[eshurakov]

Summary

Town creation now requires the gastownAccess claim minted after the gastown-access PostHog flag check. This closes the legacy REST bypass and removes the separate 7-day account-age requirement.

• Added gastownFlaggedProcedure and use it for createTown and createOrgTown. Admins no longer bypass this check for town creation.
• Added gastownAccessMiddleware to the legacy POST /api/users/:userId/towns and POST /api/orgs/:orgId/towns routes.
• Removed checkTownCreationEligibility, the 7-day account-age check, and the now-unused created_at lookup.

Verification

• New town-creation unit tests: 12 passed
• Full Gastown unit suite: 322 passed
• Targeted integration suite (user-route-auth): 31 passed
• pnpm --filter cloudflare-gastown typecheck
• pnpm --filter cloudflare-gastown lint
• Formatting checked with oxfmt

[kilo-code-bot]

Code Review Summary

Status: No Issues Found | Recommendation: Merge

Files Reviewed (11 files)

• services/gastown/src/gastown.worker.ts
• services/gastown/src/handlers/org-towns.handler.ts
• services/gastown/src/handlers/town-creation.test.ts
• services/gastown/src/handlers/towns.handler.ts
• services/gastown/src/middleware/gastown-access.middleware.ts
• services/gastown/src/trpc/init.ts
• services/gastown/src/trpc/router.ts
• services/gastown/src/util/town-creation.util.test.ts
• services/gastown/src/util/town-creation.util.ts
• services/gastown/src/util/user-db.util.ts
• services/gastown/test/integration/user-route-auth.test.ts

---

_{Reviewed by deepseek-v4.1-flash-1017 · Input: 94K · Output: 23.5K · Cached: 3.2M}

_{Review guidance: REVIEW.md from base branch main}