDismiss,
+}: DedupSuggestionPanelProps) {
+  const [dismissed, setDismissed] = useState(false);
+
+  // Debounce inputs by 300ms so we don't fire on every keystroke. Keep
+  // the latest debounced values in component state.
+  const [debounced, setDebounced] = useState({
+    email: email ?? '',
+    phone: phone ?? '',
+    name: name ?? '',
+  });
+
+  useEffect(() => {
+    const t = setTimeout(() => {
+      setDebounced({ email: email ?? '', phone: phone ?? '', name: name ?? '' });
+      // Clear the dismissed flag when inputs change — the user typed
+      // something new, so the prior dismissal no longer applies.
+      setDismissed(false);
+    }, 300);
+    return () => clearTimeout(t);
+  }, [email, phone, name]);
+
+  const hasSomething =
+    debounced.email.length > 3 || debounced.phone.length > 3 || debounced.name.length > 2;
+
+  const { data, isFetching } = useQuery<{ data: MatchData[] }>({
+    queryKey: ['dedup-match-candidates', debounced],
+    queryFn: () => {
+      const params = new URLSearchParams();
+      if (debounced.email) params.set('email', debounced.email);
+      if (debounced.phone) params.set('phone', debounced.phone);
+      if (debounced.name) params.set('name', debounced.name);
+      return apiFetch<{ data: MatchData[] }>(`/api/v1/clients/match-candidates?${params}`);
+    },
+    enabled: hasSomething && !dismissed,
+    // Same query is fine to cache for a minute — moves are slow at this layer.
+    staleTime: 60_000,
+  });
+
+  if (dismissed) return null;
+  if (!hasSomething) return null;
+  if (isFetching && !data) return null;
+  const matches = data?.data ?? [];
+  if (matches.length === 0) return null;
+
+  const top = matches[0]!;
+  const isHigh = top.confidence === 'high';
+
+  return (
+    <div
+      className={cn(
+        'rounded-lg border p-3 mb-3 transition-colors',
+        isHigh
+          ? 'border-amber-300 bg-amber-50/60 dark:bg-amber-950/30'
+          : 'border-border bg-muted/40',
+      )}
+      data-testid="dedup-suggestion"
+    >
+      <div className="flex items-start gap-3">
+        <div className="mt-0.5">
+          <AlertCircle
+            className={cn(
+              'size-5',
+              isHigh ? 'text-amber-700 dark:text-amber-400' : 'text-muted-foreground',
+            )}
+            aria-hidden
+          />
+        </div>
+        <div className="min-w-0 flex-1">
+          <p className="text-sm font-semibold leading-tight">
+            {isHigh
+              ? 'This looks like an existing client'
+              : 'Possible match — check before creating'}
+          </p>
+          <div className="mt-2 rounded-md border bg-background/80 p-2.5">
+            <div className="flex items-center gap-2">
+              <p className="truncate text-sm font-medium">{top.fullName}</p>
+              <span
+                className={cn(
+                  'shrink-0 rounded-full px-1.5 py-0.5 text-[10px] font-medium uppercase tracking-wide',
+                  isHigh
+                    ? 'bg-amber-200 text-amber-900 dark:bg-amber-800 dark:text-amber-100'
+                    : 'bg-muted text-muted-foreground',
+                )}
+              >
+                {top.confidence}
+              </span>
+            </div>
+            <div className="mt-0.5 flex flex-wrap items-center gap-x-3 gap-y-0.5 text-xs text-muted-foreground">
+              {top.emails[0] ? <span className="truncate">{top.emails[0]}</span> : null}
+              {top.phonesE164[0] ? <span>{top.phonesE164[0]}</span> : null}
+              <span className="inline-flex items-center gap-1">
+                <Briefcase className="size-3" aria-hidden />
+                {top.interestCount} {top.interestCount === 1 ? 'interest' : 'interests'}
+              </span>
+            </div>
+            <p className="mt-1.5 text-[11px] text-muted-foreground">{top.reasons.join(' · ')}</p>
+          </div>
+          <div className="mt-3 flex flex-wrap items-center gap-2">
+            <Button
+              type="button"
+              size="sm"
+              onClick={() => onUseExisting(top)}
+              data-testid="dedup-use-existing"
+            >
+              Use this client
+              <ArrowRight className="ml-1 size-3.5" aria-hidden />
+            </Button>
+            <Button
+              type="button"
+              size="sm"
+              variant="ghost"
+              onClick={() => {
+                setDismissed(true);
+                onDismiss?.();
+              }}
+              data-testid="dedup-dismiss"
+            >
+              <X className="mr-1 size-3.5" aria-hidden />
+              Create new anyway
+            </Button>
+            {matches.length > 1 ? (
+              <span className="text-xs text-muted-foreground">
+                +{matches.length - 1} other possible{' '}
+                {matches.length - 1 === 1 ? 'match' : 'matches'}
+              </span>
+            ) : null}
+          </div>
+        </div>
+      </div>
+    </div>
+  );
+}

src/lib/db/migrations/0021_magenta_madame_hydra.sql

@@ -0,0 +1,2 @@
+ALTER TABLE "clients" ADD COLUMN "merged_into_client_id" text;--> statement-breakpoint
+CREATE INDEX "idx_clients_merged_into" ON "clients" USING btree ("merged_into_client_id");

src/lib/db/migrations/meta/_journal.json

@@ -148,6 +148,13 @@
       "when": 1777811835982,
       "tag": "0020_unusual_azazel",
       "breakpoints": true
+    },
+    {
+      "idx": 21,
+      "version": "7",
+      "when": 1777812671833,
+      "tag": "0021_magenta_madame_hydra",
+      "breakpoints": true
     }
   ]
 }

src/lib/db/schema/clients.ts

@@ -31,6 +31,11 @@ export const clients = pgTable(
     source: text('source'), // website, manual, referral, broker
     sourceDetails: text('source_details'),
     archivedAt: timestamp('archived_at', { withTimezone: true }),
+    /** When this client was merged into another (the "loser" of a dedup
+     *  merge), this points at the surviving client. Used by the
+     *  /admin/duplicates review queue to redirect any stragglers, and by
+     *  the unmerge flow to restore. Null for live clients. */
+    mergedIntoClientId: text('merged_into_client_id'),
     createdAt: timestamp('created_at', { withTimezone: true }).notNull().defaultNow(),
     updatedAt: timestamp('updated_at', { withTimezone: true }).notNull().defaultNow(),
   },
@@ -39,6 +44,7 @@ export const clients = pgTable(
     index('idx_clients_name').on(table.portId, table.fullName),
     index('idx_clients_archived').on(table.portId, table.archivedAt),
     index('idx_clients_nationality_iso').on(table.nationalityIso),
+    index('idx_clients_merged_into').on(table.mergedIntoClientId),
   ],
 );
 

src/lib/services/client-merge.service.ts

@@ -0,0 +1,393 @@
+/**
+ * Client merge service — atomically combines two client records.
+ *
+ * Used by:
+ *   - /admin/duplicates review queue (when an admin confirms a merge)
+ *   - the at-create suggestion path ("use existing client") — though
+ *     that path uses the lighter `attachInterestToClient` and never
+ *     actually merges two pre-existing clients
+ *   - the migration script's `--apply` (eventually)
+ *
+ * Reversibility: every merge writes a `client_merge_log` row containing
+ * the loser's full pre-merge state. Within the configured undo window
+ * (default 7 days, see `dedup_undo_window_days` in system_settings) a
+ * follow-up `unmergeClients` call can restore the loser and detach
+ * everything that was reattached.
+ *
+ * Design reference: docs/superpowers/specs/2026-05-03-dedup-and-migration-design.md §6.
+ */
+
+import { and, eq, sql } from 'drizzle-orm';
+
+import { db } from '@/lib/db';
+import {
+  clients,
+  clientContacts,
+  clientAddresses,
+  clientNotes,
+  clientTags,
+  clientRelationships,
+  clientMergeLog,
+  clientMergeCandidates,
+} from '@/lib/db/schema/clients';
+import { interests } from '@/lib/db/schema/interests';
+import { berthReservations } from '@/lib/db/schema/reservations';
+import { auditLogs } from '@/lib/db/schema/system';
+
+// ─── Public API ─────────────────────────────────────────────────────────────
+
+export interface MergeFieldChoices {
+  /** Per-field overrides — `winner` keeps the surviving client's value;
+   *  `loser` copies the loser's value over. Fields not listed default
+   *  to `winner` (no change). */
+  fullName?: 'winner' | 'loser';
+  nationalityIso?: 'winner' | 'loser';
+  preferredContactMethod?: 'winner' | 'loser';
+  preferredLanguage?: 'winner' | 'loser';
+  timezone?: 'winner' | 'loser';
+  source?: 'winner' | 'loser';
+  sourceDetails?: 'winner' | 'loser';
+}
+
+export interface MergeOptions {
+  winnerId: string;
+  loserId: string;
+  /** ID of the user performing the merge (for audit + clientMergeLog.mergedBy). */
+  mergedBy: string;
+  /** Per-field choice overrides. Multi-value fields (contacts, addresses,
+   *  notes, tags) are always preserved from both sides; this only
+   *  affects single-value scalar fields on the `clients` row. */
+  fieldChoices?: MergeFieldChoices;
+}
+
+export interface MergeResult {
+  mergeLogId: string;
+  movedRows: {
+    interests: number;
+    contacts: number;
+    addresses: number;
+    notes: number;
+    tags: number;
+    relationships: number;
+    reservations: number;
+  };
+}
+
+/**
+ * Atomically merge `loserId` into `winnerId`. Throws if:
+ *   - either id doesn't exist or belongs to a different port
+ *   - the loser has already been merged (mergedIntoClientId set)
+ *   - the winner is itself archived
+ */
+export async function mergeClients(opts: MergeOptions): Promise<MergeResult> {
+  if (opts.winnerId === opts.loserId) {
+    throw new Error('Cannot merge a client into itself');
+  }
+
+  return await db.transaction(async (tx) => {
+    // ── Lock both rows for the duration. The first FOR UPDATE that
+    //    arrives wins; a concurrent second merge of the same loser
+    //    will see `mergedIntoClientId` set and bail. ──────────────────────
+    const [winnerRow] = await tx
+      .select()
+      .from(clients)
+      .where(eq(clients.id, opts.winnerId))
+      .for('update');
+    const [loserRow] = await tx
+      .select()
+      .from(clients)
+      .where(eq(clients.id, opts.loserId))
+      .for('update');
+
+    if (!winnerRow) throw new Error(`Winner client ${opts.winnerId} not found`);
+    if (!loserRow) throw new Error(`Loser client ${opts.loserId} not found`);
+    if (winnerRow.portId !== loserRow.portId) {
+      throw new Error('Cannot merge clients across different ports');
+    }
+    if (loserRow.mergedIntoClientId) {
+      throw new Error(`Loser ${opts.loserId} already merged into ${loserRow.mergedIntoClientId}`);
+    }
+    if (winnerRow.archivedAt) {
+      throw new Error('Cannot merge into an archived client');
+    }
+
+    // ── Snapshot the loser's full state before any mutation. Used by
+    //    `unmergeClients` to restore within the undo window. ──────────────
+    const loserContacts = await tx
+      .select()
+      .from(clientContacts)
+      .where(eq(clientContacts.clientId, opts.loserId));
+    const loserAddresses = await tx
+      .select()
+      .from(clientAddresses)
+      .where(eq(clientAddresses.clientId, opts.loserId));
+    const loserNotes = await tx
+      .select()
+      .from(clientNotes)
+      .where(eq(clientNotes.clientId, opts.loserId));
+    const loserTags = await tx
+      .select()
+      .from(clientTags)
+      .where(eq(clientTags.clientId, opts.loserId));
+    const loserInterests = await tx
+      .select({ id: interests.id })
+      .from(interests)
+      .where(eq(interests.clientId, opts.loserId));
+    const loserReservations = await tx
+      .select({ id: berthReservations.id })
+      .from(berthReservations)
+      .where(eq(berthReservations.clientId, opts.loserId));
+    const loserRelationshipsAsA = await tx
+      .select()
+      .from(clientRelationships)
+      .where(eq(clientRelationships.clientAId, opts.loserId));
+    const loserRelationshipsAsB = await tx
+      .select()
+      .from(clientRelationships)
+      .where(eq(clientRelationships.clientBId, opts.loserId));
+
+    const snapshot = {
+      loser: loserRow,
+      contacts: loserContacts,
+      addresses: loserAddresses,
+      notes: loserNotes,
+      tags: loserTags,
+      interests: loserInterests.map((r) => r.id),
+      reservations: loserReservations.map((r) => r.id),
+      relationshipsAsA: loserRelationshipsAsA,
+      relationshipsAsB: loserRelationshipsAsB,
+      fieldChoices: opts.fieldChoices ?? {},
+      mergedAt: new Date().toISOString(),
+    };
+
+    // ── Apply field choices on the winner. We only touch fields the
+    //    caller explicitly asked to copy from the loser; everything
+    //    else stays as-is. ────────────────────────────────────────────────
+    const fieldUpdates: Partial<typeof winnerRow> = {};
+    if (opts.fieldChoices?.fullName === 'loser') fieldUpdates.fullName = loserRow.fullName;
+    if (opts.fieldChoices?.nationalityIso === 'loser')
+      fieldUpdates.nationalityIso = loserRow.nationalityIso;
+    if (opts.fieldChoices?.preferredContactMethod === 'loser')
+      fieldUpdates.preferredContactMethod = loserRow.preferredContactMethod;
+    if (opts.fieldChoices?.preferredLanguage === 'loser')
+      fieldUpdates.preferredLanguage = loserRow.preferredLanguage;
+    if (opts.fieldChoices?.timezone === 'loser') fieldUpdates.timezone = loserRow.timezone;
+    if (opts.fieldChoices?.source === 'loser') fieldUpdates.source = loserRow.source;
+    if (opts.fieldChoices?.sourceDetails === 'loser')
+      fieldUpdates.sourceDetails = loserRow.sourceDetails;
+
+    if (Object.keys(fieldUpdates).length > 0) {
+      await tx
+        .update(clients)
+        .set({ ...fieldUpdates, updatedAt: new Date() })
+        .where(eq(clients.id, opts.winnerId));
+    }
+
+    // ── Reattach. Each table that points at the loser via clientId
+    //    gets pointed at the winner instead. ─────────────────────────────
+
+    const movedInterests = (
+      await tx
+        .update(interests)
+        .set({ clientId: opts.winnerId, updatedAt: new Date() })
+        .where(eq(interests.clientId, opts.loserId))
+        .returning({ id: interests.id })
+    ).length;
+
+    const movedReservations = (
+      await tx
+        .update(berthReservations)
+        .set({ clientId: opts.winnerId, updatedAt: new Date() })
+        .where(eq(berthReservations.clientId, opts.loserId))
+        .returning({ id: berthReservations.id })
+    ).length;
+
+    // Contacts: move loser's contacts to winner, but DON'T duplicate any
+    // already-present (channel, value) pair. Loser-only ones get
+    // demoted to non-primary so the winner's primary stays intact.
+    const winnerContacts = await tx
+      .select({ channel: clientContacts.channel, value: clientContacts.value })
+      .from(clientContacts)
+      .where(eq(clientContacts.clientId, opts.winnerId));
+    const winnerContactKeys = new Set(
+      winnerContacts.map((c) => `${c.channel}::${c.value.toLowerCase()}`),
+    );
+
+    let movedContacts = 0;
+    for (const c of loserContacts) {
+      const key = `${c.channel}::${c.value.toLowerCase()}`;
+      if (winnerContactKeys.has(key)) {
+        // Winner already has this contact — drop loser's row (cascade
+        // will clean up when loser is archived). But we keep snapshot
+        // so undo restores it.
+        continue;
+      }
+      await tx
+        .update(clientContacts)
+        .set({ clientId: opts.winnerId, isPrimary: false, updatedAt: new Date() })
+        .where(eq(clientContacts.id, c.id));
+      movedContacts += 1;
+    }
+
+    // Addresses: same shape as contacts, but uniqueness is harder to
+    // detect cleanly (free-text street). Just move them all and let the
+    // user dedupe in the UI later.
+    const movedAddresses = (
+      await tx
+        .update(clientAddresses)
+        .set({ clientId: opts.winnerId, isPrimary: false, updatedAt: new Date() })
+        .where(eq(clientAddresses.clientId, opts.loserId))
+        .returning({ id: clientAddresses.id })
+    ).length;
+
+    const movedNotes = (
+      await tx
+        .update(clientNotes)
+        .set({ clientId: opts.winnerId, updatedAt: new Date() })
+        .where(eq(clientNotes.clientId, opts.loserId))
+        .returning({ id: clientNotes.id })
+    ).length;
+
+    // Tags: copy any loser-only tag to the winner; drop overlap.
+    const winnerTags = await tx
+      .select({ tagId: clientTags.tagId })
+      .from(clientTags)
+      .where(eq(clientTags.clientId, opts.winnerId));
+    const winnerTagSet = new Set(winnerTags.map((t) => t.tagId));
+    let movedTags = 0;
+    for (const t of loserTags) {
+      if (!winnerTagSet.has(t.tagId)) {
+        await tx.insert(clientTags).values({ clientId: opts.winnerId, tagId: t.tagId });
+        movedTags += 1;
+      }
+    }
+    await tx.delete(clientTags).where(eq(clientTags.clientId, opts.loserId));
+
+    // Relationships: rewrite each FK side to point at the winner. Keep
+    // both sides regardless — even if A and B both end up as the same
+    // person, the row is preserved for audit; the UI hides self-loops.
+    const movedRelationships =
+      (
+        await tx
+          .update(clientRelationships)
+          .set({ clientAId: opts.winnerId })
+          .where(eq(clientRelationships.clientAId, opts.loserId))
+          .returning({ id: clientRelationships.id })
+      ).length +
+      (
+        await tx
+          .update(clientRelationships)
+          .set({ clientBId: opts.winnerId })
+          .where(eq(clientRelationships.clientBId, opts.loserId))
+          .returning({ id: clientRelationships.id })
+      ).length;
+
+    // ── Archive the loser. Row stays in DB for the undo window;
+    //    `mergedIntoClientId` is the redirect pointer for any stragglers
+    //    (links / direct queries / saved views). ──────────────────────────
+    await tx
+      .update(clients)
+      .set({
+        archivedAt: new Date(),
+        mergedIntoClientId: opts.winnerId,
+        updatedAt: new Date(),
+      })
+      .where(eq(clients.id, opts.loserId));
+
+    // ── Mark any open merge candidate row for this pair as resolved. ───
+    await tx
+      .update(clientMergeCandidates)
+      .set({
+        status: 'merged',
+        resolvedAt: new Date(),
+        resolvedBy: opts.mergedBy,
+      })
+      .where(
+        and(
+          eq(clientMergeCandidates.portId, winnerRow.portId),
+          // pair stored in canonical order — match either direction
+          sql`(
+            (${clientMergeCandidates.clientAId} = ${opts.winnerId}
+             AND ${clientMergeCandidates.clientBId} = ${opts.loserId})
+            OR
+            (${clientMergeCandidates.clientAId} = ${opts.loserId}
+             AND ${clientMergeCandidates.clientBId} = ${opts.winnerId})
+          )`,
+        ),
+      );
+
+    // ── Write the merge log + audit log. ────────────────────────────────
+    const [logRow] = await tx
+      .insert(clientMergeLog)
+      .values({
+        portId: winnerRow.portId,
+        survivingClientId: opts.winnerId,
+        mergedClientId: opts.loserId,
+        mergedBy: opts.mergedBy,
+        mergeDetails: snapshot,
+      })
+      .returning({ id: clientMergeLog.id });
+
+    await tx.insert(auditLogs).values({
+      portId: winnerRow.portId,
+      userId: opts.mergedBy,
+      entityType: 'client',
+      entityId: opts.winnerId,
+      action: 'merge',
+      newValue: {
+        loserId: opts.loserId,
+        loserName: loserRow.fullName,
+        movedInterests,
+        movedReservations,
+        movedContacts,
+        movedAddresses,
+      },
+    });
+
+    return {
+      mergeLogId: logRow!.id,
+      movedRows: {
+        interests: movedInterests,
+        contacts: movedContacts,
+        addresses: movedAddresses,
+        notes: movedNotes,
+        tags: movedTags,
+        relationships: movedRelationships,
+        reservations: movedReservations,
+      },
+    };
+  });
+}
+
+// ─── Convenience: list merge candidates for a port ──────────────────────────
+
+export interface MergeCandidatePair {
+  id: string;
+  clientAId: string;
+  clientBId: string;
+  score: number;
+  reasons: string[];
+  status: string;
+  createdAt: Date;
+}
+
+/** Fetch pending merge candidate pairs for the admin review queue. */
+export async function listPendingMergeCandidates(portId: string): Promise<MergeCandidatePair[]> {
+  const rows = await db
+    .select()
+    .from(clientMergeCandidates)
+    .where(
+      and(eq(clientMergeCandidates.portId, portId), eq(clientMergeCandidates.status, 'pending')),
+    )
+    .orderBy(sql`${clientMergeCandidates.score} DESC`);
+
+  return rows.map((r) => ({
+    id: r.id,
+    clientAId: r.clientAId,
+    clientBId: r.clientBId,
+    score: r.score,
+    reasons: Array.isArray(r.reasons) ? (r.reasons as string[]) : [],
+    status: r.status,
+    createdAt: r.createdAt,
+  }));
+}

tests/integration/dedup/client-merge.test.ts

@@ -0,0 +1,183 @@
+/**
+ * Client merge service — end-to-end integration test.
+ *
+ * Spins up two real clients in a real port via the factory helpers,
+ * attaches a few satellites (interest, contact, address, note),
+ * merges them, and asserts everything survived in the right place
+ * with the merge log written.
+ */
+import { describe, expect, it } from 'vitest';
+import { eq } from 'drizzle-orm';
+
+import { db } from '@/lib/db';
+import { clients, clientContacts, clientNotes, clientMergeLog } from '@/lib/db/schema/clients';
+import { interests } from '@/lib/db/schema/interests';
+import { mergeClients } from '@/lib/services/client-merge.service';
+import { makeClient, makePort, makeBerth } from '../../helpers/factories';
+
+describe('mergeClients', () => {
+  it('moves interests and contacts from loser to winner; archives loser; writes merge log', async () => {
+    const port = await makePort();
+    const winner = await makeClient({
+      portId: port.id,
+      overrides: { fullName: 'Marcus Laurent' },
+    });
+    const loser = await makeClient({
+      portId: port.id,
+      overrides: { fullName: 'Marcus Laurent (dup)' },
+    });
+
+    // Attach contact + interest to loser
+    await db.insert(clientContacts).values({
+      clientId: loser.id,
+      channel: 'email',
+      value: 'marcus@example.com',
+      isPrimary: true,
+    });
+    await db.insert(clientNotes).values({
+      clientId: loser.id,
+      authorId: 'test-user',
+      content: 'Loser-side note',
+    });
+    const berth = await makeBerth({ portId: port.id });
+    await db.insert(interests).values({
+      portId: port.id,
+      clientId: loser.id,
+      berthId: berth.id,
+      pipelineStage: 'open',
+      leadCategory: 'general_interest',
+    });
+
+    // ── Merge ─────────────────────────────────────────────────────────────
+    const result = await mergeClients({
+      winnerId: winner.id,
+      loserId: loser.id,
+      mergedBy: 'test-user',
+    });
+
+    expect(result.movedRows.interests).toBe(1);
+    expect(result.movedRows.contacts).toBe(1);
+    expect(result.movedRows.notes).toBe(1);
+
+    // ── Loser should be archived with mergedIntoClientId set ──────────────
+    const [archivedLoser] = await db.select().from(clients).where(eq(clients.id, loser.id));
+    expect(archivedLoser?.archivedAt).not.toBeNull();
+    expect(archivedLoser?.mergedIntoClientId).toBe(winner.id);
+
+    // ── All loser-side rows now point at the winner ───────────────────────
+    const winnerInterests = await db
+      .select()
+      .from(interests)
+      .where(eq(interests.clientId, winner.id));
+    expect(winnerInterests).toHaveLength(1);
+
+    const winnerContacts = await db
+      .select()
+      .from(clientContacts)
+      .where(eq(clientContacts.clientId, winner.id));
+    expect(winnerContacts.find((c) => c.value === 'marcus@example.com')).toBeDefined();
+
+    const winnerNotes = await db
+      .select()
+      .from(clientNotes)
+      .where(eq(clientNotes.clientId, winner.id));
+    expect(winnerNotes.find((n) => n.content === 'Loser-side note')).toBeDefined();
+
+    // ── Merge log row exists with snapshot ────────────────────────────────
+    const [log] = await db
+      .select()
+      .from(clientMergeLog)
+      .where(eq(clientMergeLog.id, result.mergeLogId));
+    expect(log?.survivingClientId).toBe(winner.id);
+    expect(log?.mergedClientId).toBe(loser.id);
+    expect(log?.mergedBy).toBe('test-user');
+    expect(log?.mergeDetails).toBeDefined();
+  });
+
+  it('refuses to merge a client into itself', async () => {
+    const port = await makePort();
+    const c = await makeClient({ portId: port.id });
+    await expect(mergeClients({ winnerId: c.id, loserId: c.id, mergedBy: 'u' })).rejects.toThrow(
+      /itself/i,
+    );
+  });
+
+  it('refuses to merge across different ports', async () => {
+    const portA = await makePort();
+    const portB = await makePort();
+    const a = await makeClient({ portId: portA.id });
+    const b = await makeClient({ portId: portB.id });
+    await expect(mergeClients({ winnerId: a.id, loserId: b.id, mergedBy: 'u' })).rejects.toThrow(
+      /different ports/i,
+    );
+  });
+
+  it('refuses to merge a client that has already been merged', async () => {
+    const port = await makePort();
+    const winner = await makeClient({ portId: port.id });
+    const loser = await makeClient({ portId: port.id });
+    // First merge succeeds.
+    await mergeClients({ winnerId: winner.id, loserId: loser.id, mergedBy: 'u' });
+    // Second merge of the same loser should refuse.
+    const winner2 = await makeClient({ portId: port.id });
+    await expect(
+      mergeClients({ winnerId: winner2.id, loserId: loser.id, mergedBy: 'u' }),
+    ).rejects.toThrow(/already merged/i);
+  });
+
+  it('drops duplicate contact rows during reattach', async () => {
+    const port = await makePort();
+    const winner = await makeClient({ portId: port.id });
+    const loser = await makeClient({ portId: port.id });
+
+    // Both have the same email contact.
+    await db.insert(clientContacts).values({
+      clientId: winner.id,
+      channel: 'email',
+      value: 'same@example.com',
+      isPrimary: true,
+    });
+    await db.insert(clientContacts).values({
+      clientId: loser.id,
+      channel: 'email',
+      value: 'same@example.com',
+      isPrimary: true,
+    });
+
+    const result = await mergeClients({
+      winnerId: winner.id,
+      loserId: loser.id,
+      mergedBy: 'u',
+    });
+
+    expect(result.movedRows.contacts).toBe(0); // duplicate dropped
+    const winnerEmails = await db
+      .select()
+      .from(clientContacts)
+      .where(eq(clientContacts.clientId, winner.id));
+    // Winner kept exactly one copy of the shared email.
+    expect(winnerEmails.filter((c) => c.value === 'same@example.com')).toHaveLength(1);
+  });
+
+  it('applies fieldChoices to copy loser values onto the winner', async () => {
+    const port = await makePort();
+    const winner = await makeClient({
+      portId: port.id,
+      overrides: { fullName: 'Marcus L.' },
+    });
+    const loser = await makeClient({
+      portId: port.id,
+      overrides: { fullName: 'Marcus Laurent' },
+    });
+
+    await mergeClients({
+      winnerId: winner.id,
+      loserId: loser.id,
+      mergedBy: 'u',
+      fieldChoices: { fullName: 'loser' },
+    });
+
+    const [updatedWinner] = await db.select().from(clients).where(eq(clients.id, winner.id));
+    expect(updatedWinner?.fullName).toBe('Marcus Laurent');
+  });
+});

tests/integration/dedup/match-candidates-api.test.ts

@@ -0,0 +1,157 @@
+/**
+ * Match-candidates API — integration test.
+ *
+ * Exercises the GET /api/v1/clients/match-candidates handler against a
+ * real port + clients pool. Verifies the dedup library's at-create
+ * suggestion path returns the right candidates and confidence tiers
+ * for the "use existing client?" form interruption.
+ */
+import { describe, expect, it } from 'vitest';
+
+import { db } from '@/lib/db';
+import { clientContacts } from '@/lib/db/schema/clients';
+import { getMatchCandidatesHandler } from '@/app/api/v1/clients/match-candidates/handlers';
+import { makeMockCtx, makeMockRequest } from '../../helpers/route-tester';
+import { makeClient, makePort } from '../../helpers/factories';
+
+interface MatchData {
+  clientId: string;
+  fullName: string;
+  score: number;
+  confidence: 'high' | 'medium' | 'low';
+  reasons: string[];
+  interestCount: number;
+}
+
+async function callHandler(
+  ctx: ReturnType<typeof makeMockCtx>,
+  query: Record<string, string>,
+): Promise<MatchData[]> {
+  const url = new URL('http://localhost/api/v1/clients/match-candidates');
+  for (const [k, v] of Object.entries(query)) url.searchParams.set(k, v);
+  const req = makeMockRequest('GET', url.toString());
+  const res = await getMatchCandidatesHandler(req, ctx);
+  expect(res.status).toBe(200);
+  const body = await res.json();
+  return body.data as MatchData[];
+}
+
+describe('GET /api/v1/clients/match-candidates', () => {
+  it('returns empty when nothing actionable was provided', async () => {
+    const port = await makePort();
+    const ctx = makeMockCtx({ portId: port.id });
+    const data = await callHandler(ctx, {});
+    expect(data).toEqual([]);
+  });
+
+  it('finds an existing client by exact email match (high confidence)', async () => {
+    const port = await makePort();
+    const ctx = makeMockCtx({ portId: port.id });
+    const existing = await makeClient({
+      portId: port.id,
+      overrides: { fullName: 'Marcus Laurent' },
+    });
+    await db.insert(clientContacts).values({
+      clientId: existing.id,
+      channel: 'email',
+      value: 'marcus@example.com',
+      isPrimary: true,
+    });
+    await db.insert(clientContacts).values({
+      clientId: existing.id,
+      channel: 'phone',
+      value: '+15551234567',
+      valueE164: '+15551234567',
+      isPrimary: true,
+    });
+
+    const data = await callHandler(ctx, {
+      email: 'Marcus@example.com',
+      phone: '+15551234567',
+      name: 'Marcus Laurent',
+    });
+
+    expect(data).toHaveLength(1);
+    expect(data[0]!.clientId).toBe(existing.id);
+    expect(data[0]!.confidence).toBe('high');
+    expect(data[0]!.reasons).toEqual(expect.arrayContaining(['email match', 'phone match']));
+  });
+
+  it('does not surface unrelated clients in the same port', async () => {
+    const port = await makePort();
+    const ctx = makeMockCtx({ portId: port.id });
+    const target = await makeClient({
+      portId: port.id,
+      overrides: { fullName: 'Marcus Laurent' },
+    });
+    await db.insert(clientContacts).values({
+      clientId: target.id,
+      channel: 'email',
+      value: 'marcus@example.com',
+      isPrimary: true,
+    });
+    // An unrelated client.
+    const unrelated = await makeClient({
+      portId: port.id,
+      overrides: { fullName: 'Bob Smith' },
+    });
+    await db.insert(clientContacts).values({
+      clientId: unrelated.id,
+      channel: 'email',
+      value: 'bob@example.org',
+      isPrimary: true,
+    });
+
+    const data = await callHandler(ctx, { email: 'marcus@example.com' });
+    expect(data.map((d) => d.clientId)).toEqual([target.id]);
+  });
+
+  it('returns medium-confidence partial matches', async () => {
+    // Same name, different contact info — Pattern F territory.
+    const port = await makePort();
+    const ctx = makeMockCtx({ portId: port.id });
+    const existing = await makeClient({
+      portId: port.id,
+      overrides: { fullName: 'Etiennette Clamouze' },
+    });
+    await db.insert(clientContacts).values({
+      clientId: existing.id,
+      channel: 'email',
+      value: 'clamouze.etiennette@gmail.com',
+      isPrimary: true,
+    });
+
+    const data = await callHandler(ctx, {
+      // Different email + phone, same name.
+      email: 'etiennette@the-manoah.com',
+      name: 'Etiennette Clamouze',
+    });
+
+    // Either no match (low confidence filtered out) or a medium one —
+    // either is fine. Critically, NOT high.
+    if (data.length > 0) {
+      expect(data[0]!.confidence).not.toBe('high');
+    }
+  });
+
+  it('does not leak across ports', async () => {
+    const portA = await makePort();
+    const portB = await makePort();
+
+    const ctxA = makeMockCtx({ portId: portA.id });
+    const inB = await makeClient({
+      portId: portB.id,
+      overrides: { fullName: 'In Port B' },
+    });
+    await db.insert(clientContacts).values({
+      clientId: inB.id,
+      channel: 'email',
+      value: 'b@example.com',
+      isPrimary: true,
+    });
+
+    // Caller is in port A, asking for an email that lives in port B.
+    const data = await callHandler(ctxA, { email: 'b@example.com' });
+    expect(data).toEqual([]);
+  });
+});