diff --git a/nextjs_space/app/actions/kyc-check.ts b/nextjs_space/app/actions/kyc-check.ts
index 83fdf231..84c24c15 100644
--- a/nextjs_space/app/actions/kyc-check.ts
+++ b/nextjs_space/app/actions/kyc-check.ts
@@ -4,6 +4,7 @@ import { getCurrentUser } from "@/lib/auth-helper";
 import { prisma } from "@/lib/db";
 import { getTenantDrGreenConfig } from "@/lib/tenant/tenant-config";
 import { fetchClient, fetchClientByEmail } from "@/lib/drgreen/doctor-green-api";
+import { canonicalAdminApproval } from "@/lib/drgreen/approval-status";
 import { logger } from "@/lib/logger";
 
 export type KycStatus = {
@@ -181,6 +182,12 @@ export async function checkUserKycStatus(): Promise<KycStatus> {
             // consultation still lives under the original tenant), migrate the
             // row to the current tenant so the mirror actually writes.
             {
+                // Mirror Dr Green's adminApproval verbatim (canonicalised to
+                // the VERIFIED|PENDING|REJECTED enum — the legacy "APPROVED"
+                // literal this block used to write is what let the products
+                // gate and the dashboard disagree). Unknown values leave the
+                // stored field untouched.
+                const mirroredApproval = canonicalAdminApproval(client.adminApproval);
                 const current = await prisma.consultation_questionnaires.updateMany({
                     where: {
                         tenantId: dbUser.tenantId,
@@ -188,7 +195,7 @@ export async function checkUserKycStatus(): Promise<KycStatus> {
                     },
                     data: {
                         isKycVerified: isVerified,
-                        ...(isVerified ? { adminApproval: "APPROVED" } : {}),
+                        ...(mirroredApproval ? { adminApproval: mirroredApproval } : {}),
                         updatedAt: new Date(),
                     },
                 });
@@ -211,7 +218,7 @@ export async function checkUserKycStatus(): Promise<KycStatus> {
                                 // on this path would re-create the latch for
                                 // any user whose row lives under another tenant.
                                 isKycVerified: isVerified,
-                                ...(isVerified ? { adminApproval: "APPROVED" } : {}),
+                                ...(mirroredApproval ? { adminApproval: mirroredApproval } : {}),
                                 updatedAt: new Date(),
                             },
                         });
diff --git a/nextjs_space/app/api/consultation/status/route.ts b/nextjs_space/app/api/consultation/status/route.ts
index 7ac17d71..54fbd069 100644
--- a/nextjs_space/app/api/consultation/status/route.ts
+++ b/nextjs_space/app/api/consultation/status/route.ts
@@ -2,6 +2,7 @@ import { NextResponse } from "next/server";
 import { withAuth } from "@/lib/api-auth";
 import { prisma } from "@/lib/db";
 import { getTenantFromRequest } from "@/lib/tenant/tenant";
+import { ADMIN_APPROVAL, canonicalAdminApproval } from "@/lib/drgreen/approval-status";
 import { apiError } from "@/lib/api-error";
 
 export const GET = withAuth(async (req, { user }) => {
@@ -53,7 +54,10 @@ export const GET = withAuth(async (req, { user }) => {
       drGreenClientId: consultation.drGreenClientId,
       kycLink: consultation.kycLink,
       isKycVerified: consultation.isKycVerified,
-      adminApproval: consultation.adminApproval,
+      // Canonicalised so consumers comparing to "VERIFIED" (the products-page
+      // gate) also accept rows stored with the legacy "APPROVED" literal.
+      adminApproval:
+        canonicalAdminApproval(consultation.adminApproval) ?? ADMIN_APPROVAL.PENDING,
     });
   } catch (error: any) {
     console.error("Error fetching consultation status:", error);
diff --git a/nextjs_space/app/api/shop/register/route.ts b/nextjs_space/app/api/shop/register/route.ts
index ee5ef65b..253dfa79 100644
--- a/nextjs_space/app/api/shop/register/route.ts
+++ b/nextjs_space/app/api/shop/register/route.ts
@@ -143,19 +143,33 @@ export const POST = withAuth(async (req, { user }) => {
       config,
     );
 
-    // Update user with additional info
-    await prisma.users.update({
-      where: { id: dbUser.id },
-      data: {
-        name: `${personal.firstName} ${personal.lastName}`,
-        firstName: personal.firstName,
-        lastName: personal.lastName,
-        // Phone was collected + validated above but previously only sent to
-        // Dr Green — persist it locally so Customers detail/export show it.
-        phone: `${phoneCode} ${contactNumber}`.trim(),
-        updatedAt: new Date(),
-      },
-    });
+    // Update user with additional info. The Dr Green client already exists at
+    // this point — a local persistence failure must NOT fail the registration
+    // (log and continue; the status-refresh sweep self-heals the client id).
+    try {
+      await prisma.users.update({
+        where: { id: dbUser.id },
+        data: {
+          name: `${personal.firstName} ${personal.lastName}`,
+          firstName: personal.firstName,
+          lastName: personal.lastName,
+          // Phone was collected + validated above but previously only sent to
+          // Dr Green — persist it locally so Customers detail/export show it.
+          phone: `${phoneCode} ${contactNumber}`.trim(),
+          // The Dr Green client id was previously returned to the browser but
+          // never persisted, leaving these customers unreachable by webhooks
+          // and status sync — permanently "pending" on every admin surface.
+          ...(result.clientId ? { drGreenClientId: result.clientId } : {}),
+          ...(tenant?.id && !dbUser.tenantId ? { tenantId: tenant.id } : {}),
+          updatedAt: new Date(),
+        },
+      });
+    } catch (persistError) {
+      console.error(
+        "[shop/register] Dr Green client created but local persistence failed",
+        persistError instanceof Error ? persistError.message : persistError,
+      );
+    }
 
     return NextResponse.json({
       success: true,
diff --git a/nextjs_space/app/api/tenant-admin/customers/[id]/route.ts b/nextjs_space/app/api/tenant-admin/customers/[id]/route.ts
index b2524854..a6503ed0 100644
--- a/nextjs_space/app/api/tenant-admin/customers/[id]/route.ts
+++ b/nextjs_space/app/api/tenant-admin/customers/[id]/route.ts
@@ -5,6 +5,7 @@ import { clerkClient } from "@clerk/nextjs/server";
 import { prisma } from "@/lib/db";
 import { getTenantDrGreenConfig } from "@/lib/tenant/tenant-config";
 import { fetchClientByEmail, updateClient } from "@/lib/drgreen/doctor-green-api";
+import { ADMIN_APPROVAL } from "@/lib/drgreen/approval-status";
 import { createAuditLog, AUDIT_ACTIONS, getClientInfo } from "@/lib/audit-log";
 import { eraseUser } from "@/lib/gdpr/erasure";
 import { apiError, apiValidationError } from "@/lib/api-error";
@@ -380,7 +381,10 @@ export const PATCH = withAuth(async (request, { user }, params) => {
         },
         data: {
           isKycVerified: true,
-          adminApproval: "APPROVED",
+          // Dr Green's enum value — the legacy "APPROVED" literal here made
+          // the products-page gate (which only accepts VERIFIED) disagree
+          // with every other surface. See lib/drgreen/approval-status.ts.
+          adminApproval: ADMIN_APPROVAL.VERIFIED,
           updatedAt: new Date(),
         },
       });
diff --git a/nextjs_space/app/tenant-admin/customers/[id]/page.tsx b/nextjs_space/app/tenant-admin/customers/[id]/page.tsx
index ff39f6f5..b5486349 100644
--- a/nextjs_space/app/tenant-admin/customers/[id]/page.tsx
+++ b/nextjs_space/app/tenant-admin/customers/[id]/page.tsx
@@ -1,12 +1,17 @@
 import { currentUser } from "@clerk/nextjs/server";
 import { redirect, notFound } from "next/navigation";
+import { format } from "date-fns";
 import { prisma } from "@/lib/db";
 import { getActiveAdminTenant } from "@/lib/tenant/active-admin-tenant";
+import {
+  deriveVerificationStatus,
+  VERIFICATION_STATUS_DISPLAY,
+} from "@/lib/drgreen/approval-status";
 import CustomerEditForm from "./customer-edit-form";
 import CustomerActions from "./customer-actions";
 import CustomerTags from "./customer-tags";
 import MarketingConsentCard from "./marketing-consent-card";
-import { Breadcrumbs } from "@/components/admin/shared";
+import { Breadcrumbs, RowPill } from "@/components/admin/shared";
 
 export default async function CustomerDetailPage({
   params,
@@ -62,27 +67,39 @@ export default async function CustomerDetailPage({
     notFound();
   }
 
-  // Existing customers created via the ID-upload/consultation intake had their
-  // name saved only to users.name and phone only on the questionnaire (the
-  // granular users.firstName/lastName/phone were left null). Backfill for
-  // display so the form doesn't show "Not set" for data actually provided.
-  const needsBackfill = !(customer.firstName && customer.lastName && customer.phone);
-  const questionnaire =
-    needsBackfill && customer.email
-      ? await prisma.consultation_questionnaires.findFirst({
-          where: {
-            email: customer.email,
-            ...(customer.tenantId && { tenantId: customer.tenantId }),
-          },
-          orderBy: { createdAt: "desc" },
-          select: {
-            firstName: true,
-            lastName: true,
-            phoneCode: true,
-            phoneNumber: true,
-          },
-        })
-      : null;
+  // Always loaded now: the name/phone backfill for the edit form (existing
+  // customers created via the ID-upload/consultation intake saved name/phone
+  // only on the questionnaire) PLUS the Dr Green approval mirror for the
+  // Verification card below. Last-known state — no Dr Green API call here.
+  const questionnaire = customer.email
+    ? await prisma.consultation_questionnaires.findFirst({
+        where: {
+          email: { equals: customer.email, mode: "insensitive" },
+          ...(customer.tenantId && { tenantId: customer.tenantId }),
+        },
+        orderBy: { createdAt: "desc" },
+        select: {
+          firstName: true,
+          lastName: true,
+          phoneCode: true,
+          phoneNumber: true,
+          isKycVerified: true,
+          adminApproval: true,
+          idDocumentStatus: true,
+          kycLink: true,
+          drGreenClientId: true,
+          updatedAt: true,
+        },
+      })
+    : null;
+
+  const verificationStatus = deriveVerificationStatus({
+    hasQuestionnaire: !!questionnaire,
+    isKycVerified: questionnaire?.isKycVerified,
+    adminApproval: questionnaire?.adminApproval,
+    idDocumentStatus: questionnaire?.idDocumentStatus,
+  });
+  const verificationDisplay = VERIFICATION_STATUS_DISPLAY[verificationStatus];
   // US-024: the customer's tag chips. Tag rows always carry the tenant they
   // were created under; the extra tenant predicate keeps a super-admin's
   // cross-tenant view scoped to the row's own tenant.
@@ -171,6 +188,75 @@ export default async function CustomerDetailPage({
         </div>
 
         <div className="space-y-6">
+          <section className="bs-card bs-card-pad">
+            <div className="bs-card-head mb-4 flex items-center justify-between">
+              <h2
+                className="text-[22px] text-bs-fg"
+                style={{ fontFamily: "var(--bs-font-display, 'Cormorant Garamond', serif)" }}
+              >
+                Verification
+              </h2>
+              <RowPill tone={verificationDisplay.tone}>
+                {verificationDisplay.label}
+              </RowPill>
+            </div>
+            <dl className="space-y-2 text-sm">
+              {questionnaire?.idDocumentStatus && (
+                <div className="flex items-center justify-between gap-2">
+                  <dt className="text-bs-fg-muted">ID document</dt>
+                  <dd className="font-mono text-bs-fg">
+                    {questionnaire.idDocumentStatus === "UPLOAD_FAILED"
+                      ? "Upload failed"
+                      : "Uploaded"}
+                  </dd>
+                </div>
+              )}
+              {questionnaire?.drGreenClientId && (
+                <div className="flex items-center justify-between gap-2">
+                  <dt className="text-bs-fg-muted">Dr Green client</dt>
+                  <dd
+                    className="font-mono text-xs text-bs-fg truncate max-w-[160px]"
+                    title={questionnaire.drGreenClientId}
+                  >
+                    {questionnaire.drGreenClientId}
+                  </dd>
+                </div>
+              )}
+              {questionnaire && (
+                <div className="flex items-center justify-between gap-2">
+                  <dt className="text-bs-fg-muted">Last synced</dt>
+                  <dd className="font-mono text-bs-fg">
+                    {format(questionnaire.updatedAt, "MMM d, yyyy HH:mm")}
+                  </dd>
+                </div>
+              )}
+            </dl>
+            {questionnaire &&
+              !questionnaire.isKycVerified &&
+              questionnaire.kycLink &&
+              verificationStatus !== "VERIFIED" && (
+                <a
+                  href={questionnaire.kycLink}
+                  target="_blank"
+                  rel="noopener noreferrer"
+                  className="bs-btn bs-btn-ghost bs-btn-sm mt-4 w-full"
+                >
+                  Open customer&apos;s KYC link
+                </a>
+              )}
+            {!questionnaire && (
+              <p className="text-sm text-bs-fg-muted">
+                This customer has not submitted a consultation, so they have no
+                Dr Green verification record yet.
+              </p>
+            )}
+            <p className="mt-3 text-[11px] text-bs-fg-muted">
+              Last-known status from Dr Green — approvals happen in the Dr Green
+              admin. Use &quot;Refresh from Dr Green&quot; on the Customers list
+              to sync.
+            </p>
+          </section>
+
           <section className="bs-card bs-card-pad">
             <div className="bs-card-head mb-4">
               <h2
diff --git a/nextjs_space/app/tenant-admin/customers/customers-table.tsx b/nextjs_space/app/tenant-admin/customers/customers-table.tsx
index 22cdfd37..5a029ae2 100644
--- a/nextjs_space/app/tenant-admin/customers/customers-table.tsx
+++ b/nextjs_space/app/tenant-admin/customers/customers-table.tsx
@@ -1,9 +1,10 @@
 "use client";
 
-import { useMemo } from "react";
+import { useMemo, useTransition } from "react";
 import Link from "next/link";
-import { format } from "date-fns";
-import { Users, Search, Phone, ShoppingBag, Share2, Eye } from "lucide-react";
+import { useRouter } from "next/navigation";
+import { format, formatDistanceToNow } from "date-fns";
+import { Users, Search, Phone, ShoppingBag, Share2, Eye, RefreshCw } from "lucide-react";
 import {
   SearchInput,
   EmptyState,
@@ -16,6 +17,11 @@ import {
 import { useTableState } from "@/lib/admin/url-state";
 import { exportToCSV } from "@/lib/admin/csv-export";
 import { normalizeTag } from "@/lib/customers/tag-format";
+import {
+  VERIFICATION_STATUS_DISPLAY,
+  type CustomerVerificationStatus,
+} from "@/lib/drgreen/approval-status";
+import { refreshCustomerStatuses } from "./refresh-status-action";
 import { toast } from "@/components/ui/sonner";
 import { useCallback } from "react";
 
@@ -28,9 +34,9 @@ export interface Customer {
   _count: {
     orders: number;
   };
-  // PRD-220 Part B: inline ID-document upload failed during registration —
-  // the customer is stuck unverified until they (or we) re-upload.
-  idUploadFailed?: boolean;
+  /** Dr Green approval mirror, derived server-side (last-known, not live).
+   *  Subsumes the former idUploadFailed flag (ID_UPLOAD_FAILED status). */
+  verificationStatus?: CustomerVerificationStatus;
 }
 
 interface CustomersTableProps {
@@ -38,6 +44,17 @@ interface CustomersTableProps {
   totalCount: number;
   /** US-024: every tag in use across the tenant — the tag filter's options. */
   availableTags?: string[];
+  /** Tenant-wide approval breakdown (unfiltered, matches the stat cards). */
+  statusCounts?: Record<CustomerVerificationStatus, number>;
+  /** Last "Refresh from Dr Green" run (ISO), or null if never refreshed. */
+  lastSyncedAt?: string | null;
+  /** False for a cross-tenant super-admin view — nothing to refresh. */
+  canRefresh?: boolean;
+}
+
+function StatusPill({ status }: { status: CustomerVerificationStatus }) {
+  const display = VERIFICATION_STATUS_DISPLAY[status];
+  return <RowPill tone={display.tone}>{display.label}</RowPill>;
 }
 
 /** Filter shape for useTableState — `tag` rides the URL as ?tag=<value>. */
@@ -50,7 +67,29 @@ export function CustomersTable({
   customers,
   totalCount,
   availableTags = [],
+  statusCounts,
+  lastSyncedAt,
+  canRefresh = false,
 }: CustomersTableProps) {
+  const router = useRouter();
+  const [isRefreshing, startRefresh] = useTransition();
+
+  const handleRefreshStatuses = () => {
+    startRefresh(async () => {
+      const result = await refreshCustomerStatuses();
+      if (result.ok) {
+        toast.success(
+          result.updated
+            ? `Statuses refreshed — ${result.updated} customer${result.updated === 1 ? "" : "s"} updated.`
+            : "Statuses refreshed — everything already up to date.",
+        );
+        router.refresh();
+      } else {
+        toast.error(result.error || "Refresh failed. Try again shortly.");
+      }
+    });
+  };
+
   const [
     { search, filters, page, pageSize, sort },
     { setSearch, setFilter, setPage, setPageSize, setSort, resetFilters },
@@ -111,6 +150,9 @@ export function CustomersTable({
       name: c.name || "N/A",
       email: c.email,
       phone: c.phone || "N/A",
+      status: c.verificationStatus
+        ? VERIFICATION_STATUS_DISPLAY[c.verificationStatus].label
+        : "N/A",
       orders: c._count.orders,
       createdAt: format(new Date(c.createdAt), "yyyy-MM-dd"),
     }));
@@ -119,6 +161,7 @@ export function CustomersTable({
       { key: "name" as const, label: "Name" },
       { key: "email" as const, label: "Email" },
       { key: "phone" as const, label: "Phone" },
+      { key: "status" as const, label: "Status" },
       { key: "orders" as const, label: "Orders" },
       { key: "createdAt" as const, label: "Joined" },
     ];
@@ -192,6 +235,42 @@ export function CustomersTable({
             />
           </div>
         </div>
+
+        {/* Approval-status summary + refresh. Counts are tenant-wide (they
+            ignore search/tag filters, like the stat cards above). */}
+        {statusCounts && (
+          <div className="mt-4 flex flex-col gap-2 sm:flex-row sm:items-center sm:justify-between">
+            <div className="flex flex-wrap items-center gap-2">
+              <RowPill tone="emerald">{statusCounts.VERIFIED} verified</RowPill>
+              <RowPill tone="amber">{statusCounts.PENDING} pending</RowPill>
+              <RowPill tone="red">
+                {statusCounts.REJECTED + statusCounts.ID_UPLOAD_FAILED} rejected / failed
+              </RowPill>
+              <RowPill tone="slate">{statusCounts.NOT_SUBMITTED} not submitted</RowPill>
+            </div>
+            {canRefresh && (
+              <div className="flex items-center gap-3">
+                <span className="text-xs text-bs-fg-muted">
+                  {lastSyncedAt
+                    ? `Synced ${formatDistanceToNow(new Date(lastSyncedAt), { addSuffix: true })}`
+                    : "Showing last-known statuses"}
+                </span>
+                <button
+                  type="button"
+                  onClick={handleRefreshStatuses}
+                  disabled={isRefreshing}
+                  className="bs-btn bs-btn-ghost bs-btn-sm gap-1.5 disabled:opacity-50"
+                >
+                  <RefreshCw
+                    className={`h-3.5 w-3.5 ${isRefreshing ? "animate-spin" : ""}`}
+                    aria-hidden="true"
+                  />
+                  {isRefreshing ? "Refreshing..." : "Refresh from Dr Green"}
+                </button>
+              </div>
+            )}
+          </div>
+        )}
       </div>
 
       <div>
@@ -244,6 +323,7 @@ export function CustomersTable({
                     onSort={setSort}
                     className="hidden md:table-cell"
                   />
+                  <th className="text-left hidden sm:table-cell">Status</th>
                   <th className="text-center hidden sm:table-cell">
                     <span className="flex items-center justify-center gap-1.5">
                       <ShoppingBag className="h-3.5 w-3.5 text-bs-fg-muted" aria-hidden="true" />
@@ -275,10 +355,12 @@ export function CustomersTable({
                           <p className="font-medium text-bs-fg truncate">
                             {customer.name || "N/A"}
                           </p>
-                          {customer.idUploadFailed && (
-                            <RowPill tone="red" className="mt-0.5">
-                              ID upload failed
-                            </RowPill>
+                          {/* Small screens: the Status column is hidden, so the
+                              pill rides under the name instead. */}
+                          {customer.verificationStatus && (
+                            <span className="sm:hidden mt-0.5 inline-block">
+                              <StatusPill status={customer.verificationStatus} />
+                            </span>
                           )}
                           <a
                             href={`mailto:${customer.email}`}
@@ -303,6 +385,13 @@ export function CustomersTable({
                         {customer.email}
                       </a>
                     </td>
+                    <td className="hidden sm:table-cell">
+                      {customer.verificationStatus ? (
+                        <StatusPill status={customer.verificationStatus} />
+                      ) : (
+                        <span className="text-xs text-bs-fg-muted">—</span>
+                      )}
+                    </td>
                     <td className="text-center hidden sm:table-cell">
                       <RowPill tone="gold">{customer._count.orders}</RowPill>
                     </td>
diff --git a/nextjs_space/app/tenant-admin/customers/page.tsx b/nextjs_space/app/tenant-admin/customers/page.tsx
index 201d6d3a..96d07ade 100644
--- a/nextjs_space/app/tenant-admin/customers/page.tsx
+++ b/nextjs_space/app/tenant-admin/customers/page.tsx
@@ -2,12 +2,18 @@ import { currentUser } from "@clerk/nextjs/server";
 import { redirect } from "next/navigation";
 import { prisma } from "@/lib/db";
 import { requirePagePermission } from "@/lib/permissions/require-page-permission";
+import { can } from "@/lib/permissions/resolve";
 import { getActiveAdminTenant } from "@/lib/tenant/active-admin-tenant";
 import { Prisma } from "@prisma/client";
 import { listTenantTags } from "@/lib/customers/customer-tags";
 import { tagSchema } from "@/lib/customers/tag-format";
 import { ERASURE_EMAIL_DOMAIN } from "@/lib/gdpr/erasure";
-import { Users, UserCheck, UserPlus } from "lucide-react";
+import {
+  deriveVerificationStatus,
+  type CustomerVerificationStatus,
+} from "@/lib/drgreen/approval-status";
+import { AUDIT_ACTIONS } from "@/lib/audit-log";
+import { Users, UserPlus, ShieldCheck } from "lucide-react";
 import { StatCard } from "@/components/admin/shared";
 import { CustomersTable } from "./customers-table";
 
@@ -26,7 +32,7 @@ interface CustomersPageProps {
 export default async function CustomersListPage({
   searchParams,
 }: CustomersPageProps) {
-  await requirePagePermission("canViewCustomers");
+  const permissionCtx = await requirePagePermission("canViewCustomers");
   const user = await currentUser();
 
   if (
@@ -143,7 +149,7 @@ export default async function CustomersListPage({
   const thirtyDaysAgo = new Date();
   thirtyDaysAgo.setDate(thirtyDaysAgo.getDate() - 30);
 
-  const [filteredCount, rawCustomers, totalCustomersCount, recentSignupsCount, tenantQuestionnaires, availableTags] =
+  const [filteredCount, rawCustomers, totalCustomersCount, recentSignupsCount, tenantQuestionnaires, availableTags, allCustomerEmails, lastStatusRefresh] =
     await Promise.all([
       prisma.users.count({ where: whereClause }),
       prisma.users.findMany({
@@ -192,6 +198,11 @@ export default async function CustomersListPage({
         select: {
           email: true,
           idDocumentStatus: true,
+          // Approval mirror — synced by webhooks, the customer's own status
+          // checks, and the "Refresh from Dr Green" action. Last-known, not
+          // live: rendering the list makes zero Dr Green calls.
+          isKycVerified: true,
+          adminApproval: true,
           firstName: true,
           lastName: true,
           phoneCode: true,
@@ -200,38 +211,57 @@ export default async function CustomersListPage({
       }),
       // US-024: every tag in use across this tenant — the filter's options.
       listTenantTags(tenantId),
+      // Every (non-erased) customer's email — joined to the questionnaire map
+      // for tenant-wide status counts. Emails only; a few KB even at scale.
+      prisma.users.findMany({
+        where: {
+          role: "PATIENT",
+          ...(tenantId && { tenantId }),
+          ...notErased,
+        },
+        select: { email: true },
+      }),
+      // Last "Refresh from Dr Green" — the audit row doubles as the
+      // last-synced marker (no schema change; migrations here are hand-run).
+      tenantId
+        ? prisma.audit_logs.findFirst({
+            where: { action: AUDIT_ACTIONS.CUSTOMER_STATUS_REFRESHED, tenantId },
+            orderBy: { createdAt: "desc" },
+            select: { createdAt: true },
+          })
+        : Promise.resolve(null),
     ]);
 
-  const failedIdUploadEmails = new Set(
-    tenantQuestionnaires
-      .filter(
-        (q: { idDocumentStatus: string | null }) =>
-          q.idDocumentStatus === "UPLOAD_FAILED",
-      )
-      .map((q: { email: string }) => q.email.toLowerCase()),
-  );
   // Backfill name/phone for customers whose intake saved the name only to
   // users.name and the phone only on the questionnaire (granular users columns
   // were left null). Latest questionnaire per email wins (rows ordered desc).
-  const questionnaireByEmail = new Map<
-    string,
-    {
-      firstName: string | null;
-      lastName: string | null;
-      phoneCode: string | null;
-      phoneNumber: string | null;
-    }
-  >();
-  for (const q of tenantQuestionnaires as Array<{
-    email: string;
+  type QuestionnaireSummary = {
     firstName: string | null;
     lastName: string | null;
     phoneCode: string | null;
     phoneNumber: string | null;
-  }>) {
+    isKycVerified: boolean;
+    adminApproval: string | null;
+    idDocumentStatus: string | null;
+  };
+  const questionnaireByEmail = new Map<string, QuestionnaireSummary>();
+  for (const q of tenantQuestionnaires as Array<
+    QuestionnaireSummary & { email: string }
+  >) {
     const key = q.email.toLowerCase();
     if (!questionnaireByEmail.has(key)) questionnaireByEmail.set(key, q);
   }
+
+  const statusForEmail = (email: string): CustomerVerificationStatus => {
+    const q = questionnaireByEmail.get(email.toLowerCase());
+    return deriveVerificationStatus({
+      hasQuestionnaire: !!q,
+      isKycVerified: q?.isKycVerified,
+      adminApproval: q?.adminApproval,
+      idDocumentStatus: q?.idDocumentStatus,
+    });
+  };
+
   const customers = rawCustomers.map(
     (customer: { email: string; name: string | null; phone: string | null }) => {
       const q = questionnaireByEmail.get(customer.email.toLowerCase());
@@ -243,11 +273,24 @@ export default async function CustomersListPage({
         phone:
           customer.phone ??
           (q?.phoneNumber ? `${q.phoneCode ?? ""} ${q.phoneNumber}`.trim() : null),
-        idUploadFailed: failedIdUploadEmails.has(customer.email.toLowerCase()),
+        verificationStatus: statusForEmail(customer.email),
       };
     },
   );
 
+  // Tenant-wide approval breakdown (ignores search/tag filters, matching the
+  // other stat cards) — derived from data already in memory, zero extra cost.
+  const statusCounts: Record<CustomerVerificationStatus, number> = {
+    VERIFIED: 0,
+    PENDING: 0,
+    REJECTED: 0,
+    ID_UPLOAD_FAILED: 0,
+    NOT_SUBMITTED: 0,
+  };
+  for (const { email } of allCustomerEmails as Array<{ email: string }>) {
+    statusCounts[statusForEmail(email)]++;
+  }
+
   return (
     <div className="space-y-8">
       <header className="bs-page-header-centered">
@@ -270,10 +313,10 @@ export default async function CustomersListPage({
           hint="Registered users"
         />
         <StatCard
-          label="Active Customers"
-          value={totalCustomersCount}
-          icon={UserCheck}
-          hint="Currently active"
+          label="Verified"
+          value={statusCounts.VERIFIED}
+          icon={ShieldCheck}
+          hint="Approved by Dr Green"
         />
         <StatCard
           label="Recent Sign-ups"
@@ -287,6 +330,13 @@ export default async function CustomersListPage({
         customers={customers}
         totalCount={filteredCount}
         availableTags={availableTags}
+        statusCounts={statusCounts}
+        lastSyncedAt={lastStatusRefresh?.createdAt.toISOString() ?? null}
+        canRefresh={
+          // Refresh WRITES the mirror — needs the edit grant, matching the
+          // server action's own gate (view-only presets hide the button).
+          Boolean(tenantId) && can(permissionCtx.permissions, "canEditCustomers")
+        }
       />
     </div>
   );
diff --git a/nextjs_space/app/tenant-admin/customers/refresh-status-action.ts b/nextjs_space/app/tenant-admin/customers/refresh-status-action.ts
new file mode 100644
index 00000000..50991b8e
--- /dev/null
+++ b/nextjs_space/app/tenant-admin/customers/refresh-status-action.ts
@@ -0,0 +1,197 @@
+"use server";
+
+import { currentUser } from "@clerk/nextjs/server";
+import { prisma } from "@/lib/db";
+import { requirePagePermission } from "@/lib/permissions/require-page-permission";
+import { getActiveAdminTenant } from "@/lib/tenant/active-admin-tenant";
+import { getTenantDrGreenConfig } from "@/lib/tenant/tenant-config";
+import {
+  sweepClientStatuses,
+  planStatusUpdates,
+} from "@/lib/drgreen/client-status-sweep";
+import { createAuditLog, AUDIT_ACTIONS } from "@/lib/audit-log";
+import { logger } from "@/lib/logger";
+
+/** Minimum interval between refreshes per tenant. */
+const REFRESH_THROTTLE_MS = 60_000;
+
+export interface RefreshStatusResult {
+  ok: boolean;
+  /** Safe, user-facing message on failure. */
+  error?: string;
+  updated?: number;
+  swept?: number;
+  syncedAt?: string;
+}
+
+/**
+ * "Refresh from Dr Green" — bulk-sync the tenant's customer approval mirror.
+ *
+ * One paginated sweep of GET /dapp/clients (Dr Green scopes rows to the
+ * tenant's partner key), diffed against consultation_questionnaires, writing
+ * only changed rows. The audit-log row doubles as the last-synced marker and
+ * the throttle, so no schema change is needed (this repo's migrations are
+ * hand-applied SQL — a deploy must never depend on one).
+ */
+export async function refreshCustomerStatuses(): Promise<RefreshStatusResult> {
+  // Stricter than the page's view gate: this action WRITES the KYC/approval
+  // mirror for every customer, and the customer_support/manager presets hold
+  // canViewCustomers as an explicitly read-only grant. Redirects (throws)
+  // when unauthenticated or denied — the button is permission-hidden too.
+  await requirePagePermission("canEditCustomers");
+  const user = await currentUser();
+
+  // Tenant scope, matching the Customers page: impersonating super-admin →
+  // impersonated tenant; tenant admin → own tenant. A non-impersonating
+  // super-admin has no single tenant to sweep — the UI hides the button.
+  let tenantId: string | undefined;
+  const active = await getActiveAdminTenant();
+  if (active?.isImpersonating) {
+    tenantId = active.tenantId;
+  } else if (user?.publicMetadata.role === "TENANT_ADMIN") {
+    const email = user.emailAddresses[0]?.emailAddress;
+    const localUser = email
+      ? await prisma.users.findFirst({ where: { email }, select: { tenantId: true } })
+      : null;
+    tenantId = localUser?.tenantId ?? undefined;
+  }
+
+  if (!tenantId) {
+    return { ok: false, error: "Select a store to refresh customer statuses." };
+  }
+
+  // Throttle from the audit trail — the previous refresh row.
+  const lastRefresh = await prisma.audit_logs.findFirst({
+    where: { action: AUDIT_ACTIONS.CUSTOMER_STATUS_REFRESHED, tenantId },
+    orderBy: { createdAt: "desc" },
+    select: { createdAt: true },
+  });
+  if (lastRefresh && Date.now() - lastRefresh.createdAt.getTime() < REFRESH_THROTTLE_MS) {
+    return {
+      ok: false,
+      error: "Statuses were refreshed less than a minute ago.",
+      syncedAt: lastRefresh.createdAt.toISOString(),
+    };
+  }
+
+  let config;
+  try {
+    config = await getTenantDrGreenConfig(tenantId);
+  } catch {
+    return {
+      ok: false,
+      error: "Dr Green API keys are not configured for this store.",
+    };
+  }
+
+  // Claim the throttle BEFORE the sweep, not after: the sweep can run for
+  // many seconds, and writing the marker only on completion left the whole
+  // sweep duration as a race window for concurrent refreshes (double-click,
+  // second tab). A failed sweep still holds the 60s throttle — intended.
+  await createAuditLog({
+    action: AUDIT_ACTIONS.CUSTOMER_STATUS_REFRESHED,
+    entityType: "Tenant",
+    entityId: tenantId,
+    userId: user?.id,
+    userEmail: user?.emailAddresses[0]?.emailAddress,
+    tenantId,
+    metadata: { phase: "started" },
+  });
+
+  let swept;
+  try {
+    swept = await sweepClientStatuses(config);
+  } catch (error) {
+    logger.error("[status-refresh] sweep failed", {
+      tenantId,
+      error: error instanceof Error ? error.message : String(error),
+    });
+    return {
+      ok: false,
+      error: "Dr Green did not respond — try again in a few minutes.",
+    };
+  }
+
+  const rows = await prisma.consultation_questionnaires.findMany({
+    where: { tenantId },
+    select: {
+      id: true,
+      email: true,
+      drGreenClientId: true,
+      isKycVerified: true,
+      adminApproval: true,
+    },
+  });
+
+  const updates = planStatusUpdates(swept, rows);
+
+  // Write only changed rows, in small parallel batches.
+  const BATCH = 10;
+  for (let i = 0; i < updates.length; i += BATCH) {
+    await Promise.all(
+      updates.slice(i, i + BATCH).map((u) =>
+        prisma.consultation_questionnaires.update({
+          where: { id: u.questionnaireId },
+          data: {
+            isKycVerified: u.isKycVerified,
+            adminApproval: u.adminApproval,
+            ...(u.backfillDrGreenClientId
+              ? { drGreenClientId: u.backfillDrGreenClientId }
+              : {}),
+            updatedAt: new Date(),
+          },
+        }),
+      ),
+    );
+  }
+
+  // Self-heal users.drGreenClientId (the /api/shop/register history) by
+  // email match — only rows actually missing the id are touched.
+  const usersMissingId = await prisma.users.findMany({
+    where: { tenantId, role: "PATIENT", drGreenClientId: null },
+    select: { id: true, email: true },
+  });
+  const sweptByEmail = new Map(
+    swept.filter((c) => c.email).map((c) => [c.email as string, c.clientId]),
+  );
+  let usersBackfilled = 0;
+  for (const u of usersMissingId) {
+    const clientId = sweptByEmail.get(u.email.toLowerCase());
+    if (!clientId) continue;
+    await prisma.users.update({
+      where: { id: u.id },
+      data: { drGreenClientId: clientId, updatedAt: new Date() },
+    });
+    usersBackfilled++;
+  }
+
+  const syncedAt = new Date();
+  await createAuditLog({
+    action: AUDIT_ACTIONS.CUSTOMER_STATUS_REFRESHED,
+    entityType: "Tenant",
+    entityId: tenantId,
+    userId: user?.id,
+    userEmail: user?.emailAddresses[0]?.emailAddress,
+    tenantId,
+    metadata: {
+      phase: "completed",
+      sweptCount: swept.length,
+      updatedRows: updates.length,
+      usersBackfilled,
+    },
+  });
+
+  logger.info("[status-refresh] completed", {
+    tenantId,
+    swept: swept.length,
+    updated: updates.length,
+    usersBackfilled,
+  });
+
+  return {
+    ok: true,
+    updated: updates.length,
+    swept: swept.length,
+    syncedAt: syncedAt.toISOString(),
+  };
+}
diff --git a/nextjs_space/lib/audit-log.ts b/nextjs_space/lib/audit-log.ts
index 8db3c3cf..97b06ad3 100644
--- a/nextjs_space/lib/audit-log.ts
+++ b/nextjs_space/lib/audit-log.ts
@@ -183,6 +183,9 @@ export const AUDIT_ACTIONS = {
   CUSTOMER_UPDATED: "customer.updated",
   CUSTOMER_EMAIL_CHANGED: "customer.email_changed",
   CUSTOMER_KYC_VERIFIED: "customer.kyc_verified",
+  // Bulk mirror refresh from Dr Green (tenant-admin Customers page). The
+  // latest row per tenant doubles as the "last synced" marker + throttle.
+  CUSTOMER_STATUS_REFRESHED: "customer.status_refreshed",
   // US-023: admin manually records / withdraws a customer's marketing consent
   CUSTOMER_MARKETING_CONSENT_GRANTED: "customer.marketing_consent_granted",
   CUSTOMER_MARKETING_CONSENT_REVOKED: "customer.marketing_consent_revoked",
diff --git a/nextjs_space/lib/drgreen/approval-status.ts b/nextjs_space/lib/drgreen/approval-status.ts
new file mode 100644
index 00000000..b6bb15b5
--- /dev/null
+++ b/nextjs_space/lib/drgreen/approval-status.ts
@@ -0,0 +1,86 @@
+/**
+ * Canonical Dr Green approval-status vocabulary + display derivation.
+ *
+ * Dr Green's enum is VERIFIED | PENDING | REJECTED (AdminApprovalOnClient).
+ * BudStacks historically wrote a fourth value, "APPROVED", from two paths
+ * (the kyc-check mirror and the tenant-admin verifyKyc API) while the
+ * webhook handlers wrote "VERIFIED" — and readers only accepted "VERIFIED",
+ * so mirror-approved customers could read as unverified (the products-page
+ * gate) while their dashboard said verified. Every reader and writer now
+ * goes through this module; stored legacy "APPROVED" rows keep working via
+ * read-side canonicalisation (an optional SQL backfill exists in
+ * prisma/migrations/normalize_admin_approval_verified.sql).
+ */
+
+export const ADMIN_APPROVAL = {
+  VERIFIED: "VERIFIED",
+  PENDING: "PENDING",
+  REJECTED: "REJECTED",
+} as const;
+
+export type AdminApproval = (typeof ADMIN_APPROVAL)[keyof typeof ADMIN_APPROVAL];
+
+/** Map a stored/remote adminApproval value to the canonical enum.
+ *  Legacy "APPROVED" → VERIFIED. Unknown/empty input → null (caller decides). */
+export function canonicalAdminApproval(
+  value: string | null | undefined,
+): AdminApproval | null {
+  switch ((value ?? "").trim().toUpperCase()) {
+    case "VERIFIED":
+    case "APPROVED":
+      return ADMIN_APPROVAL.VERIFIED;
+    case "REJECTED":
+      return ADMIN_APPROVAL.REJECTED;
+    case "PENDING":
+      return ADMIN_APPROVAL.PENDING;
+    default:
+      return null;
+  }
+}
+
+/** Display status for a customer on tenant-admin surfaces. */
+export type CustomerVerificationStatus =
+  | "VERIFIED"
+  | "PENDING"
+  | "REJECTED"
+  | "ID_UPLOAD_FAILED"
+  | "NOT_SUBMITTED";
+
+export interface VerificationStatusInput {
+  /** Whether any consultation_questionnaires row exists for this customer. */
+  hasQuestionnaire: boolean;
+  isKycVerified?: boolean | null;
+  adminApproval?: string | null;
+  /** UPLOADED | UPLOAD_FAILED | null (ID-upload tenants only). */
+  idDocumentStatus?: string | null;
+}
+
+/**
+ * Mirror-field → display status. "Verified" matches the customer-facing
+ * read in app/actions/kyc-check.ts (isKYCVerified OR adminApproval=VERIFIED)
+ * so the admin list and the customer dashboard never disagree.
+ */
+export function deriveVerificationStatus(
+  input: VerificationStatusInput,
+): CustomerVerificationStatus {
+  if (!input.hasQuestionnaire) return "NOT_SUBMITTED";
+
+  const approval = canonicalAdminApproval(input.adminApproval);
+  const verified = input.isKycVerified === true || approval === ADMIN_APPROVAL.VERIFIED;
+  if (verified) return "VERIFIED";
+  if (approval === ADMIN_APPROVAL.REJECTED) return "REJECTED";
+  if (input.idDocumentStatus === "UPLOAD_FAILED") return "ID_UPLOAD_FAILED";
+  return "PENDING";
+}
+
+/** Pill labels/tones shared by the list, detail page and CSV export. */
+export const VERIFICATION_STATUS_DISPLAY: Record<
+  CustomerVerificationStatus,
+  { label: string; tone: "emerald" | "amber" | "red" | "slate" }
+> = {
+  VERIFIED: { label: "Verified", tone: "emerald" },
+  PENDING: { label: "Pending", tone: "amber" },
+  REJECTED: { label: "Rejected", tone: "red" },
+  ID_UPLOAD_FAILED: { label: "ID upload failed", tone: "red" },
+  NOT_SUBMITTED: { label: "Not submitted", tone: "slate" },
+};
diff --git a/nextjs_space/lib/drgreen/client-status-sweep.ts b/nextjs_space/lib/drgreen/client-status-sweep.ts
new file mode 100644
index 00000000..e8e451bd
--- /dev/null
+++ b/nextjs_space/lib/drgreen/client-status-sweep.ts
@@ -0,0 +1,194 @@
+import {
+  doctorGreenRequest,
+  extractClientsFromResponse,
+  type DoctorGreenConfig,
+} from "@/lib/drgreen/doctor-green-api";
+import { canonicalAdminApproval, type AdminApproval } from "@/lib/drgreen/approval-status";
+import { logger } from "@/lib/logger";
+
+/**
+ * Bulk client-status sweep for the tenant-admin "Refresh from Dr Green".
+ *
+ * Pages GET /dapp/clients (partner-key authed; Dr Green scopes rows to the
+ * key's nftId server-side) and returns the status fields per client. This is
+ * the ONLY sanctioned way to hydrate many statuses: the single-client
+ * endpoint has a history of upstream 401s (see fetchClient's scan fallback)
+ * and over-fetches the client's medicalRecord, which must never transit for
+ * an admin list (PII).
+ */
+
+export interface SweptClientStatus {
+  clientId: string;
+  email: string | null;
+  adminApproval: AdminApproval | null;
+  isKYCVerified: boolean;
+  isActive: boolean;
+  verificationType: string | null;
+  verifiedAt: string | null;
+  rejectedAt: string | null;
+}
+
+const PAGE_SIZE = 200;
+/** Same reach budget as scanClientList — a runaway-pagination backstop. */
+const MAX_PAGES = 40;
+/** The shared Dr Green client has no request timeout, so a hung upstream
+ *  would pin the refresh action (and its throttle) indefinitely — bound each
+ *  page and the whole sweep here instead of touching the shared transport. */
+const PAGE_TIMEOUT_MS = 15_000;
+const SWEEP_DEADLINE_MS = 60_000;
+
+function withTimeout<T>(promise: Promise<T>, ms: number, label: string): Promise<T> {
+  return new Promise<T>((resolve, reject) => {
+    const timer = setTimeout(
+      () => reject(new Error(`${label} timed out after ${ms}ms`)),
+      ms,
+    );
+    promise.then(
+      (value) => {
+        clearTimeout(timer);
+        resolve(value);
+      },
+      (error) => {
+        clearTimeout(timer);
+        reject(error);
+      },
+    );
+  });
+}
+
+export async function sweepClientStatuses(
+  config: DoctorGreenConfig,
+): Promise<SweptClientStatus[]> {
+  const results: SweptClientStatus[] = [];
+  const seen = new Set<string>();
+  const deadline = Date.now() + SWEEP_DEADLINE_MS;
+
+  for (let page = 1; page <= MAX_PAGES; page++) {
+    if (Date.now() > deadline) {
+      throw new Error("client status sweep exceeded its time budget");
+    }
+    const response = await withTimeout(
+      doctorGreenRequest<any>("/dapp/clients", {
+        config,
+        queryParams: { take: PAGE_SIZE, page, orderBy: "desc" },
+      }),
+      PAGE_TIMEOUT_MS,
+      `client status sweep page ${page}`,
+    );
+
+    const clients = extractClientsFromResponse(response);
+    if (clients.length === 0) break;
+
+    for (const client of clients) {
+      const clientId = typeof client?.id === "string" ? client.id : null;
+      if (!clientId || seen.has(clientId)) continue;
+      seen.add(clientId);
+      results.push({
+        clientId,
+        email:
+          typeof client?.email === "string" && client.email.trim()
+            ? client.email.trim().toLowerCase()
+            : null,
+        adminApproval: canonicalAdminApproval(client?.adminApproval),
+        isKYCVerified: client?.isKYCVerified === true,
+        isActive: client?.isActive === true,
+        verificationType:
+          typeof client?.verificationType === "string" ? client.verificationType : null,
+        verifiedAt: typeof client?.verifiedAt === "string" ? client.verifiedAt : null,
+        rejectedAt: typeof client?.rejectedAt === "string" ? client.rejectedAt : null,
+      });
+    }
+
+    if (clients.length < PAGE_SIZE) break;
+    if (page === MAX_PAGES) {
+      logger.warn("[status-sweep] page budget exhausted — tenant list truncated", {
+        collected: results.length,
+      });
+    }
+  }
+
+  return results;
+}
+
+// ── Update planning (pure — unit-tested) ─────────────────────────
+
+export interface MirrorRow {
+  id: string;
+  email: string;
+  drGreenClientId: string | null;
+  isKycVerified: boolean;
+  adminApproval: string | null;
+}
+
+export interface PlannedUpdate {
+  questionnaireId: string;
+  isKycVerified: boolean;
+  adminApproval: AdminApproval;
+  /** Set when the row was matched by email and had no stored client id. */
+  backfillDrGreenClientId?: string;
+}
+
+/**
+ * Diff swept Dr Green statuses against the tenant's mirror rows and return
+ * only the rows that actually need writing. Matching precedence:
+ * drGreenClientId first, then lowercased email (also self-healing the
+ * missing client id on email matches — the /api/shop/register history).
+ * Swept clients with no matching local row are ignored: the sweep never
+ * invents questionnaires.
+ */
+export function planStatusUpdates(
+  swept: SweptClientStatus[],
+  rows: MirrorRow[],
+): PlannedUpdate[] {
+  const byClientId = new Map<string, MirrorRow[]>();
+  const byEmail = new Map<string, MirrorRow[]>();
+  for (const row of rows) {
+    if (row.drGreenClientId) {
+      const list = byClientId.get(row.drGreenClientId) ?? [];
+      list.push(row);
+      byClientId.set(row.drGreenClientId, list);
+    }
+    const emailKey = row.email.trim().toLowerCase();
+    const list = byEmail.get(emailKey) ?? [];
+    list.push(row);
+    byEmail.set(emailKey, list);
+  }
+
+  const updates: PlannedUpdate[] = [];
+  const planned = new Set<string>();
+
+  for (const client of swept) {
+    // A client with no canonical approval value gives us nothing to mirror.
+    const approval = client.adminApproval;
+    if (!approval) continue;
+
+    const idMatches = byClientId.get(client.clientId) ?? [];
+    const matches =
+      idMatches.length > 0
+        ? idMatches
+        : client.email
+          ? (byEmail.get(client.email) ?? []).filter((r) => !r.drGreenClientId)
+          : [];
+
+    for (const row of matches) {
+      if (planned.has(row.id)) continue;
+      const needsBackfill = !row.drGreenClientId;
+      const changed =
+        row.isKycVerified !== client.isKYCVerified ||
+        canonicalAdminApproval(row.adminApproval) !== approval ||
+        // Rewrite legacy literals ("APPROVED") to the canonical value even
+        // when they canonicalise equal — the sweep is the self-heal path.
+        row.adminApproval !== approval;
+      if (!changed && !needsBackfill) continue;
+      planned.add(row.id);
+      updates.push({
+        questionnaireId: row.id,
+        isKycVerified: client.isKYCVerified,
+        adminApproval: approval,
+        ...(needsBackfill ? { backfillDrGreenClientId: client.clientId } : {}),
+      });
+    }
+  }
+
+  return updates;
+}
diff --git a/nextjs_space/lib/drgreen/doctor-green-api.ts b/nextjs_space/lib/drgreen/doctor-green-api.ts
index 1f81cc8c..a45feadf 100644
--- a/nextjs_space/lib/drgreen/doctor-green-api.ts
+++ b/nextjs_space/lib/drgreen/doctor-green-api.ts
@@ -387,7 +387,7 @@ export async function fetchProduct(
  * Parse the /dapp/clients response into a clients[] array.
  * Dr Green's API returns several nestings across versions — handle them all.
  */
-function extractClientsFromResponse(response: any): any[] {
+export function extractClientsFromResponse(response: any): any[] {
   if (Array.isArray(response)) return response;
   if (Array.isArray(response?.data)) return response.data;
   if (Array.isArray(response?.data?.items)) return response.data.items;
diff --git a/nextjs_space/lib/drgreen/status-event-handlers.ts b/nextjs_space/lib/drgreen/status-event-handlers.ts
index 5d59957a..b6651080 100644
--- a/nextjs_space/lib/drgreen/status-event-handlers.ts
+++ b/nextjs_space/lib/drgreen/status-event-handlers.ts
@@ -7,6 +7,14 @@ import {
   type DrGreenWebhookPayload,
 } from "@/lib/drgreen/drgreen-webhook-verify";
 
+/** Dr Green's outbound dispatcher sends `data.emailsSent: true` when it has
+ *  already emailed the client (branded per nftId) for this transition — in
+ *  that case our own customer email would be a duplicate and is skipped.
+ *  Older/unknown senders omit the flag and keep the existing behaviour. */
+function senderAlreadyEmailedClient(payload: DrGreenWebhookPayload): boolean {
+  return payload.data?.emailsSent === true;
+}
+
 export async function dispatchEvent(
   event: string,
   tenantId: string,
@@ -126,7 +134,7 @@ async function handleKycVerified(
   await logKycJourney(tenantId, clientId, payload.data?.email, "kyc.verified", payload);
 
   const user = await findUserByClientId(clientId);
-  if (user) {
+  if (user && !senderAlreadyEmailedClient(payload)) {
     const tenant = await prisma.tenants.findUnique({ where: { id: tenantId } });
     const html = await emailTemplates.kycStatus(
       user.name || user.firstName || "there",
@@ -163,7 +171,7 @@ async function handleKycRejected(
   await logKycJourney(tenantId, clientId, payload.data?.email, "kyc.rejected", payload);
 
   const user = await findUserByClientId(clientId);
-  if (user) {
+  if (user && !senderAlreadyEmailedClient(payload)) {
     const tenant = await prisma.tenants.findUnique({ where: { id: tenantId } });
     // Use kycLink from payload, or fall back to stored link for retry
     let retryLink = kycLink;
@@ -221,13 +229,19 @@ async function handleClientApproved(
 
   await prisma.consultation_questionnaires.updateMany({
     where: { drGreenClientId: clientId, tenantId },
-    data: { adminApproval: "VERIFIED" },
+    data: {
+      adminApproval: "VERIFIED",
+      // ID-path approvals set the client's KYC flag in the same admin action;
+      // the dispatcher reports it so both mirror fields stay in step (the
+      // order gate needs both).
+      ...(payload.data?.isKYCVerified === true ? { isKycVerified: true } : {}),
+    },
   });
 
   await logKycJourney(tenantId, clientId, payload.data?.email, "client.approved", payload);
 
   const user = await findUserByClientId(clientId);
-  if (user) {
+  if (user && !senderAlreadyEmailedClient(payload)) {
     const tenant = await prisma.tenants.findUnique({ where: { id: tenantId } });
     const html = await emailTemplates.clientStatus(
       user.name || user.firstName || "there",
@@ -277,7 +291,7 @@ async function handleClientRejected(
   await logKycJourney(tenantId, clientId, payload.data?.email, "client.rejected", payload);
 
   const user = await findUserByClientId(clientId);
-  if (user) {
+  if (user && !senderAlreadyEmailedClient(payload)) {
     const tenant = await prisma.tenants.findUnique({ where: { id: tenantId } });
     const html = await emailTemplates.clientStatus(
       user.name || user.firstName || "there",
diff --git a/nextjs_space/lib/security/redact.ts b/nextjs_space/lib/security/redact.ts
index e2eaff1b..450eaf03 100644
--- a/nextjs_space/lib/security/redact.ts
+++ b/nextjs_space/lib/security/redact.ts
@@ -21,6 +21,12 @@ import { ARTICLE_9_FIELDS } from "./article9";
  * so the redaction list and the persistence guard share one definition.
  */
 export const SENSITIVE_FIELDS: ReadonlySet<string> = new Set([
+  // Admin free-text about why a client's KYC/ID was rejected — can reference
+  // identity or medical context. Delivered by Dr Green client.rejected
+  // webhooks and stored on drgreen_webhook_logs/kyc_journey_logs otherwise.
+  "rejectionReason",
+  "rejectionNote",
+
   // emails (variants seen across the codebase)
   "email",
   "userEmail",
diff --git a/nextjs_space/prisma/migrations/normalize_admin_approval_verified.sql b/nextjs_space/prisma/migrations/normalize_admin_approval_verified.sql
new file mode 100644
index 00000000..4674fa74
--- /dev/null
+++ b/nextjs_space/prisma/migrations/normalize_admin_approval_verified.sql
@@ -0,0 +1,16 @@
+-- Normalise the legacy adminApproval literal "APPROVED" (written by the
+-- kyc-check mirror and the tenant-admin verifyKyc API before 2026-08) to
+-- Dr Green's canonical enum value "VERIFIED".
+--
+-- OPTIONAL / safe-to-defer: all readers canonicalise APPROVED -> VERIFIED in
+-- code (lib/drgreen/approval-status.ts), and the "Refresh from Dr Green"
+-- sweep rewrites rows to canonical values as it syncs. Running this simply
+-- makes the stored data match the vocabulary immediately.
+--
+-- Apply manually (this repo's migrations are hand-run):
+--   psql "$DATABASE_URL" -f prisma/migrations/normalize_admin_approval_verified.sql
+
+UPDATE consultation_questionnaires
+SET "adminApproval" = 'VERIFIED',
+    "updatedAt" = NOW()
+WHERE "adminApproval" = 'APPROVED';
diff --git a/nextjs_space/tests/unit/approval-status.test.ts b/nextjs_space/tests/unit/approval-status.test.ts
new file mode 100644
index 00000000..0eb3006c
--- /dev/null
+++ b/nextjs_space/tests/unit/approval-status.test.ts
@@ -0,0 +1,117 @@
+import { describe, it, expect } from "vitest";
+
+import {
+  ADMIN_APPROVAL,
+  canonicalAdminApproval,
+  deriveVerificationStatus,
+} from "@/lib/drgreen/approval-status";
+
+/**
+ * The vocabulary bug this module closes: two write paths stored "APPROVED"
+ * while the webhook wrote "VERIFIED" and readers only accepted "VERIFIED" —
+ * so a mirror-approved customer read as unverified on the products gate
+ * while their dashboard said verified.
+ */
+describe("canonicalAdminApproval", () => {
+  it("maps the legacy APPROVED literal to VERIFIED", () => {
+    expect(canonicalAdminApproval("APPROVED")).toBe(ADMIN_APPROVAL.VERIFIED);
+    expect(canonicalAdminApproval("approved")).toBe(ADMIN_APPROVAL.VERIFIED);
+  });
+
+  it("passes canonical values through", () => {
+    expect(canonicalAdminApproval("VERIFIED")).toBe("VERIFIED");
+    expect(canonicalAdminApproval("PENDING")).toBe("PENDING");
+    expect(canonicalAdminApproval("REJECTED")).toBe("REJECTED");
+    expect(canonicalAdminApproval(" rejected ")).toBe("REJECTED");
+  });
+
+  it("returns null for unknown or empty input", () => {
+    expect(canonicalAdminApproval("")).toBeNull();
+    expect(canonicalAdminApproval(null)).toBeNull();
+    expect(canonicalAdminApproval(undefined)).toBeNull();
+    expect(canonicalAdminApproval("BANANA")).toBeNull();
+  });
+});
+
+describe("deriveVerificationStatus", () => {
+  it("NOT_SUBMITTED when no questionnaire exists", () => {
+    expect(deriveVerificationStatus({ hasQuestionnaire: false })).toBe("NOT_SUBMITTED");
+  });
+
+  it("VERIFIED via isKycVerified, matching the kyc-check read", () => {
+    expect(
+      deriveVerificationStatus({
+        hasQuestionnaire: true,
+        isKycVerified: true,
+        adminApproval: "PENDING",
+      }),
+    ).toBe("VERIFIED");
+  });
+
+  it("VERIFIED via adminApproval, including the legacy APPROVED literal", () => {
+    expect(
+      deriveVerificationStatus({
+        hasQuestionnaire: true,
+        isKycVerified: false,
+        adminApproval: "VERIFIED",
+      }),
+    ).toBe("VERIFIED");
+    expect(
+      deriveVerificationStatus({
+        hasQuestionnaire: true,
+        isKycVerified: false,
+        adminApproval: "APPROVED",
+      }),
+    ).toBe("VERIFIED");
+  });
+
+  it("verified wins over a stale upload-failed marker", () => {
+    expect(
+      deriveVerificationStatus({
+        hasQuestionnaire: true,
+        isKycVerified: true,
+        adminApproval: "VERIFIED",
+        idDocumentStatus: "UPLOAD_FAILED",
+      }),
+    ).toBe("VERIFIED");
+  });
+
+  it("REJECTED when not verified and approval is REJECTED", () => {
+    expect(
+      deriveVerificationStatus({
+        hasQuestionnaire: true,
+        isKycVerified: false,
+        adminApproval: "REJECTED",
+        idDocumentStatus: "UPLOAD_FAILED",
+      }),
+    ).toBe("REJECTED");
+  });
+
+  it("ID_UPLOAD_FAILED when unverified with a failed inline upload", () => {
+    expect(
+      deriveVerificationStatus({
+        hasQuestionnaire: true,
+        isKycVerified: false,
+        adminApproval: "PENDING",
+        idDocumentStatus: "UPLOAD_FAILED",
+      }),
+    ).toBe("ID_UPLOAD_FAILED");
+  });
+
+  it("PENDING otherwise, including unknown approval values", () => {
+    expect(
+      deriveVerificationStatus({
+        hasQuestionnaire: true,
+        isKycVerified: false,
+        adminApproval: "PENDING",
+      }),
+    ).toBe("PENDING");
+    expect(
+      deriveVerificationStatus({
+        hasQuestionnaire: true,
+        isKycVerified: false,
+        adminApproval: "WEIRD_VALUE",
+      }),
+    ).toBe("PENDING");
+  });
+});
diff --git a/nextjs_space/tests/unit/client-status-sweep.test.ts b/nextjs_space/tests/unit/client-status-sweep.test.ts
new file mode 100644
index 00000000..133c5567
--- /dev/null
+++ b/nextjs_space/tests/unit/client-status-sweep.test.ts
@@ -0,0 +1,170 @@
+import { describe, it, expect, vi, beforeEach } from "vitest";
+
+import {
+  planStatusUpdates,
+  sweepClientStatuses,
+  type MirrorRow,
+  type SweptClientStatus,
+} from "@/lib/drgreen/client-status-sweep";
+import { doctorGreenRequest } from "@/lib/drgreen/doctor-green-api";
+
+vi.mock("@/lib/drgreen/doctor-green-api", async (importActual) => {
+  const actual = await importActual<typeof import("@/lib/drgreen/doctor-green-api")>();
+  return {
+    ...actual,
+    doctorGreenRequest: vi.fn(),
+  };
+});
+
+const mockedRequest = vi.mocked(doctorGreenRequest);
+
+const CONFIG = { apiKey: "key", secretKey: "secret" } as any;
+
+function client(over: Partial<Record<string, unknown>> = {}) {
+  return {
+    id: "c-1",
+    email: "Ann@Example.com",
+    adminApproval: "VERIFIED",
+    isKYCVerified: true,
+    isActive: true,
+    verificationType: "KYC",
+    verifiedAt: "2026-08-01T00:00:00.000Z",
+    rejectedAt: null,
+    ...over,
+  };
+}
+
+describe("sweepClientStatuses", () => {
+  beforeEach(() => {
+    mockedRequest.mockReset();
+  });
+
+  it("unwraps the single-wrap list envelope and normalises fields", async () => {
+    mockedRequest.mockResolvedValueOnce({
+      success: true,
+      data: { clients: [client()], pageMetaDto: { page: 1 } },
+    });
+
+    const swept = await sweepClientStatuses(CONFIG);
+
+    expect(swept).toHaveLength(1);
+    expect(swept[0]).toMatchObject({
+      clientId: "c-1",
+      email: "ann@example.com", // lowercased
+      adminApproval: "VERIFIED",
+      isKYCVerified: true,
+    });
+    expect(mockedRequest).toHaveBeenCalledWith("/dapp/clients", {
+      config: CONFIG,
+      queryParams: { take: 200, page: 1, orderBy: "desc" },
+    });
+  });
+
+  it("pages until a short page and dedupes overlapping rows", async () => {
+    const fullPage = Array.from({ length: 200 }, (_, i) => client({ id: `c-${i}` }));
+    mockedRequest
+      .mockResolvedValueOnce({ data: { clients: fullPage } })
+      .mockResolvedValueOnce({ data: { clients: [client({ id: "c-0" }), client({ id: "c-200" })] } });
+
+    const swept = await sweepClientStatuses(CONFIG);
+
+    expect(mockedRequest).toHaveBeenCalledTimes(2);
+    expect(swept).toHaveLength(201); // c-0 not double-counted
+  });
+
+  it("returns empty for an empty tenant without further paging", async () => {
+    mockedRequest.mockResolvedValueOnce({ data: { clients: [] } });
+    const swept = await sweepClientStatuses(CONFIG);
+    expect(swept).toEqual([]);
+    expect(mockedRequest).toHaveBeenCalledTimes(1);
+  });
+});
+
+describe("planStatusUpdates", () => {
+  const row = (over: Partial<MirrorRow> = {}): MirrorRow => ({
+    id: "q-1",
+    email: "ann@example.com",
+    drGreenClientId: "c-1",
+    isKycVerified: false,
+    adminApproval: "PENDING",
+    ...over,
+  });
+
+  const swept = (over: Partial<SweptClientStatus> = {}): SweptClientStatus => ({
+    clientId: "c-1",
+    email: "ann@example.com",
+    adminApproval: "VERIFIED",
+    isKYCVerified: true,
+    isActive: true,
+    verificationType: "KYC",
+    verifiedAt: null,
+    rejectedAt: null,
+    ...over,
+  });
+
+  it("updates a changed row matched by client id", () => {
+    const updates = planStatusUpdates([swept()], [row()]);
+    expect(updates).toEqual([
+      { questionnaireId: "q-1", isKycVerified: true, adminApproval: "VERIFIED" },
+    ]);
+  });
+
+  it("skips rows that are already canonical and unchanged", () => {
+    const updates = planStatusUpdates(
+      [swept()],
+      [row({ isKycVerified: true, adminApproval: "VERIFIED" })],
+    );
+    expect(updates).toEqual([]);
+  });
+
+  it("rewrites the legacy APPROVED literal even when canonically equal", () => {
+    const updates = planStatusUpdates(
+      [swept()],
+      [row({ isKycVerified: true, adminApproval: "APPROVED" })],
+    );
+    expect(updates).toEqual([
+      { questionnaireId: "q-1", isKycVerified: true, adminApproval: "VERIFIED" },
+    ]);
+  });
+
+  it("falls back to email matching and backfills the missing client id", () => {
+    const updates = planStatusUpdates(
+      [swept()],
+      [row({ drGreenClientId: null, email: "Ann@Example.com" })],
+    );
+    expect(updates).toEqual([
+      {
+        questionnaireId: "q-1",
+        isKycVerified: true,
+        adminApproval: "VERIFIED",
+        backfillDrGreenClientId: "c-1",
+      },
+    ]);
+  });
+
+  it("email fallback never rebinds a row already linked to another client", () => {
+    const updates = planStatusUpdates(
+      [swept({ clientId: "c-OTHER" })],
+      [row({ drGreenClientId: "c-1", email: "ann@example.com", isKycVerified: true, adminApproval: "VERIFIED" })],
+    );
+    expect(updates).toEqual([]);
+  });
+
+  it("ignores swept clients with no local row and no canonical approval", () => {
+    const updates = planStatusUpdates(
+      [swept({ clientId: "c-unknown", email: "nobody@example.com" }), swept({ adminApproval: null })],
+      [row({ isKycVerified: true, adminApproval: "VERIFIED" })],
+    );
+    expect(updates).toEqual([]);
+  });
+
+  it("mirrors a rejection", () => {
+    const updates = planStatusUpdates(
+      [swept({ adminApproval: "REJECTED", isKYCVerified: false })],
+      [row({ isKycVerified: true, adminApproval: "VERIFIED" })],
+    );
+    expect(updates).toEqual([
+      { questionnaireId: "q-1", isKycVerified: false, adminApproval: "REJECTED" },
+    ]);
+  });
+});
diff --git a/tasks/prd-customer-approval-status.md b/tasks/prd-customer-approval-status.md
new file mode 100644
index 00000000..300dba00
--- /dev/null
+++ b/tasks/prd-customer-approval-status.md
@@ -0,0 +1,198 @@
+# PRD: Customer Approval-Status Visibility (BudStacks ↔ Dr Green)
+
+## Introduction
+
+When a customer signs up on a BudStacks tenant storefront they are submitted to Dr Green for approval and can sit in PENDING until manually approved. Customers can already see their own status (storefront dashboard calls Dr Green live per-session), but **tenant admins cannot see who is approved and who isn't** — the tenant-admin Customers pages show no approval state at all.
+
+The local mirror of approval state already exists (`consultation_questionnaires.isKycVerified` / `.adminApproval`, maintained by the customer-side status check and by an inbound webhook receiver), and Dr Green already exposes a partner-scoped bulk status endpoint (`GET /api/v1/dapp/clients`). This PRD wires the three missing pieces:
+
+- **Phase 1 (budstack-saas):** show last-known status on the tenant-admin Customers list + detail pages, after fixing two pre-existing data bugs that would make any badge lie.
+- **Phase 2 (budstack-saas):** a pull-based "Refresh from Dr Green" that bulk-syncs the mirror via the existing partner API.
+- **Phase 3 (dr-green-backend):** outbound client-status webhooks so the mirror updates in near-real-time without polling — the budstack receiver for these events already exists and is signature-verified; today nothing sends them.
+
+Spans two repos: `budstack-saas` (Phases 1–2) and `dr-green-backend` (Phase 3). Dr Green remains the **system of record**; BudStacks only mirrors.
+
+## Goals
+
+- Tenant admins see per-customer verification status (Verified / Pending / Rejected / ID upload failed / Not submitted) on the Customers list, detail page, and CSV export.
+- Status vocabulary is consistent end-to-end (`VERIFIED | PENDING | REJECTED`, matching Dr Green's enum) — fixing the live bug where the purchase gate and the dashboard disagree.
+- Every registration path persists `drGreenClientId` so no customer is permanently "pending" by accident.
+- Admins can refresh all statuses for their tenant in one action costing ≤ a handful of upstream calls (no per-row API calls, ever).
+- Dr Green pushes client-status changes to partners so the mirror stays fresh without manual refresh.
+
+## Decisions already made (from review discussion)
+
+- The dead `verifyKyc` local-approve API gets **no UI** — approving locally would diverge from the system of record.
+- Freshness is **pull-based in Phase 2** (no push exists yet) and **push-based in Phase 3** (new outbound webhooks in dr-green-backend, copying its existing payments-webhook dispatcher pattern).
+- The single-client Dr Green endpoint is never used for lists (historic 401s force an up-to-80-request scan fallback, and it over-fetches `medicalRecord` PII).
+
+## User Stories
+
+### Phase 1 — Status on tenant-admin pages (budstack-saas)
+
+#### US-001: Normalise adminApproval vocabulary
+**Description:** As the platform, I need one status vocabulary so every reader renders the same truth.
+
+**Acceptance Criteria:**
+- [ ] All local writes of `adminApproval` use Dr Green's enum values (`VERIFIED`, not `APPROVED`): `app/actions/kyc-check.ts` (2 sites), `app/api/tenant-admin/customers/[id]/route.ts` (verifyKyc path).
+- [ ] A shared canonicaliser (lib) maps legacy `"APPROVED"` → `VERIFIED` on read; all readers (`RestrictedRegionGate`, `/api/consultation/status` consumers, new admin UI) use it.
+- [ ] Data backfill migration: `UPDATE consultation_questionnaires SET "adminApproval" = 'VERIFIED' WHERE "adminApproval" = 'APPROVED'`.
+- [ ] Unit tests cover the canonicaliser (VERIFIED/APPROVED/PENDING/REJECTED/unknown).
+- [ ] Typecheck passes (CI).
+
+#### US-002: Persist drGreenClientId on the shop/register path
+**Description:** As the platform, I need every registration path to store the Dr Green client id so status sync can reach every customer.
+
+**Acceptance Criteria:**
+- [ ] `POST /api/shop/register` persists `drGreenClientId` (and `tenantId`) onto `users` after `createClient`, matching `consultation/submit` behaviour.
+- [ ] Failure to persist does not fail the registration (log + continue), mirroring existing best-effort conventions.
+- [ ] Typecheck passes (CI).
+
+#### US-003: Status derivation helper
+**Description:** As a developer, I need one function that turns mirror fields into a display status so list, detail, CSV and gate agree.
+
+**Acceptance Criteria:**
+- [ ] `lib/customers/verification-status.ts` (or equivalent) exports `deriveVerificationStatus({ isKycVerified, adminApproval, idDocumentStatus, submittedToDrGreen, hasQuestionnaire })` → `VERIFIED | PENDING | REJECTED | ID_UPLOAD_FAILED | NOT_SUBMITTED`.
+- [ ] Precedence: no questionnaire → NOT_SUBMITTED; rejected → REJECTED; upload-failed → ID_UPLOAD_FAILED; verified (isKycVerified OR canonical adminApproval=VERIFIED, matching `kyc-check.ts`'s read) → VERIFIED; else PENDING.
+- [ ] Unit tests for each branch.
+- [ ] Typecheck passes (CI).
+
+#### US-004: Status pills on the Customers list + CSV
+**Description:** As a tenant admin, I want to see each customer's approval status at a glance so I know who is cleared to order.
+
+**Acceptance Criteria:**
+- [ ] List page selects `isKycVerified`, `adminApproval` from the questionnaire fetch it already performs (zero additional queries) and maps a `verificationStatus` per row.
+- [ ] `customers-table.tsx` renders a status pill per row (Verified=green, Pending=amber, Rejected=red, ID upload failed=red variant, Not submitted=grey), reusing the existing `RowPill` pattern.
+- [ ] CSV export gains a `Status` column.
+- [ ] Erased customers remain filtered out (existing `@deleted.local` filter untouched).
+- [ ] Typecheck passes (CI); verify on staging after deploy (list renders pills for a tenant with mixed statuses).
+
+#### US-005: Status summary counts on the list header
+**Description:** As a tenant admin, I want Verified/Pending/Rejected counts so I can gauge the approval backlog.
+
+**Acceptance Criteria:**
+- [ ] Header stat chips: Verified / Pending / Rejected (+ Not submitted folded into Pending or shown separately — implementer's call, consistent with US-003 derivation), computed locally from the questionnaire rows already loaded (no new queries or upstream calls).
+- [ ] Counts respect the erasure filter.
+- [ ] Typecheck passes (CI); verify on staging after deploy.
+
+#### US-006: Status card on the customer detail page
+**Description:** As a tenant admin, I want a customer's verification detail (status, mode, last update, KYC link) when I open their record.
+
+**Acceptance Criteria:**
+- [ ] Detail page loads the customer's questionnaire (by tenantId + lowercased email) and renders: status pill, verification mode (KYC / ID upload), `idDocumentStatus` when present, last-updated timestamp (`updatedAt`), and the `kycLink` (copyable) when the customer is unverified on the KYC path.
+- [ ] No Dr Green API call is made from this page.
+- [ ] Rejection shows status + date only (no rejection note — see Open Questions).
+- [ ] Typecheck passes (CI); verify on staging after deploy.
+
+### Phase 2 — Pull refresh (budstack-saas)
+
+#### US-007: Bulk status sweep client
+**Description:** As a developer, I need a function that fetches all client statuses for a tenant from Dr Green in a few paginated calls.
+
+**Acceptance Criteria:**
+- [ ] `lib/drgreen/client-status-sweep.ts` pages `GET /dapp/clients` (take=200, ascending pages until `pageMetaDto` exhausted; hard cap ~40 pages) using the existing `callDrGreenAPI` signing (GET signature over the exact query string serialisation).
+- [ ] Returns rows keyed by client id AND lowercased email, each `{ clientId, email, adminApproval, isKYCVerified, isActive, verificationType, verifiedAt, rejectedAt }`.
+- [ ] Handles the single-wrap list envelope (`data.clients` + `data.pageMetaDto`) with the same defensive extraction used elsewhere.
+- [ ] Never calls the single-client endpoint; never touches `medicalRecord`.
+- [ ] Unit tests: pagination loop, envelope extraction, empty tenant.
+- [ ] Typecheck passes (CI).
+
+#### US-008: Refresh action + upsert
+**Description:** As a tenant admin, I want a "Refresh from Dr Green" action that updates every customer's mirrored status now.
+
+**Acceptance Criteria:**
+- [ ] Tenant-admin server action (or API route) guarded by the same permission as the Customers page; uses `getTenantDrGreenConfig(tenantId)`; missing credentials → clear, non-crashing error state.
+- [ ] Sweep results update `consultation_questionnaires` matched by `drGreenClientId` first, else `(tenantId, lowercased email)`; writes `isKycVerified`, canonical `adminApproval`; never invents rows for unknown clients.
+- [ ] Records sync completion time per tenant (new nullable `tenants.drGreenStatusSyncedAt` column via migration).
+- [ ] Per-tenant throttle: refresh no-ops (with message) if last sync < 60s ago.
+- [ ] Audit-log entry on each refresh (actor, counts updated).
+- [ ] Unit tests: matching precedence, canonicalisation on write, throttle.
+- [ ] Typecheck passes (CI).
+
+#### US-009: Refresh UI + staleness label
+**Description:** As a tenant admin, I want to trigger the refresh and see how fresh the data is.
+
+**Acceptance Criteria:**
+- [ ] "Refresh from Dr Green" button on the Customers list header; disabled while running; success/error toast with updated-row count.
+- [ ] "Statuses last synced &lt;relative time&gt;" label (or "never — showing last-known from customer activity") near the button.
+- [ ] Page data reloads after a successful refresh.
+- [ ] Typecheck passes (CI); verify on staging after deploy (refresh updates a known-changed status).
+
+### Phase 3 — Outbound status webhooks (dr-green-backend)
+
+#### US-010: Dispatch client-status events on transitions
+**Description:** As a partner platform, I want Dr Green to notify me when a client's approval state changes so my mirror stays fresh without polling.
+
+**Acceptance Criteria:**
+- [ ] Events emitted on: single approve (`client.approved`), single reject (`client.rejected`), bulk approve/reject (one event per client), KYC flag set by First-AML webhook/cron (`kyc.verified`), and document-path approval (which routes through the same status update).
+- [ ] Dispatch is best-effort/async: a webhook failure never fails or delays the admin action; outcomes are logged (reuse the payments dispatcher's logging pattern).
+- [ ] Partner endpoint + secret resolution reuses the existing per-partner mechanism the payments webhook dispatcher already uses (per-key hosts model); clients whose nftId has no configured partner endpoint are skipped silently.
+- [ ] Payload includes at minimum: event name, clientId, nftId, adminApproval, isKYCVerified, timestamps; **no medical/PII payload**.
+- [ ] Signature and event names match the budstack receiver contract (`/api/webhooks/drgreen/status` + `drgreen-webhook-verify`) — verified against that code, not assumed.
+- [ ] Unit tests per repo conventions for the dispatch hook points.
+- [ ] Repo CI green.
+
+#### US-011: End-to-end contract verification
+**Description:** As the platform owner, I need proof the events Dr Green sends are the events BudStacks consumes.
+
+**Acceptance Criteria:**
+- [ ] Event names/payloads asserted equal on both sides (shared fixture committed to both repos or documented in this PRD's PRs).
+- [ ] budstack `status-event-handlers` accepts every emitted event without code change, OR the minimal receiver adjustments ship in the budstack PR (note: `kyc.rejected` currently logs/emails without a DB write — leave as-is unless contract requires otherwise).
+- [ ] Staging smoke: approve a test client in Dr Green admin → budstack questionnaire row shows VERIFIED without the customer logging in.
+
+## Functional Requirements
+
+- FR-1: All `adminApproval` writes in budstack use `VERIFIED | PENDING | REJECTED`; reads canonicalise legacy `APPROVED` → `VERIFIED`. A one-off backfill migrates stored `APPROVED` rows.
+- FR-2: `/api/shop/register` persists `drGreenClientId` + `tenantId` onto `users`.
+- FR-3: The Customers list derives status exclusively from local mirror data already fetched by the page; zero upstream calls on render.
+- FR-4: Status pill, CSV column, header counts, and detail card all derive from one shared helper (US-003).
+- FR-5: Refresh sweeps `GET /dapp/clients` paginated (≤ 200/page), upserts the mirror, stamps `tenants.drGreenStatusSyncedAt`, and is throttled to ≥ 60s between runs per tenant.
+- FR-6: dr-green-backend emits signed `client.approved` / `client.rejected` / `kyc.verified` events to the partner endpoint configured for the client's nftId, asynchronously, with logging; admin flows never block on dispatch.
+- FR-7: No surface introduced by this PRD fetches or stores `medicalRecord` or any Article 9 data (existing prohibition — see `consultation_questionnaires` schema comment).
+
+## Non-Goals (Out of Scope)
+
+- No local approve/reject UI for tenant admins (Dr Green admin remains the only approval surface; `verifyKyc` API stays UI-less).
+- No per-row or per-render live Dr Green calls from admin pages.
+- No status filter tabs on the Customers list in this iteration (the email-join makes pre-pagination filtering non-trivial; revisit after Phase 3 lands).
+- No scheduled/cron auto-sync in budstack (manual refresh + webhooks cover it; revisit if webhook delivery proves unreliable).
+- No realtime UI push (page reload/refresh shows new state).
+- No display of Dr Green `rejectionNote` to tenant admins (privacy call — see Open Questions).
+
+## Technical Considerations
+
+- **Join fragility:** `consultation_questionnaires` has no `userId` FK; joins are `(tenantId, lower(email))`. `kyc-check` migrates questionnaire tenantIds when users move tenants. Prefer `drGreenClientId` matching wherever available.
+- **Signing:** Dr Green GET requests sign the exact `URLSearchParams` serialisation of the query — pagination params must be serialised once and signed as-sent (`drgreen-api-client.ts` rules).
+- **Envelope:** list responses are single-wrapped (`data.clients`/`data.pageMetaDto`); several other endpoints double-wrap (`data.data`) — use the established defensive extraction.
+- **Known upstream quirk:** `/dapp/clients/:id` historically 401'd, which is why per-client lookups fall back to an expensive scan — the sweep must use the list endpoint only.
+- **Erasure:** erased users (`@deleted.local`) stay excluded from all new surfaces and counts.
+- **dr-green-backend hook placement:** status transitions concentrate in `client.service.ts` (`updateClientStatus`, `approveClients`, `rejectClients`) and the KYC repository update; document approval delegates into `updateClientStatus`, so a single well-placed dispatch point covers the ID path.
+- **Deploy models:** budstack merge-to-main auto-deploys (Railway); dr-green-backend flows develop → staging, main → prod — Phase 3 PR targets `develop`.
+
+## Success Metrics
+
+- A tenant admin can answer "is this customer approved?" from the Customers list with zero support contact.
+- Refresh for a tenant with ≤ 600 customers completes in ≤ 3 upstream calls.
+- With Phase 3 live: Dr Green approval → budstack mirror updated in under a minute, with no customer login and no manual refresh.
+- Zero increase in per-render Dr Green API traffic from admin pages.
+
+## Implementation notes (as-built)
+
+Deviations from the ACs above, made during implementation for grounded reasons:
+
+- **US-008 sync marker/throttle:** no `tenants.drGreenStatusSyncedAt` column. This repo's migrations are hand-run SQL with no automated runner, and declaring a schema column the DB lacks breaks *every* tenants query at deploy (merge = instant Railway deploy). The latest `customer.status_refreshed` audit-log row is the marker and throttle instead — durable, tenant-scoped, zero deploy hazard. The throttle row is written BEFORE the sweep (post-review fix: writing it after left the whole sweep duration as a concurrency race window).
+- **US-008 permission:** gated on `canEditCustomers`, not `canViewCustomers` — the customer_support/manager presets hold the view grant as explicitly read-only, and this action writes the KYC/approval mirror.
+- **US-010 dispatcher:** dr-green-backend has NO existing outbound webhook mechanism (the "payments dispatcher" assumption was wrong — all its webhooks are inbound; budstack's receiver was aspirational). Built new as a plain env-configured function module (`src/webhooks/partner-status-webhook.ts`) rather than an @Injectable, because the natural call sites are re-provided across many modules' flat provider arrays and a new constructor dependency breaks Nest boot unless every array is updated. Config: `PARTNER_STATUS_WEBHOOK_URL` + `PARTNER_STATUS_WEBHOOK_SECRET` (must equal budstack's `DRGREEN_WEBHOOK_SECRET`) + optional `PARTNER_STATUS_WEBHOOK_NFT_IDS` allowlist. Dispatch is OFF until the env pair is set on both sides. Single attempt, fire-and-forget, logged; retries deliberately omitted — the pull refresh covers missed deliveries.
+- **Duplicate-email contract:** payloads carry `data.emailsSent`, truthful per call site (admin approve/reject paths email the client; the First-AML KYC pass does not). The budstack receiver skips its own customer email only when the flag is true — so standard-KYC customers now get a KYC-pass email (from budstack) where previously neither platform sent one.
+- `rejectionReason`/`rejectionNote` added to budstack's log-redaction list (`lib/security/redact.ts`) — the webhooks are the first flow delivering that admin free-text into budstack's own log tables.
+
+## Security review outcomes
+
+- 🔴 **Pre-existing (NOT introduced here), rollout-blocking:** `POST /api/consultation/submit` is unauthenticated and, for a caller-supplied email that matches an EXISTING user, overwrites that user's `tenantId` and `drGreenClientId` — letting an attacker bind a victim's account to the attacker's own (approvable) Dr Green client. The new badge/sync makes that spoofed approval more visible and more trusted. **Fix that route (bind to the authenticated session; never re-stamp an existing user's linkage from an anonymous call) before setting the Phase 3 env vars or promoting the admin badge as authoritative.** Tracked as its own follow-up.
+- Shared platform webhook secret = platform-wide blast radius if leaked; keep a rotation runbook and watch for repeated 401s on the status webhook route (probing signal).
+
+## Open Questions
+
+- Show Dr Green `rejectionNote` to tenant admins on the detail page? (It can contain sensitive wording aimed at the customer; default here is status + date only.)
+- Status filter tabs on the list — worth the join rework once webhooks keep the mirror fresh?
+- Should Phase 2's refresh also backfill missing `users.drGreenClientId` by email match (self-healing the `/api/shop/register` history)? Default: yes if trivially safe during upsert.