diff --git a/VERSION b/VERSION
index 155d478..02c1916 100644
--- a/VERSION
+++ b/VERSION
@@ -1 +1 @@
-1.3.44
+1.3.62
diff --git a/app/Console/Commands/PruneDormantAccounts.php b/app/Console/Commands/PruneDormantAccounts.php
new file mode 100644
index 0000000..4a5362c
--- /dev/null
+++ b/app/Console/Commands/PruneDormantAccounts.php
@@ -0,0 +1,206 @@
+<?php
+
+namespace App\Console\Commands;
+
+use App\Mail\DormantAccountWarningMail;
+use App\Models\User;
+use App\Models\UserDevice;
+use Illuminate\Console\Command;
+use Illuminate\Support\Carbon;
+use Illuminate\Support\Facades\Log;
+use Illuminate\Support\Facades\Mail;
+use Throwable;
+
+/**
+ * A confirmed account that has never had a package, removed after a year.
+ *
+ * The other sweep (PruneUnverifiedAccounts) is about registrations nobody
+ * confirmed and takes five days. This one is about the opposite case: somebody
+ * confirmed their address, looked around, never bought anything, and never came
+ * back. A year later there is a login, an address and a password hash on file
+ * for no purpose at all — which is a data-protection question, not tidiness.
+ *
+ * ## What "no package" means, and why it is drawn this wide
+ *
+ * No instance, no contract, no order, no invoice — ever, not merely "not now".
+ * A customer who cancelled last month has invoices, and invoices have to be kept
+ * for seven years (§ 132 BAO). Their login is part of how they reach those
+ * invoices, so nothing with commercial history is touched here. Both links
+ * between `users` and `customers` count, by id and by address, for the same
+ * reason as in the other sweep.
+ *
+ * ## The clock is reset by signing in
+ *
+ * Measured from the LATEST of the registration and the last time any device was
+ * seen (`user_devices.last_seen_at`) — so a person who signs in once a year
+ * keeps their account, which is what the terms promise. There is no
+ * `last_login_at` on users, and the device rows already carry exactly this.
+ *
+ * ## Nobody is deleted without being told
+ *
+ * A warning goes out a fortnight before, once, and `dormant_warned_at` records
+ * it. An account is only removed when that warning is on file and old enough —
+ * so a run that has never warned anybody deletes nobody, and a mail server that
+ * was down that night delays the deletion instead of skipping the warning.
+ */
+class PruneDormantAccounts extends Command
+{
+    /** How long an account with no package is kept. */
+    public const AFTER_DAYS = 365;
+
+    /** How long before that the warning goes out. */
+    public const WARN_DAYS_BEFORE = 14;
+
+    protected $signature = 'clupilot:prune-dormant {--dry-run : Only say what would happen}';
+
+    protected $description = 'Warn, then delete confirmed accounts that never had a package';
+
+    public function handle(): int
+    {
+        $dry = (bool) $this->option('dry-run');
+
+        $warned = $this->sendWarnings($dry);
+        $removed = $this->remove($dry);
+
+        $this->info($dry
+            ? "would warn {$warned}, would remove {$removed}."
+            : "{$warned} warned, {$removed} removed.");
+
+        return self::SUCCESS;
+    }
+
+    /**
+     * The fortnight's notice.
+     *
+     * Not called warn(): Command::warn() is the framework's "print a warning
+     * line" and overriding it with something private breaks the class outright.
+     */
+    private function sendWarnings(bool $dry): int
+    {
+        $due = $this->dormant()
+            ->whereNull('dormant_warned_at')
+            ->get()
+            ->filter(fn (User $user) => $this->dormantSince($user)
+                ->lte(now()->subDays(self::AFTER_DAYS - self::WARN_DAYS_BEFORE)));
+
+        foreach ($due as $user) {
+            if ($dry) {
+                $this->line('would warn: '.$user->email);
+
+                continue;
+            }
+
+            try {
+                Mail::to($user->email)->queue(new DormantAccountWarningMail($user, self::WARN_DAYS_BEFORE));
+            } catch (Throwable $e) {
+                // Not stamped: the stamp is what permits the deletion, and
+                // stamping a mail that never went out would delete an account
+                // whose owner was never told.
+                Log::warning('Could not warn a dormant account', [
+                    'email' => $user->email,
+                    'exception' => $e->getMessage(),
+                ]);
+
+                continue;
+            }
+
+            $user->forceFill(['dormant_warned_at' => now()])->save();
+        }
+
+        return $due->count();
+    }
+
+    /** The deletion itself, a fortnight after the warning at the earliest. */
+    private function remove(bool $dry): int
+    {
+        $due = $this->dormant()
+            ->whereNotNull('dormant_warned_at')
+            ->where('dormant_warned_at', '<=', now()->subDays(self::WARN_DAYS_BEFORE))
+            ->get()
+            ->filter(fn (User $user) => $this->dormantSince($user)
+                ->lte(now()->subDays(self::AFTER_DAYS)));
+
+        foreach ($due as $user) {
+            if ($dry) {
+                $this->line('would remove: '.$user->email.' (dormant since '.$this->dormantSince($user)->toDateString().')');
+
+                continue;
+            }
+
+            // Logged individually rather than as a count: an address that
+            // disappears is the kind of thing somebody asks about later, and a
+            // number in a log answers nothing.
+            Log::info('Removing a dormant account', [
+                'email' => $user->email,
+                'registered_at' => $user->created_at?->toIso8601String(),
+                'warned_at' => $user->dormant_warned_at?->toIso8601String(),
+            ]);
+
+            $user->delete();
+        }
+
+        return $due->count();
+    }
+
+    /**
+     * Confirmed, and with no customer record behind it at all.
+     *
+     * Drawn at the customer record rather than at "has no live package on
+     * record", and deliberately wider than it has to be:
+     *
+     *  - A customer record means somebody in the business knows this person —
+     *    an operator entered them, or a checkout created them. Removing the
+     *    login of a record we keep is half a deletion.
+     *  - Anything commercial (an order, a contract, an instance, an invoice)
+     *    hangs off a customer record, and invoices have to be kept for seven
+     *    years (§ 132 BAO). Skipping every customer record skips all of that
+     *    without having to enumerate it and without a new table sneaking past
+     *    the enumeration later.
+     *
+     * What is left is exactly the case this exists for: somebody registered,
+     * confirmed their address, never bought anything, and never came back.
+     * Registration alone creates no customer record.
+     *
+     * Both links count, by id and by address — see Customer::emailTaken for why
+     * one can exist without the other.
+     *
+     * @return \Illuminate\Database\Eloquent\Builder<User>
+     */
+    private function dormant()
+    {
+        return User::query()
+            ->whereNotNull('email_verified_at')
+            // Old enough to be worth looking at. The precise cut-off is applied
+            // per user afterwards, because it depends on the devices — and this
+            // one is <=, not <: a timestamp exactly at the threshold is stored to
+            // the second, and a stricter pre-filter would drop the very account
+            // the per-user check was about to catch.
+            ->where('created_at', '<=', now()->subDays(self::AFTER_DAYS - self::WARN_DAYS_BEFORE))
+            ->whereNotExists(fn ($q) => $q->selectRaw('1')->from('customers')
+                ->whereColumn('customers.user_id', 'users.id'))
+            ->whereNotExists(fn ($q) => $q->selectRaw('1')->from('customers')
+                ->whereColumn('customers.email', 'users.email'));
+    }
+
+    /**
+     * Since when this account has been doing nothing.
+     *
+     * The later of the registration and the last time any of its devices was
+     * seen: signing in resets the clock, which is what the terms say.
+     */
+    private function dormantSince(User $user): Carbon
+    {
+        // Scoped by guard as well as by id: operator 1 is not customer 1 (R21),
+        // and there is no devices() relation on User to hide that behind.
+        $lastSeen = UserDevice::query()
+            ->where('guard', 'web')
+            ->where('authenticatable_id', $user->id)
+            ->max('last_seen_at');
+
+        $since = $user->created_at ?? now();
+
+        return $lastSeen === null
+            ? $since
+            : Carbon::parse($lastSeen)->max($since);
+    }
+}
diff --git a/app/Console/Commands/PruneUnverifiedAccounts.php b/app/Console/Commands/PruneUnverifiedAccounts.php
new file mode 100644
index 0000000..d9513c3
--- /dev/null
+++ b/app/Console/Commands/PruneUnverifiedAccounts.php
@@ -0,0 +1,82 @@
+<?php
+
+namespace App\Console\Commands;
+
+use App\Models\Customer;
+use App\Models\User;
+use Illuminate\Console\Command;
+use Illuminate\Support\Facades\Log;
+
+/**
+ * Registrations nobody ever confirmed, removed.
+ *
+ * An abandoned attempt used to stay in `users` for ever, and it holds the
+ * address hostage while it does: the unique index means the same person cannot
+ * register again with the address they meant. "Abmelden und neu registrieren"
+ * was therefore advice that could not work — signing out frees nothing.
+ *
+ * Five days, because that is long enough for somebody who registered on a
+ * Friday, found the mail in a spam folder on Monday, and clicked it — and short
+ * enough that a typo does not block the correct address for a month.
+ *
+ * What it will NOT touch, and this is the important half:
+ *
+ *  - a confirmed account, whatever else is true of it;
+ *  - an account with a customer record behind it. A paid checkout creates the
+ *    login through the webhook, and such a user can sit unconfirmed while
+ *    already having a contract. Deleting that is data loss, not housekeeping.
+ */
+class PruneUnverifiedAccounts extends Command
+{
+    /** How long an unconfirmed registration is kept. */
+    public const AFTER_DAYS = 5;
+
+    protected $signature = 'clupilot:prune-unverified {--dry-run : Only say what would go}';
+
+    protected $description = 'Delete registrations that were never confirmed';
+
+    public function handle(): int
+    {
+        $stale = User::query()
+            ->whereNull('email_verified_at')
+            ->where('created_at', '<', now()->subDays(self::AFTER_DAYS))
+            // Not a join: the two tables are linked by user_id OR by address
+            // (see Customer::emailTaken — a row can predate or outlive the
+            // other), and either one means somebody is a customer.
+            ->whereNotExists(fn ($q) => $q->selectRaw('1')->from('customers')
+                ->whereColumn('customers.user_id', 'users.id'))
+            ->whereNotExists(fn ($q) => $q->selectRaw('1')->from('customers')
+                ->whereColumn('customers.email', 'users.email'))
+            ->get();
+
+        if ($stale->isEmpty()) {
+            $this->info('Nothing to remove.');
+
+            return self::SUCCESS;
+        }
+
+        if ($this->option('dry-run')) {
+            foreach ($stale as $user) {
+                $this->line('would remove: '.$user->email.' (registered '.$user->created_at->toDateString().')');
+            }
+
+            return self::SUCCESS;
+        }
+
+        foreach ($stale as $user) {
+            // Logged individually rather than as a count: an address that
+            // disappears is the kind of thing somebody asks about later, and a
+            // number in a log answers nothing.
+            Log::info('Removing an unconfirmed registration', [
+                'email' => $user->email,
+                'registered_at' => $user->created_at?->toIso8601String(),
+            ]);
+
+            $user->delete();
+        }
+
+        $this->info($stale->count().' unconfirmed registration(s) removed.');
+
+        return self::SUCCESS;
+    }
+}
diff --git a/app/Console/Commands/PublishProcessingAgreement.php b/app/Console/Commands/PublishProcessingAgreement.php
new file mode 100644
index 0000000..4a97309
--- /dev/null
+++ b/app/Console/Commands/PublishProcessingAgreement.php
@@ -0,0 +1,85 @@
+<?php
+
+namespace App\Console\Commands;
+
+use App\Models\DpaVersion;
+use App\Services\Legal\DpaRenderer;
+use Illuminate\Console\Command;
+use Illuminate\Support\Facades\Storage;
+
+/**
+ * Render the processing agreement and its annex, store them, put them in force.
+ *
+ * The documents are generated from the repository (resources/views/legal/dpa),
+ * so a change to the wording is a change somebody can review in a diff — and the
+ * company name, the sub-processors and the deletion deadlines come from the same
+ * places the rest of the application reads them, which is what stops the
+ * agreement drifting away from what the software does.
+ *
+ * The console's upload form still exists and is unchanged: a lawyer's revision
+ * arrives as a PDF and becomes a version like any other. This command is for the
+ * version this application maintains itself.
+ */
+class PublishProcessingAgreement extends Command
+{
+    protected $signature = 'clupilot:publish-dpa
+        {version : What the document calls itself, e.g. 1.0}
+        {--draft : Store it without putting it in force}';
+
+    protected $description = 'Render the processing agreement and its annex, and put them in force';
+
+    public function handle(DpaRenderer $renderer): int
+    {
+        $version = (string) $this->argument('version');
+
+        if (DpaVersion::query()->where('version', $version)->exists()) {
+            $this->error("Version {$version} already exists. Pick another name — two documents under one name makes every acceptance ambiguous.");
+
+            return self::FAILURE;
+        }
+
+        $agreementPath = 'dpa/av-vertrag-'.$this->slug($version).'.pdf';
+        $measuresPath = 'dpa/tom-'.$this->slug($version).'.pdf';
+
+        // Visibility "public" is about the FILE MODE, not about the web: this
+        // disk's root is outside the document root and nothing here becomes
+        // reachable by URL. What it changes is 0755/0644 instead of 0700/0600 —
+        // and that is the difference between a document the web process can read
+        // and one it cannot.
+        //
+        // It matters because this command is normally run as root (an artisan
+        // call in a container is root; PHP-FPM is www-data). The first run left
+        // a directory only root could enter, the route's exists() check answered
+        // false, and every link on the page 404'd with nothing in any log to say
+        // why.
+        Storage::disk('local')->put($agreementPath, $renderer->agreement($version), 'public');
+        Storage::disk('local')->put($measuresPath, $renderer->measures($version), 'public');
+
+        $row = DpaVersion::query()->create([
+            'version' => $version,
+            'agreement_path' => $agreementPath,
+            'measures_path' => $measuresPath,
+            // Publishing is the point of the command; --draft is for looking at
+            // it first. Every customer who accepted an earlier version is
+            // outstanding again from this moment.
+            'published_at' => $this->option('draft') ? null : now(),
+        ]);
+
+        foreach ([$agreementPath, $measuresPath] as $path) {
+            if (Storage::disk('local')->getVisibility($path) !== 'public') {
+                $this->warn("{$path} is not readable by the web process. Run this as the user PHP runs as, or fix the mode — the page will 404 otherwise.");
+            }
+        }
+
+        $this->info(($this->option('draft') ? 'Drafted' : 'Published').' version '.$row->version.'.');
+        $this->line('  '.$agreementPath.' ('.number_format(strlen(Storage::disk('local')->get($agreementPath)) / 1024, 0).' KB)');
+        $this->line('  '.$measuresPath.' ('.number_format(strlen(Storage::disk('local')->get($measuresPath)) / 1024, 0).' KB)');
+
+        return self::SUCCESS;
+    }
+
+    private function slug(string $version): string
+    {
+        return preg_replace('/[^a-z0-9.-]+/i', '-', $version) ?: 'version';
+    }
+}
diff --git a/app/Console/Commands/SyncStripeCatalogue.php b/app/Console/Commands/SyncStripeCatalogue.php
index d7ba574..f33270b 100644
--- a/app/Console/Commands/SyncStripeCatalogue.php
+++ b/app/Console/Commands/SyncStripeCatalogue.php
@@ -142,9 +142,27 @@ class SyncStripeCatalogue extends Command
                     $productId = $stripe->createProduct(
                         $family->name,
                         ['plan_family' => $family->key, 'plan_family_id' => (string) $family->id],
-                        // Keyed on our row, so a crash between Stripe creating
-                        // the product and us storing its id gives back the same
-                        // product on the next run rather than a second one.
+                        // Covers a RETRY, for twenty-four hours, and nothing
+                        // after that: Stripe forgets a key at the end of them.
+                        // A crash between Stripe creating the Product and us
+                        // storing its id therefore leaves an orphan, and the
+                        // next run past the expiry makes a second Product for
+                        // this family. There is no recognition step for Products
+                        // — App\Services\Billing\AdoptStripePrice covers Prices
+                        // only — so nothing here ever asks Stripe what Products
+                        // it already has. A KNOWN GAP, not something this key
+                        // closes, and a worse one than a duplicate Price:
+                        // activePricesFor() would then be asked about the new
+                        // Product, and the Price recognition goes blind for the
+                        // whole family.
+                        //
+                        // IdempotencyKey::forProduct() folds the name and the
+                        // metadata into what goes on the wire, so a renamed
+                        // family under an unstored id now mints a second Product
+                        // where it used to answer HTTP 400 for a day. That is
+                        // the trade this branch chose deliberately: a blockade
+                        // reaches a paying customer, a duplicate Product does
+                        // not.
                         idempotencyKey: "clupilot-product-{$family->id}",
                     );
                     $family->update(['stripe_product_id' => $productId]);
@@ -168,9 +186,16 @@ class SyncStripeCatalogue extends Command
             return self::SUCCESS;
         }
 
+        // "or adopted", because the count is taken BEFORE ensure() runs and
+        // ensure() may find the Price already at Stripe and adopt it instead of
+        // creating anything — see App\Services\Billing\AdoptStripePrice. Telling
+        // which of the two happened is the whole purpose of that step, so the
+        // first thing an operator reads after an interrupted run must not assert
+        // a creation that did not take place. The log entry adoption writes names
+        // the Price it took over.
         $this->info($dryRun
-            ? "{$created} object(s) would be created. Run without --dry-run to create them."
-            : "{$created} object(s) created in Stripe.");
+            ? "{$created} object(s) would be created or adopted. Run without --dry-run to do it."
+            : "{$created} object(s) created or adopted in Stripe.");
 
         return self::SUCCESS;
     }
diff --git a/app/Http/Controllers/CheckoutController.php b/app/Http/Controllers/CheckoutController.php
index 38c1b68..3193012 100644
--- a/app/Http/Controllers/CheckoutController.php
+++ b/app/Http/Controllers/CheckoutController.php
@@ -53,16 +53,19 @@ class CheckoutController extends Controller
         $data = $request->validate([
             'plan' => ['required', 'string', 'max:64'],
             'term' => ['nullable', 'in:'.Subscription::TERM_MONTHLY.','.Subscription::TERM_YEARLY],
-            // The consumer's express request that we begin inside the
-            // fourteen-day withdrawal window (FAGG §16, §356 BGB). Required,
-            // because the cloud starts being built the moment the payment
-            // lands: without this on record a withdrawal on day thirteen gets
-            // the WHOLE amount back, however many days the machine actually
-            // ran. A seller who cannot prove the consent was given cannot
-            // charge for the days — and the proof is a timestamp taken here.
-            'immediate_start' => ['accepted'],
+            // Acceptance of the terms, which is where everything about this
+            // sale is regulated: the delivery, the price, the fourteen-day
+            // withdrawal right, and the consumer's express request that we
+            // begin inside that window (FAGG §16, §356 BGB) — a cloud is built
+            // the moment the payment lands, so that request cannot be avoided
+            // and is stated on the checkbox as well as in the terms.
+            //
+            // Required. An order cannot be submitted without it: the box is the
+            // declaration, and the browser only disables the button — this is
+            // the line that actually refuses.
+            'terms_accepted' => ['accepted'],
         ], [
-            'immediate_start.accepted' => __('checkout.immediate_start_required'),
+            'terms_accepted.accepted' => __('checkout.terms_required'),
         ]);
 
         $term = $data['term'] ?? Subscription::TERM_MONTHLY;
@@ -156,6 +159,13 @@ class CheckoutController extends Controller
                     // than being stamped here — the contract only exists once
                     // the payment does, and a consent recorded for a checkout
                     // somebody abandoned would be a consent to nothing.
+                    //
+                    // The KEY keeps its old name deliberately. The form field it
+                    // came from is called terms_accepted now, but a checkout
+                    // session opened before a deploy is paid after it, and the
+                    // webhook would find nothing under a new name. What it
+                    // records is unchanged: the customer declared, at this
+                    // moment, that we may start at once.
                     'immediate_start' => '1',
                     // What part of Stripe's amount_total is the setup fee, so the
                     // webhook can tell the two apart again: the package's charge
diff --git a/app/Http/Controllers/LandingController.php b/app/Http/Controllers/LandingController.php
index 5e0af28..6bcd6d2 100644
--- a/app/Http/Controllers/LandingController.php
+++ b/app/Http/Controllers/LandingController.php
@@ -510,6 +510,21 @@ class LandingController extends Controller
                 // and for them the net figure was simply the wrong number.
                 'price' => $this->money($this->gross((int) $plan['price_cents']), (string) $plan['currency']),
                 'price_net' => $this->money((int) $plan['price_cents'], (string) $plan['currency']),
+                // Paying for a year, in the same three figures the order page
+                // shows: what leaves the account once, what that works out to
+                // per month, and what twelve monthly payments would have been.
+                // A sheet that quotes only the monthly price cannot mention a
+                // saving, and the saving is the reason to offer the term.
+                'price_yearly' => $this->money(
+                    $yearlyGross = $this->gross((int) ($plan['yearly_price_cents'] ?? 0)),
+                    (string) $plan['currency'],
+                ),
+                'price_yearly_net' => $this->money((int) ($plan['yearly_price_cents'] ?? 0), (string) $plan['currency']),
+                // intdiv, so the headline never claims a tenth of a cent nobody
+                // is charged; the total beside it is the amount actually taken.
+                'price_yearly_monthly' => $this->money(intdiv($yearlyGross, 12), (string) $plan['currency']),
+                'price_twelve_months' => $this->money($this->gross((int) $plan['price_cents']) * 12, (string) $plan['currency']),
+                'free_months' => (int) ($plan['free_months'] ?? 0),
                 'storage' => $this->storage((int) $plan['quota_gb']),
                 'traffic' => $this->storage((int) $plan['traffic_gb']),
                 'seats' => (int) $plan['seats'],
diff --git a/app/Livewire/Admin/ConfirmPublishDpa.php b/app/Livewire/Admin/ConfirmPublishDpa.php
new file mode 100644
index 0000000..64ce619
--- /dev/null
+++ b/app/Livewire/Admin/ConfirmPublishDpa.php
@@ -0,0 +1,45 @@
+<?php
+
+namespace App\Livewire\Admin;
+
+use App\Models\DpaVersion;
+use LivewireUI\Modal\ModalComponent;
+
+/**
+ * Confirmation before a processing agreement goes into force (R23).
+ *
+ * Publishing is not a save: acceptance is per version, so from this moment every
+ * customer who had accepted the previous one is outstanding again. That is the
+ * correct behaviour and an expensive one to trigger by a misplaced click.
+ *
+ * Mutates nothing itself — it dispatches back to ProcessingAgreements, whose
+ * publish() keeps the permission check it already had.
+ */
+class ConfirmPublishDpa extends ModalComponent
+{
+    public string $uuid;
+
+    public string $version = '';
+
+    public function mount(string $uuid): void
+    {
+        $this->authorize('dpa.manage');
+
+        $version = DpaVersion::query()->where('uuid', $uuid)->firstOrFail();
+
+        $this->uuid = $uuid;
+        $this->version = $version->version;
+    }
+
+    public function confirm(): void
+    {
+        $this->authorize('dpa.manage');
+        $this->dispatch('dpa-publish-confirmed', uuid: $this->uuid);
+        $this->closeModal();
+    }
+
+    public function render()
+    {
+        return view('livewire.admin.confirm-publish-dpa');
+    }
+}
diff --git a/app/Livewire/Admin/EditCustomer.php b/app/Livewire/Admin/EditCustomer.php
index 06e5b47..76ad9e8 100644
--- a/app/Livewire/Admin/EditCustomer.php
+++ b/app/Livewire/Admin/EditCustomer.php
@@ -52,7 +52,19 @@ class EditCustomer extends ModalComponent
 
     public string $vatId = '';
 
-    public string $billingAddress = '';
+    /**
+     * The address, field by field — the same four the customer's own settings
+     * page writes. One free-text block here and four fields there would mean an
+     * operator's correction being silently reverted the next time the customer
+     * saved their profile: their fields still held the old values.
+     */
+    public string $billingStreet = '';
+
+    public string $billingPostcode = '';
+
+    public string $billingCity = '';
+
+    public string $billingCountry = '';
 
     public string $locale = '';
 
@@ -74,7 +86,10 @@ class EditCustomer extends ModalComponent
         $this->phone = (string) $customer->phone;
         $this->customerType = (string) $customer->customer_type;
         $this->vatId = (string) $customer->vat_id;
-        $this->billingAddress = (string) $customer->billing_address;
+        $this->billingStreet = (string) $customer->billing_street;
+        $this->billingPostcode = (string) $customer->billing_postcode;
+        $this->billingCity = (string) $customer->billing_city;
+        $this->billingCountry = (string) $customer->billing_country;
         $this->locale = (string) $customer->locale;
         $this->originalEmail = (string) $customer->email;
         $this->originalVatId = (string) $customer->vat_id;
@@ -104,7 +119,10 @@ class EditCustomer extends ModalComponent
             // cleared back to "nobody asked".
             'customerType' => ['nullable', Rule::in(Customer::TYPES)],
             'vatId' => 'nullable|string|max:64',
-            'billingAddress' => 'nullable|string|max:2000',
+            'billingStreet' => 'nullable|string|max:255',
+            'billingPostcode' => 'nullable|string|max:32',
+            'billingCity' => 'nullable|string|max:255',
+            'billingCountry' => 'nullable|string|max:255',
             'locale' => ['nullable', Rule::in(self::LOCALES)],
         ]);
 
@@ -147,7 +165,14 @@ class EditCustomer extends ModalComponent
                 // left alone: it is the record of what was checked, and clearing
                 // it would destroy the evidence rather than the claim.
                 'vat_id' => trim((string) $data['vatId']) ?: null,
-                'billing_address' => trim((string) $data['billingAddress']) ?: null,
+                'billing_street' => trim((string) $data['billingStreet']) ?: null,
+                'billing_postcode' => trim((string) $data['billingPostcode']) ?: null,
+                'billing_city' => trim((string) $data['billingCity']) ?: null,
+                'billing_country' => trim((string) $data['billingCountry']) ?: null,
+                // The composed block, from the same composer the portal uses —
+                // one shape for one field, whichever side writes it. An address
+                // that was never split keeps the block it had.
+                'billing_address' => \App\Livewire\Settings::composeAddress($data) ?: $customer->billing_address,
                 'locale' => $data['locale'] ?: null,
             ]);
 
diff --git a/app/Livewire/Admin/Inbox.php b/app/Livewire/Admin/Inbox.php
index 0204def..f6443f4 100644
--- a/app/Livewire/Admin/Inbox.php
+++ b/app/Livewire/Admin/Inbox.php
@@ -6,6 +6,7 @@ use App\Models\Customer;
 use App\Models\InboundMail;
 use App\Services\Mail\IngestInboundMail;
 use App\Services\Mail\InboundMailbox;
+use App\Services\Mail\InboundMailStatus;
 use Livewire\Attributes\Layout;
 use Livewire\Attributes\Url;
 use Livewire\Component;
@@ -127,6 +128,11 @@ class Inbox extends Component
             // explain: a mailbox that was never configured looks exactly like a
             // mailbox with no mail in it.
             'configured' => app(InboundMailbox::class)->isConfigured(),
+            // The same line the settings page shows. This is where somebody
+            // notices nothing is arriving, so this is where "last reached" has
+            // to be readable — otherwise an empty inbox and a broken mailbox
+            // look identical.
+            'status' => app(InboundMailStatus::class)->last(),
         ]);
     }
 }
diff --git a/app/Livewire/Admin/Integrations.php b/app/Livewire/Admin/Integrations.php
index a5ab5b3..6c314d2 100644
--- a/app/Livewire/Admin/Integrations.php
+++ b/app/Livewire/Admin/Integrations.php
@@ -6,6 +6,8 @@ use App\Livewire\Concerns\ConfirmsPassword;
 use App\Services\Deployment\UpdateChannel;
 use App\Services\Env\EnvFileEditor;
 use App\Services\Env\InvalidEnvContentException;
+use App\Services\Mail\InboundMailbox;
+use App\Services\Mail\InboundMailStatus;
 use App\Services\Secrets\SecretVault;
 use App\Support\OperatingMode;
 use App\Support\ProvisioningSettings;
@@ -429,6 +431,32 @@ class Integrations extends Component
         abort_unless($this->passwordRecentlyConfirmed(), 403);
     }
 
+    /**
+     * Reach the support mailbox now and say what came back.
+     *
+     * The one thing an operator wants after typing a host, a user and a
+     * password: did any of it work. Waiting for the next scheduled run to find
+     * out is not an answer, and "der Posteingang ist leer" is not one either.
+     *
+     * Saved first, deliberately: testing what is on screen while the server
+     * still holds the previous values would report on a mailbox nobody
+     * configured. The unsaved form is the question being asked.
+     */
+    public function testInbound(): void
+    {
+        $this->guardInfra();
+        $this->saveInfra();
+
+        $check = app(InboundMailbox::class)->check();
+        app(InboundMailStatus::class)->record($check['ok'], $check['message'], $check['unseen']);
+
+        $this->dispatch('notify', message: $check['ok']
+            ? ($check['unseen'] === null
+                ? __('integrations.inbound_ok')
+                : trans_choice('integrations.inbound_ok_waiting', $check['unseen'], ['count' => $check['unseen']]))
+            : __('integrations.inbound_failed_'.$check['message']));
+    }
+
     public function render()
     {
         $vault = app(SecretVault::class);
@@ -487,6 +515,9 @@ class Integrations extends Component
                 self::TABS,
                 fn (string $tab) => $tab !== 'env' || $canSecrets,
             )),
+            // When the mailbox was last reached, and what came back. Null until
+            // somebody — or the scheduler — has asked once.
+            'inboundStatus' => app(InboundMailStatus::class)->last(),
             'canSecrets' => $canSecrets,
             'canInfra' => $canInfra,
             'unlocked' => $unlocked,
diff --git a/app/Livewire/Admin/MailPreview.php b/app/Livewire/Admin/MailPreview.php
new file mode 100644
index 0000000..e4e6a3d
--- /dev/null
+++ b/app/Livewire/Admin/MailPreview.php
@@ -0,0 +1,106 @@
+<?php
+
+namespace App\Livewire\Admin;
+
+use App\Services\Mail\MailPreviews;
+use Illuminate\Support\Facades\Auth;
+use Illuminate\Support\Facades\Mail;
+use Livewire\Attributes\Layout;
+use Livewire\Component;
+use Throwable;
+
+/**
+ * Look at a mail before a customer does.
+ *
+ * There was no way to. An invoice mail needs an invoice, a maintenance
+ * announcement needs a window, and "register an account to see whether the
+ * confirmation reads well on a phone" is not a workflow — which is how every
+ * mail went out with a hard 600px table until somebody opened one on a
+ * telephone and had to scroll sideways to read a sentence.
+ *
+ * Two ways to look: in the browser, which answers the desktop question at once,
+ * and as a real mail to the operator's OWN address, which is the only way to
+ * answer the phone question. Never to a customer: a preview is for us.
+ */
+#[Layout('layouts.admin')]
+class MailPreview extends Component
+{
+    public function mount(): void
+    {
+        $this->authorize('mail.manage');
+    }
+
+    /**
+     * Send one to the signed-in operator.
+     *
+     * To themselves and nobody else — no address field. A preview that can be
+     * addressed is a form for sending mail to strangers from inside the console,
+     * which is not what this is for and not something to leave lying about.
+     */
+    public function sendToMe(string $key): void
+    {
+        $this->authorize('mail.manage');
+
+        $operator = Auth::guard('operator')->user();
+        $mailable = app(MailPreviews::class)->make($key);
+
+        if ($operator === null || $mailable === null) {
+            return;
+        }
+
+        try {
+            // sendNow(), not send(): every mailable here implements ShouldQueue,
+            // and send() silently defers to queue() for those — which would put
+            // a failure in a worker's log while the button reported success. The
+            // person pressing it is waiting for the mail, so the send happens in
+            // their request and its failure reaches them.
+            //
+            // Through the mailable's OWN mailer. Mail::to() hands back a pending
+            // mail bound to the DEFAULT mailer, and sendNow() then ignores the
+            // mailer the mailable asked for — so a support mail addressed
+            // support@ went out over the no-reply@ login and the server answered
+            // "553 Sender address rejected: not owned by user". Every purpose
+            // mailbox here has its own SMTP account, and the From has to belong
+            // to the account that authenticates.
+            Mail::mailer($mailable->mailer ?: null)
+                ->to($operator->email)
+                ->sendNow($mailable);
+        } catch (Throwable $e) {
+            $this->dispatch('notify', message: __('mail_preview.failed', [
+                'reason' => mb_substr($e->getMessage(), 0, 160),
+            ]));
+
+            return;
+        }
+
+        $this->dispatch('notify', message: __('mail_preview.sent', ['email' => $operator->email]));
+    }
+
+    public function render()
+    {
+        $this->authorize('mail.manage');
+
+        $previews = app(MailPreviews::class)->all();
+
+        return view('livewire.admin.mail-preview', [
+            'previews' => $previews,
+            // Read off the mailables rather than kept as a second list: the
+            // sender is decided by the purpose mailbox, and a table here would
+            // be a copy that drifts.
+            // From the envelope, not from the mailable's `from` property: that
+            // property stays empty until the mail is built, so reading it here
+            // showed nothing at all.
+            'senders' => collect($previews)
+                ->keys()
+                ->mapWithKeys(fn (string $key) => [
+                    $key => app(MailPreviews::class)->make($key)?->envelope()->from?->address,
+                ])
+                ->all(),
+            'me' => Auth::guard('operator')->user()?->email ?? '',
+            // A preview that goes nowhere is worse than none: with a
+            // non-delivering mailer the browser view still works and the send
+            // silently writes to a file.
+            'delivers' => ! in_array(config('mail.default'), ['log', 'array', null], true),
+        ]);
+    }
+}
diff --git a/app/Livewire/Admin/Overview.php b/app/Livewire/Admin/Overview.php
index 30fd08e..4ebc4df 100644
--- a/app/Livewire/Admin/Overview.php
+++ b/app/Livewire/Admin/Overview.php
@@ -3,6 +3,7 @@
 namespace App\Livewire\Admin;
 
 use App\Livewire\Concerns\BuildsRunSteps;
+use App\Mail\Transport\MailboxTransport;
 use App\Models\Customer;
 use App\Models\Host;
 use App\Models\Instance;
@@ -11,7 +12,9 @@ use App\Models\ProvisioningRun;
 use App\Models\Subscription;
 use App\Services\Billing\PlanCatalogue;
 use App\Services\Provisioning\HostCapacity;
+use App\Support\AdminArea;
 use App\Support\Readiness;
+use App\Support\Settings;
 use Illuminate\Support\Carbon;
 use Illuminate\Support\Number;
 use Livewire\Attributes\Layout;
@@ -369,6 +372,57 @@ class Overview extends Component
             ])];
         }
 
+        // The site being switched off. It is a deliberate state, not a fault —
+        // but it answers 503 to every visitor who is not on the VPN, and the
+        // only place that says so is the switch itself, three clicks away on
+        // another page. Asked as "ich komme nicht auf www.dev", which is exactly
+        // what it looks like from outside.
+        if (! Settings::bool('site.public', true)) {
+            $notices[] = [
+                'level' => 'warning',
+                'text' => __('admin.notice.site_hidden'),
+                'route' => 'admin.settings',
+            ];
+        }
+
+        // MAIL_MAILER=log. Every purpose mailer short-circuits to the log
+        // transport then — see MailboxTransport::NON_DELIVERING — however well
+        // the mailboxes are configured, and nothing is delivered to anybody.
+        //
+        // Worth its own notice because the failure is SILENT in every direction:
+        // the queue reports success, no job fails, the console's own mailbox test
+        // reports success (MailboxTester builds its own transport on purpose), and
+        // the mail sits in storage/logs. Somebody registering and waiting for a
+        // verification mail has no way to find that out. Asked exactly that way.
+        if (in_array(config('mail.default'), MailboxTransport::NON_DELIVERING, true)) {
+            $notices[] = [
+                'level' => 'warning',
+                'text' => __('admin.notice.mail_not_delivering', ['mailer' => (string) (config('mail.default') ?? 'null')]),
+                'route' => 'admin.mail',
+            ];
+        }
+
+        // No SITE_HOST. The marketing site is then registered without a
+        // hostname, so it answers on the PORTAL's host as well — and every
+        // route() it generates points at APP_URL, which is why a link on the
+        // site lands on the portal's domain.
+        //
+        // Only where the installation is host-separated at all. On a fresh
+        // checkout nothing is bound to a hostname by design (see
+        // RestrictAdminHost: "upgrading must not lock anyone out of a system
+        // that was working"), and a warning there would be furniture — the same
+        // mistake the capacity notice made before it learned to ask whether
+        // there is a host at all.
+        if (AdminArea::isHostBound() && config('admin_access.site_hosts') === []) {
+            $notices[] = [
+                'level' => 'warning',
+                'text' => __('admin.notice.no_site_host', [
+                    'app' => (string) parse_url((string) config('app.url'), PHP_URL_HOST),
+                ]),
+                'route' => 'admin.integrations',
+            ];
+        }
+
         // What is not yet set up at all, as opposed to everything above (what
         // IS set up but currently unhealthy). Readiness::blocking() is the
         // same list App\Livewire\Admin\Readiness renders in full — this is
diff --git a/app/Livewire/Admin/PlanVersions.php b/app/Livewire/Admin/PlanVersions.php
index f86d0f9..0b9611b 100644
--- a/app/Livewire/Admin/PlanVersions.php
+++ b/app/Livewire/Admin/PlanVersions.php
@@ -53,7 +53,17 @@ class PlanVersions extends Component
      */
     public string $monthlyPrice = '49,00';
 
-    public string $yearlyPrice = '588,00';
+    /**
+     * How many of the twelve months a year costs nothing.
+     *
+     * The yearly TOTAL used to be typed here as a second free-form figure, and
+     * nothing then knew why 588 belonged to a package costing 49 — so no page
+     * could say "two months free" without somebody working it out again by hand.
+     * The total is derived from this (see yearlyCents), which is also the only
+     * arrangement in which the sentence a customer reads and the amount Stripe
+     * charges cannot drift apart.
+     */
+    public int $freeMonths = 2;
 
     /** Publishing: when it goes on sale, and optionally when it stops. */
     public string $availableFrom = '';
@@ -85,12 +95,22 @@ class PlanVersions extends Component
             $this->features = $latest->features ?? [];
 
             $monthly = $latest->priceFor(Subscription::TERM_MONTHLY);
-            $yearly = $latest->priceFor(Subscription::TERM_YEARLY);
             $this->monthlyPrice = Money::fromCents($monthly?->amount_cents ?? 4900);
-            $this->yearlyPrice = Money::fromCents($yearly?->amount_cents ?? 58800);
+            $this->freeMonths = (int) $latest->free_months;
         }
     }
 
+    /**
+     * What a year costs: the months that are paid for, at the monthly price.
+     *
+     * One place, static, so the preview on the form and the amount written to
+     * the catalogue are the same arithmetic rather than two copies of it.
+     */
+    public static function yearlyCents(int $monthlyCents, int $freeMonths): int
+    {
+        return $monthlyCents * (12 - max(0, min(12, $freeMonths)));
+    }
+
     private function family(): PlanFamily
     {
         return PlanFamily::query()->where('uuid', $this->uuid)->firstOrFail();
@@ -137,11 +157,14 @@ class PlanVersions extends Component
                     $fail(__('plans.price_invalid'));
                 }
             }],
-            'yearlyPrice' => ['required', 'string', $price],
+            // Nought is a legitimate answer — "a year costs twelve months, pay
+            // it in one go" — and the upper bound stops at six, because eleven
+            // free months is a typo and not a discount.
+            'freeMonths' => 'required|integer|min:0|max:6',
         ]);
 
         $monthlyCents = Money::toCents($data['monthlyPrice']);
-        $yearlyCents = Money::toCents($data['yearlyPrice']);
+        $yearlyCents = self::yearlyCents((int) $monthlyCents, (int) $data['freeMonths']);
 
         $version = app(PlanCatalogue::class)->draft(
             $this->family(),
@@ -155,6 +178,7 @@ class PlanVersions extends Component
                 'performance' => $data['performance'],
                 'template_vmid' => $data['templateVmid'],
                 'features' => array_values($data['features']),
+                'free_months' => (int) $data['freeMonths'],
             ],
             // Both terms, because publishing refuses a version that is not
             // priced for each — better to find that out here than in front of
@@ -317,6 +341,13 @@ class PlanVersions extends Component
             'featureKeys' => array_keys((array) __('billing.feature')),
             'performanceClasses' => (array) __('billing.perf'),
             'currency' => Subscription::catalogueCurrency(),
+            // What a year will cost, worked out here so the form shows the same
+            // figure it is about to write. Null while the monthly price is not a
+            // number yet — the field says so on its own, and a preview of
+            // nothing is worse than no preview.
+            'yearlyPreview' => ($cents = Money::toCents($this->monthlyPrice)) === null
+                ? null
+                : self::yearlyCents((int) $cents, $this->freeMonths),
         ]);
     }
 }
diff --git a/app/Livewire/Admin/ProcessingAgreements.php b/app/Livewire/Admin/ProcessingAgreements.php
new file mode 100644
index 0000000..6a35497
--- /dev/null
+++ b/app/Livewire/Admin/ProcessingAgreements.php
@@ -0,0 +1,137 @@
+<?php
+
+namespace App\Livewire\Admin;
+
+use App\Models\Customer;
+use App\Models\DpaVersion;
+use App\Services\Legal\ProcessingAgreement;
+use Illuminate\Support\Facades\Auth;
+use Illuminate\Support\Facades\Storage;
+use Livewire\Attributes\Layout;
+use Livewire\Attributes\On;
+use Livewire\Component;
+use Livewire\WithFileUploads;
+
+/**
+ * The data-processing agreement: upload a version, publish it, see who has it.
+ *
+ * The TEXT is not this application's and never will be. Art. 28(3) GDPR wants a
+ * contract between the controller (the customer) and the processor (us); what
+ * belongs in it is a lawyer's answer, and inventing one here would be worse than
+ * having none. What this page does is the part software can do properly: keep
+ * the document, say which version is in force, hand it to the customer, and hold
+ * the evidence that they accepted it.
+ *
+ * ## Publishing is what asks every customer again
+ *
+ * Acceptance is per VERSION. Publishing a new one therefore leaves every
+ * customer outstanding until they accept it, which is the correct behaviour and
+ * an expensive one to trigger by accident — so a draft is uploaded first and
+ * published deliberately, in two steps.
+ */
+#[Layout('layouts.admin')]
+class ProcessingAgreements extends Component
+{
+    use WithFileUploads;
+
+    /** What the document itself calls this version — "1.0", "2026-08". */
+    public string $version = '';
+
+    public string $note = '';
+
+    /** The agreement, and the technical and organisational measures beside it. */
+    public $agreement = null;
+
+    public $measures = null;
+
+    public function mount(): void
+    {
+        $this->authorize('dpa.manage');
+    }
+
+    public function upload(): void
+    {
+        $this->authorize('dpa.manage');
+
+        $data = $this->validate([
+            'version' => 'required|string|max:64|unique:dpa_versions,version',
+            'note' => 'nullable|string|max:2000',
+            // PDF only, and a real size limit: this is handed to customers as
+            // the contract between us, not as an editable file.
+            'agreement' => 'required|file|mimes:pdf|max:10240',
+            'measures' => 'nullable|file|mimes:pdf|max:10240',
+        ]);
+
+        // The private DISK. An agreement is not a public asset, and a guessable
+        // URL to one would be a list of who our customers are — the root of this
+        // disk is outside the document root and nothing here is reachable except
+        // through the two routes that check who is asking.
+        //
+        // The visibility below is the file MODE, not the web: 0755/0644 rather
+        // than 0700/0600, so a document written by one process (an artisan run
+        // as root) stays readable by the other (PHP-FPM as www-data). Getting
+        // that wrong produced a directory nothing could enter and a page whose
+        // every link 404'd silently.
+        $version = DpaVersion::query()->create([
+            'version' => $data['version'],
+            'note' => $data['note'] ?: null,
+            'agreement_path' => $this->agreement->store('dpa', 'local', 'public'),
+            'measures_path' => $this->measures?->store('dpa', 'local', 'public'),
+            'created_by' => Auth::guard('operator')->id(),
+        ]);
+
+        $this->reset('version', 'note', 'agreement', 'measures');
+
+        $this->dispatch('notify', message: __('dpa_admin.uploaded', ['version' => $version->version]));
+    }
+
+    /**
+     * Put a version in force.
+     *
+     * Deliberately separate from the upload: every customer who had accepted the
+     * previous one is outstanding again from this moment, and that is not
+     * something to do by dropping a file on a form.
+     */
+    #[On('dpa-publish-confirmed')]
+    public function publish(string $uuid): void
+    {
+        $this->authorize('dpa.manage');
+
+        $version = DpaVersion::query()->where('uuid', $uuid)->firstOrFail();
+
+        if ($version->isPublished()) {
+            return;
+        }
+
+        $version->update(['published_at' => now()]);
+
+        $this->dispatch('notify', message: __('dpa_admin.published', ['version' => $version->version]));
+    }
+
+    public function render()
+    {
+        $this->authorize('dpa.manage');
+
+        $current = app(ProcessingAgreement::class)->current();
+
+        // How many customers are outstanding on the version in force. Counted
+        // against customers who are actually still customers — a closed record
+        // is not somebody we are waiting on.
+        $customers = Customer::query()->whereNull('closed_at')->count();
+        $accepted = $current === null ? 0 : $current->acceptances()->count();
+
+        return view('livewire.admin.processing-agreements', [
+            'versions' => DpaVersion::query()->withCount('acceptances')->latest('id')->get(),
+            'current' => $current,
+            'customers' => $customers,
+            'accepted' => $accepted,
+            'outstanding' => max(0, $customers - $accepted),
+        ]);
+    }
+
+    /** Whether a stored file is actually there, for the list. */
+    public function exists(?string $path): bool
+    {
+        return $path !== null && Storage::disk('local')->exists($path);
+    }
+}
diff --git a/app/Livewire/Auth/VerifyEmail.php b/app/Livewire/Auth/VerifyEmail.php
index ad621e4..fd936fb 100644
--- a/app/Livewire/Auth/VerifyEmail.php
+++ b/app/Livewire/Auth/VerifyEmail.php
@@ -2,18 +2,26 @@
 
 namespace App\Livewire\Auth;
 
+use App\Models\Customer;
 use Illuminate\Support\Facades\Auth;
 use Illuminate\Support\Facades\RateLimiter;
 use Livewire\Attributes\Layout;
+use Livewire\Attributes\On;
 use Livewire\Component;
 
 /**
  * Where somebody waits between registering and confirming.
  *
  * Signed in but not through: the account exists, and nothing in the portal
- * opens until the address is confirmed. The page therefore has to offer the
- * only two things that can move somebody forward — send it again, or sign out
- * and register with the address they meant.
+ * opens until the address is confirmed. The page offers the two things that can
+ * move somebody forward — send it again, or throw the account away and start
+ * over with the address they meant.
+ *
+ * "Abmelden und neu registrieren" used to be the second one, and it was wrong
+ * twice: signing out does not free the address, so registering again with the
+ * same one fails — and every abandoned attempt stays in `users` for ever. The
+ * button deletes the account instead, and anything nobody comes back to is
+ * removed after PruneUnverifiedAccounts::AFTER_DAYS days.
  *
  * Fortify would own this page, but 'views' => false: the app renders its own
  * screens (R1/R2) and Fortify keeps only the POST actions.
@@ -70,13 +78,49 @@ class VerifyEmail extends Component
         $this->dispatch('notify', message: __('verify_email.notice_sent'));
     }
 
-    public function signOut()
+    /**
+     * Throw this registration away.
+     *
+     * Only an UNCONFIRMED account, and only one nothing is attached to. The
+     * webhook creates a customer's login from a paid checkout, and such a user
+     * can sit here unconfirmed while already having a contract — deleting that
+     * would be data loss dressed up as a convenience. It refuses and says where
+     * to go instead.
+     *
+     * R23: the confirmation is a modal, not a browser dialog. This method is
+     * what the modal's event reaches, and it re-checks everything itself
+     * because a modal is reachable without this page's own guards.
+     */
+    #[On('own-account-delete-confirmed')]
+    public function deleteAccount()
     {
+        $user = Auth::user();
+
+        if ($user === null) {
+            return $this->redirectRoute('login', navigate: false);
+        }
+
+        if ($user->hasVerifiedEmail()) {
+            // Confirmed accounts are closed, not deleted — that is a different
+            // action, with an invoice history behind it (ConfirmCloseAccount).
+            return $this->redirectRoute('dashboard', navigate: false);
+        }
+
+        if (Customer::query()->where('user_id', $user->getKey())->exists()
+            || Customer::query()->where('email', $user->email)->exists()) {
+            $this->dispatch('notify', message: __('verify_email.delete_has_contract'));
+
+            return null;
+        }
+
         Auth::guard('web')->logout();
+        $user->delete();
+
         session()->invalidate();
         session()->regenerateToken();
+        session()->flash('status', __('verify_email.deleted'));
 
-        return $this->redirectRoute('login', navigate: false);
+        return $this->redirectRoute('register', navigate: false);
     }
 
     public function render()
diff --git a/app/Livewire/Billing.php b/app/Livewire/Billing.php
index 23c9b64..8b16e09 100644
--- a/app/Livewire/Billing.php
+++ b/app/Livewire/Billing.php
@@ -466,6 +466,12 @@ class Billing extends Component
             // Per month: the card says "/ month", and a yearly contract stores
             // the whole year.
             'price_cents' => $subscription->monthlyPriceCents(),
+            // Which term is running, and what leaves the account when it does.
+            // The figure above is per month either way, so a yearly customer
+            // read a number they never see on a statement and nothing said why.
+            'term' => (string) $subscription->term,
+            'term_total_cents' => (int) $subscription->price_cents,
+            'renews_at' => $subscription->current_period_end,
             // The portal shows a granted package without a price at all — not
             // "free", not struck through — so a later conversion to paid does
             // not read as a negotiation.
@@ -548,12 +554,35 @@ class Billing extends Component
         $customer = $this->customer();
         $instance = $customer?->instances()->latest('id')->first();
         $plans = app(PlanCatalogue::class)->sellable();
-        $currentKey = $instance?->plan ?? 'start';
+
+        // The contract, resolved from the CUSTOMER rather than from the
+        // instance: a paid order waiting for a machine has a subscription and no
+        // instance yet (see ReserveResources, which parks it), and asking the
+        // instance would report "no package" at somebody who has paid.
+        $contract = $customer === null ? null : Subscription::query()
+            ->where('customer_id', $customer->id)
+            ->whereIn('status', ['active', 'past_due'])
+            ->latest('id')
+            ->first();
+
+        // Whether there is anything to show at all. Without this the page fell
+        // back to 'start' for a customer who had bought nothing and rendered it
+        // as "AKTUELLES PAKET Start — Status Aktiv": a contract nobody entered
+        // into, on the page a customer opens to find out what they pay. Reported
+        // straight after registering, and the dashboard said the opposite on the
+        // same account.
+        // An INSTANCE counts too, whatever the subscription rows say: a running
+        // cloud is a contract by any reading a customer cares about, and older
+        // installations have instances whose subscription row predates the
+        // catalogue rebuild.
+        $hasContract = $contract !== null || $instance !== null;
+
+        $currentKey = $instance?->plan ?? $contract?->plan ?? (string) array_key_first($plans);
 
         // Rank, not price: a grandfathered plan can cost less than a smaller
         // one does today, and offering that as an "upgrade" would charge a
         // customer immediately for losing resources.
-        $currentTier = (int) ($instance?->subscription?->tier ?? $plans[$currentKey]['tier'] ?? 0);
+        $currentTier = (int) ($instance?->subscription?->tier ?? $contract?->tier ?? $plans[$currentKey]['tier'] ?? 0);
 
         // Smaller plans, each with the reason it cannot be taken today. Shown
         // WITH the reason rather than hidden: a customer who cannot downgrade
@@ -577,12 +606,13 @@ class Billing extends Component
             : collect();
 
         return view('livewire.billing', [
+            'hasContract' => $hasContract,
             'currentKey' => $currentKey,
             // What they HAVE comes from their contract; only what they could
             // BUY comes from the shop. Reading this off the catalogue showed a
             // customer today's price as though it were theirs, and dropped the
             // card entirely once their plan stopped being sold.
-            'current' => $this->currentTerms($instance?->subscription, $instance, $plans[$currentKey] ?? []),
+            'current' => $this->currentTerms($instance?->subscription ?? $contract, $instance, $plans[$currentKey] ?? []),
             'instance' => $instance,
             'plans' => $plans,
             'features' => collect($plans)->map(fn ($p) => $p['features'] ?? [])->all(),
diff --git a/app/Livewire/Checkout.php b/app/Livewire/Checkout.php
new file mode 100644
index 0000000..5d053ad
--- /dev/null
+++ b/app/Livewire/Checkout.php
@@ -0,0 +1,153 @@
+<?php
+
+namespace App\Livewire;
+
+use App\Models\Customer;
+use App\Models\Subscription;
+use App\Services\Billing\PlanCatalogue;
+use App\Services\Billing\SetupFee;
+use App\Services\Billing\TaxTreatment;
+use App\Services\Provisioning\HostCapacity;
+use App\Support\CompanyProfile;
+use Illuminate\Support\Facades\Auth;
+use Livewire\Attributes\Layout;
+use Livewire\Attributes\Url;
+use Livewire\Component;
+use Throwable;
+
+/**
+ * The order, before it is placed.
+ *
+ * There was no such page. The order page posted straight to Stripe, so the last
+ * thing a customer saw in this product's own design was a grid of packages, and
+ * the first thing they saw after pressing was somebody else's payment form
+ * asking for a card. What they were buying, what it costs in total, what happens
+ * afterwards and what they were agreeing to were never stated in one place.
+ *
+ * This is that place: one package, one term, every figure that will be charged,
+ * and the terms acceptance directly above the button that spends money — which
+ * is also where it belongs and where the owner asked for it.
+ *
+ * ## It decides nothing
+ *
+ * Every figure here comes from the same three sources the checkout itself uses —
+ * the catalogue, TaxTreatment, SetupFee — and none of them is recomputed. A
+ * summary that works out its own total is a second answer waiting to disagree
+ * with the first, and the one that matters is the one Stripe is handed.
+ */
+#[Layout('layouts.portal-app')]
+class Checkout extends Component
+{
+    /** Which package. In the address, so this page can be reloaded and shared. */
+    #[Url]
+    public string $plan = '';
+
+    /** Monthly or yearly — carried from the choice on the order page. */
+    #[Url]
+    public string $term = Subscription::TERM_MONTHLY;
+
+    public function mount(): void
+    {
+        if (! in_array($this->term, [Subscription::TERM_MONTHLY, Subscription::TERM_YEARLY], true)) {
+            $this->term = Subscription::TERM_MONTHLY;
+        }
+    }
+
+    public function render()
+    {
+        $user = Auth::user();
+        $customer = $user === null ? null : Customer::query()->where('email', $user->email)->first();
+
+        // Someone who already has a contract does not buy a second one by
+        // accident: changing package is a plan change, which prorates and keeps
+        // their data. Same rule as the order page, checked again here because a
+        // link into this page skips that one.
+        $contract = $customer === null ? null : Subscription::query()
+            ->where('customer_id', $customer->id)
+            ->whereIn('status', ['active', 'past_due'])
+            ->first();
+
+        $tax = TaxTreatment::for($customer);
+        // NOT called `plan` in the view: the public property of that name is a
+        // key, a string, and Livewire merges its properties into the view data —
+        // so a package array under the same name is shadowed by it and every
+        // `$plan['name']` in the template reads an offset off a string.
+        $package = $this->plan === '' ? null : $this->planOf($this->plan);
+
+        return view('livewire.checkout', [
+            'package' => $package,
+            'contract' => $contract,
+            'tax' => $tax,
+            'lines' => $package === null ? [] : $this->lines($package, $tax),
+            'vat' => rtrim(rtrim(number_format(CompanyProfile::taxRate(), 1, ',', '.'), '0'), ','),
+        ]);
+    }
+
+    /**
+     * The chosen package as the shop describes it, or null when the key names
+     * nothing on sale — a URL is a string somebody can retype.
+     *
+     * @return array<string, mixed>|null
+     */
+    private function planOf(string $key): ?array
+    {
+        try {
+            $sellable = app(PlanCatalogue::class)->sellable();
+        } catch (Throwable) {
+            // The catalogue fails loudly by design; a customer's page is not
+            // the place to argue about it. No package, one sentence.
+            return null;
+        }
+
+        if (! array_key_exists($key, $sellable)) {
+            return null;
+        }
+
+        $plan = $sellable[$key];
+
+        return $plan + [
+            'key' => $key,
+            'delivery' => app(HostCapacity::class)->deliveryFor((int) ($plan['disk_gb'] ?? 0)),
+        ];
+    }
+
+    /**
+     * What will be charged, line by line, in the order an invoice states it.
+     *
+     * Net, tax and gross come from TaxTreatment rather than from a
+     * multiplication here: a business with a valid EU VAT number outside Austria
+     * pays no Austrian tax at all, and a summary that "adds 20 %" would quote
+     * that customer a total they will never be charged.
+     *
+     * @param  array<string, mixed>  $plan
+     * @return array<string, mixed>
+     */
+    private function lines(array $plan, TaxTreatment $tax): array
+    {
+        $yearly = $this->term === Subscription::TERM_YEARLY;
+
+        $recurringNet = (int) ($yearly ? $plan['yearly_price_cents'] : $plan['price_cents']);
+        $recurringGross = $tax->chargeCents($recurringNet);
+        $setupGross = SetupFee::chargedCents($tax);
+        $setupNet = SetupFee::netCents();
+
+        return [
+            'currency' => (string) $plan['currency'],
+            'recurring_net' => $recurringNet,
+            'recurring_gross' => $recurringGross,
+            'setup_net' => $setupNet,
+            'setup_gross' => $setupGross,
+            // What leaves the account on the first charge: the term plus the
+            // one-off. Every figure afterwards is the term alone.
+            'today_net' => $recurringNet + $setupNet,
+            'today_gross' => $recurringGross + $setupGross,
+            'today_tax' => ($recurringGross + $setupGross) - ($recurringNet + $setupNet),
+            'yearly' => $yearly,
+            'free_months' => (int) ($plan['free_months'] ?? 0),
+            // Only on the yearly view, and only when there is something to
+            // compare against: twelve monthly charges at the monthly price.
+            'twelve_months_gross' => $tax->chargeCents((int) $plan['price_cents']) * 12,
+            'per_month_gross' => $yearly ? intdiv($recurringGross, 12) : $recurringGross,
+        ];
+    }
+}
diff --git a/app/Livewire/ConfirmCancelPackage.php b/app/Livewire/ConfirmCancelPackage.php
index f0919e1..3d2a543 100644
--- a/app/Livewire/ConfirmCancelPackage.php
+++ b/app/Livewire/ConfirmCancelPackage.php
@@ -6,6 +6,7 @@ use App\Livewire\Concerns\ResolvesCustomer;
 use App\Models\Customer;
 use App\Models\Instance;
 use App\Models\Subscription;
+use App\Services\Billing\WithdrawalRight;
 use App\Services\Stripe\StripeClient;
 use Illuminate\Support\Carbon;
 use Illuminate\Support\Facades\Log;
@@ -46,6 +47,12 @@ class ConfirmCancelPackage extends ModalComponent
 
     public string $confirmName = '';
 
+    /** Why. One of Subscription::CANCEL_REASONS. */
+    public string $reason = '';
+
+    /** What they wanted to say about it — required when the reason is "other". */
+    public string $note = '';
+
     public function cancelPackage()
     {
         $customer = $this->customer();
@@ -68,6 +75,22 @@ class ConfirmCancelPackage extends ModalComponent
             return;
         }
 
+        // Asked, and required. A departure with no reason on it is the one fact
+        // about it worth having, and "we can ask them later" means never: the
+        // customer is here now and never comes back to this form.
+        if (! in_array($this->reason, Subscription::CANCEL_REASONS, true)) {
+            $this->addError('reason', __('settings.cancel_reason_required'));
+
+            return;
+        }
+
+        // "Sonstiges" with nothing beside it is the same as no answer at all.
+        if ($this->reason === 'other' && trim($this->note) === '') {
+            $this->addError('note', __('settings.cancel_note_required'));
+
+            return;
+        }
+
         $contract = $this->contractFor($customer, $instance);
 
         if (! $this->stopBilling($contract)) {
@@ -86,7 +109,11 @@ class ConfirmCancelPackage extends ModalComponent
         // half of the application can tell a cancelled contract from an untouched
         // one — and the status deliberately stays `active`, because until the term
         // runs out this is a paying customer.
-        $contract?->update(['cancel_requested_at' => now()]);
+        $contract?->update([
+            'cancel_requested_at' => now(),
+            'cancel_reason' => $this->reason,
+            'cancel_reason_note' => trim($this->note) ?: null,
+        ]);
 
         return $this->redirectRoute('settings', navigate: true);
     }
@@ -200,10 +227,26 @@ class ConfirmCancelPackage extends ModalComponent
 
     public function render()
     {
-        $instance = $this->customer()?->instances()->where('status', 'active')->latest('id')->first();
+        $customer = $this->customer();
+        $instance = $customer?->instances()->where('status', 'active')->latest('id')->first();
+
+        // Whether withdrawing is still open to them. Offered as a way OUT of
+        // this dialogue rather than as a reason inside it: a withdrawal is a
+        // different act with a different consequence — the whole amount back and
+        // the service ending the same day — and somebody who is entitled to one
+        // should not cancel by mistake and lose it. WithdrawalRight answers for
+        // a business customer as well: it says no.
+        // contractFor() needs an instance; with none there is nothing to
+        // withdraw from either, and WithdrawalRight answers null with "no".
+        $withdrawal = WithdrawalRight::for(
+            $instance === null ? null : $this->contractFor($customer, $instance)
+        );
 
         return view('livewire.confirm-cancel-package', [
             'subdomain' => $instance?->subdomain ?? '',
+            'reasons' => Subscription::CANCEL_REASONS,
+            'canWithdraw' => $withdrawal->applies && $withdrawal->open,
+            'withdrawalEndsAt' => $withdrawal->endsAt,
         ]);
     }
 }
diff --git a/app/Livewire/ConfirmDeleteOwnAccount.php b/app/Livewire/ConfirmDeleteOwnAccount.php
new file mode 100644
index 0000000..e8de50e
--- /dev/null
+++ b/app/Livewire/ConfirmDeleteOwnAccount.php
@@ -0,0 +1,28 @@
+<?php
+
+namespace App\Livewire;
+
+use LivewireUI\Modal\ModalComponent;
+
+/**
+ * "Diese Registrierung wirklich verwerfen?"
+ *
+ * R23: a consequence is confirmed in this product's own design, never in a
+ * window the browser draws. The modal mutates nothing — it dispatches the event
+ * the page component listens for, so the checks that decide whether the account
+ * may be deleted stay in the one place they already are (Auth\VerifyEmail),
+ * rather than being duplicated here where they could drift.
+ */
+class ConfirmDeleteOwnAccount extends ModalComponent
+{
+    public function confirm(): void
+    {
+        $this->dispatch('own-account-delete-confirmed');
+        $this->closeModal();
+    }
+
+    public function render()
+    {
+        return view('livewire.confirm-delete-own-account');
+    }
+}
diff --git a/app/Livewire/Order.php b/app/Livewire/Order.php
index d8f309d..295c9cb 100644
--- a/app/Livewire/Order.php
+++ b/app/Livewire/Order.php
@@ -34,7 +34,12 @@ use Throwable;
  * purchase becomes real on the webhook, which is the only place allowed to
  * believe a payment happened.
  */
-#[Layout('layouts.portal')]
+// layouts.portal is the bare shell the SIGN-IN pages use: no navigation, no
+// page padding. This page is reached signed in and behind `verified`, so it
+// belongs in the app shell like every other portal page — Dashboard and Billing
+// were already there. In the wrong one it rendered flush against the top and
+// bottom of the window with no way back to anything.
+#[Layout('layouts.portal-app')]
 class Order extends Component
 {
     public function render()
@@ -100,6 +105,9 @@ class Order extends Component
 
         foreach ($sellable as $key => $plan) {
             $net = (int) $plan['price_cents'];
+            $yearlyNet = (int) ($plan['yearly_price_cents'] ?? $net * 12);
+            $yearlyGross = $tax->chargeCents($yearlyNet);
+            $freeMonths = (int) ($plan['free_months'] ?? 0);
 
             $plans[] = [
                 'key' => $key,
@@ -107,6 +115,16 @@ class Order extends Component
                 'audience' => (string) ($plan['audience'] ?? ''),
                 'gross' => $tax->chargeCents($net),
                 'net' => $net,
+                // Paying for a year, in the three figures somebody compares:
+                // what leaves the account once, what that works out to per
+                // month, and what it would have cost month by month.
+                'yearly_gross' => $yearlyGross,
+                'yearly_net' => $yearlyNet,
+                // intdiv, so the headline figure never claims a tenth of a cent
+                // nobody is charged. The total above it is the amount taken.
+                'yearly_per_month' => intdiv($yearlyGross, 12),
+                'twelve_months_gross' => $tax->chargeCents($net) * 12,
+                'free_months' => $freeMonths,
                 'currency' => (string) $plan['currency'],
                 'quota_gb' => (int) $plan['quota_gb'],
                 'traffic_gb' => (int) $plan['traffic_gb'],
diff --git a/app/Livewire/Settings.php b/app/Livewire/Settings.php
index 336216f..dd4c3eb 100644
--- a/app/Livewire/Settings.php
+++ b/app/Livewire/Settings.php
@@ -10,6 +10,7 @@ use App\Livewire\Concerns\ResolvesCustomer;
 use App\Models\Customer;
 use App\Services\Billing\CustomDomainAccess;
 use App\Services\Billing\WithdrawalRight;
+use App\Services\Legal\ProcessingAgreement;
 use Illuminate\Support\Facades\Storage;
 use Illuminate\Validation\Rule;
 use Illuminate\Validation\ValidationException;
@@ -19,16 +20,52 @@ use Laravel\Fortify\Actions\EnableTwoFactorAuthentication;
 use Laravel\Fortify\Actions\GenerateNewRecoveryCodes;
 use Livewire\Attributes\Layout;
 use Livewire\Attributes\On;
+use Livewire\Attributes\Url;
 use Livewire\Attributes\Validate;
 use Livewire\Component;
 use Livewire\WithFileUploads;
 use RuntimeException;
 
+/**
+ * The customer's own settings.
+ *
+ * It was one column, 768 pixels wide inside a 1240-pixel shell — a third of the
+ * window left empty beside it — and everything a customer might ever change was
+ * stacked in it: the company address, their password, two-factor, the devices
+ * they are signed in on, the branding of their cloud, the contract, and the
+ * button that closes the account. Two thousand pixels of scroll, and the way to
+ * a particular thing was to know how far down it lived.
+ *
+ * Four tabs now, by what somebody came to do: their data, how the account is
+ * protected, how the cloud looks, and the contract. The choice lives in the
+ * query string, so a reload, a bookmark and the back button all land where they
+ * were — and a link to this page can name the part it means.
+ */
 class Settings extends Component
 {
     use ChangesOwnPassword;
     use ConfirmsPassword;
 
+    /**
+     * The tabs, in the order they are shown.
+     *
+     * The list IS the schema: it validates the query string, builds the tab bar
+     * and decides which section renders. A fourth place to add a tab is a fourth
+     * place to forget one.
+     */
+    public const TABS = ['profile', 'security', 'branding', 'contract'];
+
+    /**
+     * Which one is open, taken from and written back to the address.
+     *
+     * `history: true`, so each tab is a step the back button can take, and no
+     * `except`, so the parameter is there from the first render — hiding it on
+     * the default reads as "the tab is not in the URL", which is exactly how it
+     * was reported on the console's settings page.
+     */
+    #[Url(history: true)]
+    public string $tab = 'profile';
+
     /** Shown once, right after setting two-factor up. */
     public ?array $recoveryCodes = null;
 
@@ -138,8 +175,29 @@ class Settings extends Component
     #[Validate('nullable|string|max:64')]
     public string $vatId = '';
 
-    #[Validate('nullable|string|max:2000')]
-    public string $billingAddress = '';
+    /**
+     * The billing address, field by field.
+     *
+     * It was one textarea, so what landed in it was whatever somebody typed — a
+     * postcode on the street line, a city with no postcode, no country at all.
+     * An invoice has to name its recipient precisely enough to be a document.
+     *
+     * `customers.billing_address` still exists and is written from these on
+     * every save: everything that already reads it (IssueInvoice, the console's
+     * customer page) keeps working, and a record nobody has re-saved keeps the
+     * block it always had rather than being guessed apart.
+     */
+    #[Validate('nullable|string|max:255')]
+    public string $billingStreet = '';
+
+    #[Validate('nullable|string|max:32')]
+    public string $billingPostcode = '';
+
+    #[Validate('nullable|string|max:255')]
+    public string $billingCity = '';
+
+    #[Validate('nullable|string|max:255')]
+    public string $billingCountry = '';
 
     // Branding
     #[Validate('nullable|string|max:255')]
@@ -158,6 +216,13 @@ class Settings extends Component
 
     public function mount(): void
     {
+        // A tab name out of the URL is a string a stranger typed. Anything
+        // unknown falls back to the first rather than rendering a settings page
+        // with no section on it at all.
+        if (! in_array($this->tab, self::TABS, true)) {
+            $this->tab = self::TABS[0];
+        }
+
         $c = $this->customer();
         if ($c === null) {
             return;
@@ -167,7 +232,10 @@ class Settings extends Component
         $this->phone = $c->phone ?? '';
         $this->customerType = $c->customer_type ?? '';
         $this->vatId = $c->vat_id ?? '';
-        $this->billingAddress = $c->billing_address ?? '';
+        $this->billingStreet = $c->billing_street ?? '';
+        $this->billingPostcode = $c->billing_postcode ?? '';
+        $this->billingCity = $c->billing_city ?? '';
+        $this->billingCountry = $c->billing_country ?? '';
         $this->brandDisplayName = $c->brand_display_name ?? '';
         $this->brandPrimary = $c->brand_primary_color ?? '';
         $this->brandAccent = $c->brand_accent_color ?? '';
@@ -191,25 +259,61 @@ class Settings extends Component
             // who never touched this field — but no third value can ever get in.
             'customerType' => ['nullable', Rule::in(Customer::TYPES)],
             'vatId' => 'nullable|string|max:64',
-            'billingAddress' => 'nullable|string|max:2000',
+            'billingStreet' => 'nullable|string|max:255',
+            'billingPostcode' => 'nullable|string|max:32',
+            'billingCity' => 'nullable|string|max:255',
+            'billingCountry' => 'nullable|string|max:255',
         ]);
 
         $c->update([
             'name' => $data['companyName'],
             'contact_name' => $data['contactName'] ?: null,
             'phone' => $data['phone'] ?: null,
-            // Never cleared back to "unrecorded" from here. Once somebody has
-            // answered, the answer stands until it is replaced by the other one:
-            // a form submitted with the field blank must not quietly undo a
-            // recorded consumer into an unknown.
-            'customer_type' => $data['customerType'] ?: $c->customer_type,
+            // FIXED once it is on record, and this is the line that fixes it.
+            //
+            // It decides the fourteen-day right of withdrawal, and a business
+            // that could set itself to "Privatperson" here would be a business
+            // that can withdraw from a contract it has no right to withdraw
+            // from. That is why registration asks the question and why this form
+            // cannot answer it a second time. A record that has none — created
+            // before the question existed — may still be given one, once.
+            'customer_type' => $c->customer_type ?: ($data['customerType'] ?: null),
             'vat_id' => $data['vatId'] ?: null,
-            'billing_address' => $data['billingAddress'] ?: null,
+            'billing_street' => $data['billingStreet'] ?: null,
+            'billing_postcode' => $data['billingPostcode'] ?: null,
+            'billing_city' => $data['billingCity'] ?: null,
+            'billing_country' => $data['billingCountry'] ?: null,
+            // The composed block, rewritten from the fields. Everything that
+            // reads an address today reads this one.
+            'billing_address' => self::composeAddress($data) ?: $c->billing_address,
         ]);
 
         $this->dispatch('notify', message: $this->verifyVatId($c));
     }
 
+    /**
+     * The four fields as the block every reader already expects.
+     *
+     * Street, then postcode and city on one line, then the country — the shape
+     * an address takes on an Austrian invoice. Empty in, empty out: a customer
+     * who has filled in nothing must not be given a document with two blank
+     * lines and a comma on it.
+     *
+     * @param  array<string, mixed>  $data
+     */
+    public static function composeAddress(array $data): string
+    {
+        $city = trim(trim((string) ($data['billingPostcode'] ?? '')).' '.trim((string) ($data['billingCity'] ?? '')));
+
+        $lines = array_filter([
+            trim((string) ($data['billingStreet'] ?? '')),
+            $city,
+            trim((string) ($data['billingCountry'] ?? '')),
+        ], fn (string $line) => $line !== '');
+
+        return implode("\n", $lines);
+    }
+
     /**
      * Check the number against the register, and say what came back.
      *
@@ -293,6 +397,32 @@ class Settings extends Component
      * never seen this card can still name the method — so the refusal is made
      * where the mutation is, once, in the customer's own words.
      */
+    /**
+     * Accept the processing agreement in force.
+     *
+     * One press, no dialogue: this is an agreement, not a deletion, and putting
+     * a confirmation in front of it would only make the record harder to obtain.
+     * The evidence — the moment, the address, the login — is taken by the
+     * service, so nothing here can record an acceptance from an address it
+     * invented.
+     */
+    public function acceptProcessingAgreement(): void
+    {
+        $c = $this->requireCustomer();
+
+        if ($c === null) {
+            return;
+        }
+
+        if (app(ProcessingAgreement::class)->accept($c) === null) {
+            // Nothing published yet. The card does not render in that case, so
+            // reaching this line means somebody posted to it directly.
+            return;
+        }
+
+        $this->dispatch('notify', message: __('dpa.accepted_notice'));
+    }
+
     #[On('withdrawal-confirmed')]
     public function withdraw(): void
     {
@@ -358,6 +488,7 @@ class Settings extends Component
         $withdrawal = WithdrawalRight::for($contract);
 
         return view('livewire.settings', [
+            'tabs' => self::TABS,
             // Never the secret itself — only whether it exists, and the SVG
             // Fortify renders from it. The secret in a Livewire property would
             // travel to the browser and back in the component snapshot.
@@ -378,6 +509,11 @@ class Settings extends Component
             // thing somebody can choose. An unrecorded customer sees neither
             // selected, which is the truth about their record.
             'customerTypes' => Customer::TYPES,
+            // The processing agreement in force and this customer's acceptance
+            // of THAT version — an acceptance of a superseded one is history,
+            // not an answer (see ProcessingAgreement).
+            'dpa' => ($dpaService = app(ProcessingAgreement::class))->current(),
+            'dpaAcceptance' => $dpaService->acceptanceOf($c),
         ]);
     }
 }
diff --git a/app/Mail/DormantAccountWarningMail.php b/app/Mail/DormantAccountWarningMail.php
new file mode 100644
index 0000000..9f5ea31
--- /dev/null
+++ b/app/Mail/DormantAccountWarningMail.php
@@ -0,0 +1,48 @@
+<?php
+
+namespace App\Mail;
+
+use App\Mail\Concerns\SendsFromMailbox;
+use App\Models\User;
+use App\Services\Mail\MailPurpose;
+use Illuminate\Bus\Queueable;
+use Illuminate\Contracts\Queue\ShouldQueue;
+use Illuminate\Mail\Mailable;
+use Illuminate\Mail\Mailables\Content;
+use Illuminate\Mail\Mailables\Envelope;
+use Illuminate\Queue\SerializesModels;
+
+/**
+ * "Your account will be removed in a fortnight, and here is how to keep it."
+ *
+ * Sent once, a fortnight before an account that has never had a package is
+ * deleted for good (App\Console\Commands\PruneDormantAccounts). Not a marketing
+ * mail and not a nudge to buy something: it says what will happen, when, and that
+ * signing in is enough to stop it.
+ *
+ * From the SYSTEM mailbox — this is about the login, not about money and not
+ * about a running service.
+ */
+class DormantAccountWarningMail extends Mailable implements ShouldQueue
+{
+    use Queueable, SendsFromMailbox, SerializesModels;
+
+    public function __construct(public User $user, public int $days)
+    {
+        $this->mailer('cp_'.MailPurpose::SYSTEM);
+    }
+
+    public function envelope(): Envelope
+    {
+        return $this->mailboxEnvelope(MailPurpose::SYSTEM, __('dormant_mail.subject'));
+    }
+
+    public function content(): Content
+    {
+        return new Content(view: 'mail.dormant-warning', with: [
+            'name' => (string) $this->user->name,
+            'days' => $this->days,
+            'loginUrl' => route('login'),
+        ]);
+    }
+}
diff --git a/app/Mail/InvoiceMail.php b/app/Mail/InvoiceMail.php
index cc52021..bbe8d5d 100644
--- a/app/Mail/InvoiceMail.php
+++ b/app/Mail/InvoiceMail.php
@@ -28,7 +28,16 @@ class InvoiceMail extends Mailable implements ShouldQueue
 {
     use Queueable, SendsFromMailbox, SerializesModels;
 
-    public function __construct(public Invoice $invoice, public string $name) {}
+    public function __construct(public Invoice $invoice, public string $name)
+    {
+        // The mailer, alongside the From. A purpose mailbox authenticates with
+        // its OWN account, and a mail server lets an account send only from the
+        // address it owns — so a From of billing@ over the default mailer's
+        // no-reply@ login is answered "553 Sender address rejected: not owned by
+        // user". Setting the From from a mailbox and leaving the mailer at the
+        // default is a mail that renders perfectly and never arrives.
+        $this->mailer('cp_'.MailPurpose::BILLING);
+    }
 
     public function envelope(): Envelope
     {
diff --git a/app/Mail/OrderConfirmationMail.php b/app/Mail/OrderConfirmationMail.php
index ca0009b..5a3f23e 100644
--- a/app/Mail/OrderConfirmationMail.php
+++ b/app/Mail/OrderConfirmationMail.php
@@ -30,7 +30,16 @@ class OrderConfirmationMail extends Mailable implements ShouldQueue
 {
     use Queueable, SendsFromMailbox, SerializesModels;
 
-    public function __construct(public Order $order, public string $name) {}
+    public function __construct(public Order $order, public string $name)
+    {
+        // The mailer, alongside the From. A purpose mailbox authenticates with
+        // its OWN account, and a mail server lets an account send only from the
+        // address it owns — so a From of billing@ over the default mailer's
+        // no-reply@ login is answered "553 Sender address rejected: not owned by
+        // user". Setting the From from a mailbox and leaving the mailer at the
+        // default is a mail that renders perfectly and never arrives.
+        $this->mailer('cp_'.MailPurpose::BILLING);
+    }
 
     public function envelope(): Envelope
     {
diff --git a/app/Models/Customer.php b/app/Models/Customer.php
index da61ee5..8c300c4 100644
--- a/app/Models/Customer.php
+++ b/app/Models/Customer.php
@@ -117,6 +117,7 @@ class Customer extends Model
 
     protected $fillable = [
         'user_id', 'name', 'contact_name', 'email', 'customer_type', 'phone', 'vat_id', 'vat_id_verified_at', 'vat_id_verified_value', 'billing_address',
+        'billing_street', 'billing_postcode', 'billing_city', 'billing_country',
         'locale', 'stripe_customer_id', 'status', 'closed_at',
         'brand_display_name', 'brand_logo_path', 'brand_primary_color', 'brand_accent_color',
     ];
diff --git a/app/Models/DpaAcceptance.php b/app/Models/DpaAcceptance.php
new file mode 100644
index 0000000..b715121
--- /dev/null
+++ b/app/Models/DpaAcceptance.php
@@ -0,0 +1,42 @@
+<?php
+
+namespace App\Models;
+
+use App\Models\Concerns\HasUuid;
+use Illuminate\Database\Eloquent\Factories\HasFactory;
+use Illuminate\Database\Eloquent\Model;
+use Illuminate\Database\Eloquent\Relations\BelongsTo;
+
+/**
+ * That a customer accepted a particular version, when, and from where.
+ *
+ * Evidence, so nothing here is ever updated: a new version means a new row. What
+ * makes it evidence rather than a flag is the three fields beside the link — the
+ * moment, the address it came from, and the login that pressed the button.
+ */
+class DpaAcceptance extends Model
+{
+    use HasFactory, HasUuid;
+
+    protected $fillable = ['customer_id', 'dpa_version_id', 'user_id', 'ip', 'accepted_at'];
+
+    protected function casts(): array
+    {
+        return ['accepted_at' => 'datetime'];
+    }
+
+    public function customer(): BelongsTo
+    {
+        return $this->belongsTo(Customer::class);
+    }
+
+    public function version(): BelongsTo
+    {
+        return $this->belongsTo(DpaVersion::class, 'dpa_version_id');
+    }
+
+    public function user(): BelongsTo
+    {
+        return $this->belongsTo(User::class);
+    }
+}
diff --git a/app/Models/DpaVersion.php b/app/Models/DpaVersion.php
new file mode 100644
index 0000000..16bc583
--- /dev/null
+++ b/app/Models/DpaVersion.php
@@ -0,0 +1,60 @@
+<?php
+
+namespace App\Models;
+
+use App\Models\Concerns\HasUuid;
+use Illuminate\Database\Eloquent\Factories\HasFactory;
+use Illuminate\Database\Eloquent\Model;
+use Illuminate\Database\Eloquent\Relations\HasMany;
+
+/**
+ * One published version of the data-processing agreement.
+ *
+ * The TEXT is not this application's. An operator uploads the document their
+ * lawyer wrote, names the version, and publishes it; everything here is about
+ * serving that file and knowing which one is in force. The technical and
+ * organisational measures ride along as a second file rather than as a second
+ * concept — they are an annex to the agreement, and "which measures applied when
+ * this customer accepted" has to have one answer.
+ */
+class DpaVersion extends Model
+{
+    use HasFactory, HasUuid;
+
+    protected $fillable = ['version', 'agreement_path', 'measures_path', 'note', 'published_at', 'created_by'];
+
+    protected function casts(): array
+    {
+        return ['published_at' => 'datetime'];
+    }
+
+    /**
+     * The version in force: the newest published one.
+     *
+     * Newest by publication, not by id — a version prepared earlier and
+     * published later is the later one, and the id says nothing about that.
+     */
+    public static function current(): ?self
+    {
+        return static::query()
+            ->whereNotNull('published_at')
+            ->where('published_at', '<=', now())
+            ->latest('published_at')
+            ->first();
+    }
+
+    public function isPublished(): bool
+    {
+        return $this->published_at !== null && $this->published_at->isPast();
+    }
+
+    public function acceptances(): HasMany
+    {
+        return $this->hasMany(DpaAcceptance::class);
+    }
+
+    public function operator()
+    {
+        return $this->belongsTo(Operator::class, 'created_by');
+    }
+}
diff --git a/app/Models/PlanVersion.php b/app/Models/PlanVersion.php
index d554844..92b3fca 100644
--- a/app/Models/PlanVersion.php
+++ b/app/Models/PlanVersion.php
@@ -33,6 +33,10 @@ class PlanVersion extends Model
     public const FROZEN = [
         'plan_family_id', 'version', 'quota_gb', 'traffic_gb', 'seats', 'ram_mb',
         'cores', 'disk_gb', 'performance', 'template_vmid', 'features', 'published_at',
+        // How many of the twelve months a year costs nothing. Frozen with the
+        // rest: it is not presentation, it is what the customer bought — and the
+        // yearly amount in `plan_prices` was derived from it.
+        'free_months',
     ];
 
     protected $guarded = [];
@@ -156,6 +160,11 @@ class PlanVersion extends Model
             'quota_gb' => $this->quota_gb,
             'traffic_gb' => $this->traffic_gb,
             'seats' => $this->seats,
+            // Part of the terms, so it travels with them: every reader of the
+            // catalogue — the shop, the order page, the console — gets the
+            // figure from the version rather than dividing two prices and
+            // hoping the answer is whole.
+            'free_months' => (int) $this->free_months,
             'ram_mb' => $this->ram_mb,
             'cores' => $this->cores,
             'disk_gb' => $this->disk_gb,
diff --git a/app/Models/Subscription.php b/app/Models/Subscription.php
index 0163a6c..e3765bd 100644
--- a/app/Models/Subscription.php
+++ b/app/Models/Subscription.php
@@ -33,6 +33,31 @@ class Subscription extends Model
 
     protected $guarded = [];
 
+    /**
+     * Why a customer cancelled, as a fixed list.
+     *
+     * A free-text box alone answers nothing that can be counted, and "sonstiges"
+     * with a sentence beside it is worth more than eight boxes nobody ticks
+     * honestly. Keys, not sentences: the wording lives in the settings language
+     * files and can be rewritten without rewriting what is on record. (Written
+     * that way on purpose — a path with a star and a slash in it ends the
+     * docblock it is standing in.)
+     *
+     * `withdrawal` is deliberately NOT here. Withdrawing is a different act with
+     * a different consequence — the whole amount back and the service ending the
+     * same day — and it is recorded by WithdrawContract, not by a cancellation
+     * carrying a reason that says it was one.
+     */
+    public const CANCEL_REASONS = [
+        'too_expensive',
+        'missing_features',
+        'switching_provider',
+        'no_longer_needed',
+        'performance',
+        'support',
+        'other',
+    ];
+
     protected static function booted(): void
     {
         static::updating(function (self $subscription) {
diff --git a/app/Models/User.php b/app/Models/User.php
index 12c58a7..9ee8281 100644
--- a/app/Models/User.php
+++ b/app/Models/User.php
@@ -64,6 +64,9 @@ class User extends Authenticatable implements MustVerifyEmail
     {
         return [
             'email_verified_at' => 'datetime',
+            // When we told this account it would be removed for having no
+            // package — see App\Console\Commands\PruneDormantAccounts.
+            'dormant_warned_at' => 'datetime',
             'password' => 'hashed',
             // is_admin itself is dead: nothing reads it any more (see
             // Operator/the operator guard). The column stays because dropping
diff --git a/app/Services/Billing/AddonPrices.php b/app/Services/Billing/AddonPrices.php
index 6973cdd..ecb49bd 100644
--- a/app/Services/Billing/AddonPrices.php
+++ b/app/Services/Billing/AddonPrices.php
@@ -44,7 +44,10 @@ use Illuminate\Database\UniqueConstraintViolationException;
  */
 final class AddonPrices
 {
-    public function __construct(private readonly StripeClient $stripe) {}
+    public function __construct(
+        private readonly StripeClient $stripe,
+        private readonly AdoptStripePrice $adopt,
+    ) {}
 
     /**
      * The net a whole term of this module costs.
@@ -125,30 +128,45 @@ final class AddonPrices
 
         $productId = $this->product($addonKey);
 
-        $priceId = $this->stripe->createPrice(
+        $metadata = [
+            // Read back when a Stripe invoice line has to be turned into
+            // wording a customer can read — see StripeInvoiceLines.
+            'addon' => $addonKey,
+            // Which of the module's two Prices this is, for anyone reading
+            // Stripe's own dashboard, where they would otherwise differ only
+            // by an amount.
+            'tax_treatment' => $reverseCharge ? 'reverse_charge' : 'domestic',
+        ];
+
+        // Asked BEFORE minting, because a run that died between Stripe's create
+        // and our insert left a Price no table of ours knows — and the key below
+        // stops protecting it after twenty-four hours. See AdoptStripePrice for
+        // what may be taken over and why so narrowly.
+        $priceId = ($this->adopt)(
             productId: $productId,
             amountCents: $amount,
             currency: $currency,
             interval: $interval,
-            metadata: [
-                // Read back when a Stripe invoice line has to be turned into
-                // wording a customer can read — see StripeInvoiceLines.
-                'addon' => $addonKey,
-                // Which of the module's two Prices this is, for anyone reading
-                // Stripe's own dashboard, where they would otherwise differ only
-                // by an amount.
-                'tax_treatment' => $reverseCharge ? 'reverse_charge' : 'domestic',
-            ],
-            // Keyed on what the Price IS, so a crash between Stripe creating it
-            // and us storing its id gives back the same Price on the next
-            // attempt rather than a second one at the same money. The amount is
-            // the CHARGED one, so the move from net to gross does not replay the
-            // net Price the old key was minted under — and the treatment is in
-            // there because at a rate of nought the two Prices are the same
-            // amount: one key would have Stripe hand the same object back for
-            // both, and the two rows would then share a Price, so archiving the
-            // gross one at the next rate change would withdraw the very Price the
-            // net side is still selling.
+            metadata: $metadata,
+            identifying: ['addon'],
+            claimed: fn (string $id) => StripeAddonPrice::query()
+                ->where('stripe_price_id', $id)
+                ->exists(),
+        );
+
+        $priceId ??= $this->stripe->createPrice(
+            productId: $productId,
+            amountCents: $amount,
+            currency: $currency,
+            interval: $interval,
+            metadata: $metadata,
+            // Says "I have already sent this call", nothing more. The amount is
+            // the CHARGED one and the treatment is in there because at a rate of
+            // nought the two Prices are the same amount — but what stops a
+            // second Price for one figure is AdoptStripePrice above, not this:
+            // Stripe forgets a key after twenty-four hours. The metadata is
+            // folded in by IdempotencyKey inside the client, so changing the
+            // format above can never again refuse the call for a day.
             idempotencyKey: "clupilot-addon-price-{$addonKey}-{$interval}-{$amount}-{$currency}"
                 .($reverseCharge ? '-rc' : ''),
         );
@@ -269,6 +287,11 @@ final class AddonPrices
         return $this->stripe->createProduct(
             app(AddonCatalogue::class)->name($addonKey),
             ['addon' => $addonKey],
+            // A retry's guard for twenty-four hours and nothing beyond them, the
+            // same as the plan side's in SyncStripeCatalogue — and the same known
+            // gap: there is no recognition step for Products, so a run that
+            // created this one and died before any row carried its id leaves an
+            // orphan nothing here will ever ask Stripe about.
             idempotencyKey: "clupilot-addon-product-{$addonKey}",
         );
     }
@@ -298,6 +321,28 @@ final class AddonPrices
             // Two bookings of the same module landed together. Stripe replayed
             // one Price for both — the idempotency key saw to that — so there is
             // nothing to correct here beyond letting the first row stand.
+            //
+            // Since the unique index on `stripe_price_id` below, this catch has a
+            // SECOND meaning: another TUPLE claims this Price id, which is two
+            // callers adopting the same orphan at once. The outcome then is no row
+            // for this tuple at all, not "the first row stands" — the row that
+            // exists belongs to the other tuple. That self-heals on the next
+            // ensure(): the orphan is claimed, so adoption refuses it and
+            // createPrice() mints this tuple its own Price. No money moves in the
+            // meantime, because both callers matched the same `unit_amount`
+            // before adopting; what a caller gets back here is the Price id it
+            // asked for, and it charges what was asked.
+            //
+            // What keeps two ROWS off one Price id is the `claimed` callback in
+            // ensure(), asked before minting. The unique index on
+            // `stripe_price_id` (`stripe_addon_prices_price_unique`, since
+            // 2026_07_31_210000_one_row_per_stripe_price, matching
+            // `stripe_plan_prices.stripe_price_id` on the plan side) is the net
+            // UNDER that callback, not a substitute for it — two rows sharing one
+            // Price would be worse than the ordinary duplicate this catch
+            // handles: archiving one — the ordinary response to a superseded
+            // figure — would then withdraw the very Price the other row is still
+            // selling.
         }
     }
 }
diff --git a/app/Services/Billing/AdoptStripePrice.php b/app/Services/Billing/AdoptStripePrice.php
new file mode 100644
index 0000000..41461d5
--- /dev/null
+++ b/app/Services/Billing/AdoptStripePrice.php
@@ -0,0 +1,188 @@
+<?php
+
+namespace App\Services\Billing;
+
+use App\Services\Stripe\StripeClient;
+use Illuminate\Support\Facades\Log;
+
+/**
+ * The Stripe Price we were about to create and Stripe already has.
+ *
+ * An abandoned run leaves an orphan: Stripe made the Price, our insert never
+ * happened, and the table that decides everything afterwards does not know it
+ * exists. The idempotency key covers the next twenty-four hours; after that it
+ * covers nothing, and the run that follows makes a SECOND live Price for the
+ * same money — precisely the duplicate the key was there to prevent. It happened
+ * on 2026-07-29 with priority_support at 3480 EUR.
+ *
+ * So before minting, we ask. Nothing else in the catalogue ever did.
+ *
+ * **What may be taken over, and why so narrowly.** Same amount, same currency,
+ * same interval — a Price at another figure would move money, and moving money
+ * is what this must never do: a running contract keeps the Price it was sold on
+ * and every booking stays frozen at what it cost that day. Then proof: the
+ * candidate must not contradict our metadata, and it must confirm at least one
+ * identifying key of it. An active Price at the right money on our own Product
+ * with no metadata at all is what a person clicking through Stripe's dashboard
+ * leaves behind, and adopting that would be worse than minting a second one.
+ * Finally it must be unclaimed — a Price id belongs to one row, which is what
+ * the unique index on both registers now enforces.
+ *
+ * **Several orphans.** The oldest is adopted, because it is the one a lost row
+ * is likeliest to have been billing on, and the others are archived at Stripe.
+ * Archiving stops a Price being SOLD and leaves every subscription on it exactly
+ * where it was — the same grandfathering archiveSuperseded() has always relied
+ * on — so the rule "one live Price per figure" is restored without touching a
+ * single contract.
+ *
+ * **Reported through the log, not the console.** AddonPrices::ensure() runs
+ * inside a customer's module booking as well as in the sweep, and there is no
+ * command line there.
+ */
+final class AdoptStripePrice
+{
+    public function __construct(private readonly StripeClient $stripe) {}
+
+    /**
+     * The id of an existing Stripe Price to use instead of creating one, or null.
+     *
+     * @param  array<string, string>  $metadata  what the create call would send
+     * @param  array<int, string>  $identifying  metadata keys that mark a Price as ours
+     * @param  callable(string): bool  $claimed  is this Price id already in our register?
+     */
+    public function __invoke(
+        string $productId,
+        int $amountCents,
+        string $currency,
+        string $interval,
+        array $metadata,
+        array $identifying,
+        callable $claimed,
+    ): ?string {
+        // Stripe hands metadata back as strings. An un-cast int here would then
+        // never satisfy confirms()'s strict ===, silently disabling adoption for
+        // that Price forever and warning on every sweep and every booking. One
+        // cast here makes the class independent of what a caller happens to pass.
+        $metadata = array_map(fn ($value) => (string) $value, $metadata);
+
+        $candidates = [];
+
+        foreach ($this->stripe->activePricesFor($productId) as $price) {
+            if ($price['unit_amount'] !== $amountCents
+                || $price['currency'] !== strtoupper($currency)
+                || $price['interval'] !== $interval) {
+                continue;
+            }
+
+            if ($claimed($price['id'])) {
+                continue;
+            }
+
+            // Contradicts on something it carries: another Price of ours, not a
+            // mystery. Silent — at a VAT rate of nought the two treatments share
+            // an amount, and this would otherwise warn on every sweep.
+            if ($this->contradicts($price['metadata'], $metadata)) {
+                continue;
+            }
+
+            if (! $this->confirms($price['metadata'], $metadata, $identifying)) {
+                Log::warning('stripe: left an unexplained active price alone rather than adopting it', [
+                    'price' => $price['id'],
+                    'product' => $productId,
+                    'amount_cents' => $amountCents,
+                    'currency' => strtoupper($currency),
+                    'interval' => $interval,
+                ]);
+
+                continue;
+            }
+
+            $candidates[] = $price;
+        }
+
+        if ($candidates === []) {
+            return null;
+        }
+
+        usort($candidates, fn (array $a, array $b) => $a['created'] <=> $b['created']);
+
+        $adopted = array_shift($candidates);
+
+        foreach ($candidates as $duplicate) {
+            $this->stripe->archivePrice($duplicate['id']);
+
+            Log::warning('stripe: stopped selling a duplicate price for one figure', [
+                'price' => $duplicate['id'],
+                'adopted' => $adopted['id'],
+                'product' => $productId,
+                'amount_cents' => $amountCents,
+            ]);
+        }
+
+        // Only when it differs, so a sweep over a healthy catalogue makes no
+        // writes at Stripe at all. Compared through array_intersect_key() rather
+        // than a bare !==, for two reasons: Stripe MERGES a metadata write rather
+        // than replacing it, so a Price can carry a key of its own that a write
+        // would never remove and a bare !== would then never call equal — and
+        // PHP's array !== is key-order sensitive, so Stripe handing the same
+        // values back in a different order would trigger a write every single
+        // sweep. ksort() on both sides settles the order; the intersect settles
+        // the extra key, by looking only at what WE would send.
+        $overlap = array_intersect_key($adopted['metadata'], $metadata);
+        $wanted = $metadata;
+        ksort($overlap);
+        ksort($wanted);
+
+        if ($overlap !== $wanted) {
+            $this->stripe->updatePriceMetadata($adopted['id'], $metadata);
+        }
+
+        Log::info('stripe: adopted an existing price instead of creating a second one', [
+            'price' => $adopted['id'],
+            'product' => $productId,
+            'amount_cents' => $amountCents,
+            'currency' => strtoupper($currency),
+            'interval' => $interval,
+        ]);
+
+        return $adopted['id'];
+    }
+
+    /**
+     * Does this Price say something about itself that we do not?
+     *
+     * @param  array<string, string>  $found
+     * @param  array<string, string>  $expected
+     */
+    private function contradicts(array $found, array $expected): bool
+    {
+        foreach ($expected as $key => $value) {
+            if (array_key_exists($key, $found) && $found[$key] !== $value) {
+                return true;
+            }
+        }
+
+        return false;
+    }
+
+    /**
+     * Does it prove it is ours?
+     *
+     * Failing to contradict is not enough — an empty metadata bag contradicts
+     * nothing. At least one identifying key has to be there and agree.
+     *
+     * @param  array<string, string>  $found
+     * @param  array<string, string>  $expected
+     * @param  array<int, string>  $identifying
+     */
+    private function confirms(array $found, array $expected, array $identifying): bool
+    {
+        foreach ($identifying as $key) {
+            if (isset($found[$key]) && $found[$key] === ($expected[$key] ?? null)) {
+                return true;
+            }
+        }
+
+        return false;
+    }
+}
diff --git a/app/Services/Billing/PlanCatalogue.php b/app/Services/Billing/PlanCatalogue.php
index 4392ace..2d2080e 100644
--- a/app/Services/Billing/PlanCatalogue.php
+++ b/app/Services/Billing/PlanCatalogue.php
@@ -70,10 +70,18 @@ final class PlanCatalogue
                 }
 
                 $monthly = $priced[Subscription::TERM_MONTHLY];
+                $yearly = $priced[Subscription::TERM_YEARLY];
 
                 return [$family->key => array_merge($version->capabilities(), [
                     'name' => $family->name,
                     'price_cents' => $monthly->amount_cents,
+                    // The yearly figure travels with the monthly one. Both terms
+                    // are already required before a version can be sold at all
+                    // (requiredPrices above), so a shop showing one and hiding
+                    // the other was hiding a price it had in its hand — and
+                    // whoever wanted to show it would have gone looking for a
+                    // second source.
+                    'yearly_price_cents' => $yearly->amount_cents,
                     'currency' => $monthly->currency,
                     'plan_version_id' => $version->id,
                     // Marketing presentation, not a capability: it lives on the
diff --git a/app/Services/Billing/PlanPrices.php b/app/Services/Billing/PlanPrices.php
index ed8d631..5d58ce7 100644
--- a/app/Services/Billing/PlanPrices.php
+++ b/app/Services/Billing/PlanPrices.php
@@ -40,7 +40,10 @@ use App\Services\Stripe\StripeClient;
  */
 final class PlanPrices
 {
-    public function __construct(private readonly StripeClient $stripe) {}
+    public function __construct(
+        private readonly StripeClient $stripe,
+        private readonly AdoptStripePrice $adopt,
+    ) {}
 
     /** What Stripe is asked to take for this row from a customer treated so. */
     public static function chargedCents(PlanPrice $price, TaxTreatment $treatment): int
@@ -131,30 +134,56 @@ final class PlanPrices
         $existing = $this->registered($price, $treatment, includeArchived: true);
 
         $priceId = $existing?->stripe_price_id;
+        $interval = $price->term === Subscription::TERM_YEARLY ? 'year' : 'month';
 
         if ($priceId === null) {
-            $priceId = $this->stripe->createPrice(
+            $metadata = [
+                'plan_family' => $family->key,
+                'plan_version' => (string) $version->version,
+                'plan_version_id' => (string) $version->id,
+                'plan_price_id' => (string) $price->id,
+                // Read back by anything that has a Price id and needs to know
+                // what kind of sale it was — and by a person looking at
+                // Stripe's own dashboard, where two Prices on one Product
+                // would otherwise differ only by an amount.
+                'tax_treatment' => $treatment->reverseCharge ? 'reverse_charge' : 'domestic',
+            ];
+
+            // Asked BEFORE minting: a run that died between Stripe's create and
+            // our insert left a Price the register does not know, and the key
+            // below stops protecting it after twenty-four hours. `plan_price_id`
+            // is what proves such a Price is this row's — one Product carries
+            // every version and term of a family, so the amount alone would not.
+            $priceId = ($this->adopt)(
                 productId: (string) $productId,
                 amountCents: $charged,
                 currency: (string) $price->currency,
-                interval: $price->term === Subscription::TERM_YEARLY ? 'year' : 'month',
-                metadata: [
-                    'plan_family' => $family->key,
-                    'plan_version' => (string) $version->version,
-                    'plan_version_id' => (string) $version->id,
-                    'plan_price_id' => (string) $price->id,
-                    // Read back by anything that has a Price id and needs to know
-                    // what kind of sale it was — and by a person looking at
-                    // Stripe's own dashboard, where two Prices on one Product
-                    // would otherwise differ only by an amount.
-                    'tax_treatment' => $treatment->reverseCharge ? 'reverse_charge' : 'domestic',
-                ],
-                // The CHARGED amount is part of the key, so a run after a rate
-                // change cannot replay the Price minted at the old figure. So is
-                // the treatment, and it has to be: at a rate of nought the two
-                // Prices are the same amount, and one key would have Stripe hand
-                // back the same object for both — which the register, where a
-                // Price id is unique, would refuse to record twice.
+                interval: $interval,
+                metadata: $metadata,
+                identifying: ['plan_price_id'],
+                claimed: fn (string $id) => StripePlanPrice::query()
+                    ->where('stripe_price_id', $id)
+                    ->exists(),
+            );
+
+            $priceId ??= $this->stripe->createPrice(
+                productId: (string) $productId,
+                amountCents: $charged,
+                currency: (string) $price->currency,
+                interval: $interval,
+                metadata: $metadata,
+                // Says "I have already sent this call", nothing more. The
+                // CHARGED amount is part of the key, so a run after a rate
+                // change cannot replay the Price minted at the old figure. So
+                // is the treatment, and it has to be: at a rate of nought the
+                // two Prices are the same amount, and one key would have
+                // Stripe hand back the same object for both — which the
+                // register, where a Price id is unique, would refuse to
+                // record twice. The metadata is folded in by IdempotencyKey
+                // inside the client, so changing the format above can never
+                // again refuse the call for a day. What stops a second Price
+                // for one figure is the adoption step above, not this key —
+                // Stripe forgets a key after twenty-four hours.
                 idempotencyKey: "clupilot-price-{$price->id}-{$charged}"
                     .($treatment->reverseCharge ? '-rc' : ''),
             );
diff --git a/app/Services/Legal/DpaRenderer.php b/app/Services/Legal/DpaRenderer.php
new file mode 100644
index 0000000..2567f50
--- /dev/null
+++ b/app/Services/Legal/DpaRenderer.php
@@ -0,0 +1,109 @@
+<?php
+
+namespace App\Services\Legal;
+
+use App\Console\Commands\PruneDormantAccounts;
+use App\Console\Commands\PruneUnverifiedAccounts;
+use App\Support\CompanyProfile;
+use Illuminate\Support\Carbon;
+use Illuminate\Support\Facades\View;
+use TCPDF;
+
+/**
+ * The processing agreement and its annex, as PDFs.
+ *
+ * TCPDF, because the invoices already render through it — a second PDF engine
+ * for two documents a year would be a dependency nobody maintains. Its HTML
+ * support is not a browser's, so the two Blade views are deliberately plain:
+ * headings, paragraphs, lists, one table.
+ *
+ * ## The documents are generated, not uploaded
+ *
+ * They name the company from CompanyProfile and take their deadlines from the
+ * commands that enforce them, so the agreement cannot drift from the invoices or
+ * from what the software actually does. An operator can still upload a lawyer's
+ * revision as a new version — the console does not care where a file came from.
+ */
+final class DpaRenderer
+{
+    /**
+     * The sub-processors this installation actually talks to.
+     *
+     * Here rather than in the template because it is a fact about the system,
+     * not wording: hosting, payment and mail are the three places customer-
+     * related data leaves this application, and a list that quietly omits one is
+     * the single most common defect in a processing agreement.
+     *
+     * @return array<int, array<string, string>>
+     */
+    public static function subprocessors(): array
+    {
+        return [
+            [
+                'name' => 'Hetzner Online GmbH',
+                'service' => 'Rechenzentrum, Server und Netzanbindung der Kundeninstanzen',
+                'location' => 'Falkenstein und Nürnberg, Deutschland; Helsinki, Finnland',
+            ],
+            [
+                'name' => 'Stripe Payments Europe, Ltd.',
+                'service' => 'Zahlungsabwicklung (Vertrags- und Zahlungsdaten des Kunden, keine Instanzinhalte)',
+                'location' => 'Irland (EU)',
+            ],
+            [
+                'name' => 'thinkidoo e.U.',
+                'service' => 'Mailserver für den Versand und Empfang der Betriebs- und Support-E-Mails',
+                'location' => 'Österreich',
+            ],
+        ];
+    }
+
+    /** The agreement itself. */
+    public function agreement(string $version, ?Carbon $issuedOn = null): string
+    {
+        return $this->render('legal.dpa.agreement', $version, $issuedOn, [
+            'subprocessors' => self::subprocessors(),
+        ]);
+    }
+
+    /** Annex 1: the technical and organisational measures. */
+    public function measures(string $version, ?Carbon $issuedOn = null): string
+    {
+        return $this->render('legal.dpa.measures', $version, $issuedOn, [
+            // From the commands that enforce them, so the document cannot
+            // promise one deadline while the sweep runs another.
+            'unverifiedDays' => PruneUnverifiedAccounts::AFTER_DAYS,
+            'warnDays' => PruneDormantAccounts::WARN_DAYS_BEFORE,
+        ]);
+    }
+
+    /** @param array<string, mixed> $data */
+    private function render(string $view, string $version, ?Carbon $issuedOn, array $data): string
+    {
+        $issuedOn ??= now();
+
+        $html = View::make($view, array_merge($data, [
+            'version' => $version,
+            // R19: written on the wall clock, because a date on a contract is
+            // read by a person and not by a server.
+            'issuedOn' => $issuedOn->local()->isoFormat('LL'),
+        ]))->render();
+
+        $pdf = new TCPDF('P', 'mm', 'A4', true, 'UTF-8');
+        $pdf->SetCreator('CluPilot');
+        $pdf->SetAuthor((string) (CompanyProfile::get('name') ?? 'CluPilot'));
+        $pdf->SetTitle(__('dpa.title').' '.$version);
+        // No default header or footer bar: this is a contract, not a report, and
+        // TCPDF's default header prints a black line and a title nobody set.
+        $pdf->setPrintHeader(false);
+        $pdf->setPrintFooter(true);
+        $pdf->SetMargins(20, 18, 20);
+        $pdf->SetAutoPageBreak(true, 20);
+        // DejaVu, because the text is German: TCPDF's core fonts have no ß in
+        // the encoding this uses and would print it as a blank.
+        $pdf->SetFont('dejavusans', '', 9.5);
+        $pdf->AddPage();
+        $pdf->writeHTML($html, true, false, true, false, '');
+
+        return (string) $pdf->Output('', 'S');
+    }
+}
diff --git a/app/Services/Legal/ProcessingAgreement.php b/app/Services/Legal/ProcessingAgreement.php
new file mode 100644
index 0000000..b8e8e68
--- /dev/null
+++ b/app/Services/Legal/ProcessingAgreement.php
@@ -0,0 +1,78 @@
+<?php
+
+namespace App\Services\Legal;
+
+use App\Models\Customer;
+use App\Models\DpaAcceptance;
+use App\Models\DpaVersion;
+use Illuminate\Support\Facades\Auth;
+
+/**
+ * Which agreement is in force, and whether a customer has accepted it.
+ *
+ * One place, because the same questions are asked by the customer's own page, by
+ * the console's register and by anything that later chases the ones outstanding
+ * — and three implementations of "has this customer accepted?" is three chances
+ * to answer differently a question that is evidence.
+ *
+ * ## Accepting an OLD version is not accepting
+ *
+ * A new version supersedes the last, so this asks about the version in force and
+ * nothing else. The old acceptance is kept — it was true when it was made, and
+ * the history is the point — but it stops satisfying the question.
+ */
+final class ProcessingAgreement
+{
+    public function current(): ?DpaVersion
+    {
+        return DpaVersion::current();
+    }
+
+    /** The acceptance of the version in force, if there is one. */
+    public function acceptanceOf(?Customer $customer): ?DpaAcceptance
+    {
+        $current = $this->current();
+
+        if ($customer === null || $current === null) {
+            return null;
+        }
+
+        return DpaAcceptance::query()
+            ->where('customer_id', $customer->id)
+            ->where('dpa_version_id', $current->id)
+            ->first();
+    }
+
+    public function accepted(?Customer $customer): bool
+    {
+        return $this->acceptanceOf($customer) !== null;
+    }
+
+    /**
+     * Record an acceptance.
+     *
+     * firstOrCreate over the pair the unique index covers: pressing twice is not
+     * two agreements, and a double click must not become a duplicate-key error
+     * in front of somebody agreeing to a contract.
+     *
+     * The address is read here rather than passed in, so no caller can record an
+     * acceptance as coming from somewhere it invented.
+     */
+    public function accept(Customer $customer, ?string $ip = null): ?DpaAcceptance
+    {
+        $current = $this->current();
+
+        if ($current === null) {
+            return null;
+        }
+
+        return DpaAcceptance::query()->firstOrCreate(
+            ['customer_id' => $customer->id, 'dpa_version_id' => $current->id],
+            [
+                'user_id' => Auth::id(),
+                'ip' => $ip ?? request()->ip(),
+                'accepted_at' => now(),
+            ],
+        );
+    }
+}
diff --git a/app/Services/Mail/FakeMailbox.php b/app/Services/Mail/FakeMailbox.php
index 05b1500..fd7afd6 100644
--- a/app/Services/Mail/FakeMailbox.php
+++ b/app/Services/Mail/FakeMailbox.php
@@ -25,6 +25,22 @@ class FakeMailbox implements InboundMailbox
         return $this->configured;
     }
 
+    /**
+     * What a test wants the check to answer, if not the obvious.
+     *
+     * @var array{ok: bool, message: string, unseen: int|null}|null
+     */
+    public array|null $checkAnswer = null;
+
+    public function check(): array
+    {
+        return $this->checkAnswer ?? [
+            'ok' => $this->configured,
+            'message' => $this->configured ? '' : 'not configured',
+            'unseen' => $this->configured ? count($this->mails) : null,
+        ];
+    }
+
     public function fetch(int $limit = 50): array
     {
         return array_slice($this->mails, 0, $limit);
diff --git a/app/Services/Mail/ImapMailbox.php b/app/Services/Mail/ImapMailbox.php
index c7f1cea..ab3b384 100644
--- a/app/Services/Mail/ImapMailbox.php
+++ b/app/Services/Mail/ImapMailbox.php
@@ -2,6 +2,7 @@
 
 namespace App\Services\Mail;
 
+use App\Services\Secrets\SecretVault;
 use App\Support\ProvisioningSettings;
 use Illuminate\Support\Facades\Log;
 use RuntimeException;
@@ -44,9 +45,20 @@ class ImapMailbox implements InboundMailbox
      * Configured means: somebody entered a host, a user and a password.
      *
      * The first two come from the console (ProvisioningSettings), the password
-     * from the vault — read through config, which SecretVault overrides at
-     * boot. No separate "enabled" switch to forget: a mailbox with credentials
-     * IS the switch, and one without them cannot be polled anyway.
+     * from the VAULT — read here, at the point of use. It used to read
+     * config('services.inbound_mail.password'), which is only ever the .env
+     * value: this project deliberately does not overlay stored secrets onto
+     * config at boot (SecretVault's docblock, rule 3). So a password saved in
+     * the console counted for nothing, isConfigured() stayed false, and the
+     * inbox went on saying no mailbox was set up while the password sat right
+     * there on the settings page. Reported exactly that way.
+     *
+     * SecretVault::get() falls back to the configured value when nothing is
+     * stored, so an installation carrying INBOUND_MAIL_PASSWORD in .env keeps
+     * working unchanged.
+     *
+     * No separate "enabled" switch to forget: a mailbox with credentials IS the
+     * switch, and one without them cannot be polled anyway.
      */
     public function isConfigured(): bool
     {
@@ -54,7 +66,63 @@ class ImapMailbox implements InboundMailbox
 
         return filled($mailbox['host'])
             && filled($mailbox['username'])
-            && filled(config('services.inbound_mail.password'));
+            && filled($this->password());
+    }
+
+    /** The mailbox password, from the vault, falling back to .env. */
+    private function password(): string
+    {
+        return (string) app(SecretVault::class)->get('inbound_mail.password');
+    }
+
+    /**
+     * Reach the mailbox and count what is waiting.
+     *
+     * Deliberately the same four verbs the fetch uses — LOGIN, SELECT, SEARCH —
+     * so a green check means the thing that actually runs would work. A check
+     * that proves something easier than the real job is worse than none: it was
+     * exactly that mistake (a test computing its expectation with the code under
+     * test) the timezone rule was written about.
+     *
+     * @return array{ok: bool, message: string, unseen: int|null}
+     */
+    public function check(): array
+    {
+        if (! $this->isConfigured()) {
+            return ['ok' => false, 'message' => 'incomplete', 'unseen' => null];
+        }
+
+        try {
+            $this->connect();
+            $unseen = count($this->search());
+
+            return ['ok' => true, 'message' => '', 'unseen' => $unseen];
+        } catch (Throwable $e) {
+            // The message, not the trace, and never the command: LOGIN carries
+            // the password and this string is shown on a page.
+            return ['ok' => false, 'message' => $this->reason($e), 'unseen' => null];
+        } finally {
+            $this->disconnect();
+        }
+    }
+
+    /**
+     * One line an operator can act on, with nothing secret in it.
+     *
+     * IMAP servers answer a failed LOGIN with their own prose, and this class
+     * puts the command in the exception message — which for LOGIN would be the
+     * password. So the text is matched, never passed through.
+     */
+    private function reason(Throwable $e): string
+    {
+        $text = strtolower($e->getMessage());
+
+        return match (true) {
+            str_contains($text, 'could not reach') => 'unreachable',
+            str_contains($text, 'authenticationfailed') || str_contains($text, 'login') => 'credentials',
+            str_contains($text, 'nonexistent') || str_contains($text, 'select') => 'folder',
+            default => 'failed',
+        };
     }
 
     /** @return array<int, FetchedMail> */
@@ -147,7 +215,7 @@ class ImapMailbox implements InboundMailbox
         $this->command(sprintf(
             'LOGIN %s %s',
             $this->quote($mailbox['username']),
-            $this->quote((string) config('services.inbound_mail.password')),
+            $this->quote($this->password()),
         ));
 
         $this->command('SELECT '.$this->quote($mailbox['folder']));
diff --git a/app/Services/Mail/InboundMailStatus.php b/app/Services/Mail/InboundMailStatus.php
new file mode 100644
index 0000000..c55a458
--- /dev/null
+++ b/app/Services/Mail/InboundMailStatus.php
@@ -0,0 +1,59 @@
+<?php
+
+namespace App\Services\Mail;
+
+use App\Support\Settings;
+use Illuminate\Support\Carbon;
+
+/**
+ * When the support mailbox was last reached, and what came back.
+ *
+ * A settings row rather than a table: there is exactly one mailbox and exactly
+ * one last answer, and a table of one row is a table somebody has to prune.
+ *
+ * Written by both callers on purpose — the operator's test button and the
+ * scheduled fetch. Otherwise "last checked" would mean "last time somebody
+ * pressed the button", which is the least interesting of the two: a mailbox
+ * that stopped answering at three in the morning is what an operator needs to
+ * see, and nobody presses a button at three in the morning.
+ */
+class InboundMailStatus
+{
+    private const KEY = 'inbound_mail.last_check';
+
+    /** @param  int|null  $unseen  how many unread messages were waiting, where that was asked */
+    public function record(bool $ok, string $message = '', ?int $unseen = null): void
+    {
+        Settings::set(self::KEY, [
+            'at' => Carbon::now()->toIso8601String(),
+            'ok' => $ok,
+            // Never the password, never the whole exception: this ends up on a
+            // page, and an IMAP error can quote the command it failed on.
+            'message' => mb_substr($message, 0, 300),
+            'unseen' => $unseen,
+        ]);
+    }
+
+    /**
+     * The last answer, or null if nobody has ever asked.
+     *
+     * @return array{at: Carbon, ok: bool, message: string, unseen: int|null}|null
+     */
+    public function last(): ?array
+    {
+        $row = Settings::get(self::KEY);
+
+        if (! is_array($row) || ! isset($row['at'])) {
+            return null;
+        }
+
+        return [
+            // Parsed back into a Carbon so the view can put it on the wall clock
+            // (R19) rather than printing an ISO string at somebody.
+            'at' => Carbon::parse((string) $row['at']),
+            'ok' => (bool) ($row['ok'] ?? false),
+            'message' => (string) ($row['message'] ?? ''),
+            'unseen' => isset($row['unseen']) ? (int) $row['unseen'] : null,
+        ];
+    }
+}
diff --git a/app/Services/Mail/InboundMailbox.php b/app/Services/Mail/InboundMailbox.php
index 3e240fb..ef63fa1 100644
--- a/app/Services/Mail/InboundMailbox.php
+++ b/app/Services/Mail/InboundMailbox.php
@@ -15,6 +15,20 @@ interface InboundMailbox
     /** Is a mailbox configured at all? */
     public function isConfigured(): bool;
 
+    /**
+     * Reach the mailbox now and say what happened.
+     *
+     * For the button in the console: an operator who has just typed a host, a
+     * user and a password should not have to wait for the next scheduled run to
+     * find out whether any of it was right — and "the inbox is empty" is not an
+     * answer to that question.
+     *
+     * Never throws. A failed check IS the answer.
+     *
+     * @return array{ok: bool, message: string, unseen: int|null}
+     */
+    public function check(): array;
+
     /**
      * Messages that have arrived, oldest first.
      *
diff --git a/app/Services/Mail/IngestInboundMail.php b/app/Services/Mail/IngestInboundMail.php
index 15b5fc1..22e54f6 100644
--- a/app/Services/Mail/IngestInboundMail.php
+++ b/app/Services/Mail/IngestInboundMail.php
@@ -22,7 +22,10 @@ use Illuminate\Support\Facades\Log;
  */
 class IngestInboundMail
 {
-    public function __construct(private readonly InboundMailbox $mailbox) {}
+    public function __construct(
+        private readonly InboundMailbox $mailbox,
+        private readonly InboundMailStatus $status,
+    ) {}
 
     /**
      * Fetch, store, and flag what was stored.
@@ -35,6 +38,18 @@ class IngestInboundMail
             return 0;
         }
 
+        // The scheduled run records its own outcome, so the "last checked" line
+        // in the console means the last time the mailbox was actually reached —
+        // not the last time somebody pressed a button. A mailbox that stopped
+        // answering at three in the morning is the one worth seeing, and nobody
+        // presses a button at three in the morning.
+        $check = $this->mailbox->check();
+        $this->status->record($check['ok'], $check['message'], $check['unseen']);
+
+        if (! $check['ok']) {
+            return 0;
+        }
+
         $taken = 0;
 
         foreach ($this->mailbox->fetch($limit) as $mail) {
diff --git a/app/Services/Mail/MailPreviews.php b/app/Services/Mail/MailPreviews.php
new file mode 100644
index 0000000..4d81734
--- /dev/null
+++ b/app/Services/Mail/MailPreviews.php
@@ -0,0 +1,219 @@
+<?php
+
+namespace App\Services\Mail;
+
+use App\Mail\InvoiceMail;
+use App\Mail\MaintenanceAnnouncementMail;
+use App\Mail\MaintenanceCancelledMail;
+use App\Mail\NewDeviceSignInMail;
+use App\Mail\OperatorMessageMail;
+use App\Mail\OrderConfirmationMail;
+use App\Console\Commands\PruneDormantAccounts;
+use App\Mail\DormantAccountWarningMail;
+use App\Mail\ResetPasswordMail;
+use App\Mail\VerifyEmailMail;
+use App\Models\Customer;
+use App\Models\Invoice;
+use App\Models\MaintenanceWindow;
+use App\Models\Order;
+use App\Models\User;
+use App\Models\UserDevice;
+use Illuminate\Mail\Mailable;
+use Illuminate\Support\Carbon;
+
+/**
+ * Every mail this application sends, built from sample data so it can be looked
+ * at without waiting for the event that would send it.
+ *
+ * There is no other way to see most of these. An invoice mail needs an invoice, a
+ * maintenance announcement needs a window, and "register an account to check
+ * whether the confirmation reads well on a phone" is not a workflow — which is
+ * how a mail with a hard 600px table went out for months before anybody opened
+ * one on a telephone.
+ *
+ * ## Nothing is written
+ *
+ * Every record here is built with `make()`, never `create()`: a preview must not
+ * leave an invoice, an order or a maintenance window behind in the database. The
+ * models exist for the length of one render.
+ *
+ * The one exception is by omission: where a real record already exists, it is
+ * NOT used. Rendering somebody's actual invoice to check a layout puts their
+ * figures in an operator's inbox for no reason.
+ */
+class MailPreviews
+{
+    /**
+     * The list, in the order somebody would read them: sign-up, purchase,
+     * operation, money, security.
+     *
+     * @return array<string, string> key => label
+     */
+    public function all(): array
+    {
+        return [
+            'verify-email' => 'E-Mail bestätigen (Registrierung)',
+            'reset-password' => 'Passwort zurücksetzen',
+            'order-confirmation' => 'Bestellbestätigung',
+            'cloud-ready' => 'Cloud ist bereit (Zugangsdaten)',
+            'maintenance-announcement' => 'Wartungsfenster angekündigt',
+            'maintenance-cancelled' => 'Wartungsfenster abgesagt',
+            'invoice' => 'Rechnung',
+            'new-device' => 'Anmeldung von einem neuen Gerät',
+            'dormant-warning' => 'Konto ohne Paket wird gelöscht',
+            'operator-message' => 'Nachricht aus der Konsole',
+        ];
+    }
+
+    public function has(string $key): bool
+    {
+        return array_key_exists($key, $this->all());
+    }
+
+    /**
+     * One mailable, filled with sample data.
+     *
+     * Returns null for a key nobody knows rather than throwing: this is reached
+     * from a URL, and a URL is a string somebody can retype.
+     */
+    public function make(string $key): ?Mailable
+    {
+        if (! $this->has($key)) {
+            return null;
+        }
+
+        $customer = $this->customer();
+        $user = $this->user();
+
+        return match ($key) {
+            'verify-email' => new VerifyEmailMail($user),
+            'reset-password' => new ResetPasswordMail($user, 'https://example.test/reset/beispiel-token', 60),
+            'order-confirmation' => new OrderConfirmationMail($this->order($customer), $customer->name),
+            'cloud-ready' => $this->cloudReady($customer),
+            'maintenance-announcement' => new MaintenanceAnnouncementMail($this->window(), $customer),
+            'maintenance-cancelled' => new MaintenanceCancelledMail($this->window(), $customer),
+            'invoice' => new InvoiceMail($this->invoice($customer), $customer->name),
+            'new-device' => new NewDeviceSignInMail($customer->name, $this->device($user), 'web'),
+            'dormant-warning' => new DormantAccountWarningMail($user, PruneDormantAccounts::WARN_DAYS_BEFORE),
+            'operator-message' => new OperatorMessageMail(
+                $customer,
+                'Zur Datenübernahme',
+                "Guten Tag Bea Berger,\n\nich habe mir Ihre Ausgangslage angesehen. Die Übernahme ist möglich.\n\nMit freundlichen Grüßen\nCluPilot",
+            ),
+            default => null,
+        };
+    }
+
+    // ---- The sample records. make(), never create(). ----
+
+    private function customer(): Customer
+    {
+        return Customer::make([
+            'name' => 'Beispiel GmbH',
+            'contact_name' => 'Bea Berger',
+            'email' => 'bea@beispiel.test',
+            'locale' => 'de',
+        ]);
+    }
+
+    private function user(): User
+    {
+        // The verification mail signs its URL from the model key, so the sample
+        // needs one — 0 is enough for a link nobody is meant to follow.
+        return User::make(['name' => 'Bea Berger', 'email' => 'bea@beispiel.test'])
+            ->forceFill(['id' => 0, 'email_verified_at' => null]);
+    }
+
+    private function order(Customer $customer): Order
+    {
+        return Order::make([
+            'plan' => 'start',
+            'amount_cents' => 4900,
+            'currency' => 'EUR',
+            'datacenter' => 'fsn',
+            'status' => 'paid',
+        ])->forceFill(['id' => 0, 'created_at' => Carbon::now()]);
+    }
+
+    private function invoice(Customer $customer): Invoice
+    {
+        // The document renders from its own snapshot, so a preview only needs a
+        // convincing snapshot — not a series, not a number drawn from one.
+        return Invoice::make([
+            'number' => 'RE-2026-0042',
+            'issued_on' => Carbon::now()->toDateString(),
+            'due_on' => Carbon::now()->addDays(14)->toDateString(),
+            'net_cents' => 4900,
+            'tax_cents' => 980,
+            'gross_cents' => 5880,
+            'currency' => 'EUR',
+            'snapshot' => ['meta' => ['number' => 'RE-2026-0042']],
+        ])->forceFill(['id' => 0, 'uuid' => '00000000-0000-0000-0000-000000000000']);
+    }
+
+    private function window(): MaintenanceWindow
+    {
+        return MaintenanceWindow::make([
+            'title' => 'Sicherheitsupdates Nextcloud',
+            'starts_at' => Carbon::now()->addDays(3)->setTime(2, 0),
+            'ends_at' => Carbon::now()->addDays(3)->setTime(4, 0),
+            'state' => 'scheduled',
+        ])->forceFill(['id' => 0]);
+    }
+
+    private function device(User $user): UserDevice
+    {
+        return UserDevice::make([
+            'guard' => 'web',
+            'name' => 'Firefox auf Linux',
+            'last_ip' => '203.0.113.42',
+            'last_seen_at' => Carbon::now(),
+        ])->forceFill(['id' => 0]);
+    }
+
+    /**
+     * The credentials mail is a notification rather than a Mailable.
+     *
+     * Built through its own toMail() so the preview shows the real thing, not a
+     * second copy of the wording that would then drift.
+     */
+    private function cloudReady(Customer $customer): Mailable
+    {
+        $mail = new class($customer) extends Mailable
+        {
+            use \App\Mail\Concerns\SendsFromMailbox;
+
+            public function __construct(public Customer $customer)
+            {
+                // The same mailbox the real notification sends from. Without
+                // this the preview took the framework default — an address no
+                // mailbox owns, over whichever account mail.default logs in
+                // with, which is the "553 Sender address rejected" every
+                // properly configured mail server answers with.
+                $this->mailer('cp_'.MailPurpose::PROVISIONING);
+            }
+
+            public function envelope(): \Illuminate\Mail\Mailables\Envelope
+            {
+                return $this->mailboxEnvelope(MailPurpose::PROVISIONING, __('provisioning.mail.ready_subject'));
+            }
+
+            public function content(): \Illuminate\Mail\Mailables\Content
+            {
+                // The same keys App\Notifications\CloudReady hands the view. A
+                // preview that invented its own would render a mail nobody ever
+                // receives, and drift from the real one without saying so.
+                return new \Illuminate\Mail\Mailables\Content(view: 'mail.cloud-ready', with: [
+                    'name' => $this->customer->name,
+                    'url' => 'https://beispiel.clupilot.cloud',
+                    'plan' => 'start',
+                    'storage' => __('provisioning.mail.value_storage', ['gb' => 100]),
+                    'location' => 'Falkenstein, Deutschland',
+                    'dashboardUrl' => route('dashboard'),
+                ]);
+            }
+        };
+
+        return $mail;
+    }
+}
diff --git a/app/Services/Stripe/FakeStripeClient.php b/app/Services/Stripe/FakeStripeClient.php
index 5a5398d..25d4ebc 100644
--- a/app/Services/Stripe/FakeStripeClient.php
+++ b/app/Services/Stripe/FakeStripeClient.php
@@ -19,7 +19,7 @@ class FakeStripeClient implements StripeClient
     /** @var array<int, array{name: string, metadata: array}> */
     public array $products = [];
 
-    /** @var array<int, array{product: string, amount: int, currency: string, interval: string, metadata: array}> */
+    /** @var array<int, array{product: string, amount: int, currency: string, interval: string, metadata: array, created: int}> */
     public array $prices = [];
 
     /** @var array<int, string> */
@@ -34,7 +34,25 @@ class FakeStripeClient implements StripeClient
      */
     public array $activated = [];
 
-    /** Idempotency key → the id first returned for it. @var array<string, string> */
+    /**
+     * Every metadata write, in order, so a test can assert that an adopted
+     * orphan was brought up to today's metadata instead of being replaced.
+     *
+     * @var array<int, array{price: string, metadata: array<string, string>}>
+     */
+    public array $metadataUpdates = [];
+
+    /**
+     * Idempotency key → what was first answered for it, and a fingerprint of
+     * what it was first sent with.
+     *
+     * The fingerprint is the half that was missing. This ledger replayed the
+     * first id for a repeated key without ever looking at what the second call
+     * was asking for — so it was unrealistic in precisely the way that mattered,
+     * and no test could see the 2026-07-29 blockade.
+     *
+     * @var array<string, array{id: string, fingerprint: string}>
+     */
     public array $keys = [];
 
     /**
@@ -150,17 +168,25 @@ class FakeStripeClient implements StripeClient
 
     public function createProduct(string $name, array $metadata = [], ?string $idempotencyKey = null): string
     {
+        $key = IdempotencyKey::forProduct($idempotencyKey, $name, $metadata);
+
+        // The same parameters forProduct() just fingerprinted, asked for
+        // through the one method that knows what they are — a local literal
+        // here could drift from what the key actually covers without a test
+        // ever seeing it.
+        $parameters = IdempotencyKey::productParameters($name, $metadata);
+
         // Replays the first answer for a repeated key, as Stripe does.
-        if ($idempotencyKey !== null && isset($this->keys[$idempotencyKey])) {
-            return $this->keys[$idempotencyKey];
+        $replayed = $this->replay($key, $parameters);
+
+        if ($replayed !== null) {
+            return $replayed;
         }
 
         $id = 'prod_'.substr(sha1($name.count($this->products)), 0, 12);
         $this->products[$id] = ['name' => $name, 'metadata' => $metadata];
 
-        if ($idempotencyKey !== null) {
-            $this->keys[$idempotencyKey] = $id;
-        }
+        $this->rememberKey($key, $id, $parameters);
 
         return $id;
     }
@@ -173,8 +199,17 @@ class FakeStripeClient implements StripeClient
         array $metadata = [],
         ?string $idempotencyKey = null,
     ): string {
-        if ($idempotencyKey !== null && isset($this->keys[$idempotencyKey])) {
-            return $this->keys[$idempotencyKey];
+        $key = IdempotencyKey::forPrice($idempotencyKey, $productId, $amountCents, $currency, $interval, $metadata);
+
+        // Same reasoning as createProduct(): the parameters forPrice() just
+        // fingerprinted, not a second literal that has to be kept in step by
+        // hand.
+        $parameters = IdempotencyKey::priceParameters($productId, $amountCents, $currency, $interval, $metadata);
+
+        $replayed = $this->replay($key, $parameters);
+
+        if ($replayed !== null) {
+            return $replayed;
         }
 
         $id = 'price_'.substr(sha1($productId.$amountCents.$interval.count($this->prices)), 0, 12);
@@ -184,11 +219,18 @@ class FakeStripeClient implements StripeClient
             'currency' => $currency,
             'interval' => $interval,
             'metadata' => $metadata,
+            // Stripe stamps every object with its creation time and
+            // AdoptStripePrice takes the OLDEST of several orphans. Counted
+            // rather than clocked, because two Prices minted in the same second
+            // would share a timestamp — but the two counters are independent:
+            // plantPrice() stamps `created: 1` of its own accord, which ties with
+            // a Price minted here while this list was still empty. Any test whose
+            // outcome depends on which of two prices is older passes `created:`
+            // itself, as the adoption tests do.
+            'created' => count($this->prices) + 1,
         ];
 
-        if ($idempotencyKey !== null) {
-            $this->keys[$idempotencyKey] = $id;
-        }
+        $this->rememberKey($key, $id, $parameters);
 
         return $id;
     }
@@ -211,6 +253,76 @@ class FakeStripeClient implements StripeClient
         $this->activated[] = $priceId;
     }
 
+    public function activePricesFor(string $productId): array
+    {
+        // No failIfAsked(): createPrice(), the call this one stands in front of,
+        // does not fail either, and a test that scripts an outage for a refund
+        // must not have its catalogue sync change behaviour underneath it.
+        //
+        // None of HttpStripeClient's charging-property filter either — the four
+        // fields it names (interval_count, usage_type, transform_quantity,
+        // billing_scheme). This fake only ever holds prices its own
+        // createPrice()/plantPrice() put here, and neither takes an argument for
+        // any of them: there is nothing non-standard a test could plant, so the
+        // filter would have nothing to do. Not an oversight. What that filter
+        // does is proven where it lives, over Http::fake — see
+        // tests/Feature/Billing/StripeIdempotencyKeyTest.php.
+        $found = [];
+
+        foreach ($this->prices as $id => $price) {
+            if ($price['product'] !== $productId || in_array($id, $this->archived, true)) {
+                continue;
+            }
+
+            $found[] = [
+                'id' => $id,
+                'unit_amount' => $price['amount'],
+                'currency' => strtoupper($price['currency']),
+                'interval' => $price['interval'],
+                'created' => $price['created'],
+                'metadata' => $price['metadata'],
+            ];
+        }
+
+        return $found;
+    }
+
+    public function updatePriceMetadata(string $priceId, array $metadata): void
+    {
+        if (isset($this->prices[$priceId])) {
+            $this->prices[$priceId]['metadata'] = $metadata;
+        }
+
+        $this->metadataUpdates[] = ['price' => $priceId, 'metadata' => $metadata];
+    }
+
+    /**
+     * A Price that exists at Stripe and in no table of ours — the orphan a run
+     * leaves behind when it dies between Stripe's create and our insert.
+     *
+     * Here rather than in a test file because it is the state the whole adoption
+     * step exists for, and every test that needs it would otherwise reach into
+     * $prices and write the shape by hand.
+     */
+    public function plantPrice(
+        string $id,
+        string $productId,
+        int $amountCents,
+        string $currency,
+        string $interval,
+        array $metadata = [],
+        int $created = 1,
+    ): void {
+        $this->prices[$id] = [
+            'product' => $productId,
+            'amount' => $amountCents,
+            'currency' => $currency,
+            'interval' => $interval,
+            'metadata' => $metadata,
+            'created' => $created,
+        ];
+    }
+
     public function updateSubscriptionPrice(
         string $subscriptionId,
         string $itemId,
@@ -308,9 +420,12 @@ class FakeStripeClient implements StripeClient
             throw new RuntimeException("Unknown cancellation timing: {$when}");
         }
 
-        // Replays the first answer for a repeated key, as Stripe does, so a retry
-        // after a timeout records one order to stop rather than two.
-        if ($idempotencyKey !== null && isset($this->keys[$idempotencyKey])) {
+        // No fingerprint: for a subscription cancellation, a changed parameter
+        // under a used key is exactly what must fail loudly. See IdempotencyKey.
+        $parameters = ['subscription' => $subscriptionId, 'when' => $when];
+        $replayed = $this->replay($idempotencyKey, $parameters);
+
+        if ($replayed !== null) {
             return;
         }
 
@@ -320,9 +435,7 @@ class FakeStripeClient implements StripeClient
             'key' => $idempotencyKey,
         ];
 
-        if ($idempotencyKey !== null) {
-            $this->keys[$idempotencyKey] = $subscriptionId;
-        }
+        $this->rememberKey($idempotencyKey, $subscriptionId, $parameters);
     }
 
     public function refund(
@@ -332,10 +445,13 @@ class FakeStripeClient implements StripeClient
     ): string {
         $this->failIfAsked();
 
-        // Replays the first answer for a repeated key, as Stripe does — which
-        // is the whole point of sending one on a refund.
-        if ($idempotencyKey !== null && isset($this->keys[$idempotencyKey])) {
-            return $this->keys[$idempotencyKey];
+        // No fingerprint: for a refund, a changed parameter under a used key is
+        // exactly what must fail loudly. See IdempotencyKey.
+        $parameters = ['payment' => $paymentReference, 'amount' => (string) $amountCents];
+        $replayed = $this->replay($idempotencyKey, $parameters);
+
+        if ($replayed !== null) {
+            return $replayed;
         }
 
         $this->refunds[] = [
@@ -346,9 +462,7 @@ class FakeStripeClient implements StripeClient
 
         $id = 're_'.substr(sha1($paymentReference.count($this->refunds)), 0, 12);
 
-        if ($idempotencyKey !== null) {
-            $this->keys[$idempotencyKey] = $id;
-        }
+        $this->rememberKey($idempotencyKey, $id, $parameters);
 
         return $id;
     }
@@ -382,4 +496,33 @@ class FakeStripeClient implements StripeClient
             throw new RuntimeException($this->failWith);
         }
     }
+
+    /**
+     * The id Stripe already answered for this key, or null when it is new.
+     *
+     * Throws on a key that comes back with different parameters, which is what
+     * Stripe does — with this wording — and what makes a test able to see the
+     * failure at all.
+     */
+    private function replay(?string $key, array $parameters): ?string
+    {
+        if ($key === null || ! isset($this->keys[$key])) {
+            return null;
+        }
+
+        if ($this->keys[$key]['fingerprint'] !== IdempotencyKey::fingerprint($parameters)) {
+            throw new RuntimeException(
+                'Keys for idempotent requests can only be used with the same parameters they were first used with.',
+            );
+        }
+
+        return $this->keys[$key]['id'];
+    }
+
+    private function rememberKey(?string $key, string $id, array $parameters): void
+    {
+        if ($key !== null) {
+            $this->keys[$key] = ['id' => $id, 'fingerprint' => IdempotencyKey::fingerprint($parameters)];
+        }
+    }
 }
diff --git a/app/Services/Stripe/HttpStripeClient.php b/app/Services/Stripe/HttpStripeClient.php
index 1a4e660..94c6cf7 100644
--- a/app/Services/Stripe/HttpStripeClient.php
+++ b/app/Services/Stripe/HttpStripeClient.php
@@ -93,7 +93,7 @@ class HttpStripeClient implements StripeClient
 
     public function createProduct(string $name, array $metadata = [], ?string $idempotencyKey = null): string
     {
-        return (string) $this->request($idempotencyKey)
+        return (string) $this->request(IdempotencyKey::forProduct($idempotencyKey, $name, $metadata))
             ->asForm()
             ->post($this->url('products'), array_filter([
                 'name' => $name,
@@ -111,7 +111,9 @@ class HttpStripeClient implements StripeClient
         array $metadata = [],
         ?string $idempotencyKey = null,
     ): string {
-        return (string) $this->request($idempotencyKey)
+        return (string) $this->request(IdempotencyKey::forPrice(
+            $idempotencyKey, $productId, $amountCents, $currency, $interval, $metadata,
+        ))
             ->asForm()
             ->post($this->url('prices'), [
                 'product' => $productId,
@@ -149,6 +151,91 @@ class HttpStripeClient implements StripeClient
             ->throw();
     }
 
+    public function activePricesFor(string $productId): array
+    {
+        $prices = [];
+        $after = null;
+
+        // Paged through to the end, for the same reason invoiceLines() is: Stripe
+        // caps a page at a hundred, and a family Product collects a Price per
+        // version, term, treatment and rate change. Stopping at the first page
+        // would leave an orphan unfound and mint the duplicate anyway.
+        do {
+            $page = $this->request()
+                ->get($this->url('prices'), array_filter([
+                    'product' => $productId,
+                    'active' => 'true',
+                    'type' => 'recurring',
+                    'limit' => 100,
+                    'starting_after' => $after,
+                ], fn ($value) => $value !== null))
+                ->throw()
+                ->json();
+
+            $data = (array) ($page['data'] ?? []);
+
+            foreach ($data as $price) {
+                $recurring = (array) ($price['recurring'] ?? []);
+
+                // Only prices we could have minted ourselves. createPrice() sends
+                // product, unit_amount, currency, recurring[interval] and metadata
+                // and nothing else, so Stripe defaults every other field that
+                // decides what a Price CHARGES — and anything but those defaults
+                // is a Price this platform did not write. Skipped here rather than
+                // returned, because AdoptStripePrice compares amount, currency and
+                // interval only and trusts that triple as the whole of what a
+                // Price charges:
+                //
+                //  - interval_count multiplies the period — 3 bills every three
+                //    months — while `interval` still reads 'month';
+                //  - usage_type other than 'licensed' bills metered usage;
+                //  - a transform_quantity divides the quantity before charging,
+                //    and modules are billed BY quantity — SyncStripeAddonItems
+                //    sums a pack into one item at quantity n — so divide_by 10
+                //    would charge a customer holding three for one;
+                //  - billing_scheme 'tiered' keeps the money in tiers, leaving
+                //    unit_amount null. Read as 0 below, so such a Price fails the
+                //    amount match only while the caller's own figure is not 0 —
+                //    and PlanPrices::ensure() has no zero guard, so that is not a
+                //    condition to rest on.
+                //
+                // An ABSENT key is Stripe's default and no reason to reject.
+                // Read the other way round this filter would refuse every
+                // legitimate price and turn recognition into a permanent no-op.
+                if ((int) ($recurring['interval_count'] ?? 1) !== 1
+                    || ($recurring['usage_type'] ?? 'licensed') !== 'licensed'
+                    || (array) ($price['transform_quantity'] ?? []) !== []
+                    || ($price['billing_scheme'] ?? 'per_unit') !== 'per_unit') {
+                    continue;
+                }
+
+                $prices[] = [
+                    'id' => (string) ($price['id'] ?? ''),
+                    'unit_amount' => (int) ($price['unit_amount'] ?? 0),
+                    'currency' => strtoupper((string) ($price['currency'] ?? '')),
+                    'interval' => (string) ($recurring['interval'] ?? ''),
+                    'created' => (int) ($price['created'] ?? 0),
+                    'metadata' => array_map(
+                        fn ($value) => (string) $value,
+                        (array) ($price['metadata'] ?? []),
+                    ),
+                ];
+            }
+
+            $after = $data === [] ? null : ($data[array_key_last($data)]['id'] ?? null);
+        } while (($page['has_more'] ?? false) === true && $after !== null);
+
+        return $prices;
+    }
+
+    public function updatePriceMetadata(string $priceId, array $metadata): void
+    {
+        $this->request()
+            ->asForm()
+            ->post($this->url('prices/'.$priceId), $this->flatten('metadata', $metadata))
+            ->throw();
+    }
+
     public function updateSubscriptionPrice(
         string $subscriptionId,
         string $itemId,
@@ -348,10 +435,13 @@ class HttpStripeClient implements StripeClient
         $request = Http::withToken($this->secret())->acceptJson()->timeout(20);
 
         // Stripe replays the original response for a repeated key instead of
-        // creating a second object. That covers the gap this cannot close on
-        // its own: a crash between Stripe creating a Price and us storing its
-        // id. Their keys expire after 24 hours, so it protects a retry, not a
-        // sync re-run next week — for which the stored ids are the guard.
+        // creating a second object — but ONLY for a call repeated exactly; a
+        // changed parameter under a used key is HTTP 400 for twenty-four hours.
+        // The catalogue calls therefore fold a fingerprint of their parameters
+        // into the key (see IdempotencyKey); the money calls deliberately do
+        // not. Their keys expire after 24 hours, so this protects a retry, not
+        // a sync re-run next week — for which the stored ids and
+        // AdoptStripePrice are the guard.
         return $idempotencyKey !== null
             ? $request->withHeaders(['Idempotency-Key' => $idempotencyKey])
             : $request;
diff --git a/app/Services/Stripe/IdempotencyKey.php b/app/Services/Stripe/IdempotencyKey.php
new file mode 100644
index 0000000..d71f8ea
--- /dev/null
+++ b/app/Services/Stripe/IdempotencyKey.php
@@ -0,0 +1,111 @@
+<?php
+
+namespace App\Services\Stripe;
+
+/**
+ * The Idempotency-Key header, formed so that it cannot lie.
+ *
+ * Stripe replays the first response for a repeated key — but only if the call
+ * is repeated exactly. A key that comes back with so much as one added metadata
+ * field is answered with HTTP 400 and stays poisoned for twenty-four hours.
+ *
+ * That happened on 2026-07-29: a run created a Price and died before the row was
+ * written, 9da1358 then added the `tax_treatment` metadata field, and the next
+ * sweep sent yesterday's key with today's parameters. The sweep was blocked —
+ * and so was every module booking, because AddonPrices::ensure() runs inside one.
+ *
+ * The mistake was conceptual. A key does not state what an object IS; identity
+ * is the Price's product, amount, currency and interval, and it is
+ * AdoptStripePrice that recognises those. A key states "I have already sent
+ * this call", so everything the call sends belongs in it — which is what
+ * fingerprint() folds in.
+ *
+ * **Only for the catalogue calls.** createPrice() and createProduct(): a
+ * duplicate there is a Stripe object nothing bills on, recoverable, while a
+ * blockade reaches a paying customer. For refund(), cancelSubscription(),
+ * addSubscriptionItem() and createCheckoutSession() it is the other way round —
+ * a second object is the customer's money taken twice or a package billed
+ * twice — so those keep their bare key and Stripe's refusal with it.
+ */
+final class IdempotencyKey
+{
+    /** The key for a Price, carrying everything createPrice() puts on the wire. */
+    public static function forPrice(
+        ?string $key,
+        string $productId,
+        int $amountCents,
+        string $currency,
+        string $interval,
+        array $metadata,
+    ): ?string {
+        return self::with($key, self::priceParameters($productId, $amountCents, $currency, $interval, $metadata));
+    }
+
+    /** The key for a Product, for the same reason and against the same trap. */
+    public static function forProduct(?string $key, string $name, array $metadata): ?string
+    {
+        return self::with($key, self::productParameters($name, $metadata));
+    }
+
+    /**
+     * What counts as "the same call" for a Price — public because
+     * FakeStripeClient has to ask this exact question too, to decide whether a
+     * repeated key is a retry or a changed call. Built inline a second time in
+     * the fake, it would only ever match this by coincidence, and a later
+     * change to what a Price call fingerprints could drift from what the fake
+     * detects without a single test noticing — which is exactly the gap this
+     * task exists to close.
+     */
+    public static function priceParameters(
+        string $productId,
+        int $amountCents,
+        string $currency,
+        string $interval,
+        array $metadata,
+    ): array {
+        return [
+            'product' => $productId,
+            'unit_amount' => $amountCents,
+            'currency' => strtolower($currency),
+            'interval' => $interval,
+            'metadata' => $metadata,
+        ];
+    }
+
+    /** What counts as "the same call" for a Product — same reason as priceParameters(). */
+    public static function productParameters(string $name, array $metadata): array
+    {
+        return ['name' => $name, 'metadata' => $metadata];
+    }
+
+    /**
+     * Eight hex characters over the parameters, canonically ordered.
+     *
+     * Ordered, because PHP keeps insertion order and two callers writing the
+     * same metadata in a different order would otherwise send two keys for one
+     * call — which would mint two Prices and be a worse bug than the one this
+     * closes.
+     */
+    public static function fingerprint(array $parameters): string
+    {
+        return substr(sha1(self::canonical($parameters)), 0, 8);
+    }
+
+    private static function with(?string $key, array $parameters): ?string
+    {
+        // Null stays null: a caller who sends no key wants no replay, and
+        // inventing one here would change what the call means.
+        return $key === null ? null : $key.'-'.self::fingerprint($parameters);
+    }
+
+    private static function canonical(array $parameters): string
+    {
+        ksort($parameters);
+
+        foreach ($parameters as $name => $value) {
+            $parameters[$name] = is_array($value) ? self::canonical($value) : (string) $value;
+        }
+
+        return json_encode($parameters, JSON_THROW_ON_ERROR);
+    }
+}
diff --git a/app/Services/Stripe/StripeClient.php b/app/Services/Stripe/StripeClient.php
index 841db2d..0ffed51 100644
--- a/app/Services/Stripe/StripeClient.php
+++ b/app/Services/Stripe/StripeClient.php
@@ -124,6 +124,54 @@ interface StripeClient
         ?string $idempotencyKey = null,
     ): string;
 
+    /**
+     * Every active recurring Price of a Product, as Stripe holds them.
+     *
+     * The half of the catalogue mirror that was missing: nothing here ever asked
+     * Stripe what it already had. A run that created a Price and died before the
+     * row was written left an orphan our table never learned about, and once the
+     * idempotency key expired the next run made a SECOND live Price for the same
+     * money — the exact duplicate the key exists to prevent. See
+     * App\Services\Billing\AdoptStripePrice, which is the only caller.
+     *
+     * Active ones only, because the question being asked is "is there something
+     * here I can sell on?". `currency` comes back UPPER CASE, the way our own
+     * tables hold it.
+     *
+     * FOUR properties are checked, and they are named because the list is what
+     * the contract is: `recurring.interval_count` is 1, `recurring.usage_type`
+     * is `licensed`, there is no `transform_quantity`, and `billing_scheme` is
+     * `per_unit`. Those are Stripe's own defaults, and createPrice() sets none of
+     * the four — so anything else is a Price this platform did not write, and is
+     * filtered out here rather than returned.
+     *
+     * The reason it is filtered at all: AdoptStripePrice compares the amount,
+     * currency and interval of the shape below and trusts that triple as the
+     * WHOLE of what a Price charges. A Price billed every three months, on
+     * metered usage, dividing the quantity before charging, or pricing in tiers
+     * would otherwise pass that triple on `interval => 'month'` alone and be
+     * adopted as if it charged our figure per unit per month — which is adoption
+     * moving money, the one thing nothing here may do.
+     *
+     * Not a list of everything Stripe can put on a Price: it is the list of
+     * fields known to change what one CHARGES. A fifth would have to be added
+     * here, at the boundary, before the shape below is handed on.
+     *
+     * @return array<int, array{id: string, unit_amount: int, currency: string, interval: string, created: int, metadata: array<string, string>}>
+     */
+    public function activePricesFor(string $productId): array;
+
+    /**
+     * Write metadata onto a Price that already exists.
+     *
+     * Metadata is one of the few fields a Stripe Price lets you change — the
+     * same property activatePrice() rests on, and the reason the metadata format
+     * is NOT part of a Price's identity. An adopted orphan is brought up to
+     * today's metadata rather than replaced, which is exactly what was done by
+     * hand after 2026-07-29 and keeps Stripe's own dashboard readable.
+     */
+    public function updatePriceMetadata(string $priceId, array $metadata): void;
+
     /** Stop a Price being offered. The Price itself stays, as Stripe requires. */
     public function archivePrice(string $priceId): void;
 
diff --git a/app/Support/Navigation.php b/app/Support/Navigation.php
index b730faf..d6d7617 100644
--- a/app/Support/Navigation.php
+++ b/app/Support/Navigation.php
@@ -72,6 +72,14 @@ final class Navigation
             ]],
             ['label' => __('admin.nav_group.system'), 'items' => [
                 ['admin.mail', 'mail', 'mail', 'mail.manage'],
+                // Looking at a mail before a customer does. Beside the mailboxes
+                // it is sent from, not under Betrieb: both are about how mail
+                // leaves this installation.
+                ['admin.mail.preview', 'send', 'mail_preview', 'mail.manage'],
+                // The processing agreement. Under System with the other things
+                // that are true of the whole installation rather than of one
+                // customer.
+                ['admin.dpa', 'file-text', 'dpa', 'dpa.manage'],
                 // System, not Betrieb: the tunnel is how the console reaches
                 // the estate at all. Nothing is provisioned, monitored or
                 // updated through anything else, so it belongs beside the other
diff --git a/database/migrations/2026_07_31_210000_one_row_per_stripe_price.php b/database/migrations/2026_07_31_210000_one_row_per_stripe_price.php
new file mode 100644
index 0000000..359efba
--- /dev/null
+++ b/database/migrations/2026_07_31_210000_one_row_per_stripe_price.php
@@ -0,0 +1,107 @@
+<?php
+
+use Illuminate\Database\Migrations\Migration;
+use Illuminate\Database\Schema\Blueprint;
+use Illuminate\Support\Facades\DB;
+use Illuminate\Support\Facades\Log;
+use Illuminate\Support\Facades\Schema;
+
+/**
+ * One row per Stripe Price on the module side too.
+ *
+ * `stripe_plan_prices.stripe_price_id` has been unique since
+ * 2026_07_30_110000; the module register was never given the same guard, so two
+ * rows could claim one Price — and archiving the one would have withdrawn the
+ * Price the other was still selling. It is also the net under the adoption step
+ * (App\Services\Billing\AdoptStripePrice): at a VAT rate of nought both
+ * treatments charge the same amount, and the check that refuses an
+ * already-claimed Price is then the only thing keeping them apart.
+ *
+ * Duplicates are DELETED rather than archived. An archived row goes on claiming
+ * the id, and a unique index knows nothing about `archived_at`. Deleting is safe
+ * because the row rebuilds itself — but not through adoption: the survivor keeps
+ * the shared Price, so AdoptStripePrice's `claimed` callback reports it taken no
+ * matter which row asks, and the deleted row's own tuple — necessarily a
+ * DIFFERENT one, since the composite unique on (addon_key, reverse_charge,
+ * amount_cents, currency, interval) from 2026_07_31_200000 forbids two rows
+ * sharing a tuple — mints a fresh Price of its own instead, under its own
+ * tuple-specific idempotency key (AddonPrices::ensure() falling through to
+ * createPrice()). `subscription_addons` holds the Stripe id as text, not as a
+ * foreign key, so no booking loses its price either way.
+ *
+ * MariaDB does not run DDL in a transaction, so the deletes below are already
+ * committed by the time `Schema::table()` adds the index — a row inserted between
+ * the two on a Price id that is still shared aborts the migration with the deletes
+ * standing. Re-running is safe (the dedupe is idempotent and the index is simply
+ * not there yet), but the sweep and anything else calling
+ * AddonPrices::ensure() — a customer's module booking included — should be
+ * quiesced for the one real run this gets.
+ *
+ * The `Log::warning` below is the only record this ever gets: `down()` restores
+ * the index, not the rows it deleted. It names the shared Price, the row kept,
+ * and every row thrown away, so an operator reading the log after the one real
+ * run this migration gets can check the survivor's `amount_cents` against what
+ * Stripe actually charges for that Price — the lowest id is written first, not
+ * necessarily right, and nothing else will say what was discarded.
+ */
+return new class extends Migration
+{
+    public function up(): void
+    {
+        // Written with groupBy/having and a delete by id rather than a joined
+        // delete: production is MariaDB and the suite runs on SQLite.
+        $shared = DB::table('stripe_addon_prices')
+            ->select('stripe_price_id')
+            ->groupBy('stripe_price_id')
+            ->havingRaw('count(*) > 1')
+            ->pluck('stripe_price_id');
+
+        foreach ($shared as $priceId) {
+            $rows = DB::table('stripe_addon_prices')->where('stripe_price_id', $priceId)->get();
+
+            // The lowest id stays — the row that was written first, which is the
+            // one anything already billing is likeliest to have been reading.
+            $keep = (int) $rows->min('id');
+            $kept = $rows->first(fn ($row) => (int) $row->id === $keep);
+            $discarded = $rows->reject(fn ($row) => (int) $row->id === $keep);
+
+            // The only forensic trace this delete ever leaves — see the class
+            // docblock for why that has to be enough.
+            Log::warning('stripe: kept one row of several claiming one price, deleted the rest', [
+                'stripe_price_id' => $priceId,
+                'kept' => [
+                    'id' => $kept->id,
+                    'addon_key' => $kept->addon_key,
+                    'reverse_charge' => (bool) $kept->reverse_charge,
+                    'amount_cents' => $kept->amount_cents,
+                    'currency' => $kept->currency,
+                    'interval' => $kept->interval,
+                ],
+                'deleted' => $discarded->map(fn ($row) => [
+                    'id' => $row->id,
+                    'addon_key' => $row->addon_key,
+                    'reverse_charge' => (bool) $row->reverse_charge,
+                    'amount_cents' => $row->amount_cents,
+                    'currency' => $row->currency,
+                    'interval' => $row->interval,
+                ])->values()->all(),
+            ]);
+
+            DB::table('stripe_addon_prices')
+                ->where('stripe_price_id', $priceId)
+                ->where('id', '!=', $keep)
+                ->delete();
+        }
+
+        Schema::table('stripe_addon_prices', function (Blueprint $table) {
+            $table->unique('stripe_price_id', 'stripe_addon_prices_price_unique');
+        });
+    }
+
+    public function down(): void
+    {
+        Schema::table('stripe_addon_prices', function (Blueprint $table) {
+            $table->dropUnique('stripe_addon_prices_price_unique');
+        });
+    }
+};
diff --git a/database/migrations/2026_07_31_220000_warn_before_a_dormant_account_is_removed.php b/database/migrations/2026_07_31_220000_warn_before_a_dormant_account_is_removed.php
new file mode 100644
index 0000000..be6eeff
--- /dev/null
+++ b/database/migrations/2026_07_31_220000_warn_before_a_dormant_account_is_removed.php
@@ -0,0 +1,31 @@
+<?php
+
+use Illuminate\Database\Migrations\Migration;
+use Illuminate\Database\Schema\Blueprint;
+use Illuminate\Support\Facades\Schema;
+
+/**
+ * An account nobody ever bought anything with is removed after a year — and told
+ * about it first.
+ *
+ * The column is what makes "told about it first" provable. Without it the sweep
+ * would either write the warning every night for the last fortnight, or send it
+ * on exactly one calendar day and lose it whenever that night's run did not
+ * happen. Neither is a promise anybody can keep in an AGB.
+ */
+return new class extends Migration
+{
+    public function up(): void
+    {
+        Schema::table('users', function (Blueprint $table) {
+            $table->timestamp('dormant_warned_at')->nullable()->after('email_verified_at');
+        });
+    }
+
+    public function down(): void
+    {
+        Schema::table('users', function (Blueprint $table) {
+            $table->dropColumn('dormant_warned_at');
+        });
+    }
+};
diff --git a/database/migrations/2026_07_31_230000_say_how_many_months_a_year_is_free.php b/database/migrations/2026_07_31_230000_say_how_many_months_a_year_is_free.php
new file mode 100644
index 0000000..d20b05d
--- /dev/null
+++ b/database/migrations/2026_07_31_230000_say_how_many_months_a_year_is_free.php
@@ -0,0 +1,81 @@
+<?php
+
+use App\Models\Subscription;
+use Illuminate\Database\Migrations\Migration;
+use Illuminate\Database\Schema\Blueprint;
+use Illuminate\Support\Facades\DB;
+use Illuminate\Support\Facades\Schema;
+
+/**
+ * How many months a customer gets for nothing by paying for a year.
+ *
+ * The yearly price was already there — one `plan_prices` row per term, each with
+ * its own Stripe Price — but only as a total somebody typed. So nothing in the
+ * system knew WHY 588 was the yearly figure for a package costing 49 a month,
+ * and no page could say "two months free" without a second person working it out
+ * by hand and writing it down somewhere it would then drift.
+ *
+ * The figure lives on the VERSION, beside the capabilities publication freezes,
+ * because that is what it is: part of the terms a customer bought. The yearly
+ * amount stays in `plan_prices` — Stripe charges an amount, not a discount — and
+ * the console derives one from the other so the two cannot disagree.
+ *
+ * ## The backfill
+ *
+ * Read out of the prices that exist rather than defaulted to zero: an
+ * installation already selling twelve-for-ten must not lose that on a deploy.
+ * Only an exact division counts. A yearly price of 580 against a monthly of 49
+ * is not "eleven and a bit months free", it is a figure somebody negotiated, and
+ * 0 leaves it alone — the amount charged is untouched either way, only the
+ * sentence beside it goes unsaid.
+ */
+return new class extends Migration
+{
+    public function up(): void
+    {
+        Schema::table('plan_versions', function (Blueprint $table) {
+            $table->unsignedTinyInteger('free_months')->default(0)->after('seats');
+        });
+
+        $monthly = DB::table('plan_prices')
+            ->where('term', Subscription::TERM_MONTHLY)
+            ->pluck('amount_cents', 'plan_version_id');
+
+        foreach (DB::table('plan_prices')->where('term', Subscription::TERM_YEARLY)->get() as $yearly) {
+            $perMonth = (int) ($monthly[$yearly->plan_version_id] ?? 0);
+
+            if ($perMonth <= 0) {
+                continue;
+            }
+
+            // Modulo, not a division compared against its own cast: PHP's `/`
+            // returns an INT when two ints divide exactly, so `12 === 12.0` is
+            // false and a check written that way rejects precisely the case it
+            // was meant to accept. This one asks the only question there is —
+            // does the monthly price go into the yearly one a whole number of
+            // times.
+            if ((int) $yearly->amount_cents % $perMonth !== 0) {
+                continue;
+            }
+
+            $paidMonths = intdiv((int) $yearly->amount_cents, $perMonth);
+
+            // Inside the year. Anything else was priced by hand and is left to
+            // speak for itself.
+            if ($paidMonths < 1 || $paidMonths > 12) {
+                continue;
+            }
+
+            DB::table('plan_versions')
+                ->where('id', $yearly->plan_version_id)
+                ->update(['free_months' => 12 - $paidMonths]);
+        }
+    }
+
+    public function down(): void
+    {
+        Schema::table('plan_versions', function (Blueprint $table) {
+            $table->dropColumn('free_months');
+        });
+    }
+};
diff --git a/database/migrations/2026_08_01_090000_take_the_billing_address_field_by_field.php b/database/migrations/2026_08_01_090000_take_the_billing_address_field_by_field.php
new file mode 100644
index 0000000..9597400
--- /dev/null
+++ b/database/migrations/2026_08_01_090000_take_the_billing_address_field_by_field.php
@@ -0,0 +1,44 @@
+<?php
+
+use Illuminate\Database\Migrations\Migration;
+use Illuminate\Database\Schema\Blueprint;
+use Illuminate\Support\Facades\Schema;
+
+/**
+ * The billing address, as fields rather than as a paragraph.
+ *
+ * It was one textarea, so what landed in it was whatever somebody typed: a
+ * postcode on the street line, a city with no postcode at all, an address with
+ * the country missing. An invoice has to name a recipient precisely enough to be
+ * a document, and a free-text block cannot be checked, cannot be sorted, and
+ * cannot be handed to anything that expects a country.
+ *
+ * ## The old column stays, and stays authoritative for what is in it
+ *
+ * `billing_address` is not dropped and not parsed. Guessing which line of an
+ * existing block is the street would put a postcode where a street belongs on a
+ * document nobody can correct afterwards — the same reason IssueInvoice carries
+ * it as lines today. It becomes the COMPOSED form instead: whenever the fields
+ * are saved, the block is rewritten from them, so invoices, the console's
+ * customer page and everything else that reads it keep working untouched. A
+ * record nobody has re-saved keeps the block it always had.
+ */
+return new class extends Migration
+{
+    public function up(): void
+    {
+        Schema::table('customers', function (Blueprint $table) {
+            $table->string('billing_street')->nullable()->after('billing_address');
+            $table->string('billing_postcode', 32)->nullable()->after('billing_street');
+            $table->string('billing_city')->nullable()->after('billing_postcode');
+            $table->string('billing_country')->nullable()->after('billing_city');
+        });
+    }
+
+    public function down(): void
+    {
+        Schema::table('customers', function (Blueprint $table) {
+            $table->dropColumn(['billing_street', 'billing_postcode', 'billing_city', 'billing_country']);
+        });
+    }
+};
diff --git a/database/migrations/2026_08_01_091000_record_why_a_contract_was_cancelled.php b/database/migrations/2026_08_01_091000_record_why_a_contract_was_cancelled.php
new file mode 100644
index 0000000..97123b7
--- /dev/null
+++ b/database/migrations/2026_08_01_091000_record_why_a_contract_was_cancelled.php
@@ -0,0 +1,35 @@
+<?php
+
+use Illuminate\Database\Migrations\Migration;
+use Illuminate\Database\Schema\Blueprint;
+use Illuminate\Support\Facades\Schema;
+
+/**
+ * Why a customer left.
+ *
+ * The cancellation recorded WHEN and nothing else, so the one thing worth
+ * knowing about a departure — whether it was the price, a missing feature, or a
+ * competitor — existed only in whatever the customer happened to write to
+ * support afterwards, which most do not.
+ *
+ * On the contract rather than on the instance: a contract is what is cancelled,
+ * and it is where the withdrawal is already recorded (withdrawal_channel and the
+ * rest). The reason is a fixed key, the note is what they typed.
+ */
+return new class extends Migration
+{
+    public function up(): void
+    {
+        Schema::table('subscriptions', function (Blueprint $table) {
+            $table->string('cancel_reason', 32)->nullable()->after('cancel_requested_at');
+            $table->text('cancel_reason_note')->nullable()->after('cancel_reason');
+        });
+    }
+
+    public function down(): void
+    {
+        Schema::table('subscriptions', function (Blueprint $table) {
+            $table->dropColumn(['cancel_reason', 'cancel_reason_note']);
+        });
+    }
+};
diff --git a/database/migrations/2026_08_01_100000_keep_the_processing_agreement_and_who_accepted_it.php b/database/migrations/2026_08_01_100000_keep_the_processing_agreement_and_who_accepted_it.php
new file mode 100644
index 0000000..61f93f2
--- /dev/null
+++ b/database/migrations/2026_08_01_100000_keep_the_processing_agreement_and_who_accepted_it.php
@@ -0,0 +1,76 @@
+<?php
+
+use Illuminate\Database\Migrations\Migration;
+use Illuminate\Database\Schema\Blueprint;
+use Illuminate\Support\Facades\Schema;
+
+/**
+ * The data-processing agreement, and the proof that a customer has it.
+ *
+ * Art. 28(3) GDPR requires one wherever personal data is processed on somebody
+ * else's behalf, which is the whole of what this product does. "In writing"
+ * there explicitly includes electronic form, so a document the customer can read
+ * and a recorded acceptance is enough — a signature on paper is not required.
+ *
+ * Two tables, because they answer two different questions:
+ *
+ *  - `dpa_versions` is the DOCUMENT. The operator uploads it (the text is a
+ *    lawyer's, not this application's), gives it a version, and publishes. The
+ *    technical and organisational measures are a second file rather than a
+ *    second concept: they are an annex to the agreement and are versioned with
+ *    it, so "which TOMs applied when they accepted" has one answer.
+ *  - `dpa_acceptances` is the EVIDENCE: which customer accepted which version,
+ *    when, from where, and which login did it. One row per acceptance and never
+ *    an update — a new version is a new row, and the history is the point.
+ *
+ * The file lives on the private disk. An agreement is not a public asset, and a
+ * guessable URL to it would be a list of who our customers are.
+ */
+return new class extends Migration
+{
+    public function up(): void
+    {
+        Schema::create('dpa_versions', function (Blueprint $table) {
+            $table->id();
+            $table->uuid()->unique();
+            // What the operator calls it — "1.0", "2026-08", whatever the
+            // document itself says. Unique, because two documents with one name
+            // makes every acceptance ambiguous.
+            $table->string('version', 64)->unique();
+            $table->string('agreement_path');
+            $table->string('measures_path')->nullable();
+            $table->text('note')->nullable();
+            // Null while it is being prepared. Only a published version is
+            // shown to anybody, and only the newest published one is current.
+            $table->timestamp('published_at')->nullable();
+            $table->foreignId('created_by')->nullable()->constrained('operators')->nullOnDelete();
+            $table->timestamps();
+
+            $table->index('published_at');
+        });
+
+        Schema::create('dpa_acceptances', function (Blueprint $table) {
+            $table->id();
+            $table->uuid()->unique();
+            $table->foreignId('customer_id')->constrained('customers')->cascadeOnDelete();
+            $table->foreignId('dpa_version_id')->constrained('dpa_versions')->cascadeOnDelete();
+            // The login that pressed it, kept as evidence even when that user is
+            // later removed — the acceptance was still made.
+            $table->foreignId('user_id')->nullable()->constrained('users')->nullOnDelete();
+            $table->string('ip', 45)->nullable();
+            $table->timestamp('accepted_at');
+            $table->timestamps();
+
+            // One acceptance per customer per version. Pressing twice is not two
+            // agreements, and the unique index is what makes that true rather
+            // than a check somebody can forget.
+            $table->unique(['customer_id', 'dpa_version_id']);
+        });
+    }
+
+    public function down(): void
+    {
+        Schema::dropIfExists('dpa_acceptances');
+        Schema::dropIfExists('dpa_versions');
+    }
+};
diff --git a/database/migrations/2026_08_01_101000_add_the_dpa_manage_permission.php b/database/migrations/2026_08_01_101000_add_the_dpa_manage_permission.php
new file mode 100644
index 0000000..42f4213
--- /dev/null
+++ b/database/migrations/2026_08_01_101000_add_the_dpa_manage_permission.php
@@ -0,0 +1,40 @@
+<?php
+
+use Illuminate\Database\Migrations\Migration;
+use Spatie\Permission\Models\Permission;
+use Spatie\Permission\Models\Role;
+use Spatie\Permission\PermissionRegistrar;
+
+/**
+ * Publishing the processing agreement is a legal act, not an everyday one.
+ *
+ * Its own capability rather than settings.manage: whoever keeps the platform
+ * running does not thereby decide what every customer is asked to agree to.
+ *
+ * Guard `operator`, not `web`. RBAC moved to the operator guard on 2026-07-29
+ * (see that migration) — every capability written under `web` after it lands in
+ * a guard nothing authenticates against, and the console answers 403 for a role
+ * that visibly has the permission. Which is exactly what happened here first.
+ */
+return new class extends Migration
+{
+    public function up(): void
+    {
+        app(PermissionRegistrar::class)->forgetCachedPermissions();
+
+        $permission = Permission::findOrCreate('dpa.manage', 'operator');
+
+        foreach (['Owner', 'Admin'] as $role) {
+            Role::findOrCreate($role, 'operator')->givePermissionTo($permission);
+        }
+
+        app(PermissionRegistrar::class)->forgetCachedPermissions();
+    }
+
+    public function down(): void
+    {
+        app(PermissionRegistrar::class)->forgetCachedPermissions();
+        Permission::where('name', 'dpa.manage')->where('guard_name', 'operator')->delete();
+        app(PermissionRegistrar::class)->forgetCachedPermissions();
+    }
+};
diff --git a/docs/handoffs/2026-07-30-real-run-handoff.md b/docs/handoffs/2026-07-30-real-run-handoff.md
index 8f51e21..3364113 100644
--- a/docs/handoffs/2026-07-30-real-run-handoff.md
+++ b/docs/handoffs/2026-07-30-real-run-handoff.md
@@ -172,8 +172,11 @@ Neuer Schritt zwischen `SecureHostFirewall` und `CompleteHostOnboarding`:
 - `VerifyVmTemplate` prüft nur **Existenz**, nicht `template: 1`.
 - `applyFirewall()` setzt **nicht** `firewall=1` an `net0` der VM — ohne das greifen
   die Gastregeln trotz Datacenter-Firewall nicht. Prüfen, ob die Vorlage es mitbringt.
-- `stripe_addon_prices.stripe_price_id` ist **nicht** eindeutig (Plan-Seite schon):
-  zwei Zeilen könnten einen Preis teilen, Archivieren würde den anderen mitentziehen.
+- ~~`stripe_addon_prices.stripe_price_id` ist **nicht** eindeutig (Plan-Seite schon):
+  zwei Zeilen könnten einen Preis teilen, Archivieren würde den anderen mitentziehen.~~
+  **Erledigt** — eindeutig seit `2026_07_31_210000_one_row_per_stripe_price`; zugleich
+  das Netz unter dem Wiedererkennungsschritt, siehe
+  `docs/superpowers/specs/2026-07-30-stripe-price-adoption-design.md`.
 - `clupilot:end-due-services` schließt den **Vertrag** nicht — ein geschenkter Vertrag
   bleibt nach Ende der Instanz für immer `active` und zählt in Umsatz/Dashboard mit.
 - Eine Abbuchung, die **vor** dem Widerruf entstand und **danach** bezahlt wird,
diff --git a/docs/superpowers/plans/2026-07-30-stripe-price-adoption.md b/docs/superpowers/plans/2026-07-30-stripe-price-adoption.md
new file mode 100644
index 0000000..6334685
--- /dev/null
+++ b/docs/superpowers/plans/2026-07-30-stripe-price-adoption.md
@@ -0,0 +1,1883 @@
+# Stripe Price Adoption — Implementation Plan
+
+> **For agentic workers:** REQUIRED SUB-SKILL: Use superpowers:subagent-driven-development (recommended) or superpowers:executing-plans to implement this plan task-by-task. Steps use checkbox (`- [ ]`) syntax for tracking.
+
+**Goal:** Ein Abgleich, der zwischen Stripes Anlage und unserem Schreiben abbricht, erkennt den vorhandenen Preis beim nächsten Lauf wieder statt einen zweiten anzulegen — und eine Änderung an den Metadaten von `createPrice` blockiert Abgleich und Kundenbuchung nie wieder mit HTTP 400.
+
+**Architecture:** Zwei neue Bauteile. `App\Services\Stripe\IdempotencyKey` faltet einen Fingerabdruck der tatsächlich gesendeten Parameter in den Schlüssel — angewandt **nur** auf `createPrice`/`createProduct`, nie auf Geldbewegungen. `App\Services\Billing\AdoptStripePrice` fragt Stripe vor dem Anlegen nach den aktiven Preisen des Produkts und übernimmt einen beweisbar eigenen. Beide Preis-Dienste (`AddonPrices`, `PlanPrices`) bekommen den Wiedererkennungsschritt zwischen Tabellen-Blick und `createPrice`. Dazu ein eindeutiger Index auf `stripe_addon_prices.stripe_price_id` als Netz darunter.
+
+**Tech Stack:** Laravel 11, Pest, Livewire (nicht berührt), Stripe REST über `Illuminate\Http\Client`, MariaDB in Produktion / SQLite `:memory:` in Tests.
+
+**Spec:** `docs/superpowers/specs/2026-07-30-stripe-price-adoption-design.md`
+
+## Global Constraints
+
+- **Commit-Disziplin (Nutzervorgabe, nicht verhandelbar):** Eine zweite Session arbeitet im selben Git-Index. **Immer** `git add -- <pfade>` und `git commit -F - -- <pfade>`. **Nie** `git add -A`, `git add .`, `git commit -a`.
+- **Sprache:** Code, Kommentare, Log-Meldungen und Commit-Botschaften **englisch**. Spec/Plan/Handoff-Dokumente **deutsch**. Kommentare erklären das *Warum*, nicht das *Was* — das ist die Hausschrift dieses Repos, siehe die vorhandenen Klassenkommentare in `app/Services/Billing/`.
+- **Bestehende Verträge behalten ihre alten Preise.** Neue Preise gelten nur für neu abschließende Kunden. Keine Änderung dieses Plans darf einen laufenden Vertrag auf einen anderen Betrag bewegen.
+- **Jede Buchung friert ihren Preis ein.** Ein später gebuchtes Modul kommt zum heutigen Preis; eine Stornierung zieht den damaligen Betrag ab.
+- **Der Fingerabdruck ist ausschließlich für `createPrice` und `createProduct`.** Bei `refund`, `cancelSubscription`, `addSubscriptionItem` und `createCheckoutSession` muss Stripes HTTP 400 bei geänderten Parametern erhalten bleiben — dort ist ein Duplikat doppelt abgebuchtes Kundengeld.
+- **`TaxTreatment` bleibt die einzige Steuerinstanz.** `automatic_tax` bleibt aus.
+- **Kein Testlauf mit `--filter` als Abschluss:** jede Task endet mit dem vollen Billing-Ordner (`php artisan test --testsuite=Feature tests/Feature/Billing`), bevor committet wird.
+- **Zahlen für Tests, aus dem echten Katalog:** `priority_support` = `2900` Netto (`config/provisioning.php:308`), Steuersatz 20 % → `3480` verrechnet monatlich, `34800` Netto/`41760` verrechnet jährlich. `3480 EUR monatlich` ist genau der Preis aus dem Vorfall (`price_1TygdEC7u8NpJ8pOt3nsoyYw`).
+
+---
+
+## Korrekturen
+
+**Dieses Dokument ist nicht geprüft, sondern korrigiert.** Die Reviews der
+einzelnen Tasks haben **fünf Defekte im Plan selbst** gefunden — nicht in der
+Umsetzung. Sie stehen hier, damit niemand die Anweisungen weiter unten für
+verifiziert hält. Der vollständige Verlauf, Task für Task, liegt in
+`.superpowers/sdd/2026-07-30-stripe-price-adoption/progress.md`.
+
+1. **Ein zerstörerischer Befehl.** Task 6, Step 5 verlangte
+   `php artisan migrate:fresh --env=testing`. Es gibt in diesem Repo keine
+   `.env.testing`, also hätte der Befehl die echte, von laufenden Containern
+   benutzte Entwicklungsdatenbank neu gebaut. Der Umsetzer hat den Schritt
+   verweigert — richtig — und den Index über den SQLite-Migrationslauf der Suite
+   belegt. Der Schritt steht unten durchgestrichen mit Warnung, statt gelöscht.
+2. **Eine Begründung, deren Mechanismus nicht feuern kann.** Der
+   Migrations-Kommentar im vorgeschriebenen Codeblock von Task 6 sagt, die
+   gelöschte Zeile baue sich wieder auf, indem `ensure()` den Preis „through the
+   adoption step" bei Stripe findet. Genau das kann nicht passieren: nach dem
+   Entdoppeln beansprucht die überlebende Zeile diese Preis-ID, also lehnt
+   `AdoptStripePrice` sie über die `claimed`-Prüfung immer ab. Der Wiederaufbau
+   ist echt, läuft aber über `createPrice()` unter dem tupel-eigenen Schlüssel.
+   Die ausgelieferte Migration ist berichtigt; der Plantext schreibt die falsche
+   Fassung weiter vor. Die Commit-Botschaft in Step 8 sagt nur „the row rebuilds
+   itself on the next ensure()" und nennt den Mechanismus nicht — das ist wahr,
+   aber es ist nicht die Begründung, die ausgeliefert wurde.
+3. **Ein tautologischer Test.** Der einzige Test, der in Task 4 die
+   Auftraggeber-Regel „jede Buchung friert ihren Preis ein" bewachte, prüfte
+   `subscription_addons.stripe_price_id` nach einem `stripe:sync-catalogue`-Lauf —
+   eine Spalte, die dieses Kommando nie schreibt. Er war grün, bevor
+   `AddonPrices.php` überhaupt angefasst war.
+4. **Zwei Plan-Tests, die mit entfernter Übernahme bestanden.** Beide neuen Tests
+   aus Task 5 liefen grün, nachdem der `adopt()`-Aufruf entfernt war. Ursache:
+   sie erzeugten ihre Waise über einen echten Sync-Lauf, sodass der
+   Schlüssel-Ledger des Fakes dieselbe Preis-ID zurückspielte — also genau der
+   Zustand (Schlüssel noch in Kraft), in dem es nichts zu beweisen gibt. Der
+   Vorfall vom 29.07. konnte erst **nach** dem Ablauf des Schlüssels entstehen.
+5. **Drei falsche Testzahlen.** Die „Expected"-Zeilen von Task 1, 2 und 3 nennen
+   sieben, zehn und acht Tests; die dort vorgeschriebenen Dateien enthalten sechs,
+   neun und sieben.
+
+Die Abschnitte darunter sind **absichtlich nicht umgeschrieben** — die
+vorgeschriebenen Codeblöcke bleiben stehen, wie sie umgesetzt wurden, damit Plan
+und Verlauf vergleichbar bleiben. Diese Liste ist die Korrektur.
+
+---
+
+## Dateistruktur
+
+**Neu**
+
+| Datei | Verantwortung |
+|---|---|
+| `app/Services/Stripe/IdempotencyKey.php` | Bildet Header-Werte: sprechender Schlüssel + Fingerabdruck der Aufrufparameter. Die **einzige** Stelle, an der ein Fingerabdruck entsteht — beide Clients müssen denselben Wert bilden. |
+| `app/Services/Billing/AdoptStripePrice.php` | Der Wiedererkennungsschritt und seine fünf Bedingungen. Weiß nichts über Module oder Pakete; bekommt Produkt, Betrag, Metadaten und eine Frage „ist diese ID schon beansprucht?" gestellt. |
+| `database/migrations/2026_07_31_210000_one_row_per_stripe_price.php` | Entdoppelt `stripe_addon_prices` und macht `stripe_price_id` eindeutig. |
+| `tests/Feature/Billing/StripeIdempotencyKeyTest.php` | Was auf der Leitung landet (`Http::fake` gegen `HttpStripeClient`) und dass der Fake Stripe nachbildet. |
+| `tests/Feature/Billing/StripePriceAdoptionTest.php` | Die Übernahmeregeln, beide Seiten, plus der eindeutige Index und die eingefrorene Buchung. |
+
+**Geändert**
+
+| Datei | Änderung |
+|---|---|
+| `app/Services/Stripe/StripeClient.php` | Zwei Methoden am Vertrag: `activePricesFor()`, `updatePriceMetadata()`. |
+| `app/Services/Stripe/HttpStripeClient.php` | Beide Methoden umgesetzt; Fingerabdruck an `createPrice`/`createProduct`. |
+| `app/Services/Stripe/FakeStripeClient.php` | Beide Methoden; `created` an den Preisen; `plantPrice()` für Tests; Schlüssel-Ledger vergleicht Parameter. |
+| `app/Services/Billing/AddonPrices.php` | Wiedererkennung vor `createPrice`; Schlüssel-Kommentar berichtigt. |
+| `app/Services/Billing/PlanPrices.php` | Dasselbe. |
+| `docs/handoffs/2026-07-30-real-run-handoff.md` | Block-D-Punkt zur Eindeutigkeit als erledigt markieren. |
+
+**Reihenfolge und Abhängigkeit:** Task 1 (Schlüssel) und Task 2 (Client-Methoden) sind unabhängig voneinander. Task 3 braucht Task 2. Task 4 und 5 brauchen Task 3. Task 6 ist unabhängig, kommt aber zuletzt, weil ihr Test die Übernahme aus Task 4 mitprüft.
+
+---
+
+### Task 1: Der Idempotenz-Schlüssel trägt, was gesendet wird
+
+**Files:**
+- Create: `app/Services/Stripe/IdempotencyKey.php`
+- Modify: `app/Services/Stripe/HttpStripeClient.php:87-121` (`createProduct`, `createPrice`)
+- Modify: `app/Services/Stripe/FakeStripeClient.php:37-38` (Ledger-Eigenschaft), `:151-193` (`createProduct`, `createPrice`), `:313`, `:337-350` (`cancelSubscription`, `refund`)
+- Test: `tests/Feature/Billing/StripeIdempotencyKeyTest.php`
+
+**Interfaces:**
+- Consumes: nichts.
+- Produces:
+  - `IdempotencyKey::forPrice(?string $key, string $productId, int $amountCents, string $currency, string $interval, array $metadata): ?string`
+  - `IdempotencyKey::forProduct(?string $key, string $name, array $metadata): ?string`
+  - `IdempotencyKey::fingerprint(array $parameters): string` — acht Hex-Zeichen
+  - `FakeStripeClient::$keys` wechselt von `array<string, string>` zu `array<string, array{id: string, fingerprint: string}>`. **Kein Test liest die Eigenschaft** (geprüft), nur der Fake selbst an vier Stellen.
+
+- [ ] **Step 1: Write the failing test**
+
+`tests/Feature/Billing/StripeIdempotencyKeyTest.php`:
+
+```php
+<?php
+
+use App\Services\Stripe\FakeStripeClient;
+use App\Services\Stripe\HttpStripeClient;
+use Illuminate\Support\Facades\Http;
+
+/**
+ * A key says "I have already sent this call" — not "this is what the object is".
+ *
+ * The difference cost a day. A run created a Price at Stripe and died before the
+ * row was written; the next sweep sent the SAME key with an added metadata field
+ * and Stripe refused it for twenty-four hours — the sweep and, because
+ * AddonPrices::ensure() also runs inside a customer's module booking, the
+ * booking with it.
+ *
+ * So every parameter that goes on the wire goes into the key. On the catalogue
+ * calls only: for a refund or a second subscription item, Stripe's refusal is
+ * the thing standing between a customer and being charged twice.
+ */
+beforeEach(function () {
+    // The environment fallback is enough — HttpStripeClient reads the vault,
+    // and the vault falls back to config until a secret has been stored.
+    config()->set('services.stripe.secret', 'sk_test_plan_task_one');
+});
+
+it('sends a different key once the metadata changes', function () {
+    Http::fake(['api.stripe.com/*' => Http::response(['id' => 'price_x'])]);
+
+    $client = new HttpStripeClient;
+    $spoken = 'clupilot-addon-price-priority_support-month-3480-EUR';
+
+    // The call as it stood before 9da1358, and the call after it: same money,
+    // same interval, one metadata field more.
+    $client->createPrice('prod_1', 3480, 'EUR', 'month',
+        ['addon' => 'priority_support'], $spoken);
+
+    $client->createPrice('prod_1', 3480, 'EUR', 'month',
+        ['addon' => 'priority_support', 'tax_treatment' => 'domestic'], $spoken);
+
+    $sent = collect(Http::recorded())
+        ->map(fn (array $pair) => $pair[0]->header('Idempotency-Key')[0] ?? null)
+        ->all();
+
+    expect($sent[0])->toStartWith($spoken)
+        ->and($sent[1])->toStartWith($spoken)
+        ->and($sent[1])->not->toBe($sent[0]);
+});
+
+it('sends the same key for the very same call', function () {
+    Http::fake(['api.stripe.com/*' => Http::response(['id' => 'price_x'])]);
+
+    $client = new HttpStripeClient;
+
+    foreach ([1, 2] as $ignored) {
+        $client->createPrice('prod_1', 3480, 'EUR', 'month',
+            ['addon' => 'priority_support'], 'clupilot-addon-price');
+    }
+
+    $sent = collect(Http::recorded())
+        ->map(fn (array $pair) => $pair[0]->header('Idempotency-Key')[0] ?? null)
+        ->unique()
+        ->all();
+
+    expect($sent)->toHaveCount(1);
+});
+
+it('fingerprints the product call too, where the same trap was waiting', function () {
+    Http::fake(['api.stripe.com/*' => Http::response(['id' => 'prod_x'])]);
+
+    $client = new HttpStripeClient;
+
+    $client->createProduct('Priority Support', ['addon' => 'priority_support'], 'clupilot-addon-product-x');
+    $client->createProduct('Priority Support', ['addon' => 'priority_support', 'sold_as' => 'entitlement'], 'clupilot-addon-product-x');
+
+    $sent = collect(Http::recorded())
+        ->map(fn (array $pair) => $pair[0]->header('Idempotency-Key')[0] ?? null)
+        ->all();
+
+    expect($sent[1])->not->toBe($sent[0]);
+});
+
+it('leaves the money calls their bare key, so Stripe still refuses a changed one', function () {
+    Http::fake(['api.stripe.com/*' => Http::response(['id' => 'x'])]);
+
+    $client = new HttpStripeClient;
+
+    $client->refund('pi_1', 500, 'clupilot-refund-7');
+    $client->cancelSubscription('sub_1', 'at_period_end', 'clupilot-cancel-7');
+    $client->addSubscriptionItem('sub_1', 'price_1', 1, 'none', 'clupilot-item-7');
+
+    $sent = collect(Http::recorded())
+        ->map(fn (array $pair) => $pair[0]->header('Idempotency-Key')[0] ?? null)
+        ->all();
+
+    expect($sent)->toBe(['clupilot-refund-7', 'clupilot-cancel-7', 'clupilot-item-7']);
+});
+
+it('reproduces the refusal Stripe makes, which the fake used to swallow', function () {
+    $fake = new FakeStripeClient;
+
+    $fake->refund('pi_1', 500, 'clupilot-refund-7');
+
+    // Same key, different amount. Stripe answers 400; the fake said nothing and
+    // replayed the first refund's id, which is how a test could pass over the
+    // very failure that stopped production.
+    expect(fn () => $fake->refund('pi_1', 900, 'clupilot-refund-7'))
+        ->toThrow(RuntimeException::class, 'same parameters');
+});
+
+it('mints a second price rather than blocking when the metadata moved', function () {
+    $fake = new FakeStripeClient;
+
+    $first = $fake->createPrice('prod_1', 3480, 'EUR', 'month',
+        ['addon' => 'priority_support'], 'clupilot-addon-price');
+
+    $second = $fake->createPrice('prod_1', 3480, 'EUR', 'month',
+        ['addon' => 'priority_support', 'tax_treatment' => 'domestic'], 'clupilot-addon-price');
+
+    // Two objects, no exception. That the second one is not WANTED is the job of
+    // AdoptStripePrice, not of the key — see StripePriceAdoptionTest.
+    expect($second)->not->toBe($first);
+});
+```
+
+- [ ] **Step 2: Run test to verify it fails**
+
+```bash
+php artisan test tests/Feature/Billing/StripeIdempotencyKeyTest.php
+```
+
+Expected: FAIL — `Class "App\Services\Stripe\IdempotencyKey" not found` erscheint noch nicht, weil der Test die Klasse nicht direkt anfasst; stattdessen schlagen die Erwartungen fehl (`$sent[1]` **ist** gleich `$sent[0]`), und der Refund-Test schlägt fehl, weil der Fake nicht wirft.
+
+- [ ] **Step 3: Write `IdempotencyKey`**
+
+`app/Services/Stripe/IdempotencyKey.php`:
+
+```php
+<?php
+
+namespace App\Services\Stripe;
+
+/**
+ * The Idempotency-Key header, formed so that it cannot lie.
+ *
+ * Stripe replays the first response for a repeated key — but only if the call
+ * is repeated exactly. A key that comes back with so much as one added metadata
+ * field is answered with HTTP 400 and stays poisoned for twenty-four hours.
+ *
+ * That happened on 2026-07-29: a run created a Price and died before the row was
+ * written, 9da1358 then added the `tax_treatment` metadata field, and the next
+ * sweep sent yesterday's key with today's parameters. The sweep was blocked —
+ * and so was every module booking, because AddonPrices::ensure() runs inside one.
+ *
+ * The mistake was conceptual. A key does not state what an object IS; identity
+ * is the Price's product, amount, currency and interval, and it is
+ * AdoptStripePrice that recognises those. A key states "I have already sent
+ * this call", so everything the call sends belongs in it — which is what
+ * fingerprint() folds in.
+ *
+ * **Only for the catalogue calls.** createPrice() and createProduct(): a
+ * duplicate there is a Stripe object nothing bills on, recoverable, while a
+ * blockade reaches a paying customer. For refund(), cancelSubscription(),
+ * addSubscriptionItem() and createCheckoutSession() it is the other way round —
+ * a second object is the customer's money taken twice or a package billed
+ * twice — so those keep their bare key and Stripe's refusal with it.
+ */
+final class IdempotencyKey
+{
+    /** The key for a Price, carrying everything createPrice() puts on the wire. */
+    public static function forPrice(
+        ?string $key,
+        string $productId,
+        int $amountCents,
+        string $currency,
+        string $interval,
+        array $metadata,
+    ): ?string {
+        return self::with($key, [
+            'product' => $productId,
+            'unit_amount' => $amountCents,
+            'currency' => strtolower($currency),
+            'interval' => $interval,
+            'metadata' => $metadata,
+        ]);
+    }
+
+    /** The key for a Product, for the same reason and against the same trap. */
+    public static function forProduct(?string $key, string $name, array $metadata): ?string
+    {
+        return self::with($key, ['name' => $name, 'metadata' => $metadata]);
+    }
+
+    /**
+     * Eight hex characters over the parameters, canonically ordered.
+     *
+     * Ordered, because PHP keeps insertion order and two callers writing the
+     * same metadata in a different order would otherwise send two keys for one
+     * call — which would mint two Prices and be a worse bug than the one this
+     * closes.
+     */
+    public static function fingerprint(array $parameters): string
+    {
+        return substr(sha1(self::canonical($parameters)), 0, 8);
+    }
+
+    private static function with(?string $key, array $parameters): ?string
+    {
+        // Null stays null: a caller who sends no key wants no replay, and
+        // inventing one here would change what the call means.
+        return $key === null ? null : $key.'-'.self::fingerprint($parameters);
+    }
+
+    private static function canonical(array $parameters): string
+    {
+        ksort($parameters);
+
+        foreach ($parameters as $name => $value) {
+            $parameters[$name] = is_array($value) ? self::canonical($value) : (string) $value;
+        }
+
+        return json_encode($parameters, JSON_THROW_ON_ERROR);
+    }
+}
+```
+
+- [ ] **Step 4: Wire it into `HttpStripeClient`**
+
+`app/Services/Stripe/HttpStripeClient.php` — `createProduct` (ab `:87`):
+
+```php
+    public function createProduct(string $name, array $metadata = [], ?string $idempotencyKey = null): string
+    {
+        return (string) $this->request(IdempotencyKey::forProduct($idempotencyKey, $name, $metadata))
+            ->asForm()
+            ->post($this->url('products'), array_filter([
+                'name' => $name,
+                ...$this->flatten('metadata', $metadata),
+            ]))
+            ->throw()
+            ->json('id');
+    }
+```
+
+`createPrice` (ab `:99`) — nur die erste Zeile des `return` ändert sich:
+
+```php
+        return (string) $this->request(IdempotencyKey::forPrice(
+            $idempotencyKey, $productId, $amountCents, $currency, $interval, $metadata,
+        ))
+            ->asForm()
+            ->post($this->url('prices'), [
+```
+
+Und den Kommentar in `request()` (`:344-351`) ergänzen — er behauptet heute, der Schlüssel schütze einen Retry, und verschweigt, dass er einen geänderten Aufruf abwürgt:
+
+```php
+        // Stripe replays the original response for a repeated key instead of
+        // creating a second object — but ONLY for a call repeated exactly; a
+        // changed parameter under a used key is HTTP 400 for twenty-four hours.
+        // The catalogue calls therefore fold a fingerprint of their parameters
+        // into the key (see IdempotencyKey); the money calls deliberately do
+        // not. Their keys expire after 24 hours, so this protects a retry, not
+        // a sync re-run next week — for which the stored ids and
+        // AdoptStripePrice are the guard.
+```
+
+`use App\Services\Stripe\IdempotencyKey;` ist **nicht** nötig — dieselbe Namespace.
+
+- [ ] **Step 5: Make the fake faithful**
+
+`app/Services/Stripe/FakeStripeClient.php` — Eigenschaft ersetzen (`:37-38`):
+
+```php
+    /**
+     * Idempotency key → what was first answered for it, and a fingerprint of
+     * what it was first sent with.
+     *
+     * The fingerprint is the half that was missing. This ledger replayed the
+     * first id for a repeated key without ever looking at what the second call
+     * was asking for — so it was unrealistic in precisely the way that mattered,
+     * and no test could see the 2026-07-29 blockade.
+     *
+     * @var array<string, array{id: string, fingerprint: string}>
+     */
+    public array $keys = [];
+```
+
+Zwei private Helfer am Ende der Klasse, neben `failIfAsked()`:
+
+```php
+    /**
+     * The id Stripe already answered for this key, or null when it is new.
+     *
+     * Throws on a key that comes back with different parameters, which is what
+     * Stripe does — with this wording — and what makes a test able to see the
+     * failure at all.
+     */
+    private function replay(?string $key, array $parameters): ?string
+    {
+        if ($key === null || ! isset($this->keys[$key])) {
+            return null;
+        }
+
+        if ($this->keys[$key]['fingerprint'] !== IdempotencyKey::fingerprint($parameters)) {
+            throw new RuntimeException(
+                'Keys for idempotent requests can only be used with the same parameters they were first used with.',
+            );
+        }
+
+        return $this->keys[$key]['id'];
+    }
+
+    private function rememberKey(?string $key, string $id, array $parameters): void
+    {
+        if ($key !== null) {
+            $this->keys[$key] = ['id' => $id, 'fingerprint' => IdempotencyKey::fingerprint($parameters)];
+        }
+    }
+```
+
+`createProduct` (`:151-166`) — Schlüssel **mit Fingerabdruck**, genau wie der HTTP-Client, sonst prüft der Test etwas anderes als die Produktion sendet:
+
+```php
+    public function createProduct(string $name, array $metadata = [], ?string $idempotencyKey = null): string
+    {
+        $key = IdempotencyKey::forProduct($idempotencyKey, $name, $metadata);
+        $parameters = ['name' => $name, 'metadata' => $metadata];
+
+        // Replays the first answer for a repeated key, as Stripe does.
+        $replayed = $this->replay($key, $parameters);
+
+        if ($replayed !== null) {
+            return $replayed;
+        }
+
+        $id = 'prod_'.substr(sha1($name.count($this->products)), 0, 12);
+        $this->products[$id] = ['name' => $name, 'metadata' => $metadata];
+
+        $this->rememberKey($key, $id, $parameters);
+
+        return $id;
+    }
+```
+
+`createPrice` (`:168-194`) — dasselbe Muster, plus `created` am gespeicherten Preis (Task 3 sortiert danach):
+
+```php
+    public function createPrice(
+        string $productId,
+        int $amountCents,
+        string $currency,
+        string $interval,
+        array $metadata = [],
+        ?string $idempotencyKey = null,
+    ): string {
+        $key = IdempotencyKey::forPrice($idempotencyKey, $productId, $amountCents, $currency, $interval, $metadata);
+        $parameters = [
+            'product' => $productId,
+            'unit_amount' => $amountCents,
+            'currency' => strtolower($currency),
+            'interval' => $interval,
+            'metadata' => $metadata,
+        ];
+
+        $replayed = $this->replay($key, $parameters);
+
+        if ($replayed !== null) {
+            return $replayed;
+        }
+
+        $id = 'price_'.substr(sha1($productId.$amountCents.$interval.count($this->prices)), 0, 12);
+        $this->prices[$id] = [
+            'product' => $productId,
+            'amount' => $amountCents,
+            'currency' => $currency,
+            'interval' => $interval,
+            'metadata' => $metadata,
+            // Stripe stamps every object with its creation time and
+            // AdoptStripePrice takes the OLDEST of several orphans. A counter
+            // is enough and beats a clock: it cannot tie.
+            'created' => count($this->prices) + 1,
+        ];
+
+        $this->rememberKey($key, $id, $parameters);
+
+        return $id;
+    }
+```
+
+Das `@var` der Eigenschaft `$prices` (`:22`) um `created: int` ergänzen.
+
+`cancelSubscription` (`:313`, `:324`) und `refund` (`:337`, `:350`) auf `replay()`/`rememberKey()` umstellen — **ohne** `IdempotencyKey`, mit dem rohen Schlüssel:
+
+```php
+        // No fingerprint: for a refund, a changed parameter under a used key is
+        // exactly what must fail loudly. See IdempotencyKey.
+        $parameters = ['payment' => $paymentReference, 'amount' => (string) $amountCents];
+        $replayed = $this->replay($idempotencyKey, $parameters);
+
+        if ($replayed !== null) {
+            return $replayed;
+        }
+```
+
+und nach dem Anlegen `$this->rememberKey($idempotencyKey, $id, $parameters);`. Für `cancelSubscription` sind die Parameter `['subscription' => $subscriptionId, 'when' => $when]`, die gemerkte „id" bleibt `$subscriptionId` wie heute.
+
+- [ ] **Step 6: Run the test to verify it passes**
+
+```bash
+php artisan test tests/Feature/Billing/StripeIdempotencyKeyTest.php
+```
+
+Expected: PASS, sieben Tests.
+
+- [ ] **Step 7: Run the whole billing folder — the fake is used by a dozen files**
+
+```bash
+php artisan test tests/Feature/Billing
+```
+
+Expected: PASS. Wenn hier etwas fällt, ist es ein Test, der einen Schlüssel zweimal mit verschiedenen Parametern schickte und das bisher nicht merkte — **das ist ein echter Fund**, nicht ein zu unterdrückender Testfehler: den Aufrufer korrigieren, nicht den Fake.
+
+- [ ] **Step 8: Commit**
+
+```bash
+git add -- app/Services/Stripe/IdempotencyKey.php app/Services/Stripe/HttpStripeClient.php app/Services/Stripe/FakeStripeClient.php tests/Feature/Billing/StripeIdempotencyKeyTest.php
+```
+
+```bash
+git commit -F - -- app/Services/Stripe/IdempotencyKey.php app/Services/Stripe/HttpStripeClient.php app/Services/Stripe/FakeStripeClient.php tests/Feature/Billing/StripeIdempotencyKeyTest.php <<'MSG'
+Put in the key everything the call actually sends
+
+A key says "I already sent this call", not "this is what the object is". The
+catalogue calls sent metadata that the key knew nothing about, so adding the
+tax_treatment field in 9da1358 poisoned yesterday's key for a day — and
+AddonPrices::ensure() runs inside a customer's module booking, not only in the
+sweep.
+
+createPrice and createProduct now fold a fingerprint of their parameters into
+the key. refund, cancelSubscription, addSubscriptionItem and the checkout
+deliberately do not: there a second object is the customer's money taken twice,
+and Stripe's refusal is the thing worth keeping.
+
+The fake could not see any of this. Its ledger replayed the first id for a
+repeated key without ever comparing what the second call asked for.
+
+Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
+MSG
+```
+
+---
+
+### Task 2: Stripe fragen, was es schon hat
+
+**Files:**
+- Modify: `app/Services/Stripe/StripeClient.php:118-140` (zwischen `createPrice` und `archivePrice`)
+- Modify: `app/Services/Stripe/HttpStripeClient.php` (nach `activatePrice`, `:143`)
+- Modify: `app/Services/Stripe/FakeStripeClient.php` (nach `activatePrice`, `:201-212`)
+- Test: `tests/Feature/Billing/StripeIdempotencyKeyTest.php` (zwei Tests angehängt — dieselbe Datei, weil es wieder um das geht, was auf der Leitung landet)
+
+**Interfaces:**
+- Consumes: nichts aus Task 1.
+- Produces:
+  - `StripeClient::activePricesFor(string $productId): array` — Liste von
+    `array{id: string, unit_amount: int, currency: string, interval: string, created: int, metadata: array<string, string>}`.
+    **`currency` kommt GROSSGESCHRIEBEN zurück** (Stripe liefert klein; unsere Tabellen halten groß), `interval` ist `month`/`year`.
+  - `StripeClient::updatePriceMetadata(string $priceId, array $metadata): void`
+  - `FakeStripeClient::plantPrice(string $id, string $productId, int $amountCents, string $currency, string $interval, array $metadata, int $created = 1): void`
+  - `FakeStripeClient::$metadataUpdates` — `array<int, array{price: string, metadata: array<string, string>}>`
+
+- [ ] **Step 1: Write the failing test**
+
+An `tests/Feature/Billing/StripeIdempotencyKeyTest.php` anhängen:
+
+```php
+it('pages through every active price of a product', function () {
+    Http::fake([
+        'api.stripe.com/*' => Http::sequence()
+            ->push([
+                'data' => [
+                    ['id' => 'price_a', 'unit_amount' => 3480, 'currency' => 'eur',
+                        'created' => 100, 'recurring' => ['interval' => 'month'],
+                        'metadata' => ['addon' => 'priority_support']],
+                    ['id' => 'price_b', 'unit_amount' => 41760, 'currency' => 'eur',
+                        'created' => 101, 'recurring' => ['interval' => 'year'], 'metadata' => []],
+                ],
+                'has_more' => true,
+            ])
+            ->push([
+                'data' => [
+                    ['id' => 'price_c', 'unit_amount' => 2900, 'currency' => 'eur',
+                        'created' => 102, 'recurring' => ['interval' => 'month'],
+                        'metadata' => ['addon' => 'priority_support', 'tax_treatment' => 'reverse_charge']],
+                ],
+                'has_more' => false,
+            ]),
+    ]);
+
+    $prices = (new HttpStripeClient)->activePricesFor('prod_1');
+
+    expect($prices)->toHaveCount(3)
+        ->and($prices[0])->toBe([
+            'id' => 'price_a',
+            'unit_amount' => 3480,
+            // Upper case, because that is how our own tables hold it and the
+            // comparison in AdoptStripePrice must not have to remember which
+            // side is which.
+            'currency' => 'EUR',
+            'interval' => 'month',
+            'created' => 100,
+            'metadata' => ['addon' => 'priority_support'],
+        ])
+        ->and($prices[2]['id'])->toBe('price_c');
+
+    // The second page has to be asked for, or this reintroduces the very gap it
+    // exists to close — a family product accumulates prices across versions,
+    // terms, treatments and every rate change.
+    Http::assertSent(fn ($request) => str_contains($request->url(), 'starting_after=price_b'));
+
+    // Archived prices are none of our business here: we are looking for
+    // something to SELL on.
+    Http::assertSent(fn ($request) => str_contains($request->url(), 'active=true'));
+});
+
+it('writes metadata onto a price that already exists', function () {
+    Http::fake(['api.stripe.com/*' => Http::response(['id' => 'price_a'])]);
+
+    (new HttpStripeClient)->updatePriceMetadata('price_a', ['addon' => 'priority_support']);
+
+    Http::assertSent(fn ($request) => $request->url() === 'https://api.stripe.com/v1/prices/price_a'
+        && $request['metadata[addon]'] === 'priority_support');
+});
+
+it('lets the fake answer with the prices it holds, minus the archived ones', function () {
+    $fake = new FakeStripeClient;
+
+    $kept = $fake->createPrice('prod_1', 3480, 'EUR', 'month', ['addon' => 'priority_support']);
+    $gone = $fake->createPrice('prod_1', 2900, 'EUR', 'month', ['addon' => 'priority_support']);
+    $other = $fake->createPrice('prod_2', 3480, 'EUR', 'month', []);
+    $fake->archivePrice($gone);
+
+    $fake->plantPrice('price_orphan', 'prod_1', 3480, 'EUR', 'month',
+        ['addon' => 'priority_support'], created: 0);
+
+    $found = collect($fake->activePricesFor('prod_1'))->pluck('id')->all();
+
+    expect($found)->toContain($kept, 'price_orphan')
+        ->and($found)->not->toContain($gone, $other);
+});
+```
+
+- [ ] **Step 2: Run test to verify it fails**
+
+```bash
+php artisan test tests/Feature/Billing/StripeIdempotencyKeyTest.php
+```
+
+Expected: FAIL — `Call to undefined method App\Services\Stripe\HttpStripeClient::activePricesFor()`.
+
+- [ ] **Step 3: Add both methods to the contract**
+
+`app/Services/Stripe/StripeClient.php`, zwischen `createPrice` und `archivePrice`:
+
+```php
+    /**
+     * Every active recurring Price of a Product, as Stripe holds them.
+     *
+     * The half of the catalogue mirror that was missing: nothing here ever asked
+     * Stripe what it already had. A run that created a Price and died before the
+     * row was written left an orphan our table never learned about, and once the
+     * idempotency key expired the next run made a SECOND live Price for the same
+     * money — the exact duplicate the key exists to prevent. See
+     * App\Services\Billing\AdoptStripePrice, which is the only caller.
+     *
+     * Active ones only, because the question being asked is "is there something
+     * here I can sell on?". `currency` comes back UPPER CASE, the way our own
+     * tables hold it.
+     *
+     * @return array<int, array{id: string, unit_amount: int, currency: string, interval: string, created: int, metadata: array<string, string>}>
+     */
+    public function activePricesFor(string $productId): array;
+
+    /**
+     * Write metadata onto a Price that already exists.
+     *
+     * Metadata is one of the few fields a Stripe Price lets you change — the
+     * same property activatePrice() rests on, and the reason the metadata format
+     * is NOT part of a Price's identity. An adopted orphan is brought up to
+     * today's metadata rather than replaced, which is exactly what was done by
+     * hand after 2026-07-29 and keeps Stripe's own dashboard readable.
+     */
+    public function updatePriceMetadata(string $priceId, array $metadata): void;
+```
+
+- [ ] **Step 4: Implement in `HttpStripeClient`** (nach `activatePrice`)
+
+```php
+    public function activePricesFor(string $productId): array
+    {
+        $prices = [];
+        $after = null;
+
+        // Paged through to the end, for the same reason invoiceLines() is: Stripe
+        // caps a page at a hundred, and a family Product collects a Price per
+        // version, term, treatment and rate change. Stopping at the first page
+        // would leave an orphan unfound and mint the duplicate anyway.
+        do {
+            $page = $this->request()
+                ->get($this->url('prices'), array_filter([
+                    'product' => $productId,
+                    'active' => 'true',
+                    'type' => 'recurring',
+                    'limit' => 100,
+                    'starting_after' => $after,
+                ], fn ($value) => $value !== null))
+                ->throw()
+                ->json();
+
+            $data = (array) ($page['data'] ?? []);
+
+            foreach ($data as $price) {
+                $prices[] = [
+                    'id' => (string) ($price['id'] ?? ''),
+                    'unit_amount' => (int) ($price['unit_amount'] ?? 0),
+                    'currency' => strtoupper((string) ($price['currency'] ?? '')),
+                    'interval' => (string) ($price['recurring']['interval'] ?? ''),
+                    'created' => (int) ($price['created'] ?? 0),
+                    'metadata' => array_map(
+                        fn ($value) => (string) $value,
+                        (array) ($price['metadata'] ?? []),
+                    ),
+                ];
+            }
+
+            $after = $data === [] ? null : ($data[array_key_last($data)]['id'] ?? null);
+        } while (($page['has_more'] ?? false) === true && $after !== null);
+
+        return $prices;
+    }
+
+    public function updatePriceMetadata(string $priceId, array $metadata): void
+    {
+        $this->request()
+            ->asForm()
+            ->post($this->url('prices/'.$priceId), $this->flatten('metadata', $metadata))
+            ->throw();
+    }
+```
+
+- [ ] **Step 5: Implement in `FakeStripeClient`** (nach `activatePrice`)
+
+```php
+    public function activePricesFor(string $productId): array
+    {
+        // No failIfAsked(): createPrice(), the call this one stands in front of,
+        // does not fail either, and a test that scripts an outage for a refund
+        // must not have its catalogue sync change behaviour underneath it.
+        $found = [];
+
+        foreach ($this->prices as $id => $price) {
+            if ($price['product'] !== $productId || in_array($id, $this->archived, true)) {
+                continue;
+            }
+
+            $found[] = [
+                'id' => $id,
+                'unit_amount' => $price['amount'],
+                'currency' => strtoupper($price['currency']),
+                'interval' => $price['interval'],
+                'created' => $price['created'],
+                'metadata' => $price['metadata'],
+            ];
+        }
+
+        return $found;
+    }
+
+    public function updatePriceMetadata(string $priceId, array $metadata): void
+    {
+        if (isset($this->prices[$priceId])) {
+            $this->prices[$priceId]['metadata'] = $metadata;
+        }
+
+        $this->metadataUpdates[] = ['price' => $priceId, 'metadata' => $metadata];
+    }
+
+    /**
+     * A Price that exists at Stripe and in no table of ours — the orphan a run
+     * leaves behind when it dies between Stripe's create and our insert.
+     *
+     * Here rather than in a test file because it is the state the whole adoption
+     * step exists for, and every test that needs it would otherwise reach into
+     * $prices and write the shape by hand.
+     */
+    public function plantPrice(
+        string $id,
+        string $productId,
+        int $amountCents,
+        string $currency,
+        string $interval,
+        array $metadata = [],
+        int $created = 1,
+    ): void {
+        $this->prices[$id] = [
+            'product' => $productId,
+            'amount' => $amountCents,
+            'currency' => $currency,
+            'interval' => $interval,
+            'metadata' => $metadata,
+            'created' => $created,
+        ];
+    }
+```
+
+Eigenschaft dazu, neben `$activated`:
+
+```php
+    /**
+     * Every metadata write, in order, so a test can assert that an adopted
+     * orphan was brought up to today's metadata instead of being replaced.
+     *
+     * @var array<int, array{price: string, metadata: array<string, string>}>
+     */
+    public array $metadataUpdates = [];
+```
+
+- [ ] **Step 6: Run the tests**
+
+```bash
+php artisan test tests/Feature/Billing/StripeIdempotencyKeyTest.php
+```
+
+Expected: PASS, zehn Tests.
+
+- [ ] **Step 7: Run the billing folder**
+
+```bash
+php artisan test tests/Feature/Billing
+```
+
+Expected: PASS.
+
+- [ ] **Step 8: Commit**
+
+```bash
+git add -- app/Services/Stripe/StripeClient.php app/Services/Stripe/HttpStripeClient.php app/Services/Stripe/FakeStripeClient.php tests/Feature/Billing/StripeIdempotencyKeyTest.php
+```
+
+```bash
+git commit -F - -- app/Services/Stripe/StripeClient.php app/Services/Stripe/HttpStripeClient.php app/Services/Stripe/FakeStripeClient.php tests/Feature/Billing/StripeIdempotencyKeyTest.php <<'MSG'
+Let the catalogue ask Stripe what it already has
+
+Nothing here could. The client could create, archive and unarchive a Price and
+had no way to list one, so a run that died between Stripe's create and our
+insert left an orphan our table never learned about — and once the key expired,
+the next run made a second live Price for the same money.
+
+Paged to the end like invoiceLines(), because a family Product collects a Price
+per version, term, treatment and rate change, and stopping at the first page
+would leave the orphan unfound and mint the duplicate anyway.
+
+updatePriceMetadata() alongside it: metadata is one of the few fields a Price
+lets you change, which is why the metadata format is not part of a Price's
+identity and why an adopted orphan is brought up to date rather than replaced.
+
+Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
+MSG
+```
+
+---
+
+### Task 3: `AdoptStripePrice` — die fünf Bedingungen
+
+**Files:**
+- Create: `app/Services/Billing/AdoptStripePrice.php`
+- Test: `tests/Feature/Billing/StripePriceAdoptionTest.php`
+
+**Interfaces:**
+- Consumes: `StripeClient::activePricesFor()`, `updatePriceMetadata()`, `archivePrice()` aus Task 2. `FakeStripeClient::plantPrice()`, `$metadataUpdates`.
+- Produces:
+
+```php
+public function __invoke(
+    string $productId,
+    int $amountCents,
+    string $currency,
+    string $interval,
+    array $metadata,
+    array $identifying,
+    callable $claimed,   // fn (string $priceId): bool
+): ?string
+```
+
+  Gibt die übernommene Preis-ID zurück oder `null`, wenn nichts zu übernehmen ist. `$identifying` sind die Metadatenschlüssel, die einen Preis als unseren ausweisen (`['addon']` bzw. `['plan_price_id']`).
+
+- [ ] **Step 1: Write the failing test**
+
+`tests/Feature/Billing/StripePriceAdoptionTest.php`:
+
+```php
+<?php
+
+use App\Services\Billing\AdoptStripePrice;
+use App\Services\Stripe\FakeStripeClient;
+use App\Services\Stripe\StripeClient;
+use Illuminate\Support\Facades\Log;
+
+/**
+ * A run that dies between Stripe's create and our insert leaves an orphan — and
+ * the next run must recognise it instead of minting a second live Price for the
+ * same money.
+ *
+ * On 2026-07-29 23:11 a sweep created price_1TygdEC7u8NpJ8pOt3nsoyYw
+ * (priority_support, 3480 EUR, monthly) and died before the row was written.
+ * The idempotency key covered the next twenty-four hours and then stopped
+ * covering anything; after that, the guard against a duplicate was nothing at
+ * all. This is that guard.
+ *
+ * What may be adopted is narrow on purpose: same money, same interval, same
+ * currency, proof in the metadata that the Price is ours, and no row claiming
+ * it already. Adopting somebody else's Price would be a worse failure than
+ * minting a second one, and adopting a Price at a DIFFERENT amount would move
+ * money — which nothing here is allowed to do.
+ */
+beforeEach(function () {
+    $this->stripe = new FakeStripeClient;
+    app()->instance(StripeClient::class, $this->stripe);
+});
+
+/** The module metadata as AddonPrices sends it today. */
+function moduleMetadata(string $treatment = 'domestic'): array
+{
+    return ['addon' => 'priority_support', 'tax_treatment' => $treatment];
+}
+
+/** Ask the adoption step the question AddonPrices asks it. */
+function adoptModulePrice(?array $metadata = null, ?callable $claimed = null): ?string
+{
+    return app(AdoptStripePrice::class)(
+        productId: 'prod_support',
+        amountCents: 3480,
+        currency: 'EUR',
+        interval: 'month',
+        metadata: $metadata ?? moduleMetadata(),
+        identifying: ['addon'],
+        claimed: $claimed ?? fn (string $id) => false,
+    );
+}
+
+it('adopts the orphan of 2026-07-29 instead of minting a second price', function () {
+    // The state that morning: the Price exists at Stripe, carries the metadata
+    // of the code that made it — WITHOUT tax_treatment, which 9da1358 added
+    // afterwards — and no row of ours knows it.
+    $this->stripe->plantPrice('price_1TygdEC7u8NpJ8pOt3nsoyYw', 'prod_support',
+        3480, 'EUR', 'month', ['addon' => 'priority_support']);
+
+    expect(adoptModulePrice())->toBe('price_1TygdEC7u8NpJ8pOt3nsoyYw');
+
+    // Brought up to today's metadata rather than replaced: metadata is mutable
+    // at Stripe, the amount is not, which is the whole reason the format is no
+    // part of a Price's identity.
+    expect($this->stripe->metadataUpdates)->toBe([[
+        'price' => 'price_1TygdEC7u8NpJ8pOt3nsoyYw',
+        'metadata' => moduleMetadata(),
+    ]]);
+});
+
+it('leaves the metadata alone when it already says the right thing', function () {
+    $this->stripe->plantPrice('price_ok', 'prod_support', 3480, 'EUR', 'month', moduleMetadata());
+
+    expect(adoptModulePrice())->toBe('price_ok')
+        ->and($this->stripe->metadataUpdates)->toBe([]);
+});
+
+it('adopts nothing when the amount, currency or interval differ', function () {
+    $this->stripe->plantPrice('price_cheaper', 'prod_support', 2900, 'EUR', 'month', moduleMetadata());
+    $this->stripe->plantPrice('price_yearly', 'prod_support', 3480, 'EUR', 'year', moduleMetadata());
+    $this->stripe->plantPrice('price_dollars', 'prod_support', 3480, 'USD', 'month', moduleMetadata());
+
+    expect(adoptModulePrice())->toBeNull();
+});
+
+it('refuses a price nothing proves is ours, and says so', function () {
+    Log::spy();
+
+    // What a person clicking through Stripe's own dashboard leaves behind: the
+    // right money on our product, and not one word about what it is for.
+    $this->stripe->plantPrice('price_by_hand', 'prod_support', 3480, 'EUR', 'month', []);
+
+    expect(adoptModulePrice())->toBeNull();
+
+    Log::shouldHaveReceived('warning')->once();
+});
+
+it('passes silently over another of our own prices', function () {
+    Log::spy();
+
+    // At a VAT rate of nought both treatments are the same amount, so the
+    // reverse-charge Price sits at the domestic one's money — and contradicts on
+    // tax_treatment. That is not a mystery worth a warning; it is a Price of
+    // ours that is not the one being asked for.
+    $this->stripe->plantPrice('price_rc', 'prod_support', 3480, 'EUR', 'month',
+        moduleMetadata('reverse_charge'));
+
+    expect(adoptModulePrice())->toBeNull();
+
+    Log::shouldNotHaveReceived('warning');
+});
+
+it('never hands out a price a row already claims', function () {
+    $this->stripe->plantPrice('price_taken', 'prod_support', 3480, 'EUR', 'month', moduleMetadata());
+
+    expect(adoptModulePrice(claimed: fn (string $id) => $id === 'price_taken'))->toBeNull();
+});
+
+it('adopts the oldest of several orphans and stops selling the rest', function () {
+    Log::spy();
+
+    $this->stripe->plantPrice('price_second', 'prod_support', 3480, 'EUR', 'month',
+        ['addon' => 'priority_support'], created: 200);
+    $this->stripe->plantPrice('price_first', 'prod_support', 3480, 'EUR', 'month',
+        ['addon' => 'priority_support'], created: 100);
+    $this->stripe->plantPrice('price_third', 'prod_support', 3480, 'EUR', 'month',
+        ['addon' => 'priority_support'], created: 300);
+
+    // The oldest, because it is the one a lost row is likeliest to have been
+    // billing on.
+    expect(adoptModulePrice())->toBe('price_first')
+        ->and($this->stripe->archived)->toBe(['price_second', 'price_third']);
+
+    Log::shouldHaveReceived('warning');
+});
+```
+
+- [ ] **Step 2: Run test to verify it fails**
+
+```bash
+php artisan test tests/Feature/Billing/StripePriceAdoptionTest.php
+```
+
+Expected: FAIL — `Target class [App\Services\Billing\AdoptStripePrice] does not exist.`
+
+- [ ] **Step 3: Write the implementation**
+
+`app/Services/Billing/AdoptStripePrice.php`:
+
+```php
+<?php
+
+namespace App\Services\Billing;
+
+use App\Services\Stripe\StripeClient;
+use Illuminate\Support\Facades\Log;
+
+/**
+ * The Stripe Price we were about to create and Stripe already has.
+ *
+ * An abandoned run leaves an orphan: Stripe made the Price, our insert never
+ * happened, and the table that decides everything afterwards does not know it
+ * exists. The idempotency key covers the next twenty-four hours; after that it
+ * covers nothing, and the run that follows makes a SECOND live Price for the
+ * same money — precisely the duplicate the key was there to prevent. It happened
+ * on 2026-07-29 with priority_support at 3480 EUR.
+ *
+ * So before minting, we ask. Nothing else in the catalogue ever did.
+ *
+ * **What may be taken over, and why so narrowly.** Same amount, same currency,
+ * same interval — a Price at another figure would move money, and moving money
+ * is what this must never do: a running contract keeps the Price it was sold on
+ * and every booking stays frozen at what it cost that day. Then proof: the
+ * candidate must not contradict our metadata, and it must confirm at least one
+ * identifying key of it. An active Price at the right money on our own Product
+ * with no metadata at all is what a person clicking through Stripe's dashboard
+ * leaves behind, and adopting that would be worse than minting a second one.
+ * Finally it must be unclaimed — a Price id belongs to one row, which is what
+ * the unique index on both registers now enforces.
+ *
+ * **Several orphans.** The oldest is adopted, because it is the one a lost row
+ * is likeliest to have been billing on, and the others are archived at Stripe.
+ * Archiving stops a Price being SOLD and leaves every subscription on it exactly
+ * where it was — the same grandfathering archiveSuperseded() has always relied
+ * on — so the rule "one live Price per figure" is restored without touching a
+ * single contract.
+ *
+ * **Reported through the log, not the console.** AddonPrices::ensure() runs
+ * inside a customer's module booking as well as in the sweep, and there is no
+ * command line there.
+ */
+final class AdoptStripePrice
+{
+    public function __construct(private readonly StripeClient $stripe) {}
+
+    /**
+     * The id of an existing Stripe Price to use instead of creating one, or null.
+     *
+     * @param  array<string, string>  $metadata  what the create call would send
+     * @param  array<int, string>  $identifying  metadata keys that mark a Price as ours
+     * @param  callable(string): bool  $claimed  is this Price id already in our register?
+     */
+    public function __invoke(
+        string $productId,
+        int $amountCents,
+        string $currency,
+        string $interval,
+        array $metadata,
+        array $identifying,
+        callable $claimed,
+    ): ?string {
+        $candidates = [];
+
+        foreach ($this->stripe->activePricesFor($productId) as $price) {
+            if ($price['unit_amount'] !== $amountCents
+                || $price['currency'] !== strtoupper($currency)
+                || $price['interval'] !== $interval) {
+                continue;
+            }
+
+            if ($claimed($price['id'])) {
+                continue;
+            }
+
+            // Contradicts on something it carries: another Price of ours, not a
+            // mystery. Silent — at a VAT rate of nought the two treatments share
+            // an amount, and this would otherwise warn on every sweep.
+            if ($this->contradicts($price['metadata'], $metadata)) {
+                continue;
+            }
+
+            if (! $this->confirms($price['metadata'], $metadata, $identifying)) {
+                Log::warning('stripe: left an unexplained active price alone rather than adopting it', [
+                    'price' => $price['id'],
+                    'product' => $productId,
+                    'amount_cents' => $amountCents,
+                    'currency' => strtoupper($currency),
+                    'interval' => $interval,
+                ]);
+
+                continue;
+            }
+
+            $candidates[] = $price;
+        }
+
+        if ($candidates === []) {
+            return null;
+        }
+
+        usort($candidates, fn (array $a, array $b) => $a['created'] <=> $b['created']);
+
+        $adopted = array_shift($candidates);
+
+        foreach ($candidates as $duplicate) {
+            $this->stripe->archivePrice($duplicate['id']);
+
+            Log::warning('stripe: stopped selling a duplicate price for one figure', [
+                'price' => $duplicate['id'],
+                'adopted' => $adopted['id'],
+                'product' => $productId,
+                'amount_cents' => $amountCents,
+            ]);
+        }
+
+        // Only when it differs, so a sweep over a healthy catalogue makes no
+        // writes at Stripe at all.
+        if ($adopted['metadata'] !== $metadata) {
+            $this->stripe->updatePriceMetadata($adopted['id'], $metadata);
+        }
+
+        Log::info('stripe: adopted an existing price instead of creating a second one', [
+            'price' => $adopted['id'],
+            'product' => $productId,
+            'amount_cents' => $amountCents,
+            'currency' => strtoupper($currency),
+            'interval' => $interval,
+        ]);
+
+        return $adopted['id'];
+    }
+
+    /**
+     * Does this Price say something about itself that we do not?
+     *
+     * @param  array<string, string>  $found
+     * @param  array<string, string>  $expected
+     */
+    private function contradicts(array $found, array $expected): bool
+    {
+        foreach ($expected as $key => $value) {
+            if (array_key_exists($key, $found) && $found[$key] !== $value) {
+                return true;
+            }
+        }
+
+        return false;
+    }
+
+    /**
+     * Does it prove it is ours?
+     *
+     * Failing to contradict is not enough — an empty metadata bag contradicts
+     * nothing. At least one identifying key has to be there and agree.
+     *
+     * @param  array<string, string>  $found
+     * @param  array<string, string>  $expected
+     * @param  array<int, string>  $identifying
+     */
+    private function confirms(array $found, array $expected, array $identifying): bool
+    {
+        foreach ($identifying as $key) {
+            if (isset($found[$key]) && $found[$key] === ($expected[$key] ?? null)) {
+                return true;
+            }
+        }
+
+        return false;
+    }
+}
+```
+
+- [ ] **Step 4: Run the test to verify it passes**
+
+```bash
+php artisan test tests/Feature/Billing/StripePriceAdoptionTest.php
+```
+
+Expected: PASS, acht Tests.
+
+- [ ] **Step 5: Commit**
+
+```bash
+git add -- app/Services/Billing/AdoptStripePrice.php tests/Feature/Billing/StripePriceAdoptionTest.php
+```
+
+```bash
+git commit -F - -- app/Services/Billing/AdoptStripePrice.php tests/Feature/Billing/StripePriceAdoptionTest.php <<'MSG'
+Recognise the price Stripe already has
+
+An abandoned run leaves an orphan: Stripe made the Price, our insert never
+happened, and the table that decides everything afterwards does not know it
+exists. The key covers a day; after that the next run makes a second live Price
+for the same money.
+
+What may be taken over is narrow. Same amount, currency and interval — a Price
+at another figure would move money, and nothing here may: a running contract
+keeps the Price it was sold on, and a booking stays frozen at what it cost that
+day. Plus proof in the metadata, because an unexplained active Price at the
+right money is what somebody clicking through Stripe's dashboard leaves behind,
+and adopting that is worse than minting a second one.
+
+Several orphans: the oldest is adopted — likeliest to be the one a lost row was
+billing on — and the rest are archived, which stops them being sold and moves
+nobody.
+
+Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
+MSG
+```
+
+---
+
+### Task 4: Die Modulseite benutzt den Wiedererkennungsschritt
+
+**Files:**
+- Modify: `app/Services/Billing/AddonPrices.php:47` (Konstruktor), `:126-159` (der Anlege-Pfad in `ensure`)
+- Test: `tests/Feature/Billing/StripePriceAdoptionTest.php` (angehängt)
+
+**Interfaces:**
+- Consumes: `AdoptStripePrice::__invoke()` aus Task 3.
+- Produces: `AddonPrices::__construct(StripeClient $stripe, AdoptStripePrice $adopt)`. **Geprüft: niemand konstruiert `AddonPrices` mit `new`** (weder App noch Tests), der Container löst auf.
+
+- [ ] **Step 1: Write the failing test**
+
+An `tests/Feature/Billing/StripePriceAdoptionTest.php` anhängen:
+
+```php
+use App\Models\StripeAddonPrice;
+use App\Models\Subscription;
+use App\Models\SubscriptionAddon;
+use App\Services\Billing\AddonPrices;
+use App\Services\Billing\TaxTreatment;
+use Illuminate\Contracts\Console\Kernel;
+
+it('takes the orphan over instead of minting a second module price', function () {
+    // The product exists because a previous run got that far; the Price exists
+    // because the run that made it died before the insert.
+    $this->stripe->plantPrice('price_1TygdEC7u8NpJ8pOt3nsoyYw', 'prod_support',
+        3480, 'EUR', 'month', ['addon' => 'priority_support']);
+    StripeAddonPrice::query()->create([
+        'addon_key' => 'priority_support', 'reverse_charge' => false,
+        'amount_cents' => 41760, 'net_cents' => 34800, 'currency' => 'EUR',
+        'interval' => 'year', 'stripe_product_id' => 'prod_support',
+        'stripe_price_id' => 'price_yearly_already_known',
+    ]);
+
+    $before = count($this->stripe->prices);
+
+    $id = app(AddonPrices::class)->ensure(
+        'priority_support', 2900, 'EUR', Subscription::TERM_MONTHLY, TaxTreatment::domestic(),
+    );
+
+    expect($id)->toBe('price_1TygdEC7u8NpJ8pOt3nsoyYw')
+        // Nothing new at Stripe: the orphan was taken over, not replaced.
+        ->and(count($this->stripe->prices))->toBe($before)
+        ->and(StripeAddonPrice::query()
+            ->where('addon_key', 'priority_support')
+            ->where('interval', 'month')
+            ->where('reverse_charge', false)
+            ->value('stripe_price_id'))->toBe('price_1TygdEC7u8NpJ8pOt3nsoyYw');
+});
+
+it('does not block a booking because the metadata format moved', function () {
+    // 2026-07-29, exactly: orphan with the old metadata, code with the new. This
+    // is the call that answered HTTP 400 for twenty-four hours.
+    $this->stripe->plantPrice('price_1TygdEC7u8NpJ8pOt3nsoyYw', 'prod_support',
+        3480, 'EUR', 'month', ['addon' => 'priority_support']);
+    StripeAddonPrice::query()->create([
+        'addon_key' => 'priority_support', 'reverse_charge' => false,
+        'amount_cents' => 41760, 'net_cents' => 34800, 'currency' => 'EUR',
+        'interval' => 'year', 'stripe_product_id' => 'prod_support',
+        'stripe_price_id' => 'price_yearly_already_known',
+    ]);
+
+    $id = app(AddonPrices::class)->ensure(
+        'priority_support', 2900, 'EUR', Subscription::TERM_MONTHLY, TaxTreatment::domestic(),
+    );
+
+    expect($id)->toBe('price_1TygdEC7u8NpJ8pOt3nsoyYw')
+        ->and($this->stripe->metadataUpdates)->toHaveCount(1);
+});
+
+it('leaves a frozen booking on the price it was sold at', function () {
+    app(Kernel::class)->call('stripe:sync-catalogue');
+
+    $sold = app(AddonPrices::class)->liveFor(
+        'priority_support', 2900, 'EUR', Subscription::TERM_MONTHLY, TaxTreatment::domestic(),
+    );
+
+    $subscription = Subscription::factory()->plan('team')->create();
+    $booking = SubscriptionAddon::query()->create([
+        'subscription_id' => $subscription->id,
+        'addon_key' => 'priority_support',
+        // Net, per month, per unit — frozen at booking. `currency` and
+        // `booked_at` are both NOT NULL (2026_07_26_060000), and `uuid` fills
+        // itself through the model's uniqueIds().
+        'price_cents' => 2900,
+        'currency' => 'EUR',
+        'quantity' => 1,
+        'booked_at' => now(),
+        'stripe_price_id' => $sold,
+    ]);
+
+    // The catalogue moves, and somebody has already left an orphan at the new
+    // figure. Neither may reach a booking that is already frozen.
+    config()->set('provisioning.addons.priority_support.price_cents', 3900);
+    $this->stripe->plantPrice('price_orphan_new_figure', 'prod_support',
+        4680, 'EUR', 'month', ['addon' => 'priority_support']);
+
+    app(Kernel::class)->call('stripe:sync-catalogue');
+
+    expect($booking->refresh()->stripe_price_id)->toBe($sold)
+        ->and($this->stripe->archived)->not->toContain($sold);
+});
+```
+
+**Zum letzten Test:** `SubscriptionAddon::booted()` wirft bei jeder Änderung an `FROZEN` (`subscription_id`, `addon_key`, `price_cents`, `currency`, `quantity`, `booked_at`) — die Regel „eine Buchung friert ihren Preis ein" steht also schon im Modell. `stripe_price_id` gehört nicht dazu und ist damit änderbar; genau deshalb muss ein Test sagen, dass die Übernahme sie nicht anfasst. `Subscription::factory()->plan('team')` ist die Form aus `tests/Feature/Billing/ReverseChargePriceTest.php:220`.
+
+- [ ] **Step 2: Run test to verify it fails**
+
+```bash
+php artisan test tests/Feature/Billing/StripePriceAdoptionTest.php
+```
+
+Expected: FAIL — `ensure()` legt einen neuen Preis an, `count($this->stripe->prices)` ist um eins gewachsen, und die zurückgegebene ID ist nicht die der Waise.
+
+- [ ] **Step 3: Wire the adoption into `AddonPrices`**
+
+Konstruktor (`:47`):
+
+```php
+    public function __construct(
+        private readonly StripeClient $stripe,
+        private readonly AdoptStripePrice $adopt,
+    ) {}
+```
+
+Der Anlege-Pfad in `ensure()` (`:126-159`) wird zu:
+
+```php
+        $productId = $this->product($addonKey);
+
+        $metadata = [
+            // Read back when a Stripe invoice line has to be turned into
+            // wording a customer can read — see StripeInvoiceLines.
+            'addon' => $addonKey,
+            // Which of the module's two Prices this is, for anyone reading
+            // Stripe's own dashboard, where they would otherwise differ only
+            // by an amount.
+            'tax_treatment' => $reverseCharge ? 'reverse_charge' : 'domestic',
+        ];
+
+        // Asked BEFORE minting, because a run that died between Stripe's create
+        // and our insert left a Price no table of ours knows — and the key below
+        // stops protecting it after twenty-four hours. See AdoptStripePrice for
+        // what may be taken over and why so narrowly.
+        $priceId = ($this->adopt)(
+            productId: $productId,
+            amountCents: $amount,
+            currency: $currency,
+            interval: $interval,
+            metadata: $metadata,
+            identifying: ['addon'],
+            claimed: fn (string $id) => StripeAddonPrice::query()
+                ->where('stripe_price_id', $id)
+                ->exists(),
+        );
+
+        $priceId ??= $this->stripe->createPrice(
+            productId: $productId,
+            amountCents: $amount,
+            currency: $currency,
+            interval: $interval,
+            metadata: $metadata,
+            // Says "I have already sent this call", nothing more. The amount is
+            // the CHARGED one and the treatment is in there because at a rate of
+            // nought the two Prices are the same amount — but what stops a
+            // second Price for one figure is AdoptStripePrice above, not this:
+            // Stripe forgets a key after twenty-four hours. The metadata is
+            // folded in by IdempotencyKey inside the client, so changing the
+            // format below can never again refuse the call for a day.
+            idempotencyKey: "clupilot-addon-price-{$addonKey}-{$interval}-{$amount}-{$currency}"
+                .($reverseCharge ? '-rc' : ''),
+        );
+
+        $this->remember($addonKey, $reverseCharge, $amount, $netCents, $currency, $interval, $productId, $priceId);
+        $this->archiveSuperseded($addonKey, $reverseCharge, $netCents, $currency, $interval, $amount);
+
+        return $priceId;
+```
+
+`use App\Services\Billing\AdoptStripePrice;` ist nicht nötig (gleiche Namespace).
+
+Den Kommentar in `remember()` (`:297-301`) um den zweiten Grund ergänzen, aus dem die Ausnahme kommen kann:
+
+```php
+        } catch (UniqueConstraintViolationException) {
+            // Two bookings of the same module landed together. Stripe replayed
+            // one Price for both — the idempotency key saw to that — so there is
+            // nothing to correct here beyond letting the first row stand. The
+            // same catch now also covers a Price id another row already claims,
+            // which the unique index refuses: the caller is handed the id
+            // regardless, because refusing would fail a customer's booking over
+            // a register that is one row short.
+        }
+```
+
+- [ ] **Step 4: Run the test to verify it passes**
+
+```bash
+php artisan test tests/Feature/Billing/StripePriceAdoptionTest.php
+```
+
+Expected: PASS, elf Tests.
+
+- [ ] **Step 5: Run the billing folder**
+
+```bash
+php artisan test tests/Feature/Billing
+```
+
+Expected: PASS. Ein Fehler in `StripeAddonBillingTest` oder `AddonCancellationTest` bedeutet, dass der Wiedererkennungsschritt einen Preis übernimmt, wo ein Test einen neuen erwartet — dann prüfen, ob die Erwartung des Tests oder die Bedingung in `AdoptStripePrice` falsch ist, **bevor** irgendetwas geändert wird.
+
+- [ ] **Step 6: Commit**
+
+```bash
+git add -- app/Services/Billing/AddonPrices.php tests/Feature/Billing/StripePriceAdoptionTest.php
+```
+
+```bash
+git commit -F - -- app/Services/Billing/AddonPrices.php tests/Feature/Billing/StripePriceAdoptionTest.php <<'MSG'
+Ask before minting a module price
+
+The sweep that died on 2026-07-29 left price_1TygdEC7u8NpJ8pOt3nsoyYw at Stripe
+and no row here. This is the step that finds it: same money, same interval, our
+metadata on it, unclaimed — taken over and brought up to date instead of
+duplicated.
+
+The comment on the key was the root of it. It read "keyed on what the Price IS",
+and a key is not that: identity is product, amount, currency and interval, and
+recognising those is AdoptStripePrice's job. Stripe forgets a key after a day;
+it never was the guard against a duplicate.
+
+A booking stays where it was sold. Adoption only ever matches an identical
+amount, so a frozen booking cannot be moved by it — there is a test that says so.
+
+Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
+MSG
+```
+
+---
+
+### Task 5: Die Paketseite benutzt ihn ebenso
+
+**Files:**
+- Modify: `app/Services/Billing/PlanPrices.php:43` (Konstruktor), `:130-160` (der Anlege-Zweig in `ensure`)
+- Test: `tests/Feature/Billing/StripePriceAdoptionTest.php` (angehängt)
+
+**Interfaces:**
+- Consumes: `AdoptStripePrice::__invoke()` aus Task 3.
+- Produces: `PlanPrices::__construct(StripeClient $stripe, AdoptStripePrice $adopt)`. **Geprüft: niemand konstruiert `PlanPrices` mit `new`.**
+
+- [ ] **Step 1: Write the failing test**
+
+An `tests/Feature/Billing/StripePriceAdoptionTest.php` anhängen:
+
+```php
+use App\Models\PlanPrice;
+use App\Models\StripePlanPrice;
+use App\Services\Billing\PlanPrices;
+
+it('takes over an orphaned package price', function () {
+    // A catalogue mirrored once, so families have Products and rows have Prices.
+    app(Kernel::class)->call('stripe:sync-catalogue');
+
+    $row = PlanPrice::query()->firstOrFail();
+    $charged = PlanPrices::chargedCents($row, TaxTreatment::domestic());
+
+    // The register loses its row and Stripe keeps the Price: a run that died
+    // between the two, seen from the next run's point of view.
+    $orphan = (string) StripePlanPrice::query()
+        ->where('plan_price_id', $row->id)
+        ->where('reverse_charge', false)
+        ->value('stripe_price_id');
+    StripePlanPrice::query()->where('stripe_price_id', $orphan)->delete();
+
+    $before = count($this->stripe->prices);
+
+    $id = app(PlanPrices::class)->ensure($row->refresh(), TaxTreatment::domestic());
+
+    expect($id)->toBe($orphan)
+        ->and(count($this->stripe->prices))->toBe($before)
+        ->and(StripePlanPrice::query()
+            ->where('plan_price_id', $row->id)
+            ->where('reverse_charge', false)
+            ->where('charged_cents', $charged)
+            ->value('stripe_price_id'))->toBe($orphan)
+        // The pointer for the ordinary domestic sale is written as before.
+        ->and((string) $row->refresh()->stripe_price_id)->toBe($orphan);
+});
+
+it('does not take a package price belonging to another catalogue row', function () {
+    app(Kernel::class)->call('stripe:sync-catalogue');
+
+    $row = PlanPrice::query()->firstOrFail();
+    $product = (string) $row->version->family->stripe_product_id;
+    $charged = PlanPrices::chargedCents($row, TaxTreatment::domestic());
+    $interval = $row->term === Subscription::TERM_YEARLY ? 'year' : 'month';
+
+    StripePlanPrice::query()->where('plan_price_id', $row->id)->delete();
+
+    // Same product, same money, same interval — and plan_price_id says it is a
+    // DIFFERENT row's Price. One Product carries every version and term of a
+    // family, so this is the ordinary case, not an exotic one.
+    $this->stripe->plantPrice('price_other_row', $product, $charged, (string) $row->currency,
+        $interval, ['plan_price_id' => (string) ($row->id + 1000), 'tax_treatment' => 'domestic']);
+
+    $id = app(PlanPrices::class)->ensure($row->refresh(), TaxTreatment::domestic());
+
+    expect($id)->not->toBe('price_other_row');
+});
+```
+
+- [ ] **Step 2: Run test to verify it fails**
+
+```bash
+php artisan test tests/Feature/Billing/StripePriceAdoptionTest.php
+```
+
+Expected: FAIL im ersten der beiden — `ensure()` legt einen zweiten Preis an, `count($this->stripe->prices)` wächst.
+
+- [ ] **Step 3: Wire the adoption into `PlanPrices`**
+
+Konstruktor (`:43`):
+
+```php
+    public function __construct(
+        private readonly StripeClient $stripe,
+        private readonly AdoptStripePrice $adopt,
+    ) {}
+```
+
+Der Zweig `if ($priceId === null)` in `ensure()` (`:135-160`):
+
+```php
+        $interval = $price->term === Subscription::TERM_YEARLY ? 'year' : 'month';
+
+        if ($priceId === null) {
+            $metadata = [
+                'plan_family' => $family->key,
+                'plan_version' => (string) $version->version,
+                'plan_version_id' => (string) $version->id,
+                'plan_price_id' => (string) $price->id,
+                // Read back by anything that has a Price id and needs to know
+                // what kind of sale it was — and by a person looking at
+                // Stripe's own dashboard, where two Prices on one Product
+                // would otherwise differ only by an amount.
+                'tax_treatment' => $treatment->reverseCharge ? 'reverse_charge' : 'domestic',
+            ];
+
+            // Asked BEFORE minting: a run that died between Stripe's create and
+            // our insert left a Price the register does not know, and the key
+            // below stops protecting it after twenty-four hours. `plan_price_id`
+            // is what proves such a Price is this row's — one Product carries
+            // every version and term of a family, so the amount alone would not.
+            $priceId = ($this->adopt)(
+                productId: (string) $productId,
+                amountCents: $charged,
+                currency: (string) $price->currency,
+                interval: $interval,
+                metadata: $metadata,
+                identifying: ['plan_price_id'],
+                claimed: fn (string $id) => StripePlanPrice::query()
+                    ->where('stripe_price_id', $id)
+                    ->exists(),
+            );
+
+            $priceId ??= $this->stripe->createPrice(
+                productId: (string) $productId,
+                amountCents: $charged,
+                currency: (string) $price->currency,
+                interval: $interval,
+                metadata: $metadata,
+                // Says "I have already sent this call", nothing more — the
+                // metadata is folded in by IdempotencyKey inside the client, so
+                // changing the format above can never again refuse the call for
+                // a day. What stops a second Price for one figure is the
+                // adoption step above; Stripe forgets a key after 24 hours.
+                idempotencyKey: "clupilot-price-{$price->id}-{$charged}"
+                    .($treatment->reverseCharge ? '-rc' : ''),
+            );
+        } elseif ($existing?->archived_at !== null) {
+```
+
+Der bestehende `elseif`-Zweig und alles darunter bleiben unverändert.
+
+- [ ] **Step 4: Run the test to verify it passes**
+
+```bash
+php artisan test tests/Feature/Billing/StripePriceAdoptionTest.php
+```
+
+Expected: PASS, dreizehn Tests.
+
+- [ ] **Step 5: Run the billing folder**
+
+```bash
+php artisan test tests/Feature/Billing
+```
+
+Expected: PASS. `ReverseChargePriceTest` ist hier der wichtigste Zeuge: `:342-347` zählt genau 16 Register-Zeilen und 16 verschiedene Preis-IDs nach einem doppelten Sync-Lauf. Bleibt das grün, hat der Wiedererkennungsschritt nichts verdoppelt und nichts zusammengelegt.
+
+- [ ] **Step 6: Commit**
+
+```bash
+git add -- app/Services/Billing/PlanPrices.php tests/Feature/Billing/StripePriceAdoptionTest.php
+```
+
+```bash
+git commit -F - -- app/Services/Billing/PlanPrices.php tests/Feature/Billing/StripePriceAdoptionTest.php <<'MSG'
+Ask before minting a package price
+
+Same defect, same fix, one difference: a family Product carries every version
+and every term, so the amount alone does not say which row a Price belongs to.
+plan_price_id in the metadata does, and it is what has to agree before a Price
+is taken over.
+
+Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
+MSG
+```
+
+---
+
+### Task 6: Eine Zeile pro Stripe-Preis
+
+**Files:**
+- Create: `database/migrations/2026_07_31_210000_one_row_per_stripe_price.php`
+- Modify: `docs/handoffs/2026-07-30-real-run-handoff.md:175-176`
+- Test: `tests/Feature/Billing/StripePriceAdoptionTest.php` (angehängt)
+
+**Interfaces:**
+- Consumes: nichts.
+- Produces: eindeutiger Index `stripe_addon_prices_price_unique` auf `stripe_addon_prices.stripe_price_id`.
+
+- [ ] **Step 1: Write the failing test**
+
+An `tests/Feature/Billing/StripePriceAdoptionTest.php` anhängen:
+
+```php
+use Illuminate\Database\UniqueConstraintViolationException;
+
+it('lets no two module rows claim one stripe price', function () {
+    $shared = [
+        'addon_key' => 'priority_support', 'net_cents' => 2900, 'currency' => 'EUR',
+        'stripe_product_id' => 'prod_support', 'stripe_price_id' => 'price_shared',
+    ];
+
+    StripeAddonPrice::query()->create([...$shared,
+        'reverse_charge' => false, 'amount_cents' => 3480, 'interval' => 'month']);
+
+    // Two rows on one Price is what Block D warned about: archiving the one
+    // would withdraw the Price the other is still selling.
+    expect(fn () => StripeAddonPrice::query()->create([...$shared,
+        'reverse_charge' => true, 'amount_cents' => 2900, 'interval' => 'month']))
+        ->toThrow(UniqueConstraintViolationException::class);
+});
+```
+
+- [ ] **Step 2: Run test to verify it fails**
+
+```bash
+php artisan test tests/Feature/Billing/StripePriceAdoptionTest.php
+```
+
+Expected: FAIL — keine Ausnahme, die zweite Zeile entsteht.
+
+- [ ] **Step 3: Write the migration**
+
+`database/migrations/2026_07_31_210000_one_row_per_stripe_price.php`:
+
+```php
+<?php
+
+use Illuminate\Database\Migrations\Migration;
+use Illuminate\Database\Schema\Blueprint;
+use Illuminate\Support\Facades\DB;
+use Illuminate\Support\Facades\Schema;
+
+/**
+ * One row per Stripe Price on the module side too.
+ *
+ * `stripe_plan_prices.stripe_price_id` has been unique since
+ * 2026_07_30_110000; the module register was never given the same guard, so two
+ * rows could claim one Price — and archiving the one would have withdrawn the
+ * Price the other was still selling. It is also the net under the adoption step
+ * (App\Services\Billing\AdoptStripePrice): at a VAT rate of nought both
+ * treatments charge the same amount, and the check that refuses an
+ * already-claimed Price is then the only thing keeping them apart.
+ *
+ * Duplicates are DELETED rather than archived. An archived row goes on claiming
+ * the id, and a unique index knows nothing about `archived_at`. Deleting is safe
+ * because the row rebuilds itself: the next ensure() finds the Price at Stripe
+ * through the adoption step and writes the row again. `subscription_addons`
+ * holds the Stripe id as text, not as a foreign key, so no booking loses its
+ * price.
+ */
+return new class extends Migration
+{
+    public function up(): void
+    {
+        // Written with groupBy/having and a delete by id rather than a joined
+        // delete: production is MariaDB and the suite runs on SQLite.
+        $shared = DB::table('stripe_addon_prices')
+            ->select('stripe_price_id')
+            ->groupBy('stripe_price_id')
+            ->havingRaw('count(*) > 1')
+            ->pluck('stripe_price_id');
+
+        foreach ($shared as $priceId) {
+            // The lowest id stays — the row that was written first, which is the
+            // one anything already billing is likeliest to have been reading.
+            $keep = DB::table('stripe_addon_prices')->where('stripe_price_id', $priceId)->min('id');
+
+            DB::table('stripe_addon_prices')
+                ->where('stripe_price_id', $priceId)
+                ->where('id', '!=', $keep)
+                ->delete();
+        }
+
+        Schema::table('stripe_addon_prices', function (Blueprint $table) {
+            $table->unique('stripe_price_id', 'stripe_addon_prices_price_unique');
+        });
+    }
+
+    public function down(): void
+    {
+        Schema::table('stripe_addon_prices', function (Blueprint $table) {
+            $table->dropUnique('stripe_addon_prices_price_unique');
+        });
+    }
+};
+```
+
+- [ ] **Step 4: Run the test to verify it passes**
+
+```bash
+php artisan test tests/Feature/Billing/StripePriceAdoptionTest.php
+```
+
+Expected: PASS, vierzehn Tests.
+
+- [ ] ~~**Step 5: Prove the deduplication itself, on a real migration run**~~ — **NICHT AUSFÜHREN**
+
+~~`php artisan migrate:fresh --env=testing && php artisan migrate:status | tail -3`~~
+
+> **Warnung, nicht stillschweigend gelöscht, weil die Falle es wert ist:** Dieser Befehl darf nicht laufen — es gibt in diesem Repo **keine** `.env.testing`, also greift die Verbindung aus `.env` und `migrate:fresh` löscht und baut die **echte Entwicklungsdatenbank** neu, die laufende Container benutzen. Der Index ist durch den SQLite-Migrationslauf der Suite belegt (Step 1 und Step 4); ein zweiter Beleg ist keinen Datenverlust wert.
+
+- [ ] **Step 6: Mark the Block D item done**
+
+`docs/handoffs/2026-07-30-real-run-handoff.md:175-176` ersetzen:
+
+```markdown
+- ~~`stripe_addon_prices.stripe_price_id` ist **nicht** eindeutig (Plan-Seite schon):
+  zwei Zeilen könnten einen Preis teilen, Archivieren würde den anderen mitentziehen.~~
+  **Erledigt** — eindeutig seit `2026_07_31_210000_one_row_per_stripe_price`; zugleich
+  das Netz unter dem Wiedererkennungsschritt, siehe
+  `docs/superpowers/specs/2026-07-30-stripe-price-adoption-design.md`.
+```
+
+- [ ] **Step 7: Run the full suite — this is a schema change**
+
+```bash
+php artisan test
+```
+
+Expected: PASS. Eine `UniqueConstraintViolationException` in einem fremden Test bedeutet, dass dort zwei Modul-Zeilen absichtlich eine Preis-ID teilten — das ist ein Fund, der gemeldet und nicht durch Zurücknehmen des Index behoben wird.
+
+- [ ] **Step 8: Commit**
+
+```bash
+git add -- database/migrations/2026_07_31_210000_one_row_per_stripe_price.php tests/Feature/Billing/StripePriceAdoptionTest.php docs/handoffs/2026-07-30-real-run-handoff.md
+```
+
+```bash
+git commit -F - -- database/migrations/2026_07_31_210000_one_row_per_stripe_price.php tests/Feature/Billing/StripePriceAdoptionTest.php docs/handoffs/2026-07-30-real-run-handoff.md <<'MSG'
+One row per Stripe price on the module side too
+
+The plan register has had this since 2026_07_30_110000. The module register
+never did, so two rows could claim one Price and archiving the one would have
+withdrawn the Price the other was still selling — Block D of the real-run
+handoff.
+
+It is also the net under the adoption step: at a VAT rate of nought both
+treatments charge the same amount, and the check that refuses an already-claimed
+Price is then the only thing keeping the two apart.
+
+Duplicates are deleted, not archived. An archived row goes on claiming the id
+and a unique index knows nothing about archived_at; the row rebuilds itself on
+the next ensure(), and subscription_addons holds the Stripe id as text rather
+than a foreign key, so no booking loses its price.
+
+Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
+MSG
+```
+
+---
+
+## Nach dem letzten Task
+
+- [ ] **Voller Testlauf** (nicht nur `tests/Feature/Billing`):
+
+```bash
+php artisan test
+```
+
+- [ ] **Ein Review über den Gesamtdiff**, dann **eine** Fix-Runde, dann **ein** Re-Review über den Fix-Diff — und danach werden offene Befunde mit schriftlicher Begründung geparkt (R22.1). Ein zweiter Re-Review desselben Befundes ist verboten.
+- [ ] **Nicht geplant, bewusst offen** (Spec §12): ein Aufräum-Kommando für Waisen, die niemand übernehmen kann. Sie stehen mit ihrer ID im Log (`stripe: left an unexplained active price alone…`). Als Folgepunkt in den Merge Request.
diff --git a/docs/superpowers/specs/2026-07-30-stripe-price-adoption-design.md b/docs/superpowers/specs/2026-07-30-stripe-price-adoption-design.md
new file mode 100644
index 0000000..be50139
--- /dev/null
+++ b/docs/superpowers/specs/2026-07-30-stripe-price-adoption-design.md
@@ -0,0 +1,359 @@
+# Spec — Bestehende Stripe-Preise wiedererkennen, statt sie zu verdoppeln
+
+**Datum:** 2026-07-30
+**Status:** entworfen, noch nicht umgesetzt
+**Vorgänger-Kontext:** `docs/handoffs/2026-07-30-real-run-handoff.md` Block D
+(`stripe_addon_prices.stripe_price_id` ist nicht eindeutig)
+
+---
+
+## 1. Der Vorfall
+
+Ein Lauf am **2026-07-29 23:11** legte bei Stripe
+`price_1TygdEC7u8NpJ8pOt3nsoyYw` an (`priority_support`, 3480 EUR, monatlich) und
+brach ab, **bevor** die Zeile in `stripe_addon_prices` geschrieben war. Commit
+`9da1358` fügte danach das Metadatenfeld `tax_treatment` hinzu. Der nächste
+Abgleich schickte **denselben** Idempotenz-Schlüssel mit den **neuen** Metadaten
+und bekam von Stripe:
+
+> HTTP 400 — Keys for idempotent requests can only be used with the same
+> parameters they were first used with.
+
+Der Abgleich war damit hart blockiert und wäre es bis zum Ablauf des Schlüssels
+(24 h) geblieben. Von Hand bereinigt: Zeile für den vorhandenen Preis
+nachgetragen, Metadaten bei Stripe angeglichen. Die Ursache stand offen.
+
+## 2. Ausgangsbefund — gemessen, nicht gelesen
+
+| Befund | Beleg |
+|---|---|
+| Der Modul-Schlüssel deckt Betrag, Währung, Intervall, Modul und Behandlung ab — **keine** Metadaten | `app/Services/Billing/AddonPrices.php:152` |
+| Der Paket-Schlüssel ebenso | `app/Services/Billing/PlanPrices.php:158` |
+| Beide senden Metadaten mit, die **nicht** im Schlüssel stehen — u. a. das neue `tax_treatment` | `AddonPrices.php:133-141`, `PlanPrices.php:141-151` |
+| `createProduct` hat dieselbe Falle latent: Metadaten mit, Schlüssel ohne | `AddonPrices.php:269-273`, `SyncStripeCatalogue.php:104-111`, `HttpStripeClient.php:87-97` |
+| Kein Aufruf fragt Stripe nach **vorhandenen** Preisen. Der Client hat gar keine Methode dafür | `app/Services/Stripe/StripeClient.php` — `createPrice`, `archivePrice`, `activatePrice`, kein Auflisten |
+| `ensure()` läuft **nicht nur** im Abgleich, sondern in der **Kundenbuchung** | `BookAddon.php:259` und `:360` → `SyncStripeAddonItems.php:183` und `:291` → `AddonPrices::ensure()` |
+| Der Fake spielt einen bekannten Schlüssel zurück, **ohne die Parameter zu vergleichen** | `FakeStripeClient.php:168-193`, Ledger `$keys` (`:38`) |
+| `stripe_plan_prices.stripe_price_id` ist eindeutig | Migration `2026_07_30_110000:56` |
+| `stripe_addon_prices.stripe_price_id` ist **nicht** eindeutig; eindeutig ist nur das Tupel | Migration `2026_07_31_200000:59-77` |
+| Der Client blättert schon woanders durch Stripe-Listen | `HttpStripeClient::invoiceLines()`, `:312-336` |
+| Produktion `mariadb`, Tests `sqlite :memory:` | `.env:24`, `phpunit.xml:42-43` |
+
+**Der 400 ist damit kein Betriebsfehler, sondern ein Kundenfehler.** Ein
+Kunde, der ein Modul bucht, während ein Waisen-Preis mit altem Metadatenformat
+bei Stripe liegt, bekommt 24 Stunden lang keine Buchung zustande.
+
+## 3. Zwei getrennte Mängel
+
+1. **Waise ohne Wiedererkennung.** Ein Abgleich, der zwischen Stripes Anlage und
+   unserem Schreiben abbricht, hinterlässt einen Preis bei Stripe, den unsere
+   Tabelle nie erfährt. Nach Ablauf der 24 Stunden legt der nächste Lauf einen
+   **zweiten aktiven** Preis über dieselbe Summe an — genau das, was der
+   Schlüssel verhindern soll.
+2. **Metadaten im Aufruf, nicht im Schlüssel.** Jede künftige Änderung an den
+   Metadaten von `createPrice` blockiert den Abgleich für 24 Stunden auf
+   dieselbe Weise.
+
+## 4. Gehört das Metadatenformat zur Identität? — Nein
+
+**Identität** eines Preises ist, was Stripe unveränderlich macht: Produkt,
+Betrag, Währung, Intervall — und, weil bei einem Steuersatz von 0 % beide
+Behandlungen denselben Betrag haben, welche der beiden es ist. Metadaten sind
+bei Stripe **nachträglich änderbar**. Deshalb wird ein wiedererkannter Preis mit
+korrigierten Metadaten **übernommen**, nicht durch einen neuen ersetzt.
+
+Der Idempotenz-Schlüssel behauptet aber gar keine Identität. Er behauptet
+„**diesen Aufruf habe ich schon abgeschickt**". Weil Stripe das wörtlich prüft,
+müssen **alle gesendeten Parameter** hinein — sonst ist der Schlüssel eine
+Lüge, die mit 400 endet.
+
+Der Kommentar im Code verwechselt beides („Keyed on what the Price IS",
+`AddonPrices.php:142-151`). Das ist die eigentliche Ursache und wird
+mitkorrigiert: die Identität wandert in den Wiedererkennungsschritt, der
+Schlüssel wird auf seine tatsächliche Aussage zurückgeführt.
+
+## 5. Regeln des Auftraggebers, die dieser Entwurf nicht anfassen darf
+
+Beide wurden im Gespräch am 2026-07-30 gesetzt und gelten als Prüfstein:
+
+1. **Bestehende Verträge behalten ihre alten Preise.** Neue Preise gelten nur
+   für Kunden, die neu abschließen. Daraus folgt die Freigabe zum Archivieren:
+   ein archivierter Stripe-Preis bleibt für laufende Abos in Kraft, er wird nur
+   nicht mehr **verkauft** — worauf `archiveSuperseded()` schon heute beruht.
+2. **Jede Buchung friert ihren Preis ein.** Ein Paket und zwei Module werden
+   immer gleich verrechnet; ein später gebuchtes Modul kommt zum heutigen Preis;
+   eine Stornierung zieht genau den damaligen Betrag ab und wird danach nicht
+   mehr verrechnet.
+
+Beides bleibt strukturell gewahrt, weil die Übernahme **ausschließlich** Preise
+mit **identischem** Betrag, Währung und Intervall betrifft. Sie kann niemandes
+Verrechnung verschieben. §11 schreibt es als Test fest.
+
+## 6. Bauteil 1 — `App\Services\Billing\AdoptStripePrice`
+
+Der Wiedererkennungsschritt, **einmal** für beide Seiten (Modul und Paket), weil
+zwei Fassungen derselben Regel der Anfang ihres Auseinanderlaufens sind.
+
+**Stellung im Ablauf:** nach dem Blick in unsere eigene Tabelle, vor
+`createPrice`. Also genau dann ein zusätzliches GET, wenn ohnehin ein POST
+fällig gewesen wäre — nie im Normalfall.
+
+```
+ensure()
+  ├─ Zeile in unserer Tabelle?           → ja: wie heute (ggf. reaktivieren)
+  ├─ AdoptStripePrice: Kandidat bei Stripe? → ja: übernehmen
+  └─ createPrice(…)                       → nein: wie heute anlegen
+```
+
+**Ein Kandidat wird übernommen, wenn er alle fünf Bedingungen erfüllt:**
+
+1. bei Stripe **aktiv** und an **unserem** Produkt hängend
+   (`active=true`, `product=…`, `type=recurring`);
+2. **exakt** gleich in Betrag, Währung (klein/groß normalisiert) und Intervall;
+3. **widerspricht keinem** unserer Metadatenschlüssel, den er trägt;
+4. **bestätigt mindestens einen** tragenden Schlüssel — `addon` auf der
+   Modulseite, `plan_price_id` auf der Paketseite. Ein von Hand im Dashboard
+   angelegter Preis wird damit nie übernommen;
+5. ist **von keiner Zeile beansprucht** (Prüfung gegen die eigene Tabelle,
+   archivierte Zeilen eingeschlossen).
+
+**Danach:** Metadaten bei Stripe angleichen (genau das, was von Hand getan
+wurde), Zeile schreiben, `archiveSuperseded()` wie im Anlege-Pfad, Preis-ID
+zurückgeben.
+
+**Mehrere Kandidaten:** der **älteste** (`created` aufsteigend) wird übernommen —
+er ist am ehesten der, auf dem eine verlorene Zeile schon bilanziert. Die
+übrigen werden bei Stripe **archiviert** (Freigabe aus §5.1) und protokolliert.
+
+**Kein beweisbar eigener Kandidat:** Verhalten wie heute (anlegen), mit Warnung
+im Log. Bewusst so: einen fremden Preis zu übernehmen ist schlimmer als einen
+zweiten anzulegen, und die Warnung nennt die ID, damit ein Betreiber entscheiden
+kann.
+
+**Meldeweg ist das Log** (`Log::warning`), nicht die Konsolenausgabe: `ensure()`
+läuft auch im Web-Request, wo es keine Kommandozeile gibt.
+
+## 7. Bauteil 2 — `App\Services\Stripe\IdempotencyKey`
+
+Bildet aus dem sprechenden Schlüssel plus einem kurzen Fingerabdruck der
+**tatsächlich gesendeten Parameter** den Header-Wert:
+
+```php
+IdempotencyKey::for('clupilot-addon-price-priority_support-month-3480-EUR', $payload)
+// → 'clupilot-addon-price-priority_support-month-3480-EUR-9f3a1c07'
+```
+
+Kanonisch gebildet (Schlüssel sortiert, dann `sha1`, auf 8 Zeichen gekürzt),
+damit dieselbe Nutzlast immer denselben Fingerabdruck ergibt. In **einer**
+Support-Klasse, weil `HttpStripeClient` und `FakeStripeClient` denselben Wert
+bilden müssen — sonst prüft der Test etwas anderes, als die Produktion sendet.
+
+**Angewandt nur auf `createPrice` und `createProduct`.** Bewusst **nicht** auf:
+
+| Aufruf | Warum der 400 dort bleiben muss |
+|---|---|
+| `refund` | Ein zweiter Refund schickt dem Kunden das Geld zweimal. |
+| `cancelSubscription` | Andere Parameter unter demselben Schlüssel heißt: eine andere Kündigungsart als die schon abgeschickte. |
+| `addSubscriptionItem` | Ein zweites Item verrechnet dasselbe Modul doppelt. |
+| `createCheckoutSession` | Eine zweite Session zu geänderten Parametern ist ein zweiter Kaufvorgang. |
+
+Die Regel lautet also: **der Fingerabdruck ist für die Katalogseite, wo ein
+Duplikat reparierbar und eine Blockade kundenwirksam ist.** Bei
+Geldbewegungen ist es umgekehrt. §11 schreibt diese Grenze als Test fest, damit
+sie niemand „vereinheitlicht".
+
+## 8. Zwei neue Client-Methoden
+
+```php
+/** @return array<int, array{id: string, unit_amount: int, currency: string, interval: string, created: int, metadata: array<string, string>}> */
+public function activePricesFor(string $productId): array;
+
+public function updatePriceMetadata(string $priceId, array $metadata): void;
+```
+
+`activePricesFor()` blättert nach dem Muster von `invoiceLines()`
+(`HttpStripeClient.php:312-336`) — ein Familien-Produkt sammelt über Versionen,
+Terme, Behandlungen und Steuersatzänderungen hinweg leicht mehr als eine Seite,
+und beim ersten Seitenende stehenzubleiben wäre dieselbe Lücke in neuer Form.
+
+`updatePriceMetadata()` benutzt, dass Metadaten eines der wenigen Felder sind,
+die ein Stripe-Preis ändern lässt — dieselbe Eigenschaft, auf der
+`activatePrice()` schon beruht.
+
+Beide im `FakeStripeClient` nachgezogen.
+
+## 9. Der Fake muss Stripe erst einmal nachbilden
+
+`FakeStripeClient::createPrice` spielt einen bekannten Schlüssel zurück, **ohne
+die Parameter zu vergleichen** (`:168-193`). Er ist genau in der Sache
+unrealistisch, um die es hier geht — deshalb konnte kein Test den Vorfall sehen.
+
+Der Ledger `$keys` speichert künftig neben der ID auch die Nutzlast und wirft
+bei gleichem Schlüssel mit anderen Parametern — mit Stripes Wortlaut. Das ist
+der Regressionstest, der den 29.07. gesehen hätte.
+
+## 10. Migration — eine Zeile pro Stripe-Preis
+
+`2026_07_31_210000_one_row_per_stripe_price.php` (nach der letzten vorhandenen
+Migration einsortiert):
+
+1. **Entdoppeln:** Zeilen in `stripe_addon_prices`, die eine
+   `stripe_price_id` teilen — niedrigste Zeilen-ID bleibt, die übrigen werden
+   **gelöscht**. Nicht archiviert: eine archivierte Zeile beansprucht die ID
+   weiter und der eindeutige Index kennt `archived_at` nicht.
+2. **Index:** `stripe_price_id` wird eindeutig — wie auf der Paketseite seit
+   `2026_07_30_110000:56`.
+
+Löschen ist gefahrlos: die Zeile baut sich beim nächsten `ensure()` über die
+Wiedererkennung selbst wieder auf, und `subscription_addons.stripe_price_id`
+hält die Stripe-ID als **Text**, nicht als Fremdschlüssel.
+
+Treiberneutral formuliert (Auswahl über `groupBy`/`having`, Löschen über
+IDs) — Produktion ist `mariadb`, Tests laufen auf `sqlite`.
+
+**Was der Index absichert:** Bei einem Steuersatz von 0 % sind die Beträge
+beider Behandlungen gleich. Die Übernahme lehnt einen bereits beanspruchten
+Preis dann über §6 Bedingung 5 ab und legt für die zweite Behandlung einen
+eigenen an (der Schlüssel trägt `-rc`). Der Index ist das Netz darunter, falls
+diese Prüfung je gerissen wird.
+
+## 11. Tests
+
+Zwei Regeldatei-Tests nach Repo-Sitte, getrennt danach, **gegen wen** sie prüfen:
+
+- `tests/Feature/Billing/StripeIdempotencyKeyTest.php` — was auf der Leitung
+  landet. Läuft über `Http::fake()` gegen `HttpStripeClient`, weil geprüft werden
+  muss, was **gesendet** wird, nicht was der Fake sich merkt. Hier steht auch,
+  dass der Fake Stripes 400 überhaupt nachbildet.
+- `tests/Feature/Billing/StripePriceAdoptionTest.php` — die Übernahmeregeln,
+  beide Seiten, über den `FakeStripeClient`.
+
+| Prüfung | Deckt ab |
+|---|---|
+| Waise bei Stripe → wird übernommen, `createPrice` **nicht** aufgerufen, Zeile trägt die vorhandene ID (Modul **und** Paket) | Mangel 1 |
+| Waise mit **altem** Metadatenformat → wird übernommen, Metadaten bei Stripe angeglichen | der Vorfall selbst |
+| Zwei Waisen → älteste übernommen, andere bei Stripe archiviert, Warnung im Log | §6 |
+| Aktiver Preis an unserem Produkt **ohne** unsere Metadaten → **nicht** übernommen, neuer angelegt, Warnung | §6 Bedingung 4 |
+| Preis-ID schon von einer Zeile beansprucht → **nicht** zweimal vergeben | §6 Bedingung 5 |
+| **Eine eingefrorene Buchung behält ihren Betrag**: ein auf altem Preis laufendes Modul wird von einem Abgleich nicht verschoben | §5.2 |
+| Gleicher sprechender Schlüssel + geänderte Metadaten → **unterschiedlicher** Header, kein 400 | Mangel 2 |
+| Fingerabdruck **nur** bei `createPrice`/`createProduct`, nicht bei `refund`, `cancelSubscription`, `addSubscriptionItem`, `createCheckoutSession` | §7 |
+| Der Fake wirft bei gleichem Schlüssel mit anderen Parametern | §9 |
+| Zwei Zeilen können keine `stripe_price_id` teilen | §10 |
+
+## 12. Nicht Teil dieses Vorhabens
+
+- **Ein Aufräum-Kommando** für Waisen, die niemand mehr übernehmen kann (etwa
+  ohne unsere Metadaten). Der Log-Eintrag nennt sie; ein Kommando dafür ist ein
+  Folgepunkt.
+- **Die übrigen Block-D-Punkte** aus `docs/handoffs/2026-07-30-real-run-handoff.md`.
+- **`stripe:reprice-subscriptions`** und alles, was laufende Verträge bewegt.
+  Dieser Entwurf bewegt keinen einzigen — siehe §5.
+- **Stripes `automatic_tax`** bleibt aus, `TaxTreatment` bleibt die einzige
+  Steuerinstanz.
+
+## 13. Berührte Dateien
+
+**Neu**
+- `app/Services/Billing/AdoptStripePrice.php`
+- `app/Services/Stripe/IdempotencyKey.php`
+- `database/migrations/2026_07_31_210000_one_row_per_stripe_price.php`
+- `tests/Feature/Billing/StripeIdempotencyKeyTest.php`
+- `tests/Feature/Billing/StripePriceAdoptionTest.php`
+
+**Geändert**
+- `app/Services/Stripe/StripeClient.php` — zwei Methoden
+- `app/Services/Stripe/HttpStripeClient.php` — Auflisten, Metadaten schreiben,
+  Fingerabdruck bei den zwei Anlege-Aufrufen
+- `app/Services/Stripe/FakeStripeClient.php` — beide Methoden, Ledger mit
+  Parametervergleich
+- `app/Services/Billing/AddonPrices.php` — Wiedererkennung vor `createPrice`,
+  Kommentar zur Schlüssel-Begründung berichtigt
+- `app/Services/Billing/PlanPrices.php` — dasselbe
+- `docs/handoffs/2026-07-30-real-run-handoff.md` — Block-D-Punkt als erledigt
+  markieren
+
+---
+
+## 14. Folgepunkte, die aus der Umsetzung entstanden sind
+
+Nachgetragen nach dem Abschluss-Review. Alle Befunde sind offengelegt, keiner
+blockiert den Merge — aber keiner ist erledigt.
+
+### Die eine echte Lücke: Waisen-**Produkte**
+
+`activePricesFor()` erkennt einen verwaisten *Preis* wieder. Für ein verwaistes
+**Produkt** gibt es kein Gegenstück, und dort ist der Schaden größer: ein
+zweites Produkt lässt jedes `activePricesFor($neueId)` leer zurückkommen, damit
+ist die Wiedererkennung für dieses Modul oder diese Familie **dauerhaft blind**
+und jede Waise am ersten Produkt unerreichbar. Der Zweig deaktiviert seine
+eigene Sicherung durch die Lücke, die er nicht geschlossen hat.
+
+Betroffen: `SyncStripeCatalogue::handle()` (Produkt anlegen, ID danach in einem
+zweiten Schreibvorgang speichern) und `AddonPrices::product()`. Beide Kommentare
+benennen die Lücke jetzt; der Fix wäre ein `productsFor()` nach dem Muster von
+`activePricesFor()`, das Stripe nach den Produkten fragt und über die Metadaten
+wiedererkennt.
+
+### Das Geld-Tor sitzt an der falschen Stelle
+
+`AdoptStripePrice` verspricht in seinem Kopfkommentar, keine Übernahme könne
+Geld verschieben — kann aber nur Betrag, Währung und Intervall vergleichen. Was
+sonst noch entscheidet, was ein Preis verrechnet (`interval_count`,
+`usage_type`, `transform_quantity`, `billing_scheme`), filtert
+`HttpStripeClient::activePricesFor()`. Zwei Folgen: der `FakeStripeClient` kann
+diese Felder gar nicht ausdrücken, also kann **kein Test von
+`AdoptStripePrice` das Geld-Tor abdecken**; und eine dritte Implementierung von
+`StripeClient` ließe es still fallen. Die Prüfung gehört in die Klasse, die sie
+zusagt.
+
+Verwandt: `PlanPrices::ensure()` hat keine `<= 0`-Schranke, wo
+`AddonPrices::ensure()` eine hat. Das ist das Einzige, was einen
+`billing_scheme: tiered`-Preis (bei dem Stripe `unit_amount: null` liefert, hier
+als 0 gelesen) auf der Paketseite überhaupt erreichbar macht.
+
+### Kleineres, benannt statt vergessen
+
+- **Der Abgleich zählt „angelegt", auch wo er übernommen hat.** Die Wortwahl der
+  Konsolenausgabe ist entschärft („created or adopted"), gezählt wird weiterhin
+  vor dem Aufruf. Eine echte Trennung der beiden Zahlen fehlt — und das ist die
+  eine Zahl, die ein Mensch nach einem Vorfall zuerst liest.
+- **Die Warnung über einen unerklärlichen Preis hat keine Drosselung.** Sie
+  feuert bei jedem Abgleich *und* jeder Kundenbuchung, solange die Waise
+  existiert — und weil das Aufräum-Kommando (§12) ein Folgepunkt ist, auf
+  unbestimmte Zeit. Der Widerspruchs-Pfad wurde aus genau diesem Grund still
+  gestellt; der Bestätigungs-Pfad bekam dieselbe Überlegung nicht.
+- **`FakeStripeClient::updatePriceMetadata()` ersetzt, wo Stripe zusammenführt**,
+  und `activePricesFor()` gibt Metadaten ungecastet zurück, wo der HTTP-Client
+  auf String castet. Heute nicht beobachtbar, aber es ist genau die Sorte
+  Untreue des Fakes, gegen die §9 geschrieben wurde.
+- **`created` im Fake kann gleichstehen**: `createPrice()` stempelt
+  `count($prices) + 1`, `plantPrice()` hat die Vorgabe `1`. Der Kommentar sagt
+  das jetzt zu, statt es zu bestreiten; ein Gleichstand-Tiebreak auf die ID
+  fehlt weiter.
+- **`HttpStripeClient::activePricesFor()` bricht das Blättern still ab**, wenn
+  dem letzten Eintrag einer nicht-letzten Seite die `id` fehlt — getreue Kopie
+  desselben Verhaltens in `invoiceLines()`. Die Folge hat sich aber geändert: in
+  `invoiceLines()` entsteht ein zu kurzer Belegtext, hier eine ungesehene Waise
+  und ein zweiter aktiver Preis, also der Vorfall. Wer es anfasst, soll werfen
+  statt anhalten.
+- **Der Idempotenz-Fingerabdruck und der POST-Rumpf müssen zusammenbleiben.**
+  Ein Feld, das künftig in `createPrice()` gesendet, aber nicht in
+  `IdempotencyKey::priceParameters()` aufgenommen wird, öffnet den Vorfall
+  wieder. Der Test „does not block a booking because the metadata format moved"
+  wacht über diese Nahtstelle — mit einem gesetzten Ledger-Eintrag, weil der
+  Zustand heute nicht mehr fahrbar ist.
+
+### Zwei fremde, vorbestehende Testfehler, die dieser Zweig aufgedeckt hat
+
+Keiner davon wird von diesem Zweig verursacht.
+
+1. **`HostStepsTest.php:1064`** schreibt `fsn-01.node.clupilot.com` hart hinein,
+   während `.env:107` `CLUPILOT_DNS_ZONE=clupilot.cloud` setzt und `phpunit.xml`
+   neun andere Variablen mit `force="true"` festnagelt, diese aber nicht. Eine
+   Zeile in `phpunit.xml`. Derselbe Punkt steht als offene Aufgabe in
+   `docs/handoffs/2026-07-30-real-run-handoff.md`.
+2. **`PlanCatalogueTest.php`** ist einmal ausgefallen und lief beim
+   Wiederholen durch. „Beim zweiten Mal grün" ist keine Diagnose, und ein
+   sprunghafter Fehler in den Katalogpreis-Tests liegt im Wirkungskreis dieses
+   Zweigs, auch wenn er nicht von ihm kommt.
diff --git a/lang/de/admin.php b/lang/de/admin.php
index b8baca3..49895a1 100644
--- a/lang/de/admin.php
+++ b/lang/de/admin.php
@@ -11,6 +11,8 @@ return [
     ],
 
     'nav' => [
+        'dpa' => 'AV-Vertrag',
+        'mail_preview' => 'E-Mail-Vorschau',
         'inbox' => 'Posteingang',
         'mail_log' => 'Postausgang',
         'templates' => 'E-Mail-Vorlagen',
@@ -89,6 +91,9 @@ return [
     ],
 
     'notice' => [
+        'mail_not_delivering' => 'MAIL_MAILER steht auf „:mailer“ — es wird keine E-Mail zugestellt, alles landet in storage/logs. Auch der Postfach-Test meldet trotzdem Erfolg, weil er seinen eigenen Weg nimmt.',
+        'site_hidden' => 'Website und Kundenbereich sind ausgeblendet — Besucher außerhalb des VPN bekommen die Platzhalterseite (503). Umschalten unter Einstellungen → Installation.',
+        'no_site_host' => 'SITE_HOST ist nicht gesetzt. Die Website antwortet dadurch auch auf :app, und Links auf ihr zeigen dorthin statt auf den eigenen Namen.',
         'no_capacity' => 'Kein Host hat noch Platz für „:plan“ — das Paket braucht :needs GB, der freieste Host hat :largest GB. Eine bezahlte Bestellung dafür würde bei der Reservierung scheitern.',
         'failed_runs' => ':n fehlgeschlagene Bereitstellung(en).',
         'host_error' => 'Host :host meldet einen Fehler.',
diff --git a/lang/de/billing.php b/lang/de/billing.php
index 890bef2..661d018 100644
--- a/lang/de/billing.php
+++ b/lang/de/billing.php
@@ -29,6 +29,8 @@ return [
     'per_month' => 'netto pro Monat',
 
     'net_reverse_charge' => 'netto — Reverse Charge',
+    'term_yearly_note' => 'Jahreszahlung: :total netto im Jahr',
+    'renews_at' => 'nächste Abrechnung :date',
     'net_per_month' => 'netto pro Monat',
     'granted_plan' => 'Bereitgestellt',
     'net_once' => 'netto, einmalig',
@@ -65,6 +67,9 @@ return [
     'traffic_cta' => ':gb GB nachbuchen',
     'title' => 'Paket & Addons',
     'subtitle' => 'Ihr aktuelles Paket, Upgrades, Zusatzspeicher und Erweiterungen.',
+    'none_title' => 'Sie haben noch kein Paket gebucht',
+    'none_body' => 'Hier stehen später Ihr Paket, Ihre Zusatzoptionen und was das monatlich kostet. Solange nichts gebucht ist, gibt es hier auch nichts zu ändern.',
+    'none_cta' => 'Paket buchen',
     'current_plan' => 'Aktuelles Paket',
     'per_month' => 'pro Monat',
     'month_short' => 'Mon.',
diff --git a/lang/de/checkout.php b/lang/de/checkout.php
index d5306cf..a015533 100644
--- a/lang/de/checkout.php
+++ b/lang/de/checkout.php
@@ -22,6 +22,33 @@ return [
     // tatsächlich tun, ist eine falsche Angabe — auch wenn sie zu unseren
     // Lasten ginge. Von der Zustimmung hängt jetzt nichts mehr ab; sie bleibt
     // als Beleg dafür, dass der Kunde den sofortigen Beginn verlangt hat.
-    'immediate_start' => 'Ich verlange ausdrücklich, dass Sie mit der Leistung schon vor Ablauf der 14-tägigen Widerrufsfrist beginnen. Mein Widerrufsrecht bleibt davon unberührt: Bei einem Widerruf innerhalb der Frist erhalte ich den gesamten gezahlten Betrag zurück.',
-    'immediate_start_required' => 'Bitte bestätigen Sie, dass die Leistung sofort beginnen soll — sonst können wir Ihre Cloud erst nach Ablauf der Widerrufsfrist einrichten.',
+    // Was ohne das Häkchen passiert: die Bestellung kommt nicht zustande. Der
+    // Satz stand einmal anders da („dann richten wir erst nach Ablauf der Frist
+    // ein") und versprach damit einen Weg, den es nicht gibt — eine Cloud wird
+    // nach der Zahlung eingerichtet und nicht vierzehn Tage später.
+    'terms_required' => 'Ohne Annahme der AGB kommt die Bestellung nicht zustande. Bitte setzen Sie das Häkchen — darin ist auch Ihr 14-tägiges Widerrufsrecht geregelt.',
+
+    // The order page before Stripe — App\Livewire\Checkout.
+    'eyebrow' => 'Bestellung',
+    'title' => 'Bestellung prüfen',
+    'back_to_plans' => 'Andere Pakete',
+    'unknown_plan' => 'Dieses Paket steht nicht (mehr) zum Verkauf.',
+    'performance' => 'Leistung',
+    'summary_title' => 'Zusammenfassung',
+    'setup_line' => 'Einmalige Einrichtung',
+    'tax_line' => 'Umsatzsteuer :rate %',
+    'total_today' => 'Heute zu zahlen',
+    'then_monthly' => 'Danach :amount pro Monat',
+    'then_yearly' => 'Danach :amount pro Jahr',
+    'pay_cta' => 'Zahlungspflichtig bestellen',
+    'stripe_note' => 'Weiter zu Stripe. Kartendaten erreichen unsere Server nie.',
+    'next_title' => 'Was danach passiert',
+    'step_pay_title' => 'Zahlung bei Stripe',
+    'step_pay_body' => 'Sie geben Ihre Zahlungsdaten bei Stripe ein und kommen anschließend hierher zurück.',
+    'step_build_title' => 'Ihre Cloud wird aufgesetzt',
+    'step_build_body' => 'Das beginnt, sobald die Zahlung eingegangen ist, und läuft ohne Ihr Zutun.',
+    'step_credentials_title' => 'Zugangsdaten per E-Mail',
+    'step_credentials_body' => 'Sobald die Cloud bereitsteht, bekommen Sie Adresse und Zugangsdaten an Ihre bestätigte Adresse.',
+    'note_withdrawal_title' => '14 Tage Widerrufsrecht',
+    'note_withdrawal_body' => 'Als Verbraucher treten Sie binnen 14 Tagen ohne Angabe von Gründen zurück und erhalten den gesamten Betrag zurück.',
 ];
diff --git a/lang/de/dormant_mail.php b/lang/de/dormant_mail.php
new file mode 100644
index 0000000..cbc0f15
--- /dev/null
+++ b/lang/de/dormant_mail.php
@@ -0,0 +1,14 @@
+<?php
+
+// Ein Konto, mit dem nie etwas gebucht wurde, wird nach einem Jahr gelöscht.
+// Diese Nachricht sagt es vorher — einmal, vierzehn Tage davor.
+return [
+    'subject' => 'Ihr CluPilot-Konto wird in :days Tagen gelöscht',
+    'heading' => 'Ihr Konto wird gelöscht',
+    'preheader' => 'In :days Tagen — anmelden genügt, um das zu verhindern.',
+    'greeting' => 'Guten Tag :name,',
+    'intro' => 'zu Ihrem CluPilot-Konto besteht kein Paket und hat auch nie eines bestanden. Konten ohne Paket löschen wir nach einem Jahr, damit keine unbenutzten Daten bei uns liegen bleiben. Bei Ihrem Konto ist das in :days Tagen der Fall.',
+    'how_to_keep' => 'Wenn Sie das Konto behalten möchten, melden Sie sich einfach einmal an — damit beginnt die Frist neu. Eine Bestellung genügt natürlich ebenso.',
+    'action' => 'Anmelden und Konto behalten',
+    'nothing_lost' => 'Verloren geht dabei nichts außer dem Zugang selbst: Es gibt zu diesem Konto keine Cloud, keine Dateien und keine Rechnungen. Sie können sich später jederzeit neu registrieren.',
+];
diff --git a/lang/de/dpa.php b/lang/de/dpa.php
new file mode 100644
index 0000000..6f79b85
--- /dev/null
+++ b/lang/de/dpa.php
@@ -0,0 +1,18 @@
+<?php
+
+// Der Auftragsverarbeitungsvertrag, wie ihn der Kunde sieht. Der TEXT des
+// Vertrags liegt nicht hier — er wird in der Konsole hochgeladen.
+return [
+    'title' => 'AV-Vertrag & TOM',
+    'sub' => 'Der Vertrag zur Auftragsverarbeitung nach Art. 28 DSGVO samt Dokumentation der technischen und organisatorischen Maßnahmen — für Ihre eigene Dokumentation und Prüfung.',
+    'read_agreement' => 'AV-Vertrag ansehen',
+    'read_measures' => 'TOM ansehen',
+    'version' => 'Fassung :version',
+    'accept_cta' => 'Zusätzlich bestätigen',
+    'accepted_on' => 'Fassung :version von Ihnen bestätigt am :when. Bei einer neuen Fassung informieren wir Sie.',
+    'accepted_notice' => 'Bestätigung festgehalten. Den Vertrag finden Sie jederzeit hier.',
+    'download' => 'Herunterladen',
+    'in_force_note' => 'Dieser Vertrag ist mit Ihrer Bestellung Bestandteil unserer Vereinbarung; eine gesonderte Unterschrift ist nicht nötig. Wenn Sie für Ihre Unterlagen eine ausdrückliche Bestätigung möchten, halten wir Fassung, Zeitpunkt und IP-Adresse fest.',
+    'download_agreement' => 'AV-Vertrag laden',
+    'download_measures' => 'TOM laden',
+];
diff --git a/lang/de/dpa_admin.php b/lang/de/dpa_admin.php
new file mode 100644
index 0000000..20b1b2d
--- /dev/null
+++ b/lang/de/dpa_admin.php
@@ -0,0 +1,36 @@
+<?php
+
+return [
+    'eyebrow' => 'Rechtliches',
+    'title' => 'AV-Vertrag & TOM',
+    'subtitle' => 'Das Dokument, das Ihre Kunden nach Art. 28 DSGVO abschließen. Den Text laden Sie hoch — geschrieben wird er von Ihrer Rechtsberatung, nicht von dieser Anwendung.',
+    'upload_title' => 'Neue Fassung hochladen',
+    'upload_sub' => 'PDF, höchstens 10 MB. Die TOM sind eine Anlage zum Vertrag und werden mit derselben Fassung geführt.',
+    'version' => 'Bezeichnung der Fassung',
+    'version_hint' => 'Wie das Dokument selbst sie nennt — „1.0", „2026-08".',
+    'note' => 'Interne Notiz',
+    'note_hint' => 'Optional, nur für die Konsole.',
+    'file_agreement' => 'AV-Vertrag (PDF)',
+    'file_measures' => 'TOM (PDF)',
+    'upload_cta' => 'Hochladen',
+    'uploaded' => 'Fassung :version hochgeladen. Sie ist noch nicht in Kraft.',
+    'current_title' => 'In Kraft',
+    'none_yet' => 'Noch keine Fassung veröffentlicht. Solange nichts in Kraft ist, sehen Ihre Kunden den Punkt nicht.',
+    'in_force_since' => 'seit :when',
+    'accepted_count' => ':accepted von :total Kunden haben zusätzlich bestätigt.',
+    'outstanding' => 'Eine Bestätigung ist nicht erforderlich — der Vertrag gilt mit den AGB.',
+    'versions_title' => 'Fassungen',
+    'no_versions' => 'Noch nichts hochgeladen.',
+    'col_version' => 'Fassung',
+    'col_state' => 'Status',
+    'col_accepted' => 'Abschlüsse',
+    'col_files' => 'Dateien',
+    'state_current' => 'In Kraft',
+    'state_superseded' => 'Abgelöst',
+    'state_draft' => 'Entwurf',
+    'publish' => 'In Kraft setzen',
+    'published' => 'Fassung :version ist in Kraft.',
+    'publish_title' => 'Fassung :version in Kraft setzen?',
+    'publish_body' => 'Ab diesem Moment gilt diese Fassung. Alle Kunden, die die bisherige abgeschlossen hatten, sind wieder offen und müssen erneut zustimmen.',
+    'download' => 'Herunterladen',
+];
diff --git a/lang/de/inbox.php b/lang/de/inbox.php
index 94f2e58..36ad498 100644
--- a/lang/de/inbox.php
+++ b/lang/de/inbox.php
@@ -8,6 +8,9 @@ return [
     'fetch_now' => 'Jetzt abrufen',
     'fetched' => '{1} :count neue Nachricht|[2,*] :count neue Nachrichten',
     'nothing_new' => 'Nichts Neues im Postfach.',
+    'never_checked' => 'Das Postfach wurde noch nie abgerufen — der nächste Lauf ist in wenigen Minuten.',
+    'last_ok' => 'Postfach zuletzt erreicht: :when (:ago)',
+    'last_failed' => 'Postfach zuletzt nicht erreichbar: :when (:ago).',
 
     'show_archived' => 'Erledigte zeigen',
     'show_open' => 'Offene zeigen',
diff --git a/lang/de/integrations.php b/lang/de/integrations.php
index b10ccb7..3494874 100644
--- a/lang/de/integrations.php
+++ b/lang/de/integrations.php
@@ -102,6 +102,17 @@ return [
     'inbound_port_hint' => '993 ist IMAP über TLS. Alles andere läuft unverschlüsselt — dieser Zugang trägt ein Passwort und die Worte Ihrer Kunden.',
     'inbound_username' => 'Postfach',
     'inbound_folder' => 'Ordner',
+    'inbound_test' => 'Verbindung prüfen',
+    'inbound_never' => 'Noch nie geprüft.',
+    'inbound_last_ok' => 'Zuletzt erreichbar: :when (:ago)',
+    'inbound_last_failed' => 'Zuletzt fehlgeschlagen: :when (:ago)',
+    'inbound_ok' => 'Postfach erreichbar.',
+    'inbound_ok_waiting' => '{0} Postfach erreichbar, nichts Ungelesenes.|{1} Postfach erreichbar, :count ungelesene Nachricht.|[2,*] Postfach erreichbar, :count ungelesene Nachrichten.',
+    'inbound_failed_incomplete' => 'Es fehlen noch Angaben: Server, Postfach oder Passwort.',
+    'inbound_failed_unreachable' => 'Der Server ist nicht erreichbar. Stimmen Adresse und Port?',
+    'inbound_failed_credentials' => 'Der Server hat die Anmeldung abgelehnt. Stimmen Postfach und Passwort?',
+    'inbound_failed_folder' => 'Anmeldung hat funktioniert, den Ordner gibt es aber nicht.',
+    'inbound_failed_failed' => 'Die Verbindung ist fehlgeschlagen. Näheres steht im Log.',
 
     // Die Reiter. Getrennt nach dem, wofür ein Abschnitt da ist — nicht danach,
     // welcher Speichermechanismus einen Wert zufällig hält.
diff --git a/lang/de/mail_preview.php b/lang/de/mail_preview.php
new file mode 100644
index 0000000..5a7633b
--- /dev/null
+++ b/lang/de/mail_preview.php
@@ -0,0 +1,12 @@
+<?php
+
+// Eine Mail ansehen, bevor ein Kunde sie sieht.
+return [
+    'title' => 'E-Mail-Vorschau',
+    'subtitle' => 'Jede Nachricht, die diese Installation verschickt, mit Beispieldaten gefüllt. Im Browser ansehen beantwortet die Frage am Rechner; als echte Mail an sich selbst schicken ist der einzige Weg, es am Telefon zu beurteilen.',
+    'open' => 'Im Browser',
+    'send' => 'An mich senden',
+    'sent' => 'Vorschau an :email geschickt.',
+    'failed' => 'Konnte nicht geschickt werden: :reason',
+    'note' => 'Gesendet wird immer an Ihre eigene Adresse (:email) — es gibt bewusst kein Empfängerfeld. Die Beispieldaten sind erfunden und werden nicht gespeichert.',
+];
diff --git a/lang/de/order.php b/lang/de/order.php
index 0831bd7..57ab377 100644
--- a/lang/de/order.php
+++ b/lang/de/order.php
@@ -7,7 +7,31 @@ return [
     'title' => 'Paket buchen',
     'subtitle' => 'Wählen Sie Ihr Paket. Nach der Zahlung wird Ihre Cloud automatisch aufgesetzt — Sie bekommen die Zugangsdaten per E-Mail und müssen nichts weiter tun.',
 
+    'terms_title' => 'AGB annehmen',
+    'terms_label' => 'Ich habe die :link gelesen und nehme sie an.',
+    'terms_link' => 'Allgemeinen Geschäftsbedingungen',
+    'terms_why' => 'Darin ist alles zu dieser Bestellung geregelt: Preis, Umsatzsteuer, Bereitstellung, Kündigung und Ihr 14-tägiges Widerrufsrecht. Sie verlangen damit auch ausdrücklich, dass die Einrichtung sofort beginnt — sonst könnten wir Ihre Cloud nicht gleich bereitstellen. Widerrufen Sie innerhalb der Frist, erhalten Sie den gesamten Betrag zurück.',
+    'terms_first' => 'Bitte oben die AGB annehmen.',
+    'term_monthly' => 'Monatlich',
+    'term_yearly' => 'Jährlich',
+    'free_months_taken' => '{1} 1 Monat gratis enthalten|[2,*] :count Monate gratis enthalten',
+    'free_months_hint' => '{1} 1 Monat gratis bei Jahreszahlung|[2,*] :count Monate gratis bei Jahreszahlung',
+    'yearly_total' => ':total jährlich',
+    'instead_of' => 'statt :amount',
+    'eyebrow' => 'Pakete',
+    'choose' => 'Weiter',
+    'per_year' => '/Jahr',
+    'per_month_label' => 'monatlich',
+    'per_year_label' => 'jährlich',
+    'per_month_equivalent' => 'entspricht :amount pro Monat',
+    'note_cancel_title' => 'Monatlich kündbar',
+    'note_cancel_body' => 'Keine Mindestlaufzeit. Sie kündigen im Kundenbereich zum Ende der laufenden Periode und erhalten davor einen vollständigen Datenexport.',
+    'note_payment_title' => 'Zahlung über Stripe',
+    'note_payment_body' => 'Kartendaten erreichen unsere Server nie. Die Zahlung läuft über Stripe; wir sehen nur, dass sie erfolgt ist.',
+    'note_migration_title' => 'Datenübernahme',
+    'note_migration_body' => 'Nicht Teil des Pakets — jede Ausgangslage ist anders. Schreiben Sie uns, wir sehen sie uns an und machen ein Angebot.',
     'recommended' => 'Empfohlen',
+    'up_to' => 'bis :count',
     'per_month' => '/Monat',
     'incl_vat' => 'inkl. :rate % MwSt.',
     // Für ein bestätigtes EU-Unternehmen außerhalb Österreichs: keine Umsatzsteuer,
diff --git a/lang/de/plans.php b/lang/de/plans.php
index 91d2848..d594780 100644
--- a/lang/de/plans.php
+++ b/lang/de/plans.php
@@ -91,6 +91,10 @@ return [
     'cents_hint' => 'In Cent, netto.',
     'disk_hint' => 'Mindestens so groß wie der Speicher.',
     'net' => 'netto',
+    'free_months' => 'Gratis-Monate im Jahr',
+    'free_months_hint' => '0 bis 6. Bei 2 zahlt der Kunde 10 Monate und bekommt 12.',
+    'yearly_preview' => 'Jahrespreis: :total netto (:months Monate bezahlt)',
+    'free_months_note' => '{1} ein Monat gratis|[2,*] :count Monate gratis',
     'term_monthly' => 'Monatlich',
     'term_yearly' => 'Jährlich',
 
diff --git a/lang/de/settings.php b/lang/de/settings.php
index 8b14fdb..098d932 100644
--- a/lang/de/settings.php
+++ b/lang/de/settings.php
@@ -1,8 +1,18 @@
 <?php
 
 return [
+    'eyebrow' => 'Konto',
+    'company_sub' => 'Diese Angaben stehen auf Ihren Rechnungen.',
+    // The tab bar. The list in App\Livewire\Settings::TABS decides which
+    // exist; these only name them.
+    'tab' => [
+        'profile' => 'Ihre Daten',
+        'security' => 'Sicherheit',
+        'branding' => 'Erscheinungsbild',
+        'contract' => 'Vertrag',
+    ],
     'title' => 'Einstellungen',
-    'subtitle' => 'Firmendaten, Branding und Ihr Paket verwalten.',
+    'subtitle' => 'Alles, was zu Ihrem Konto gehört — nach Themen getrennt.',
     'save' => 'Speichern',
 
     'company_title' => 'Firmendaten',
@@ -10,6 +20,12 @@ return [
     'contact_name' => 'Ansprechpartner',
     'phone' => 'Telefon',
     'vat_id' => 'USt-IdNr.',
+    'billing_street' => 'Straße und Hausnummer',
+    'billing_postcode' => 'PLZ',
+    'billing_city' => 'Ort',
+    'billing_country' => 'Land',
+    'customer_type_locked' => 'Bei der Registrierung angegeben. Eine Änderung nehmen wir nur nach Rückfrage vor — schreiben Sie uns.',
+    'customer_type_once' => 'Diese Angabe ist noch offen. Sie lässt sich einmal setzen und danach nur noch über den Support ändern.',
     'billing_address' => 'Rechnungsadresse',
     'profile_saved' => 'Firmendaten gespeichert.',
 
@@ -33,6 +49,9 @@ return [
     'brand_using_default' => 'Es werden aktuell die CluPilot-Standardwerte verwendet.',
     'branding_saved' => 'Branding gespeichert.',
 
+    'contract_title' => 'Vertrag und Konto',
+    'contract_sub' => 'Ihr Paket, Ihre Rechte daraus und die Unterlagen dazu.',
+    'to_packages' => 'Pakete ansehen',
     'package_title' => 'Paket',
     'package_active' => 'Aktives Paket: :plan.',
     'no_package' => 'Kein aktives Paket.',
@@ -45,12 +64,34 @@ return [
     'cancel_point_term' => 'Wirksam zum Ende der Laufzeit — bis dahin bleibt alles verfügbar.',
     'cancel_point_export' => 'Zum Laufzeitende erhalten Sie einen vollständigen Datenexport.',
     'cancel_point_irreversible' => 'Die Kündigung ist nach Bestätigung verbindlich.',
+    'cancel_reason_label' => 'Warum kündigen Sie?',
+    'cancel_reason_choose' => 'Bitte wählen',
+    'cancel_reason_required' => 'Bitte wählen Sie einen Grund.',
+    'cancel_note_label' => 'Möchten Sie uns etwas dazu sagen? (optional)',
+    'cancel_note_label_required' => 'Bitte sagen Sie uns kurz, worum es geht.',
+    'cancel_note_required' => 'Bei „Sonstiges" brauchen wir eine kurze Angabe.',
+    // The keys live in Subscription::CANCEL_REASONS; only the wording is here.
+    'cancel_reason' => [
+        'too_expensive' => 'Zu teuer',
+        'missing_features' => 'Funktionen fehlen',
+        'switching_provider' => 'Wechsel zu einem anderen Anbieter',
+        'no_longer_needed' => 'Wird nicht mehr gebraucht',
+        'performance' => 'Geschwindigkeit oder Verfügbarkeit',
+        'support' => 'Unzufrieden mit der Betreuung',
+        'other' => 'Sonstiges',
+    ],
     'cancel_confirm_label' => 'Zum Bestätigen „:name" eingeben:',
     'cancel_confirm' => 'Verbindlich kündigen',
     'cancel_mismatch' => 'Die Eingabe stimmt nicht mit Ihrer Cloud-Adresse überein.',
     'cancel_billing_unreachable' => 'Die Kündigung konnte gerade nicht bei unserem Zahlungsdienstleister eingetragen werden. Es wurde nichts geändert — bitte versuchen Sie es in ein paar Minuten erneut.',
     'keep' => 'Abbrechen',
 
+    'lifecycle_title' => 'Wann wir ein Konto von selbst löschen',
+    'lifecycle_unverified' => 'Eine Registrierung, deren E-Mail-Adresse nicht bestätigt wurde, löschen wir nach :days Tagen. Die Adresse ist danach wieder frei.',
+    'lifecycle_dormant' => 'Ein bestätigtes Konto, zu dem nie ein Paket bestanden hat, löschen wir nach einem Jahr. Wir kündigen das :warn Tage vorher per E-Mail an, und eine Anmeldung genügt, damit die Frist neu beginnt.',
+    'lifecycle_kept' => 'Solange ein Paket läuft, wird nichts automatisch gelöscht. Rechnungen bewahren wir unabhängig davon sieben Jahre auf — dazu sind wir gesetzlich verpflichtet.',
+    'lifecycle_terms' => 'In den AGB nachlesen',
+
     'close_account_title' => 'Konto schließen',
     'close_account_sub' => 'Ihr CluPilot-Konto dauerhaft schließen.',
     'close_cta' => 'Konto schließen',
diff --git a/lang/de/verify_email.php b/lang/de/verify_email.php
index 34179b8..350eaf5 100644
--- a/lang/de/verify_email.php
+++ b/lang/de/verify_email.php
@@ -12,7 +12,7 @@ return [
     // Ausdrücklich: ohne Bestätigung passiert nichts weiter. Wer hier
     // fälschlich eine fremde Adresse eingetragen hat, soll den Empfänger nicht
     // zu einer Handlung zwingen.
-    'not_you' => 'Sie haben sich nicht angemeldet? Dann ignorieren Sie diese Nachricht. Ohne Bestätigung wird das Konto nicht freigeschaltet, und wir schreiben Ihnen nicht wieder.',
+    'not_you' => 'Sie haben sich nicht angemeldet? Dann ignorieren Sie diese Nachricht. Ohne Bestätigung wird das Konto nicht freigeschaltet, nach fünf Tagen von selbst gelöscht, und wir schreiben Ihnen nicht wieder.',
 
     // Die Seite, auf der jemand landet, der sich angemeldet hat aber noch nicht
     // bestätigt ist.
@@ -21,6 +21,15 @@ return [
     'notice_hint' => 'Nichts angekommen? Sehen Sie im Spam-Ordner nach — oder schicken Sie die Nachricht erneut.',
     'notice_resend' => 'Erneut schicken',
     'notice_sent' => 'Bestätigung erneut verschickt.',
-    'notice_signout' => 'Abmelden',
-    'notice_wrong_address' => 'Adresse falsch eingetragen? Melden Sie sich ab und registrieren Sie sich erneut.',
+    'notice_delete' => 'Registrierung verwerfen',
+    'notice_wrong_address' => 'Adresse falsch eingetragen? Verwerfen Sie diese Registrierung und legen Sie sie neu an — erst dann ist die Adresse wieder frei. Bestätigen Sie fünf Tage lang nicht, wird der Zugang von selbst gelöscht; Sie müssen dann nichts tun.',
+
+    'notice_after_confirm' => 'Nach der Bestätigung bleibt Ihr Konto bestehen. Nur ein bestätigtes Konto, zu dem nie ein Paket bestanden hat, löschen wir nach einem Jahr — angekündigt per E-Mail, und eine Anmeldung setzt die Frist zurück.',
+
+    'delete_title' => 'Diese Registrierung verwerfen?',
+    'delete_body' => 'Der Zugang wird gelöscht und die E-Mail-Adresse ist wieder frei. Es ist noch nichts eingerichtet und nichts bezahlt — es geht nur diese unbestätigte Anmeldung verloren.',
+    'delete_keep' => 'Behalten',
+    'delete_confirm' => 'Verwerfen',
+    'deleted' => 'Registrierung verworfen. Sie können sich mit derselben Adresse neu anmelden.',
+    'delete_has_contract' => 'Zu diesem Zugang gehört bereits ein Vertrag — er lässt sich hier nicht verwerfen. Schreiben Sie uns, wir klären das.',
 ];
diff --git a/lang/de/withdrawal.php b/lang/de/withdrawal.php
index d0daa58..5262552 100644
--- a/lang/de/withdrawal.php
+++ b/lang/de/withdrawal.php
@@ -11,6 +11,8 @@
 return [
     'card_title' => 'Widerrufsrecht',
     'card_sub' => 'Sie können diesen Vertrag noch bis zum :date widerrufen — :days Tag(e). Der Dienst endet dann sofort und Sie erhalten den gesamten gezahlten Betrag zurück.',
+    'instead_title' => 'Sie können noch widerrufen',
+    'instead_body' => 'Bis :date können Sie stattdessen vom Vertrag zurücktreten: Sie erhalten den gesamten gezahlten Betrag zurück, die Cloud endet dann allerdings sofort statt zum Ende der bezahlten Periode.',
     'cta' => 'Widerruf erklären',
     'keep' => 'Abbrechen',
     'confirm' => 'Widerruf erklären',
diff --git a/lang/en/admin.php b/lang/en/admin.php
index 2d53112..212d315 100644
--- a/lang/en/admin.php
+++ b/lang/en/admin.php
@@ -11,6 +11,8 @@ return [
     ],
 
     'nav' => [
+        'dpa' => 'Processing agreement',
+        'mail_preview' => 'Mail preview',
         'inbox' => 'Inbox',
         'mail_log' => 'Mail sent',
         'templates' => 'Mail templates',
@@ -89,6 +91,9 @@ return [
     ],
 
     'notice' => [
+        'mail_not_delivering' => 'MAIL_MAILER is set to ":mailer" — no mail is delivered to anybody, it all goes to storage/logs. The mailbox test still reports success, because it builds its own transport.',
+        'site_hidden' => 'The website and the customer portal are hidden — a visitor outside the VPN gets the placeholder page (503). The switch is under Settings → Installation.',
+        'no_site_host' => 'SITE_HOST is not set. The website therefore also answers on :app, and links on it point there instead of at its own name.',
         'no_capacity' => 'No host has room for “:plan” any more — the package needs :needs GB and the roomiest host has :largest GB. A paid order for it would fail at reservation.',
         'failed_runs' => ':n failed provisioning run(s).',
         'host_error' => 'Host :host reports an error.',
diff --git a/lang/en/billing.php b/lang/en/billing.php
index 9693921..8fe0421 100644
--- a/lang/en/billing.php
+++ b/lang/en/billing.php
@@ -29,6 +29,8 @@ return [
     'per_month' => 'net per month',
 
     'net_reverse_charge' => 'net — reverse charge',
+    'term_yearly_note' => 'Paid yearly: :total net per year',
+    'renews_at' => 'next charge :date',
     'net_per_month' => 'net per month',
     'granted_plan' => 'Provided',
     'net_once' => 'net, one-off',
@@ -65,6 +67,9 @@ return [
     'traffic_cta' => 'Add :gb GB',
     'title' => 'Plan & add-ons',
     'subtitle' => 'Your current plan, upgrades, extra storage and add-ons.',
+    'none_title' => 'You have not booked a package yet',
+    'none_body' => 'Your package, your extras and what they cost per month will be here. While nothing is booked there is nothing to change here either.',
+    'none_cta' => 'Book a package',
     'current_plan' => 'Current plan',
     'per_month' => 'per month',
     'month_short' => 'mo',
diff --git a/lang/en/checkout.php b/lang/en/checkout.php
index 146113e..01d3e08 100644
--- a/lang/en/checkout.php
+++ b/lang/en/checkout.php
@@ -12,14 +12,37 @@ return [
     // name for the same charge at the till is when somebody abandons a checkout.
     'setup_fee_line' => 'Setting up your cloud, one-off',
 
-    // The express request that the service begin at once.
+    // What happens without the tick: no order at all.
     //
-    // The second sentence used to state a pro-rata liability (FAGG §16). There
-    // is none here any more: a withdrawing consumer gets the whole amount back
-    // (see App\Actions\WithdrawContract), and a tick-box that promises the
-    // customer something worse than what we actually do is a false statement,
-    // even when it is against our own interest. Nothing turns on the consent
-    // now; it stays as a record that the customer asked us to start at once.
-    'immediate_start' => 'I expressly request that you begin providing the service before the 14-day withdrawal period has ended. My right of withdrawal is unaffected: if I withdraw within the period I get the full amount paid back.',
-    'immediate_start_required' => 'Please confirm that the service should begin at once — otherwise we can only build your cloud once the withdrawal period has ended.',
+    // The box used to carry the whole FAGG §16 sentence, including a pro-rata
+    // liability that does not exist here — a withdrawing consumer gets the whole
+    // amount back (App\Actions\WithdrawContract). It is the terms that regulate
+    // this sale now, and the express request to start at once is stated there and
+    // summarised beside the box. Nothing turns on the record either way; it stays
+    // as proof that the customer asked us to start at once.
+    'terms_required' => 'Without accepting the terms the order cannot go through. Please tick the box — your 14-day right of withdrawal is regulated in there too.',
+
+    // The order page before Stripe — App\Livewire\Checkout.
+    'eyebrow' => 'Order',
+    'title' => 'Review your order',
+    'back_to_plans' => 'Other packages',
+    'unknown_plan' => 'This package is not on sale (any more).',
+    'performance' => 'Performance',
+    'summary_title' => 'Summary',
+    'setup_line' => 'One-off setup',
+    'tax_line' => 'VAT :rate %',
+    'total_today' => 'Due today',
+    'then_monthly' => 'Then :amount per month',
+    'then_yearly' => 'Then :amount per year',
+    'pay_cta' => 'Place binding order',
+    'stripe_note' => 'On to Stripe. Card details never reach our servers.',
+    'next_title' => 'What happens next',
+    'step_pay_title' => 'Payment at Stripe',
+    'step_pay_body' => 'You enter your payment details at Stripe and come back here afterwards.',
+    'step_build_title' => 'Your cloud is built',
+    'step_build_body' => 'That starts as soon as the payment lands and runs without you.',
+    'step_credentials_title' => 'Credentials by mail',
+    'step_credentials_body' => 'As soon as the cloud is ready you get the address and credentials at your confirmed address.',
+    'note_withdrawal_title' => '14-day right of withdrawal',
+    'note_withdrawal_body' => 'As a consumer you may withdraw within 14 days without giving a reason and get the full amount back.',
 ];
diff --git a/lang/en/dormant_mail.php b/lang/en/dormant_mail.php
new file mode 100644
index 0000000..b1e1dd9
--- /dev/null
+++ b/lang/en/dormant_mail.php
@@ -0,0 +1,12 @@
+<?php
+
+return [
+    'subject' => 'Your CluPilot account will be deleted in :days days',
+    'heading' => 'Your account will be deleted',
+    'preheader' => 'In :days days — signing in once is enough to stop it.',
+    'greeting' => 'Hello :name,',
+    'intro' => 'there is no package on your CluPilot account and there never has been. We delete accounts without a package after a year, so that no unused data is left lying with us. For your account that happens in :days days.',
+    'how_to_keep' => 'If you would like to keep the account, simply sign in once — that starts the period again. An order does the same, of course.',
+    'action' => 'Sign in and keep the account',
+    'nothing_lost' => 'Nothing is lost but the login itself: there is no cloud, no file and no invoice on this account. You can register again at any time.',
+];
diff --git a/lang/en/dpa.php b/lang/en/dpa.php
new file mode 100644
index 0000000..4c0b3a5
--- /dev/null
+++ b/lang/en/dpa.php
@@ -0,0 +1,18 @@
+<?php
+
+// The processing agreement as the customer sees it. The TEXT of the agreement
+// is not here — it is uploaded in the console.
+return [
+    'title' => 'Processing agreement & TOMs',
+    'sub' => 'The data-processing agreement under Art. 28 GDPR together with the documentation of technical and organisational measures — for your own records and audits.',
+    'read_agreement' => 'Read the agreement',
+    'read_measures' => 'Read the measures',
+    'version' => 'Version :version',
+    'accept_cta' => 'Confirm additionally',
+    'accepted_on' => 'Version :version confirmed by you on :when. We will tell you when a new version is issued.',
+    'accepted_notice' => 'Confirmation recorded. The agreement stays available here.',
+    'download' => 'Download',
+    'in_force_note' => 'This agreement became part of our contract with your order; a separate signature is not required. If you would like an explicit confirmation for your records, we note the version, the moment and the IP address.',
+    'download_agreement' => 'Download agreement',
+    'download_measures' => 'Download measures',
+];
diff --git a/lang/en/dpa_admin.php b/lang/en/dpa_admin.php
new file mode 100644
index 0000000..e1ee1bb
--- /dev/null
+++ b/lang/en/dpa_admin.php
@@ -0,0 +1,36 @@
+<?php
+
+return [
+    'eyebrow' => 'Legal',
+    'title' => 'Processing agreement & TOMs',
+    'subtitle' => 'The document your customers conclude under Art. 28 GDPR. You upload the text — it is written by your lawyer, not by this application.',
+    'upload_title' => 'Upload a new version',
+    'upload_sub' => 'PDF, at most 10 MB. The measures are an annex to the agreement and are versioned with it.',
+    'version' => 'Version label',
+    'version_hint' => 'What the document itself calls it — "1.0", "2026-08".',
+    'note' => 'Internal note',
+    'note_hint' => 'Optional, console only.',
+    'file_agreement' => 'Agreement (PDF)',
+    'file_measures' => 'Measures (PDF)',
+    'upload_cta' => 'Upload',
+    'uploaded' => 'Version :version uploaded. It is not in force yet.',
+    'current_title' => 'In force',
+    'none_yet' => 'No version published yet. While nothing is in force, customers do not see the section.',
+    'in_force_since' => 'since :when',
+    'accepted_count' => ':accepted of :total customers confirmed it additionally.',
+    'outstanding' => 'A confirmation is not required — the agreement applies with the terms.',
+    'versions_title' => 'Versions',
+    'no_versions' => 'Nothing uploaded yet.',
+    'col_version' => 'Version',
+    'col_state' => 'State',
+    'col_accepted' => 'Conclusions',
+    'col_files' => 'Files',
+    'state_current' => 'In force',
+    'state_superseded' => 'Superseded',
+    'state_draft' => 'Draft',
+    'publish' => 'Put in force',
+    'published' => 'Version :version is in force.',
+    'publish_title' => 'Put version :version in force?',
+    'publish_body' => 'From this moment this version applies. Every customer who had concluded the previous one is outstanding again and must accept anew.',
+    'download' => 'Download',
+];
diff --git a/lang/en/inbox.php b/lang/en/inbox.php
index 01f742a..54fbb16 100644
--- a/lang/en/inbox.php
+++ b/lang/en/inbox.php
@@ -8,6 +8,9 @@ return [
     'fetch_now' => 'Fetch now',
     'fetched' => '{1} :count new message|[2,*] :count new messages',
     'nothing_new' => 'Nothing new in the mailbox.',
+    'never_checked' => 'The mailbox has never been fetched yet — the next run is a few minutes away.',
+    'last_ok' => 'Mailbox last reached: :when (:ago)',
+    'last_failed' => 'Mailbox last unreachable: :when (:ago).',
 
     'show_archived' => 'Show filed',
     'show_open' => 'Show open',
diff --git a/lang/en/integrations.php b/lang/en/integrations.php
index 0c13a19..6d98f1f 100644
--- a/lang/en/integrations.php
+++ b/lang/en/integrations.php
@@ -102,6 +102,17 @@ return [
     'inbound_port_hint' => '993 is IMAP over TLS. Anything else is unencrypted — and this connection carries a password and your customers own words.',
     'inbound_username' => 'Mailbox',
     'inbound_folder' => 'Folder',
+    'inbound_test' => 'Test the connection',
+    'inbound_never' => 'Never checked.',
+    'inbound_last_ok' => 'Last reached: :when (:ago)',
+    'inbound_last_failed' => 'Last failed: :when (:ago)',
+    'inbound_ok' => 'Mailbox reachable.',
+    'inbound_ok_waiting' => '{0} Mailbox reachable, nothing unread.|{1} Mailbox reachable, :count unread message.|[2,*] Mailbox reachable, :count unread messages.',
+    'inbound_failed_incomplete' => 'Something is still missing: server, mailbox or password.',
+    'inbound_failed_unreachable' => 'The server cannot be reached. Are the address and port right?',
+    'inbound_failed_credentials' => 'The server refused the sign-in. Are the mailbox and password right?',
+    'inbound_failed_folder' => 'The sign-in worked, but that folder does not exist.',
+    'inbound_failed_failed' => 'The connection failed. There is more in the log.',
 
     // The tabs. Split by what a section is for — not by which storage
     // mechanism happens to hold a given value.
diff --git a/lang/en/mail_preview.php b/lang/en/mail_preview.php
new file mode 100644
index 0000000..36f4667
--- /dev/null
+++ b/lang/en/mail_preview.php
@@ -0,0 +1,12 @@
+<?php
+
+// Looking at a mail before a customer does.
+return [
+    'title' => 'Mail preview',
+    'subtitle' => 'Every message this installation sends, filled with sample data. Opening it in the browser answers the desktop question; sending it to yourself as a real mail is the only way to judge it on a phone.',
+    'open' => 'In the browser',
+    'send' => 'Send to me',
+    'sent' => 'Preview sent to :email.',
+    'failed' => 'Could not be sent: :reason',
+    'note' => 'Always sent to your own address (:email) — there is deliberately no recipient field. The sample data is invented and is not stored.',
+];
diff --git a/lang/en/order.php b/lang/en/order.php
index 9bf9101..b055da9 100644
--- a/lang/en/order.php
+++ b/lang/en/order.php
@@ -7,7 +7,31 @@ return [
     'title' => 'Book a package',
     'subtitle' => 'Pick your package. Once it is paid your cloud is built automatically — your credentials arrive by mail and there is nothing else for you to do.',
 
+    'terms_title' => 'Accept the terms',
+    'terms_label' => 'I have read and accept the :link.',
+    'terms_link' => 'terms and conditions',
+    'terms_why' => 'They regulate everything about this order: price, VAT, delivery, cancellation and your 14-day right of withdrawal. You are also expressly requesting that we begin at once — otherwise your cloud could not be built straight away. Withdraw within the period and you get the full amount back.',
+    'terms_first' => 'Please accept the terms above.',
+    'term_monthly' => 'Monthly',
+    'term_yearly' => 'Yearly',
+    'free_months_taken' => '{1} 1 month free included|[2,*] :count months free included',
+    'free_months_hint' => '{1} 1 month free when paying yearly|[2,*] :count months free when paying yearly',
+    'yearly_total' => ':total per year',
+    'instead_of' => 'instead of :amount',
+    'eyebrow' => 'Packages',
+    'choose' => 'Continue',
+    'per_year' => '/year',
+    'per_month_label' => 'monthly',
+    'per_year_label' => 'yearly',
+    'per_month_equivalent' => 'that is :amount per month',
+    'note_cancel_title' => 'Cancel monthly',
+    'note_cancel_body' => 'No minimum term. Cancel in the portal to the end of the current period; you get a full data export before it ends.',
+    'note_payment_title' => 'Payment via Stripe',
+    'note_payment_body' => 'Card details never reach our servers. Stripe handles the payment; we only learn that it happened.',
+    'note_migration_title' => 'Data migration',
+    'note_migration_body' => 'Not part of the package — every starting point differs. Write to us, we will look at yours and quote for it.',
     'recommended' => 'Recommended',
+    'up_to' => 'up to :count',
     'per_month' => '/month',
     'incl_vat' => 'incl. :rate % VAT',
     // For a verified EU business outside Austria: no VAT, and therefore no second
diff --git a/lang/en/plans.php b/lang/en/plans.php
index 36fce03..6fc36bf 100644
--- a/lang/en/plans.php
+++ b/lang/en/plans.php
@@ -91,6 +91,10 @@ return [
     'cents_hint' => 'In cents, net.',
     'disk_hint' => 'At least as large as the storage quota.',
     'net' => 'net',
+    'free_months' => 'Free months per year',
+    'free_months_hint' => '0 to 6. At 2 the customer pays for 10 months and gets 12.',
+    'yearly_preview' => 'Yearly price: :total net (:months months paid)',
+    'free_months_note' => '{1} one month free|[2,*] :count months free',
     'term_monthly' => 'Monthly',
     'term_yearly' => 'Yearly',
 
diff --git a/lang/en/settings.php b/lang/en/settings.php
index 8f33501..e72e94f 100644
--- a/lang/en/settings.php
+++ b/lang/en/settings.php
@@ -1,8 +1,18 @@
 <?php
 
 return [
+    'eyebrow' => 'Account',
+    'company_sub' => 'These details appear on your invoices.',
+    // The tab bar. The list in App\Livewire\Settings::TABS decides which
+    // exist; these only name them.
+    'tab' => [
+        'profile' => 'Your details',
+        'security' => 'Security',
+        'branding' => 'Appearance',
+        'contract' => 'Contract',
+    ],
     'title' => 'Settings',
-    'subtitle' => 'Manage your company details, branding and package.',
+    'subtitle' => 'Everything that belongs to your account, grouped by subject.',
     'save' => 'Save',
 
     'company_title' => 'Company details',
@@ -10,6 +20,12 @@ return [
     'contact_name' => 'Contact person',
     'phone' => 'Phone',
     'vat_id' => 'VAT ID',
+    'billing_street' => 'Street and number',
+    'billing_postcode' => 'Postcode',
+    'billing_city' => 'Town',
+    'billing_country' => 'Country',
+    'customer_type_locked' => 'Given at registration. We only change it after asking — write to us.',
+    'customer_type_once' => 'Not answered yet. It can be set once and changed afterwards only through support.',
     'billing_address' => 'Billing address',
     'profile_saved' => 'Company details saved.',
 
@@ -33,6 +49,9 @@ return [
     'brand_using_default' => 'Currently using the CluPilot defaults.',
     'branding_saved' => 'Branding saved.',
 
+    'contract_title' => 'Contract and account',
+    'contract_sub' => 'Your package, the rights that come with it, and the documents.',
+    'to_packages' => 'See the packages',
     'package_title' => 'Package',
     'package_active' => 'Active package: :plan.',
     'no_package' => 'No active package.',
@@ -45,12 +64,34 @@ return [
     'cancel_point_term' => 'Effective at the end of the term — everything stays available until then.',
     'cancel_point_export' => 'At the end of the term you receive a full data export.',
     'cancel_point_irreversible' => 'Once confirmed, the cancellation is binding.',
+    'cancel_reason_label' => 'Why are you cancelling?',
+    'cancel_reason_choose' => 'Please choose',
+    'cancel_reason_required' => 'Please choose a reason.',
+    'cancel_note_label' => 'Anything you would like to tell us? (optional)',
+    'cancel_note_label_required' => 'Please tell us briefly what it is about.',
+    'cancel_note_required' => 'With "other" we need a short note.',
+    // The keys live in Subscription::CANCEL_REASONS; only the wording is here.
+    'cancel_reason' => [
+        'too_expensive' => 'Too expensive',
+        'missing_features' => 'Missing features',
+        'switching_provider' => 'Moving to another provider',
+        'no_longer_needed' => 'No longer needed',
+        'performance' => 'Speed or availability',
+        'support' => 'Unhappy with the support',
+        'other' => 'Other',
+    ],
     'cancel_confirm_label' => 'Type “:name” to confirm:',
     'cancel_confirm' => 'Cancel for good',
     'cancel_mismatch' => 'That does not match your cloud address.',
     'cancel_billing_unreachable' => 'The cancellation could not be registered with our payment provider just now. Nothing has been changed — please try again in a few minutes.',
     'keep' => 'Keep',
 
+    'lifecycle_title' => 'When we delete an account by ourselves',
+    'lifecycle_unverified' => 'A registration whose address was never confirmed is deleted after :days days. The address is free again afterwards.',
+    'lifecycle_dormant' => 'A confirmed account that never had a package is deleted after a year. We announce it :warn days beforehand by mail, and signing in once is enough to start the period again.',
+    'lifecycle_kept' => 'While a package is running nothing is deleted automatically. Invoices are kept for seven years regardless — we are required to.',
+    'lifecycle_terms' => 'Read it in the terms',
+
     'close_account_title' => 'Close account',
     'close_account_sub' => 'Permanently close your CluPilot account.',
     'close_cta' => 'Close account',
diff --git a/lang/en/verify_email.php b/lang/en/verify_email.php
index f915f95..faa578c 100644
--- a/lang/en/verify_email.php
+++ b/lang/en/verify_email.php
@@ -11,7 +11,7 @@ return [
     'fallback' => 'If the button does not work, copy this address into your browser:',
     // Said plainly: without confirmation nothing further happens. Somebody who
     // typed a stranger's address must not force that stranger to act.
-    'not_you' => 'Did not sign up? Ignore this message. Without confirmation the account is not opened, and we will not write again.',
+    'not_you' => 'Did not sign up? Ignore this message. Without confirmation the account is never activated, is removed by itself after five days, and we will not write again.',
 
     // The page somebody lands on when signed in but not yet confirmed.
     'notice_title' => 'One step left',
@@ -19,6 +19,15 @@ return [
     'notice_hint' => 'Nothing arrived? Check the spam folder — or send it again.',
     'notice_resend' => 'Send again',
     'notice_sent' => 'Confirmation sent again.',
-    'notice_signout' => 'Sign out',
-    'notice_wrong_address' => 'Typed the wrong address? Sign out and register again.',
+    'notice_delete' => 'Discard this registration',
+    'notice_wrong_address' => 'Typed the wrong address? Discard this registration and start again — only then is the address free. If you do not confirm within five days the account is removed by itself; there is nothing for you to do.',
+
+    'notice_after_confirm' => 'Once confirmed, your account stays. Only a confirmed account that never had a package is deleted after a year — announced by mail, and signing in starts the period again.',
+
+    'delete_title' => 'Discard this registration?',
+    'delete_body' => 'The account is deleted and the address becomes free again. Nothing has been set up and nothing paid for — only this unconfirmed sign-up is lost.',
+    'delete_keep' => 'Keep it',
+    'delete_confirm' => 'Discard',
+    'deleted' => 'Registration discarded. You can sign up again with the same address.',
+    'delete_has_contract' => 'There is already a contract behind this account, so it cannot be discarded here. Write to us and we will sort it out.',
 ];
diff --git a/lang/en/withdrawal.php b/lang/en/withdrawal.php
index a73b82a..cbdea95 100644
--- a/lang/en/withdrawal.php
+++ b/lang/en/withdrawal.php
@@ -11,6 +11,8 @@
 return [
     'card_title' => 'Right of withdrawal',
     'card_sub' => 'You may withdraw from this contract until :date — :days day(s) left. The service ends immediately and you get the full amount paid back.',
+    'instead_title' => 'You can still withdraw',
+    'instead_body' => 'Until :date you may withdraw from the contract instead: you get the whole amount back, but the cloud then ends at once rather than at the end of the paid period.',
     'cta' => 'Declare withdrawal',
     'keep' => 'Cancel',
     'confirm' => 'Declare withdrawal',
diff --git a/resources/views/components/admin/secret-field.blade.php b/resources/views/components/admin/secret-field.blade.php
index f7c818b..2fc6705 100644
--- a/resources/views/components/admin/secret-field.blade.php
+++ b/resources/views/components/admin/secret-field.blade.php
@@ -15,7 +15,15 @@
     <div class="flex flex-wrap items-start justify-between gap-3">
         <div>
             <h3 class="text-sm font-semibold text-ink">{{ $entry['label'] }}</h3>
-            <p class="mt-0.5 font-mono text-xs text-muted">{{ $entry['key'] }}</p>
+            {{-- The NAME OF THE SERVER VARIABLE, not the internal registry key.
+
+                 It used to print `stripe.secret` — an identifier from
+                 SecretVault::REGISTRY that means nothing on this page and is not
+                 something an operator can type anywhere. The env name is: it is
+                 what stands in the server file, it is what the .env tab of this
+                 same page lists, and when the badge beside this says "Aus der
+                 Serverdatei" it is the answer to "which line?". --}}
+            <p class="mt-0.5 font-mono text-xs text-muted">{{ $entry['envKey'] }}</p>
         </div>
         <div class="flex flex-wrap items-center gap-2">
             {{-- Which of the two slots THIS card reads and writes right now —
diff --git a/resources/views/components/mail/layout.blade.php b/resources/views/components/mail/layout.blade.php
index 3420f0e..6952df1 100644
--- a/resources/views/components/mail/layout.blade.php
+++ b/resources/views/components/mail/layout.blade.php
@@ -28,18 +28,37 @@
 <table role="presentation" width="100%" cellpadding="0" cellspacing="0" border="0" style="background-color:#f6f6f8;border-collapse:collapse;">
 <tr><td align="center" style="padding:32px 16px;">
 
-  <table role="presentation" width="600" cellpadding="0" cellspacing="0" border="0" style="width:600px;max-width:600px;border-collapse:collapse;font-family:'IBM Plex Sans',-apple-system,BlinkMacSystemFont,'Segoe UI',Helvetica,Arial,sans-serif;">
+  {{-- FLUID, with 600 as a ceiling rather than a floor. width="600" plus
+       width:600px forced every phone to scroll sideways to read a sentence —
+       reported exactly that way. A mail cannot rely on a media query (Outlook
+       renders with Word and drops <style> blocks, which is why this file is
+       inline attributes throughout), so the layout has to shrink by itself. --}}
+  <table role="presentation" width="100%" cellpadding="0" cellspacing="0" border="0" style="width:100%;max-width:600px;border-collapse:collapse;font-family:'IBM Plex Sans',-apple-system,BlinkMacSystemFont,'Segoe UI',Helvetica,Arial,sans-serif;">
 
     <tr><td style="padding:0 0 20px 4px;">
       <table role="presentation" cellpadding="0" cellspacing="0" border="0" style="border-collapse:collapse;">
         <tr>
           <td style="padding-right:10px;">
+            {{-- The mark, not just its orange tile. It shipped as an empty
+                 square: the ascent inside it lives in an SVG the site loads, and
+                 a mail cannot — Gmail strips inline SVG, Outlook renders with
+                 Word, and this layout carries no image by design (half of all
+                 clients block remote content).
+
+                 So the shape is drawn with a character every mail font has.
+                 ▲ is the mark's own silhouette — the autopilot ascent — in white
+                 on the accent tile, which is the whole of what a reader
+                 recognises at 26 pixels. --}}
             <table role="presentation" cellpadding="0" cellspacing="0" border="0" style="border-collapse:collapse;">
-              <tr><td width="26" height="26" style="width:26px;height:26px;background-color:#f97316;border-radius:7px;font-size:0;line-height:0;">&nbsp;</td></tr>
+              <tr><td width="26" height="26" align="center" valign="middle" style="width:26px;height:26px;background-color:#f97316;border-radius:7px;text-align:center;">
+                <span style="display:inline-block;font-family:Helvetica,Arial,sans-serif;font-size:13px;line-height:26px;color:#ffffff;">&#9650;</span>
+              </td></tr>
             </table>
           </td>
           <td style="font-size:17px;line-height:26px;color:#17171c;letter-spacing:-0.2px;">
-            <span style="font-weight:700;color:#17171c;">CluPilot</span>
+            {{-- The whole name, as the wordmark writes it: CluPilot in ink,
+                 Cloud in the muted tone beside it. --}}
+            <span style="font-weight:700;color:#17171c;">CluPilot</span> <span style="font-weight:600;color:#6e6e7a;">Cloud</span>
           </td>
         </tr>
       </table>
@@ -48,7 +67,7 @@
     <tr><td style="background-color:#ffffff;border:1px solid #e9e9ee;border-radius:12px;">
       <table role="presentation" width="100%" cellpadding="0" cellspacing="0" border="0" style="border-collapse:collapse;">
 
-        <tr><td style="padding:40px 40px 0 40px;">
+        <tr><td style="padding:40px 24px 0 24px;">
           <h1 style="margin:0 0 14px 0;font-size:25px;line-height:32px;font-weight:700;color:#17171c;letter-spacing:-0.5px;">{{ $heading }}</h1>
           @if ($greeting)
             <p style="margin:0 0 8px 0;font-size:15px;line-height:24px;color:#43434e;">{{ $greeting }}</p>
diff --git a/resources/views/components/ui/panel.blade.php b/resources/views/components/ui/panel.blade.php
new file mode 100644
index 0000000..3b2740b
--- /dev/null
+++ b/resources/views/components/ui/panel.blade.php
@@ -0,0 +1,40 @@
+@props([
+    'title' => null,
+    'subtitle' => null,
+])
+
+{{-- A settings panel: one card, a header that names it, a body of rows, and an
+     optional footer for whatever finishes the group.
+
+     The page was a heap of cards of different heights, each holding one thing,
+     which produced a staircase down the screen and left half the width empty
+     beside it. A panel with divided rows is what every settings page worth
+     copying does — the group is the card, the settings are its rows, and the
+     rhythm comes from the dividers rather than from the gaps between boxes. --}}
+<section {{ $attributes->merge(['class' => 'overflow-hidden rounded-lg border border-line bg-surface shadow-xs']) }}>
+    @if ($title || isset($header))
+        <div class="flex flex-wrap items-start justify-between gap-3 border-b border-line px-6 py-4">
+            @isset($header)
+                {{ $header }}
+            @else
+                <div class="min-w-0">
+                    <h2 class="text-sm font-bold text-ink">{{ $title }}</h2>
+                    @if ($subtitle)
+                        <p class="mt-0.5 max-w-[76ch] text-sm leading-relaxed text-muted">{{ $subtitle }}</p>
+                    @endif
+                </div>
+                @isset($action)
+                    <div class="shrink-0">{{ $action }}</div>
+                @endisset
+            @endisset
+        </div>
+    @endif
+
+    <div class="divide-y divide-line">{{ $slot }}</div>
+
+    @isset($footer)
+        <div class="flex flex-wrap items-center justify-end gap-3 border-t border-line bg-surface-2 px-6 py-4">
+            {{ $footer }}
+        </div>
+    @endisset
+</section>
diff --git a/resources/views/components/ui/row.blade.php b/resources/views/components/ui/row.blade.php
new file mode 100644
index 0000000..f0e6609
--- /dev/null
+++ b/resources/views/components/ui/row.blade.php
@@ -0,0 +1,27 @@
+@props([
+    'label' => null,
+    'hint' => null,
+    'for' => null,
+])
+
+{{-- One row of a settings panel: what it is on the left, the control on the
+     right.
+
+     The two-column shape is what uses the width. A single column of full-width
+     inputs on a 1240px shell leaves two thirds of the line empty and makes a
+     four-field form look like a questionnaire; a label column of 280px with the
+     control beside it reads as a settings page and fits the screen it is on.
+
+     Stacks below `sm`, because on a telephone the label belongs above its
+     field. --}}
+<div {{ $attributes->merge(['class' => 'grid gap-x-6 gap-y-2 px-6 py-4 sm:grid-cols-[minmax(0,280px)_minmax(0,1fr)] sm:items-start']) }}>
+    @if ($label)
+        <div class="min-w-0">
+            <label @if ($for) for="{{ $for }}" @endif class="text-sm font-medium text-ink">{{ $label }}</label>
+            @if ($hint)
+                <p class="mt-0.5 text-xs leading-relaxed text-muted">{{ $hint }}</p>
+            @endif
+        </div>
+    @endif
+    <div class="min-w-0">{{ $slot }}</div>
+</div>
diff --git a/resources/views/landing.blade.php b/resources/views/landing.blade.php
index 89cf2ff..329dbb1 100644
--- a/resources/views/landing.blade.php
+++ b/resources/views/landing.blade.php
@@ -511,11 +511,47 @@
             // stylesheet by reading these files as text, so a class name
             // assembled at render time is a class name that was never compiled.
             $planColumns = ['lg:grid-cols-1', 'lg:grid-cols-2', 'lg:grid-cols-3', 'lg:grid-cols-4'][min(count($plans), 4) - 1];
+            $bestFreeMonths = (int) collect($plans)->max('free_months');
         @endphp
+
+        {{-- Monthly or yearly, on the sheet itself. Both figures are rendered
+             and one is hidden, so switching costs no request — and a visitor who
+             never touches it still reads the monthly price the portal will
+             charge. The saving is named next to the switch: "jährlich" on its
+             own gives nobody a reason to look. --}}
+        <div x-data="{ term: 'monthly' }" class="mt-12">
+            {{-- The saving above the switch, and always present: hidden on the
+                 yearly view it re-centred the row every time somebody changed
+                 their mind. One line, two wordings. --}}
+            @if ($bestFreeMonths > 0)
+                <p class="mb-3 text-center text-sm font-semibold text-success">
+                    <span x-show="term !== 'yearly'">{{ $bestFreeMonths === 1 ? '1 Monat gratis' : $bestFreeMonths.' Monate gratis' }} bei Jahreszahlung</span>
+                    <span x-show="term === 'yearly'" x-cloak>{{ $bestFreeMonths === 1 ? '1 Monat gratis' : $bestFreeMonths.' Monate gratis' }} — in jedem Jahrespreis enthalten</span>
+                </p>
+            @endif
+            <div class="flex flex-wrap items-center justify-center gap-3">
+                {{-- text-bg on the active option, not a colour that does not
+                     exist: `text-on-ink` is not in the palette (the ink pairing
+                     is bg-ink/text-bg, as x-ui.button's ink variant has it), so
+                     the label kept its inherited grey and sat unreadable on the
+                     dark pill. And one radius scale nested inside another: the
+                     shell rounded-lg, the option rounded — the shell's radius
+                     less its own padding. --}}
+                <div class="inline-flex rounded-lg border border-line bg-surface p-1 shadow-xs" role="group">
+                    @foreach (['monthly' => 'Monatlich', 'yearly' => 'Jährlich'] as $option => $label)
+                        <button type="button" x-on:click="term = '{{ $option }}'"
+                                class="rounded px-5 py-2 text-sm font-semibold transition-colors"
+                                x-bind:class="term === '{{ $option }}' ? 'bg-ink text-bg shadow-xs' : 'text-muted hover:text-ink'">
+                            {{ $label }}
+                        </button>
+                    @endforeach
+                </div>
+            </div>
+
         {{-- Stretched, not items-start: the cards carry different numbers of
              features, and four "anfragen" buttons at four different heights is
              the first thing the eye picks up on a price sheet. --}}
-        <div class="mt-14 grid gap-5 sm:grid-cols-2 lg:gap-6 {{ $planColumns }}">
+        <div class="mt-8 grid gap-5 sm:grid-cols-2 lg:gap-6 {{ $planColumns }}">
             @foreach ($plans as $i => $plan)
                 <div @class([
                     'rv flex flex-col rounded-xl border p-7',
@@ -536,18 +572,44 @@
                         <p class="mt-1 text-sm text-muted">{{ $plan['audience'] }}</p>
                     @endif
 
-                    <p class="mt-6 flex items-baseline gap-1.5">
-                        <span class="text-[2.4rem] font-bold leading-none tabular-nums tracking-[-0.04em] text-ink">{{ $plan['price'] }}</span>
-                        <span class="text-sm text-muted">/Monat</span>
-                    </p>
-                    {{-- The net figure under the gross one, not instead of it.
-                         A private customer pays what is written large; a
-                         business needs the other number for its books, and
-                         printing only one of the two was wrong for one of the
-                         two readers whichever we picked. --}}
-                    <p class="mt-1.5 text-xs text-muted">
-                        inkl. {{ $vat['label'] }} % MwSt. · netto {{ $plan['price_net'] }}
-                    </p>
+                    {{-- The headline stays "per month" in both terms: a yearly
+                         total shown as one big number reads as five times dearer
+                         at a glance, and the amount actually taken is named on
+                         the line under it. --}}
+                    <div x-show="term === 'monthly'">
+                        <p class="mt-6 flex items-baseline gap-1.5">
+                            <span class="text-[2.4rem] font-bold leading-none tabular-nums tracking-[-0.04em] text-ink">{{ $plan['price'] }}</span>
+                            <span class="text-sm text-muted">/Monat</span>
+                        </p>
+                        {{-- The net figure under the gross one, not instead of it.
+                             A private customer pays what is written large; a
+                             business needs the other number for its books, and
+                             printing only one of the two was wrong for one of the
+                             two readers whichever we picked. --}}
+                        <p class="mt-1.5 text-xs text-muted">
+                            inkl. {{ $vat['label'] }} % MwSt. · netto {{ $plan['price_net'] }}
+                        </p>
+                    </div>
+
+                    {{-- The yearly PRICE, not the monthly equivalent of it. Shown
+                         per month, the figure did not move at all when the switch
+                         was thrown on a package with no free months, and the
+                         sheet looked like it had ignored the click. What it works
+                         out to per month is worth knowing and is said under. --}}
+                    <div x-show="term === 'yearly'" x-cloak>
+                        <p class="mt-6 flex items-baseline gap-1.5">
+                            <span class="text-[2.4rem] font-bold leading-none tabular-nums tracking-[-0.04em] text-ink">{{ $plan['price_yearly'] }}</span>
+                            <span class="text-sm text-muted">/Jahr</span>
+                        </p>
+                        <p class="mt-1.5 text-xs text-muted">
+                            entspricht {{ $plan['price_yearly_monthly'] }} pro Monat · inkl. {{ $vat['label'] }} % MwSt. · netto {{ $plan['price_yearly_net'] }}
+                        </p>
+                        @if ($plan['free_months'] > 0)
+                            <p class="mt-1 text-xs font-semibold text-success-text">
+                                {{ $plan['free_months'] === 1 ? '1 Monat gratis' : $plan['free_months'].' Monate gratis' }} · statt {{ $plan['price_twelve_months'] }}
+                            </p>
+                        @endif
+                    </div>
                     {{-- Named, or not mentioned. "zzgl. einmaliger Einrichtung"
                          without a figure told a visitor only that there is a
                          cost — the worst of both. Zero on the Finance page
@@ -601,6 +663,7 @@
                 </div>
             @endforeach
         </div>
+        </div>{{-- /x-data: the switch and the cards it switches share one scope --}}
 
         {{-- The baseline, said once and said first. Four of these were rows of
              ticks running straight down every column of the table below, and
diff --git a/resources/views/legal.blade.php b/resources/views/legal.blade.php
index be1b51a..8ce840d 100644
--- a/resources/views/legal.blade.php
+++ b/resources/views/legal.blade.php
@@ -1,30 +1,36 @@
 {{--
     Impressum, Datenschutz, AGB.
 
-    Placeholders still — the texts are the company's to write, not mine to
-    invent. What changed is that they are now pages OF the website rather than
-    a standalone card in a different design: same header, same footer, so
-    somebody following the imprint link from the footer does not land on what
-    looks like a stranded error page.
+    One shell, three pages. Where a partial exists under resources/views/legal/
+    it is included; otherwise the placeholder stands, because those texts are the
+    company's to write and not mine to invent. Pages OF the website rather than a
+    standalone card in a different design: same header, same footer, so somebody
+    following the imprint link from the footer does not land on what looks like a
+    stranded error page.
 --}}
+@php($partial = isset($page) ? 'legal.'.$page : null)
 <x-layouts.site :title="$title.' — CluPilot Cloud'" robots="noindex">
 
 <article class="mx-auto max-w-[820px] px-5 pb-20 pt-32 sm:px-8 lg:pb-28 lg:pt-40">
     <p class="lbl">Rechtliches</p>
     <h1 class="mt-4 text-[clamp(2rem,4vw,3rem)] font-bold leading-[1.08] tracking-[-0.035em] text-ink">{{ $title }}</h1>
 
-    <div class="mt-10 rounded-xl border border-line bg-surface p-8 shadow-xs lg:p-10">
-        <p class="text-md leading-relaxed text-body">Dieser Inhalt wird noch ergänzt.</p>
-        <p class="mt-4 text-md leading-relaxed text-body">
-            Bei Fragen erreichen Sie uns unter
-            <a href="mailto:office&#64;clupilot.com" class="font-medium text-accent-text underline-offset-4 hover:underline">office&#64;clupilot.com</a>.
-        </p>
+    @if ($partial && view()->exists($partial))
+        @include($partial)
+    @else
+        <div class="mt-10 rounded-xl border border-line bg-surface p-8 shadow-xs lg:p-10">
+            <p class="text-md leading-relaxed text-body">Dieser Inhalt wird noch ergänzt.</p>
+            <p class="mt-4 text-md leading-relaxed text-body">
+                Bei Fragen erreichen Sie uns unter
+                <a href="mailto:office&#64;clupilot.com" class="font-medium text-accent-text underline-offset-4 hover:underline">office&#64;clupilot.com</a>.
+            </p>
 
-        <x-ui.button href="{{ route('home') }}" variant="secondary" class="mt-8">
-            <x-ui.icon name="arrow-left" class="size-4" />
-            Zurück zur Startseite
-        </x-ui.button>
-    </div>
+            <x-ui.button href="{{ route('home') }}" variant="secondary" class="mt-8">
+                <x-ui.icon name="arrow-left" class="size-4" />
+                Zurück zur Startseite
+            </x-ui.button>
+        </div>
+    @endif
 </article>
 
 </x-layouts.site>
diff --git a/resources/views/legal/dpa/agreement.blade.php b/resources/views/legal/dpa/agreement.blade.php
new file mode 100644
index 0000000..6ac35ff
--- /dev/null
+++ b/resources/views/legal/dpa/agreement.blade.php
@@ -0,0 +1,204 @@
+{{--
+    Auftragsverarbeitungsvertrag (Art. 28 DSGVO).
+
+    Rendered to PDF by App\Services\Legal\DpaRenderer through TCPDF, so the
+    markup is deliberately plain: headings, paragraphs, lists and simple tables.
+    TCPDF's HTML support is not a browser's — no flexbox, no grid, no custom
+    properties — and anything fancier silently renders as something else.
+
+    The company's own details come from CompanyProfile, so this document and the
+    invoices cannot name the same company differently.
+
+    ## What this text is and is not
+
+    It is a working agreement built from what this installation actually does:
+    the sub-processors are the ones the software really talks to, the measures
+    referenced are the ones in the annex, and the deletion deadlines are the ones
+    the code enforces. It is NOT a lawyer's opinion, and it should be read by one
+    before it is relied on in a dispute — particularly the liability clause and
+    anything a customer negotiates.
+--}}
+@php
+    $c = App\Support\CompanyProfile::all();
+    $seat = trim(($c['postcode'] ?? '').' '.($c['city'] ?? ''));
+
+    // A register number of "FN 000000a" is a placeholder somebody has not
+    // replaced yet, and printing it on a contract is worse than leaving the line
+    // out: it looks like a real number and is not one. Anything whose digits are
+    // all zeros is treated as unfilled.
+    $real = fn (?string $value) => $value !== null && $value !== '' && preg_match('/[1-9]/', $value) === 1;
+@endphp
+
+<h1>Vertrag über die Auftragsverarbeitung</h1>
+<p><i>gemäß Art. 28 der Verordnung (EU) 2016/679 (DSGVO)</i></p>
+
+<p><b>Fassung {{ $version }}</b> · Stand {{ $issuedOn }}</p>
+
+<h2>Die Vertragsparteien</h2>
+
+<p><b>Auftragsverarbeiter</b> (im Folgenden „CluPilot"):<br />
+{{ $c['name'] ?? 'CluPilot Cloud e.U.' }}<br />
+{{ $c['address'] ?? '' }}<br />
+{{ $seat }}, {{ $c['country'] ?? 'Österreich' }}<br />
+@if ($real($c['register_number'] ?? null)){{ $c['register_number'] }}, {{ $c['register_court'] ?? '' }}<br />@endif
+@if ($real($c['vat_id'] ?? null)){{ $c['vat_id'] }}<br />@endif
+{{ $c['email'] ?? '' }}</p>
+
+<p><b>Verantwortlicher</b> (im Folgenden „Kunde"):<br />
+die im Kundenkonto hinterlegten Stammdaten. Der Kunde hält diese Angaben aktuell; sie
+sind Bestandteil dieses Vertrags.</p>
+
+<p>Dieser Vertrag wird elektronisch geschlossen. Art. 28 Abs. 9 DSGVO lässt das
+ausdrücklich zu; eine Unterschrift auf Papier ist nicht erforderlich. CluPilot hält
+Fassung, Zeitpunkt und IP-Adresse des Abschlusses fest und stellt dem Kunden den
+Vertrag im Kundenbereich dauerhaft zum Abruf bereit.</p>
+
+<h2>1. Gegenstand und Dauer</h2>
+
+<p>1.1 CluPilot betreibt für den Kunden eine eigene Nextcloud-Instanz und verarbeitet
+dabei personenbezogene Daten ausschließlich im Auftrag und nach Weisung des Kunden.
+Der Kunde bleibt Verantwortlicher im Sinne von Art. 4 Z 7 DSGVO.</p>
+
+<p>1.2 Dieser Vertrag gilt für die Dauer des Hauptvertrags (Nutzung eines CluPilot-Pakets)
+und endet mit ihm. Regelungen, die ihrer Natur nach fortwirken — insbesondere
+Verschwiegenheit und Löschung —, gelten darüber hinaus.</p>
+
+<h2>2. Art, Zweck und Umfang der Verarbeitung</h2>
+
+<p>2.1 <b>Zweck:</b> Bereitstellung, Betrieb, Wartung und Sicherung einer
+Nextcloud-Installation samt zugehöriger Dienste (Speicherung und Freigabe von Dateien,
+Kalender, Kontakte, sowie die vom Kunden gebuchten Zusatzmodule).</p>
+
+<p>2.2 <b>Art der Verarbeitung:</b> Speichern, Aufbewahren, Sichern, Übermitteln im
+Rahmen des Dienstes, Löschen. Eine inhaltliche Auswertung der Kundendaten findet nicht
+statt.</p>
+
+<p>2.3 <b>Kategorien betroffener Personen:</b> Beschäftigte, Kundinnen und Kunden,
+Mandantinnen und Mandanten, Patientinnen und Patienten, Lieferanten und sonstige
+Kontakte des Kunden — je nachdem, wessen Daten der Kunde in seiner Instanz speichert.</p>
+
+<p>2.4 <b>Kategorien personenbezogener Daten:</b> Stamm- und Kontaktdaten,
+Kommunikationsdaten, Inhalts- und Dokumentendaten, Nutzungs- und Protokolldaten der
+Instanz. Der Kunde entscheidet allein, welche Daten er speichert; besondere Kategorien
+nach Art. 9 DSGVO sind möglich, wenn der Kunde solche Daten einbringt.</p>
+
+<h2>3. Weisungen</h2>
+
+<p>3.1 CluPilot verarbeitet die Daten nur auf dokumentierte Weisung des Kunden. Der
+Hauptvertrag samt Leistungsbeschreibung ist die vollständige Weisung für den
+Regelbetrieb; weitere Weisungen erteilt der Kunde in Textform an
+{{ $c['email'] ?? '' }} oder über den Kundenbereich.</p>
+
+<p>3.2 Hält CluPilot eine Weisung für rechtswidrig, teilt sie dies dem Kunden unverzüglich
+mit und darf die Ausführung bis zur Bestätigung aussetzen (Art. 28 Abs. 3 letzter Satz
+DSGVO).</p>
+
+<p>3.3 Eine Verarbeitung zu eigenen Zwecken findet nicht statt. Davon unberührt bleiben
+Daten, die CluPilot als eigener Verantwortlicher verarbeitet — insbesondere die
+Vertrags- und Rechnungsdaten des Kunden selbst.</p>
+
+<h2>4. Vertraulichkeit</h2>
+
+<p>CluPilot setzt zur Verarbeitung nur Personen ein, die zur Vertraulichkeit verpflichtet
+und über die einschlägigen Bestimmungen des Datenschutzes unterwiesen sind (Art. 28
+Abs. 3 lit. b DSGVO). Die Verpflichtung wirkt über das Ende der Tätigkeit hinaus.</p>
+
+<h2>5. Technische und organisatorische Maßnahmen</h2>
+
+<p>5.1 CluPilot trifft die Maßnahmen nach Art. 32 DSGVO. Sie sind in der <b>Anlage 1
+(TOM)</b> beschrieben, die Bestandteil dieses Vertrags ist.</p>
+
+<p>5.2 Die Maßnahmen unterliegen dem technischen Fortschritt. CluPilot darf sie
+weiterentwickeln, solange das Schutzniveau nicht unterschritten wird; wesentliche
+Änderungen werden dem Kunden mit einer neuen Fassung dieses Vertrags mitgeteilt.</p>
+
+<h2>6. Unterauftragsverarbeiter</h2>
+
+<p>6.1 Der Kunde erteilt die allgemeine Genehmigung zur Beauftragung der nachstehenden
+Unterauftragsverarbeiter (Art. 28 Abs. 4 DSGVO):</p>
+
+<table border="1" cellpadding="4">
+    <tr>
+        <td width="30%"><b>Unternehmen</b></td>
+        <td width="30%"><b>Leistung</b></td>
+        <td width="40%"><b>Ort der Verarbeitung</b></td>
+    </tr>
+    @foreach ($subprocessors as $sub)
+        <tr>
+            <td>{{ $sub['name'] }}</td>
+            <td>{{ $sub['service'] }}</td>
+            <td>{{ $sub['location'] }}</td>
+        </tr>
+    @endforeach
+</table>
+
+<p>6.2 CluPilot informiert den Kunden über die Hinzuziehung oder den Austausch eines
+Unterauftragsverarbeiters mindestens vier Wochen vorher in Textform. Der Kunde kann
+binnen zwei Wochen ab Zugang aus wichtigem, datenschutzbezogenem Grund widersprechen;
+in diesem Fall kann jede Seite den Vertrag zum Wirksamwerden der Änderung kündigen.</p>
+
+<p>6.3 CluPilot verpflichtet jeden Unterauftragsverarbeiter auf Pflichten, die diesem
+Vertrag entsprechen, und haftet für dessen Verhalten wie für eigenes.</p>
+
+<h2>7. Ort der Verarbeitung, Drittländer</h2>
+
+<p>Die Verarbeitung findet ausschließlich in Mitgliedstaaten der Europäischen Union
+statt. Eine Übermittlung in ein Drittland erfolgt nicht; sollte sie künftig
+erforderlich werden, geschieht dies nur unter den Voraussetzungen der Art. 44 ff.
+DSGVO und nach vorheriger Information des Kunden.</p>
+
+<h2>8. Unterstützung des Kunden</h2>
+
+<p>8.1 CluPilot unterstützt den Kunden mit geeigneten Maßnahmen bei der Erfüllung von
+Betroffenenrechten (Art. 12 bis 23 DSGVO). Wendet sich eine betroffene Person direkt an
+CluPilot, wird sie an den Kunden verwiesen und der Kunde unverzüglich verständigt.</p>
+
+<p>8.2 CluPilot unterstützt den Kunden bei den Pflichten nach Art. 32 bis 36 DSGVO,
+insbesondere bei Datenschutz-Folgenabschätzungen und bei Meldungen an die Aufsichtsbehörde.</p>
+
+<p>8.3 <b>Verletzungen des Schutzes personenbezogener Daten</b> meldet CluPilot dem Kunden
+unverzüglich, spätestens innerhalb von 24 Stunden ab Kenntnis, mit den nach Art. 33
+Abs. 3 DSGVO erforderlichen Angaben, soweit sie vorliegen. Die Meldung an die
+Aufsichtsbehörde obliegt dem Kunden.</p>
+
+<h2>9. Nachweise und Kontrollen</h2>
+
+<p>9.1 CluPilot stellt dem Kunden auf Anfrage die zum Nachweis der Einhaltung dieses
+Vertrags erforderlichen Informationen zur Verfügung, insbesondere die jeweils geltende
+Fassung der Anlage 1.</p>
+
+<p>9.2 Der Kunde ist berechtigt, sich von der Einhaltung zu überzeugen. Kontrollen finden
+nach Anmeldung mit angemessener Frist, während der üblichen Geschäftszeiten und ohne
+Störung des Betriebsablaufs statt. CluPilot kann eine Kontrolle durch Vorlage geeigneter
+Nachweise ersetzen, soweit dies zur Überprüfung ausreicht. Der Zutritt zu Räumen Dritter
+richtet sich nach den Regeln des jeweiligen Unterauftragsverarbeiters.</p>
+
+<h2>10. Löschung und Rückgabe</h2>
+
+<p>10.1 Nach Beendigung des Hauptvertrags stellt CluPilot dem Kunden dessen Daten in
+einem gängigen Format zum Abruf bereit. Die Bereitstellung erfolgt zum Ende der bezahlten
+Periode; der Kunde hat ab Bereitstellung <b>30 Tage</b> Zeit, sie abzuholen.</p>
+
+<p>10.2 Nach Ablauf dieser Frist löscht CluPilot die Instanz samt aller darin enthaltenen
+personenbezogenen Daten sowie die zugehörigen Sicherungen. Die Löschung wird dem Kunden
+auf Anfrage bestätigt.</p>
+
+<p>10.3 Von der Löschung ausgenommen sind Daten, für die eine gesetzliche
+Aufbewahrungspflicht besteht — insbesondere Rechnungen und Buchhaltungsunterlagen
+(sieben Jahre, § 132 BAO). Diese Daten verarbeitet CluPilot als eigener Verantwortlicher.</p>
+
+<h2>11. Haftung</h2>
+
+<p>Es gilt Art. 82 DSGVO. Im Übrigen richtet sich die Haftung nach dem Hauptvertrag.</p>
+
+<h2>12. Schlussbestimmungen</h2>
+
+<p>12.1 Änderungen bedürfen der Textform. Widerspricht dieser Vertrag dem Hauptvertrag in
+Fragen des Datenschutzes, geht dieser Vertrag vor.</p>
+
+<p>12.2 Ist eine Bestimmung unwirksam, bleibt der übrige Vertrag gültig.</p>
+
+<p>12.3 Es gilt österreichisches Recht. Gerichtsstand ist, soweit gesetzlich zulässig,
+{{ $c['city'] ?? 'Wien' }}.</p>
+
+<p><b>Anlage 1:</b> Technische und organisatorische Maßnahmen (TOM), Fassung {{ $version }}.</p>
diff --git a/resources/views/legal/dpa/measures.blade.php b/resources/views/legal/dpa/measures.blade.php
new file mode 100644
index 0000000..7ab10ce
--- /dev/null
+++ b/resources/views/legal/dpa/measures.blade.php
@@ -0,0 +1,148 @@
+{{--
+    Anlage 1: Technische und organisatorische Maßnahmen (Art. 32 DSGVO).
+
+    Written from what this installation ACTUALLY does — the backup job as
+    RegisterBackup creates it, the isolation Proxmox gives, the sign-in as
+    Fortify enforces it, the deletion deadlines the two prune commands run. Every
+    sentence here is meant to survive somebody checking it against the machine.
+
+    Where a measure is planned but not in place, it is not written down. A TOM
+    that claims more than the system does is worse than a short one: it is the
+    document an auditor reads before looking.
+--}}
+@php
+    $c = App\Support\CompanyProfile::all();
+@endphp
+
+<h1>Anlage 1 — Technische und organisatorische Maßnahmen</h1>
+<p><i>gemäß Art. 32 DSGVO, Anlage zum Auftragsverarbeitungsvertrag</i></p>
+
+<p><b>Fassung {{ $version }}</b> · Stand {{ $issuedOn }} · {{ $c['name'] ?? 'CluPilot Cloud e.U.' }}</p>
+
+<p>Diese Anlage beschreibt die Maßnahmen, die CluPilot beim Betrieb der
+Kundeninstanzen tatsächlich umsetzt. Sie wird mit jeder Fassung des
+Auftragsverarbeitungsvertrags überprüft und, wo nötig, fortgeschrieben.</p>
+
+<h2>1. Zutrittskontrolle (physisch)</h2>
+
+<p>Die Instanzen laufen ausschließlich in Rechenzentren der in Ziffer 6 des
+Hauptvertrags genannten Unterauftragsverarbeiter innerhalb der Europäischen Union.
+Physischer Zutritt, Videoüberwachung, Zutrittsprotokollierung, Brand- und
+Einbruchschutz sowie unterbrechungsfreie Stromversorgung liegen in deren
+Verantwortung und richten sich nach deren jeweils veröffentlichten Nachweisen
+(u. a. ISO/IEC 27001). CluPilot selbst betreibt keine eigenen Serverräume.</p>
+
+<h2>2. Zugangskontrolle (Systemzugang)</h2>
+
+<ul>
+    <li>Jeder Zugang zum Kundenportal und zur Betreiberkonsole erfordert Benutzername
+        und Passwort. Passwörter werden ausschließlich als Hash gespeichert (bcrypt);
+        die Klartexte sind CluPilot zu keinem Zeitpunkt bekannt.</li>
+    <li>Zwei-Faktor-Authentisierung (TOTP) steht sowohl Kundinnen und Kunden als auch
+        Betreibern zur Verfügung; für Betreiberkonten wird sie eingesetzt.</li>
+    <li>Sicherheitsrelevante Änderungen (Zwei-Faktor abschalten, Schlüssel speichern)
+        verlangen zusätzlich eine erneute Passwortbestätigung innerhalb der laufenden
+        Sitzung.</li>
+    <li>Angemeldete Geräte werden je Konto geführt und können einzeln abgemeldet
+        werden; eine Anmeldung von einem neuen Gerät löst eine Benachrichtigung per
+        E-Mail aus.</li>
+    <li>Die Betreiberkonsole ist über eine eigene Adresse erreichbar und für das
+        öffentliche Internet gesperrt; der Zugang erfolgt über ein privates Netz
+        (WireGuard).</li>
+    <li>Der administrative Zugriff auf die Virtualisierungsplattform erfolgt über
+        API-Token je Host, nicht über gemeinsam genutzte Kennwörter.</li>
+</ul>
+
+<h2>3. Zugriffskontrolle (Berechtigungen)</h2>
+
+<ul>
+    <li>Die Betreiberkonsole kennt abgestufte Rollen (Owner, Admin, Support, Billing,
+        Read-only) mit einzeln vergebenen Berechtigungen; jede Aktion prüft die
+        Berechtigung serverseitig, nicht durch Ausblenden von Bedienelementen.</li>
+    <li>Betreiber- und Kundenkonten sind getrennte Identitäten in getrennten Tabellen
+        mit getrennten Anmeldewegen. Ein Kundenkonto kann keine Betreiberrechte
+        erhalten.</li>
+    <li>CluPilot greift nicht auf Inhalte in Kundeninstanzen zu. Ein Zugriff erfolgt
+        nur, wenn der Kunde im Rahmen einer Supportanfrage darum ersucht, oder wenn
+        eine gesetzliche Verpflichtung besteht.</li>
+    <li>Zugangsdaten und Schlüssel (Zahlungsdienst, DNS, Hosts, Mailkonten) werden
+        verschlüsselt gespeichert; der dafür verwendete Schlüssel ist vom
+        Anwendungsschlüssel getrennt.</li>
+</ul>
+
+<h2>4. Trennungskontrolle (Mandantentrennung)</h2>
+
+<ul>
+    <li>Jede Kundin und jeder Kunde erhält eine <b>eigene virtuelle Maschine</b> mit
+        eigenem Betriebssystem, eigener Datenbank und eigenem Dateisystem. Es gibt
+        keine geteilte Nextcloud-Installation und keine gemeinsame Datenbank für
+        Kundeninhalte.</li>
+    <li>Jede Instanz hat eine eigene Adresse und ein eigenes Zertifikat.</li>
+    <li>Die Verwaltungsdaten von CluPilot (Verträge, Rechnungen, Betriebsdaten) sind
+        von den Kundeninhalten getrennt und liegen nicht in den Kundeninstanzen.</li>
+</ul>
+
+<h2>5. Weitergabekontrolle (Transport und Ablage)</h2>
+
+<ul>
+    <li>Sämtlicher Verkehr zu Kundeninstanzen, Portal und Konsole läuft über HTTPS mit
+        Zertifikaten von Let's Encrypt; unverschlüsselte Verbindungen werden nicht
+        angeboten.</li>
+    <li>E-Mail wird über TLS an den Mailserver übergeben.</li>
+    <li>Administrativer Zugriff auf Hosts erfolgt über SSH beziehungsweise über die
+        API der Virtualisierungsplattform, jeweils verschlüsselt.</li>
+    <li>Zahlungsdaten werden nicht von CluPilot verarbeitet: Karteneingabe und
+        Zahlungsabwicklung finden beim Zahlungsdienstleister statt. CluPilot erfährt
+        nur, dass und in welcher Höhe gezahlt wurde.</li>
+</ul>
+
+<h2>6. Eingabekontrolle (Nachvollziehbarkeit)</h2>
+
+<ul>
+    <li>Jede automatisierte Einrichtung, Änderung und Beendigung einer Instanz wird
+        Schritt für Schritt protokolliert und bleibt in der Konsole einsehbar.</li>
+    <li>Ausgehende E-Mails an Kundinnen und Kunden werden mit Zeitpunkt, Empfänger und
+        Betreff in einem eigenen Register geführt.</li>
+    <li>Wesentliche Vertragsvorgänge (Bestellung, Kündigung samt Grund, Widerruf,
+        Abschluss dieses Vertrags) werden mit Zeitpunkt festgehalten; der Abschluss
+        dieser Vereinbarung zusätzlich mit Fassung und IP-Adresse.</li>
+    <li>Anwendungs- und Systemprotokolle werden auf den Servern geführt.</li>
+</ul>
+
+<h2>7. Verfügbarkeit und Belastbarkeit</h2>
+
+<ul>
+    <li><b>Sicherung:</b> Für jede Instanz wird bei der Einrichtung ein täglicher
+        Sicherungslauf um 02:00 Uhr auf der Virtualisierungsplattform eingerichtet
+        (Snapshot der gesamten Maschine).</li>
+    <li><b>Überwachung:</b> Erreichbarkeit und Zustand der Instanzen und Hosts werden
+        laufend überwacht; Störungen erzeugen Meldungen an den Betrieb.</li>
+    <li><b>Kapazität:</b> Vor jeder Einrichtung wird geprüft, ob auf dem Zielhost
+        ausreichend Speicher und Rechenleistung frei sind; reicht sie nicht, wird die
+        Bestellung vorgemerkt statt einen Host zu überbuchen.</li>
+    <li><b>Aktualisierung:</b> Sicherheits- und Versionsaktualisierungen werden
+        eingespielt; geplante Wartungen werden angekündigt.</li>
+</ul>
+
+<h2>8. Löschung und Aufbewahrung</h2>
+
+<ul>
+    <li>Nach Vertragsende werden die Daten zum Abruf bereitgestellt und nach Ablauf der
+        im Hauptvertrag genannten Frist samt Sicherungen gelöscht.</li>
+    <li>Registrierungen, deren E-Mail-Adresse nie bestätigt wurde, werden nach
+        {{ $unverifiedDays }} Tagen automatisch gelöscht.</li>
+    <li>Bestätigte Konten ohne jemals gebuchtes Paket werden nach einem Jahr gelöscht;
+        die Löschung wird {{ $warnDays }} Tage vorher per E-Mail angekündigt.</li>
+    <li>Rechnungen und Buchhaltungsunterlagen werden sieben Jahre aufbewahrt
+        (§ 132 BAO). Sie enthalten Vertrags-, nicht Inhaltsdaten.</li>
+</ul>
+
+<h2>9. Auftragskontrolle und Überprüfung</h2>
+
+<ul>
+    <li>Unterauftragsverarbeiter werden vertraglich auf ein entsprechendes
+        Schutzniveau verpflichtet; die Liste ist Teil des Hauptvertrags.</li>
+    <li>Diese Maßnahmen werden bei jeder neuen Fassung des
+        Auftragsverarbeitungsvertrags überprüft, mindestens jedoch jährlich.</li>
+    <li>Ansprechstelle für Datenschutzfragen: {{ $c['email'] ?? '' }}</li>
+</ul>
diff --git a/resources/views/legal/terms.blade.php b/resources/views/legal/terms.blade.php
new file mode 100644
index 0000000..0fa6a86
--- /dev/null
+++ b/resources/views/legal/terms.blade.php
@@ -0,0 +1,253 @@
+{{--
+    AGB.
+
+    Written from what this software actually does — the checkout, the withdrawal
+    handling in App\Services\Billing\WithdrawalRight, the capacity queue in
+    App\Provisioning\Steps\Customer\ReserveResources, the two account-deletion
+    sweeps in app/Console/Commands, the cancellation in ConfirmCancelPackage.
+    Nothing here promises anything the code does not do, and no availability
+    figure or liability cap has been invented: where the statute already says it,
+    the statute is referred to rather than restated with numbers nobody checked.
+
+    The company data comes from CompanyProfile so this page and the invoices
+    cannot drift apart. Filling in the real register number in the console fixes
+    it here too.
+
+    This is the operator's text, not a lawyer's opinion. It should be read by one
+    before it is relied on in a dispute.
+--}}
+@php
+    $company = App\Support\CompanyProfile::all();
+    $vat = rtrim(rtrim(number_format(App\Support\CompanyProfile::taxRate(), 1, ',', '.'), '0'), ',');
+    $setup = App\Support\CompanyProfile::setupFeeCents();
+    $unverifiedDays = App\Console\Commands\PruneUnverifiedAccounts::AFTER_DAYS;
+@endphp
+
+<div class="mt-10 space-y-8 rounded-xl border border-line bg-surface p-8 shadow-xs lg:p-10">
+
+    <p class="text-sm text-muted">Fassung vom {{ now()->local()->isoFormat('D. MMMM YYYY') }}</p>
+
+    <section class="space-y-3">
+        <h2 class="text-md font-bold tracking-[-0.01em] text-ink">1. Vertragspartner und Geltungsbereich</h2>
+        <p class="text-md leading-relaxed text-body">
+            Diese Allgemeinen Geschäftsbedingungen gelten für alle Verträge zwischen
+            {{ $company['name'] }}, {{ $company['address'] }}, {{ $company['postcode'] }} {{ $company['city'] }},
+            {{ $company['country'] }} (im Folgenden „CluPilot“) und ihren Kundinnen und Kunden über die
+            Bereitstellung und den Betrieb von Nextcloud-Instanzen und der dazugehörigen Zusatzleistungen.
+            Die vollständigen Unternehmensdaten stehen im <a href="{{ route('legal.impressum') }}" class="font-medium text-accent-text underline-offset-4 hover:underline">Impressum</a>.
+        </p>
+        <p class="text-md leading-relaxed text-body">
+            Abweichende Bedingungen des Kunden werden nicht Vertragsinhalt, auch wenn CluPilot ihnen nicht
+            ausdrücklich widerspricht.
+        </p>
+    </section>
+
+    <section class="space-y-3">
+        <h2 class="text-md font-bold tracking-[-0.01em] text-ink">2. Leistungsgegenstand</h2>
+        <p class="text-md leading-relaxed text-body">
+            CluPilot stellt eine betriebsfertige Nextcloud-Installation auf eigener Infrastruktur bereit und
+            betreibt sie. Welcher Speicherplatz, welches Datenvolumen und wie viele Benutzerkonten enthalten
+            sind, ergibt sich aus dem gebuchten Paket, das dem Kunden bei der Bestellung und im Kundenportal
+            angezeigt wird. Zum Betrieb gehören das Einspielen von Sicherheits- und Versionsaktualisierungen,
+            die Überwachung des Dienstes und die im Paket beschriebenen Sicherungen.
+        </p>
+        <p class="text-md leading-relaxed text-body">
+            Der Standort der Instanz wird bei der Bestellung angezeigt. Ein Anspruch auf einen bestimmten
+            Server besteht nicht; CluPilot darf eine Instanz auf einen anderen Server derselben Region
+            verlegen, wenn der Betrieb dies erfordert.
+        </p>
+    </section>
+
+    <section class="space-y-3">
+        <h2 class="text-md font-bold tracking-[-0.01em] text-ink">3. Zustandekommen des Vertrags</h2>
+        <p class="text-md leading-relaxed text-body">
+            Die Darstellung der Pakete auf der Website ist kein Angebot, sondern eine Einladung zur Bestellung.
+            Bestellt wird ausschließlich im Kundenportal. Der Kunde gibt seine Bestellung ab, indem er diese
+            AGB durch Setzen des Häkchens annimmt und anschließend die Bezahlung abschließt. Ohne diese Annahme
+            kann keine Bestellung abgeschickt werden.
+        </p>
+        <p class="text-md leading-relaxed text-body">
+            Der Vertrag kommt mit dem Eingang der Zahlung zustande. Der Kunde erhält darüber eine Bestätigung
+            per E-Mail; die Rechnung wird gesondert zugestellt und ist im Kundenportal abrufbar.
+        </p>
+    </section>
+
+    <section class="space-y-3">
+        <h2 class="text-md font-bold tracking-[-0.01em] text-ink">4. Preise, Umsatzsteuer und Zahlung</h2>
+        <p class="text-md leading-relaxed text-body">
+            Die im Kundenportal angezeigten Preise für Verbraucher sind Bruttopreise und enthalten
+            {{ $vat }} % Umsatzsteuer. Unternehmerischen Kunden werden die Preise zusätzlich netto ausgewiesen;
+            bei einer gültigen UID aus einem anderen EU-Mitgliedstaat wird die Umsatzsteuer nach dem
+            Reverse-Charge-Verfahren nicht in Rechnung gestellt.
+        </p>
+        <p class="text-md leading-relaxed text-body">
+            Das Entgelt ist monatlich im Voraus fällig und wird über den Zahlungsdienstleister Stripe
+            eingezogen.
+            @if ($setup > 0)
+                Zusätzlich wird eine einmalige Einrichtungsgebühr von
+                {{ Number::currency($setup / 100, in: 'EUR', locale: 'de') }} verrechnet; sie ist bei der
+                ersten Zahlung fällig und wird bei der Bestellung ausgewiesen.
+            @else
+                Eine Einrichtungsgebühr wird derzeit nicht verrechnet. Fällt eine an, wird sie bei der
+                Bestellung ausgewiesen und ist mit der ersten Zahlung fällig.
+            @endif
+        </p>
+        <p class="text-md leading-relaxed text-body">
+            Zusatzleistungen (etwa zusätzlicher Speicher oder eine eigene Domain) werden zum jeweils
+            angezeigten Preis gebucht und ab der nächsten Abrechnungsperiode gemeinsam mit dem Paket
+            verrechnet.
+        </p>
+    </section>
+
+    <section class="space-y-3">
+        <h2 class="text-md font-bold tracking-[-0.01em] text-ink">5. Bereitstellung</h2>
+        <p class="text-md leading-relaxed text-body">
+            Die Einrichtung beginnt unmittelbar nach Eingang der Zahlung und ist üblicherweise innerhalb
+            weniger Minuten abgeschlossen. Der Kunde erhält seine Zugangsdaten per E-Mail, sobald die Instanz
+            bereitsteht. Eine bestimmte Bereitstellungsdauer wird nicht zugesagt.
+        </p>
+        <p class="text-md leading-relaxed text-body">
+            Steht zum Zeitpunkt der Bestellung keine freie Kapazität zur Verfügung, wird die Bestellung
+            vorgemerkt und ausgeliefert, sobald Kapazität geschaffen ist; der Kunde wird darüber informiert.
+            Ist die Bereitstellung binnen 14 Tagen nicht möglich, kann der Kunde vom Vertrag zurücktreten und
+            erhält den gezahlten Betrag zurück.
+        </p>
+    </section>
+
+    <section class="space-y-3">
+        <h2 class="text-md font-bold tracking-[-0.01em] text-ink">6. Widerrufsrecht für Verbraucher</h2>
+        <p class="text-md leading-relaxed text-body">
+            Verbraucher können binnen 14 Tagen ab Vertragsabschluss ohne Angabe von Gründen vom Vertrag
+            zurücktreten. Für die Erklärung genügt eine Mitteilung an
+            <a href="mailto:{{ $company['email'] }}" class="font-medium text-accent-text underline-offset-4 hover:underline">{{ $company['email'] }}</a>;
+            im Kundenportal steht dafür auch eine Schaltfläche bereit.
+        </p>
+        <p class="text-md leading-relaxed text-body">
+            Mit der Annahme dieser AGB bei der Bestellung verlangt der Kunde ausdrücklich, dass CluPilot mit
+            der Leistung schon vor Ablauf dieser Frist beginnt — anders wäre eine sofortige Bereitstellung
+            nicht möglich. Das Widerrufsrecht bleibt davon unberührt: Bei einem Widerruf innerhalb der Frist
+            erhält der Kunde den <strong class="font-semibold text-ink">gesamten gezahlten Betrag</strong>
+            zurück. Ein Wertersatz für die Tage, an denen die Cloud bereits gelaufen ist, wird nicht verlangt,
+            obwohl § 16 FAGG dies zulassen würde. Über den Widerruf wird eine Storno-Rechnung ausgestellt.
+        </p>
+        <p class="text-md leading-relaxed text-body">
+            Unternehmerischen Kunden steht dieses Rücktrittsrecht nicht zu.
+        </p>
+    </section>
+
+    <section class="space-y-3">
+        <h2 class="text-md font-bold tracking-[-0.01em] text-ink">7. Laufzeit und Kündigung</h2>
+        <p class="text-md leading-relaxed text-body">
+            Der Vertrag läuft auf unbestimmte Zeit und kann vom Kunden jederzeit im Kundenportal zum Ende der
+            laufenden Abrechnungsperiode gekündigt werden. Bis dahin bleibt die Cloud vollständig nutzbar. Zum
+            Ende der Periode erhält der Kunde einen Datenexport; danach wird die Instanz abgebaut und die
+            Daten werden gelöscht.
+        </p>
+        <p class="text-md leading-relaxed text-body">
+            CluPilot kann den Vertrag mit einer Frist von drei Monaten zum Monatsende kündigen sowie aus
+            wichtigem Grund mit sofortiger Wirkung, insbesondere bei Zahlungsverzug trotz Mahnung oder bei
+            einem Verstoß gegen Punkt 9.
+        </p>
+    </section>
+
+    <section class="space-y-3">
+        <h2 class="text-md font-bold tracking-[-0.01em] text-ink">8. Kundenkonto und Löschfristen</h2>
+        <p class="text-md leading-relaxed text-body">
+            Ein Konto entsteht mit der Registrierung im Kundenportal und ist erst nach Bestätigung der
+            E-Mail-Adresse nutzbar. CluPilot löscht Konten von selbst, damit keine unbenutzten Daten liegen
+            bleiben:
+        </p>
+        <ul class="ml-5 list-disc space-y-2 text-md leading-relaxed text-body">
+            <li>
+                <strong class="font-semibold text-ink">Nicht bestätigte Registrierungen</strong> werden nach
+                {{ $unverifiedDays }} Tagen gelöscht. Die E-Mail-Adresse ist danach wieder frei.
+            </li>
+            <li>
+                <strong class="font-semibold text-ink">Bestätigte Konten ohne Paket</strong> werden nach einem
+                Jahr gelöscht, wenn zu ihnen nie ein Paket, eine Buchung oder eine Rechnung bestanden hat.
+                CluPilot kündigt das vorher per E-Mail an; eine Anmeldung oder eine Bestellung setzt die Frist
+                zurück.
+            </li>
+        </ul>
+        <p class="text-md leading-relaxed text-body">
+            Ein Konto mit gebuchtem Paket wird nicht automatisch gelöscht. Der Kunde kann sein Konto jederzeit
+            selbst schließen, sobald kein Paket mehr läuft. Rechnungen und Buchhaltungsunterlagen bewahrt
+            CluPilot unabhängig davon sieben Jahre auf — dazu ist sie nach § 132 BAO verpflichtet.
+        </p>
+    </section>
+
+    <section class="space-y-3">
+        <h2 class="text-md font-bold tracking-[-0.01em] text-ink">9. Pflichten des Kunden</h2>
+        <p class="text-md leading-relaxed text-body">
+            Der Kunde bewahrt seine Zugangsdaten sorgfältig auf und ist für die Inhalte verantwortlich, die er
+            und die von ihm angelegten Benutzer in der Cloud speichern. Rechtswidrige Inhalte, das Versenden
+            unerbetener Massen-E-Mails und jede Nutzung, die den Betrieb der Plattform gefährdet, sind
+            untersagt. CluPilot sieht Kundendaten nicht ein, außer der Kunde bittet im Rahmen einer
+            Supportanfrage darum oder eine gesetzliche Verpflichtung besteht.
+        </p>
+    </section>
+
+    <section class="space-y-3">
+        <h2 class="text-md font-bold tracking-[-0.01em] text-ink">10. Verfügbarkeit und Wartung</h2>
+        <p class="text-md leading-relaxed text-body">
+            CluPilot betreibt die Plattform mit der Sorgfalt eines fachkundigen Betreibers, schuldet aber keine
+            bestimmte Verfügbarkeit, solange keine gesonderte Vereinbarung darüber getroffen wurde. Geplante
+            Wartungen werden im Kundenportal und per E-Mail angekündigt und nach Möglichkeit in
+            verkehrsschwache Zeiten gelegt. Sicherheitsaktualisierungen können auch ohne Vorankündigung
+            eingespielt werden, wenn ein Aufschub ein Risiko wäre.
+        </p>
+    </section>
+
+    <section class="space-y-3">
+        <h2 class="text-md font-bold tracking-[-0.01em] text-ink">11. Datenschutz</h2>
+        <p class="text-md leading-relaxed text-body">
+            Welche Daten CluPilot zu welchem Zweck verarbeitet, steht in der
+            <a href="{{ route('legal.datenschutz') }}" class="font-medium text-accent-text underline-offset-4 hover:underline">Datenschutzerklärung</a>.
+            Soweit CluPilot Daten im Auftrag des Kunden verarbeitet, gilt der Vertrag über die
+            Auftragsverarbeitung nach Art. 28 DSGVO in seiner jeweils geltenden Fassung. Er wird mit
+            diesen AGB Bestandteil des Vertrags; einer gesonderten Unterzeichnung bedarf es nicht.
+            Der Vertrag und die Dokumentation der technischen und organisatorischen Maßnahmen stehen
+            im Kundenbereich jederzeit zum Ansehen und Herunterladen bereit. Eine neue Fassung wird
+            dem Kunden mitgeteilt.
+        </p>
+    </section>
+
+    <section class="space-y-3">
+        <h2 class="text-md font-bold tracking-[-0.01em] text-ink">12. Haftung</h2>
+        <p class="text-md leading-relaxed text-body">
+            CluPilot haftet nach den gesetzlichen Bestimmungen. Gegenüber unternehmerischen Kunden ist die
+            Haftung für leichte Fahrlässigkeit ausgeschlossen; die Haftung für Personenschäden sowie für Vorsatz
+            und grobe Fahrlässigkeit bleibt in jedem Fall unberührt. Gegenüber Verbrauchern wird die Haftung
+            nicht eingeschränkt.
+        </p>
+    </section>
+
+    <section class="space-y-3">
+        <h2 class="text-md font-bold tracking-[-0.01em] text-ink">13. Änderungen dieser AGB</h2>
+        <p class="text-md leading-relaxed text-body">
+            CluPilot kann diese AGB ändern und teilt Änderungen mindestens sechs Wochen vor ihrem Wirksamwerden
+            per E-Mail mit. Widerspricht der Kunde nicht bis zum Wirksamwerden, gelten die Änderungen als
+            angenommen; darauf wird in der Mitteilung ausdrücklich hingewiesen. Widerspricht er, kann jede
+            Seite den Vertrag zum Zeitpunkt des Wirksamwerdens kündigen.
+        </p>
+    </section>
+
+    <section class="space-y-3">
+        <h2 class="text-md font-bold tracking-[-0.01em] text-ink">14. Schlussbestimmungen</h2>
+        <p class="text-md leading-relaxed text-body">
+            Es gilt österreichisches Recht. Gegenüber Verbrauchern bleiben zwingende Schutzvorschriften ihres
+            Aufenthaltsstaats unberührt, und es gilt der gesetzliche Gerichtsstand. Gegenüber unternehmerischen
+            Kunden ist das für {{ $company['city'] }} sachlich zuständige Gericht zuständig. Sollte eine
+            Bestimmung unwirksam sein, bleibt der Vertrag im Übrigen gültig.
+        </p>
+        <p class="text-md leading-relaxed text-body">
+            Fragen dazu jederzeit an
+            <a href="mailto:{{ $company['email'] }}" class="font-medium text-accent-text underline-offset-4 hover:underline">{{ $company['email'] }}</a>.
+        </p>
+    </section>
+
+    <x-ui.button href="{{ route('home') }}" variant="secondary">
+        <x-ui.icon name="arrow-left" class="size-4" />
+        Zurück zur Startseite
+    </x-ui.button>
+</div>
diff --git a/resources/views/livewire/admin/confirm-publish-dpa.blade.php b/resources/views/livewire/admin/confirm-publish-dpa.blade.php
new file mode 100644
index 0000000..79e75e0
--- /dev/null
+++ b/resources/views/livewire/admin/confirm-publish-dpa.blade.php
@@ -0,0 +1,15 @@
+<div class="rounded-lg bg-surface p-6">
+    <div class="flex items-start gap-3">
+        <span class="grid size-10 shrink-0 place-items-center rounded-lg bg-warning-bg text-warning">
+            <x-ui.icon name="alert-triangle" class="size-5" />
+        </span>
+        <div class="min-w-0">
+            <h3 class="text-base font-semibold text-ink">{{ __('dpa_admin.publish_title', ['version' => $version]) }}</h3>
+            <p class="mt-1 text-sm text-muted">{{ __('dpa_admin.publish_body') }}</p>
+        </div>
+    </div>
+    <div class="mt-6 flex justify-end gap-3">
+        <x-ui.button variant="secondary" x-on:click="Livewire.dispatch('closeModal')">{{ __('common.cancel') }}</x-ui.button>
+        <x-ui.button variant="primary" wire:click="confirm" wire:loading.attr="disabled">{{ __('dpa_admin.publish') }}</x-ui.button>
+    </div>
+</div>
diff --git a/resources/views/livewire/admin/edit-customer.blade.php b/resources/views/livewire/admin/edit-customer.blade.php
index 433b065..0934a5a 100644
--- a/resources/views/livewire/admin/edit-customer.blade.php
+++ b/resources/views/livewire/admin/edit-customer.blade.php
@@ -42,10 +42,15 @@
         </div>
 
         <div>
-            <label for="billingAddress" class="block text-sm font-medium text-body">{{ __('edit_customer.address') }}</label>
-            <textarea id="billingAddress" rows="4" wire:model="billingAddress"
-                      class="mt-1.5 block w-full rounded border border-line bg-surface px-3.5 py-2.5 text-sm text-ink"></textarea>
-            @error('billingAddress')<p class="mt-1.5 text-xs text-danger">{{ $message }}</p>@enderror
+            <p class="block text-sm font-medium text-body">{{ __('edit_customer.address') }}</p>
+            <div class="mt-1.5 space-y-3">
+                <x-ui.input name="billingStreet" wire:model="billingStreet" :label="__('settings.billing_street')" />
+                <div class="grid gap-3 sm:grid-cols-[140px_minmax(0,1fr)]">
+                    <x-ui.input name="billingPostcode" wire:model="billingPostcode" :label="__('settings.billing_postcode')" />
+                    <x-ui.input name="billingCity" wire:model="billingCity" :label="__('settings.billing_city')" />
+                </div>
+                <x-ui.input name="billingCountry" wire:model="billingCountry" :label="__('settings.billing_country')" />
+            </div>
         </div>
 
         <div class="max-w-56">
diff --git a/resources/views/livewire/admin/inbox.blade.php b/resources/views/livewire/admin/inbox.blade.php
index ea57daf..b5ca7fd 100644
--- a/resources/views/livewire/admin/inbox.blade.php
+++ b/resources/views/livewire/admin/inbox.blade.php
@@ -24,6 +24,31 @@
         </x-ui.alert>
     @endif
 
+    {{-- When the mailbox was last reached. Shown whether or not anything came of
+         it: an empty inbox and a mailbox that stopped answering look exactly the
+         same, and the difference is this line. --}}
+    @if ($configured)
+        <p @class([
+            'flex flex-wrap items-center gap-1.5 text-xs',
+            'text-muted' => $status === null || $status['ok'],
+            'text-danger' => $status !== null && ! $status['ok'],
+        ])>
+            @if ($status === null)
+                {{ __('inbox.never_checked') }}
+            @else
+                <x-ui.icon :name="$status['ok'] ? 'check' : 'alert-triangle'" class="size-3.5" />
+                {{-- R19: stored in UTC, read on the wall clock. --}}
+                {{ __($status['ok'] ? 'inbox.last_ok' : 'inbox.last_failed', [
+                    'when' => $status['at']->local()->isoFormat('D. MMM YYYY, HH:mm'),
+                    'ago' => $status['at']->diffForHumans(),
+                ]) }}
+                @if (! $status['ok'])
+                    <a href="{{ route('admin.integrations') }}" class="font-semibold underline">{{ __('inbox.to_integrations') }}</a>
+                @endif
+            @endif
+        </p>
+    @endif
+
     @if ($mails->isEmpty())
         <div class="rounded-lg border border-line bg-surface p-10 text-center shadow-xs animate-rise">
             <p class="text-sm text-muted">{{ $archived ? __('inbox.empty_archived') : __('inbox.empty') }}</p>
diff --git a/resources/views/livewire/admin/integrations.blade.php b/resources/views/livewire/admin/integrations.blade.php
index 04b335d..b3b8b36 100644
--- a/resources/views/livewire/admin/integrations.blade.php
+++ b/resources/views/livewire/admin/integrations.blade.php
@@ -155,6 +155,35 @@
                 @if ($canInfra)<hr class="border-line" />@endif
                 <x-admin.secret-field :entry="$entries['inbound_mail.password']" :unlocked="$unlocked" :mode="$mode" />
             @endif
+
+            {{-- The one thing an operator wants after typing all of it: did any
+                 of it work. The button saves first, because testing what is on
+                 screen while the server still holds the old values would report
+                 on a mailbox nobody configured. --}}
+            @if ($canInfra)
+                <div class="flex flex-wrap items-center gap-3 border-t border-line pt-4">
+                    <x-ui.button wire:click="testInbound" variant="secondary" size="sm"
+                                 wire:loading.attr="disabled" wire:target="testInbound">
+                        <x-ui.icon name="plug" class="size-4" />{{ __('integrations.inbound_test') }}
+                    </x-ui.button>
+
+                    {{-- Always said, including "never": a line that appears only
+                         after a success leaves an operator unable to tell a
+                         mailbox that has not been checked from one that is fine.
+                         R19: stored in UTC, read on the wall clock. --}}
+                    @if ($inboundStatus === null)
+                        <p class="text-xs text-muted">{{ __('integrations.inbound_never') }}</p>
+                    @else
+                        <p @class(['flex items-center gap-1.5 text-xs', 'text-success' => $inboundStatus['ok'], 'text-danger' => ! $inboundStatus['ok']])>
+                            <x-ui.icon :name="$inboundStatus['ok'] ? 'check' : 'alert-triangle'" class="size-3.5" />
+                            {{ __($inboundStatus['ok'] ? 'integrations.inbound_last_ok' : 'integrations.inbound_last_failed', [
+                                'when' => $inboundStatus['at']->local()->isoFormat('D. MMM YYYY, HH:mm'),
+                                'ago' => $inboundStatus['at']->diffForHumans(),
+                            ]) }}
+                        </p>
+                    @endif
+                </div>
+            @endif
         </div>
     @endif
 
diff --git a/resources/views/livewire/admin/mail-preview.blade.php b/resources/views/livewire/admin/mail-preview.blade.php
new file mode 100644
index 0000000..bea833d
--- /dev/null
+++ b/resources/views/livewire/admin/mail-preview.blade.php
@@ -0,0 +1,52 @@
+<div class="mx-auto max-w-[1120px] space-y-5">
+    <div class="animate-rise">
+        <h1 class="text-2xl font-bold tracking-tight text-ink">{{ __('mail_preview.title') }}</h1>
+        <p class="mt-1 max-w-[70ch] text-sm leading-relaxed text-muted">{{ __('mail_preview.subtitle') }}</p>
+    </div>
+
+    {{-- A preview that goes nowhere is worse than none: the browser view still
+         works, and "senden" would write to a file and report success. --}}
+    @if (! $delivers)
+        <x-ui.alert variant="warning">
+            {{ __('admin.notice.mail_not_delivering', ['mailer' => (string) (config('mail.default') ?? 'null')]) }}
+        </x-ui.alert>
+    @endif
+
+    <div class="overflow-hidden rounded-lg border border-line bg-surface shadow-xs animate-rise [animation-delay:60ms]">
+        <ul class="divide-y divide-line">
+            @foreach ($previews as $key => $label)
+                <li wire:key="prev-{{ $key }}" class="flex flex-wrap items-center gap-3 px-6 py-4">
+                    <div class="min-w-0 flex-1">
+                        <p class="text-sm font-medium text-ink">{{ $label }}</p>
+                        {{-- Which mailbox it goes out from, because that is the
+                             field a mail server checks: an account may only send
+                             from the address it owns, and a mismatch here is the
+                             "553 Sender address rejected" that has no other
+                             visible cause. --}}
+                        <p class="font-mono text-xs text-muted">
+                            {{ $key }}
+                            @if ($senders[$key] ?? null)
+                                · {{ $senders[$key] }}
+                            @endif
+                        </p>
+                    </div>
+
+                    {{-- A new tab, not an iframe: a mail is a whole document with
+                         its own background, and judging it inside a console page
+                         judges the console's frame around it. --}}
+                    <x-ui.button :href="route('admin.mail.preview.show', $key)" variant="secondary" size="sm" target="_blank">
+                        <x-ui.icon name="external-link" class="size-4" />{{ __('mail_preview.open') }}
+                    </x-ui.button>
+
+                    <x-ui.button wire:click="sendToMe('{{ $key }}')" variant="primary" size="sm"
+                                 wire:loading.attr="disabled" wire:target="sendToMe('{{ $key }}')"
+                                 :disabled="! $delivers">
+                        <x-ui.icon name="send" class="size-4" />{{ __('mail_preview.send') }}
+                    </x-ui.button>
+                </li>
+            @endforeach
+        </ul>
+    </div>
+
+    <p class="text-xs leading-relaxed text-muted">{{ __('mail_preview.note', ['email' => $me]) }}</p>
+</div>
diff --git a/resources/views/livewire/admin/mail.blade.php b/resources/views/livewire/admin/mail.blade.php
index 3b00c8e..e491f38 100644
--- a/resources/views/livewire/admin/mail.blade.php
+++ b/resources/views/livewire/admin/mail.blade.php
@@ -4,6 +4,19 @@
         <p class="mt-1 text-sm text-muted">{{ __('mail_settings.subtitle') }}</p>
     </div>
 
+    {{-- The one thing that makes every mailbox on this page decorative. Said
+         here as well as on the front page, because this is where somebody comes
+         to find out why no mail arrived — and the test button below reports
+         success regardless, since MailboxTester builds its own transport on
+         purpose (a check that honoured MAIL_MAILER=log would report success
+         while writing to a file). --}}
+    @if (in_array(config('mail.default'), ['log', 'array', null], true))
+        <x-ui.alert variant="warning">
+            {{ __('admin.notice.mail_not_delivering', ['mailer' => (string) (config('mail.default') ?? 'null')]) }}
+        </x-ui.alert>
+    @endif
+
+
     @if (! $usable)
         <x-ui.alert variant="warning">{{ __('mail_settings.no_key') }}</x-ui.alert>
     @endif
diff --git a/resources/views/livewire/admin/plan-versions.blade.php b/resources/views/livewire/admin/plan-versions.blade.php
index 5676b30..59067a8 100644
--- a/resources/views/livewire/admin/plan-versions.blade.php
+++ b/resources/views/livewire/admin/plan-versions.blade.php
@@ -201,10 +201,30 @@
 
                 <p class="pt-1 text-xs font-semibold text-muted">{{ __('plans.pricing') }}</p>
                 <div class="grid grid-cols-2 gap-3">
-                    <x-ui.input name="monthlyPrice" inputmode="decimal" :label="__('plans.term_monthly')" :hint="__('plans.euro_hint')" wire:model="monthlyPrice" />
-                    <x-ui.input name="yearlyPrice" inputmode="decimal" :label="__('plans.term_yearly')" :hint="__('plans.euro_hint')" wire:model="yearlyPrice" />
+                    <x-ui.input name="monthlyPrice" inputmode="decimal" :label="__('plans.term_monthly')" :hint="__('plans.euro_hint')"
+                                wire:model.live.debounce.500ms="monthlyPrice" />
+                    {{-- Free months, not a second price. The yearly total is
+                         derived from the two, which is the only arrangement in
+                         which "2 Monate gratis" on the website and the amount
+                         Stripe charges cannot drift apart. --}}
+                    <x-ui.input name="freeMonths" type="number" min="0" max="6" :label="__('plans.free_months')"
+                                :hint="__('plans.free_months_hint')" wire:model.live="freeMonths" />
                 </div>
 
+                {{-- What that comes to, before it is written. Live, from the same
+                     arithmetic the draft uses. --}}
+                @if ($yearlyPreview !== null)
+                    <p class="text-xs text-muted">
+                        {{ __('plans.yearly_preview', [
+                            'total' => $eur($yearlyPreview),
+                            'months' => 12 - max(0, min(12, $freeMonths)),
+                        ]) }}
+                        @if ($freeMonths > 0)
+                            · {{ trans_choice('plans.free_months_note', $freeMonths, ['count' => $freeMonths]) }}
+                        @endif
+                    </p>
+                @endif
+
                 <p class="pt-1 text-xs font-semibold text-muted">{{ __('plans.features') }}</p>
                 <div class="space-y-2">
                     @foreach ($featureKeys as $key)
diff --git a/resources/views/livewire/admin/processing-agreements.blade.php b/resources/views/livewire/admin/processing-agreements.blade.php
new file mode 100644
index 0000000..ce81e8a
--- /dev/null
+++ b/resources/views/livewire/admin/processing-agreements.blade.php
@@ -0,0 +1,159 @@
+{{--
+    The processing agreement, in the console.
+
+    Upload left, what is in force and who has it right, the versions underneath.
+    Uploading and publishing are two acts on purpose: publishing leaves every
+    customer outstanding again, and that is not something to trigger by dropping
+    a file on a form.
+--}}
+<div class="space-y-6">
+
+    <header class="animate-rise">
+        <p class="lbl">{{ __('dpa_admin.eyebrow') }}</p>
+        <h1 class="mt-[7px] text-[23px] font-bold leading-[1.12] tracking-[-0.03em] text-ink min-[901px]:text-[30px]">
+            {{ __('dpa_admin.title') }}
+        </h1>
+        <p class="mt-2 max-w-[76ch] text-sm leading-relaxed text-muted">{{ __('dpa_admin.subtitle') }}</p>
+    </header>
+
+    <div class="grid gap-5 lg:grid-cols-[minmax(0,1fr)_360px] lg:items-start">
+
+        {{-- ── Upload ─────────────────────────────────────────────────────── --}}
+        <form wire:submit="upload" class="space-y-5 rounded-lg border border-line bg-surface p-6 shadow-xs animate-rise [animation-delay:40ms]">
+            <div>
+                <h2 class="text-sm font-bold text-ink">{{ __('dpa_admin.upload_title') }}</h2>
+                <p class="mt-1 text-sm leading-relaxed text-muted">{{ __('dpa_admin.upload_sub') }}</p>
+            </div>
+
+            <div class="grid gap-4 sm:grid-cols-2">
+                <x-ui.input name="version" wire:model="version" :label="__('dpa_admin.version')" :hint="__('dpa_admin.version_hint')" />
+                <x-ui.input name="note" wire:model="note" :label="__('dpa_admin.note')" :hint="__('dpa_admin.note_hint')" />
+            </div>
+
+            <div class="grid gap-4 sm:grid-cols-2">
+                <div>
+                    <label class="text-sm font-medium text-body">{{ __('dpa_admin.file_agreement') }}</label>
+                    <input type="file" wire:model="agreement" accept="application/pdf"
+                           class="mt-1.5 w-full text-sm text-body file:mr-3 file:rounded file:border-0 file:bg-surface-2 file:px-3 file:py-1.5 file:text-sm file:font-semibold file:text-body" />
+                    @error('agreement')<p class="mt-1 text-xs text-danger">{{ $message }}</p>@enderror
+                </div>
+                <div>
+                    <label class="text-sm font-medium text-body">{{ __('dpa_admin.file_measures') }}</label>
+                    <input type="file" wire:model="measures" accept="application/pdf"
+                           class="mt-1.5 w-full text-sm text-body file:mr-3 file:rounded file:border-0 file:bg-surface-2 file:px-3 file:py-1.5 file:text-sm file:font-semibold file:text-body" />
+                    @error('measures')<p class="mt-1 text-xs text-danger">{{ $message }}</p>@enderror
+                </div>
+            </div>
+
+            <div class="flex justify-end border-t border-line pt-4">
+                <x-ui.button type="submit" variant="primary" wire:loading.attr="disabled" wire:target="upload,agreement,measures">
+                    {{ __('dpa_admin.upload_cta') }}
+                </x-ui.button>
+            </div>
+        </form>
+
+        {{-- ── What is in force ───────────────────────────────────────────── --}}
+        <div class="space-y-4 rounded-lg border border-line bg-surface p-6 shadow-xs animate-rise [animation-delay:80ms]">
+            <h2 class="text-sm font-bold text-ink">{{ __('dpa_admin.current_title') }}</h2>
+
+            @if ($current === null)
+                <p class="text-sm leading-relaxed text-muted">{{ __('dpa_admin.none_yet') }}</p>
+            @else
+                <p class="font-mono text-lg font-semibold text-ink">{{ $current->version }}</p>
+                {{-- R19: stored in UTC, read on the wall clock. --}}
+                <p class="text-xs text-muted">{{ __('dpa_admin.in_force_since', ['when' => $current->published_at->local()->isoFormat('LL')]) }}</p>
+
+                <div class="border-t border-line pt-4">
+                    <p class="text-sm text-body">
+                        {{ __('dpa_admin.accepted_count', ['accepted' => $accepted, 'total' => $customers]) }}
+                    </p>
+                    @if ($outstanding > 0)
+                        <p class="mt-1 text-sm font-semibold text-warning">{{ __('dpa_admin.outstanding', ['count' => $outstanding]) }}</p>
+                    @endif
+                </div>
+            @endif
+        </div>
+    </div>
+
+    {{-- ── The versions ───────────────────────────────────────────────────── --}}
+    <div class="overflow-hidden rounded-lg border border-line bg-surface shadow-xs animate-rise [animation-delay:120ms]">
+        <div class="border-b border-line px-6 py-4">
+            <h2 class="text-sm font-bold text-ink">{{ __('dpa_admin.versions_title') }}</h2>
+        </div>
+
+        @if ($versions->isEmpty())
+            <p class="px-6 py-10 text-center text-sm text-muted">{{ __('dpa_admin.no_versions') }}</p>
+        @else
+            <div class="overflow-x-auto">
+                <table class="w-full text-sm">
+                    <thead>
+                        <tr class="border-b border-line text-left">
+                            <th class="px-6 py-3 font-medium text-muted">{{ __('dpa_admin.col_version') }}</th>
+                            <th class="px-6 py-3 font-medium text-muted">{{ __('dpa_admin.col_state') }}</th>
+                            <th class="px-6 py-3 font-medium text-muted">{{ __('dpa_admin.col_accepted') }}</th>
+                            <th class="px-6 py-3 font-medium text-muted">{{ __('dpa_admin.col_files') }}</th>
+                            <th class="px-6 py-3"></th>
+                        </tr>
+                    </thead>
+                    <tbody>
+                        @foreach ($versions as $v)
+                            <tr wire:key="dpa-{{ $v->uuid }}" class="border-b border-line last:border-0">
+                                <td class="px-6 py-3">
+                                    <span class="font-mono font-semibold text-ink">{{ $v->version }}</span>
+                                    @if ($v->note)
+                                        <span class="mt-0.5 block text-xs text-muted">{{ $v->note }}</span>
+                                    @endif
+                                </td>
+                                <td class="px-6 py-3">
+                                    @if ($v->isPublished())
+                                        <x-ui.badge status="{{ $current?->id === $v->id ? 'success' : 'neutral' }}">
+                                            {{ $current?->id === $v->id ? __('dpa_admin.state_current') : __('dpa_admin.state_superseded') }}
+                                        </x-ui.badge>
+                                        <span class="mt-0.5 block text-xs text-muted">{{ $v->published_at->local()->isoFormat('LL') }}</span>
+                                    @else
+                                        <x-ui.badge status="warning">{{ __('dpa_admin.state_draft') }}</x-ui.badge>
+                                    @endif
+                                </td>
+                                <td class="px-6 py-3 font-mono tabular-nums text-body">{{ $v->acceptances_count }}</td>
+                                <td class="px-6 py-3">
+                                    <div class="flex flex-wrap gap-2">
+                                        <a href="{{ route('admin.dpa.file', ['uuid' => $v->uuid, 'which' => 'agreement']) }}"
+                                           target="_blank" rel="noopener"
+                                           class="text-xs font-semibold text-accent-text underline-offset-4 hover:underline">
+                                            {{ __('dpa_admin.file_agreement') }}
+                                        </a>
+                                        @if ($v->measures_path)
+                                            <a href="{{ route('admin.dpa.file', ['uuid' => $v->uuid, 'which' => 'measures']) }}"
+                                               target="_blank" rel="noopener"
+                                               class="text-xs font-semibold text-accent-text underline-offset-4 hover:underline">
+                                                {{ __('dpa_admin.file_measures') }}
+                                            </a>
+                                        @endif
+                                        {{-- A download, so it says so and looks like
+                                             a control rather than a third link in
+                                             a row of two. --}}
+                                        <a href="{{ route('admin.dpa.file', ['uuid' => $v->uuid, 'which' => 'agreement', 'download' => 1]) }}"
+                                           download
+                                           class="inline-flex items-center gap-1 rounded border border-line-strong bg-surface px-2 py-0.5 text-xs font-semibold text-body hover:bg-surface-hover">
+                                            <x-ui.icon name="download" class="size-3.5" />{{ __('dpa_admin.download') }}
+                                        </a>
+                                    </div>
+                                </td>
+                                <td class="px-6 py-3 text-right">
+                                    @if (! $v->isPublished())
+                                        {{-- R23: a modal, because publishing leaves every
+                                             customer outstanding again. --}}
+                                        <x-ui.button size="sm" variant="secondary"
+                                                     x-on:click="$dispatch('openModal', { component: 'admin.confirm-publish-dpa', arguments: { uuid: '{{ $v->uuid }}' } })">
+                                            {{ __('dpa_admin.publish') }}
+                                        </x-ui.button>
+                                    @endif
+                                </td>
+                            </tr>
+                        @endforeach
+                    </tbody>
+                </table>
+            </div>
+        @endif
+    </div>
+</div>
diff --git a/resources/views/livewire/auth/verify-email.blade.php b/resources/views/livewire/auth/verify-email.blade.php
index 5fee4e4..1a43c73 100644
--- a/resources/views/livewire/auth/verify-email.blade.php
+++ b/resources/views/livewire/auth/verify-email.blade.php
@@ -13,11 +13,22 @@
                 <x-ui.icon name="refresh" class="size-4" />
                 {{ __('verify_email.notice_resend') }}
             </x-ui.button>
-            <x-ui.button variant="secondary" wire:click="signOut" wire:loading.attr="disabled" wire:target="signOut">
-                {{ __('verify_email.notice_signout') }}
+            {{-- R23: confirmed in a modal. Deleting an account is not a thing
+                 to do on one click, even an account that is five minutes old. --}}
+            <x-ui.button variant="secondary"
+                         x-on:click="$dispatch('openModal', { component: 'confirm-delete-own-account' })">
+                {{ __('verify_email.notice_delete') }}
             </x-ui.button>
         </div>
 
+        {{-- Said here, not only in the mail: somebody who never got the mail is
+             looking at THIS page, and the deadline is the reason they do not
+             have to do anything about an attempt they abandon. --}}
+        {{-- Both deadlines, because reading only the first one ("deleted after
+             five days") leaves somebody thinking a confirmed account goes the
+             same way. It does not: the five days are about a registration nobody
+             confirmed. --}}
         <p class="mt-5 border-t border-line pt-4 text-xs text-muted">{{ __('verify_email.notice_wrong_address') }}</p>
+        <p class="mt-2 text-xs text-muted">{{ __('verify_email.notice_after_confirm') }}</p>
     </div>
 </div>
diff --git a/resources/views/livewire/billing.blade.php b/resources/views/livewire/billing.blade.php
index 15be227..894e5db 100644
--- a/resources/views/livewire/billing.blade.php
+++ b/resources/views/livewire/billing.blade.php
@@ -9,11 +9,34 @@
 
     {{-- purchase() refuses before touching anything when the active mode has
          no Stripe key — a sentence here, not a 500 page, and not a cart entry
-         nobody can ever pay for. --}}
+         nobody can ever pay for.
+
+         OUTSIDE the contract branch below on purpose: the customer most likely
+         to meet this is the one buying for the FIRST time, who has no contract
+         yet. Inside the @else it would be invisible to exactly them. --}}
     @error('purchase')
         <x-ui.alert variant="danger">{{ $message }}</x-ui.alert>
     @enderror
 
+    {{-- Nothing booked. Said plainly instead of falling back to the first plan
+         and rendering it as "AKTUELLES PAKET — Status Aktiv": that is a contract
+         nobody entered into, on the page a customer opens to find out what they
+         pay, and the dashboard said the opposite about the same account.
+
+         Everything below needs a contract to mean anything — an "Upgrade" from
+         nothing is a purchase, and that has its own page. --}}
+    @if (! $hasContract)
+        <div class="rounded-lg border border-line bg-surface p-8 shadow-xs animate-rise [animation-delay:60ms]">
+            <h2 class="text-lg font-semibold text-ink">{{ __('billing.none_title') }}</h2>
+            <p class="mt-2 max-w-[70ch] text-sm leading-relaxed text-muted">{{ __('billing.none_body') }}</p>
+
+            <div class="mt-6 flex flex-wrap gap-2.5">
+                <x-ui.button variant="ink" :href="route('order')" wire:navigate>{{ __('billing.none_cta') }}</x-ui.button>
+                <x-ui.button variant="secondary" :href="route('support')" wire:navigate>{{ __('dashboard.nav.support') }}</x-ui.button>
+            </div>
+        </div>
+    @else
+
     {{-- Current plan --}}
     <div class="overflow-hidden rounded-lg border border-line bg-surface shadow-xs animate-rise [animation-delay:60ms]">
         <div class="flex flex-wrap items-center justify-between gap-4 border-b border-line bg-surface-2 px-6 py-4">
@@ -29,6 +52,19 @@
                 @else
                     <p class="text-2xl font-semibold text-ink">{{ $eur($current['price_cents'] ?? 0) }}</p>
                     <p class="text-xs text-muted">{{ __('billing.net_per_month') }}</p>
+                    {{-- A yearly contract is charged once a year; the figure
+                         above is per month whatever the term, so without this
+                         line a yearly customer read a number that never appears
+                         on a statement. --}}
+                    @if (($current['term'] ?? null) === App\Models\Subscription::TERM_YEARLY)
+                        <p class="mt-1 text-xs font-medium text-body">
+                            {{ __('billing.term_yearly_note', ['total' => $eur($current['term_total_cents'] ?? 0)]) }}
+                            @if ($current['renews_at'] ?? null)
+                                {{-- R19: stored in UTC, read on the wall clock. --}}
+                                · {{ __('billing.renews_at', ['date' => $current['renews_at']->local()->isoFormat('D. MMM YYYY')]) }}
+                            @endif
+                        </p>
+                    @endif
                     @if ($totalMonthlyCents !== null && $totalMonthlyCents !== ($current['price_cents'] ?? 0))
                         {{-- The plan alone is not the bill once modules are booked,
                              and every part of it is frozen at what was agreed. --}}
@@ -86,9 +122,14 @@
             </div>
         @endif
     </div>
+    @endif
 
     {{-- Cart: "5 purchases pending" told nobody what they had ordered, and
-         offered no way to change their mind. --}}
+         offered no way to change their mind.
+
+         Outside the contract gate on purpose: a customer can have something in
+         their cart before they have any contract at all, and hiding it there
+         would hide the thing they came to pay for. --}}
     @if ($pending->isNotEmpty())
         <div class="overflow-hidden rounded-lg border border-info-border bg-surface shadow-xs animate-rise">
             <div class="flex items-center gap-2 border-b border-line bg-info-bg px-5 py-3">
@@ -157,6 +198,8 @@
         </div>
     @endif
 
+    @if ($hasContract)
+
     {{-- Upgrades --}}
     @if (count($upgrades) > 0)
         <div class="animate-rise [animation-delay:120ms]">
@@ -442,5 +485,7 @@
         @endforeach
     </div>
 
+    @endif
+
     <p class="text-xs text-muted">{{ __('billing.mock_note') }}</p>
 </div>
diff --git a/resources/views/livewire/checkout.blade.php b/resources/views/livewire/checkout.blade.php
new file mode 100644
index 0000000..ea2ae43
--- /dev/null
+++ b/resources/views/livewire/checkout.blade.php
@@ -0,0 +1,222 @@
+{{--
+    The order, before it is placed.
+
+    Two columns, and which is which matters: the LEFT one is what you are buying
+    and what will happen, the RIGHT one is what it costs and the button that
+    spends the money. The summary sticks, so on a long left column the total and
+    the button stay in view — the shape every enterprise checkout has, for the
+    reason that the figure you are agreeing to should never be scrolled away from
+    the agreement.
+
+    The terms acceptance sits at the BOTTOM of the right column, immediately
+    above that button. It used to be at the top of the package list, as a
+    condition of looking at prices; it is a condition of buying, and this is the
+    moment of buying.
+--}}
+@php
+    use Illuminate\Support\Number;
+
+    $eur = fn (int $cents) => Number::currency($cents / 100, in: $lines['currency'] ?? 'EUR', locale: app()->getLocale());
+@endphp
+
+<div class="space-y-6">
+
+    <header class="flex flex-wrap items-end gap-x-6 gap-y-4 border-b border-line pb-5 animate-rise">
+        <div class="min-w-0 flex-1">
+            <p class="lbl">{{ __('checkout.eyebrow') }}</p>
+            <h1 class="mt-[7px] text-[23px] font-bold leading-[1.12] tracking-[-0.03em] text-ink min-[901px]:text-[30px]">
+                {{ __('checkout.title') }}
+            </h1>
+        </div>
+        <a href="{{ route('order') }}" wire:navigate
+           class="inline-flex items-center gap-2 text-sm font-semibold text-muted transition-colors hover:text-ink">
+            <x-ui.icon name="arrow-left" class="size-4" />{{ __('checkout.back_to_plans') }}
+        </a>
+    </header>
+
+    @if ($contract)
+        <x-ui.alert variant="info">
+            {{ __('order.already_customer') }}
+            <a href="{{ route('billing') }}" class="font-semibold underline">{{ __('order.to_billing') }}</a>
+        </x-ui.alert>
+    @elseif ($package === null)
+        {{-- A package key nobody knows. Reached from a retyped address or from a
+             package taken off sale between the two pages. --}}
+        <x-ui.alert variant="warning">
+            {{ __('checkout.unknown_plan') }}
+            <a href="{{ route('order') }}" class="font-semibold underline">{{ __('checkout.back_to_plans') }}</a>
+        </x-ui.alert>
+    @else
+        @error('plan')<x-ui.alert variant="error">{{ $message }}</x-ui.alert>@enderror
+        @error('term')<x-ui.alert variant="error">{{ $message }}</x-ui.alert>@enderror
+        @error('terms_accepted')<x-ui.alert variant="error">{{ $message }}</x-ui.alert>@enderror
+        @error('checkout')<x-ui.alert variant="error">{{ $message }}</x-ui.alert>@enderror
+
+        <div class="grid gap-5 lg:grid-cols-[minmax(0,1fr)_400px] lg:items-start">
+
+            {{-- ── What you are buying ──────────────────────────────────────── --}}
+            <div class="space-y-5">
+                <section class="overflow-hidden rounded-lg border border-line bg-surface shadow-xs animate-rise">
+                    <div class="flex flex-wrap items-baseline gap-x-3 gap-y-1 border-b border-line px-6 py-4">
+                        <h2 class="text-md font-bold tracking-[-0.01em] text-ink">{{ $package['name'] }}</h2>
+                        <span class="rounded-pill border border-line bg-surface-2 px-2.5 py-0.5 text-xs font-semibold text-body">
+                            {{ __('order.term_'.$term) }}
+                        </span>
+                        @if ($package['audience'] ?? '')
+                            <span class="text-sm text-muted">{{ $package['audience'] }}</span>
+                        @endif
+                    </div>
+
+                    <dl class="grid grid-cols-2 gap-px bg-line sm:grid-cols-4">
+                        @foreach ([
+                            __('order.storage') => $package['quota_gb'] >= 1000 ? ($package['quota_gb'] / 1000).' TB' : $package['quota_gb'].' GB',
+                            __('order.traffic') => $package['traffic_gb'] >= 1000 ? ($package['traffic_gb'] / 1000).' TB' : $package['traffic_gb'].' GB',
+                            __('order.seats') => __('order.up_to', ['count' => $package['seats']]),
+                            __('checkout.performance') => __('billing.perf.'.($package['performance'] ?? 'standard')),
+                        ] as $label => $value)
+                            <div class="bg-surface px-6 py-4">
+                                <dt class="text-xs text-muted">{{ $label }}</dt>
+                                <dd class="mt-1 font-mono text-sm tabular-nums text-ink">{{ $value }}</dd>
+                            </div>
+                        @endforeach
+                    </dl>
+
+                    <div class="border-t border-line px-6 py-4">
+                        <x-ui.delivery :state="$package['delivery']" />
+                    </div>
+                </section>
+
+                {{-- What happens after the button. Three steps, because "you are
+                     redirected to a payment provider" is the point at which a
+                     first-time buyer wants to know what they are getting into. --}}
+                <section class="rounded-lg border border-line bg-surface p-6 shadow-xs animate-rise [animation-delay:60ms]">
+                    <h2 class="text-sm font-bold text-ink">{{ __('checkout.next_title') }}</h2>
+                    <ol class="mt-4 space-y-4">
+                        @foreach (['pay', 'build', 'credentials'] as $i => $step)
+                            <li class="flex gap-3.5">
+                                <span class="mt-0.5 flex size-6 shrink-0 items-center justify-center rounded-pill bg-ink text-xs font-bold text-bg">{{ $i + 1 }}</span>
+                                <span class="min-w-0">
+                                    <b class="block text-sm font-semibold text-ink">{{ __('checkout.step_'.$step.'_title') }}</b>
+                                    <span class="mt-0.5 block text-xs leading-relaxed text-muted">{{ __('checkout.step_'.$step.'_body') }}</span>
+                                </span>
+                            </li>
+                        @endforeach
+                    </ol>
+                </section>
+
+                {{-- The three standing facts about the sale. Same band as the
+                     order page, so the two pages read as one flow. --}}
+                <div class="grid gap-px overflow-hidden rounded-lg border border-line bg-line shadow-xs sm:grid-cols-3 animate-rise [animation-delay:120ms]">
+                    @foreach ([
+                        ['icon' => 'refresh', 'title' => __('order.note_cancel_title'), 'body' => __('order.note_cancel_body')],
+                        ['icon' => 'lock', 'title' => __('order.note_payment_title'), 'body' => __('order.note_payment_body')],
+                        ['icon' => 'shield', 'title' => __('checkout.note_withdrawal_title'), 'body' => __('checkout.note_withdrawal_body')],
+                    ] as $note)
+                        <div class="bg-surface p-5">
+                            <p class="flex items-center gap-2 text-sm font-semibold text-ink">
+                                <x-ui.icon :name="$note['icon']" class="size-4 text-accent-text" />{{ $note['title'] }}
+                            </p>
+                            <p class="mt-2 text-xs leading-relaxed text-muted">{{ $note['body'] }}</p>
+                        </div>
+                    @endforeach
+                </div>
+            </div>
+
+            {{-- ── What it costs, and the button ────────────────────────────── --}}
+            <form method="POST" action="{{ route('checkout.start') }}"
+                  x-data="{ terms: false }"
+                  class="rounded-lg border border-line bg-surface shadow-md animate-rise [animation-delay:40ms] lg:sticky lg:top-6">
+                @csrf
+                <input type="hidden" name="plan" value="{{ $package['key'] }}" />
+                <input type="hidden" name="term" value="{{ $term }}" />
+                <input type="hidden" name="terms_accepted" x-bind:value="terms ? '1' : ''" />
+
+                <div class="border-b border-line px-6 py-4">
+                    <h2 class="text-sm font-bold text-ink">{{ __('checkout.summary_title') }}</h2>
+                </div>
+
+                <dl class="space-y-3 px-6 py-5 text-sm">
+                    <div class="flex items-baseline justify-between gap-4">
+                        <dt class="text-muted">
+                            {{ $package['name'] }} ·
+                            {{ $lines['yearly'] ? __('order.per_year_label') : __('order.per_month_label') }}
+                        </dt>
+                        <dd class="font-mono tabular-nums text-ink">{{ $eur($lines['recurring_net']) }}</dd>
+                    </div>
+
+                    @if ($lines['yearly'] && $lines['free_months'] > 0)
+                        <div class="flex items-baseline justify-between gap-4 text-success">
+                            <dt>{{ trans_choice('order.free_months_hint', $lines['free_months'], ['count' => $lines['free_months']]) }}</dt>
+                            <dd class="font-mono tabular-nums">− {{ $eur($lines['twelve_months_gross'] - $lines['recurring_gross']) }}</dd>
+                        </div>
+                    @endif
+
+                    @if ($lines['setup_net'] > 0)
+                        <div class="flex items-baseline justify-between gap-4">
+                            <dt class="text-muted">{{ __('checkout.setup_line') }}</dt>
+                            <dd class="font-mono tabular-nums text-ink">{{ $eur($lines['setup_net']) }}</dd>
+                        </div>
+                    @endif
+
+                    <div class="flex items-baseline justify-between gap-4 border-t border-line pt-3">
+                        <dt class="text-muted">{{ __('checkout.tax_line', ['rate' => $vat]) }}</dt>
+                        <dd class="font-mono tabular-nums text-ink">{{ $eur($lines['today_tax']) }}</dd>
+                    </div>
+
+                    {{-- The one figure that will actually be charged, and it is
+                         the largest thing in the panel. --}}
+                    <div class="flex items-baseline justify-between gap-4 border-t border-line pt-3">
+                        <dt class="text-sm font-semibold text-ink">{{ __('checkout.total_today') }}</dt>
+                        <dd class="font-mono text-xl font-bold tabular-nums tracking-[-0.02em] text-ink">{{ $eur($lines['today_gross']) }}</dd>
+                    </div>
+
+                    {{-- And what comes after it, because the total above includes
+                         a one-off and the next charge will not. --}}
+                    <p class="text-xs leading-relaxed text-muted">
+                        {{ __($lines['yearly'] ? 'checkout.then_yearly' : 'checkout.then_monthly', [
+                            'amount' => $eur($lines['recurring_gross']),
+                        ]) }}
+                        @if ($lines['yearly'])
+                            · {{ __('order.per_month_equivalent', ['amount' => $eur($lines['per_month_gross'])]) }}
+                        @endif
+                    </p>
+                </dl>
+
+                {{-- ── The acceptance, directly above the button ─────────────
+                     Not at the top of the previous page as a condition of
+                     looking at prices: it is a condition of buying, and this is
+                     the button that buys. The server rule is the real gate
+                     (CheckoutController validates `accepted`), so with
+                     JavaScript off the field arrives empty and the checkout is
+                     refused with the sentence explaining why. --}}
+                <div class="border-t border-line bg-surface-2 px-6 py-5">
+                    <label class="flex cursor-pointer items-start gap-3">
+                        <input type="checkbox" x-model="terms"
+                               class="mt-0.5 size-4 shrink-0 rounded-sm border-line-strong text-accent-active focus:ring-accent-active" />
+                        <span class="min-w-0 text-sm leading-relaxed text-body">
+                            {{-- A new tab: following the link must not lose the
+                                 page with the order on it. --}}
+                            {!! __('order.terms_label', [
+                                'link' => '<a href="'.route('legal.agb').'" target="_blank" rel="noopener"
+                                              class="font-semibold text-accent-text underline underline-offset-4">'
+                                          .e(__('order.terms_link')).'</a>',
+                            ]) !!}
+                        </span>
+                    </label>
+                    <p class="mt-2 pl-7 text-xs leading-relaxed text-muted">{{ __('order.terms_why') }}</p>
+
+                    <button type="submit"
+                            class="mt-5 inline-flex w-full items-center justify-center gap-2 rounded bg-ink px-4 py-3 text-sm font-semibold text-bg transition-colors hover:bg-accent-text"
+                            x-bind:disabled="!terms"
+                            x-bind:class="terms ? '' : 'cursor-not-allowed opacity-50'">
+                        <x-ui.icon name="lock" class="size-4" />{{ __('checkout.pay_cta') }}
+                    </button>
+                    <p class="mt-2 text-center text-[11px] leading-snug text-muted" x-show="!terms" x-cloak>
+                        {{ __('order.terms_first') }}
+                    </p>
+                    <p class="mt-3 text-center text-[11px] leading-snug text-muted">{{ __('checkout.stripe_note') }}</p>
+                </div>
+            </form>
+        </div>
+    @endif
+</div>
diff --git a/resources/views/livewire/confirm-cancel-package.blade.php b/resources/views/livewire/confirm-cancel-package.blade.php
index 4aac027..4158b72 100644
--- a/resources/views/livewire/confirm-cancel-package.blade.php
+++ b/resources/views/livewire/confirm-cancel-package.blade.php
@@ -15,9 +15,50 @@
         <li class="flex items-start gap-2"><x-ui.icon name="alert-triangle" class="mt-0.5 size-4 shrink-0 text-warning" />{{ __('settings.cancel_point_irreversible') }}</li>
     </ul>
 
+    {{-- Still inside the fourteen days: offered as a way OUT of this dialogue,
+         not as one more reason inside it. Withdrawing ends the service the same
+         day and sends the WHOLE amount back; cancelling keeps the term that was
+         paid for. Somebody entitled to the first should not lose it by taking
+         the second without being told. --}}
+    @if ($canWithdraw)
+        <div class="mt-4 rounded border border-accent-border bg-accent-subtle p-4">
+            <p class="text-sm font-semibold text-ink">{{ __('withdrawal.instead_title') }}</p>
+            <p class="mt-1 text-xs leading-relaxed text-body">
+                {{ __('withdrawal.instead_body', ['date' => $withdrawalEndsAt?->local()->isoFormat('LL')]) }}
+            </p>
+            <x-ui.button variant="secondary" size="sm" class="mt-3"
+                         x-on:click="Livewire.dispatch('closeModal'); $nextTick(() => $dispatch('openModal', { component: 'confirm-withdraw' }))">
+                {{ __('withdrawal.cta') }}
+            </x-ui.button>
+        </div>
+    @endif
+
+    {{-- Why. Asked here because this is the only moment the customer is looking
+         at the question; afterwards they are gone and nobody asks again. --}}
+    <div class="mt-4">
+        <label class="text-sm text-body" for="cancel-reason">{{ __('settings.cancel_reason_label') }}</label>
+        <select id="cancel-reason" wire:model.live="reason"
+                class="mt-1.5 w-full rounded border border-line-strong bg-surface px-3 py-2 text-sm text-ink">
+            <option value="">{{ __('settings.cancel_reason_choose') }}</option>
+            @foreach ($reasons as $key)
+                <option value="{{ $key }}">{{ __('settings.cancel_reason.'.$key) }}</option>
+            @endforeach
+        </select>
+        @error('reason')<p class="mt-1 text-xs text-danger">{{ $message }}</p>@enderror
+    </div>
+
+    <div class="mt-3">
+        <label class="text-sm text-body" for="cancel-note">
+            {{ $reason === 'other' ? __('settings.cancel_note_label_required') : __('settings.cancel_note_label') }}
+        </label>
+        <textarea id="cancel-note" wire:model="note" rows="2"
+                  class="mt-1.5 w-full rounded border border-line-strong bg-surface px-3 py-2 text-sm text-ink"></textarea>
+        @error('note')<p class="mt-1 text-xs text-danger">{{ $message }}</p>@enderror
+    </div>
+
     <div class="mt-4">
         <label class="text-sm text-body">{{ __('settings.cancel_confirm_label', ['name' => $subdomain]) }}</label>
-        <input type="text" wire:model="confirmName" class="mt-1.5 w-full rounded-md border border-line-strong bg-surface px-3 py-2 text-sm text-ink" />
+        <input type="text" wire:model="confirmName" class="mt-1.5 w-full rounded border border-line-strong bg-surface px-3 py-2 text-sm text-ink" />
         @error('confirmName')<p class="mt-1 text-xs text-danger">{{ $message }}</p>@enderror
     </div>
 
diff --git a/resources/views/livewire/confirm-delete-own-account.blade.php b/resources/views/livewire/confirm-delete-own-account.blade.php
new file mode 100644
index 0000000..98d9379
--- /dev/null
+++ b/resources/views/livewire/confirm-delete-own-account.blade.php
@@ -0,0 +1,14 @@
+<x-ui.modal :title="__('verify_email.delete_title')">
+    <p class="text-sm leading-relaxed text-body">{{ __('verify_email.delete_body') }}</p>
+
+    <x-slot:footer>
+        <div class="flex flex-wrap justify-end gap-3">
+            <x-ui.button variant="secondary" x-on:click="Livewire.dispatch('closeModal')">
+                {{ __('verify_email.delete_keep') }}
+            </x-ui.button>
+            <x-ui.button variant="danger" wire:click="confirm" wire:loading.attr="disabled" wire:target="confirm">
+                {{ __('verify_email.delete_confirm') }}
+            </x-ui.button>
+        </div>
+    </x-slot:footer>
+</x-ui.modal>
diff --git a/resources/views/livewire/order.blade.php b/resources/views/livewire/order.blade.php
index 5fe395b..209f67b 100644
--- a/resources/views/livewire/order.blade.php
+++ b/resources/views/livewire/order.blade.php
@@ -1,14 +1,80 @@
-<div class="mx-auto max-w-[1120px] space-y-6">
-    <div class="animate-rise">
-        <h1 class="text-2xl font-bold tracking-tight text-ink">{{ __('order.title') }}</h1>
-        <p class="mt-1 max-w-[70ch] text-sm text-muted">{{ __('order.subtitle') }}</p>
-    </div>
+{{--
+    Choosing a package. Choosing only — nothing is agreed to on this page.
+
+    ## What was wrong with the last one
+
+    Everything but the cards was pinned to the left half of the window: a
+    68-character title, an 80-character footnote, and a switch under them, on a
+    1240px shell. It read as a column that had lost its second half.
+
+    And the terms sat at the TOP as a condition of looking at prices, which is
+    the wrong order twice over — it is a condition of BUYING, and the buttons
+    below it were dead until it was ticked, so the page arrived looking broken.
+    The acceptance now lives one step later, on the checkout page, directly above
+    the button that spends money. This page has no form on it at all.
+
+    ## The shape
+
+    A header band that uses the width — name and purpose left, the term switch
+    right, where a control belongs. Then the cards. Then a closing band of three
+    columns rather than a paragraph trailing off to the left.
+--}}
+@php
+    use Illuminate\Support\Number;
+
+    $eur = fn (int $cents, string $currency) => Number::currency($cents / 100, in: $currency, locale: app()->getLocale());
+    $bestFreeMonths = (int) collect($plans)->max('free_months');
+@endphp
+
+<div class="space-y-6" x-data="{ term: 'monthly' }">
+
+    {{-- ── Header band ──────────────────────────────────────────────────────
+         Title left, control right, one rule under both. The switch is a page
+         control and not a card decoration, so it sits with the heading. --}}
+    <header class="flex flex-wrap items-end gap-x-6 gap-y-4 border-b border-line pb-5 animate-rise">
+        <div class="min-w-0 flex-1">
+            <p class="lbl">{{ __('order.eyebrow') }}</p>
+            <h1 class="mt-[7px] text-[23px] font-bold leading-[1.12] tracking-[-0.03em] text-ink min-[901px]:text-[30px]">
+                {{ __('order.title') }}
+            </h1>
+            <p class="mt-2 max-w-[76ch] text-sm leading-relaxed text-muted">{{ __('order.subtitle') }}</p>
+        </div>
+
+        @if ($plans !== [] && ! $contract)
+            <div class="flex flex-col items-start gap-2 sm:items-end">
+                {{-- One radius scale, nested: the shell is rounded-lg (16px) and
+                     the option inside it rounded (11px), which is the shell's
+                     radius less its own padding. A rounded-md option — Tailwind's
+                     untokenised 6px — read as a different component sitting
+                     inside this one. --}}
+                {{-- Above the switch, and ALWAYS present. It hung underneath
+                     and was hidden on the yearly view, so choosing a term moved
+                     the buttons that choose it. One line, two wordings: an offer
+                     while it is an offer, a statement once it is taken. --}}
+                @if ($bestFreeMonths > 0)
+                    <span class="text-xs font-semibold text-success">
+                        <span x-show="term !== 'yearly'">{{ trans_choice('order.free_months_hint', $bestFreeMonths, ['count' => $bestFreeMonths]) }}</span>
+                        <span x-show="term === 'yearly'" x-cloak>{{ trans_choice('order.free_months_taken', $bestFreeMonths, ['count' => $bestFreeMonths]) }}</span>
+                    </span>
+                @endif
+                <div class="inline-flex rounded-lg border border-line bg-surface p-1 shadow-xs" role="group">
+                    @foreach (['monthly', 'yearly'] as $option)
+                        <button type="button" x-on:click="term = '{{ $option }}'"
+                                class="rounded px-5 py-2 text-sm font-semibold transition-colors"
+                                x-bind:class="term === '{{ $option }}' ? 'bg-ink text-bg shadow-xs' : 'text-muted hover:text-ink'">
+                            {{ __('order.term_'.$option) }}
+                        </button>
+                    @endforeach
+                </div>
+            </div>
+        @endif
+    </header>
 
     @if ($contract)
-        {{-- Not an error and not a dead end: they have a contract, and the way
-             to a bigger package is a plan change, which prorates and leaves
-             their data where it is. A second checkout would build a second,
-             empty cloud and bill for both. --}}
+        {{-- Not an error and not a dead end: they have a contract, and the way to
+             a bigger package is a plan change, which prorates and leaves their
+             data where it is. A second checkout would build a second, empty cloud
+             and bill for both. --}}
         <x-ui.alert variant="info">
             {{ __('order.already_customer') }}
             <a href="{{ route('billing') }}" class="font-semibold underline">{{ __('order.to_billing') }}</a>
@@ -18,110 +84,127 @@
     @else
         @error('plan')<x-ui.alert variant="error">{{ $message }}</x-ui.alert>@enderror
 
-        {{-- One consent for the page, not one per card: the sentence is the
-             law's own wording and four copies of it is a wall nobody reads.
-             The forms each carry it as a hidden field bound to this one box.
-
-             The server rule is the real gate (CheckoutController validates
-             `accepted`), so with JavaScript off the field arrives empty and the
-             checkout is refused with the sentence explaining why — the safe
-             direction to fail in. Ticking a box in a browser is not the record
-             anyway: the record is the timestamp taken when the payment lands. --}}
-        <div x-data="{ immediateStart: false }">
-        <div class="grid gap-5 sm:grid-cols-2 lg:grid-cols-4">
-            @foreach ($plans as $plan)
+        {{-- ── The packages ──────────────────────────────────────────────────
+             Three columns: five plans read as 3 + 2, and a fifth card alone on a
+             row of four reads as a mistake. items-start, because the recommended
+             one is allowed to be taller without dragging its neighbours' buttons
+             down with it. --}}
+        <div class="grid gap-4 sm:grid-cols-2 lg:grid-cols-3 lg:items-start">
+            @foreach ($plans as $i => $plan)
                 <div @class([
                     'flex flex-col rounded-lg border bg-surface p-6 shadow-xs animate-rise',
-                    'border-ink shadow-md' => $plan['recommended'],
+                    'border-ink shadow-md ring-1 ring-ink' => $plan['recommended'],
                     'border-line' => ! $plan['recommended'],
-                ])>
+                ]) style="animation-delay: {{ 60 + $i * 40 }}ms">
                     <div class="flex flex-wrap items-center gap-2">
-                        <h2 class="font-semibold text-ink">{{ $plan['name'] }}</h2>
+                        <h2 class="text-md font-bold tracking-[-0.01em] text-ink">{{ $plan['name'] }}</h2>
                         @if ($plan['recommended'])
-                            <span class="rounded-pill bg-accent-active px-2 py-0.5 text-[10px] font-medium uppercase tracking-wider text-on-accent">{{ __('order.recommended') }}</span>
+                            <span class="rounded-pill bg-accent-active px-2 py-0.5 text-[10px] font-semibold uppercase tracking-wider text-on-accent">{{ __('order.recommended') }}</span>
                         @endif
                     </div>
                     @if ($plan['audience'])
-                        <p class="mt-1 text-xs text-muted">{{ $plan['audience'] }}</p>
+                        <p class="mt-1 text-xs leading-relaxed text-muted">{{ $plan['audience'] }}</p>
                     @endif
 
-                    {{-- What this customer's card will be charged, like the public
-                         sheet. A customer quoted 58,80 € out there must not meet
-                         49 € on the page with the button on it. --}}
-                    <p class="mt-5 flex items-baseline gap-1.5">
-                        <span class="font-mono text-2xl font-semibold tabular-nums text-ink">{{ Number::currency($plan['gross'] / 100, in: $plan['currency'], locale: app()->getLocale()) }}</span>
-                        <span class="text-xs text-muted">{{ __('order.per_month') }}</span>
-                    </p>
-                    <p class="mt-1 text-xs text-muted">
-                        {{-- A reverse-charge business is charged the bare net, so
-                             there is no VAT to state and no second figure to show:
-                             saying "inkl. 20 %" over a net price would describe a
-                             tax nothing collects. --}}
-                        @if ($tax->reverseCharge)
-                            {{ __('order.reverse_charge') }}
-                        @else
-                            {{ __('order.incl_vat', ['rate' => $vat]) }} ·
-                            {{ __('order.net') }} {{ Number::currency($plan['net'] / 100, in: $plan['currency'], locale: app()->getLocale()) }}
+                    {{-- The price of the term that is selected — the whole price,
+                         in the unit it is charged in. The yearly view used to
+                         show the monthly EQUIVALENT in the headline, so on a
+                         package with no free months the figure did not move at
+                         all when the switch was thrown, and the page looked like
+                         it had ignored the click. What a year works out to per
+                         month is worth knowing and is said underneath. --}}
+                    <div x-show="term === 'monthly'">
+                        <p class="mt-5 flex items-baseline gap-1.5">
+                            <span class="text-[2rem] font-bold leading-none tabular-nums tracking-[-0.03em] text-ink">{{ $eur($plan['gross'], $plan['currency']) }}</span>
+                            <span class="text-xs text-muted">{{ __('order.per_month') }}</span>
+                        </p>
+                        <p class="mt-1.5 text-xs text-muted">
+                            {{ __('order.incl_vat', ['rate' => $vat]) }} · {{ __('order.net') }} {{ $eur($plan['net'], $plan['currency']) }}
+                        </p>
+                    </div>
+
+                    <div x-show="term === 'yearly'" x-cloak>
+                        <p class="mt-5 flex items-baseline gap-1.5">
+                            <span class="text-[2rem] font-bold leading-none tabular-nums tracking-[-0.03em] text-ink">{{ $eur($plan['yearly_gross'], $plan['currency']) }}</span>
+                            <span class="text-xs text-muted">{{ __('order.per_year') }}</span>
+                        </p>
+                        <p class="mt-1.5 text-xs text-muted">
+                            {{ __('order.per_month_equivalent', ['amount' => $eur($plan['yearly_per_month'], $plan['currency'])]) }} ·
+                            {{ __('order.incl_vat', ['rate' => $vat]) }} · {{ __('order.net') }} {{ $eur($plan['yearly_net'], $plan['currency']) }}
+                        </p>
+                        @if ($plan['free_months'] > 0)
+                            <p class="mt-1 text-xs font-semibold text-success">
+                                {{ trans_choice('order.free_months_hint', $plan['free_months'], ['count' => $plan['free_months']]) }}
+                                · {{ __('order.instead_of', ['amount' => $eur($plan['twelve_months_gross'], $plan['currency'])]) }}
+                            </p>
                         @endif
-                    </p>
+                    </div>
+
                     @if ($setup > 0)
                         <p class="mt-1 text-xs text-muted">
-                            {{ __('order.setup', ['amount' => Number::currency($setup / 100, in: $plan['currency'], locale: app()->getLocale())]) }}
+                            {{ __('order.setup', ['amount' => $eur($setup, $plan['currency'])]) }}
                         </p>
                     @endif
 
+                    {{-- Read from the estate, not written down: where a host has
+                         room this rolls out on its own. --}}
                     <x-ui.delivery :state="$plan['delivery']" class="mt-4" />
 
-                    <dl class="mt-5 flex-1 space-y-2 border-t border-line pt-4 text-sm">
+                    <dl class="mt-4 flex-1 space-y-2 border-t border-line pt-4 text-sm">
                         @foreach ([
-                            __('order.storage') => $plan['quota_gb'].' GB',
-                            __('order.traffic') => $plan['traffic_gb'].' GB',
-                            __('order.seats') => $plan['seats'],
-                        ] as $term => $value)
-                            <div class="flex justify-between gap-3">
-                                <dt class="text-muted">{{ $term }}</dt>
+                            __('order.storage') => $plan['quota_gb'] >= 1000 ? ($plan['quota_gb'] / 1000).' TB' : $plan['quota_gb'].' GB',
+                            __('order.traffic') => $plan['traffic_gb'] >= 1000 ? ($plan['traffic_gb'] / 1000).' TB' : $plan['traffic_gb'].' GB',
+                            __('order.seats') => __('order.up_to', ['count' => $plan['seats']]),
+                        ] as $label => $value)
+                            <div class="flex items-baseline justify-between gap-3">
+                                <dt class="text-muted">{{ $label }}</dt>
                                 <dd class="font-mono tabular-nums text-ink">{{ $value }}</dd>
                             </div>
                         @endforeach
                     </dl>
 
-                    {{-- A plain form post, not a Livewire action: the response
-                         is a redirect to another domain, and Livewire's
-                         XHR-and-swap cannot leave the site. --}}
-                    <form method="POST" action="{{ route('checkout.start') }}" class="mt-6">
-                        @csrf
-                        <input type="hidden" name="plan" value="{{ $plan['key'] }}" />
-                        {{-- The consent, carried from the one box below. --}}
-                        <input type="hidden" name="immediate_start" x-bind:value="immediateStart ? '1' : ''" />
-                        {{-- The wording is the legal one and not a nicety:
-                             the button that concludes a paid contract has to
-                             say that it costs money. --}}
-                        <x-ui.button type="submit" :variant="$plan['recommended'] ? 'primary' : 'secondary'" class="w-full"
-                                     x-bind:disabled="!immediateStart">
-                            {{ __('order.buy') }}
-                        </x-ui.button>
-                    </form>
+                    {{-- A link, not a form: choosing a package is a navigation,
+                         and what follows is a page where the order is confirmed.
+                         The term travels in the address, so the checkout shows
+                         what was being looked at — and a reload of that page
+                         still shows it. --}}
+                    {{-- The whole address from route(), with the term swapped
+                         into it — not route() plus "?term=". Both parameters are
+                         query parameters here, so appending a second "?" built
+                         `?plan=team?term=monthly`, and the package arrived as
+                         the string "team?term=monthly": every click landed on
+                         "this package is not on sale". --}}
+                    <a href="{{ route('checkout', ['plan' => $plan['key'], 'term' => 'monthly']) }}"
+                       x-bind:href="'{{ route('checkout', ['plan' => $plan['key'], 'term' => '__TERM__']) }}'.replace('__TERM__', term)"
+                       @class([
+                           'mt-6 inline-flex w-full items-center justify-center gap-2 rounded px-4 py-2.5 text-sm font-semibold transition-colors',
+                           'bg-ink text-bg hover:bg-accent-text' => $plan['recommended'],
+                           'border border-line-strong bg-surface text-ink hover:bg-surface-hover' => ! $plan['recommended'],
+                       ])>
+                        {{ __('order.choose') }}
+                        <x-ui.icon name="chevron-down" class="size-4 -rotate-90" />
+                    </a>
                 </div>
             @endforeach
         </div>
 
-        {{-- The withdrawal consent. Without it on record a withdrawal on day
-             thirteen gets the WHOLE amount back however long the machine ran,
-             because a seller who cannot prove the consent was given cannot
-             charge for the days it was given for. --}}
-        <label class="mt-5 flex max-w-[80ch] cursor-pointer items-start gap-3 rounded-lg border border-line bg-surface-2 p-4">
-            <input type="checkbox" x-model="immediateStart"
-                   class="mt-0.5 size-4 shrink-0 rounded border-line-strong text-accent-active focus:ring-accent-active" />
-            <span class="text-xs leading-relaxed text-body">{{ __('checkout.immediate_start') }}</span>
-        </label>
-
-        @error('immediate_start')
-            <x-ui.alert variant="error" class="mt-3">{{ $message }}</x-ui.alert>
-        @enderror
+        {{-- ── The closing band ──────────────────────────────────────────────
+             Three columns across the same width as the cards. It was one
+             paragraph wrapped at 80 characters, which left two thirds of the
+             page empty under a grid that used all of it. --}}
+        <div class="grid gap-px overflow-hidden rounded-lg border border-line bg-line shadow-xs sm:grid-cols-3 animate-rise [animation-delay:240ms]">
+            @foreach ([
+                ['icon' => 'refresh', 'title' => __('order.note_cancel_title'), 'body' => __('order.note_cancel_body')],
+                ['icon' => 'lock', 'title' => __('order.note_payment_title'), 'body' => __('order.note_payment_body')],
+                ['icon' => 'box', 'title' => __('order.note_migration_title'), 'body' => __('order.note_migration_body')],
+            ] as $note)
+                <div class="bg-surface p-6">
+                    <p class="flex items-center gap-2 text-sm font-semibold text-ink">
+                        <x-ui.icon :name="$note['icon']" class="size-4 text-accent-text" />{{ $note['title'] }}
+                    </p>
+                    <p class="mt-2 text-xs leading-relaxed text-muted">{{ $note['body'] }}</p>
+                </div>
+            @endforeach
         </div>
-
-        <p class="max-w-[80ch] text-xs leading-relaxed text-muted">
-            {{ __('order.terms') }}
-        </p>
     @endif
 </div>
diff --git a/resources/views/livewire/settings.blade.php b/resources/views/livewire/settings.blade.php
index 7beea0a..2298e20 100644
--- a/resources/views/livewire/settings.blade.php
+++ b/resources/views/livewire/settings.blade.php
@@ -1,280 +1,456 @@
-<div class="mx-auto max-w-3xl space-y-6">
-    <div class="animate-rise">
-        <h1 class="text-2xl font-bold tracking-tight text-ink">{{ __('settings.title') }}</h1>
-        <p class="mt-1 text-sm text-muted">{{ __('settings.subtitle') }}</p>
+{{--
+    The customer's own settings.
+
+    ## What was wrong, three times over
+
+    First it was one column 768px wide in a 1240px shell, holding everything a
+    customer might ever change, two thousand pixels deep. Then it became four
+    tabs — better — but the cards inside them were still boxes of different
+    heights in a grid, which on the contract tab produced a short one, a wide one
+    and a short one again: a staircase with no rhythm and half the width empty
+    beside it.
+
+    ## What it is now
+
+    Panels and rows (x-ui.panel, x-ui.row). A group is a card with a header that
+    names it; a setting is a ROW inside that card — what it is on the left, the
+    control on the right, dividers between. That is the shape every settings page
+    worth copying uses, and it is the shape that uses the width: a label column
+    of 280px with the control beside it fills the line, where a stack of
+    full-width inputs leaves two thirds of it empty.
+
+    Below `sm` the rows stack, because on a telephone a label belongs above its
+    field.
+--}}
+<div class="space-y-6">
+
+    <header class="animate-rise">
+        <p class="lbl">{{ __('settings.eyebrow') }}</p>
+        <h1 class="mt-[7px] text-[23px] font-bold leading-[1.12] tracking-[-0.03em] text-ink min-[901px]:text-[30px]">
+            {{ __('settings.title') }}
+        </h1>
+        <p class="mt-2 max-w-[76ch] text-sm leading-relaxed text-muted">{{ __('settings.subtitle') }}</p>
+    </header>
+
+    {{-- The same tab bar the console uses, so one vocabulary holds on both sides
+         of the login. The choice lives in the query string — see the #[Url]
+         attribute on the component. --}}
+    <div class="flex flex-wrap items-center gap-x-1 gap-y-2 border-b border-line animate-rise [animation-delay:40ms]" role="tablist">
+        @foreach ($tabs as $name)
+            <button type="button" role="tab" wire:click="$set('tab', '{{ $name }}')"
+                    aria-selected="{{ $tab === $name ? 'true' : 'false' }}"
+                    @class([
+                        'flex items-center gap-2 whitespace-nowrap border-b-2 px-4 py-2.5 text-sm font-medium transition-colors -mb-px',
+                        'border-accent-active text-ink' => $tab === $name,
+                        'border-transparent text-muted hover:text-ink' => $tab !== $name,
+                    ])>
+                <x-ui.icon :name="['profile' => 'users', 'security' => 'shield-check', 'branding' => 'pen', 'contract' => 'receipt'][$name] ?? 'settings'"
+                           class="size-4" />{{ __('settings.tab.'.$name) }}
+            </button>
+        @endforeach
     </div>
 
-    {{-- Company / billing profile --}}
-    <form wire:submit="saveProfile" class="space-y-4 rounded-lg border border-line bg-surface p-6 shadow-xs animate-rise [animation-delay:60ms]">
-        <h2 class="font-semibold text-ink">{{ __('settings.company_title') }}</h2>
-        <div class="grid grid-cols-1 gap-4 sm:grid-cols-2">
-            <x-ui.input name="companyName" wire:model="companyName" :label="__('settings.company_name')" />
-            <x-ui.input name="contactName" wire:model="contactName" :label="__('settings.contact_name')" />
-            <x-ui.input name="phone" wire:model="phone" :label="__('settings.phone')" />
-            <x-ui.input name="vatId" wire:model="vatId" :label="__('settings.vat_id')" />
-        </div>
-        {{-- Beside the VAT number, deliberately, because that is the field
-             people mistake it for. A business without a number is an ordinary
-             small business and a consumer with one does not exist, so the two
-             answer different questions: this one decides the fourteen-day right
-             of withdrawal and whether reverse charge can ever apply. Nothing is
-             preselected for a customer nobody has asked yet. --}}
-        <fieldset class="space-y-1.5">
-            <legend class="text-sm font-medium text-body">{{ __('settings.customer_type') }}</legend>
-            <div class="grid grid-cols-1 gap-2 sm:grid-cols-2">
-                @foreach ($customerTypes as $type)
-                    <label class="flex cursor-pointer items-center gap-2 rounded-md border border-line-strong bg-surface px-3 py-2 text-sm text-ink transition has-[:checked]:border-ink">
-                        <input type="radio" wire:model="customerType" value="{{ $type }}"
-                               class="size-4 shrink-0 border-line text-ink" />
-                        {{ __('settings.customer_type_'.$type) }}
-                    </label>
-                @endforeach
-            </div>
-            <p class="text-xs text-muted">{{ __('settings.customer_type_hint') }}</p>
-            @error('customerType')<p class="text-xs text-danger">{{ $message }}</p>@enderror
-        </fieldset>
-        <div>
-            <label class="text-sm font-medium text-body" for="billingAddress">{{ __('settings.billing_address') }}</label>
-            <textarea id="billingAddress" wire:model="billingAddress" rows="3"
-                      class="mt-1.5 w-full rounded-md border border-line-strong bg-surface px-3 py-2 text-sm text-ink"></textarea>
-            @error('billingAddress')<p class="mt-1 text-xs text-danger">{{ $message }}</p>@enderror
-        </div>
-        <div class="flex justify-end">
-            <x-ui.button variant="primary" type="submit" wire:loading.attr="disabled" wire:target="saveProfile">{{ __('settings.save') }}</x-ui.button>
-        </div>
-    </form>
+    {{-- ══ Ihre Daten ═══════════════════════════════════════════════════════ --}}
+    @if ($tab === 'profile')
+        <form wire:submit="saveProfile" class="space-y-5 animate-rise [animation-delay:60ms]">
+            <x-ui.panel :title="__('settings.company_title')" :subtitle="__('settings.company_sub')">
+                <x-ui.row :label="__('settings.company_name')" for="companyName">
+                    <x-ui.input name="companyName" wire:model="companyName" />
+                </x-ui.row>
+                <x-ui.row :label="__('settings.contact_name')" for="contactName">
+                    <x-ui.input name="contactName" wire:model="contactName" />
+                </x-ui.row>
+                <x-ui.row :label="__('settings.phone')" for="phone">
+                    <x-ui.input name="phone" wire:model="phone" />
+                </x-ui.row>
+                <x-ui.row :label="__('settings.vat_id')" for="vatId">
+                    <x-ui.input name="vatId" wire:model="vatId" />
+                </x-ui.row>
 
-    {{-- Branding --}}
-
-    {{-- Own password. There was no way to change one at all — Fortify's
-         updatePasswords feature was switched off. --}}
-    <form wire:submit="updateOwnPassword" class="space-y-4 rounded-lg border border-line bg-surface p-6 shadow-xs animate-rise [animation-delay:90ms]">
-        <div>
-            <h2 class="font-semibold text-ink">{{ __('admin_settings.password_title') }}</h2>
-            <p class="mt-1 text-sm text-muted">{{ __('admin_settings.password_sub') }}</p>
-        </div>
-
-        <div class="grid gap-4 sm:grid-cols-3">
-            <x-ui.input name="currentPassword" type="password" autocomplete="current-password"
-                        :label="__('admin_settings.password_current')" wire:model="currentPassword" />
-            <x-ui.input name="newPassword" type="password" autocomplete="new-password"
-                        :label="__('admin_settings.password_new')" wire:model="newPassword" />
-            <x-ui.input name="newPasswordConfirmation" type="password" autocomplete="new-password"
-                        :label="__('admin_settings.password_repeat')" wire:model="newPasswordConfirmation" />
-        </div>
-
-        <div class="flex justify-end">
-            <x-ui.button type="submit" variant="primary" wire:loading.attr="disabled" wire:target="updateOwnPassword">{{ __('admin_settings.password_save') }}</x-ui.button>
-        </div>
-    </form>
-
-
-    {{-- Two-factor. Every action is re-checked server-side against a recent
-         password confirmation — hiding the buttons stops nobody who can post
-         to /livewire/update. --}}
-    <div class="space-y-4 rounded-lg border border-line bg-surface p-6 shadow-xs animate-rise [animation-delay:150ms]">
-        <div class="flex flex-wrap items-start justify-between gap-4">
-            <div>
-                <div class="flex flex-wrap items-center gap-2">
-                    <h2 class="font-semibold text-ink">{{ __('settings.twofa_title') }}</h2>
-                    <span class="inline-flex items-center gap-1.5 rounded-pill border px-2.5 py-0.5 text-xs font-medium
-                          {{ $twoFactorOn ? 'border-success-border bg-success-bg text-success' : 'border-line-strong bg-surface-2 text-muted' }}">
-                        <span class="size-1.5 rounded-pill bg-current" aria-hidden="true"></span>
-                        {{ $twoFactorOn ? __('settings.twofa_state_on') : __('settings.twofa_state_off') }}
-                    </span>
-                </div>
-                <p class="mt-1.5 max-w-xl text-sm text-muted">{{ __('settings.twofa_sub') }}</p>
-            </div>
-        </div>
-
-        @if (! $passwordConfirmed)
-            {{-- The gate. A signed-in session is not enough to change how the
-                 account is protected — the risk is an unlocked machine. --}}
-            <form wire:submit="confirmPassword" class="rounded-lg border border-line bg-surface-2 p-4">
-                <p class="text-sm text-body">{{ __('settings.twofa_confirm_first') }}</p>
-                <div class="mt-3 flex flex-wrap items-start gap-2">
-                    <div class="min-w-56 flex-1">
-                        <x-ui.input name="confirmablePassword" type="password" autocomplete="current-password"
-                                    :label="__('admin_settings.password_current')" wire:model="confirmablePassword" />
+                {{-- Field by field, not a paragraph: what landed in the textarea
+                     was whatever somebody typed — a postcode on the street line,
+                     a town with no postcode, no country at all — and an invoice
+                     has to name its recipient precisely enough to be a
+                     document. --}}
+                <x-ui.row :label="__('settings.billing_address')" for="billingStreet">
+                    <div class="space-y-3">
+                        <x-ui.input name="billingStreet" wire:model="billingStreet" :placeholder="__('settings.billing_street')" />
+                        <div class="grid gap-3 sm:grid-cols-[140px_minmax(0,1fr)]">
+                            <x-ui.input name="billingPostcode" wire:model="billingPostcode" :placeholder="__('settings.billing_postcode')" />
+                            <x-ui.input name="billingCity" wire:model="billingCity" :placeholder="__('settings.billing_city')" />
+                        </div>
+                        <x-ui.input name="billingCountry" wire:model="billingCountry" :placeholder="__('settings.billing_country')" />
                     </div>
-                    <x-ui.button type="submit" variant="secondary" class="mt-7" wire:loading.attr="disabled" wire:target="confirmPassword">
-                        {{ __('settings.twofa_confirm_button') }}
-                    </x-ui.button>
-                </div>
-            </form>
-        @elseif ($twoFactorOn)
-            <div class="flex flex-wrap gap-2">
-                <x-ui.button variant="secondary" wire:click="regenerateRecoveryCodes" wire:loading.attr="disabled" wire:target="regenerateRecoveryCodes">
-                    {{ __('settings.twofa_new_codes') }}
-                </x-ui.button>
-                <x-ui.button variant="danger"
-                             x-on:click="$dispatch('openModal', { component: 'confirm-disable-two-factor' })">
-                    {{ __('settings.twofa_disable') }}
-                </x-ui.button>
-            </div>
-        @elseif ($twoFactorPending)
-            <div class="grid gap-5 sm:grid-cols-[auto_1fr] sm:items-start">
-                <div class="rounded-lg border border-line bg-white p-3">{!! $twoFactorQr !!}</div>
-                <form wire:submit="confirmTwoFactor" class="space-y-3">
-                    <p class="text-sm text-muted">{{ __('settings.twofa_scan') }}</p>
-                    <div class="max-w-48">
-                        <x-ui.input name="twoFactorCode" inputmode="numeric" autocomplete="one-time-code"
-                                    :label="__('settings.twofa_code')" wire:model="twoFactorCode" />
-                    </div>
-                    <x-ui.button type="submit" variant="primary" wire:loading.attr="disabled" wire:target="confirmTwoFactor">
-                        {{ __('settings.twofa_activate') }}
-                    </x-ui.button>
-                </form>
-            </div>
-        @else
-            <x-ui.button variant="primary" wire:click="enableTwoFactor" wire:loading.attr="disabled" wire:target="enableTwoFactor">
-                {{ __('settings.twofa_enable') }}
-            </x-ui.button>
-        @endif
+                </x-ui.row>
 
-        @if ($recoveryCodes)
-            {{-- Shown once, on purpose: nobody writes down what they were never
-                 shown, and these are the way back in when the phone is gone. --}}
-            <div class="rounded-lg border border-warning-border bg-warning-bg p-4">
-                <p class="text-sm font-medium text-warning">{{ __('settings.twofa_codes_title') }}</p>
-                <p class="mt-1 text-xs text-warning">{{ __('settings.twofa_codes_hint') }}</p>
-                <ul class="mt-3 grid grid-cols-2 gap-x-6 gap-y-1 font-mono text-sm text-ink sm:grid-cols-4">
-                    @foreach ($recoveryCodes as $code)<li class="select-all">{{ $code }}</li>@endforeach
-                </ul>
-            </div>
-        @endif
-    </div>
-
-    {{-- Directly under two-factor, because the two answer the same question:
-         who can get into this account, and what can I do about it. --}}
-    <div class="animate-rise [animation-delay:165ms]">
-        @livewire('sessions')
-    </div>
-
-    <form wire:submit="saveBranding" class="space-y-4 rounded-lg border border-line bg-surface p-6 shadow-xs animate-rise [animation-delay:120ms]">
-        <div>
-            <h2 class="font-semibold text-ink">{{ __('settings.branding_title') }}</h2>
-            <p class="mt-1 text-sm text-muted">{{ __('settings.branding_sub') }}</p>
-        </div>
-
-        <x-ui.input name="brandDisplayName" wire:model="brandDisplayName" :label="__('settings.brand_display_name')" :placeholder="$branding['display_name'] ?? ''" />
-
-        <div class="grid grid-cols-1 gap-4 sm:grid-cols-2">
-            <div>
-                <label class="text-sm font-medium text-body">{{ __('settings.brand_primary') }}</label>
-                <div class="mt-1.5 flex items-center gap-2">
-                    <input type="color" wire:model="brandPrimary" value="{{ $brandPrimary ?: ($branding['primary_color'] ?? '#f97316') }}" class="h-9 w-12 rounded border border-line-strong bg-surface" aria-label="{{ __('settings.brand_primary') }}" />
-                    <input type="text" wire:model="brandPrimary" placeholder="{{ $branding['primary_color'] ?? '#f97316' }}" class="w-28 rounded-md border border-line-strong bg-surface px-2.5 py-1.5 font-mono text-sm text-ink" />
-                </div>
-                @error('brandPrimary')<p class="mt-1 text-xs text-danger">{{ $message }}</p>@enderror
-            </div>
-            <div>
-                <label class="text-sm font-medium text-body">{{ __('settings.brand_accent') }}</label>
-                <div class="mt-1.5 flex items-center gap-2">
-                    <input type="color" wire:model="brandAccent" value="{{ $brandAccent ?: ($branding['accent_color'] ?? '#c2560a') }}" class="h-9 w-12 rounded border border-line-strong bg-surface" aria-label="{{ __('settings.brand_accent') }}" />
-                    <input type="text" wire:model="brandAccent" placeholder="{{ $branding['accent_color'] ?? '#c2560a' }}" class="w-28 rounded-md border border-line-strong bg-surface px-2.5 py-1.5 font-mono text-sm text-ink" />
-                </div>
-                @error('brandAccent')<p class="mt-1 text-xs text-danger">{{ $message }}</p>@enderror
-            </div>
-        </div>
-
-        <div>
-            <label class="text-sm font-medium text-body">{{ __('settings.brand_logo') }}</label>
-            <div class="mt-1.5 flex flex-wrap items-center gap-4">
-                <div class="grid size-16 place-items-center overflow-hidden rounded-lg border border-line bg-surface-2">
-                    @if ($logo)
-                        <img src="{{ $logo->temporaryUrl() }}" alt="" class="max-h-16 max-w-16 object-contain" />
-                    @elseif ($logoUrl)
-                        <img src="{{ $logoUrl }}" alt="" class="max-h-16 max-w-16 object-contain" />
-                    @else
-                        <span class="text-xs text-muted">{{ __('settings.brand_default') }}</span>
-                    @endif
-                </div>
-                <div class="flex flex-col gap-1.5">
-                    <input type="file" wire:model="logo" accept="image/png,image/webp" class="text-sm text-body file:mr-3 file:rounded-md file:border-0 file:bg-surface-2 file:px-3 file:py-1.5 file:text-sm file:font-semibold file:text-body" />
-                    <p class="text-xs text-muted">{{ __('settings.brand_logo_hint') }}</p>
-                    @if ($logoUrl)
-                        <button type="button" wire:click="removeLogo" class="self-start text-xs font-semibold text-danger hover:underline">{{ __('settings.brand_logo_remove') }}</button>
-                    @endif
-                </div>
-            </div>
-            @error('logo')<p class="mt-1 text-xs text-danger">{{ $message }}</p>@enderror
-        </div>
-
-        @if ($branding['is_default'] ?? false)
-            <p class="text-xs text-muted">{{ __('settings.brand_using_default') }}</p>
-        @endif
-
-        <div class="flex justify-end">
-            <x-ui.button variant="primary" type="submit" wire:loading.attr="disabled" wire:target="saveBranding,logo">{{ __('settings.save') }}</x-ui.button>
-        </div>
-    </form>
-
-    {{-- Package & account lifecycle --}}
-    <div class="space-y-4 rounded-lg border border-line bg-surface p-6 shadow-xs animate-rise [animation-delay:180ms]">
-        <h2 class="font-semibold text-ink">{{ __('settings.package_title') }}</h2>
-
-        @if ($cancellationScheduled)
-            <div class="flex items-start gap-3 rounded-lg border border-warning-border bg-warning-bg p-4">
-                <x-ui.icon name="alert-triangle" class="size-5 shrink-0 text-warning" />
-                <div>
-                    <p class="text-sm font-semibold text-ink">{{ __('settings.cancel_scheduled_title') }}</p>
-                    <p class="mt-0.5 text-sm text-body">{{ __('settings.cancel_scheduled_body', ['date' => $instance?->service_ends_at?->local()->isoFormat('LL')]) }}</p>
-                </div>
-            </div>
-        @elseif ($hasActivePackage)
-            <div class="flex flex-wrap items-center justify-between gap-3">
-                <p class="text-sm text-muted">{{ __('settings.package_active', ['plan' => $instance ? __('billing.plan.'.$instance->plan) : '—']) }}</p>
-                <x-ui.button variant="secondary" size="sm"
-                             x-on:click="$dispatch('openModal', { component: 'confirm-cancel-package' })">
-                    {{ __('settings.cancel_cta') }}
-                </x-ui.button>
-            </div>
-        @else
-            <p class="text-sm text-muted">{{ __('settings.no_package') }}</p>
-        @endif
-
-        {{-- The fourteen-day right of withdrawal. Shown only where it exists:
-             a business customer has none and never sees this block — and the
-             server refuses them again in Settings::withdraw(), because a card
-             that is not rendered has never stopped anybody who can post to
-             /livewire/update.
-
-             Separate from the cancellation above it, and not a variant of it.
-             A cancellation ends a contract that was validly concluded and keeps
-             the term the customer paid for; a withdrawal unwinds the contract
-             itself, ends the service the same day and sends the money back. --}}
-        @if ($withdrawal->applies && $withdrawal->open)
-            <div class="border-t border-line pt-4">
-                <div class="flex flex-wrap items-center justify-between gap-3">
-                    <div>
-                        <p class="text-sm font-semibold text-ink">{{ __('withdrawal.card_title') }}</p>
-                        <p class="mt-0.5 max-w-xl text-sm text-muted">
-                            {{ __('withdrawal.card_sub', [
-                                'date' => $withdrawal->endsAt->local()->isoFormat('LL'),
-                                'days' => $withdrawal->daysLeft(),
-                            ]) }}
+                {{-- A FACT for a record that has one. It decides the fourteen-day
+                     right of withdrawal: a business able to set itself to
+                     "Privatperson" here is a business able to withdraw from a
+                     contract it may not withdraw from. Registration asks; this
+                     page reports. The lock is in Settings::saveProfile, not here
+                     — a form that only hides a control has never stopped anybody
+                     who can post to /livewire/update. --}}
+                <x-ui.row :label="__('settings.customer_type')"
+                          :hint="$customer?->customer_type ? __('settings.customer_type_locked') : __('settings.customer_type_once')">
+                    @if ($customer?->customer_type)
+                        <p class="flex items-center gap-2 py-2 text-sm font-semibold text-ink">
+                            <x-ui.icon name="lock" class="size-4 text-muted" />
+                            {{ __('settings.customer_type_'.$customer->customer_type) }}
                         </p>
-                    </div>
-                    <x-ui.button variant="secondary" size="sm"
-                                 x-on:click="$dispatch('openModal', { component: 'confirm-withdraw' })">
-                        {{ __('withdrawal.cta') }}
-                    </x-ui.button>
-                </div>
-            </div>
-        @endif
+                    @else
+                        <div class="flex flex-wrap gap-2">
+                            @foreach ($customerTypes as $type)
+                                <label class="flex cursor-pointer items-center gap-2 rounded border border-line-strong bg-surface px-3 py-2 text-sm text-ink transition has-[:checked]:border-ink">
+                                    <input type="radio" wire:model="customerType" value="{{ $type }}"
+                                           class="size-4 shrink-0 border-line text-ink" />
+                                    {{ __('settings.customer_type_'.$type) }}
+                                </label>
+                            @endforeach
+                        </div>
+                        @error('customerType')<p class="mt-1.5 text-xs text-danger">{{ $message }}</p>@enderror
+                    @endif
+                </x-ui.row>
 
-        <div class="border-t border-line pt-4">
-            <div class="flex flex-wrap items-center justify-between gap-3">
-                <div>
-                    <p class="text-sm font-semibold text-ink">{{ __('settings.close_account_title') }}</p>
-                    <p class="mt-0.5 text-sm text-muted">{{ __('settings.close_account_sub') }}</p>
-                </div>
-                <x-ui.button variant="secondary" size="sm"
-                             x-on:click="$dispatch('openModal', { component: 'confirm-close-account' })">
-                    {{ __('settings.close_cta') }}
-                </x-ui.button>
-            </div>
+                <x-slot:footer>
+                    <x-ui.button variant="primary" type="submit" wire:loading.attr="disabled" wire:target="saveProfile">
+                        {{ __('settings.save') }}
+                    </x-ui.button>
+                </x-slot:footer>
+            </x-ui.panel>
+        </form>
+    @endif
+
+    {{-- ══ Sicherheit ═══════════════════════════════════════════════════════ --}}
+    @if ($tab === 'security')
+        <div class="space-y-5 animate-rise [animation-delay:60ms]">
+
+            {{-- Own password. There was no way to change one at all — Fortify's
+                 updatePasswords feature was switched off. --}}
+            <form wire:submit="updateOwnPassword">
+                <x-ui.panel :title="__('admin_settings.password_title')" :subtitle="__('admin_settings.password_sub')">
+                    <x-ui.row :label="__('admin_settings.password_current')" for="currentPassword">
+                        <x-ui.input name="currentPassword" type="password" autocomplete="current-password" wire:model="currentPassword" />
+                    </x-ui.row>
+                    <x-ui.row :label="__('admin_settings.password_new')" for="newPassword">
+                        <div class="grid gap-3 sm:grid-cols-2">
+                            <x-ui.input name="newPassword" type="password" autocomplete="new-password" wire:model="newPassword" />
+                            <x-ui.input name="newPasswordConfirmation" type="password" autocomplete="new-password"
+                                        :placeholder="__('admin_settings.password_repeat')" wire:model="newPasswordConfirmation" />
+                        </div>
+                    </x-ui.row>
+
+                    <x-slot:footer>
+                        <x-ui.button type="submit" variant="primary" wire:loading.attr="disabled" wire:target="updateOwnPassword">
+                            {{ __('admin_settings.password_save') }}
+                        </x-ui.button>
+                    </x-slot:footer>
+                </x-ui.panel>
+            </form>
+
+            {{-- Two-factor. Every action is re-checked server-side against a
+                 recent password confirmation — hiding the buttons stops nobody
+                 who can post to /livewire/update. --}}
+            <x-ui.panel>
+                <x-slot:header>
+                    <div class="min-w-0">
+                        <div class="flex flex-wrap items-center gap-2">
+                            <h2 class="text-sm font-bold text-ink">{{ __('settings.twofa_title') }}</h2>
+                            <span class="inline-flex items-center gap-1.5 rounded-pill border px-2.5 py-0.5 text-xs font-medium
+                                  {{ $twoFactorOn ? 'border-success-border bg-success-bg text-success' : 'border-line-strong bg-surface-2 text-muted' }}">
+                                <span class="size-1.5 rounded-pill bg-current" aria-hidden="true"></span>
+                                {{ $twoFactorOn ? __('settings.twofa_state_on') : __('settings.twofa_state_off') }}
+                            </span>
+                        </div>
+                        <p class="mt-0.5 max-w-[76ch] text-sm leading-relaxed text-muted">{{ __('settings.twofa_sub') }}</p>
+                    </div>
+                </x-slot:header>
+
+                @if (! $passwordConfirmed)
+                    {{-- The gate. A signed-in session is not enough to change how
+                         the account is protected — the risk is an unlocked
+                         machine. --}}
+                    <form wire:submit="confirmPassword">
+                        <x-ui.row :label="__('admin_settings.password_current')" :hint="__('settings.twofa_confirm_first')" for="confirmablePassword">
+                            <div class="flex flex-wrap items-start gap-2">
+                                <div class="min-w-56 flex-1">
+                                    <x-ui.input name="confirmablePassword" type="password" autocomplete="current-password" wire:model="confirmablePassword" />
+                                </div>
+                                <x-ui.button type="submit" variant="secondary" wire:loading.attr="disabled" wire:target="confirmPassword">
+                                    {{ __('settings.twofa_confirm_button') }}
+                                </x-ui.button>
+                            </div>
+                        </x-ui.row>
+                    </form>
+                @elseif ($twoFactorOn)
+                    <x-ui.row :label="__('settings.twofa_state_on')" :hint="__('settings.twofa_codes_hint')">
+                        <div class="flex flex-wrap gap-2">
+                            <x-ui.button variant="secondary" wire:click="regenerateRecoveryCodes" wire:loading.attr="disabled" wire:target="regenerateRecoveryCodes">
+                                {{ __('settings.twofa_new_codes') }}
+                            </x-ui.button>
+                            <x-ui.button variant="danger"
+                                         x-on:click="$dispatch('openModal', { component: 'confirm-disable-two-factor' })">
+                                {{ __('settings.twofa_disable') }}
+                            </x-ui.button>
+                        </div>
+                    </x-ui.row>
+                @elseif ($twoFactorPending)
+                    <x-ui.row :label="__('settings.twofa_scan')">
+                        <div class="flex flex-wrap items-start gap-5">
+                            <div class="rounded border border-line bg-white p-3">{!! $twoFactorQr !!}</div>
+                            <form wire:submit="confirmTwoFactor" class="space-y-3">
+                                <div class="max-w-48">
+                                    <x-ui.input name="twoFactorCode" inputmode="numeric" autocomplete="one-time-code"
+                                                :label="__('settings.twofa_code')" wire:model="twoFactorCode" />
+                                </div>
+                                <x-ui.button type="submit" variant="primary" wire:loading.attr="disabled" wire:target="confirmTwoFactor">
+                                    {{ __('settings.twofa_activate') }}
+                                </x-ui.button>
+                            </form>
+                        </div>
+                    </x-ui.row>
+                @else
+                    <x-ui.row :label="__('settings.twofa_state_off')">
+                        <x-ui.button variant="primary" wire:click="enableTwoFactor" wire:loading.attr="disabled" wire:target="enableTwoFactor">
+                            {{ __('settings.twofa_enable') }}
+                        </x-ui.button>
+                    </x-ui.row>
+                @endif
+
+                @if ($recoveryCodes)
+                    {{-- Shown once, on purpose: nobody writes down what they were
+                         never shown, and these are the way back in when the phone
+                         is gone. --}}
+                    <x-ui.row :label="__('settings.twofa_codes_title')" :hint="__('settings.twofa_codes_hint')">
+                        <ul class="grid grid-cols-2 gap-x-6 gap-y-1 rounded border border-warning-border bg-warning-bg p-4 font-mono text-sm text-ink sm:grid-cols-3">
+                            @foreach ($recoveryCodes as $code)<li class="select-all">{{ $code }}</li>@endforeach
+                        </ul>
+                    </x-ui.row>
+                @endif
+            </x-ui.panel>
+
+            {{-- The devices. It answers the same question two-factor does — who
+                 can get into this account — and it is a table of its own. --}}
+            @livewire('sessions')
         </div>
-    </div>
+    @endif
+
+    {{-- ══ Erscheinungsbild ═════════════════════════════════════════════════ --}}
+    @if ($tab === 'branding')
+        <form wire:submit="saveBranding" class="space-y-5 animate-rise [animation-delay:60ms]">
+            <x-ui.panel :title="__('settings.branding_title')" :subtitle="__('settings.branding_sub')">
+                <x-ui.row :label="__('settings.brand_display_name')" for="brandDisplayName">
+                    <x-ui.input name="brandDisplayName" wire:model="brandDisplayName" :placeholder="$branding['display_name'] ?? ''" />
+                </x-ui.row>
+
+                <x-ui.row :label="__('settings.brand_primary')">
+                    <div class="flex items-center gap-2">
+                        <input type="color" wire:model="brandPrimary" value="{{ $brandPrimary ?: ($branding['primary_color'] ?? '#f97316') }}"
+                               class="h-10 w-14 rounded border border-line-strong bg-surface" aria-label="{{ __('settings.brand_primary') }}" />
+                        <input type="text" wire:model="brandPrimary" placeholder="{{ $branding['primary_color'] ?? '#f97316' }}"
+                               class="w-32 rounded border border-line-strong bg-surface px-3 py-2.5 font-mono text-sm text-ink" />
+                    </div>
+                    @error('brandPrimary')<p class="mt-1.5 text-xs text-danger">{{ $message }}</p>@enderror
+                </x-ui.row>
+
+                <x-ui.row :label="__('settings.brand_accent')">
+                    <div class="flex items-center gap-2">
+                        <input type="color" wire:model="brandAccent" value="{{ $brandAccent ?: ($branding['accent_color'] ?? '#c2560a') }}"
+                               class="h-10 w-14 rounded border border-line-strong bg-surface" aria-label="{{ __('settings.brand_accent') }}" />
+                        <input type="text" wire:model="brandAccent" placeholder="{{ $branding['accent_color'] ?? '#c2560a' }}"
+                               class="w-32 rounded border border-line-strong bg-surface px-3 py-2.5 font-mono text-sm text-ink" />
+                    </div>
+                    @error('brandAccent')<p class="mt-1.5 text-xs text-danger">{{ $message }}</p>@enderror
+                </x-ui.row>
+
+                <x-ui.row :label="__('settings.brand_logo')" :hint="__('settings.brand_logo_hint')">
+                    <div class="flex flex-wrap items-center gap-4">
+                        <div class="grid size-20 shrink-0 place-items-center overflow-hidden rounded border border-line bg-surface-2">
+                            @if ($logo)
+                                <img src="{{ $logo->temporaryUrl() }}" alt="" class="max-h-20 max-w-20 object-contain" />
+                            @elseif ($logoUrl)
+                                <img src="{{ $logoUrl }}" alt="" class="max-h-20 max-w-20 object-contain" />
+                            @else
+                                <span class="px-2 text-center text-xs text-muted">{{ __('settings.brand_default') }}</span>
+                            @endif
+                        </div>
+                        <div class="min-w-0 flex-1 space-y-2">
+                            <input type="file" wire:model="logo" accept="image/png,image/webp"
+                                   class="w-full text-sm text-body file:mr-3 file:rounded file:border-0 file:bg-surface-2 file:px-3 file:py-1.5 file:text-sm file:font-semibold file:text-body" />
+                            @if ($logoUrl)
+                                <button type="button" wire:click="removeLogo" class="text-xs font-semibold text-danger hover:underline">{{ __('settings.brand_logo_remove') }}</button>
+                            @endif
+                            @error('logo')<p class="text-xs text-danger">{{ $message }}</p>@enderror
+                        </div>
+                    </div>
+                </x-ui.row>
+
+                <x-slot:footer>
+                    @if ($branding['is_default'] ?? false)
+                        <p class="mr-auto text-xs text-muted">{{ __('settings.brand_using_default') }}</p>
+                    @endif
+                    <x-ui.button variant="primary" type="submit" wire:loading.attr="disabled" wire:target="saveBranding,logo">
+                        {{ __('settings.save') }}
+                    </x-ui.button>
+                </x-slot:footer>
+            </x-ui.panel>
+        </form>
+    @endif
+
+    {{-- ══ Vertrag ══════════════════════════════════════════════════════════ --}}
+    @if ($tab === 'contract')
+        <div class="space-y-5 animate-rise [animation-delay:60ms]">
+
+            <x-ui.panel :title="__('settings.contract_title')" :subtitle="__('settings.contract_sub')">
+
+                {{-- The package, and the way out of it. --}}
+                <x-ui.row :label="__('settings.package_title')">
+                    <div class="flex flex-wrap items-center justify-between gap-3">
+                        <p class="min-w-0 text-sm text-body">
+                            @if ($cancellationScheduled)
+                                {{ __('settings.cancel_scheduled_body', ['date' => $instance?->service_ends_at?->local()->isoFormat('LL')]) }}
+                            @elseif ($hasActivePackage)
+                                {{ __('settings.package_active', ['plan' => $instance ? __('billing.plan.'.$instance->plan) : '—']) }}
+                            @else
+                                {{ __('settings.no_package') }}
+                            @endif
+                        </p>
+
+                        @if ($hasActivePackage && ! $cancellationScheduled)
+                            <x-ui.button variant="secondary" size="sm"
+                                         x-on:click="$dispatch('openModal', { component: 'confirm-cancel-package' })">
+                                {{ __('settings.cancel_cta') }}
+                            </x-ui.button>
+                        @elseif (! $hasActivePackage && ! $cancellationScheduled)
+                            <x-ui.button :href="route('order')" variant="secondary" size="sm" wire:navigate>
+                                {{ __('settings.to_packages') }}
+                            </x-ui.button>
+                        @endif
+                    </div>
+                </x-ui.row>
+
+                {{-- ── Das Widerrufsrecht ────────────────────────────────────
+                     Shown to every CONSUMER with a contract, open or not — not
+                     only while it is open. It vanished entirely once the
+                     fourteen days ran out, which is indistinguishable from a
+                     feature that was never built: the owner went looking for it
+                     and reported it missing from an account that has no contract
+                     at all, so there was nothing for it to be about.
+
+                     A business never sees it, and the server refuses them again
+                     in Settings::withdraw() — a card that is not rendered has
+                     never stopped anybody who can post to /livewire/update.
+
+                     Not a variant of the cancellation above: that one ends a
+                     contract validly concluded and keeps the term already paid
+                     for; this one unwinds the contract, ends the service the same
+                     day and sends the whole amount back. --}}
+                @if ($withdrawal->applies)
+                    <x-ui.row :label="__('withdrawal.card_title')">
+                        <div class="flex flex-wrap items-center justify-between gap-3">
+                            <p class="min-w-0 max-w-[70ch] text-sm text-body">
+                                @if ($withdrawal->open)
+                                    {{ __('withdrawal.card_sub', [
+                                        'date' => $withdrawal->endsAt->local()->isoFormat('LL'),
+                                        'days' => $withdrawal->daysLeft(),
+                                    ]) }}
+                                @else
+                                    {{ $withdrawal->refusal }}
+                                @endif
+                            </p>
+                            @if ($withdrawal->open)
+                                <x-ui.button variant="secondary" size="sm"
+                                             x-on:click="$dispatch('openModal', { component: 'confirm-withdraw' })">
+                                    {{ __('withdrawal.cta') }}
+                                </x-ui.button>
+                            @endif
+                        </div>
+                    </x-ui.row>
+                @endif
+
+                {{-- ── AV-Vertrag & TOM ──────────────────────────────────────
+                     Art. 28 DSGVO wants a contract wherever personal data is
+                     processed on somebody else's behalf. It is concluded WITH the
+                     terms at checkout (see the AGB), so this is not a second
+                     signing ceremony: the document has to be available, current
+                     and retrievable. The extra confirmation is offered because a
+                     practice or a firm that gets audited often wants one on file.
+
+                     Nothing renders until an operator has published a version. --}}
+                @if ($dpa !== null)
+                    <x-ui.row :label="__('dpa.title')" :hint="__('dpa.sub')">
+                        <div class="space-y-3">
+                            <div class="flex flex-wrap items-center gap-2">
+                                <x-ui.button :href="route('dpa.file', 'agreement')" variant="secondary" size="sm" target="_blank">
+                                    <x-ui.icon name="file-text" class="size-4" />{{ __('dpa.read_agreement') }}
+                                </x-ui.button>
+                                <x-ui.button :href="route('dpa.file', ['which' => 'agreement', 'download' => 1])" variant="ghost" size="sm" download>
+                                    <x-ui.icon name="download" class="size-4" />{{ __('dpa.download') }}
+                                </x-ui.button>
+                                @if ($dpa->measures_path)
+                                    <span class="mx-1 h-4 w-px bg-line" aria-hidden="true"></span>
+                                    <x-ui.button :href="route('dpa.file', 'measures')" variant="secondary" size="sm" target="_blank">
+                                        <x-ui.icon name="shield" class="size-4" />{{ __('dpa.read_measures') }}
+                                    </x-ui.button>
+                                    <x-ui.button :href="route('dpa.file', ['which' => 'measures', 'download' => 1])" variant="ghost" size="sm" download>
+                                        <x-ui.icon name="download" class="size-4" />{{ __('dpa.download') }}
+                                    </x-ui.button>
+                                @endif
+                                <span class="ml-auto font-mono text-xs text-muted">{{ __('dpa.version', ['version' => $dpa->version]) }}</span>
+                            </div>
+
+                            @if ($dpaAcceptance)
+                                {{-- R19: stored in UTC, read on the wall clock. --}}
+                                <p class="flex items-start gap-2 text-xs leading-relaxed text-muted">
+                                    <x-ui.icon name="check" class="mt-0.5 size-3.5 shrink-0 text-success" />
+                                    {{ __('dpa.accepted_on', [
+                                        'version' => $dpa->version,
+                                        'when' => $dpaAcceptance->accepted_at->local()->isoFormat('LL, LT'),
+                                    ]) }}
+                                </p>
+                            @else
+                                <div class="flex flex-wrap items-center justify-between gap-3 rounded border border-line bg-surface-2 px-4 py-3">
+                                    <p class="min-w-0 max-w-[70ch] text-xs leading-relaxed text-muted">{{ __('dpa.in_force_note') }}</p>
+                                    <x-ui.button variant="secondary" size="sm"
+                                                 wire:click="acceptProcessingAgreement" wire:loading.attr="disabled" wire:target="acceptProcessingAgreement">
+                                        {{ __('dpa.accept_cta') }}
+                                    </x-ui.button>
+                                </div>
+                            @endif
+                        </div>
+                    </x-ui.row>
+                @endif
+
+                {{-- Closing the account. Last row of the panel, where the
+                     irreversible things belong. --}}
+                <x-ui.row :label="__('settings.close_account_title')" :hint="__('settings.close_account_sub')">
+                    <div class="flex justify-start sm:justify-end">
+                        <x-ui.button variant="secondary" size="sm"
+                                     x-on:click="$dispatch('openModal', { component: 'confirm-close-account' })">
+                            {{ __('settings.close_cta') }}
+                        </x-ui.button>
+                    </div>
+                </x-ui.row>
+            </x-ui.panel>
+
+            {{-- The deadlines, said where somebody asks the question. "Nach fünf
+                 Tagen gelöscht" on the verification page reads as if it applied
+                 to every account; it applies to a registration nobody confirmed.
+                 The other rule — a year without a package — was nowhere at all.
+                 Both come from the commands that enforce them, so the page cannot
+                 drift from what actually happens. --}}
+            <x-ui.panel :title="__('settings.lifecycle_title')">
+                <div class="px-6 py-4">
+                    <ul class="space-y-1.5 text-sm leading-relaxed text-muted">
+                        <li>{{ __('settings.lifecycle_unverified', ['days' => App\Console\Commands\PruneUnverifiedAccounts::AFTER_DAYS]) }}</li>
+                        <li>{{ __('settings.lifecycle_dormant', ['warn' => App\Console\Commands\PruneDormantAccounts::WARN_DAYS_BEFORE]) }}</li>
+                        <li>{{ __('settings.lifecycle_kept') }}</li>
+                    </ul>
+                    <a href="{{ route('legal.agb') }}" target="_blank" rel="noopener"
+                       class="mt-3 inline-block text-sm font-medium text-accent-text underline-offset-4 hover:underline">
+                        {{ __('settings.lifecycle_terms') }}
+                    </a>
+                </div>
+            </x-ui.panel>
+        </div>
+    @endif
 </div>
diff --git a/resources/views/mail/cloud-ready.blade.php b/resources/views/mail/cloud-ready.blade.php
index a2cab14..643e016 100644
--- a/resources/views/mail/cloud-ready.blade.php
+++ b/resources/views/mail/cloud-ready.blade.php
@@ -4,14 +4,14 @@
     :greeting="$name ? __('provisioning.mail.ready_greeting_name', ['name' => $name]) : null"
 >
 
-<tr><td style="padding:0 40px 24px 40px;">
+<tr><td style="padding:0 24px 24px 24px;">
     <p style="margin:0;font-size:15px;line-height:24px;color:#43434e;">{{ __('provisioning.mail.ready_line') }}</p>
 </td></tr>
 
 {{-- What was actually built, as a table. Somebody who ordered a fortnight ago
      is checking this against what they bought, and that is a comparison
      rather than a sentence. --}}
-<tr><td style="padding:0 40px;">
+<tr><td style="padding:0 24px;">
     <table role="presentation" width="100%" cellpadding="0" cellspacing="0" border="0" style="border-collapse:collapse;background-color:#fafafb;border:1px solid #e9e9ee;border-radius:8px;">
         <tr>
             <td style="padding:14px 16px 6px 16px;font-size:13px;line-height:20px;color:#6e6e7a;width:34%;">{{ __('provisioning.mail.field_address') }}</td>
@@ -36,7 +36,7 @@
      recipient to hunt for one. It used to travel in this mail: across
      third-party mail servers, then sitting in an inbox for ever. It now waits
      behind the sign-in and is deleted once acknowledged. --}}
-<tr><td style="padding:24px 40px 0 40px;">
+<tr><td style="padding:24px 24px 0 24px;">
     <p style="margin:0 0 16px 0;font-size:15px;line-height:24px;color:#43434e;">{{ __('provisioning.mail.ready_credentials') }}</p>
     <table role="presentation" cellpadding="0" cellspacing="0" border="0" style="border-collapse:collapse;">
         <tr><td align="center" bgcolor="#b8500a" style="background-color:#b8500a;border-radius:8px;">
@@ -45,7 +45,7 @@
     </table>
 </td></tr>
 
-<tr><td style="padding:24px 40px 32px 40px;">
+<tr><td style="padding:24px 24px 32px 24px;">
     <table role="presentation" width="100%" cellpadding="0" cellspacing="0" border="0" style="border-collapse:collapse;">
         <tr><td style="border-top:1px solid #e9e9ee;padding-top:20px;">
             <p style="margin:0;font-size:13px;line-height:20px;color:#6e6e7a;">{{ __('provisioning.mail.ready_help') }}</p>
diff --git a/resources/views/mail/dormant-warning.blade.php b/resources/views/mail/dormant-warning.blade.php
new file mode 100644
index 0000000..8ac3143
--- /dev/null
+++ b/resources/views/mail/dormant-warning.blade.php
@@ -0,0 +1,34 @@
+<x-mail.layout
+    :heading="__('dormant_mail.heading')"
+    :preheader="__('dormant_mail.preheader', ['days' => $days])"
+    :greeting="$name !== '' ? __('dormant_mail.greeting', ['name' => $name]) : null"
+>
+
+<tr><td style="padding:0 24px 20px 24px;">
+    <p style="margin:0;font-size:15px;line-height:24px;color:#43434e;">{{ __('dormant_mail.intro', ['days' => $days]) }}</p>
+</td></tr>
+
+{{-- The one thing that stops it. A single button, because there is exactly one
+     action and asking somebody to "log in or place an order or write to us"
+     leaves them deciding which. --}}
+<tr><td style="padding:0 24px;">
+    <p style="margin:0 0 16px 0;font-size:15px;line-height:24px;color:#43434e;">{{ __('dormant_mail.how_to_keep') }}</p>
+    <table role="presentation" cellpadding="0" cellspacing="0" border="0" style="border-collapse:collapse;">
+        <tr><td align="center" bgcolor="#b8500a" style="background-color:#b8500a;border-radius:8px;">
+            <a href="{{ $loginUrl }}" style="display:inline-block;padding:13px 26px;font-family:'IBM Plex Sans',-apple-system,Helvetica,Arial,sans-serif;font-size:15px;line-height:20px;font-weight:600;color:#ffffff;text-decoration:none;border-radius:8px;">{{ __('dormant_mail.action') }}</a>
+        </td></tr>
+    </table>
+</td></tr>
+
+<tr><td style="padding:24px 24px 32px 24px;">
+    <table role="presentation" width="100%" cellpadding="0" cellspacing="0" border="0" style="border-collapse:collapse;">
+        <tr><td style="border-top:1px solid #e9e9ee;padding-top:20px;">
+            {{-- Said out loud: nothing is lost, because there was never anything
+                 to lose. Somebody who reads "your account will be deleted" and
+                 owns nothing still wonders about invoices and files. --}}
+            <p style="margin:0;font-size:13px;line-height:20px;color:#6e6e7a;">{{ __('dormant_mail.nothing_lost') }}</p>
+        </td></tr>
+    </table>
+</td></tr>
+
+</x-mail.layout>
diff --git a/resources/views/mail/invoice.blade.php b/resources/views/mail/invoice.blade.php
index aec1f33..5d61454 100644
--- a/resources/views/mail/invoice.blade.php
+++ b/resources/views/mail/invoice.blade.php
@@ -4,11 +4,11 @@
     :greeting="$name ? __('invoice_mail.greeting', ['name' => $name]) : null"
 >
 
-<tr><td style="padding:0 40px 24px 40px;">
+<tr><td style="padding:0 24px 24px 24px;">
     <p style="margin:0;font-size:15px;line-height:24px;color:#43434e;">{{ __('invoice_mail.intro') }}</p>
 </td></tr>
 
-<tr><td style="padding:0 40px;">
+<tr><td style="padding:0 24px;">
     <table role="presentation" width="100%" cellpadding="0" cellspacing="0" border="0" style="border-collapse:collapse;background-color:#fafafb;border:1px solid #e9e9ee;border-radius:8px;">
         <tr>
             <td style="padding:14px 16px 6px 16px;font-size:13px;line-height:20px;color:#6e6e7a;width:38%;">{{ __('invoice_mail.field_number') }}</td>
@@ -32,12 +32,12 @@
 </td></tr>
 
 @if ($paymentTerms)
-<tr><td style="padding:20px 40px 0 40px;">
+<tr><td style="padding:20px 24px 0 24px;">
     <p style="margin:0;font-size:15px;line-height:24px;color:#43434e;">{{ $paymentTerms }}</p>
 </td></tr>
 @endif
 
-<tr><td style="padding:24px 40px 0 40px;">
+<tr><td style="padding:24px 24px 0 24px;">
     <table role="presentation" cellpadding="0" cellspacing="0" border="0" style="border-collapse:collapse;">
         <tr><td align="center" bgcolor="#b8500a" style="background-color:#b8500a;border-radius:8px;">
             <a href="{{ $invoicesUrl }}" style="display:inline-block;padding:13px 26px;font-family:'IBM Plex Sans',-apple-system,Helvetica,Arial,sans-serif;font-size:15px;line-height:20px;font-weight:600;color:#ffffff;text-decoration:none;border-radius:8px;">{{ __('invoice_mail.action') }}</a>
@@ -45,7 +45,7 @@
     </table>
 </td></tr>
 
-<tr><td style="padding:24px 40px 32px 40px;">
+<tr><td style="padding:24px 24px 32px 24px;">
     <table role="presentation" width="100%" cellpadding="0" cellspacing="0" border="0" style="border-collapse:collapse;">
         <tr><td style="border-top:1px solid #e9e9ee;padding-top:20px;">
             <p style="margin:0;font-size:13px;line-height:20px;color:#6e6e7a;">{{ __('invoice_mail.attached') }}</p>
diff --git a/resources/views/mail/maintenance-announcement.blade.php b/resources/views/mail/maintenance-announcement.blade.php
index a355b27..b735c70 100644
--- a/resources/views/mail/maintenance-announcement.blade.php
+++ b/resources/views/mail/maintenance-announcement.blade.php
@@ -4,14 +4,14 @@
     :greeting="__('maintenance.mail_greeting', ['name' => $name])"
 >
 
-<tr><td style="padding:0 40px 20px 40px;">
+<tr><td style="padding:0 24px 20px 24px;">
     <p style="margin:0;font-size:15px;line-height:24px;color:#17171c;font-weight:600;">{{ $title }}</p>
 </td></tr>
 
 {{-- The window as its own block rather than inside a sentence. The one thing
      the reader is looking for is when, and a date buried in prose has to be
      found before it can be read. --}}
-<tr><td style="padding:0 40px;">
+<tr><td style="padding:0 24px;">
     <table role="presentation" width="100%" cellpadding="0" cellspacing="0" border="0" style="border-collapse:collapse;background-color:#fafafb;border:1px solid #e9e9ee;border-radius:8px;">
         <tr>
             <td style="padding:14px 16px 6px 16px;font-size:13px;line-height:20px;color:#6e6e7a;width:26%;">{{ __('maintenance.mail_field_start') }}</td>
@@ -25,12 +25,12 @@
 </td></tr>
 
 @if ($description)
-<tr><td style="padding:20px 40px 0 40px;">
+<tr><td style="padding:20px 24px 0 24px;">
     <p style="margin:0;font-size:15px;line-height:24px;color:#43434e;">{{ $description }}</p>
 </td></tr>
 @endif
 
-<tr><td style="padding:24px 40px 32px 40px;">
+<tr><td style="padding:24px 24px 32px 24px;">
     <table role="presentation" width="100%" cellpadding="0" cellspacing="0" border="0" style="border-collapse:collapse;">
         <tr><td style="border-top:1px solid #e9e9ee;padding-top:20px;">
             <p style="margin:0;font-size:13px;line-height:20px;color:#6e6e7a;">{{ __('maintenance.mail_no_action') }}</p>
diff --git a/resources/views/mail/maintenance-cancelled.blade.php b/resources/views/mail/maintenance-cancelled.blade.php
index 4f611aa..829b490 100644
--- a/resources/views/mail/maintenance-cancelled.blade.php
+++ b/resources/views/mail/maintenance-cancelled.blade.php
@@ -4,7 +4,7 @@
     :greeting="__('maintenance.mail_greeting', ['name' => $name])"
 >
 
-<tr><td style="padding:0 40px 32px 40px;">
+<tr><td style="padding:0 24px 32px 24px;">
     <p style="margin:0;font-size:15px;line-height:24px;color:#43434e;">{{ __('maintenance.mail_cancel_body', ['title' => $title]) }}</p>
 </td></tr>
 
diff --git a/resources/views/mail/new-device.blade.php b/resources/views/mail/new-device.blade.php
index 023c556..01fd013 100644
--- a/resources/views/mail/new-device.blade.php
+++ b/resources/views/mail/new-device.blade.php
@@ -4,13 +4,13 @@
     :greeting="$name !== '' ? __('devices.mail_greeting', ['name' => $name]) : null"
 >
 
-<tr><td style="padding:0 40px 24px 40px;">
+<tr><td style="padding:0 24px 24px 24px;">
     <p style="margin:0;font-size:15px;line-height:24px;color:#43434e;">{{ __('devices.mail_intro') }}</p>
 </td></tr>
 
 {{-- The facts, as a table rather than a sentence: the reader is checking
      whether this was them, and that is a comparison, not a story. --}}
-<tr><td style="padding:0 40px;">
+<tr><td style="padding:0 24px;">
     <table role="presentation" width="100%" cellpadding="0" cellspacing="0" border="0" style="border-collapse:collapse;background-color:#fafafb;border:1px solid #e9e9ee;border-radius:8px;">
         <tr>
             <td style="padding:14px 16px 6px 16px;font-size:13px;line-height:20px;color:#6e6e7a;width:38%;">{{ __('devices.field_device') }}</td>
@@ -27,7 +27,7 @@
     </table>
 </td></tr>
 
-<tr><td style="padding:24px 40px 0 40px;">
+<tr><td style="padding:24px 24px 0 24px;">
     <p style="margin:0 0 16px 0;font-size:15px;line-height:24px;color:#43434e;">{{ __('devices.mail_if_you') }}</p>
     <table role="presentation" cellpadding="0" cellspacing="0" border="0" style="border-collapse:collapse;">
         <tr><td align="center" bgcolor="#b8500a" style="background-color:#b8500a;border-radius:8px;">
@@ -36,7 +36,7 @@
     </table>
 </td></tr>
 
-<tr><td style="padding:24px 40px 32px 40px;">
+<tr><td style="padding:24px 24px 32px 24px;">
     <table role="presentation" width="100%" cellpadding="0" cellspacing="0" border="0" style="border-collapse:collapse;">
         <tr><td style="border-top:1px solid #e9e9ee;padding-top:20px;">
             <p style="margin:0;font-size:13px;line-height:20px;color:#6e6e7a;">{{ __('devices.mail_false_alarm') }}</p>
diff --git a/resources/views/mail/operator-message.blade.php b/resources/views/mail/operator-message.blade.php
index c3b310a..66b0208 100644
--- a/resources/views/mail/operator-message.blade.php
+++ b/resources/views/mail/operator-message.blade.php
@@ -4,7 +4,7 @@
     :greeting="__('customer_message.mail_greeting', ['name' => $name])"
 >
 
-<tr><td style="padding:0 40px 32px 40px;">
+<tr><td style="padding:0 24px 32px 24px;">
     {{-- The operator's own words, as they typed them. nl2br over an escaped
          string, never {!! !!}: this text comes out of a form, and a message
          somebody pastes in must not be able to bring markup into a mail we
diff --git a/resources/views/mail/order-confirmation.blade.php b/resources/views/mail/order-confirmation.blade.php
index 354cae4..9a92f47 100644
--- a/resources/views/mail/order-confirmation.blade.php
+++ b/resources/views/mail/order-confirmation.blade.php
@@ -4,11 +4,11 @@
     :greeting="$name ? __('orders.mail_greeting', ['name' => $name]) : null"
 >
 
-<tr><td style="padding:0 40px 24px 40px;">
+<tr><td style="padding:0 24px 24px 24px;">
     <p style="margin:0;font-size:15px;line-height:24px;color:#43434e;">{{ __('orders.mail_intro') }}</p>
 </td></tr>
 
-<tr><td style="padding:0 40px;">
+<tr><td style="padding:0 24px;">
     <table role="presentation" width="100%" cellpadding="0" cellspacing="0" border="0" style="border-collapse:collapse;background-color:#fafafb;border:1px solid #e9e9ee;border-radius:8px;">
         <tr>
             <td style="padding:14px 16px 6px 16px;font-size:13px;line-height:20px;color:#6e6e7a;width:34%;">{{ __('orders.field_product') }}</td>
@@ -32,7 +32,7 @@
 {{-- What happens next, without naming a time. Provisioning takes as long as it
      takes and CloudReady announces the end of it; a promised minute that slips
      is worse than no promise. --}}
-<tr><td style="padding:24px 40px 0 40px;">
+<tr><td style="padding:24px 24px 0 24px;">
     <p style="margin:0 0 16px 0;font-size:15px;line-height:24px;color:#43434e;">{{ __('orders.mail_next') }}</p>
     <table role="presentation" cellpadding="0" cellspacing="0" border="0" style="border-collapse:collapse;">
         <tr><td align="center" bgcolor="#b8500a" style="background-color:#b8500a;border-radius:8px;">
@@ -41,7 +41,7 @@
     </table>
 </td></tr>
 
-<tr><td style="padding:24px 40px 32px 40px;">
+<tr><td style="padding:24px 24px 32px 24px;">
     <table role="presentation" width="100%" cellpadding="0" cellspacing="0" border="0" style="border-collapse:collapse;">
         <tr><td style="border-top:1px solid #e9e9ee;padding-top:20px;">
             <p style="margin:0;font-size:13px;line-height:20px;color:#6e6e7a;">{{ __('orders.mail_help') }}</p>
diff --git a/resources/views/mail/reset-password.blade.php b/resources/views/mail/reset-password.blade.php
index 8293742..67012fd 100644
--- a/resources/views/mail/reset-password.blade.php
+++ b/resources/views/mail/reset-password.blade.php
@@ -4,11 +4,11 @@
     :greeting="$name ? __('reset_password.greeting', ['name' => $name]) : null"
 >
 
-<tr><td style="padding:0 40px 24px 40px;">
+<tr><td style="padding:0 24px 24px 24px;">
     <p style="margin:0;font-size:15px;line-height:24px;color:#43434e;">{{ __('reset_password.intro') }}</p>
 </td></tr>
 
-<tr><td style="padding:0 40px;">
+<tr><td style="padding:0 24px;">
     <table role="presentation" cellpadding="0" cellspacing="0" border="0" style="border-collapse:collapse;">
         <tr><td align="center" bgcolor="#b8500a" style="background-color:#b8500a;border-radius:8px;">
             <a href="{{ $url }}" style="display:inline-block;padding:13px 26px;font-family:'IBM Plex Sans',-apple-system,Helvetica,Arial,sans-serif;font-size:15px;line-height:20px;font-weight:600;color:#ffffff;text-decoration:none;border-radius:8px;">{{ __('reset_password.action') }}</a>
@@ -21,7 +21,7 @@
      corporate mail gateways rewrite button links and some of them fetch the
      target first to scan it, which on a single-use link spends it before the
      recipient ever clicks. --}}
-<tr><td style="padding:28px 40px 0 40px;">
+<tr><td style="padding:28px 24px 0 24px;">
     <table role="presentation" width="100%" cellpadding="0" cellspacing="0" border="0" style="border-collapse:collapse;background-color:#fafafb;border:1px solid #e9e9ee;border-radius:8px;">
         <tr><td style="padding:14px 16px;">
             <p style="margin:0 0 6px 0;font-size:12px;line-height:16px;color:#6e6e7a;">{{ __('reset_password.fallback') }}</p>
@@ -34,7 +34,7 @@
      NOT ask for it has just learned that a stranger knows their address, and
      the right advice is "do nothing" — not "contact us immediately", which is
      what a phishing copy would say. --}}
-<tr><td style="padding:24px 40px 0 40px;">
+<tr><td style="padding:24px 24px 0 24px;">
     <p style="margin:0;font-size:13px;line-height:20px;color:#6e6e7a;">{{ __('reset_password.not_you') }}</p>
 </td></tr>
 
diff --git a/resources/views/mail/verify-email.blade.php b/resources/views/mail/verify-email.blade.php
index d0350b1..7246908 100644
--- a/resources/views/mail/verify-email.blade.php
+++ b/resources/views/mail/verify-email.blade.php
@@ -4,11 +4,11 @@
     :greeting="$name ? __('verify_email.greeting', ['name' => $name]) : null"
 >
 
-<tr><td style="padding:0 40px 24px 40px;">
+<tr><td style="padding:0 24px 24px 24px;">
     <p style="margin:0;font-size:15px;line-height:24px;color:#43434e;">{{ __('verify_email.intro') }}</p>
 </td></tr>
 
-<tr><td style="padding:0 40px;">
+<tr><td style="padding:0 24px;">
     <table role="presentation" cellpadding="0" cellspacing="0" border="0" style="border-collapse:collapse;">
         <tr><td align="center" bgcolor="#b8500a" style="background-color:#b8500a;border-radius:8px;">
             <a href="{{ $url }}" style="display:inline-block;padding:13px 26px;font-family:'IBM Plex Sans',-apple-system,Helvetica,Arial,sans-serif;font-size:15px;line-height:20px;font-weight:600;color:#ffffff;text-decoration:none;border-radius:8px;">{{ __('verify_email.action') }}</a>
@@ -20,7 +20,7 @@
 {{-- The link as text as well. Corporate mail gateways rewrite button links and
      some of them fetch the target first to scan it — on a single-use link that
      burns the confirmation before the recipient ever sees it. --}}
-<tr><td style="padding:28px 40px 0 40px;">
+<tr><td style="padding:28px 24px 0 24px;">
     <table role="presentation" width="100%" cellpadding="0" cellspacing="0" border="0" style="border-collapse:collapse;background-color:#fafafb;border:1px solid #e9e9ee;border-radius:8px;">
         <tr><td style="padding:14px 16px;">
             <p style="margin:0 0 6px 0;font-size:12px;line-height:16px;color:#6e6e7a;">{{ __('verify_email.fallback') }}</p>
@@ -29,7 +29,7 @@
     </table>
 </td></tr>
 
-<tr><td style="padding:24px 40px 32px 40px;">
+<tr><td style="padding:24px 24px 32px 24px;">
     <table role="presentation" width="100%" cellpadding="0" cellspacing="0" border="0" style="border-collapse:collapse;">
         <tr><td style="border-top:1px solid #e9e9ee;padding-top:20px;">
             <p style="margin:0;font-size:13px;line-height:20px;color:#6e6e7a;">{{ __('verify_email.not_you') }}</p>
diff --git a/routes/admin.php b/routes/admin.php
index bf0a3e1..26ef9de 100644
--- a/routes/admin.php
+++ b/routes/admin.php
@@ -48,6 +48,44 @@ Route::get('/finance', Admin\Finance::class)->name('finance');
 Route::get('/customers/{uuid}', Admin\CustomerDetail::class)->name('customer');
 // What customers wrote to us — see Admin\Inbox.
 Route::get('/inbox', Admin\Inbox::class)->name('inbox');
+// Looking at a mail before a customer does. The list is a page; the render is a
+// plain response, because a mail is a whole document and belongs in its own tab.
+Route::get('/mail/preview', Admin\MailPreview::class)->name('mail.preview');
+Route::get('/mail/preview/{key}', function (string $key) {
+    abort_unless(auth('operator')->user()?->can('mail.manage') ?? false, 403);
+
+    $mailable = app(App\Services\Mail\MailPreviews::class)->make($key);
+
+    abort_if($mailable === null, 404);
+
+    // The rendered mail, as the recipient's client would get it. Not escaped
+    // into a console page: this is the document itself.
+    return response($mailable->render());
+})->name('mail.preview.show');
+// The processing agreement (Art. 28 DSGVO): the document, the version in force,
+// and who has accepted it. The TEXT is uploaded, never written here.
+Route::get('/processing-agreement', Admin\ProcessingAgreements::class)->name('dpa');
+Route::get('/processing-agreement/{uuid}/{which}', function (string $uuid, string $which) {
+    abort_unless(auth('operator')->user()?->can('dpa.manage') ?? false, 403);
+    abort_unless(in_array($which, ['agreement', 'measures'], true), 404);
+
+    $version = App\Models\DpaVersion::query()->where('uuid', $uuid)->firstOrFail();
+    $path = $which === 'agreement' ? $version->agreement_path : $version->measures_path;
+
+    abort_if($path === null || ! Illuminate\Support\Facades\Storage::disk('local')->exists($path), 404);
+
+    // Inline: a contract is read before it is filed. With ?download=1 it is
+    // kept instead, under a name carrying the version.
+    $name = ($which === 'agreement' ? 'CluPilot-AV-Vertrag-' : 'CluPilot-TOM-').$version->version.'.pdf';
+
+    return request()->boolean('download')
+        ? Illuminate\Support\Facades\Storage::disk('local')->download($path, $name)
+        : Illuminate\Support\Facades\Storage::disk('local')->response($path, $name, [
+            'Content-Type' => 'application/pdf',
+            'Content-Disposition' => 'inline; filename="'.$name.'"',
+        ]);
+})->name('dpa.file');
+
 // The answers an operator gives over and over, written once — see
 // Admin\MailTemplates.
 Route::get('/mail-templates', Admin\MailTemplates::class)->name('templates');
diff --git a/routes/console.php b/routes/console.php
index b21fd77..01f0d07 100644
--- a/routes/console.php
+++ b/routes/console.php
@@ -76,6 +76,21 @@ Schedule::call(fn () => StripePendingEvent::query()
 //
 // Hourly rather than by the minute: the failure it repairs lasts as long as an
 // outage lasts, and a retry storm against a mount that is down helps nobody.
+// Registrations nobody confirmed. Daily is often enough for a five-day window,
+// and it holds the address hostage until it runs: the unique index means the
+// person cannot register again with the address they meant.
+Schedule::command('clupilot:prune-unverified')
+    ->dailyAt('03:20')
+    ->withoutOverlapping();
+
+// Confirmed accounts that never had a package. A year, with a fortnight's notice
+// by mail — so this has to run daily even though the window is long: the notice
+// is what permits the deletion, and an account whose warning was never sent is
+// never removed. See App\Console\Commands\PruneDormantAccounts.
+Schedule::command('clupilot:prune-dormant')
+    ->dailyAt('03:35')
+    ->withoutOverlapping();
+
 // The support mailbox. Polling, because IMAP is a mailbox you look in — a mail
 // server has no way to tell us something arrived — so the interval IS the
 // answer to "how long until I see it". Two minutes is short enough that an
diff --git a/routes/web.php b/routes/web.php
index d5218cb..006570e 100644
--- a/routes/web.php
+++ b/routes/web.php
@@ -208,7 +208,11 @@ $publicSite = function () {
         // but the address is not part of the copy.
         Route::get('/imprint', fn () => view('legal', ['title' => 'Impressum']))->name('impressum');
         Route::get('/privacy', fn () => view('legal', ['title' => 'Datenschutz']))->name('datenschutz');
-        Route::get('/terms', fn () => view('legal', ['title' => 'AGB']))->name('agb');
+        // The AGB has a text now (resources/views/legal/terms.blade.php): the
+        // order page requires accepting it, and it is where the withdrawal
+        // right, the immediate start and the account deletion deadlines are
+        // regulated rather than repeated in a checkbox nobody can read.
+        Route::get('/terms', fn () => view('legal', ['title' => 'AGB', 'page' => 'terms']))->name('agb');
 
         // The German paths these shipped under. Permanent, because they have
         // been in mail footers and in the site footer for weeks.
@@ -300,6 +304,32 @@ $portal = function () {
             );
         })->name('invoices.pdf');
 
+        // The processing agreement the customer is being asked to accept — the
+        // version in FORCE, never one named in the address: which document
+        // applies is ours to say, not a parameter.
+        Route::get('/processing-agreement/{which}', function (string $which) {
+            abort_unless(in_array($which, ['agreement', 'measures'], true), 404);
+
+            $version = app(App\Services\Legal\ProcessingAgreement::class)->current();
+            $path = $version === null
+                ? null
+                : ($which === 'agreement' ? $version->agreement_path : $version->measures_path);
+
+            abort_if($path === null || ! Illuminate\Support\Facades\Storage::disk('local')->exists($path), 404);
+
+            // Inline to read, attachment to keep — and the file that lands in
+            // somebody's downloads folder carries the VERSION in its name, so
+            // "which one did I agree to" is answerable from the filename alone.
+            $name = ($which === 'agreement' ? 'CluPilot-AV-Vertrag-' : 'CluPilot-TOM-').$version->version.'.pdf';
+
+            return request()->boolean('download')
+                ? Illuminate\Support\Facades\Storage::disk('local')->download($path, $name)
+                : Illuminate\Support\Facades\Storage::disk('local')->response($path, $name, [
+                    'Content-Type' => 'application/pdf',
+                    'Content-Disposition' => 'inline; filename="'.$name.'"',
+                ]);
+        })->name('dpa.file');
+
         Route::get('/billing', Billing::class)->name('billing');
         Route::get('/settings', \App\Livewire\Settings::class)->name('settings');
         Route::get('/support', Support::class)->name('support');
@@ -313,6 +343,12 @@ $portal = function () {
         // account that may not belong to the person holding it — and the
         // credentials for the finished cloud are sent to that address.
         Route::get('/order', \App\Livewire\Order::class)->name('order');
+        // The order, before it is placed. There was no such page: the order page
+        // posted straight to Stripe, so the last thing a customer saw in this
+        // product's design was a grid of packages and the next thing was
+        // somebody else's card form. GET, with the package and the term in the
+        // address, so it survives a reload.
+        Route::get('/checkout', \App\Livewire\Checkout::class)->name('checkout');
         Route::post('/checkout', [\App\Http\Controllers\CheckoutController::class, 'start'])
             // Throttled: each attempt opens a session on somebody else's API.
             ->middleware('throttle:10,1')
diff --git a/tests/Feature/Admin/ConsoleReportsRealDataTest.php b/tests/Feature/Admin/ConsoleReportsRealDataTest.php
index 20b9ede..e1d9818 100644
--- a/tests/Feature/Admin/ConsoleReportsRealDataTest.php
+++ b/tests/Feature/Admin/ConsoleReportsRealDataTest.php
@@ -24,6 +24,12 @@ it('reports an empty estate as empty, not as a going concern', function () {
     // console still claimed 42 customers, 39 instances, 4 hosts and €7,842 a
     // month. The figures are asserted directly rather than searched for in the
     // markup — "42" also occurs inside Livewire's own component ids.
+    //
+    // The mailer is pinned to a delivering one: phpunit.xml forces
+    // MAIL_MAILER=array so a test suite cannot send mail, and the console
+    // rightly warns that nothing is being delivered. That warning is about the
+    // ENVIRONMENT, not about the estate, and this test is about an empty estate.
+    config()->set('mail.default', 'smtp');
     Livewire::actingAs(operator('Owner'), 'operator')
         ->test(Overview::class)
         ->assertViewHas('kpis', function (array $kpis) {
@@ -123,6 +129,11 @@ it('states monthly revenue off the contracts, with a yearly term divided', funct
  * top of whatever readiness gaps a fresh install already carries.
  */
 it('raises an incident notice only when something is actually wrong', function () {
+    // The suite deliberately delivers no mail, and the console now says so on
+    // the overview. Pinned so this test's "clean" estate is clean of the MAIL
+    // notice too — the readiness gaps above it stay, by design.
+    config()->set('mail.default', 'smtp');
+
     $clean = Livewire::actingAs(operator('Owner'), 'operator')->test(Overview::class);
     $clean->assertDontSee(__('admin.notice.failed_runs', ['n' => 1]));
 
diff --git a/tests/Feature/Admin/EditCustomerTest.php b/tests/Feature/Admin/EditCustomerTest.php
index ba29643..aa5e406 100644
--- a/tests/Feature/Admin/EditCustomerTest.php
+++ b/tests/Feature/Admin/EditCustomerTest.php
@@ -40,7 +40,9 @@ it('saves the details an operator corrected', function () {
         ->set('name', 'Beispiel GmbH & Co KG')
         ->set('contactName', 'Bernd Berger')
         ->set('phone', '+43 1 999')
-        ->set('billingAddress', "Neue Gasse 9\n1020 Wien")
+        ->set('billingStreet', 'Neue Gasse 9')
+        ->set('billingPostcode', '1020')
+        ->set('billingCity', 'Wien')
         ->set('locale', 'en')
         ->call('save')
         ->assertHasNoErrors();
diff --git a/tests/Feature/Admin/InboundMailTest.php b/tests/Feature/Admin/InboundMailTest.php
index c25eb86..3a1fc00 100644
--- a/tests/Feature/Admin/InboundMailTest.php
+++ b/tests/Feature/Admin/InboundMailTest.php
@@ -9,6 +9,7 @@ use App\Services\Mail\FetchedMail;
 use App\Services\Mail\IngestInboundMail;
 use App\Services\Mail\InboundMailbox;
 use App\Services\Mail\MailParser;
+use Illuminate\Support\Facades\File;
 use Livewire\Livewire;
 
 /**
@@ -332,3 +333,108 @@ it('keeps the inbox to operators who may see customers', function () {
         ->test(Inbox::class)
         ->assertForbidden();
 });
+
+// ---- Configured means configured, and the check that says so ----
+
+it('counts a password from the vault as configured', function () {
+    // The bug this closes: isConfigured() read config('services.inbound_mail
+    // .password'), which is only ever the .env value — this project deliberately
+    // does not overlay stored secrets onto config at boot. So a password saved in
+    // the console counted for nothing, and the inbox went on saying no mailbox
+    // was set up while the password sat right there on the settings page.
+    App\Support\Settings::set('inbound_mail.host', 'mail.example.test');
+    App\Support\Settings::set('inbound_mail.username', 'support@example.test');
+    config()->set('services.inbound_mail.password', null);
+
+    $mailbox = new App\Services\Mail\ImapMailbox;
+
+    expect($mailbox->isConfigured())->toBeFalse();
+
+    app(App\Services\Secrets\SecretVault::class)->put('inbound_mail.password', 'geheim', operator('Owner'));
+
+    expect($mailbox->isConfigured())->toBeTrue();
+});
+
+it('still takes the password out of the environment where that is where it is', function () {
+    // An installation carrying INBOUND_MAIL_PASSWORD keeps working: the vault
+    // falls back to the configured value when nothing is stored.
+    App\Support\Settings::set('inbound_mail.host', 'mail.example.test');
+    App\Support\Settings::set('inbound_mail.username', 'support@example.test');
+    config()->set('services.inbound_mail.password', 'aus-der-env');
+
+    expect((new App\Services\Mail\ImapMailbox)->isConfigured())->toBeTrue();
+});
+
+it('records when the mailbox was last reached, and what came back', function () {
+    $status = app(App\Services\Mail\InboundMailStatus::class);
+
+    expect($status->last())->toBeNull();
+
+    $status->record(true, '', 3);
+    $last = $status->last();
+
+    expect($last['ok'])->toBeTrue()
+        ->and($last['unseen'])->toBe(3)
+        // A Carbon, so the view can put it on the wall clock rather than
+        // printing an ISO string at somebody (R19).
+        ->and($last['at'])->toBeInstanceOf(Illuminate\Support\Carbon::class);
+});
+
+it('records the scheduled run too, not only the button', function () {
+    // "Last checked" has to mean the last time the mailbox was actually reached.
+    // A mailbox that stopped answering at three in the morning is the one worth
+    // seeing, and nobody presses a button at three in the morning.
+    $this->mailbox->mails = [fetched()];
+
+    app(IngestInboundMail::class)();
+
+    expect(app(App\Services\Mail\InboundMailStatus::class)->last())->not->toBeNull();
+});
+
+it('takes nothing in when the mailbox cannot be reached, and says so', function () {
+    // Fetching against a mailbox that just refused the login would report
+    // "nothing new", which is true and useless.
+    $this->mailbox->mails = [fetched()];
+    $this->mailbox->checkAnswer = ['ok' => false, 'message' => 'credentials', 'unseen' => null];
+
+    expect(app(IngestInboundMail::class)())->toBe(0)
+        ->and(InboundMail::query()->count())->toBe(0);
+
+    $last = app(App\Services\Mail\InboundMailStatus::class)->last();
+
+    expect($last['ok'])->toBeFalse()
+        ->and($last['message'])->toBe('credentials');
+});
+
+it('tests the connection from the settings page and shows when it last answered', function () {
+    $page = Livewire::actingAs(operator('Owner'), 'operator')
+        ->test(App\Livewire\Admin\Integrations::class)
+        ->set('inboundHost', 'mail.example.test')
+        ->set('inboundUsername', 'support@example.test')
+        ->call('testInbound');
+
+    $page->assertDispatched('notify');
+
+    // And the page now carries the line, whichever way it went.
+    Livewire::actingAs(operator('Owner'), 'operator')
+        ->test(App\Livewire\Admin\Integrations::class)
+        ->assertViewHas('inboundStatus', fn ($status) => $status !== null);
+});
+
+it('never puts the password or the command into the message it shows', function () {
+    // IMAP servers answer a failed LOGIN with their own prose, and this class
+    // puts the failing command in the exception — which for LOGIN is the
+    // password. The reasons are matched, never passed through.
+    $reasons = ['incomplete', 'unreachable', 'credentials', 'folder', 'failed'];
+
+    foreach ($reasons as $reason) {
+        expect(__('integrations.inbound_failed_'.$reason))->not->toBe('integrations.inbound_failed_'.$reason);
+    }
+
+    $code = File::get(app_path('Services/Mail/ImapMailbox.php'));
+
+    // The reason() method returns one of the fixed words above, and nothing
+    // derived from the exception text.
+    expect($code)->toContain("return match (true) {")
+        ->and($code)->not->toContain('$e->getMessage()]');
+});
diff --git a/tests/Feature/Admin/IntegrationsPageTest.php b/tests/Feature/Admin/IntegrationsPageTest.php
index e0a333f..8eda383 100644
--- a/tests/Feature/Admin/IntegrationsPageTest.php
+++ b/tests/Feature/Admin/IntegrationsPageTest.php
@@ -476,3 +476,31 @@ it('saves .env once the page receives the confirmed event', function () {
 
     expect(File::get($path))->toBe("CONFIRMED=value\n");
 });
+
+it('names the server variable under each credential, not the internal key', function () {
+    // It printed `stripe.secret` — an identifier out of SecretVault::REGISTRY
+    // that means nothing on a settings page and is not something an operator can
+    // type anywhere. The env name is what stands in the server file, what the
+    // .env tab of this same page lists, and the answer to "which line?" when the
+    // badge says the value comes from there.
+    $page = Livewire::actingAs(operator('Owner'), 'operator')->test(Integrations::class);
+
+    $page->assertSee('STRIPE_SECRET')
+        ->assertSee('INBOUND_MAIL_PASSWORD')
+        ->assertSee('HETZNER_DNS_TOKEN')
+        ->assertSee('MONITORING_API_TOKEN');
+
+    // Not asserted by absence from the HTML: the key legitimately stays in
+    // wire:key and in the modal arguments, where it is an identifier nobody
+    // reads. What must not happen is printing it AS TEXT under the label.
+    $component = Illuminate\Support\Facades\File::get(
+        resource_path('views/components/admin/secret-field.blade.php')
+    );
+    $withoutComments = (string) preg_replace('/\{\{--.*?--\}\}/s', '', $component);
+
+    // Between tags, i.e. as a text node — the key stays inside attributes
+    // (wire:key, wire:click, the modal arguments), where it is an identifier
+    // nobody reads and removing it would break the page.
+    expect($withoutComments)->toMatch('/>\s*\{\{ \$entry\[.envKey.\] \}\}\s*</')
+        ->and($withoutComments)->not->toMatch('/>\s*\{\{ \$entry\[.key.\] \}\}\s*</');
+});
diff --git a/tests/Feature/Admin/MailPreviewTest.php b/tests/Feature/Admin/MailPreviewTest.php
new file mode 100644
index 0000000..43076de
--- /dev/null
+++ b/tests/Feature/Admin/MailPreviewTest.php
@@ -0,0 +1,179 @@
+<?php
+
+use App\Livewire\Admin\MailPreview;
+use App\Models\Invoice;
+use App\Models\Mailbox;
+use App\Models\MaintenanceWindow;
+use App\Models\Order;
+use App\Services\Mail\MailPreviews;
+use Illuminate\Support\Facades\Mail;
+use Livewire\Livewire;
+
+/**
+ * Looking at a mail before a customer does.
+ *
+ * There was no way to: an invoice mail needs an invoice, a maintenance
+ * announcement needs a window, and "register an account to see whether the
+ * confirmation reads well on a phone" is not a workflow. Which is how every mail
+ * went out with a hard 600px table until somebody opened one on a telephone.
+ */
+it('renders every mail this installation sends', function () {
+    // The whole point of the list: a mail that cannot be rendered is one nobody
+    // finds out about until the event that sends it happens for real.
+    $previews = app(MailPreviews::class);
+
+    expect($previews->all())->not->toBeEmpty();
+
+    foreach (array_keys($previews->all()) as $key) {
+        $html = $previews->make($key)?->render();
+
+        expect($html)->toBeString()
+            ->and(strlen((string) $html))->toBeGreaterThan(500);
+    }
+});
+
+it('leaves nothing behind in the database', function () {
+    // make(), never create(). A preview must not leave an invoice, an order or a
+    // maintenance window lying about — least of all one carrying a number drawn
+    // from a series.
+    $before = [
+        'invoices' => Invoice::query()->count(),
+        'orders' => Order::query()->count(),
+        'windows' => MaintenanceWindow::query()->count(),
+    ];
+
+    foreach (array_keys(app(MailPreviews::class)->all()) as $key) {
+        app(MailPreviews::class)->make($key)?->render();
+    }
+
+    expect(Invoice::query()->count())->toBe($before['invoices'])
+        ->and(Order::query()->count())->toBe($before['orders'])
+        ->and(MaintenanceWindow::query()->count())->toBe($before['windows']);
+});
+
+it('answers nothing for a key nobody knows, rather than throwing', function () {
+    // Reached from a URL, and a URL is a string somebody can retype.
+    expect(app(MailPreviews::class)->make('gibt-es-nicht'))->toBeNull();
+});
+
+it('sends a preview to the operator own address and to nobody else', function () {
+    Mail::fake();
+
+    $operator = operator('Owner');
+
+    Livewire::actingAs($operator, 'operator')
+        ->test(MailPreview::class)
+        ->call('sendToMe', 'verify-email')
+        ->assertDispatched('notify');
+
+    // SENT, not queued. Every mailable here implements ShouldQueue, so send()
+    // would have deferred to the queue — putting a failure in a worker's log
+    // while the button reported success to somebody who is waiting for the mail.
+    Mail::assertSent(App\Mail\VerifyEmailMail::class, fn ($mail) => $mail->hasTo($operator->email));
+    Mail::assertNotQueued(App\Mail\VerifyEmailMail::class);
+});
+
+it('sends each preview through the mailer the mail itself asks for', function () {
+    // "553 5.7.1 Sender address rejected: not owned by user no-reply@…".
+    //
+    // Every purpose mailbox has its OWN SMTP account, and a mail server lets an
+    // account send only from the address it owns. Mail::to() hands back a pending
+    // mail bound to the DEFAULT mailer and sendNow() then ignores the mailer the
+    // mailable asked for — so a support mail addressed support@ went out over the
+    // no-reply@ login and was rejected. The mailer is not a detail here; it IS
+    // which account authenticates.
+    Mail::fake();
+
+    Livewire::actingAs(operator('Owner'), 'operator')
+        ->test(MailPreview::class)
+        ->call('sendToMe', 'operator-message');
+
+    Mail::assertSent(App\Mail\OperatorMessageMail::class, fn ($mail) => $mail->mailer === 'cp_support');
+});
+
+it('gives every preview a sender its own mailbox owns', function () {
+    // The invariant behind the 553: From has to be the address of the mailbox
+    // whose account signs in. A preview that takes the framework default
+    // (MAIL_FROM_ADDRESS, which no mailbox owns) is rejected by any properly
+    // configured server — which is exactly how the cloud-ready preview failed
+    // while all nine rendered perfectly in the browser.
+    // updateOrCreate, because the installation already seeds mailboxes: this
+    // test cares about the mapping and the addresses, not about who created the
+    // rows.
+    foreach (App\Services\Mail\MailPurpose::ALL as $purpose) {
+        Mailbox::query()->updateOrCreate(['key' => $purpose], [
+            'address' => $purpose.'@clupilot.test',
+            'password' => 'test-passwort',
+            'authenticates' => true,
+            'active' => true,
+        ]);
+        App\Support\Settings::set(App\Services\Mail\MailPurpose::settingKey($purpose), $purpose);
+    }
+
+    foreach (array_keys(app(MailPreviews::class)->all()) as $key) {
+        $mailable = app(MailPreviews::class)->make($key);
+
+        // Which mailer it will go out over, and therefore which account signs in.
+        expect($mailable->mailer)->toBeString()->and($mailable->mailer)->toStartWith('cp_');
+
+        $purpose = str_replace('cp_', '', $mailable->mailer);
+        $mailable->assertFrom($purpose.'@clupilot.test');
+    }
+});
+
+it('has no recipient field, because that would be a form for mailing strangers', function () {
+    $component = Illuminate\Support\Facades\File::get(app_path('Livewire/Admin/MailPreview.php'));
+
+    // The address comes from the signed-in operator, never from the request.
+    expect($component)->toContain("Auth::guard('operator')->user()")
+        ->and($component)->not->toContain('public string $to');
+});
+
+it('serves the rendered mail as the document itself', function () {
+    // Not escaped into a console page: a mail is a whole document with its own
+    // background, and judging it inside a frame judges the frame.
+    $this->actingAs(operator('Owner'), 'operator')
+        ->get(route('admin.mail.preview.show', 'verify-email'))
+        ->assertOk()
+        ->assertSee('max-width:600px', false);
+});
+
+it('keeps the preview to operators who may manage mail', function () {
+    Livewire::actingAs(operator('Read-only'), 'operator')
+        ->test(MailPreview::class)
+        ->assertForbidden();
+
+    $this->actingAs(operator('Read-only'), 'operator')
+        ->get(route('admin.mail.preview.show', 'verify-email'))
+        ->assertForbidden();
+});
+
+it('answers 404 for a preview that does not exist', function () {
+    $this->actingAs(operator('Owner'), 'operator')
+        ->get(route('admin.mail.preview.show', 'gibt-es-nicht'))
+        ->assertNotFound();
+});
+
+// ---- What made this necessary ----
+
+it('builds the mail layout fluid, so a phone does not scroll sideways', function () {
+    // width="600" plus width:600px forced every phone to scroll to read a
+    // sentence. A mail cannot rely on a media query — Outlook renders with Word
+    // and drops <style> blocks — so the layout has to shrink by itself.
+    $html = (string) app(MailPreviews::class)->make('verify-email')?->render();
+
+    expect($html)->toContain('width:100%;max-width:600px')
+        ->and($html)->not->toContain('width="600"')
+        // No fixed width anywhere, and max-width does not count as one.
+        ->and(preg_match('/style="[^"]*(?<!max-)width:600px/', $html))->toBe(0);
+});
+
+it('does not spend a third of a phone screen on side padding', function () {
+    // 40px each side leaves 278px of a 390px screen. 24px leaves 310px, and on
+    // the desktop 552px of a 600px canvas still reads well.
+    foreach (array_keys(app(MailPreviews::class)->all()) as $key) {
+        $html = (string) app(MailPreviews::class)->make($key)?->render();
+
+        expect(preg_match('/padding:[^";]*\b40px\b[^";]*40px/', $html))->toBe(0, $key);
+    }
+});
diff --git a/tests/Feature/Admin/MailRegisterTest.php b/tests/Feature/Admin/MailRegisterTest.php
index 49662b1..5752cc8 100644
--- a/tests/Feature/Admin/MailRegisterTest.php
+++ b/tests/Feature/Admin/MailRegisterTest.php
@@ -6,6 +6,7 @@ use App\Livewire\Admin\Overview;
 use App\Mail\OperatorMessageMail;
 use App\Models\Customer;
 use App\Models\SentMail;
+use App\Models\Subscription;
 use App\Models\SupportRequest;
 use Illuminate\Support\Facades\Mail;
 use Livewire\Livewire;
@@ -256,3 +257,129 @@ it('names the status in words rather than printing the key at it', function () {
         ->assertDontSee('customers.status.')
         ->assertDontSee('support.status.');
 });
+
+// ---- Two things the console owed the operator ----
+
+it('says on the front page that the site is switched off', function () {
+    // Asked as "ich komme nicht auf www.dev". The site answers 503 to every
+    // visitor who is not on the VPN, which is exactly what a broken deployment
+    // looks like from outside — and the only place that said so was the switch
+    // itself, on another page.
+    App\Support\Settings::set('site.public', false);
+
+    Livewire::actingAs(operator('Owner'), 'operator')
+        ->test(Overview::class)
+        ->assertSee(__('admin.notice.site_hidden'))
+        // And it leads to the switch.
+        ->assertSee(route('admin.settings'), false);
+
+    App\Support\Settings::set('site.public', true);
+
+    Livewire::actingAs(operator('Owner'), 'operator')
+        ->test(Overview::class)
+        ->assertDontSee(__('admin.notice.site_hidden'));
+});
+
+it('says when the website has no hostname of its own', function () {
+    // Without SITE_HOST the marketing site is registered without a hostname, so
+    // it answers on the PORTAL's host too — and every route() it generates
+    // points at APP_URL. That is why a link on the site lands on app.…, which
+    // was the other half of the same report.
+    // Only fires where the installation is host-separated at all: on a fresh
+    // checkout nothing is bound, and a warning there would be furniture.
+    config()->set('admin_access.hosts', ['admin.dev.example.test']);
+    config()->set('admin_access.site_hosts', []);
+    config()->set('app.url', 'https://app.dev.example.test');
+
+    Livewire::actingAs(operator('Owner'), 'operator')
+        ->test(Overview::class)
+        ->assertSee('app.dev.example.test');
+
+    config()->set('admin_access.site_hosts', ['www.dev.example.test']);
+
+    Livewire::actingAs(operator('Owner'), 'operator')
+        ->test(Overview::class)
+        ->assertDontSee(__('admin.notice.no_site_host', ['app' => 'app.dev.example.test']));
+});
+
+it('says when no mail is being delivered at all', function () {
+    // The report: "ich versuche mich zu registrieren, erhalte aber keine Verify-
+    // Mail, auch nicht beim erneuten Senden". MAIL_MAILER=log short-circuits
+    // every purpose mailer to the log transport (MailboxTransport::
+    // NON_DELIVERING) however well the mailboxes are configured — and the
+    // failure is silent in every direction: the queue reports success, no job
+    // fails, and the console's own mailbox test reports success too because it
+    // builds its own transport on purpose. Nothing on any page said so.
+    config()->set('mail.default', 'log');
+
+    Livewire::actingAs(operator('Owner'), 'operator')
+        ->test(Overview::class)
+        ->assertSee(__('admin.notice.mail_not_delivering', ['mailer' => 'log']))
+        ->assertSee(route('admin.mail'), false);
+
+    // And on the page somebody actually opens to find out why.
+    Livewire::actingAs(operator('Owner'), 'operator')
+        ->test(App\Livewire\Admin\Mail::class)
+        ->assertSee(__('admin.notice.mail_not_delivering', ['mailer' => 'log']));
+});
+
+it('stays quiet once mail really goes out', function () {
+    config()->set('mail.default', 'smtp');
+
+    Livewire::actingAs(operator('Owner'), 'operator')
+        ->test(Overview::class)
+        ->assertDontSee(__('admin.notice.mail_not_delivering', ['mailer' => 'log']));
+});
+
+it('names every mailer that swallows mail, not only the log one', function () {
+    // array and an unset default do the same thing, and the transport already
+    // treats all three alike. A notice that only knew about 'log' would be
+    // silent in the two cases nobody thinks to check.
+    $swallowing = (new ReflectionClass(App\Mail\Transport\MailboxTransport::class))
+        ->getConstant('NON_DELIVERING');
+
+    expect($swallowing)->toBe(['log', 'array', null]);
+
+    foreach (['array', null] as $mailer) {
+        config()->set('mail.default', $mailer);
+
+        Livewire::actingAs(operator('Owner'), 'operator')
+            ->test(Overview::class)
+            ->assertSee(__('admin.notice.mail_not_delivering', ['mailer' => $mailer ?? 'null']));
+    }
+});
+
+it('does not invent a package for a customer who has booked nothing', function () {
+    // Reported straight after registering: the dashboard said "noch keine
+    // Instanz", and the package page said "AKTUELLES PAKET Start — Status Aktiv"
+    // about the same account. currentKey fell back to 'start', and the view
+    // rendered that fallback as a contract the customer had entered into.
+    $user = App\Models\User::factory()->create(['email_verified_at' => now()]);
+    Customer::factory()->create(['email' => $user->email, 'user_id' => $user->id]);
+
+    Livewire::actingAs($user)
+        ->test(App\Livewire\Billing::class)
+        ->assertViewHas('hasContract', false)
+        ->assertSee(__('billing.none_title'))
+        // And no invented status beside a plan name.
+        ->assertDontSee(__('billing.current_plan'));
+});
+
+it('shows the contract of a customer whose order is still waiting for a machine', function () {
+    // Resolved from the CUSTOMER, not from the instance: a paid order parked for
+    // want of capacity has a subscription and no instance yet, and asking the
+    // instance would report "no package" at somebody who has paid.
+    $user = App\Models\User::factory()->create(['email_verified_at' => now()]);
+    $customer = Customer::factory()->create(['email' => $user->email, 'user_id' => $user->id]);
+    Subscription::factory()->plan('team')->create([
+        'customer_id' => $customer->id,
+        'status' => 'active',
+        'instance_id' => null,
+    ]);
+
+    Livewire::actingAs($user)
+        ->test(App\Livewire\Billing::class)
+        ->assertViewHas('hasContract', true)
+        ->assertSee(__('billing.plan.team'))
+        ->assertDontSee(__('billing.none_title'));
+});
diff --git a/tests/Feature/Admin/PlanAdminTest.php b/tests/Feature/Admin/PlanAdminTest.php
index 1fa26ff..5c9c18e 100644
--- a/tests/Feature/Admin/PlanAdminTest.php
+++ b/tests/Feature/Admin/PlanAdminTest.php
@@ -91,14 +91,19 @@ it('drafts a version prefilled from the last one, priced for both terms', functi
         ->assertSet('quotaGb', 500)
         ->assertSet('monthlyPrice', '179,00');
 
-    $page->set('monthlyPrice', '199,00')->set('yearlyPrice', '2388,00')->call('draft')->assertHasNoErrors();
+    // The monthly price and the free months. The yearly total is derived from
+    // them — two free means ten months paid, 199,00 × 10 — because a typed total
+    // left nothing knowing WHY it was that figure, and no page could then say
+    // "zwei Monate gratis" without working it out a second time by hand.
+    $page->set('monthlyPrice', '199,00')->set('freeMonths', 2)->call('draft')->assertHasNoErrors();
 
     $draft = teamFamily()->versions()->where('version', 2)->sole();
 
     expect($draft->isPublished())->toBeFalse()
         ->and($draft->ram_mb)->toBe(8192)
+        ->and($draft->free_months)->toBe(2)
         ->and($draft->priceFor('monthly')->amount_cents)->toBe(19900)
-        ->and($draft->priceFor('yearly')->amount_cents)->toBe(238800)
+        ->and($draft->priceFor('yearly')->amount_cents)->toBe(199000)
         // A draft is not on sale, so the shop is unchanged.
         ->and(app(PlanCatalogue::class)->sellable()['team']['price_cents'])->toBe(17900);
 });
diff --git a/tests/Feature/Admin/RbacMoveTest.php b/tests/Feature/Admin/RbacMoveTest.php
index 77f2c9b..87af37f 100644
--- a/tests/Feature/Admin/RbacMoveTest.php
+++ b/tests/Feature/Admin/RbacMoveTest.php
@@ -12,11 +12,11 @@ use Spatie\Permission\Models\Role;
 it('moves every permission and role to the operator guard, leaving none behind', function () {
     expect(Permission::where('guard_name', 'web')->count())->toBe(0)
         ->and(Role::where('guard_name', 'web')->count())->toBe(0)
-        // 17 from the original seed, plus customers.grant_plan and
-        // instances.restart — the latter created straight onto this guard,
-        // because since this migration `web` is where a permission goes to
-        // match nobody at all.
-        ->and(Permission::where('guard_name', 'operator')->count())->toBe(19)
+        // 17 from the original seed, plus customers.grant_plan,
+        // instances.restart and dpa.manage — the later ones created straight
+        // onto this guard, because since this migration `web` is where a
+        // permission goes to match nobody at all.
+        ->and(Permission::where('guard_name', 'operator')->count())->toBe(20)
         ->and(Role::where('guard_name', 'operator')->count())->toBe(6);
 });
 
@@ -157,7 +157,9 @@ it('preflights every customer conflict before mutating anything, listing all of
     // Nothing mutated: still exactly the pre-migration shape, not "moved and
     // then rolled back" — there is nothing here to roll back on a real
     // server, which is the whole reason this has to be checked up front.
-    expect(Permission::where('guard_name', 'web')->count())->toBe(19)
+    // Every capability this installation has, pushed back to `web` above to
+    // stage the pre-migration shape — the figure grows with each new one.
+    expect(Permission::where('guard_name', 'web')->count())->toBe(20)
         ->and(Permission::where('guard_name', 'operator')->count())->toBe(0)
         ->and(Role::where('guard_name', 'web')->count())->toBe(6)
         ->and(Role::where('guard_name', 'operator')->count())->toBe(0)
diff --git a/tests/Feature/Auth/DormantAccountTest.php b/tests/Feature/Auth/DormantAccountTest.php
new file mode 100644
index 0000000..b4a4b68
--- /dev/null
+++ b/tests/Feature/Auth/DormantAccountTest.php
@@ -0,0 +1,204 @@
+<?php
+
+use App\Console\Commands\PruneDormantAccounts;
+use App\Console\Commands\PruneUnverifiedAccounts;
+use App\Mail\DormantAccountWarningMail;
+use App\Models\Customer;
+use App\Models\User;
+use App\Models\UserDevice;
+use Illuminate\Support\Facades\File;
+use Illuminate\Support\Facades\Mail;
+
+/**
+ * A confirmed account that never had a package goes after a year.
+ *
+ * The five-day sweep is about registrations nobody confirmed — see
+ * UnverifiedAccountTest. This is the other half of the same question the owner
+ * asked: "wird nun der account gelöscht nach 5 tagen?" No. Only an unconfirmed
+ * one. A confirmed account stays, unless a year passes with no package on it at
+ * all — and then it is told a fortnight in advance.
+ */
+function dormantUser(int $daysOld, array $attributes = []): User
+{
+    $user = User::factory()->create(array_merge(['email_verified_at' => now()->subDays($daysOld)], $attributes));
+
+    $user->forceFill(['created_at' => now()->subDays($daysOld)])->save();
+
+    return $user;
+}
+
+it('warns a fortnight before, rather than deleting out of the blue', function () {
+    Mail::fake();
+
+    $user = dormantUser(PruneDormantAccounts::AFTER_DAYS - PruneDormantAccounts::WARN_DAYS_BEFORE);
+
+    $this->artisan('clupilot:prune-dormant')->assertSuccessful();
+
+    Mail::assertQueued(DormantAccountWarningMail::class, fn ($mail) => $mail->hasTo($user->email));
+
+    // Still here. The warning is a warning, not the deletion.
+    expect($user->fresh())->not->toBeNull()
+        ->and($user->fresh()->dormant_warned_at)->not->toBeNull();
+});
+
+it('warns once, not every night for a fortnight', function () {
+    Mail::fake();
+
+    dormantUser(PruneDormantAccounts::AFTER_DAYS - 5);
+
+    $this->artisan('clupilot:prune-dormant');
+    $this->artisan('clupilot:prune-dormant');
+    $this->artisan('clupilot:prune-dormant');
+
+    Mail::assertQueuedCount(1);
+});
+
+it('deletes the account a year on, once the warning has had its fortnight', function () {
+    Mail::fake();
+
+    $user = dormantUser(PruneDormantAccounts::AFTER_DAYS + 1);
+    $user->forceFill(['dormant_warned_at' => now()->subDays(PruneDormantAccounts::WARN_DAYS_BEFORE + 1)])->save();
+
+    $this->artisan('clupilot:prune-dormant')->assertSuccessful();
+
+    expect(User::query()->whereKey($user->id)->exists())->toBeFalse();
+});
+
+it('never deletes an account that was never warned', function () {
+    // The stamp is what permits the deletion. An installation whose mail server
+    // was down for a month delays the deletion; it does not skip the notice.
+    Mail::fake();
+
+    $user = dormantUser(PruneDormantAccounts::AFTER_DAYS * 2);
+
+    $this->artisan('clupilot:prune-dormant');
+
+    expect(User::query()->whereKey($user->id)->exists())->toBeTrue();
+});
+
+it('gives the warning its full fortnight before deleting', function () {
+    Mail::fake();
+
+    $user = dormantUser(PruneDormantAccounts::AFTER_DAYS + 30);
+    $user->forceFill(['dormant_warned_at' => now()->subDays(PruneDormantAccounts::WARN_DAYS_BEFORE - 1)])->save();
+
+    $this->artisan('clupilot:prune-dormant');
+
+    expect(User::query()->whereKey($user->id)->exists())->toBeTrue();
+});
+
+it('leaves an account alone that signed in inside the year', function () {
+    // What the terms promise: signing in once starts the period again. There is
+    // no last_login_at on users, and the device rows carry exactly this.
+    Mail::fake();
+
+    $user = dormantUser(PruneDormantAccounts::AFTER_DAYS * 3);
+    UserDevice::query()->create([
+        'guard' => 'web',
+        'authenticatable_id' => $user->id,
+        'token_hash' => hash('sha256', 'egal'),
+        'name' => 'Firefox',
+        'last_seen_at' => now()->subDays(30),
+    ]);
+
+    $this->artisan('clupilot:prune-dormant');
+
+    Mail::assertNothingQueued();
+    expect(User::query()->whereKey($user->id)->exists())->toBeTrue();
+});
+
+it('counts a device of another guard as nobody, because operator 1 is not customer 1', function () {
+    // R21. A device row of the operator guard with the same id says nothing
+    // about this customer, and treating it as activity would keep an abandoned
+    // account alive for as long as an operator keeps signing in.
+    Mail::fake();
+
+    $user = dormantUser(PruneDormantAccounts::AFTER_DAYS - 1);
+    UserDevice::query()->create([
+        'guard' => 'operator',
+        'authenticatable_id' => $user->id,
+        'token_hash' => hash('sha256', 'anders'),
+        'name' => 'Konsole',
+        'last_seen_at' => now(),
+    ]);
+
+    $this->artisan('clupilot:prune-dormant');
+
+    Mail::assertQueued(DormantAccountWarningMail::class);
+});
+
+it('never touches an unconfirmed account, which is the other sweep business', function () {
+    Mail::fake();
+
+    $user = dormantUser(PruneDormantAccounts::AFTER_DAYS * 2, ['email_verified_at' => null]);
+
+    $this->artisan('clupilot:prune-dormant');
+
+    Mail::assertNothingQueued();
+    expect(User::query()->whereKey($user->id)->exists())->toBeTrue();
+});
+
+it('never touches an account with a customer record, by id or by address', function () {
+    // A customer record means somebody in the business knows this person, and
+    // everything commercial — orders, contracts, invoices kept for seven years —
+    // hangs off one. Both links count: see Customer::emailTaken.
+    Mail::fake();
+
+    $byId = dormantUser(PruneDormantAccounts::AFTER_DAYS * 2);
+    Customer::factory()->create(['user_id' => $byId->id, 'email' => 'andere@example.test']);
+
+    $byEmail = dormantUser(PruneDormantAccounts::AFTER_DAYS * 2, ['email' => 'gleich@example.test']);
+    Customer::factory()->create(['email' => 'gleich@example.test', 'user_id' => null]);
+
+    $this->artisan('clupilot:prune-dormant');
+
+    Mail::assertNothingQueued();
+    expect(User::query()->whereKey($byId->id)->exists())->toBeTrue()
+        ->and(User::query()->whereKey($byEmail->id)->exists())->toBeTrue();
+});
+
+it('says what it would do without doing it', function () {
+    Mail::fake();
+
+    $user = dormantUser(PruneDormantAccounts::AFTER_DAYS - 1, ['email' => 'ruht@example.test']);
+
+    $this->artisan('clupilot:prune-dormant --dry-run')
+        ->expectsOutputToContain('ruht@example.test')
+        ->assertSuccessful();
+
+    Mail::assertNothingQueued();
+    expect($user->fresh()->dormant_warned_at)->toBeNull();
+});
+
+it('runs on the schedule, or it never runs at all', function () {
+    // Daily even though the window is a year: the notice is what permits the
+    // deletion, so the run that sends it has to happen every day.
+    expect(File::get(base_path('routes/console.php')))
+        ->toContain("Schedule::command('clupilot:prune-dormant')")
+        ->toContain('withoutOverlapping');
+});
+
+// ---- What a customer is told ----
+
+it('states both deadlines in the portal, not just the five days', function () {
+    // The question this answers: "wird nun der account gelöscht nach 5 tagen?"
+    // Reading only the verification page, the answer looked like yes.
+    $settings = File::get(resource_path('views/livewire/settings.blade.php'));
+
+    expect($settings)->toContain("__('settings.lifecycle_unverified'")
+        ->and($settings)->toContain("__('settings.lifecycle_dormant'")
+        // From the commands themselves, so the page cannot promise one number
+        // while the sweep uses another.
+        ->and($settings)->toContain('PruneUnverifiedAccounts::AFTER_DAYS')
+        ->and($settings)->toContain('PruneDormantAccounts::WARN_DAYS_BEFORE');
+});
+
+it('regulates both deadlines in the terms, because that is where it was promised', function () {
+    $terms = $this->get(route('legal.agb'))->assertOk()->getContent();
+
+    expect($terms)->toContain('Löschfristen')
+        ->and($terms)->toContain('Nicht bestätigte Registrierungen')
+        ->and($terms)->toContain('Bestätigte Konten ohne Paket')
+        // And the number in the text is the number the command uses.
+        ->and($terms)->toContain(PruneUnverifiedAccounts::AFTER_DAYS.' Tagen');
+});
diff --git a/tests/Feature/Auth/UnverifiedAccountTest.php b/tests/Feature/Auth/UnverifiedAccountTest.php
new file mode 100644
index 0000000..79d7901
--- /dev/null
+++ b/tests/Feature/Auth/UnverifiedAccountTest.php
@@ -0,0 +1,164 @@
+<?php
+
+use App\Console\Commands\PruneUnverifiedAccounts;
+use App\Livewire\Auth\VerifyEmail;
+use App\Models\Customer;
+use App\Models\Subscription;
+use App\Models\User;
+use Illuminate\Support\Facades\File;
+use Livewire\Livewire;
+
+/**
+ * A registration nobody confirmed does not sit in the database for ever.
+ *
+ * The page used to say "sign out and register again", which cannot work: signing
+ * out frees nothing, the address is still taken by the unique index, and the
+ * abandoned row stays. So the button discards the account, and anything nobody
+ * comes back to goes by itself after five days.
+ */
+it('discards the registration and frees the address', function () {
+    $user = User::factory()->create(['email' => 'neu@example.test', 'email_verified_at' => null]);
+
+    Livewire::actingAs($user)
+        ->test(VerifyEmail::class)
+        ->call('deleteAccount');
+
+    expect(User::query()->where('email', 'neu@example.test')->exists())->toBeFalse();
+});
+
+it('refuses to discard an account that already has a contract behind it', function () {
+    // The webhook creates a customer's login from a paid checkout, and such a
+    // user can sit on this page unconfirmed while already having a contract.
+    // Deleting that is data loss dressed up as a convenience.
+    $user = User::factory()->create(['email' => 'zahlt@example.test', 'email_verified_at' => null]);
+    $customer = Customer::factory()->create(['email' => 'zahlt@example.test', 'user_id' => $user->id]);
+    Subscription::factory()->create(['customer_id' => $customer->id, 'status' => 'active']);
+
+    Livewire::actingAs($user)
+        ->test(VerifyEmail::class)
+        ->call('deleteAccount')
+        ->assertDispatched('notify');
+
+    expect($user->fresh())->not->toBeNull();
+});
+
+it('sends a confirmed account to its dashboard instead of deleting it', function () {
+    // Closing a confirmed account is a different action with an invoice history
+    // behind it — ConfirmCloseAccount, not this.
+    //
+    // Confirmed AFTER mounting, because mount() already redirects a verified
+    // user away and there would be no component left to call anything on. The
+    // case this guards is the real one: a tab left open on this page while the
+    // link was opened in another window.
+    $user = User::factory()->create(['email_verified_at' => null]);
+
+    $page = Livewire::actingAs($user)->test(VerifyEmail::class);
+
+    $user->forceFill(['email_verified_at' => now()])->save();
+
+    $page->call('deleteAccount');
+
+    expect($user->fresh())->not->toBeNull();
+});
+
+it('confirms in a modal rather than on one click', function () {
+    // R23. And the modal mutates nothing itself: it dispatches the event the
+    // page listens for, so the checks stay in the one place they already are.
+    $page = File::get(resource_path('views/livewire/auth/verify-email.blade.php'));
+
+    expect($page)->toContain("component: 'confirm-delete-own-account'");
+
+    $modal = File::get(app_path('Livewire/ConfirmDeleteOwnAccount.php'));
+
+    expect($modal)->toContain("dispatch('own-account-delete-confirmed')")
+        ->and($modal)->not->toContain('$user');
+});
+
+it('no longer tells anybody to sign out and register again', function () {
+    // Advice that could not work: signing out frees nothing.
+    expect(__('verify_email.notice_delete'))->not->toBe('verify_email.notice_delete');
+
+    foreach (['de', 'en'] as $locale) {
+        expect(File::get(base_path("lang/{$locale}/verify_email.php")))
+            ->not->toContain("'notice_signout'");
+    }
+});
+
+// ---- The five-day sweep ----
+
+it('removes a registration nobody confirmed after five days', function () {
+    $stale = User::factory()->create(['email_verified_at' => null]);
+    $stale->forceFill(['created_at' => now()->subDays(PruneUnverifiedAccounts::AFTER_DAYS + 1)])->save();
+
+    $this->artisan('clupilot:prune-unverified')->assertSuccessful();
+
+    expect(User::query()->whereKey($stale->id)->exists())->toBeFalse();
+});
+
+it('leaves a fresh registration alone', function () {
+    // Long enough for somebody who registered on a Friday and found the mail in
+    // a spam folder on Monday.
+    $fresh = User::factory()->create(['email_verified_at' => null]);
+    $fresh->forceFill(['created_at' => now()->subDays(PruneUnverifiedAccounts::AFTER_DAYS - 1)])->save();
+
+    $this->artisan('clupilot:prune-unverified');
+
+    expect(User::query()->whereKey($fresh->id)->exists())->toBeTrue();
+});
+
+it('never touches a confirmed account, however old', function () {
+    $old = User::factory()->create(['email_verified_at' => now()->subYear()]);
+    $old->forceFill(['created_at' => now()->subYears(2)])->save();
+
+    $this->artisan('clupilot:prune-unverified');
+
+    expect(User::query()->whereKey($old->id)->exists())->toBeTrue();
+});
+
+it('never touches an unconfirmed account with a customer behind it', function () {
+    // Both links count: a customers row can point at the user, or merely carry
+    // the same address — see Customer::emailTaken for why one can exist without
+    // the other.
+    $byId = User::factory()->create(['email_verified_at' => null]);
+    $byId->forceFill(['created_at' => now()->subDays(30)])->save();
+    Customer::factory()->create(['user_id' => $byId->id, 'email' => 'andere@example.test']);
+
+    $byEmail = User::factory()->create(['email' => 'gleich@example.test', 'email_verified_at' => null]);
+    $byEmail->forceFill(['created_at' => now()->subDays(30)])->save();
+    Customer::factory()->create(['email' => 'gleich@example.test', 'user_id' => null]);
+
+    $this->artisan('clupilot:prune-unverified');
+
+    expect(User::query()->whereKey($byId->id)->exists())->toBeTrue()
+        ->and(User::query()->whereKey($byEmail->id)->exists())->toBeTrue();
+});
+
+it('says what it would remove without removing it', function () {
+    $stale = User::factory()->create(['email' => 'weg@example.test', 'email_verified_at' => null]);
+    $stale->forceFill(['created_at' => now()->subDays(30)])->save();
+
+    $this->artisan('clupilot:prune-unverified --dry-run')
+        ->expectsOutputToContain('weg@example.test')
+        ->assertSuccessful();
+
+    expect(User::query()->whereKey($stale->id)->exists())->toBeTrue();
+});
+
+it('runs on the schedule, or it never runs at all', function () {
+    $console = File::get(base_path('routes/console.php'));
+
+    expect($console)->toContain("Schedule::command('clupilot:prune-unverified')")
+        ->toContain('withoutOverlapping');
+});
+
+it('tells the person about the deadline, on the page and in the mail', function () {
+    // Somebody who never got the mail is looking at the PAGE, and the deadline
+    // is the reason they do not have to do anything about an abandoned attempt.
+    // Matched on the number, not on a whole phrase: "fünf Tage lang" and "nach
+    // fünf Tagen" are both correct German and an assertion on one of them tells
+    // the next person to write the sentence a particular way.
+    expect(__('verify_email.notice_wrong_address'))->toContain('fünf')
+        ->and(__('verify_email.not_you'))->toContain('fünf')
+        // And the sentence and the command agree on the number.
+        ->and(PruneUnverifiedAccounts::AFTER_DAYS)->toBe(5);
+});
diff --git a/tests/Feature/Billing/PackageCancellationTest.php b/tests/Feature/Billing/PackageCancellationTest.php
index 1d75a3e..277901e 100644
--- a/tests/Feature/Billing/PackageCancellationTest.php
+++ b/tests/Feature/Billing/PackageCancellationTest.php
@@ -113,6 +113,7 @@ it('tells Stripe to stop at the end of the term and keeps a yearly customer thei
 
     Livewire::actingAs($user)->test(ConfirmCancelPackage::class)
         ->set('confirmName', 'berger')
+        ->set('reason', 'no_longer_needed')
         ->call('cancelPackage')
         ->assertHasNoErrors();
 
@@ -147,6 +148,7 @@ it('keeps a monthly customer their month and no longer', function () {
 
     Livewire::actingAs($user)->test(ConfirmCancelPackage::class)
         ->set('confirmName', 'berger')
+        ->set('reason', 'no_longer_needed')
         ->call('cancelPackage')
         ->assertHasNoErrors();
 
@@ -171,6 +173,7 @@ it('cancels a granted package cleanly and asks Stripe nothing at all', function
 
     Livewire::actingAs($user)->test(ConfirmCancelPackage::class)
         ->set('confirmName', 'berger')
+        ->set('reason', 'no_longer_needed')
         ->call('cancelPackage')
         ->assertHasNoErrors();
 
@@ -188,6 +191,7 @@ it('records nothing at all when Stripe cannot be told to stop', function () {
 
     Livewire::actingAs($user)->test(ConfirmCancelPackage::class)
         ->set('confirmName', 'berger')
+        ->set('reason', 'no_longer_needed')
         ->call('cancelPackage')
         ->assertHasErrors(['confirmName']);
 
diff --git a/tests/Feature/Billing/ReverseChargePriceTest.php b/tests/Feature/Billing/ReverseChargePriceTest.php
index adc29f6..3820f1c 100644
--- a/tests/Feature/Billing/ReverseChargePriceTest.php
+++ b/tests/Feature/Billing/ReverseChargePriceTest.php
@@ -117,9 +117,9 @@ it('charges a domestic consumer and a domestic business the same gross, to the c
         'vat_id_verified_value' => 'ATU12345678',
     ]);
 
-    $this->actingAs($consumer)->post(route('checkout.start'), ['plan' => 'team', 'immediate_start' => '1'])
+    $this->actingAs($consumer)->post(route('checkout.start'), ['plan' => 'team', 'terms_accepted' => '1'])
         ->assertRedirect();
-    $this->actingAs($business)->post(route('checkout.start'), ['plan' => 'team', 'immediate_start' => '1'])
+    $this->actingAs($business)->post(route('checkout.start'), ['plan' => 'team', 'terms_accepted' => '1'])
         ->assertRedirect();
 
     // 179,00 € plus 20 %, which is the figure on the website.
@@ -135,7 +135,7 @@ it('charges a verified business in another member state the bare net, and invoic
     Queue::fake();
     [$user] = verifiedEuBusiness();
 
-    $this->actingAs($user)->post(route('checkout.start'), ['plan' => 'team', 'immediate_start' => '1'])
+    $this->actingAs($user)->post(route('checkout.start'), ['plan' => 'team', 'terms_accepted' => '1'])
         ->assertRedirect();
 
     // The bare net: no VAT is owed to us, so there is none in the price either.
@@ -188,7 +188,7 @@ it('charges an unverified EU business the gross, because an unchecked number is
         'vat_id' => 'NL123456789B01',
     ]);
 
-    $this->actingAs($user)->post(route('checkout.start'), ['plan' => 'team', 'immediate_start' => '1'])
+    $this->actingAs($user)->post(route('checkout.start'), ['plan' => 'team', 'terms_accepted' => '1'])
         ->assertRedirect();
 
     expect(chargedByCheckout($this->stripe))->toBe(21480)
@@ -202,8 +202,8 @@ it('charges the setup fee under the same rule as the package', function () {
     [$domestic] = buyerWith(['customer_type' => Customer::TYPE_CONSUMER]);
     [$business] = verifiedEuBusiness();
 
-    $this->actingAs($domestic)->post(route('checkout.start'), ['plan' => 'team', 'immediate_start' => '1']);
-    $this->actingAs($business)->post(route('checkout.start'), ['plan' => 'team', 'immediate_start' => '1']);
+    $this->actingAs($domestic)->post(route('checkout.start'), ['plan' => 'team', 'terms_accepted' => '1']);
+    $this->actingAs($business)->post(route('checkout.start'), ['plan' => 'team', 'terms_accepted' => '1']);
 
     // A fee is a supply like the package it sets up, so it cannot be taxed
     // differently from it on the same invoice — and the webhook is told how much
@@ -393,7 +393,7 @@ it('refuses the sale rather than overcharging a business the catalogue has no ne
 
     [$user] = verifiedEuBusiness();
 
-    $this->actingAs($user)->post(route('checkout.start'), ['plan' => 'team', 'immediate_start' => '1'])
+    $this->actingAs($user)->post(route('checkout.start'), ['plan' => 'team', 'terms_accepted' => '1'])
         ->assertSessionHasErrors('plan');
 
     expect($this->stripe->checkouts)->toBeEmpty();
diff --git a/tests/Feature/Billing/SetupFeeTest.php b/tests/Feature/Billing/SetupFeeTest.php
index a5e756d..0deadd7 100644
--- a/tests/Feature/Billing/SetupFeeTest.php
+++ b/tests/Feature/Billing/SetupFeeTest.php
@@ -48,7 +48,7 @@ function setupFeeBuyer(): User
 
 it('charges the fee it advertises, as a one-off line beside the monthly one', function () {
     $this->actingAs(setupFeeBuyer())
-        ->post(route('checkout.start'), ['plan' => 'start', 'immediate_start' => '1'])
+        ->post(route('checkout.start'), ['plan' => 'start', 'terms_accepted' => '1'])
         ->assertRedirect();
 
     $checkout = $this->stripe->checkouts[0];
@@ -72,7 +72,7 @@ it('sends no line at all when the operator charges no setup fee', function () {
     // something.
     Settings::set('company.setup_fee_cents', 0);
 
-    $this->actingAs(setupFeeBuyer())->post(route('checkout.start'), ['plan' => 'start', 'immediate_start' => '1']);
+    $this->actingAs(setupFeeBuyer())->post(route('checkout.start'), ['plan' => 'start', 'terms_accepted' => '1']);
 
     expect($this->stripe->checkouts[0]['one_off'])->toBeNull()
         // Stated as zero rather than left out. The webhook reads it either way,
diff --git a/tests/Feature/Billing/StripeIdempotencyKeyTest.php b/tests/Feature/Billing/StripeIdempotencyKeyTest.php
new file mode 100644
index 0000000..efe72a0
--- /dev/null
+++ b/tests/Feature/Billing/StripeIdempotencyKeyTest.php
@@ -0,0 +1,269 @@
+<?php
+
+use App\Services\Stripe\FakeStripeClient;
+use App\Services\Stripe\HttpStripeClient;
+use Illuminate\Support\Facades\Http;
+
+/**
+ * A key says "I have already sent this call" — not "this is what the object is".
+ *
+ * The difference cost a day. A run created a Price at Stripe and died before the
+ * row was written; the next sweep sent the SAME key with an added metadata field
+ * and Stripe refused it for twenty-four hours — the sweep and, because
+ * AddonPrices::ensure() also runs inside a customer's module booking, the
+ * booking with it.
+ *
+ * So every parameter that goes on the wire goes into the key. On the catalogue
+ * calls only: for a refund or a second subscription item, Stripe's refusal is
+ * the thing standing between a customer and being charged twice.
+ */
+beforeEach(function () {
+    // A stored vault row, not config(): `stripe.secret` is a STRICT vault entry
+    // as of the operating-mode work, so it never falls back to the environment
+    // in either direction — otherwise the .env would be the back door through
+    // which a live key reaches a test-mode checkout. Without a real row
+    // HttpStripeClient::secret() throws StripeNotConfigured, which is the point.
+    withStripeSecret();
+});
+
+it('sends a different key once the metadata changes', function () {
+    Http::fake(['api.stripe.com/*' => Http::response(['id' => 'price_x'])]);
+
+    $client = new HttpStripeClient;
+    $spoken = 'clupilot-addon-price-priority_support-month-3480-EUR';
+
+    // The call as it stood before 9da1358, and the call after it: same money,
+    // same interval, one metadata field more.
+    $client->createPrice('prod_1', 3480, 'EUR', 'month',
+        ['addon' => 'priority_support'], $spoken);
+
+    $client->createPrice('prod_1', 3480, 'EUR', 'month',
+        ['addon' => 'priority_support', 'tax_treatment' => 'domestic'], $spoken);
+
+    $sent = collect(Http::recorded())
+        ->map(fn (array $pair) => $pair[0]->header('Idempotency-Key')[0] ?? null)
+        ->all();
+
+    expect($sent[0])->toStartWith($spoken)
+        ->and($sent[1])->toStartWith($spoken)
+        ->and($sent[1])->not->toBe($sent[0]);
+});
+
+it('sends the same key for the very same call', function () {
+    Http::fake(['api.stripe.com/*' => Http::response(['id' => 'price_x'])]);
+
+    $client = new HttpStripeClient;
+
+    foreach ([1, 2] as $ignored) {
+        $client->createPrice('prod_1', 3480, 'EUR', 'month',
+            ['addon' => 'priority_support'], 'clupilot-addon-price');
+    }
+
+    $sent = collect(Http::recorded())
+        ->map(fn (array $pair) => $pair[0]->header('Idempotency-Key')[0] ?? null)
+        ->unique()
+        ->all();
+
+    expect($sent)->toHaveCount(1);
+});
+
+it('fingerprints the product call too, where the same trap was waiting', function () {
+    Http::fake(['api.stripe.com/*' => Http::response(['id' => 'prod_x'])]);
+
+    $client = new HttpStripeClient;
+
+    $client->createProduct('Priority Support', ['addon' => 'priority_support'], 'clupilot-addon-product-x');
+    $client->createProduct('Priority Support', ['addon' => 'priority_support', 'sold_as' => 'entitlement'], 'clupilot-addon-product-x');
+
+    $sent = collect(Http::recorded())
+        ->map(fn (array $pair) => $pair[0]->header('Idempotency-Key')[0] ?? null)
+        ->all();
+
+    expect($sent[1])->not->toBe($sent[0]);
+});
+
+it('leaves the money calls their bare key, so Stripe still refuses a changed one', function () {
+    Http::fake(['api.stripe.com/*' => Http::response(['id' => 'x'])]);
+
+    $client = new HttpStripeClient;
+
+    $client->refund('pi_1', 500, 'clupilot-refund-7');
+    $client->cancelSubscription('sub_1', 'at_period_end', 'clupilot-cancel-7');
+    $client->addSubscriptionItem('sub_1', 'price_1', 1, 'none', 'clupilot-item-7');
+
+    $sent = collect(Http::recorded())
+        ->map(fn (array $pair) => $pair[0]->header('Idempotency-Key')[0] ?? null)
+        ->all();
+
+    expect($sent)->toBe(['clupilot-refund-7', 'clupilot-cancel-7', 'clupilot-item-7']);
+});
+
+it('reproduces the refusal Stripe makes, which the fake used to swallow', function () {
+    $fake = new FakeStripeClient;
+
+    $fake->refund('pi_1', 500, 'clupilot-refund-7');
+
+    // Same key, different amount. Stripe answers 400; the fake said nothing and
+    // replayed the first refund's id, which is how a test could pass over the
+    // very failure that stopped production.
+    expect(fn () => $fake->refund('pi_1', 900, 'clupilot-refund-7'))
+        ->toThrow(RuntimeException::class, 'same parameters');
+});
+
+it('mints a second price rather than blocking when the metadata moved', function () {
+    $fake = new FakeStripeClient;
+
+    $first = $fake->createPrice('prod_1', 3480, 'EUR', 'month',
+        ['addon' => 'priority_support'], 'clupilot-addon-price');
+
+    $second = $fake->createPrice('prod_1', 3480, 'EUR', 'month',
+        ['addon' => 'priority_support', 'tax_treatment' => 'domestic'], 'clupilot-addon-price');
+
+    // Two objects, no exception. That the second one is not WANTED is the job of
+    // AdoptStripePrice, not of the key — see StripePriceAdoptionTest.
+    expect($second)->not->toBe($first);
+});
+
+it('pages through every active price of a product', function () {
+    Http::fake([
+        'api.stripe.com/*' => Http::sequence()
+            ->push([
+                'data' => [
+                    ['id' => 'price_a', 'unit_amount' => 3480, 'currency' => 'eur',
+                        'created' => 100, 'recurring' => ['interval' => 'month'],
+                        'metadata' => ['addon' => 'priority_support']],
+                    ['id' => 'price_b', 'unit_amount' => 41760, 'currency' => 'eur',
+                        'created' => 101, 'recurring' => ['interval' => 'year'], 'metadata' => []],
+                ],
+                'has_more' => true,
+            ])
+            ->push([
+                'data' => [
+                    ['id' => 'price_c', 'unit_amount' => 2900, 'currency' => 'eur',
+                        'created' => 102, 'recurring' => ['interval' => 'month'],
+                        'metadata' => ['addon' => 'priority_support', 'tax_treatment' => 'reverse_charge']],
+                ],
+                'has_more' => false,
+            ]),
+    ]);
+
+    $prices = (new HttpStripeClient)->activePricesFor('prod_1');
+
+    expect($prices)->toHaveCount(3)
+        ->and($prices[0])->toBe([
+            'id' => 'price_a',
+            'unit_amount' => 3480,
+            // Upper case, because that is how our own tables hold it and the
+            // comparison in AdoptStripePrice must not have to remember which
+            // side is which.
+            'currency' => 'EUR',
+            'interval' => 'month',
+            'created' => 100,
+            'metadata' => ['addon' => 'priority_support'],
+        ])
+        ->and($prices[2]['id'])->toBe('price_c');
+
+    // The second page has to be asked for, or this reintroduces the very gap it
+    // exists to close — a family product accumulates prices across versions,
+    // terms, treatments and every rate change.
+    Http::assertSent(fn ($request) => str_contains($request->url(), 'starting_after=price_b'));
+
+    // Archived prices are none of our business here: we are looking for
+    // something to SELL on.
+    Http::assertSent(fn ($request) => str_contains($request->url(), 'active=true'));
+});
+
+it('skips a price it could not have created itself, so the money gate never trusts a partial recurrence', function () {
+    Http::fake([
+        'api.stripe.com/*' => Http::response([
+            'data' => [
+                ['id' => 'price_monthly', 'unit_amount' => 3480, 'currency' => 'eur',
+                    'created' => 100, 'recurring' => ['interval' => 'month'],
+                    'metadata' => ['addon' => 'priority_support']],
+                ['id' => 'price_quarterly', 'unit_amount' => 3480, 'currency' => 'eur',
+                    'created' => 101, 'recurring' => ['interval' => 'month', 'interval_count' => 3],
+                    'metadata' => ['addon' => 'priority_support']],
+                ['id' => 'price_metered', 'unit_amount' => 3480, 'currency' => 'eur',
+                    'created' => 102, 'recurring' => ['interval' => 'month', 'usage_type' => 'metered'],
+                    'metadata' => ['addon' => 'priority_support']],
+            ],
+            'has_more' => false,
+        ]),
+    ]);
+
+    $prices = (new HttpStripeClient)->activePricesFor('prod_1');
+
+    // A hand-duplicated dashboard price keeps our metadata, so nothing
+    // downstream could tell it apart, and the module would bill quarterly.
+    //
+    // None of the three planted prices carries `transform_quantity` or
+    // `billing_scheme` at all, and the ordinary one still comes back — so this
+    // also holds the other direction of the next test's filter: an absent key is
+    // Stripe's default, not a reason to reject.
+    expect(collect($prices)->pluck('id')->all())->toBe(['price_monthly']);
+});
+
+it('skips a price that would charge our figure for the wrong quantity', function () {
+    Http::fake([
+        'api.stripe.com/*' => Http::response([
+            'data' => [
+                // Spelled out as Stripe actually sends them for an ordinary
+                // price: transform_quantity null, billing_scheme per_unit.
+                ['id' => 'price_ordinary', 'unit_amount' => 3480, 'currency' => 'eur',
+                    'created' => 100, 'recurring' => ['interval' => 'month'],
+                    'transform_quantity' => null, 'billing_scheme' => 'per_unit',
+                    'metadata' => ['addon' => 'priority_support']],
+                ['id' => 'price_divided', 'unit_amount' => 3480, 'currency' => 'eur',
+                    'created' => 101, 'recurring' => ['interval' => 'month'],
+                    'transform_quantity' => ['divide_by' => 10, 'round' => 'up'],
+                    'billing_scheme' => 'per_unit',
+                    'metadata' => ['addon' => 'priority_support']],
+                ['id' => 'price_tiered', 'unit_amount' => null, 'currency' => 'eur',
+                    'created' => 102, 'recurring' => ['interval' => 'month'],
+                    'billing_scheme' => 'tiered',
+                    'metadata' => ['addon' => 'priority_support']],
+            ],
+            'has_more' => false,
+        ]),
+    ]);
+
+    $prices = (new HttpStripeClient)->activePricesFor('prod_1');
+
+    // The concrete harm: modules are billed BY quantity — SyncStripeAddonItems
+    // sums a pack into ONE item at quantity n — so price_divided is our exact
+    // figure, on our Product, carrying our `addon` key, and adoption would take
+    // it. A customer holding three would then be charged ceil(3/10) = 1.
+    //
+    // price_tiered is refused by name rather than by luck: Stripe reports
+    // unit_amount null for a tiered price, activePricesFor() casts that to 0, and
+    // the amount match alone only rejects it while the caller's own figure is not
+    // 0 — which PlanPrices::ensure(), unlike AddonPrices::ensure(), does not
+    // guarantee.
+    expect(collect($prices)->pluck('id')->all())->toBe(['price_ordinary']);
+});
+
+it('writes metadata onto a price that already exists', function () {
+    Http::fake(['api.stripe.com/*' => Http::response(['id' => 'price_a'])]);
+
+    (new HttpStripeClient)->updatePriceMetadata('price_a', ['addon' => 'priority_support']);
+
+    Http::assertSent(fn ($request) => $request->url() === 'https://api.stripe.com/v1/prices/price_a'
+        && $request['metadata[addon]'] === 'priority_support');
+});
+
+it('lets the fake answer with the prices it holds, minus the archived ones', function () {
+    $fake = new FakeStripeClient;
+
+    $kept = $fake->createPrice('prod_1', 3480, 'EUR', 'month', ['addon' => 'priority_support']);
+    $gone = $fake->createPrice('prod_1', 2900, 'EUR', 'month', ['addon' => 'priority_support']);
+    $other = $fake->createPrice('prod_2', 3480, 'EUR', 'month', []);
+    $fake->archivePrice($gone);
+
+    $fake->plantPrice('price_orphan', 'prod_1', 3480, 'EUR', 'month',
+        ['addon' => 'priority_support'], created: 0);
+
+    $found = collect($fake->activePricesFor('prod_1'))->pluck('id')->all();
+
+    expect($found)->toContain($kept, 'price_orphan')
+        ->and($found)->not->toContain($gone, $other);
+});
diff --git a/tests/Feature/Billing/StripePriceAdoptionTest.php b/tests/Feature/Billing/StripePriceAdoptionTest.php
new file mode 100644
index 0000000..df68ab1
--- /dev/null
+++ b/tests/Feature/Billing/StripePriceAdoptionTest.php
@@ -0,0 +1,612 @@
+<?php
+
+use App\Models\PlanPrice;
+use App\Models\StripeAddonPrice;
+use App\Models\StripePlanPrice;
+use App\Models\Subscription;
+use App\Models\SubscriptionAddon;
+use App\Services\Billing\AddonPrices;
+use App\Services\Billing\AdoptStripePrice;
+use App\Services\Billing\PlanPrices;
+use App\Services\Billing\TaxTreatment;
+use App\Services\Stripe\FakeStripeClient;
+use App\Services\Stripe\IdempotencyKey;
+use App\Services\Stripe\StripeClient;
+use Illuminate\Contracts\Console\Kernel;
+use Illuminate\Database\Schema\Blueprint;
+use Illuminate\Database\UniqueConstraintViolationException;
+use Illuminate\Support\Facades\DB;
+use Illuminate\Support\Facades\Log;
+use Illuminate\Support\Facades\Schema;
+
+/**
+ * A run that dies between Stripe's create and our insert leaves an orphan — and
+ * the next run must recognise it instead of minting a second live Price for the
+ * same money.
+ *
+ * On 2026-07-29 23:11 a sweep created price_1TygdEC7u8NpJ8pOt3nsoyYw
+ * (priority_support, 3480 EUR, monthly) and died before the row was written.
+ * The idempotency key covered the next twenty-four hours and then stopped
+ * covering anything; after that, the guard against a duplicate was nothing at
+ * all. This is that guard.
+ *
+ * What may be adopted is narrow on purpose: same money, same interval, same
+ * currency, proof in the metadata that the Price is ours, and no row claiming
+ * it already. Adopting somebody else's Price would be a worse failure than
+ * minting a second one, and adopting a Price at a DIFFERENT amount would move
+ * money — which nothing here is allowed to do.
+ */
+beforeEach(function () {
+    $this->stripe = new FakeStripeClient;
+    app()->instance(StripeClient::class, $this->stripe);
+});
+
+/** The module metadata as AddonPrices sends it today. */
+function moduleMetadata(string $treatment = 'domestic'): array
+{
+    return ['addon' => 'priority_support', 'tax_treatment' => $treatment];
+}
+
+/** Ask the adoption step the question AddonPrices asks it. */
+function adoptModulePrice(?array $metadata = null, ?callable $claimed = null): ?string
+{
+    return app(AdoptStripePrice::class)(
+        productId: 'prod_support',
+        amountCents: 3480,
+        currency: 'EUR',
+        interval: 'month',
+        metadata: $metadata ?? moduleMetadata(),
+        identifying: ['addon'],
+        claimed: $claimed ?? fn (string $id) => false,
+    );
+}
+
+it('adopts the orphan of 2026-07-29 instead of minting a second price', function () {
+    // The state that morning: the Price exists at Stripe, carries the metadata
+    // of the code that made it — WITHOUT tax_treatment, which 9da1358 added
+    // afterwards — and no row of ours knows it.
+    $this->stripe->plantPrice('price_1TygdEC7u8NpJ8pOt3nsoyYw', 'prod_support',
+        3480, 'EUR', 'month', ['addon' => 'priority_support']);
+
+    expect(adoptModulePrice())->toBe('price_1TygdEC7u8NpJ8pOt3nsoyYw');
+
+    // Brought up to today's metadata rather than replaced: metadata is mutable
+    // at Stripe, the amount is not, which is the whole reason the format is no
+    // part of a Price's identity.
+    expect($this->stripe->metadataUpdates)->toBe([[
+        'price' => 'price_1TygdEC7u8NpJ8pOt3nsoyYw',
+        'metadata' => moduleMetadata(),
+    ]]);
+});
+
+it('leaves the metadata alone when it already says the right thing', function () {
+    $this->stripe->plantPrice('price_ok', 'prod_support', 3480, 'EUR', 'month', moduleMetadata());
+
+    expect(adoptModulePrice())->toBe('price_ok')
+        ->and($this->stripe->metadataUpdates)->toBe([]);
+});
+
+it('leaves the metadata alone when Stripe merged it in a different order plus a key of its own', function () {
+    // plantPrice() stores our own array in our own order, so the test above
+    // cannot catch an order- or merge-sensitive comparison: Stripe returns
+    // metadata as the result of a MERGE, never a replace, in whatever key
+    // order it likes — and a write never removes a key it did not send.
+    $this->stripe->plantPrice('price_ok', 'prod_support', 3480, 'EUR', 'month', [
+        'tax_treatment' => 'domestic',
+        'addon' => 'priority_support',
+        'internal_note' => 'added by hand in the Stripe dashboard',
+    ]);
+
+    expect(adoptModulePrice())->toBe('price_ok')
+        ->and($this->stripe->metadataUpdates)->toBe([]);
+});
+
+it('adopts nothing when the amount, currency or interval differ', function () {
+    $this->stripe->plantPrice('price_cheaper', 'prod_support', 2900, 'EUR', 'month', moduleMetadata());
+    $this->stripe->plantPrice('price_yearly', 'prod_support', 3480, 'EUR', 'year', moduleMetadata());
+    $this->stripe->plantPrice('price_dollars', 'prod_support', 3480, 'USD', 'month', moduleMetadata());
+
+    expect(adoptModulePrice())->toBeNull();
+});
+
+it('refuses a price nothing proves is ours, and says so', function () {
+    Log::spy();
+
+    // What a person clicking through Stripe's own dashboard leaves behind: the
+    // right money on our product, and not one word about what it is for.
+    $this->stripe->plantPrice('price_by_hand', 'prod_support', 3480, 'EUR', 'month', []);
+
+    expect(adoptModulePrice())->toBeNull();
+
+    Log::shouldHaveReceived('warning')->once();
+});
+
+it('passes silently over another of our own prices', function () {
+    Log::spy();
+
+    // At a VAT rate of nought both treatments are the same amount, so the
+    // reverse-charge Price sits at the domestic one's money — and contradicts on
+    // tax_treatment. That is not a mystery worth a warning; it is a Price of
+    // ours that is not the one being asked for.
+    $this->stripe->plantPrice('price_rc', 'prod_support', 3480, 'EUR', 'month',
+        moduleMetadata('reverse_charge'));
+
+    expect(adoptModulePrice())->toBeNull();
+
+    Log::shouldNotHaveReceived('warning');
+});
+
+it('never hands out a price a row already claims', function () {
+    $this->stripe->plantPrice('price_taken', 'prod_support', 3480, 'EUR', 'month', moduleMetadata());
+
+    expect(adoptModulePrice(claimed: fn (string $id) => $id === 'price_taken'))->toBeNull();
+});
+
+it('adopts the oldest of several orphans and stops selling the rest', function () {
+    Log::spy();
+
+    $this->stripe->plantPrice('price_second', 'prod_support', 3480, 'EUR', 'month',
+        ['addon' => 'priority_support'], created: 200);
+    $this->stripe->plantPrice('price_first', 'prod_support', 3480, 'EUR', 'month',
+        ['addon' => 'priority_support'], created: 100);
+    $this->stripe->plantPrice('price_third', 'prod_support', 3480, 'EUR', 'month',
+        ['addon' => 'priority_support'], created: 300);
+
+    // The oldest, because it is the one a lost row is likeliest to have been
+    // billing on.
+    expect(adoptModulePrice())->toBe('price_first')
+        ->and($this->stripe->archived)->toBe(['price_second', 'price_third']);
+
+    Log::shouldHaveReceived('warning');
+});
+
+it('takes the orphan over instead of minting a second module price', function () {
+    // The product exists because a previous run got that far; the Price exists
+    // because the run that made it died before the insert.
+    $this->stripe->plantPrice('price_1TygdEC7u8NpJ8pOt3nsoyYw', 'prod_support',
+        3480, 'EUR', 'month', ['addon' => 'priority_support']);
+    StripeAddonPrice::query()->create([
+        'addon_key' => 'priority_support', 'reverse_charge' => false,
+        'amount_cents' => 41760, 'net_cents' => 34800, 'currency' => 'EUR',
+        'interval' => 'year', 'stripe_product_id' => 'prod_support',
+        'stripe_price_id' => 'price_yearly_already_known',
+    ]);
+
+    $before = count($this->stripe->prices);
+
+    $id = app(AddonPrices::class)->ensure(
+        'priority_support', 2900, 'EUR', Subscription::TERM_MONTHLY, TaxTreatment::domestic(),
+    );
+
+    expect($id)->toBe('price_1TygdEC7u8NpJ8pOt3nsoyYw')
+        // Nothing new at Stripe: the orphan was taken over, not replaced.
+        ->and(count($this->stripe->prices))->toBe($before)
+        ->and(StripeAddonPrice::query()
+            ->where('addon_key', 'priority_support')
+            ->where('interval', 'month')
+            ->where('reverse_charge', false)
+            ->value('stripe_price_id'))->toBe('price_1TygdEC7u8NpJ8pOt3nsoyYw');
+});
+
+it('does not block a booking because the metadata format moved', function () {
+    // 2026-07-29, exactly: orphan with the old metadata, code with the new. This
+    // is the call that answered HTTP 400 for twenty-four hours.
+    $this->stripe->plantPrice('price_1TygdEC7u8NpJ8pOt3nsoyYw', 'prod_support',
+        3480, 'EUR', 'month', ['addon' => 'priority_support']);
+    StripeAddonPrice::query()->create([
+        'addon_key' => 'priority_support', 'reverse_charge' => false,
+        'amount_cents' => 41760, 'net_cents' => 34800, 'currency' => 'EUR',
+        'interval' => 'year', 'stripe_product_id' => 'prod_support',
+        'stripe_price_id' => 'price_yearly_already_known',
+    ]);
+
+    // Stripe's own side of that morning, and load-bearing for the same reason as
+    // the cleared ledger in 'takes over an orphaned package price' below — only
+    // the other way round. Without an entry here createPrice() would simply mint,
+    // and the test could not tell "adoption prevented the 400" from "no 400 was
+    // possible". So the ledger is seeded with what the pre-9da1358 call left
+    // behind: the id it was answered with, and a fingerprint over the metadata
+    // that call sent — `addon` alone, before tax_treatment existed. The entry sits
+    // under the header today's code sends, because that is the only way a ledger
+    // keyed by header can put this createPrice() in front of a poisoned key: the
+    // fingerprint is folded into the header now, so a changed call also changes
+    // the header, which is the branch's OTHER half of the same fix. Seeded
+    // directly, therefore, and honestly so — what it stands in for is Stripe
+    // holding this call's key against different parameters.
+    $this->stripe->keys[IdempotencyKey::forPrice(
+        'clupilot-addon-price-priority_support-month-3480-EUR',
+        'prod_support', 3480, 'EUR', 'month', moduleMetadata(),
+    )] = [
+        'id' => 'price_1TygdEC7u8NpJ8pOt3nsoyYw',
+        'fingerprint' => IdempotencyKey::fingerprint(IdempotencyKey::priceParameters(
+            'prod_support', 3480, 'EUR', 'month', ['addon' => 'priority_support'],
+        )),
+    ];
+
+    $id = app(AddonPrices::class)->ensure(
+        'priority_support', 2900, 'EUR', Subscription::TERM_MONTHLY, TaxTreatment::domestic(),
+    );
+
+    // Adoption is what keeps createPrice() from ever being reached. Take the
+    // adopt() call out of AddonPrices::ensure() and this test does not merely
+    // return the wrong id — it dies inside the fake with Stripe's own sentence,
+    // 'Keys for idempotent requests can only be used with the same parameters
+    // they were first used with.' That is the 2026-07-29 blockade, reproduced.
+    expect($id)->toBe('price_1TygdEC7u8NpJ8pOt3nsoyYw')
+        ->and($this->stripe->metadataUpdates)->toHaveCount(1);
+});
+
+it('leaves a frozen booking on the price it was sold at', function () {
+    // Seeds the product id AddonPrices::product() will find and reuse — same
+    // reason as the first two tests in this file. Without it, the sync below
+    // mints its own Stripe Product with a generated id, and the orphan planted
+    // further down (deliberately at the literal 'prod_support' Stripe uses
+    // throughout this file) would sit on a product nothing ever asks about,
+    // making it inert rather than the competing figure the test needs.
+    StripeAddonPrice::query()->create([
+        'addon_key' => 'priority_support', 'reverse_charge' => false,
+        'amount_cents' => 41760, 'net_cents' => 34800, 'currency' => 'EUR',
+        'interval' => 'year', 'stripe_product_id' => 'prod_support',
+        'stripe_price_id' => 'price_yearly_already_known',
+    ]);
+
+    app(Kernel::class)->call('stripe:sync-catalogue');
+
+    $sold = app(AddonPrices::class)->liveFor(
+        'priority_support', 2900, 'EUR', Subscription::TERM_MONTHLY, TaxTreatment::domestic(),
+    );
+
+    $subscription = Subscription::factory()->plan('team')->create();
+    $booking = SubscriptionAddon::query()->create([
+        'subscription_id' => $subscription->id,
+        'addon_key' => 'priority_support',
+        // Net, per month, per unit — frozen at booking. `currency` and
+        // `booked_at` are both NOT NULL (2026_07_26_060000), and `uuid` fills
+        // itself through the model's uniqueIds().
+        'price_cents' => 2900,
+        'currency' => 'EUR',
+        'quantity' => 1,
+        'booked_at' => now(),
+        'stripe_price_id' => $sold,
+    ]);
+
+    // The catalogue moves, and somebody has already left an orphan at the new
+    // figure. Neither may reach a booking that is already frozen.
+    config()->set('provisioning.addons.priority_support.price_cents', 3900);
+    $this->stripe->plantPrice('price_orphan_new_figure', 'prod_support',
+        4680, 'EUR', 'month', ['addon' => 'priority_support']);
+
+    app(Kernel::class)->call('stripe:sync-catalogue');
+
+    // The `archived` assertion right below — the second of this chain — is
+    // this test's only adoption tooth. AdoptStripePrice archives a Price at
+    // Stripe when it treats one as a duplicate of another it adopted, and
+    // that is the one way it could reach past the figure it was asked for
+    // (4680, the new one) and take the frozen booking's own Price (3480) down
+    // with it as a false "duplicate".
+    //
+    // The three assertions after it read the SWEEP's own row-writing code,
+    // not adoption — AdoptStripePrice performs no database writes at all, so
+    // nothing it does, singly or in combination, can fail them. They earn
+    // their place anyway, because they are exactly what a defect in the
+    // sweep's OTHER two writers would fail: archiveSuperseded() losing its
+    // `->where('net_cents', $netCents)` scoping (its own docblock is about
+    // precisely why that scoping has to hold) would sweep the 2900-net row up
+    // alongside the 3900-net one it is meant to supersede, and remember()
+    // rewritten as an updateOrCreate() keyed without `amount_cents` — the
+    // plausible-looking fix for the UniqueConstraintViolationException catch
+    // a few lines below it — would silently overwrite the very row these
+    // assertions read.
+    //
+    // Neither of adoption's two guards is isolated by this test — the amount
+    // match and the `claimed` callback cover for each other in this scenario,
+    // which is why sabotaging either alone during this fix round left the
+    // booking untouched. Each is isolated on its own elsewhere in this file:
+    // it('adopts nothing when the amount, currency or interval differ') and
+    // it('never hands out a price a row already claims').
+    expect($booking->refresh()->stripe_price_id)->toBe($sold)
+        ->and($this->stripe->archived)->not->toContain($sold)
+        // The OLD figure's Price is still what a checkout for it would use —
+        // adoption of the orphan at the NEW figure must not have reached
+        // backwards and pulled the frozen figure's Price out of circulation.
+        ->and(app(AddonPrices::class)->liveFor(
+            'priority_support', 2900, 'EUR', Subscription::TERM_MONTHLY, TaxTreatment::domestic(),
+        ))->toBe($sold)
+        // The row itself, not only whether it is archived — `archived_at`
+        // reads null for a row that is still live AND for one that is gone
+        // or rewritten onto a different net_cents, so `exists()` has to stand
+        // beside it or the row's disappearance would pass silently.
+        ->and(StripeAddonPrice::query()
+            ->where('addon_key', 'priority_support')
+            ->where('reverse_charge', false)
+            ->where('net_cents', 2900)
+            ->where('interval', 'month')
+            ->exists())->toBeTrue()
+        ->and(StripeAddonPrice::query()
+            ->where('addon_key', 'priority_support')
+            ->where('reverse_charge', false)
+            ->where('net_cents', 2900)
+            ->where('interval', 'month')
+            ->value('archived_at'))->toBeNull()
+        // And asking for the OLD figure again — the same call a renewal on
+        // this very booking would make — must still be handed $sold, not the
+        // orphan sitting at the new figure's amount.
+        ->and(app(AddonPrices::class)->ensure(
+            'priority_support', 2900, 'EUR', Subscription::TERM_MONTHLY, TaxTreatment::domestic(),
+        ))->toBe($sold);
+});
+
+it('takes over an orphaned package price', function () {
+    // A catalogue mirrored once, so families have Products and rows have Prices.
+    app(Kernel::class)->call('stripe:sync-catalogue');
+
+    $row = PlanPrice::query()->firstOrFail();
+    $charged = PlanPrices::chargedCents($row, TaxTreatment::domestic());
+
+    // The register loses its row and Stripe keeps the Price: a run that died
+    // between the two, seen from the next run's point of view.
+    $orphan = (string) StripePlanPrice::query()
+        ->where('plan_price_id', $row->id)
+        ->where('reverse_charge', false)
+        ->value('stripe_price_id');
+    StripePlanPrice::query()->where('stripe_price_id', $orphan)->delete();
+
+    // Load-bearing, not incidental cleanup: Stripe forgets an idempotency key
+    // after twenty-four hours, and that expiry is the only condition under
+    // which the 2026-07-29 duplicate was ever minted. With the sync's own key
+    // still in the fake's ledger, createPrice() would just replay $orphan's
+    // id on its own — proving nothing about adoption. Clearing it is what
+    // makes createPrice() able to mint a genuine second Price, which is the
+    // only way this test can fail.
+    $this->stripe->keys = [];
+
+    $before = count($this->stripe->prices);
+
+    $id = app(PlanPrices::class)->ensure($row->refresh(), TaxTreatment::domestic());
+
+    expect($id)->toBe($orphan)
+        ->and(count($this->stripe->prices))->toBe($before)
+        ->and(StripePlanPrice::query()
+            ->where('plan_price_id', $row->id)
+            ->where('reverse_charge', false)
+            ->where('charged_cents', $charged)
+            ->value('stripe_price_id'))->toBe($orphan)
+        // The pointer for the ordinary domestic sale is written as before.
+        ->and((string) $row->refresh()->stripe_price_id)->toBe($orphan);
+});
+
+it('does not take a package price belonging to another catalogue row', function () {
+    app(Kernel::class)->call('stripe:sync-catalogue');
+
+    $row = PlanPrice::query()->firstOrFail();
+    $product = (string) $row->version->family->stripe_product_id;
+    $charged = PlanPrices::chargedCents($row, TaxTreatment::domestic());
+    $interval = $row->term === Subscription::TERM_YEARLY ? 'year' : 'month';
+
+    // This row's OWN domestic Price from the sync above becomes a legitimate
+    // orphan the moment its register row is gone — exactly like the test
+    // above — and adopt() would be right to reclaim it. Archived here so the
+    // only Price left at this exact figure is the wrong-owner one below:
+    // otherwise adoption would correctly adopt the row's own orphan before
+    // ever weighing 'price_other_row', and the rejection this test exists to
+    // prove would never be reached.
+    $this->stripe->archivePrice((string) StripePlanPrice::query()
+        ->where('plan_price_id', $row->id)
+        ->where('reverse_charge', false)
+        ->value('stripe_price_id'));
+
+    StripePlanPrice::query()->where('plan_price_id', $row->id)->delete();
+
+    // Same product, same money, same interval — and plan_price_id says it is a
+    // DIFFERENT row's Price. One Product carries every version and term of a
+    // family, so this is the ordinary case, not an exotic one.
+    $this->stripe->plantPrice('price_other_row', $product, $charged, (string) $row->currency,
+        $interval, ['plan_price_id' => (string) ($row->id + 1000), 'tax_treatment' => 'domestic']);
+
+    // Same reason as the test above: with the sync's own idempotency key
+    // still in force, createPrice() would replay THIS row's own previous
+    // Price — which would also not be 'price_other_row', whether or not
+    // adoption ever looked at the wrong-owner Price at all. Clearing the
+    // ledger forces a real mint when nothing adoptable is found, which is
+    // what gives the assertions below something to catch.
+    $this->stripe->keys = [];
+
+    $before = count($this->stripe->prices);
+
+    $id = app(PlanPrices::class)->ensure($row->refresh(), TaxTreatment::domestic());
+
+    expect($id)->not->toBe('price_other_row')
+        // A fresh Price was minted rather than 'price_other_row' being handed
+        // out. Proves AdoptStripePrice's contradicts()/confirms() pair
+        // correctly refused the wrong-owner Price WHEN adoption runs — the
+        // two guard each other here exactly as they do on the module side, so
+        // either alone still catches this; only disabling both together lets
+        // 'price_other_row' through. It does NOT prove PlanPrices wires
+        // adopt() into ensure() at all: skipping that wiring entirely mints
+        // fresh here too, indistinguishable from a correct refusal. The test
+        // above ("takes over an orphaned package price") is what proves the
+        // wiring is present.
+        ->and(count($this->stripe->prices))->toBe($before + 1)
+        // The Price belonging to the other row must survive untouched.
+        // AdoptStripePrice archives every orphan but the one it adopts, so a
+        // defect that let it treat 'price_other_row' as a duplicate of
+        // whatever it did adopt would take this down as collateral damage —
+        // exactly the failure a wrong plan_price_id must never cause.
+        ->and($this->stripe->archived)->not->toContain('price_other_row');
+});
+
+it('does not adopt a package price that only proves the family, not this row', function () {
+    // The whole reason the plan side needs `identifying: ['plan_price_id']`
+    // rather than the module side's simpler key: one Product carries a Price
+    // for every version, term AND treatment of a family, so a Price that
+    // proves only the FAMILY could be any of them. If `identifying` were ever
+    // loosened to ['plan_family'], a Price like the one planted below would
+    // wrongly confirm — nothing else here would catch it.
+    app(Kernel::class)->call('stripe:sync-catalogue');
+
+    $row = PlanPrice::query()->firstOrFail();
+    $product = (string) $row->version->family->stripe_product_id;
+    $charged = PlanPrices::chargedCents($row, TaxTreatment::domestic());
+    $interval = $row->term === Subscription::TERM_YEARLY ? 'year' : 'month';
+
+    // This row's OWN domestic Price is a legitimate orphan the moment its
+    // register row is gone — same reason as the two tests above — and would
+    // otherwise be correctly re-adopted before the planted Price below is
+    // ever weighed, masking the very rejection this test means to prove.
+    $this->stripe->archivePrice((string) StripePlanPrice::query()
+        ->where('plan_price_id', $row->id)
+        ->where('reverse_charge', false)
+        ->value('stripe_price_id'));
+
+    StripePlanPrice::query()->where('plan_price_id', $row->id)->delete();
+
+    // Right product, right money, right currency, right interval, and the
+    // right FAMILY — the one thing missing is plan_price_id, which is the
+    // only key that says which of the family's many rows a Price belongs to.
+    $this->stripe->plantPrice('price_family_only', $product, $charged, (string) $row->currency,
+        $interval, ['plan_family' => $row->version->family->key]);
+
+    // Same reason as the two tests above: with the sync's own idempotency
+    // key still in force, createPrice() would replay this row's own previous
+    // Price rather than genuinely minting, leaving nothing for the
+    // assertions below to catch.
+    $this->stripe->keys = [];
+
+    $before = count($this->stripe->prices);
+
+    $id = app(PlanPrices::class)->ensure($row->refresh(), TaxTreatment::domestic());
+
+    expect($id)->not->toBe('price_family_only')
+        // A fresh Price was minted rather than the family-only Price being
+        // handed out — this is the assertion `identifying: ['plan_price_id']`
+        // exists to keep true; swap it for ['plan_family'] and this fails.
+        ->and(count($this->stripe->prices))->toBe($before + 1)
+        ->and($this->stripe->archived)->not->toContain('price_family_only');
+});
+
+it('lets no two module rows claim one stripe price', function () {
+    $shared = [
+        'addon_key' => 'priority_support', 'net_cents' => 2900, 'currency' => 'EUR',
+        'stripe_product_id' => 'prod_support', 'stripe_price_id' => 'price_shared',
+    ];
+
+    StripeAddonPrice::query()->create([...$shared,
+        'reverse_charge' => false, 'amount_cents' => 3480, 'interval' => 'month']);
+
+    // Two rows on one Price is what Block D warned about: archiving the one
+    // would withdraw the Price the other is still selling.
+    expect(fn () => StripeAddonPrice::query()->create([...$shared,
+        'reverse_charge' => true, 'amount_cents' => 2900, 'interval' => 'month']))
+        ->toThrow(UniqueConstraintViolationException::class);
+});
+
+it('keeps only the lowest-id row in every group of duplicates, and leaves the rest of the table alone', function () {
+    // This is the one branch of 2026_07_31_210000_one_row_per_stripe_price that
+    // deletes rows from a live table, and it cannot be reached through the
+    // ordinary migrated schema: RefreshDatabase already ran this migration, so
+    // its OWN unique index would refuse the very duplicate this test needs to
+    // insert. Dropping the index first puts the table back into the shape the
+    // migration was written to find — the shape a real, never-yet-migrated
+    // production table was in — so up() can be run again and actually take its
+    // delete branch instead of finding nothing to do.
+    Schema::table('stripe_addon_prices', fn (Blueprint $table) => $table->dropUnique('stripe_addon_prices_price_unique'));
+
+    // Group one: two rows sharing a Price, differing in `reverse_charge` so the
+    // pre-existing COMPOSITE unique index (addon_key, reverse_charge,
+    // amount_cents, currency, interval) does not itself refuse the insert —
+    // the VAT-rate-zero case Block D warned about, where only the shared
+    // stripe_price_id gives the duplicate away.
+    $kept = DB::table('stripe_addon_prices')->insertGetId([
+        'addon_key' => 'priority_support', 'reverse_charge' => false,
+        'amount_cents' => 2900, 'net_cents' => 2900, 'currency' => 'EUR', 'interval' => 'month',
+        'stripe_product_id' => 'prod_support', 'stripe_price_id' => 'price_shared',
+        'created_at' => now(), 'updated_at' => now(),
+    ]);
+
+    $duplicate = DB::table('stripe_addon_prices')->insertGetId([
+        'addon_key' => 'priority_support', 'reverse_charge' => true,
+        'amount_cents' => 2900, 'net_cents' => 2900, 'currency' => 'EUR', 'interval' => 'month',
+        'stripe_product_id' => 'prod_support', 'stripe_price_id' => 'price_shared',
+        'created_at' => now(), 'updated_at' => now(),
+    ]);
+
+    // Group two: THREE rows sharing a second, different Price — its own tuple
+    // dimension varied per row (interval, then currency) so the composite index
+    // never fires here either. One group of two proves the loop runs; this one
+    // proves it runs more than once AND that a single iteration can delete more
+    // than one row.
+    $kept2 = DB::table('stripe_addon_prices')->insertGetId([
+        'addon_key' => 'priority_support', 'reverse_charge' => false,
+        'amount_cents' => 3900, 'net_cents' => 3900, 'currency' => 'EUR', 'interval' => 'month',
+        'stripe_product_id' => 'prod_support', 'stripe_price_id' => 'price_shared_two',
+        'created_at' => now(), 'updated_at' => now(),
+    ]);
+
+    $duplicate2a = DB::table('stripe_addon_prices')->insertGetId([
+        'addon_key' => 'priority_support', 'reverse_charge' => false,
+        'amount_cents' => 3900, 'net_cents' => 3900, 'currency' => 'EUR', 'interval' => 'year',
+        'stripe_product_id' => 'prod_support', 'stripe_price_id' => 'price_shared_two',
+        'created_at' => now(), 'updated_at' => now(),
+    ]);
+
+    $duplicate2b = DB::table('stripe_addon_prices')->insertGetId([
+        'addon_key' => 'priority_support', 'reverse_charge' => false,
+        'amount_cents' => 3900, 'net_cents' => 3900, 'currency' => 'USD', 'interval' => 'month',
+        'stripe_product_id' => 'prod_support', 'stripe_price_id' => 'price_shared_two',
+        'created_at' => now(), 'updated_at' => now(),
+    ]);
+
+    // On its own Price entirely — not part of any duplicate group — and must
+    // survive completely untouched.
+    $unrelated = DB::table('stripe_addon_prices')->insertGetId([
+        'addon_key' => 'extra_storage', 'reverse_charge' => false,
+        'amount_cents' => 1000, 'net_cents' => 1000, 'currency' => 'EUR', 'interval' => 'month',
+        'stripe_product_id' => 'prod_storage', 'stripe_price_id' => 'price_untouched',
+        'created_at' => now(), 'updated_at' => now(),
+    ]);
+
+    // require, not require_once: the file `return`s a fresh anonymous-class
+    // instance every time it is evaluated, which is what lets this run the
+    // migration's up() a second time in this same process.
+    (require database_path('migrations/2026_07_31_210000_one_row_per_stripe_price.php'))->up();
+
+    $keptRow = DB::table('stripe_addon_prices')->where('id', $kept)->first();
+    $kept2Row = DB::table('stripe_addon_prices')->where('id', $kept2)->first();
+    $unrelatedRow = DB::table('stripe_addon_prices')->where('id', $unrelated)->first();
+
+    // The LOWER id survives in each group — the row that was written first,
+    // which is the one anything already billing is likeliest to have been
+    // reading. Were that ordering silently inverted, the surviving row could be
+    // one nothing ever pointed at. Read back, not merely checked for existence:
+    // a survivor that exists but was mangled in the process — the wrong
+    // stripe_price_id, or an amount_cents that no longer matches what the
+    // shared Price actually charges — would be exactly the "kept the right row
+    // but damaged it" failure existence alone cannot catch.
+    expect($keptRow)->not->toBeNull()
+        ->and($keptRow->stripe_price_id)->toBe('price_shared')
+        ->and((int) $keptRow->amount_cents)->toBe(2900)
+        ->and($kept2Row)->not->toBeNull()
+        ->and($kept2Row->stripe_price_id)->toBe('price_shared_two')
+        ->and((int) $kept2Row->amount_cents)->toBe(3900)
+        ->and($unrelatedRow)->not->toBeNull()
+        ->and($unrelatedRow->stripe_price_id)->toBe('price_untouched')
+        ->and((int) $unrelatedRow->amount_cents)->toBe(1000)
+        // Every duplicate in both groups is gone — the higher id from group
+        // one, and BOTH higher ids from group two's three-way tie.
+        ->and(DB::table('stripe_addon_prices')->where('id', $duplicate)->exists())->toBeFalse()
+        ->and(DB::table('stripe_addon_prices')->where('id', $duplicate2a)->exists())->toBeFalse()
+        ->and(DB::table('stripe_addon_prices')->where('id', $duplicate2b)->exists())->toBeFalse()
+        // Six rows went in, three survive: nothing beyond the two kept
+        // duplicates and the untouched row is left standing.
+        ->and(DB::table('stripe_addon_prices')->count())->toBe(3);
+
+    // And the index is back in force: a further row on a third, otherwise
+    // distinct tuple, but the SAME Price id, is refused by stripe_price_id
+    // alone rather than being silently accepted.
+    expect(fn () => DB::table('stripe_addon_prices')->insert([
+        'addon_key' => 'priority_support', 'reverse_charge' => false,
+        'amount_cents' => 4900, 'net_cents' => 4900, 'currency' => 'EUR', 'interval' => 'year',
+        'stripe_product_id' => 'prod_support', 'stripe_price_id' => 'price_shared',
+        'created_at' => now(), 'updated_at' => now(),
+    ]))->toThrow(UniqueConstraintViolationException::class);
+});
diff --git a/tests/Feature/Billing/WithdrawalTest.php b/tests/Feature/Billing/WithdrawalTest.php
index 3026313..324b04a 100644
--- a/tests/Feature/Billing/WithdrawalTest.php
+++ b/tests/Feature/Billing/WithdrawalTest.php
@@ -539,9 +539,13 @@ it('shows the card to a consumer and never to a business', function () {
     $user = User::factory()->create(['email' => $contract->customer->email]);
     $contract->customer->update(['user_id' => $user->id]);
 
-    Livewire::actingAs($user)->test(Settings::class)->assertSee(__('withdrawal.cta'));
+    // On the contract tab: the settings page is four tabs now, and a withdrawal
+    // belongs with the contract rather than with the company address.
+    Livewire::actingAs($user)->test(Settings::class, ['tab' => 'contract'])
+        ->assertSee(__('withdrawal.cta'));
 
     $contract->customer->update(['customer_type' => Customer::TYPE_BUSINESS]);
 
-    Livewire::actingAs($user)->test(Settings::class)->assertDontSee(__('withdrawal.cta'));
+    Livewire::actingAs($user)->test(Settings::class, ['tab' => 'contract'])
+        ->assertDontSee(__('withdrawal.cta'));
 });
diff --git a/tests/Feature/Billing/YearlyTermTest.php b/tests/Feature/Billing/YearlyTermTest.php
new file mode 100644
index 0000000..ee4eebb
--- /dev/null
+++ b/tests/Feature/Billing/YearlyTermTest.php
@@ -0,0 +1,206 @@
+<?php
+
+use App\Livewire\Admin\PlanVersions;
+use App\Models\PlanVersion;
+use App\Models\Subscription;
+use App\Models\User;
+use App\Services\Billing\PlanCatalogue;
+use App\Services\Stripe\FakeStripeClient;
+use App\Services\Stripe\StripeClient;
+use Illuminate\Support\Facades\DB;
+use Illuminate\Support\Facades\File;
+
+/**
+ * Paying for a year, and what that is worth saying out loud.
+ *
+ * Both prices have existed since the catalogue did — one `plan_prices` row per
+ * term, each with its own Stripe Price — but only the monthly one was ever shown.
+ * A customer could not choose the term, the console could only type the yearly
+ * TOTAL as a second free-form figure, and nothing in the system knew why 588
+ * belonged to a package costing 49 a month. So no page could say "two months
+ * free" without a person working it out again by hand.
+ *
+ * `free_months` on the version is that missing fact. The total is derived from
+ * it, which is the only arrangement in which the sentence a customer reads and
+ * the amount Stripe charges cannot drift apart.
+ */
+beforeEach(function () {
+    $this->stripe = new FakeStripeClient;
+    app()->instance(StripeClient::class, $this->stripe);
+
+    // A DIFFERENT id per term, unlike the other checkout suites: this one is
+    // about which of the two is picked, and one id shared by both would make
+    // every assertion here pass whatever the code did. Two statements rather
+    // than one concat(): the suite runs on SQLite, which spells that ||.
+    foreach ([Subscription::TERM_MONTHLY, Subscription::TERM_YEARLY] as $term) {
+        DB::table('plan_prices')->where('term', $term)->update(['stripe_price_id' => 'price_'.$term]);
+    }
+});
+
+function termBuyer(): User
+{
+    return User::factory()->create(['email_verified_at' => now()]);
+}
+
+it('derives the year from the month and the free months', function () {
+    // The arithmetic, in the one place both the form preview and the draft use.
+    expect(PlanVersions::yearlyCents(4900, 0))->toBe(58800)
+        ->and(PlanVersions::yearlyCents(4900, 2))->toBe(49000)
+        ->and(PlanVersions::yearlyCents(17900, 1))->toBe(196900)
+        // Out of range is clamped rather than turned into a negative price.
+        ->and(PlanVersions::yearlyCents(4900, 99))->toBe(0);
+});
+
+it('offers both terms in the shop, with the figure behind the saving', function () {
+    $plan = app(PlanCatalogue::class)->sellable()['team'];
+
+    expect($plan)->toHaveKeys(['price_cents', 'yearly_price_cents', 'free_months'])
+        ->and($plan['price_cents'])->toBe(17900)
+        // Twelve for twelve on this installation until somebody sets otherwise —
+        // what matters is that the figure is READ rather than assumed.
+        ->and($plan['yearly_price_cents'])->toBe(17900 * (12 - $plan['free_months']));
+});
+
+it('freezes the free months when the version is published', function () {
+    // It is part of the terms a customer bought, not presentation: the yearly
+    // amount was derived from it, and changing it afterwards would rewrite what
+    // a running contract says it agreed to.
+    $version = PlanVersion::query()->whereNotNull('published_at')->first();
+
+    expect(fn () => $version->update(['free_months' => 3]))
+        ->toThrow(RuntimeException::class);
+});
+
+it('lets a customer pick the term on the order page', function () {
+    $page = $this->actingAs(termBuyer())->get(route('order'))->assertOk()->getContent();
+
+    // Both figures rendered, one shown: switching costs no round trip.
+    expect($page)->toContain("term = 'yearly'")
+        ->and($page)->toContain(__('order.term_yearly'));
+});
+
+it('links to the checkout with one query string, not two question marks', function () {
+    // Both parameters are query parameters, so route() + '?term=' built
+    // `?plan=team?term=monthly` and the package arrived as the whole string
+    // "team?term=monthly". Every click landed on "this package is not on sale",
+    // and nothing in the page or the log said why.
+    $page = $this->actingAs(termBuyer())->get(route('order'))->assertOk()->getContent();
+
+    preg_match_all('/href="([^"]*checkout[^"]*)"/', $page, $plain);
+    preg_match_all('/x-bind:href="\x27([^\x27]*)\x27/', $page, $bound);
+
+    expect($plain[1])->not->toBeEmpty()
+        ->and($bound[1])->not->toBeEmpty();
+
+    foreach (array_merge($plain[1], $bound[1]) as $href) {
+        expect(substr_count($href, '?'))->toBe(1, $href);
+    }
+});
+
+it('keeps the saving above the switch, where it cannot move the buttons', function () {
+    // It hung underneath and was hidden on the yearly view, so choosing a term
+    // moved the very buttons that choose it.
+    $page = Illuminate\Support\Facades\File::get(resource_path('views/livewire/order.blade.php'));
+
+    expect(strpos($page, "order.free_months_hint"))->toBeLessThan(strpos($page, "order.term_'.\$option"))
+        // And it is always there: one line, two wordings, no appearing and
+        // disappearing.
+        ->and($page)->toContain('order.free_months_taken');
+});
+
+it('carries the chosen term into the checkout page and its form', function () {
+    $page = $this->actingAs(termBuyer())
+        ->get(route('checkout', ['plan' => 'team', 'term' => 'yearly']))
+        ->assertOk()
+        ->getContent();
+
+    expect($page)->toContain('name="term" value="yearly"')
+        // And the yearly figure is the one on the summary: 179,00 × 12 gross.
+        ->and($page)->toContain('2.577,60');
+});
+
+it('refuses a term nobody sells even in the address bar', function () {
+    // A URL is a string somebody can retype. An unknown term falls back to the
+    // month rather than showing a page priced from nothing.
+    $page = $this->actingAs(termBuyer())
+        ->get(route('checkout', ['plan' => 'team', 'term' => 'weekly']))
+        ->assertOk()
+        ->getContent();
+
+    expect($page)->toContain('name="term" value="monthly"');
+});
+
+it('opens the checkout on the yearly Stripe Price when yearly was chosen', function () {
+    // The one that matters: a term shown but not carried through would charge a
+    // month at the yearly price or the other way round.
+    $version = app(PlanCatalogue::class)->currentVersion('team');
+    $yearly = $version->priceFor(Subscription::TERM_YEARLY);
+
+    $this->actingAs(termBuyer())->post(route('checkout.start'), [
+        'plan' => 'team',
+        'term' => Subscription::TERM_YEARLY,
+        'terms_accepted' => '1',
+    ]);
+
+    expect($this->stripe->checkouts)->toHaveCount(1)
+        ->and($this->stripe->checkouts[0]['price'])->toBe($yearly->stripe_price_id);
+});
+
+it('defaults to the month when no term was sent at all', function () {
+    // A form with JavaScript off posts an empty term, and "empty" must not mean
+    // "whichever row comes first".
+    $version = app(PlanCatalogue::class)->currentVersion('team');
+
+    $this->actingAs(termBuyer())->post(route('checkout.start'), ['plan' => 'team', 'terms_accepted' => '1']);
+
+    expect($this->stripe->checkouts[0]['price'])
+        ->toBe($version->priceFor(Subscription::TERM_MONTHLY)->stripe_price_id);
+});
+
+it('refuses a term nobody sells', function () {
+    $this->actingAs(termBuyer())
+        ->post(route('checkout.start'), ['plan' => 'team', 'term' => 'weekly', 'terms_accepted' => '1'])
+        ->assertSessionHasErrors('term');
+
+    expect($this->stripe->checkouts)->toBeEmpty();
+});
+
+it('shows the yearly price on the public sheet as well', function () {
+    // "auf der website sowie im userpanel ersichtlich" — the sheet quotes the
+    // same two figures, from the same catalogue, so the switch a visitor used
+    // outside and the one in the panel cannot disagree.
+    $page = $this->get('/')->assertOk()->getContent();
+
+    expect($page)->toContain("term = 'yearly'")
+        // The yearly PRICE as the headline, in the unit it is charged in — the
+        // monthly equivalent as the headline did not move at all on a package
+        // with no free months, so the sheet looked like it ignored the click.
+        ->and($page)->toContain('/Jahr')
+        ->and($page)->toContain('entspricht');
+});
+
+it('states the term on the billing card, not just a monthly figure', function () {
+    // A yearly contract is charged once a year while the card says "per month".
+    // Without this line the customer read a number that never appears on a
+    // statement.
+    expect(File::get(resource_path('views/livewire/billing.blade.php')))
+        ->toContain("__('billing.term_yearly_note'")
+        ->and(File::get(app_path('Livewire/Billing.php')))
+        ->toContain("'term' => (string) \$subscription->term");
+});
+
+// ---- The console ----
+
+it('asks for free months rather than a second price', function () {
+    // Typing both totals let them disagree, and nothing then knew which was
+    // meant. The form takes the monthly price and the months that are free.
+    $component = File::get(app_path('Livewire/Admin/PlanVersions.php'));
+
+    expect($component)->toContain('public int $freeMonths')
+        ->and($component)->not->toContain('public string $yearlyPrice')
+        ->and($component)->toContain("'freeMonths' => 'required|integer|min:0|max:6'");
+
+    expect(File::get(resource_path('views/livewire/admin/plan-versions.blade.php')))
+        ->toContain("__('plans.free_months')")
+        ->toContain('yearlyPreview');
+});
diff --git a/tests/Feature/BladeCommentsTest.php b/tests/Feature/BladeCommentsTest.php
new file mode 100644
index 0000000..311fc33
--- /dev/null
+++ b/tests/Feature/BladeCommentsTest.php
@@ -0,0 +1,47 @@
+<?php
+
+use Illuminate\Support\Facades\File;
+
+/**
+ * A Blade comment describes a directive. It never spells one.
+ *
+ * Blade compiles what is inside `{{-- --}}` as well: the comment is stripped
+ * from the OUTPUT, but the directives in it are compiled on the way there. So a
+ * comment explaining why the parenthesised php directive was avoided produced
+ * exactly the open PHP tag it was warning about — and everything after it in the
+ * file was swallowed as PHP source.
+ *
+ * That failure is silent. No exception, no warning, no missing-view error: the
+ * page renders, one block short. The term switch on the order page disappeared
+ * this way and the only symptom was a test asserting it was there.
+ *
+ * Scoped to the forms that open a PHP tag, which are the ones that eat the rest
+ * of the file. A comment mentioning @if or @disabled is survivable and there are
+ * two of those in the repo already; this is not the place to relitigate them.
+ */
+it('never spells a php open tag inside a blade comment', function () {
+    $offenders = [];
+
+    foreach (File::allFiles(resource_path('views')) as $file) {
+        if (! str_ends_with($file->getFilename(), '.blade.php')) {
+            continue;
+        }
+
+        preg_match_all('/\{\{--.*?--\}\}/s', $file->getContents(), $comments);
+
+        foreach ($comments[0] ?? [] as $comment) {
+            // Assembled rather than written out, for the reason this test
+            // exists: the needles below would otherwise be compiled out of THIS
+            // file's own comments if it were ever a template.
+            $needles = ['@'.'php', '@'.'endphp', '<'.'?php', '<'.'?='];
+
+            foreach ($needles as $needle) {
+                if (str_contains($comment, $needle)) {
+                    $offenders[] = str_replace(resource_path().'/', '', $file->getPathname()).': '.$needle;
+                }
+            }
+        }
+    }
+
+    expect($offenders)->toBe([]);
+});
diff --git a/tests/Feature/CheckoutPageTest.php b/tests/Feature/CheckoutPageTest.php
new file mode 100644
index 0000000..8bef529
--- /dev/null
+++ b/tests/Feature/CheckoutPageTest.php
@@ -0,0 +1,140 @@
+<?php
+
+use App\Models\Customer;
+use App\Models\Subscription;
+use App\Models\User;
+use App\Services\Billing\SetupFee;
+use App\Support\Settings;
+use Illuminate\Support\Facades\File;
+
+/**
+ * The order, before it is placed.
+ *
+ * There was no such page. The order page posted straight to Stripe: the last
+ * thing a customer saw in this product's design was a grid of packages, and the
+ * next was somebody else's card form. What they were buying, what it costs in
+ * total, what happens afterwards and what they were agreeing to were never
+ * stated in one place — and the terms box sat at the TOP of the package list,
+ * as a condition of looking at prices.
+ */
+function checkoutUser(): User
+{
+    return User::factory()->create(['email_verified_at' => now()]);
+}
+
+it('states the package, the term and every figure that will be charged', function () {
+    $page = $this->actingAs(checkoutUser())
+        ->get(route('checkout', ['plan' => 'team', 'term' => 'monthly']))
+        ->assertOk();
+
+    $page->assertSee('Team')
+        ->assertSee(__('order.term_monthly'))
+        // Net, tax and gross: 179,00 net, 20 % VAT, 214,80 to pay.
+        ->assertSee('179,00')
+        ->assertSee('214,80')
+        ->assertSee(__('checkout.total_today'))
+        // And what comes after the first charge, which is not the same figure
+        // whenever a setup fee is on the first one. Asserted in two pieces: the
+        // formatter puts a non-breaking space before the sign, and building the
+        // expected string by hand is a test that checks its own typing.
+        ->assertSee(mb_substr(__('checkout.then_monthly', ['amount' => '']), 0, 6));
+});
+
+it('adds the setup fee to what is due today and to nothing after it', function () {
+    Settings::set('company.setup_fee_cents', 9900);
+
+    $page = $this->actingAs(checkoutUser())
+        ->get(route('checkout', ['plan' => 'team', 'term' => 'monthly']))
+        ->assertOk();
+
+    // 214,80 for the month plus 118,80 for the setup — both gross.
+    $page->assertSee(__('checkout.setup_line'))
+        // 214,80 for the month plus 118,80 for the setup.
+        ->assertSee('333,60')
+        // The recurring figure alone is what follows the first charge.
+        ->assertSee('214,80');
+
+    expect(SetupFee::netCents())->toBe(9900);
+});
+
+it('refuses to place the order without the terms, whatever the browser did', function () {
+    // The button is disabled until the box is ticked, and disabling a button in
+    // a browser refuses nothing. This is the rule.
+    $this->actingAs(checkoutUser())
+        ->post(route('checkout.start'), ['plan' => 'team', 'term' => 'monthly'])
+        ->assertSessionHasErrors('terms_accepted');
+});
+
+it('puts the acceptance under the total and over the button', function () {
+    // The order it is read in: what you get, what it costs, what you agree to,
+    // then the button. It used to be first, above the prices.
+    $page = File::get(resource_path('views/livewire/checkout.blade.php'));
+
+    expect(strpos($page, "__('checkout.total_today')"))
+        ->toBeLessThan(strpos($page, "__('order.terms_label'"))
+        ->and(strpos($page, "__('order.terms_label'"))
+        ->toBeLessThan(strpos($page, "__('checkout.pay_cta')"));
+});
+
+it('says what happens after the button, because the next screen is a stranger', function () {
+    // Being handed to a payment provider is the moment a first-time buyer wants
+    // to know what they are getting into.
+    $this->actingAs(checkoutUser())
+        ->get(route('checkout', ['plan' => 'start']))
+        ->assertOk()
+        ->assertSee(__('checkout.step_pay_title'))
+        ->assertSee(__('checkout.step_build_title'))
+        ->assertSee(__('checkout.step_credentials_title'))
+        ->assertSee(__('checkout.stripe_note'));
+});
+
+it('answers a package nobody sells with a sentence, not a stack trace', function () {
+    // Reached from a retyped address, or from a package taken off sale between
+    // the two pages.
+    $this->actingAs(checkoutUser())
+        ->get(route('checkout', ['plan' => 'gibt-es-nicht']))
+        ->assertOk()
+        ->assertSee(__('checkout.unknown_plan'));
+});
+
+it('sends a customer who already has a contract to their billing page', function () {
+    // A second checkout would build a second, empty cloud and bill for both.
+    // The order page says so; a link straight into this page skips that.
+    $user = checkoutUser();
+    $customer = Customer::factory()->create(['email' => $user->email, 'user_id' => $user->id]);
+    Subscription::factory()->create(['customer_id' => $customer->id, 'status' => 'active']);
+
+    $this->actingAs($user)
+        ->get(route('checkout', ['plan' => 'team']))
+        ->assertOk()
+        ->assertSee(__('order.already_customer'))
+        ->assertDontSee(__('checkout.pay_cta'));
+});
+
+it('is behind the same door as everything else', function () {
+    // An unconfirmed address is not a billing detail to be caught at checkout:
+    // the finished cloud's credentials are sent to it.
+    $this->get(route('checkout', ['plan' => 'team']))->assertRedirect();
+
+    $this->actingAs(User::factory()->unverified()->create())
+        ->get(route('checkout', ['plan' => 'team']))
+        ->assertRedirect(route('verification.notice'));
+});
+
+// ---- The mark in the mails ----
+
+it('draws the mark in the mail header, not an empty orange tile', function () {
+    // It shipped as a plain square: the ascent inside the mark lives in an SVG
+    // the site loads, and a mail cannot — Gmail strips inline SVG, Outlook
+    // renders with Word, and this layout carries no image by design. So the
+    // shape is a character every mail font has.
+    $html = (string) app(App\Services\Mail\MailPreviews::class)->make('verify-email')?->render();
+
+    // As the entity it is written with: a mail is markup, and &#9650; is what
+    // survives every client's encoding guesswork.
+    expect($html)->toContain('&#9650;')
+        ->and($html)->toContain('#f97316')
+        // And the whole name beside it, as the wordmark writes it.
+        ->and($html)->toContain('CluPilot')
+        ->and($html)->toContain('Cloud');
+});
diff --git a/tests/Feature/MailSenderOwnershipTest.php b/tests/Feature/MailSenderOwnershipTest.php
new file mode 100644
index 0000000..2fe97e0
--- /dev/null
+++ b/tests/Feature/MailSenderOwnershipTest.php
@@ -0,0 +1,54 @@
+<?php
+
+use Illuminate\Support\Facades\File;
+
+/**
+ * A From address belongs to the account that signs in.
+ *
+ * Every purpose mailbox in this installation has its OWN SMTP account, and a
+ * mail server lets an account send only from the address it owns. mailcow
+ * answers anything else with "553 5.7.1 Sender address rejected: not owned by
+ * user no-reply@…" — and it is right to.
+ *
+ * So a mail that takes its From from a mailbox has to go out over that mailbox's
+ * mailer as well. Setting one and forgetting the other produces a mail that
+ * renders perfectly, queues without complaint, and never arrives: InvoiceMail
+ * and OrderConfirmationMail both addressed billing@ while going out over the
+ * default mailer's no-reply@ login, which means no customer had ever received an
+ * invoice mail or an order confirmation on a server that checks.
+ */
+it('gives every mail that takes a mailbox From the matching mailer', function () {
+    $offenders = [];
+
+    foreach (File::allFiles(app_path('Mail')) as $file) {
+        $code = $file->getContents();
+
+        // Only the ones that take their sender from a mailbox. A mailable with
+        // no mailbox From has nothing to mismatch.
+        if (! str_contains($code, 'mailboxEnvelope(') && ! str_contains($code, 'mailboxAddresses(')) {
+            continue;
+        }
+
+        preg_match('/mailbox(?:Envelope|Addresses)\(\s*MailPurpose::([A-Z_]+)/', $code, $from);
+        preg_match("/->mailer\('cp_'\.MailPurpose::([A-Z_]+)\)/", $code, $mailer);
+
+        $fromPurpose = $from[1] ?? null;
+        $mailerPurpose = $mailer[1] ?? null;
+
+        if ($fromPurpose !== null && $fromPurpose !== $mailerPurpose) {
+            $offenders[] = $file->getFilename().': From '.$fromPurpose.', mailer '.($mailerPurpose ?? 'DEFAULT');
+        }
+    }
+
+    expect($offenders)->toBe([]);
+});
+
+it('sends each purpose over its own mailer, not over whatever mail.default is', function () {
+    // The purpose mailers exist so that each mailbox authenticates as itself.
+    // A mailable naming no mailer silently uses mail.default, which on this
+    // installation is the plain smtp mailer with ONE account behind it.
+    foreach (App\Services\Mail\MailPurpose::ALL as $purpose) {
+        expect(config('mail.mailers.cp_'.$purpose))
+            ->toBe(['transport' => 'mailbox', 'purpose' => $purpose]);
+    }
+});
diff --git a/tests/Feature/Portal/GrantedPlanPortalTest.php b/tests/Feature/Portal/GrantedPlanPortalTest.php
index a694f19..e16bd02 100644
--- a/tests/Feature/Portal/GrantedPlanPortalTest.php
+++ b/tests/Feature/Portal/GrantedPlanPortalTest.php
@@ -45,7 +45,12 @@ it('shows the granted plan on the cloud dashboard without a price', function ()
 
     Livewire::actingAs($user)
         ->test(Cloud::class)
-        ->assertDontSee('179')
+        // The formatted amount, not the bare digits: "179" also matches an id,
+        // and ids climb through a suite run because a rolled-back transaction
+        // does not reset an auto-increment counter. That made this test pass
+        // alone and fail in company. The line below is what a leak would
+        // actually look like on the page.
+        ->assertDontSee('179,00')
         ->assertDontSee('0 €')
         ->assertSee(__('billing.plan.team'));
 });
diff --git a/tests/Feature/ProcessingAgreementTest.php b/tests/Feature/ProcessingAgreementTest.php
new file mode 100644
index 0000000..f0ddc2e
--- /dev/null
+++ b/tests/Feature/ProcessingAgreementTest.php
@@ -0,0 +1,345 @@
+<?php
+
+use App\Livewire\Admin\ProcessingAgreements;
+use App\Livewire\Settings;
+use App\Models\Customer;
+use App\Models\DpaAcceptance;
+use App\Models\DpaVersion;
+use App\Models\User;
+use App\Services\Legal\ProcessingAgreement;
+use Illuminate\Http\UploadedFile;
+use Illuminate\Support\Facades\Storage;
+use Livewire\Livewire;
+
+/**
+ * The processing agreement, and the proof a customer has it.
+ *
+ * Art. 28(3) GDPR wants a contract wherever personal data is processed on
+ * somebody else's behalf, which is the whole of what this product does. "In
+ * writing" there includes electronic form (Art. 28(9)), so a document the
+ * customer can read plus a recorded acceptance is enough — no signature on
+ * paper. The website already promises "AV-Vertrag inklusive", which means it has
+ * to be obtainable without asking for it.
+ *
+ * The TEXT comes from one of two places, and the console does not care which:
+ * generated from this repository (resources/views/legal/dpa, via
+ * clupilot:publish-dpa) or uploaded as a lawyer's revision.
+ */
+function dpaCustomer(): array
+{
+    $user = User::factory()->create(['email_verified_at' => now()]);
+    $customer = Customer::factory()->create(['email' => $user->email, 'user_id' => $user->id]);
+
+    return [$user, $customer];
+}
+
+function publishedDpa(string $version = '1.0', bool $withMeasures = true): DpaVersion
+{
+    Storage::fake('local');
+
+    return DpaVersion::query()->create([
+        'version' => $version,
+        'agreement_path' => UploadedFile::fake()->create('avv.pdf', 12, 'application/pdf')->store('dpa', 'local'),
+        'measures_path' => $withMeasures
+            ? UploadedFile::fake()->create('tom.pdf', 12, 'application/pdf')->store('dpa', 'local')
+            : null,
+        'published_at' => now()->subDay(),
+    ]);
+}
+
+it('shows the customer nothing at all until a version is in force', function () {
+    // A card offering an agreement that does not exist is worse than silence.
+    [$user] = dpaCustomer();
+
+    Livewire::actingAs($user)->test(Settings::class, ['tab' => 'contract'])
+        ->assertDontSee(__('dpa.title'));
+});
+
+it('offers the document and records the acceptance with its evidence', function () {
+    $version = publishedDpa();
+    [$user, $customer] = dpaCustomer();
+
+    $page = Livewire::actingAs($user)->test(Settings::class, ['tab' => 'contract']);
+
+    // The agreement is concluded WITH the terms at checkout, so the page states
+    // that rather than nagging — and offers the extra confirmation for whoever
+    // wants one on file.
+    $page->assertSee(__('dpa.title'))
+        ->assertSee(__('dpa.in_force_note'))
+        ->assertSee(__('dpa.accept_cta'))
+        ->call('acceptProcessingAgreement')
+        ->assertDispatched('notify');
+
+    $acceptance = DpaAcceptance::query()->where('customer_id', $customer->id)->sole();
+
+    // What makes it evidence rather than a flag: the version, the moment, the
+    // login that pressed it, and where from.
+    expect($acceptance->dpa_version_id)->toBe($version->id)
+        ->and($acceptance->user_id)->toBe($user->id)
+        ->and($acceptance->accepted_at)->not->toBeNull()
+        ->and($acceptance->ip)->not->toBeNull();
+
+    // And the card states the confirmation rather than asking again.
+    Livewire::actingAs($user)->test(Settings::class, ['tab' => 'contract'])
+        ->assertSee($acceptance->accepted_at->local()->isoFormat('LL, LT'))
+        ->assertDontSee(__('dpa.accept_cta'));
+});
+
+it('counts pressing twice as one agreement', function () {
+    publishedDpa();
+    [$user, $customer] = dpaCustomer();
+
+    Livewire::actingAs($user)->test(Settings::class, ['tab' => 'contract'])
+        ->call('acceptProcessingAgreement')
+        ->call('acceptProcessingAgreement');
+
+    expect(DpaAcceptance::query()->where('customer_id', $customer->id)->count())->toBe(1);
+});
+
+it('asks again when a new version comes into force, and keeps the old acceptance', function () {
+    // Acceptance is per version: a new one supersedes the last, and accepting a
+    // superseded document is not accepting the one in force. The old row stays —
+    // it was true when it was made, and the history is the point.
+    $first = publishedDpa('1.0');
+    [$user, $customer] = dpaCustomer();
+
+    app(ProcessingAgreement::class)->accept($customer);
+
+    expect(app(ProcessingAgreement::class)->accepted($customer))->toBeTrue();
+
+    $second = DpaVersion::query()->create([
+        'version' => '2.0',
+        'agreement_path' => $first->agreement_path,
+        'published_at' => now(),
+    ]);
+
+    expect(app(ProcessingAgreement::class)->current()->id)->toBe($second->id)
+        ->and(app(ProcessingAgreement::class)->accepted($customer))->toBeFalse()
+        // Not deleted, not overwritten.
+        ->and(DpaAcceptance::query()->where('dpa_version_id', $first->id)->exists())->toBeTrue();
+});
+
+it('serves the document to the customer, and only the one in force', function () {
+    publishedDpa();
+    [$user] = dpaCustomer();
+
+    $this->actingAs($user)->get(route('dpa.file', 'agreement'))->assertOk();
+    $this->actingAs($user)->get(route('dpa.file', 'measures'))->assertOk();
+
+    // Which document applies is ours to say, not a parameter somebody can put
+    // in the address.
+    $this->actingAs($user)->get(route('dpa.file', 'sonstwas'))->assertNotFound();
+});
+
+it('does not hand the agreement to a stranger', function () {
+    publishedDpa();
+
+    $this->get(route('dpa.file', 'agreement'))->assertRedirect();
+});
+
+it('answers 404 rather than 500 when nothing is published', function () {
+    [$user] = dpaCustomer();
+
+    $this->actingAs($user)->get(route('dpa.file', 'agreement'))->assertNotFound();
+});
+
+// ---- The console ----
+
+it('takes an upload as a draft, and only a second act puts it in force', function () {
+    // Publishing leaves every customer who accepted the previous version
+    // outstanding again. That is correct, and expensive to trigger by dropping a
+    // file on a form.
+    Storage::fake('local');
+
+    Livewire::actingAs(operator('Owner'), 'operator')
+        ->test(ProcessingAgreements::class)
+        ->set('version', '3.0')
+        ->set('agreement', UploadedFile::fake()->create('avv.pdf', 20, 'application/pdf'))
+        ->call('upload')
+        ->assertHasNoErrors();
+
+    $version = DpaVersion::query()->where('version', '3.0')->sole();
+
+    expect($version->isPublished())->toBeFalse()
+        ->and(app(ProcessingAgreement::class)->current())->toBeNull()
+        ->and(Storage::disk('local')->exists($version->agreement_path))->toBeTrue();
+
+    Livewire::actingAs(operator('Owner'), 'operator')
+        ->test(ProcessingAgreements::class)
+        ->call('publish', $version->uuid);
+
+    expect(app(ProcessingAgreement::class)->current()?->id)->toBe($version->id);
+});
+
+it('takes the agreement as a PDF and nothing else', function () {
+    Storage::fake('local');
+
+    Livewire::actingAs(operator('Owner'), 'operator')
+        ->test(ProcessingAgreements::class)
+        ->set('version', '4.0')
+        ->set('agreement', UploadedFile::fake()->create('avv.docx', 20, 'application/msword'))
+        ->call('upload')
+        ->assertHasErrors(['agreement']);
+});
+
+it('refuses two versions under one name', function () {
+    publishedDpa('1.0');
+    Storage::fake('local');
+
+    Livewire::actingAs(operator('Owner'), 'operator')
+        ->test(ProcessingAgreements::class)
+        ->set('version', '1.0')
+        ->set('agreement', UploadedFile::fake()->create('avv.pdf', 20, 'application/pdf'))
+        ->call('upload')
+        ->assertHasErrors(['version']);
+});
+
+it('keeps the whole thing to operators who may manage it', function () {
+    // Its own capability: whoever keeps the platform running does not thereby
+    // decide what every customer is asked to agree to.
+    Livewire::actingAs(operator('Read-only'), 'operator')
+        ->test(ProcessingAgreements::class)
+        ->assertForbidden();
+
+    $this->actingAs(operator('Read-only'), 'operator')
+        ->get(route('admin.dpa'))
+        ->assertForbidden();
+});
+
+it('confirms publication in a modal rather than on one click', function () {
+    // R23, and for a reason beyond the rule: this is the click that makes every
+    // customer outstanding again.
+    $page = Illuminate\Support\Facades\File::get(resource_path('views/livewire/admin/processing-agreements.blade.php'));
+
+    expect($page)->toContain("component: 'admin.confirm-publish-dpa'");
+
+    $modal = Illuminate\Support\Facades\File::get(app_path('Livewire/Admin/ConfirmPublishDpa.php'));
+
+    expect($modal)->toContain("dispatch('dpa-publish-confirmed'")
+        // The modal decides nothing: the permission check stays where it was.
+        ->and($modal)->not->toContain('published_at');
+});
+
+// ---- The documents this repository generates ----
+
+it('renders both documents as real PDFs, from the company on record', function () {
+    // Generated rather than uploaded, so the agreement cannot name the company
+    // differently from the invoices — and a wording change is a diff somebody
+    // can review.
+    App\Support\CompanyProfile::put(['name' => 'Prüf GmbH', 'city' => 'Wien', 'country' => 'Österreich']);
+
+    $renderer = app(App\Services\Legal\DpaRenderer::class);
+
+    $agreement = $renderer->agreement('9.9');
+    $measures = $renderer->measures('9.9');
+
+    expect(substr($agreement, 0, 4))->toBe('%PDF')
+        ->and(substr($measures, 0, 4))->toBe('%PDF')
+        ->and(strlen($agreement))->toBeGreaterThan(20000)
+        ->and(strlen($measures))->toBeGreaterThan(20000);
+});
+
+it('names every place customer data actually leaves this application', function () {
+    // A sub-processor list that quietly omits one is the single most common
+    // defect in a processing agreement — hosting, payment and mail are the three
+    // here, and each is named with where it processes.
+    $names = collect(App\Services\Legal\DpaRenderer::subprocessors())->pluck('name')->implode(' ');
+
+    expect($names)->toContain('Hetzner')
+        ->and($names)->toContain('Stripe')
+        ->and(App\Services\Legal\DpaRenderer::subprocessors())->each->toHaveKeys(['name', 'service', 'location']);
+});
+
+it('publishes a generated version in one command, and refuses to reuse a name', function () {
+    Storage::fake('local');
+
+    $this->artisan('clupilot:publish-dpa', ['version' => '7.0'])->assertSuccessful();
+
+    $version = DpaVersion::query()->where('version', '7.0')->sole();
+
+    expect($version->isPublished())->toBeTrue()
+        ->and(Storage::disk('local')->exists($version->agreement_path))->toBeTrue()
+        ->and(Storage::disk('local')->exists($version->measures_path))->toBeTrue();
+
+    // Two documents under one name makes every acceptance ambiguous.
+    $this->artisan('clupilot:publish-dpa', ['version' => '7.0'])->assertFailed();
+});
+
+it('keeps a drafted version out of force', function () {
+    Storage::fake('local');
+
+    $this->artisan('clupilot:publish-dpa', ['version' => '8.0', '--draft' => true])->assertSuccessful();
+
+    expect(DpaVersion::query()->where('version', '8.0')->sole()->isPublished())->toBeFalse()
+        ->and(app(ProcessingAgreement::class)->current())->toBeNull();
+});
+
+it('hands the file over under a name carrying the version', function () {
+    // "Which fassung did I agree to" has to be answerable from a downloads
+    // folder months later, without opening anything.
+    publishedDpa('2.5');
+    [$user] = dpaCustomer();
+
+    $this->actingAs($user)
+        ->get(route('dpa.file', ['which' => 'agreement', 'download' => 1]))
+        ->assertOk()
+        ->assertDownload('CluPilot-AV-Vertrag-2.5.pdf');
+
+    $this->actingAs($user)
+        ->get(route('dpa.file', ['which' => 'measures', 'download' => 1]))
+        ->assertOk()
+        ->assertDownload('CluPilot-TOM-2.5.pdf');
+});
+
+it('leaves the documents readable by the process that has to serve them', function () {
+    // The failure this prevents had no error message anywhere: an artisan run in
+    // a container is root, PHP-FPM is www-data, and Laravel's local disk creates
+    // a private directory as 0700. The web process could not enter it, the
+    // route's exists() check answered false, and every link on the page 404'd
+    // while the file sat there perfectly intact.
+    //
+    // "public" here is the file MODE and nothing to do with the web: this disk's
+    // root is outside the document root either way.
+    Storage::fake('local');
+
+    $this->artisan('clupilot:publish-dpa', ['version' => '6.1'])->assertSuccessful();
+
+    $version = DpaVersion::query()->where('version', '6.1')->sole();
+
+    expect(Storage::disk('local')->getVisibility($version->agreement_path))->toBe('public')
+        ->and(Storage::disk('local')->getVisibility($version->measures_path))->toBe('public');
+});
+
+it('serves the console download too, not only the portal one', function () {
+    publishedDpa('3.3');
+    $version = DpaVersion::query()->where('version', '3.3')->sole();
+
+    $this->actingAs(operator('Owner'), 'operator')
+        ->get(route('admin.dpa.file', ['uuid' => $version->uuid, 'which' => 'agreement', 'download' => 1]))
+        ->assertOk()
+        ->assertDownload('CluPilot-AV-Vertrag-3.3.pdf');
+});
+
+it('never treats the agreement as something outstanding', function () {
+    // Art. 28 wants a contract, not a ceremony: it is concluded with the terms
+    // at checkout (see the AGB), so the page must not imply that a customer who
+    // has not clicked is missing something. Hosters that ask for a separate
+    // signature are the exception, not the rule.
+    publishedDpa();
+    [$user] = dpaCustomer();
+
+    $page = Livewire::actingAs($user)->test(Settings::class, ['tab' => 'contract'])->html();
+
+    expect($page)->toContain(__('dpa.in_force_note'))
+        // No warning colour, no "open" chip: the state is "available", and it is.
+        ->and($page)->not->toContain('text-warning">'.__('dpa.title'));
+});
+
+it('says in the terms that the agreement comes with them', function () {
+    // Which is what makes the click optional rather than a gap.
+    $terms = $this->get(route('legal.agb'))->assertOk()->getContent();
+
+    expect($terms)->toContain('Auftragsverarbeitung')
+        ->and($terms)->toContain('gesonderten Unterzeichnung')
+        ->and($terms)->toContain('Kundenbereich');
+});
diff --git a/tests/Feature/Provisioning/EndInstanceServiceTest.php b/tests/Feature/Provisioning/EndInstanceServiceTest.php
index c8b2e42..79182bc 100644
--- a/tests/Feature/Provisioning/EndInstanceServiceTest.php
+++ b/tests/Feature/Provisioning/EndInstanceServiceTest.php
@@ -186,6 +186,7 @@ it('carries the whole way from the customer cancelling to the address going away
 
     Livewire::actingAs($user)->test(ConfirmCancelPackage::class)
         ->set('confirmName', $instance->subdomain)
+        ->set('reason', 'no_longer_needed')
         ->call('cancelPackage');
 
     $instance->refresh();
diff --git a/tests/Feature/Provisioning/HostStepsTest.php b/tests/Feature/Provisioning/HostStepsTest.php
index 19b04e3..812fdbc 100644
--- a/tests/Feature/Provisioning/HostStepsTest.php
+++ b/tests/Feature/Provisioning/HostStepsTest.php
@@ -1044,6 +1044,14 @@ it('marks the host active on completion', function () {
 });
 
 it('gives the host a name that points at the tunnel, not at its public address', function () {
+    // The zone is pinned here rather than read from the machine's own .env. It
+    // used to assert the literal clupilot.com, which was true until somebody
+    // set CLUPILOT_DNS_ZONE to clupilot.cloud on their installation — and then
+    // this test failed on a correct configuration. What it is about is the
+    // SHAPE of the name and which address it carries, not which domain this
+    // particular box is configured for.
+    config()->set('provisioning.dns.zone', 'clupilot.com');
+
     $s = fakeServices();
     $host = Host::factory()->active()->create([
         'datacenter' => 'fsn',
@@ -1061,7 +1069,7 @@ it('gives the host a name that points at the tunnel, not at its public address',
     // The management address: publishing a Proxmox host's public IP would hand
     // every scanner a target. Written to the internal hostsdir, not upserted
     // anywhere via the (public) Hetzner client — see the mutation test below.
-    expect($s['hostDns']->fqdns['fsn-01'])->toBe('fsn-01.node.clupilot.cloud')
+    expect($s['hostDns']->fqdns['fsn-01'])->toBe('fsn-01.node.clupilot.com')
         ->and($s['hostDns']->ips['fsn-01'])->toBe('10.66.0.11')
         ->and($s['hostDns']->ips['fsn-01'])->not->toBe('203.0.113.11');
 });
diff --git a/tests/Feature/SelfServiceOrderTest.php b/tests/Feature/SelfServiceOrderTest.php
index fbf01d1..f27cae2 100644
--- a/tests/Feature/SelfServiceOrderTest.php
+++ b/tests/Feature/SelfServiceOrderTest.php
@@ -36,7 +36,7 @@ beforeEach(function () {
  */
 function buying(string $plan): array
 {
-    return ['plan' => $plan, 'immediate_start' => '1'];
+    return ['plan' => $plan, 'terms_accepted' => '1'];
 }
 
 /** A signed-in, verified portal user. */
@@ -156,7 +156,8 @@ it('shows the packages with the same gross prices the public sheet quotes', func
         ->get(route('order'))
         ->assertOk()
         ->assertSee('58,80')
-        ->assertSee(__('order.buy'));
+        // "Weiter", not "buy": the order page chooses, the checkout page buys.
+        ->assertSee(__('order.choose'));
 });
 
 it('promises delivery on the booking page from the estate, like everywhere else', function () {
@@ -191,14 +192,14 @@ it('does not promise a migration it has not looked at', function () {
         ->not->toContain('wie Ihre Daten sicher umziehen');
 });
 
-it('refuses to open a checkout without the express request to begin at once', function () {
+it('refuses to open a checkout without the terms being accepted', function () {
     // The gap this closes: the webhook has always read `immediate_start` off the
     // session metadata, and the checkout never put it there. So every contract
     // was concluded WITHOUT recorded consent, and every withdrawal — even on day
     // thirteen of a running cloud — had to refund the full amount.
     $this->actingAs(buyer())
         ->post(route('checkout.start'), ['plan' => 'start'])
-        ->assertSessionHasErrors('immediate_start');
+        ->assertSessionHasErrors('terms_accepted');
 
     expect($this->stripe->checkouts)->toBeEmpty();
 });
@@ -209,8 +210,8 @@ it('does not take a box that was merely present as a yes', function () {
     // not a consent.
     foreach (['', '0', 'nein'] as $value) {
         $this->actingAs(buyer())
-            ->post(route('checkout.start'), ['plan' => 'start', 'immediate_start' => $value])
-            ->assertSessionHasErrors('immediate_start');
+            ->post(route('checkout.start'), ['plan' => 'start', 'terms_accepted' => $value])
+            ->assertSessionHasErrors('terms_accepted');
     }
 
     expect($this->stripe->checkouts)->toBeEmpty();
@@ -225,15 +226,41 @@ it('carries the consent to Stripe as exactly the string the webhook compares aga
     expect($this->stripe->checkouts[0]['metadata']['immediate_start'])->toBe('1');
 });
 
-it('puts the consent in front of the customer, in the law own words', function () {
-    // On the page, once, next to the buttons — not buried in terms nobody
-    // opens. The sentence is the statutory one, and the buy buttons stay
-    // disabled until it is ticked.
+it('names what is being accepted, and links to it', function () {
+    // Not a box saying "I agree" with nothing behind it: the label says what,
+    // links to the document, and summarises beside it what a reader most needs to
+    // know before ticking — that delivery starts at once and the withdrawal right
+    // survives it.
+    //
+    // On the CHECKOUT page. It used to sit at the top of the package list as a
+    // condition of looking at prices; it is a condition of buying.
     $this->actingAs(buyer())
-        ->get(route('order'))
+        ->get(route('checkout', ['plan' => 'start']))
         ->assertOk()
-        ->assertSee(__('checkout.immediate_start'))
-        ->assertSee('immediate_start', false);
+        ->assertSee(__('order.terms_link'))
+        ->assertSee(__('order.terms_why'))
+        ->assertSee(route('legal.agb'), false)
+        ->assertSee('terms_accepted', false);
+});
+
+it('keeps the package list free of forms and consents', function () {
+    // Choosing is not agreeing. The page arrived with every button dead until a
+    // box at the top was ticked, which reads as broken before anybody has done
+    // anything wrong.
+    $page = $this->actingAs(buyer())->get(route('order'))->assertOk()->getContent();
+
+    expect($page)->not->toContain('name="terms_accepted"')
+        ->and($page)->not->toContain('action="'.route('checkout.start').'"');
+});
+
+it('serves the terms it asks a customer to accept', function () {
+    // A link to a page that says "Dieser Inhalt wird noch ergänzt" is not a
+    // contract, and accepting it would be accepting nothing.
+    $page = $this->get(route('legal.agb'))->assertOk()->getContent();
+
+    expect($page)->toContain('Widerrufsrecht')
+        ->and($page)->toContain('Löschfristen')
+        ->and($page)->not->toContain('Dieser Inhalt wird noch ergänzt');
 });
 
 it('lands as a timestamp on the order, which is what a withdrawal is measured against', function () {
@@ -286,3 +313,47 @@ it('records no consent for a session that never carried one', function () {
     expect(App\Models\Order::query()->where('stripe_event_id', 'cs_evt_no_consent')->first()?->immediate_start_consent_at)
         ->toBeNull();
 });
+
+it('asks for the terms where the money is spent, not where prices are read', function () {
+    // On the checkout page, at the bottom of the summary, directly above the
+    // button that pays — after the total, not before the prices.
+    $page = Illuminate\Support\Facades\File::get(resource_path('views/livewire/checkout.blade.php'));
+
+    expect(strpos($page, "__('checkout.total_today')"))->toBeLessThan(strpos($page, "__('order.terms_label'"))
+        ->and(strpos($page, "__('order.terms_label'"))->toBeLessThan(strpos($page, "__('checkout.pay_cta')"))
+        // No order without the terms — and the button says why rather than
+        // leaving somebody to guess at a control that does nothing.
+        ->and($page)->toContain('x-bind:disabled="!terms"')
+        ->and($page)->toContain("__('order.terms_first')");
+});
+
+it('lays five packages out as three and two', function () {
+    // A fifth card alone on a row of four reads as a mistake.
+    expect(Illuminate\Support\Facades\File::get(resource_path('views/livewire/order.blade.php')))
+        ->toContain('lg:grid-cols-3')
+        ->not->toContain('lg:grid-cols-4');
+});
+
+it('still refuses the checkout when the box was not ticked', function () {
+    // The layout changed, the wording changed, the rule did not: the server is
+    // the gate. Disabling a button in a browser refuses nothing.
+    $this->actingAs(buyer())
+        ->post(route('checkout.start'), ['plan' => 'start'])
+        ->assertSessionHasErrors('terms_accepted');
+
+    expect($this->stripe->checkouts)->toBeEmpty();
+});
+
+it('renders inside the app shell, not the bare sign-in one', function () {
+    // layouts.portal is what the sign-in pages use: no navigation, no page
+    // padding. In it, this page sat flush against the top and bottom of the
+    // window with no way back to anything.
+    expect(Illuminate\Support\Facades\File::get(app_path('Livewire/Order.php')))
+        ->toContain("#[Layout('layouts.portal-app')]");
+
+    // And the shell is actually there: the navigation proves it.
+    $this->actingAs(buyer())
+        ->get(route('order'))
+        ->assertOk()
+        ->assertSee(__('dashboard.nav.overview'));
+});
diff --git a/tests/Feature/SettingsTest.php b/tests/Feature/SettingsTest.php
index 130b510..5d9a557 100644
--- a/tests/Feature/SettingsTest.php
+++ b/tests/Feature/SettingsTest.php
@@ -62,14 +62,66 @@ it('saves the company profile', function () {
     Livewire::actingAs($user)->test(Settings::class)
         ->set('companyName', 'Acme GmbH')
         ->set('vatId', 'ATU12345678')
-        ->set('billingAddress', "Hauptstraße 1\n1010 Wien")
+        ->set('billingStreet', 'Hauptstraße 1')
+        ->set('billingPostcode', '1010')
+        ->set('billingCity', 'Wien')
+        ->set('billingCountry', 'Österreich')
         ->call('saveProfile')
         ->assertHasNoErrors();
 
     $customer->refresh();
     expect($customer->name)->toBe('Acme GmbH')
         ->and($customer->vat_id)->toBe('ATU12345678')
-        ->and($customer->billing_address)->toContain('Wien');
+        ->and($customer->billing_city)->toBe('Wien')
+        ->and($customer->billing_postcode)->toBe('1010')
+        // And the composed block every existing reader uses: street, then
+        // postcode and town on one line, then the country.
+        ->and($customer->billing_address)->toBe("Hauptstraße 1\n1010 Wien\nÖsterreich");
+});
+
+it('never lets a business turn itself into a consumer', function () {
+    // The fourteen-day right of withdrawal hangs off this field. A business that
+    // could set itself to "Privatperson" here is a business that can withdraw
+    // from a contract it may not withdraw from — which is why registration asks
+    // the question and why this form cannot answer it a second time.
+    ['user' => $user, 'customer' => $customer] = settingsSetup();
+    $customer->update(['customer_type' => App\Models\Customer::TYPE_BUSINESS]);
+
+    Livewire::actingAs($user)->test(Settings::class)
+        ->set('customerType', App\Models\Customer::TYPE_CONSUMER)
+        ->call('saveProfile')
+        ->assertHasNoErrors();
+
+    expect($customer->fresh()->customer_type)->toBe(App\Models\Customer::TYPE_BUSINESS);
+});
+
+it('lets a record created before the question was asked answer it once', function () {
+    ['user' => $user, 'customer' => $customer] = settingsSetup();
+    $customer->update(['customer_type' => null]);
+
+    Livewire::actingAs($user)->test(Settings::class)
+        ->set('customerType', App\Models\Customer::TYPE_BUSINESS)
+        ->call('saveProfile');
+
+    expect($customer->fresh()->customer_type)->toBe(App\Models\Customer::TYPE_BUSINESS);
+
+    // And then it is fixed like every other.
+    Livewire::actingAs($user)->test(Settings::class)
+        ->set('customerType', App\Models\Customer::TYPE_CONSUMER)
+        ->call('saveProfile');
+
+    expect($customer->fresh()->customer_type)->toBe(App\Models\Customer::TYPE_BUSINESS);
+});
+
+it('shows a recorded type as a fact, with no way to change it', function () {
+    ['user' => $user, 'customer' => $customer] = settingsSetup();
+    $customer->update(['customer_type' => App\Models\Customer::TYPE_BUSINESS]);
+
+    $page = Livewire::actingAs($user)->test(Settings::class)->html();
+
+    expect($page)->toContain(__('settings.customer_type_locked'))
+        // No radio to press.
+        ->and($page)->not->toContain('wire:model="customerType"');
 });
 
 it('saves branding and resolves defaults when unset', function () {
@@ -128,9 +180,19 @@ it('schedules package cancellation only with the correct typed confirmation', fu
     expect($instance->fresh()->status)->toBe('active')
         ->and($stripe->cancellations)->toBeEmpty();
 
-    // Correct confirmation → scheduled.
+    // Correct confirmation and a reason → scheduled. The reason is required:
+    // a departure with none on it loses the one fact about it worth having,
+    // and "we can ask later" means never.
     Livewire::actingAs($user)->test(ConfirmCancelPackage::class)
         ->set('confirmName', 'acme')
+        ->call('cancelPackage')
+        ->assertHasErrors(['reason']);
+
+    expect($instance->fresh()->status)->toBe('active');
+
+    Livewire::actingAs($user)->test(ConfirmCancelPackage::class)
+        ->set('confirmName', 'acme')
+        ->set('reason', 'too_expensive')
         ->call('cancelPackage');
 
     $instance->refresh();
@@ -169,3 +231,217 @@ it('closes the account when no package is active', function () {
 
     expect($customer->fresh()->closed_at)->not->toBeNull();
 });
+
+// ---- Four tabs, and the choice in the address ----
+
+it('opens on the customer own details and says so in the address', function () {
+    // The page was one column 768px wide inside a 1240px shell, holding the
+    // company address, the password, two-factor, the devices, the branding and
+    // the contract — two thousand pixels of scroll, and finding a thing meant
+    // knowing how far down it lived.
+    $user = App\Models\User::factory()->create(['email_verified_at' => now()]);
+
+    Livewire::actingAs($user)->test(App\Livewire\Settings::class)
+        ->assertSet('tab', 'profile')
+        ->assertSee(__('settings.company_title'))
+        // Not the other tabs' content.
+        ->assertDontSee(__('settings.branding_title'))
+        ->assertDontSee(__('settings.package_title'));
+});
+
+it('lands on the tab the address names', function () {
+    $user = App\Models\User::factory()->create(['email_verified_at' => now()]);
+
+    Livewire::actingAs($user)->test(App\Livewire\Settings::class, ['tab' => 'branding'])
+        ->assertSet('tab', 'branding')
+        ->assertSee(__('settings.branding_title'))
+        ->assertDontSee(__('settings.company_title'));
+});
+
+it('falls back to the first tab when the address names one nobody has', function () {
+    // A tab name out of the URL is a string a stranger typed; the alternative
+    // is a settings page with no section on it at all.
+    $user = App\Models\User::factory()->create(['email_verified_at' => now()]);
+
+    Livewire::actingAs($user)->test(App\Livewire\Settings::class, ['tab' => 'gibt-es-nicht'])
+        ->assertSet('tab', 'profile')
+        ->assertSee(__('settings.company_title'));
+});
+
+it('writes the tab into the query string, so a link can name one', function () {
+    // history: true and no `except` — the parameter is there from the first
+    // render. Hidden on the default, a link to this page could not say which
+    // tab it meant unless the tab happened not to be the first.
+    $component = Illuminate\Support\Facades\File::get(app_path('Livewire/Settings.php'));
+
+    expect($component)->toContain('#[Url(history: true)]')
+        // The property and its default, matched without spelling a PHP
+        // variable inside a quoted string.
+        ->and($component)->toContain('public string $tab')
+        ->and($component)->toContain("= 'profile';")
+        ->and($component)->not->toContain('except:');
+});
+
+it('keeps every tab reachable from the bar', function () {
+    // The list IS the schema: it validates the query string, builds the bar and
+    // decides which section renders.
+    $user = App\Models\User::factory()->create(['email_verified_at' => now()]);
+    $page = Livewire::actingAs($user)->test(App\Livewire\Settings::class);
+
+    foreach (App\Livewire\Settings::TABS as $tab) {
+        $page->assertSee(__('settings.tab.'.$tab));
+    }
+});
+
+it('uses the width it is given', function () {
+    // 768px in a 1240px shell left a third of the window empty beside a column
+    // nobody could read the end of.
+    expect(Illuminate\Support\Facades\File::get(resource_path('views/livewire/settings.blade.php')))
+        ->not->toContain('max-w-3xl');
+});
+
+it('records why, and refuses "other" with nothing beside it', function () {
+    ['user' => $user, 'customer' => $customer] = settingsSetup();
+    $instance = $customer->instances()->where('status', 'active')->first();
+    $contract = App\Models\Subscription::factory()->create([
+        'customer_id' => $customer->id,
+        'instance_id' => $instance->id,
+        'status' => 'active',
+    ]);
+
+    Livewire::actingAs($user)->test(ConfirmCancelPackage::class)
+        ->set('confirmName', $instance->subdomain)
+        ->set('reason', 'other')
+        ->call('cancelPackage')
+        ->assertHasErrors(['note']);
+
+    expect($instance->fresh()->status)->toBe('active');
+
+    Livewire::actingAs($user)->test(ConfirmCancelPackage::class)
+        ->set('confirmName', $instance->subdomain)
+        ->set('reason', 'other')
+        ->set('note', 'Wir ziehen intern um.')
+        ->call('cancelPackage');
+
+    expect($contract->fresh()->cancel_reason)->toBe('other')
+        ->and($contract->fresh()->cancel_reason_note)->toBe('Wir ziehen intern um.');
+});
+
+it('takes no reason it was not offered', function () {
+    // The select is a select; the request is a request.
+    ['user' => $user, 'customer' => $customer] = settingsSetup();
+    $instance = $customer->instances()->where('status', 'active')->first();
+
+    Livewire::actingAs($user)->test(ConfirmCancelPackage::class)
+        ->set('confirmName', $instance->subdomain)
+        ->set('reason', 'weil-ich-es-kann')
+        ->call('cancelPackage')
+        ->assertHasErrors(['reason']);
+
+    expect($instance->fresh()->status)->toBe('active');
+});
+
+it('offers the withdrawal as a way out of the cancellation, while it is open', function () {
+    // Withdrawing ends the service the same day and sends the WHOLE amount
+    // back; cancelling keeps the term that was paid for. Somebody entitled to
+    // the first should not lose it by taking the second unasked.
+    ['user' => $user, 'customer' => $customer] = settingsSetup();
+    $customer->update(['customer_type' => App\Models\Customer::TYPE_CONSUMER]);
+    $instance = $customer->instances()->where('status', 'active')->first();
+    App\Models\Subscription::factory()->create([
+        'customer_id' => $customer->id,
+        'instance_id' => $instance->id,
+        'status' => 'active',
+        'started_at' => now()->subDay(),
+        'withdrawal_ends_at' => now()->addDays(13),
+    ]);
+
+    $page = Livewire::actingAs($user)->test(ConfirmCancelPackage::class)->html();
+
+    expect($page)->toContain(__('withdrawal.instead_title'))
+        ->and($page)->toContain('confirm-withdraw');
+});
+
+it('never offers a business the withdrawal it does not have', function () {
+    ['user' => $user, 'customer' => $customer] = settingsSetup();
+    $customer->update(['customer_type' => App\Models\Customer::TYPE_BUSINESS]);
+    $instance = $customer->instances()->where('status', 'active')->first();
+    App\Models\Subscription::factory()->create([
+        'customer_id' => $customer->id,
+        'instance_id' => $instance->id,
+        'status' => 'active',
+        'started_at' => now()->subDay(),
+        'withdrawal_ends_at' => now()->addDays(13),
+    ]);
+
+    expect(Livewire::actingAs($user)->test(ConfirmCancelPackage::class)->html())
+        ->not->toContain(__('withdrawal.instead_title'));
+});
+
+it('shows a consumer their withdrawal right, expired as well as open', function () {
+    // It used to render only while the window was open, so once the fourteen
+    // days ran out it vanished — indistinguishable from a feature that was never
+    // built. Which is exactly how it was reported missing.
+    ['user' => $user, 'customer' => $customer] = settingsSetup();
+    $customer->update(['customer_type' => App\Models\Customer::TYPE_CONSUMER]);
+    $instance = $customer->instances()->where('status', 'active')->first();
+
+    $contract = App\Models\Subscription::factory()->create([
+        'customer_id' => $customer->id,
+        'instance_id' => $instance->id,
+        'status' => 'active',
+        'started_at' => now()->subDay(),
+        'withdrawal_ends_at' => now()->addDays(13),
+    ]);
+
+    Livewire::actingAs($user)->test(Settings::class, ['tab' => 'contract'])
+        ->assertSee(__('withdrawal.card_title'))
+        ->assertSee(__('withdrawal.cta'));
+
+    // Expired: still stated, with the reason, and no button.
+    $contract->update(['withdrawal_ends_at' => now()->subDay()]);
+
+    Livewire::actingAs($user)->test(Settings::class, ['tab' => 'contract'])
+        ->assertSee(__('withdrawal.card_title'))
+        ->assertDontSee(__('withdrawal.cta'));
+});
+
+it('never shows a business a right it does not have', function () {
+    ['user' => $user, 'customer' => $customer] = settingsSetup();
+    $customer->update(['customer_type' => App\Models\Customer::TYPE_BUSINESS]);
+    $instance = $customer->instances()->where('status', 'active')->first();
+    App\Models\Subscription::factory()->create([
+        'customer_id' => $customer->id,
+        'instance_id' => $instance->id,
+        'status' => 'active',
+        'started_at' => now()->subDay(),
+        'withdrawal_ends_at' => now()->addDays(13),
+    ]);
+
+    Livewire::actingAs($user)->test(Settings::class, ['tab' => 'contract'])
+        ->assertDontSee(__('withdrawal.card_title'));
+});
+
+it('offers the packages to somebody who has none, instead of a dead sentence', function () {
+    $user = App\Models\User::factory()->create(['email_verified_at' => now()]);
+    App\Models\Customer::factory()->create(['email' => $user->email, 'user_id' => $user->id]);
+
+    Livewire::actingAs($user)->test(Settings::class, ['tab' => 'contract'])
+        ->assertSee(__('settings.no_package'))
+        ->assertSee(__('settings.to_packages'))
+        // And nothing about withdrawing, because there is nothing to withdraw
+        // from — which is what the owner ran into looking for the button.
+        ->assertDontSee(__('withdrawal.card_title'));
+});
+
+it('builds every tab out of the same two pieces', function () {
+    // Panels and rows, not a heap of cards of different heights: the group is
+    // the card, the setting is a row inside it, and the label column is what
+    // uses the width.
+    $page = Illuminate\Support\Facades\File::get(resource_path('views/livewire/settings.blade.php'));
+
+    expect(substr_count($page, '<x-ui.panel'))->toBeGreaterThanOrEqual(5)
+        ->and(substr_count($page, '<x-ui.row'))->toBeGreaterThanOrEqual(12)
+        // No hand-rolled card markup left behind.
+        ->and($page)->not->toContain('rounded-lg border border-line bg-surface p-6 shadow-xs');
+});
diff --git a/tests/Feature/SiteDesignSystemTest.php b/tests/Feature/SiteDesignSystemTest.php
index a6ece4c..bb04acd 100644
--- a/tests/Feature/SiteDesignSystemTest.php
+++ b/tests/Feature/SiteDesignSystemTest.php
@@ -148,9 +148,17 @@ it('draws the wordmark from one definition, not five', function () {
 
         $source = preg_replace('/\{\{--.*?--\}\}/s', '', File::get($file->getPathname()));
 
-        // The wordmark is markup around the name; a plain sentence mentioning
-        // the company is not. `>Clu` catches exactly the lockup forms.
-        if (preg_match('/>\s*Clu(Pilot|<)/', $source)) {
+        // The wordmark is markup AROUND the name: the name is the whole content
+        // of its element, so what follows it is the next tag and not more
+        // sentence. `>Clu<` is the split form, `>CluPilot` up to a tag is the
+        // whole one.
+        //
+        // Twice now a document has tripped a looser version of this — the terms
+        // page and then the processing agreement, both with a paragraph whose
+        // first word happens to be the company name. That is a sentence, not a
+        // brand lockup, and a scan that cannot tell them apart is a scan that
+        // gets edited every time somebody writes prose.
+        if (preg_match('/>Clu(<|Pilot\s*<)/', $source)) {
             $offenders[] = str_replace(resource_path().'/', '', $file->getPathname());
         }
     }