Guests modifying a booking saw every worker for the subpage, so an eyelash booking exposed nail-only workers as switchable. Now the worker list is scoped to the booking's service category, other-category services are disabled in step 1, and the process handler rejects any worker/service category mismatch to defend against crafted POSTs. Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>