fix(clearance): allow customs risk to be corrected and keep the trail

RiskStep returned early to a badge as soon as a risk level existed, so the
control was unreachable and a mis-assigned level could never be corrected.
Both the server and the sibling AssignRiskCard treat risk as correctable
until duty is advised off it — completeWithMetadata has no already-completed
guard and overwrites metadata.riskLevel. RiskStep was stricter than either.

It now keeps the control mounted alongside the assigned badge, offers
"Reassign risk", and locks to badge-only once DUTY_TAXES_ADVISED completes.
The control also reads the persisted level (it was hardcoded to GREEN, so
unhiding it alone would have misreported the assignment), and the T1 gate is
skipped once a level exists, since risk cannot be assigned without a closed
T1 and stale T1 data must not hide the badge.

Correcting a level previously left no record of the old value, who changed
it, or when — thin ground for a customer-visible level that may be disputed.
assignRisk now appends each decision to metadata.riskHistory: the level, the
level it replaced, the timestamp, the user id, and a display name resolved
at assignment time so the trail shows a person rather than a UUID. riskLevel
still carries the current value and always equals the last entry, so
existing consumers are unchanged.

History lives on the existing metadata JSONB column, so no migration is
needed, and the logic sits in assignRisk rather than the shared
completeWithMetadata that adviseDuty and others also use. Re-picking the
level already in force is not recorded — it changed nothing.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

packages/types/src/freight/contracts.ts

@@ -407,6 +407,8 @@ export interface ContractClearanceView {
   /** Customs risk level assigned by GL ET (import; visible to the customer). */
   riskLevel?: string | null;
   riskAssignedAt?: string | null;
+  /** Every risk decision, oldest first; the last entry is the current level. */
+  riskHistory?: RiskAssignmentRecord[];
   /** Post-arrival additional duty/tax round (import). */
   secondDuty?: ClearanceSecondDuty | null;
   importReleaseGranted?: boolean;
@@ -440,9 +442,27 @@ export type MilestoneStatus = "PENDING" | "COMPLETED" | "SKIPPED";
 export const CUSTOMS_RISK_LEVELS = ["GREEN", "YELLOW", "RED"] as const;
 export type CustomsRiskLevel = (typeof CUSTOMS_RISK_LEVELS)[number];
 
+/**
+ * One customs risk decision. The level stays correctable until duty is advised
+ * off it and is customer-visible, so every assignment is kept rather than
+ * overwritten.
+ */
+export interface RiskAssignmentRecord {
+  level: CustomsRiskLevel;
+  /** The level this replaced; absent on the first assignment. */
+  previousLevel?: CustomsRiskLevel;
+  assignedAt: string;
+  assignedByUserId?: string | null;
+  /** Display name resolved at assignment time, so the trail never shows a UUID. */
+  assignedBy?: string | null;
+  note?: string | null;
+}
+
 /** Structured payload carried by RISK_ASSIGNED / DUTY_TAXES_ADVISED milestones. */
 export interface MilestoneMetadata {
   riskLevel?: CustomsRiskLevel;
+  /** Every risk decision, oldest first; the last entry matches `riskLevel`. */
+  riskHistory?: RiskAssignmentRecord[];
   dutyAmount?: number;
   dutyCurrency?: string;
   declarationSerial?: string;

packages/types/src/freight/index.ts

@@ -780,6 +780,8 @@ export interface ClearanceView {
   /** Customs risk level assigned by GL ET (import; visible to the customer). */
   riskLevel?: string | null;
   riskAssignedAt?: string | null;
+  /** Every risk decision, oldest first; the last entry is the current level. */
+  riskHistory?: import("./contracts").RiskAssignmentRecord[];
   /** Post-arrival additional duty/tax round (import). */
   secondDuty?: import("./contracts").ClearanceSecondDuty | null;
   importReleaseGranted?: boolean;