Version 1.12.0 — drei Wirt-Vorgaenge sind jetzt Knoepfe

Der Waechter ist in der Konsole sichtbar, samt seinem Ruecktritt und seinem
Schweigen. Die Vertragsversion des Wirt-Helfers wird gemeldet, bevor jemand
einen Knopf drueckt, der daran scheitert. Die Tunnel-Rettung ist ein Knopf.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

.env.example

@@ -38,7 +38,7 @@ REDIS_HOST=redis
 REDIS_PASSWORD=null
 REDIS_PORT=6379
 
-SESSION_DRIVER=redis
+SESSION_DRIVER=database
 SESSION_LIFETIME=120
 SESSION_ENCRYPT=false
 SESSION_PATH=/
@@ -63,23 +63,225 @@ REVERB_SERVER_PORT=8080
 # browser-side (baked into built assets): the address a browser can reach
 VITE_REVERB_APP_KEY=change-me-app-key
 VITE_REVERB_HOST=localhost
-VITE_REVERB_PORT=8080
-VITE_REVERB_SCHEME=http
+VITE_REVERB_PORT=443
+VITE_REVERB_SCHEME=https
 VITE_APP_NAME=CluPilot
 
 # Vite HMR host the browser connects to (dev). Set to the reachable VM address
 # when developing against a remote host; localhost for local-only.
 VITE_HMR_HOST=localhost
 
-# ── Mail (dev → log) ─────────────────────────────────────────────────────
+# ── Mail ─────────────────────────────────────────────────────────────────
+# DEV: `log` writes mails to storage/logs (nothing is sent).
+# PROD: switch to smtp and fill in the credentials below.
 MAIL_MAILER=log
 MAIL_FROM_ADDRESS=hello@clupilot.local
 MAIL_FROM_NAME=CluPilot
+# MAIL_MAILER=smtp
+# MAIL_HOST=smtp.your-provider.tld
+# MAIL_PORT=587
+# MAIL_USERNAME=
+# MAIL_PASSWORD=
+# MAIL_SCHEME=smtp          # smtp | smtps (465)
+
+# ═════════════════════════════════════════════════════════════════════════
+#  CluPilot operations — fill these in to run real provisioning.
+#  Everything below is OPTIONAL for local dev: left blank, the services are
+#  no-ops/fakes and the app + test suite still run. Only real infrastructure
+#  work (host onboarding, customer provisioning) needs them.
+# ═════════════════════════════════════════════════════════════════════════
+
+# ── Stripe (payments) ────────────────────────────────────────────────────
+# WEBHOOK_SECRET is READ BY CODE today (signature check on /webhooks/stripe).
+# Outside local/testing a missing secret makes the webhook fail closed.
+# Stripe hands out a SEPARATE signing secret per operating mode (test/live) —
+# fill in the one matching each. Which one applies follows platform.mode
+# (App\Support\StripeWebhookSecret), not this file.
+STRIPE_WEBHOOK_SECRET=
+STRIPE_WEBHOOK_SECRET_TEST=
+# Not read yet — needed once the Checkout flow is built (currently the portal
+# only records a purchase intent):
+STRIPE_KEY=
+STRIPE_SECRET=
+
+# ── DNS (Hetzner DNS API) ────────────────────────────────────────────────
+# Creates <subdomain>.<zone> A-records for each customer instance.
+HETZNER_DNS_TOKEN=
+CLUPILOT_DNS_ZONE=clupilot.cloud
+
+# Host names (fsn-01.node.…) are NOT published here — that would leak the
+# internal WireGuard subnet. They go into this directory instead, which the
+# vpn-dns container reads (dnsmasq --hostsdir) over the dns-hosts volume; see
+# docker-compose.yml. Only change if that volume is mounted somewhere else.
+CLUPILOT_DNS_HOSTS_DIR=/etc/clupilot/dns-hosts
+
+# ── Archiv einer gekündigten Instanz ─────────────────────────────────────
+# Die Proxmox-Ablage, auf die der Abbau (App\Actions\ArchiveAndTearDown) das
+# Archiv schreibt, bevor die Maschine gelöscht wird. Muss es auf JEDEM Host
+# geben und `backup` tragen — sonst bricht der Abbau ab und löscht nichts.
+CLUPILOT_ARCHIVE_STORAGE=local
+
+# ── Traefik (reverse proxy + TLS) ────────────────────────────────────────
+# Directory ON THE PROXMOX HOST where CluPilot writes dynamic route files.
+TRAEFIK_DYNAMIC_PATH=/etc/traefik/dynamic
+
+# ── WireGuard hub (this CluPilot VM) ─────────────────────────────────────
+# Hosts join this hub during onboarding; CluPilot reaches them over the tunnel.
+CLUPILOT_WG_SUBNET=10.66.0.0/24
+CLUPILOT_WG_HUB_IP=10.66.0.1
+CLUPILOT_WG_ENDPOINT=              # public host:port peers dial, e.g. vpn.clupilot.com:51820
+CLUPILOT_WG_HUB_PUBKEY=            # `wg pubkey < /etc/wireguard/privatekey`
+CLUPILOT_WG_CONFIG_PATH=/etc/wireguard/wg0.conf
+
+# ── SSH identity for host onboarding ─────────────────────────────────────
+# Deployed to each fresh server after the one-time root password login.
+# PREFERRED: point at files (a multi-line PEM cannot live in .env).
+#   ssh-keygen -t ed25519 -N '' -C clupilot -f storage/app/ssh/clupilot
+CLUPILOT_SSH_PUBLIC_KEY_PATH=
+CLUPILOT_SSH_PRIVATE_KEY_PATH=
+# Alternative (single-line values only):
+CLUPILOT_SSH_PUBLIC_KEY=
+CLUPILOT_SSH_PRIVATE_KEY=
+CLUPILOT_SSH_COMMAND_TIMEOUT=2000
+
+# ── Monitoring ───────────────────────────────────────────────────────────
+# The built-in client speaks a GENERIC REST API:
+#   GET/POST /monitors, GET/DELETE /monitors/{id}
+# For Uptime Kuma use the bundled bridge below (Kuma's own REST API is
+# read-only — monitor CRUD goes through Socket.IO):
+#   MONITORING_API_URL=http://kuma-bridge:8080
+# Leave blank to disable monitoring entirely: provisioning records a stable
+# breadcrumb and its own health checks (occ status, TLS, admin user) still
+# gate acceptance.
+MONITORING_API_URL=
+MONITORING_API_TOKEN=
+
+# ── Uptime Kuma (über die mitgelieferte Bridge) ───────────────────────────
+# Kuma kann Monitore nur über Socket.IO anlegen, daher die Bridge:
+#   docker compose --profile monitoring up -d --build kuma-bridge
+# Danach hier MONITORING_API_URL auf die Bridge zeigen lassen:
+#   MONITORING_API_URL=http://kuma-bridge:8080
+# MONITORING_API_TOKEN ist gleichzeitig das Bridge-Token (frei wählbar, lang).
+KUMA_URL=
+KUMA_USERNAME=
+KUMA_PASSWORD=
+KUMA_TOTP=
+
+# Monitoring-Verhalten bei Ausfall:
+#   MONITORING_REQUIRED=false -> Bereitstellung läuft weiter (Warn-Event), Standard
+#   MONITORING_REQUIRED=true  -> Lauf schlägt fehl, wenn Monitoring nicht erreichbar
+MONITORING_REQUIRED=false
+MONITORING_ATTEMPTS=2
+
+# ── VPN-Konfigurationen ──────────────────────────────────────────────────
+# Schlüssel für hier gespeicherte WireGuard-Konfigurationen (32 Byte, base64).
+# Bewusst getrennt von APP_KEY. Leer = Speichern deaktiviert.
+# Erzeugen: head -c 32 /dev/urandom | base64
+VPN_CONFIG_KEY=
+
+# ── Zugangsdaten der Konsole (Stripe, DNS, Monitoring, Postfächer) ────────
+# Eigener Schlüssel, ebenfalls getrennt von APP_KEY — der wird routinemäßig
+# gewechselt und würde sonst jedes gespeicherte Geheimnis unlesbar machen.
+# LEER = die Konsole speichert gar keine Zugangsdaten und sagt das auch.
+# Erzeugen: head -c 32 /dev/urandom | base64
+SECRETS_KEY=
+
+# Netze, die als "wir" gelten, solange die Website versteckt ist
+# (WireGuard-Subnetz). Alles andere sieht die Platzhalterseite.
+TRUSTED_RANGES=10.66.0.0/24,127.0.0.1
+
+# Umsatzsteuersatz des Verkäufers in Prozent. Preise in der Konfiguration
+# sind NETTO; die Oberfläche weist beides aus.
+CLUPILOT_TAX_PERCENT=20
+
+# ── Wo die Konsole antwortet ─────────────────────────────────────────────
+#
+# ADMIN_HOSTS: Hostnamen, unter denen die Konsole erreichbar ist. Der ERSTE
+# ist der kanonische — für ihn werden URLs erzeugt; die weiteren sind
+# Ausweichadressen, über die jemand hereinkommt, der ausgesperrt ist.
+#
+# ADMIN_HOST_EXCLUSIVE: darf auf diesen Namen NUR die Konsole antworten?
+#
+#   true   Die Konsole liegt an der WURZEL ihres Hostnamens
+#          (https://admin.…/), und Portal wie Website antworten dort mit 404.
+#          Dann gehört hier ausschliesslich der Konsolen-Name hinein — eine
+#          IP oder localhost mit aufzunehmen schaltet Portal und Website auf
+#          genau dieser Adresse ab. Das ist die Betriebsform.
+#
+#   false  Die Konsole liegt unter /admin auf jedem gelisteten Namen, und
+#          diese Namen bedienen weiterhin auch Portal und Website. Nur für
+#          eine Maschine ohne eigene DNS-Namen sinnvoll.
+#
+# Ohne Eintrag gilt false — dann zeigt https://admin.…/ das PORTAL, nicht die
+# Konsole, und das sieht wie ein Fehler aus, obwohl es die Vorgabe ist.
+#
+# APP_HOST: Hostname des Kundenportals, z. B. app.clupilot.com. Gesetzt, ist
+# JEDE Portal-Route an diesen Host gebunden und existiert nirgends sonst —
+# www.clupilot.com/dashboard ist dann ein 404, kein funktionierender Aufruf.
+# Das schliesst die Anmeldung ein: Fortify bindet seine eigenen Routen ueber
+# denselben Wert (config/fortify.php).
+# Leer = Portal antwortet ueberall (Vorgabe, und was jede dev-Maschine ueber
+# eine blanke IP braucht).
+APP_HOST=
+
+# SITE_HOST: Hostname der oeffentlichen Website. Gesetzt, antwortet die
+# Startseite NUR dort — jeder andere Host (das Portal, eine blanke IP) zeigt
+# unter "/" die Anmeldung bzw. das Dashboard. Leer heisst: Startseite ueberall,
+# auch auf dem Portal-Hostnamen.
+# Mehrere Namen kommagetrennt, der ERSTE ist der kanonische — er liefert aus,
+# alle weiteren leiten dauerhaft dorthin um (Pfad und Query bleiben erhalten):
+#   SITE_HOST=www.clupilot.com,clupilot.com
+# Gebunden sind Startseite, robots.txt, Kontakt und die Legal-Seiten — dadurch
+# erzeugt route('legal.impressum') auch aus einer Mail heraus eine www-Adresse,
+# wo es keine Anfrage gibt, aus der man einen Hostnamen nehmen koennte.
+SITE_HOST=
+
+# STATUS_HOST: Hostname der Statusseite, z. B. status.clupilot.com. Gesetzt,
+# liegt sie an der WURZEL dieses Namens, und /status leitet von jedem anderen
+# Host dorthin um statt zu 404en — eine Statusseite ist die Adresse, die in
+# einem Lesezeichen steht, wenn ohnehin schon etwas kaputt ist.
+# Leer = /status antwortet auf jedem Host.
+STATUS_HOST=
+
+# FILES_HOST: Hostname fuer Dateien zum Herunterladen — AGB, AV, TOM
+# (oeffentlich, dauerhaft zitierbar, weil diese Adressen in Vertraegen stehen)
+# und das Bootstrap-Archiv (nur mit gueltigem Einmal-Code).
+# Leer = das Archiv bleibt auf dem Portal-Hostnamen, damit keine bereits
+# ausgegebene Befehlszeile bricht, solange der DNS-Eintrag noch nicht steht.
+FILES_HOST=
+
+ADMIN_HOSTS=admin.dev.clupilot.com
+ADMIN_HOST_EXCLUSIVE=true
+
+# ── Nextcloud blueprint template ─────────────────────────────────────────
+# NOT an env var: set the Proxmox template VMID per plan in
+# config/provisioning.php → plans.*.template_vmid (default 9000).
 
 # ── docker-compose knobs (host-side) ─────────────────────────────────────
 HOST_UID=1000
 HOST_GID=1000
-APP_PORT=80
+# Behind a reverse proxy — which is every production install — these must stay
+# on loopback: Docker publishes ports ahead of UFW, so anything on 0.0.0.0 is
+# reachable from the internet regardless of the firewall, and reaching a backend
+# directly skips every hostname and address rule the proxy enforces.
+# For local development without a proxy, set APP_PORT=80.
+APP_PORT=127.0.0.1:8080
+# Vite dev server (HMR). Off by default: over the HTTPS domains the
+# browser cannot load assets from http://<ip>:5173. Set true only when
+# working over http://10.10.90.185, then run: docker compose up -d app
+VITE_AUTOSTART=false
 VITE_PORT=5173
-REVERB_HOST_PORT=8080
+REVERB_HOST_PORT=127.0.0.1:8081
 DB_HOST_PORT=3306
+
+# ── CI (Gitea Actions) ──────────────────────────────────────────────────────
+# Registrierungs-Token aus Gitea: Repo → Settings → Actions → Runners →
+# "Create new runner". Danach:  docker compose --profile ci up -d runner
+GITEA_INSTANCE_URL=https://git.bave.dev
+GITEA_RUNNER_TOKEN=
+GITEA_RUNNER_NAME=clupilot-local
+# Passend zur Server-Version halten (1.20 verträgt keinen aktuellen Runner).
+GITEA_RUNNER_VERSION=0.2.6
+
+# Zone in der Zeiten ANGEZEIGT werden. Gespeichert wird immer UTC.
+APP_DISPLAY_TIMEZONE=Europe/Vienna

.gitea/workflows/tests.yml

@@ -0,0 +1,118 @@
+# CluPilot CI — runs on Gitea Actions (GitHub-Actions syntax, own runner).
+#
+# Deliberately not mirrored to GitHub: this repository describes how our
+# infrastructure is provisioned, and the same workflow runs at home. If we ever
+# move, this file goes along unchanged.
+name: tests
+
+on:
+  push:
+    branches: [main, 'feat/**']
+  pull_request:
+
+jobs:
+  pest:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4.2.2
+
+      - name: Set up PHP
+        # Pinned: the floating v2 tag now requires node24, which the runner
+        # matching Gitea 1.20 cannot execute. 2.34.1 is the newest that still
+        # declares node20.
+        uses: shivammathur/setup-php@2.34.1
+        with:
+          php-version: '8.4'
+          extensions: mbstring, pdo_sqlite, sodium, redis, bcmath, gd, zip
+          coverage: none
+
+      - name: Install PHP dependencies
+        # Source clones, not dist archives: dist downloads go through GitHub's
+        # API, which throttles anonymous callers and left a half-installed
+        # vendor/ behind — the tests then failed with 500s that had nothing to
+        # do with the code. Cloning is slower and does not need anyone's quota.
+        # Swap back to --prefer-dist once a GitHub token is configured.
+        run: composer install --no-interaction --prefer-source --no-progress
+
+      - name: Prepare environment
+        run: |
+          cp .env.example .env
+          php artisan key:generate
+
+      - name: Tests
+        # phpunit.xml pins its own sqlite/array drivers, so no services needed.
+        run: ./vendor/bin/pest --colors=always
+
+  assets:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4.2.2
+
+      - uses: actions/setup-node@v4.1.0
+        with:
+          node-version: '22'
+
+      - name: Install JS dependencies
+        run: npm ci --no-fund --no-audit
+
+      # A build failure here is what used to surface as "the design is broken"
+      # only after deploying — catch it before it ships.
+      - name: Build assets
+        run: npm run build
+
+  release:
+    # Only a green run produces the tag the console offers as an update.
+    needs: [pest, assets]
+    if: github.ref == 'refs/heads/main'
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4.2.2
+        with:
+          fetch-depth: 0
+
+      - name: Tag this commit as tested
+        run: |
+          tag="tested-$(date -u +%Y%m%d-%H%M)-$(git rev-parse --short HEAD)"
+          git tag "$tag"
+          git push origin "$tag"
+
+      # A release is cut by editing VERSION and merging it — nothing else. The
+      # tag is created here, only after the suite is green, and only if it does
+      # not already exist. Never moved: servers are pinned to these, and a tag
+      # that changes underneath them means two machines claiming one version.
+      - name: Tag the release when VERSION changed
+        run: |
+          version="$(tr -d ' \n\r' < VERSION)"
+          # Anchored, because a `case` glob does not anchor: `[0-9]*.[0-9]*`
+          # happily accepts 1x.2y.3garbage and would tag it.
+          printf '%s' "$version" | grep -qE '^[0-9]+\.[0-9]+\.[0-9]+$' \
+            || { echo "VERSION is not MAJOR.MINOR.PATCH: '$version'" >&2; exit 1; }
+
+          # Only the commit that RAISED the version is the release. Without
+          # this, any later green push finds the tag missing and claims it —
+          # and the tag would then name code the bump never described. Runs
+          # overlap and finish out of order; that is enough for it to happen.
+          previous="$(git show 'HEAD^:VERSION' 2>/dev/null | tr -d ' \n\r' || true)"
+          if [ "$previous" = "$version" ]; then
+            echo "::notice::VERSION is unchanged ($version) — nothing to release."
+            exit 0
+          fi
+
+          tag="v${version}"
+          git fetch --tags --force origin
+
+          if existing="$(git rev-parse -q --verify "refs/tags/${tag}^{commit}")"; then
+            # Already released. The invariant is that the tag points at the
+            # commit VERSION was raised in — if a later commit still carries
+            # that number, that is fine, but the tag must not be re-pointed.
+            if [ "$existing" != "$(git rev-parse HEAD)" ]; then
+              echo "::notice::${tag} already exists at ${existing}; leaving it alone."
+            fi
+            exit 0
+          fi
+
+          git config user.name  "CluPilot CI"
+          git config user.email "ci@clupilot.local"
+          git tag -a "$tag" -m "CluPilot ${version}"
+          git push origin "$tag"
+          echo "::notice::Released ${tag}"

.gitignore

@@ -3,8 +3,13 @@
 .env
 .env.backup
 .env.production
+# EnvFileEditor's own backups (App\Services\Env\EnvFileEditor::backup()) — a
+# timestamped copy beside .env before every write from the console's raw
+# editor. Never pruned automatically; see the warning on that page.
+.env.bak-*
 .phpactor.json
 .phpunit.result.cache
+/.claude/
 /.codex
 /.cursor/
 /.idea
@@ -20,6 +25,10 @@
 /public/storage
 /storage/*.key
 /storage/pail
+# Exported invoice PDFs — runtime output, and on a real server this is a mount
+# point. Committing it would put customer documents into the repository and
+# make a deploy fight the archive for the directory.
+/storage/archive
 /vendor
 _ide_helper.php
 Homestead.json
@@ -28,3 +37,7 @@ Thumbs.db
 
 # Gitea push token (parent home dir; never track)
 .env.gitea
+clupilot.env
+
+# SDD-Arbeitsverzeichnis (Ledger, Briefs, Review-Pakete) — Kladde, nicht Quelltext.
+.superpowers/

CLAUDE.md

@@ -0,0 +1,314 @@
+# CluPilot — verbindliche Regeln (Repo-Teil)
+
+Die **Vollfassung der Regeln R1–R17 liegt beim Nutzer**, nicht im Repo. Die
+Kurzfassung steht in `docs/handoffs/2026-07-25-clupilot-state-handoff.md` §9.
+Bei Konflikt: **STOP & fragen.**
+
+Diese Datei hält die Regeln fest, die aus konkreten Fehlern im laufenden Betrieb
+entstanden sind — sie sind nicht verhandelbar und werden per Test erzwungen.
+
+---
+
+## R18 — Icon-Größe und Zeilenumbruch
+
+**Ein Icon steht neben seinem Text, nie darüber, und nie größer als bestellt.**
+
+Verboten:
+
+1. **Icon zwingt den Text auf eine zweite Zeile.** Ein Navigationseintrag, ein
+   Button, ein Tabellen-Action ist **einzeilig**. Zwei Zeilen sind nur erlaubt,
+   wenn der Text selbst bewusst zweizeilig gesetzt ist (Label + Unterzeile) —
+   dann steht das Icon links davon, nicht darüber.
+2. **Icon größer als die Zeile, in der es sitzt.** Standard ist `size-5` (20px)
+   in der Navigation, `size-4` (16px) in Buttons, Tabellen und Fließtext.
+   Größer nur, wenn es als eigenständiges Element gemeint ist (Leerzustand,
+   Statusplakette).
+
+### Warum das zweimal schiefging
+
+- **Zeilenumbruch.** Tailwinds Preflight setzt `svg { display: block }`. Ein
+  Icon in einem *inline*-Elternteil schiebt den folgenden Text damit auf die
+  nächste Zeile. Genau so wurde aus dem Eintrag „Zugangsdaten" ein doppelt so
+  hoher Kasten mit Schloss oben und Wort darunter.
+- **Größe.** `.size-4` und `.size-5` haben **dieselbe Spezifität**, also
+  entscheidet die Reihenfolge im Stylesheet — und Tailwind gibt `.size-4` *vor*
+  `.size-5` aus. Eine Komponente, die `size-5` bedingungslos mitmergt, überstimmt
+  damit **jedes** `class="size-4"` am Aufrufort. Alle so geschriebenen Icons
+  liefen still auf 20px.
+
+### Wie es jetzt gebaut ist
+
+- `resources/views/components/ui/icon.blade.php` setzt seine Standardgröße
+  **nur**, wenn der Aufrufort keine `size-`/`w-`/`h-`-Klasse mitgibt, und
+  rendert `inline-block shrink-0 align-middle` statt des Preflight-`block`.
+- `resources/views/components/ui/nav-item.blade.php` legt Label und Icon in eine
+  eigene Flex-Zeile, damit ein Icon auch im falschen Slot daneben landet.
+- Icons in `<x-ui.nav-item>` gehören in `<x-slot:icon>`, nicht in den
+  Default-Slot.
+
+### Erzwungen durch
+
+`tests/Feature/IconLayoutTest.php` — Größe des Aufruforts gewinnt, Icon bleibt
+`inline-block`, Nav-Eintrag bleibt einzeilig aus beiden Slots, und kein
+Blade-File im Repo darf ein Icon am Icon-Slot vorbeischmuggeln.
+
+---
+
+## R19 — Zeitzone: gespeichert in UTC, angezeigt auf der Wanduhr
+
+**Jede Zeit, die ein Mensch liest, geht vorher durch `->local()`.**
+
+Verboten:
+
+1. **Einen gespeicherten Zeitstempel direkt formatieren.** `$model->created_at->isoFormat(…)`
+   liefert UTC. Richtig ist `$model->created_at->local()->isoFormat(…)`.
+2. **`->timezone(config('app.timezone'))`.** Das ist die *Speicher*zone und bleibt
+   UTC — der Aufruf sieht aus wie eine Umrechnung und ist keine.
+3. **Ein `datetime-local`-Feld nur in eine Richtung behandeln.** Rein und raus
+   gehören zusammen: `LocalTime::toField()` und `LocalTime::fromField()`.
+   Ein Feld hat keine Zeitzone; es sind die Ziffern, die jemand auf der eigenen
+   Uhr abliest.
+
+Ausgenommen: `diffForHumans()` ist relativ und in jeder Zone gleich.
+
+### Warum das durchgerutscht ist
+
+Die Konsole kündigte eine Aktualisierung „spätestens um 15:21" an, während die
+Uhr 17:21 zeigte. Zwei der vierzehn betroffenen Ansichten sahen sogar behandelt
+aus — sie riefen `->timezone(config('app.timezone'))`, was sich liest wie „in
+Ortszeit umrechnen" und, weil diese Zone UTC ist, nichts tut. Eine Attrappe ist
+schlimmer als gar kein Aufruf: sie hält den Nächsten vom Nachsehen ab.
+
+Schlimmer als die Anzeigen waren zwei **Formulare**: Wartungsfenster und
+Paketversionen füllten ihre Felder mit UTC und lasen sie als UTC zurück. Ein
+eingetragenes „21:00" wurde zu 23:00 Ortszeit.
+
+Und die Tests deckten es nicht auf, weil sie den erwarteten Wert **mit demselben
+falschen Aufruf** bildeten. Ein Test, der die Implementierung nachrechnet, prüft
+nichts.
+
+### Wie es jetzt gebaut ist
+
+- `config('app.display_timezone')` (`APP_DISPLAY_TIMEZONE`, Vorgabe
+  `Europe/Vienna`) getrennt von `app.timezone`, das UTC bleibt.
+- `->local()` als Carbon-Makro in `AppServiceProvider`. Es **kopiert** vor dem
+  Umstellen: `Illuminate\Support\Carbon` ist mutabel, sonst schriebe das bloße
+  Anzeigen das Modellattribut um. Beide Klassen bekommen denselben Rumpf —
+  Carbon führt Makros in *einer* globalen Tabelle, die zweite Registrierung
+  ersetzt die erste für alle.
+- `App\Support\LocalTime` hält beide Feldrichtungen nebeneinander, damit niemand
+  eine ändert, ohne die andere zu sehen.
+
+### Erzwungen durch
+
+`tests/Feature/DisplayTimezoneTest.php` — kein Blade und kein Livewire-Bauteil
+darf absolut formatieren ohne `->local()`, die UTC-Attrappe ist verboten,
+Speicherzone bleibt UTC, Sommer- **und** Winterzeit werden geprüft, `->local()`
+verändert das Original nicht, und der Feld-Round-Trip kommt als derselbe
+Zeitpunkt zurück.
+
+---
+
+## R20 — Bearbeiten passiert im Modal, nie in der Zeile
+
+**Sobald etwas Eingabefelder hat, geht ein Modal auf.**
+
+Verboten:
+
+1. **Inline-Bearbeitung in einer Tabellenzeile.** Kein `<input>`, kein
+   `<textarea>` in einem `<td>`. Die Zeile wächst, die Spalten daneben springen,
+   und eine halb im Bearbeitungsmodus stehende Tabelle liest sich wie ein
+   Darstellungsfehler, nicht wie ein Formular.
+2. **Ein Bearbeiten-Knopf, der eine Methode am Seiten-Bauteil aufruft.** Er
+   schickt `openModal` — alles andere ist der Inline-Editor unter neuem Namen.
+
+Nicht betroffen: Formulare, die *die Seite sind* — Anlegen-Formulare, die
+Einstellungsseite, die Einladen-Zeile über einer Tabelle. Die bearbeiten keinen
+bestehenden Datensatz an Ort und Stelle.
+
+Ausnahmen, die kein Modal brauchen: ein einzelnes `<select>` oder eine
+Checkbox in der Zeile (Rolle umstellen, aktiv schalten). Ein Klick, ein Wert,
+keine Höhenänderung.
+
+### Warum das aufgeschrieben wurde
+
+Das Projekt hatte das Modal längst — `EditDatacenter`, mit genau dieser
+Begründung im Kopfkommentar („avoids the row-height jump of inline editing").
+Die Benutzertabelle hat es einfach nicht benutzt, und ich habe die
+Bearbeitung inline gebaut, obwohl das Muster danebenlag.
+
+### Wie es jetzt gebaut ist
+
+- `App\Livewire\EditSeat` als `ModalComponent`, geöffnet über
+  `$dispatch('openModal', { component: 'edit-seat', arguments: { uuid } })`.
+- Ein Modal ist **ohne** die Route-Middleware der Seite erreichbar. Es löst
+  deshalb den Kunden selbst auf und liest den Datensatz neu, statt einer vom
+  Browser hydrierten Eigenschaft zu glauben.
+
+### Erzwungen durch
+
+`tests/Feature/EditInModalTest.php` — kein Seiten-Blade darf ein Eingabefeld in
+einem `<td>` wachsen lassen, und die Benutzertabelle muss `edit-seat` per
+`openModal` öffnen.
+
+---
+
+## R21 — Konsole und Portal teilen keine Identität
+
+**Betreiber und Kunden sind zwei Personengruppen, nicht zwei Zustände einer.**
+
+Verboten:
+
+1. **Eine Rolle oder Berechtigung am `User`.** Alle siebzehn Berechtigungen sind
+   Konsolen-Berechtigungen; sie liegen am `operator`-Guard. Ein `users`-Datensatz
+   mit Konsolenzugang ist die Vermischung in klein.
+2. **Eine Auth-Route, die beide Seiten bedient.** `RestrictAdminHost::SHARED`
+   führt nur noch `livewire/*` und `up`.
+3. **Eine Anmeldeansicht für beide.** Das Portal hat Fortify, die Konsole hat
+   `App\Livewire\Auth\OperatorLogin`.
+
+### Warum das aufgeschrieben wurde
+
+Die Konsole lieferte die Anmeldeseite des Portals aus — mit „Kein Konto?
+Registrieren" darauf. `register` stand nicht in `SHARED` und konnte dort auch
+nicht stehen, weil eine Konsole keine Selbstregistrierung hat. Der Link führte
+also zwangsläufig in eine 404. Das war kein Anzeigefehler, sondern die Identität
+zweier Personengruppen in einer Tabelle.
+
+### Erzwungen durch
+
+`tests/Feature/IdentitySeparationTest.php`
+
+---
+
+## R22 — Der Aufwand richtet sich nach der Aufgabe, nicht nach dem Verfahren
+
+**Prüfen ist ein Mittel, kein Selbstzweck. Wer für eine Tabellenumstellung
+zwölf Stunden und zehn Prüfrunden braucht, hat die Aufgabe nicht verstanden.**
+
+Verbindliche Obergrenzen:
+
+1. **Eine Prüfrunde, eine Fix-Runde, ein Re-Review über den Fix-Diff.** Danach
+   wird ein offener Befund **geparkt** — mit schriftlicher Begründung — und
+   nicht weitergeschliffen. Ein zweiter Re-Review desselben Befundes ist
+   verboten.
+2. **Codex/R15: höchstens zwei Runden ohne P1.** Danach gehen die Restbefunde
+   als Folgepunkte in den Merge Request. Bis zur Nullmeldung zu schleifen ist
+   kein Qualitätsmerkmal, sondern fehlende Priorisierung.
+3. **Ein Review sieht nur den Diff.** Dateien, die seit dem letzten grünen
+   Testlauf nicht angefasst wurden, werden nicht erneut geprüft — weder von
+   einem Prüfer noch beim Aufräumen. Was unverändert ist, war beim letzten
+   grünen Lauf schon in Ordnung.
+4. **Mutationstests nur an der Grenze**, an der ein Fehler Daten verliert,
+   Rechte ausweitet oder Zugangsdaten preisgibt. Nicht flächendeckend.
+5. **Aufgaben ohne Entwurfsentscheidung bekommen keinen eigenen Review.** Eine
+   Sprachdatei, eine Umbenennung, ein Feld mehr: bauen, Tests, weiter.
+6. **Unabhängige Arbeit läuft gleichzeitig.** Analysen (Review, Codex,
+   Testlauf) blockieren einander nicht und werden parallel gestartet.
+
+### Warum das aufgeschrieben wurde
+
+Die Betreiber-Identität — eine Tabelle, ein Guard, eine Anmeldeseite — hat
+zehn Codex-Runden und mehrere Re-Reviews gebraucht. Die Funde waren echt, aber
+die Reihenfolge war falsch: Sicherheitsgrenzen zuerst, Randfälle in den
+Folgepunkt. Der Nutzer wartet auf ein Ergebnis, nicht auf ein Verfahren.
+
+---
+
+## R23 — Bestätigung passiert im Modal, nie im nativen Browser-Dialog
+
+**Eine Aktion mit Folgen wird im Design dieses Produkts bestätigt — nicht in
+einem Fenster, das der Browser zeichnet.**
+
+Verboten:
+
+1. **`wire:confirm`.** Das Attribut ruft `window.confirm()` auf, bevor die
+   Anfrage beim Server ankommt — eine Systemmeldung mit dem Hostnamen darin,
+   kein Bestandteil der Oberfläche, die dieses Produkt zeichnet, nicht
+   gestaltbar und nur so übersetzt, wie der Browser gerade eingestellt ist.
+2. **`confirm(` aus eigenem JavaScript.** Derselbe native Dialog, nur ohne die
+   Livewire-Beschriftung. Ein Skript, das ihn direkt aufruft, hat dasselbe
+   Problem unter anderem Namen.
+
+### Warum das aufgeschrieben wurde
+
+Die Konsole fragte vor dem Übernehmen eines Zahlungs-Schlüssels „Auf
+admin.clupilot.com wird Folgendes angezeigt: Diesen Schlüssel wirklich
+übernehmen?" — ein Systemfenster mit der Domain darin, mitten im sonst
+durchgestalteten Betreiber-Bereich. Sechs Stellen in beiden Bereichen taten
+dasselbe: ein Schlüssel speichern oder entfernen, ein VPN-Zugang neu
+ausgestellt, Zwei-Faktor entfernt (Konsole UND Portal, zwei getrennte
+Identitäten nach R21), ein Benutzerzugang entzogen.
+
+### Wie es jetzt gebaut ist
+
+- Sechs eigene Bestätigungs-Modals nach dem Muster von `ConfirmRemoveHost` und
+  den anderen bestehenden Lösch-Bestätigungen — `App\Livewire\Admin\
+  ConfirmSaveSecret`, `ConfirmForgetSecret`, `ConfirmReissueVpnPeer`,
+  `ConfirmDisableTwoFactor` in der Konsole; `App\Livewire\
+  ConfirmDisableTwoFactor` und `ConfirmRevokeSeat` im Portal. Geöffnet über
+  `$dispatch('openModal', { component: '…', arguments: { … } })`, derselbe
+  Mechanismus, dieselbe Knopf-Reihenfolge (Abbrechen sekundär, Bestätigen
+  benannt statt „OK").
+- Das Modal mutiert nichts selbst. Der eigentliche Vorgang (`save()`,
+  `forget()`, `reissue()`, `disableTwoFactor()`, `revoke()`) bleibt
+  unverändert auf der Seiten-Komponente stehen, mit ihren eigenen
+  `guard()`-/Passwort-Prüfungen. Der Bestätigen-Knopf im Modal löst nur ein
+  Event aus (z. B. `secret-save-confirmed`), das die Seiten-Komponente per
+  `#[On(...)]` auffängt und an die bestehende Methode weiterreicht — das hält
+  die Berechtigungsprüfung an der einen Stelle, an der sie schon stand, statt
+  sie im Modal zu verdoppeln.
+- Der bisherige Bestätigungssatz bleibt wortgleich als `_body` stehen; nur der
+  neue `_title` (und bei den Zwei-Faktor-Aktionen kein weiterer Text) kam
+  hinzu, `_confirm` heißt jetzt wie überall sonst im Repo die kurze
+  Knopfbeschriftung statt eines ganzen Satzes.
+
+### Erzwungen durch
+
+`tests/Feature/ConfirmInModalTest.php` — kein Blade-File im Repo darf
+`wire:confirm` enthalten, und kein JavaScript darf `confirm(` aufrufen.
+
+---
+
+## R24 — Ein Modal wird nie höher als der Bildschirm
+
+**Kopf und Fuß stehen fest, gescrollt wird nur die Mitte.**
+
+Verboten:
+
+1. **Ein Modal, das mit seinem Inhalt wächst.** Es läuft unten aus dem Fenster
+   heraus und nimmt seinen eigenen Speichern-Knopf mit — erreichbar nur, indem
+   man die Seite *hinter* dem Overlay scrollt, auf dem Telefon also gar nicht.
+2. **Titel oder Knopfzeile im Scrollbereich.** Was man lesen muss, um zu wissen,
+   wo man ist, und was man erreichen muss, um fertig zu werden, gehören beide
+   außerhalb.
+3. **Eine Blade-Direktive in der Attributliste eines Komponenten-Tags**
+   (`<x-ui.modal @if(…) wire:poll @endif>`). Sie landet im Attribut-Beutel und
+   zerlegt die View — dieselbe Falle wie `@disabled` an einer Komponente. Solche
+   Attribute gehören auf ein eigenes Element im Inhalt.
+
+### Wie es gebaut ist
+
+- `resources/views/vendor/wire-elements-modal/modal.blade.php` begrenzt das
+  Panel **einmal für alle Modals**: `max-h-[calc(100dvh-3rem)]`, Spalte,
+  `overflow-hidden`. `dvh` statt `vh`, weil am Telefon die Browserleiste zu `vh`
+  zählt — genau der Fall, in dem der letzte Zentimeter zählt.
+- `resources/views/components/ui/modal.blade.php` ist die andere Hälfte:
+  `header`-Slot (oder `title`/`subtitle`), scrollender Rumpf, `footer`-Slot.
+  `min-h-0` am Rumpf ist die Zeile, die es wirken lässt — ein Flex-Kind wird
+  ohne sie nicht kleiner als sein Inhalt, und `overflow` greift nie.
+- Ein Knopf im Fuß, der ein Formular im Rumpf abschickt, benutzt
+  `type="submit" form="…"`. Das ist der Preis für einen Fuß, der nicht
+  wegscrollt — und ein HTML-Attribut, kein Trick.
+
+### Gilt für
+
+Jedes Modal, in dem ein **Eingabefeld** steckt (`<form`, `<input`, `<textarea`,
+`<select`, `x-ui.input`). Eine zweizeilige Rückfrage mit einem Knopf hat nichts,
+was festbleiben müsste, und wird nicht umgebaut.
+
+### Erzwungen durch
+
+`tests/Feature/ModalHeightTest.php` — das Panel bleibt begrenzt, jedes Modal mit
+einem Feld benutzt `<x-ui.modal>`, und keine Blade-Direktive steht in der
+Attributliste eines Komponenten-Tags.

VERSION

@@ -0,0 +1 @@
+1.12.0

app/Actions/ApplyPlanChange.php

@@ -0,0 +1,393 @@
+<?php
+
+namespace App\Actions;
+
+use App\Models\Instance;
+use App\Models\Order;
+use App\Models\PlanFamily;
+use App\Models\ProvisioningRun;
+use App\Models\Subscription;
+use App\Models\SubscriptionRecord;
+use App\Provisioning\Jobs\AdvanceRunJob;
+use App\Services\Billing\CustomDomainAccess;
+use App\Services\Billing\PlanChange;
+use App\Services\Billing\TaxTreatment;
+use App\Services\Stripe\StripeClient;
+use Illuminate\Support\Carbon;
+use Illuminate\Support\Facades\DB;
+use Illuminate\Support\Facades\Log;
+use Throwable;
+
+/**
+ * The single place a plan change actually happens.
+ *
+ * PlanChange is the preview: what a move would cost and whether it is allowed
+ * yet. Nothing carried one out. A customer could buy an upgrade, see it sit in
+ * the cart as a paid order, and keep the same contract, the same machine and the
+ * same quota forever — the order was created and never consumed by anything.
+ *
+ * This is the consumer. It does the four things a plan change is, in one place
+ * so they cannot be done by halves:
+ *
+ *  - the CONTRACT moves onto the target package's current sellable version, so
+ *    the snapshot every step, bill and entitlement check reads says what the
+ *    customer is now on;
+ *  - the REGISTER gets one row, because a change of terms is a commercial event
+ *    and the register is the evidence of what was agreed;
+ *  - the ENTITLEMENTS that hang off the package are settled — today that is the
+ *    own domain, which a smaller package can take away;
+ *  - the MACHINE is resized, through a provisioning run like every other piece
+ *    of remote work in this application, so it is retried, logged and visible in
+ *    the console instead of happening in a web request;
+ *  - STRIPE is moved onto the new price, because it owns the billing cycle and
+ *    would otherwise keep charging for the package the customer has left. Last,
+ *    outside the transaction, and unable to fail the change — see below.
+ *
+ * Idempotent from both ends. A contract already on the target version is a
+ * no-op rather than an error — the order is consumed and nothing else moves —
+ * and the register row carries the order's own event key, so a duplicate write
+ * collides in the database rather than in a check that two callers could both
+ * pass.
+ */
+class ApplyPlanChange
+{
+    public function __construct(private RecordCommercialEvent $record) {}
+
+    /**
+     * Carry out the change an order bought.
+     *
+     * The contract is resolved through CustomDomainAccess::contractOf() rather
+     * than re-queried here: it is already the one place that answers "which
+     * contract is this customer on", and a second copy of that query is the one
+     * that would disagree the day the rule changes.
+     */
+    public function forOrder(Order $order, ?Carbon $at = null): ?ProvisioningRun
+    {
+        $subscription = app(CustomDomainAccess::class)->contractOf($order->customer);
+
+        if ($subscription === null) {
+            Log::warning('No contract to move: this plan change has no live subscription behind it.', [
+                'order_id' => $order->id, 'plan' => $order->plan,
+            ]);
+
+            return null;
+        }
+
+        return $this($subscription, (string) $order->plan, $order, $at);
+    }
+
+    /**
+     * @return ProvisioningRun|null the resize run, or null when the change was
+     *                              refused, was a no-op, or there is no machine
+     *                              to resize
+     */
+    public function __invoke(Subscription $subscription, string $targetPlan, ?Order $order = null, ?Carbon $at = null): ?ProvisioningRun
+    {
+        $at = $at?->copy() ?? now();
+
+        try {
+            // The version on sale RIGHT NOW, which is what someone moving today
+            // is being sold. Throws for a plan that has been withdrawn or is not
+            // priced on this term, and that is the correct outcome: a contract
+            // moved onto a guess is worse than a change that visibly fails.
+            $target = Subscription::snapshotFrom($targetPlan, $subscription->term);
+        } catch (Throwable $e) {
+            Log::error('Cannot move a contract onto a package the catalogue will not sell.', [
+                'subscription' => $subscription->uuid, 'plan' => $targetPlan, 'error' => $e->getMessage(),
+            ]);
+
+            return null;
+        }
+
+        // Already there. Not an error — a retried trigger, a command run twice,
+        // an operator pressing the same thing — but the order is consumed so it
+        // stops asking.
+        if ((string) $subscription->plan === $targetPlan
+            && (int) $subscription->plan_version_id === (int) $target['plan_version_id']) {
+            $this->consume($order);
+
+            return null;
+        }
+
+        // The eligibility gate. An upgrade with the period already over, a
+        // downgrade before the term the customer paid for has run out, and any
+        // move on a contract that is no longer active all stop here — see
+        // PlanChange::evaluate() for why each of them is refused.
+        $change = PlanChange::evaluate($subscription, $targetPlan, $at);
+
+        if (! $change->allowedNow) {
+            return null;
+        }
+
+        // The other gate: can this contract actually be BILLED for what it is
+        // about to become? A contract with a live Stripe subscription behind it
+        // has to end this call still agreeing with Stripe about the price, and
+        // an INTERNAL family (`plan_families.internal`) never gets one —
+        // stripe:sync-catalogue skips it on purpose, permanently, because a
+        // Stripe Price cannot be deleted once minted and a package nobody is
+        // ever charged for is not worth leaving one behind. Left to run,
+        // MoveStripeSubscriptionPrice below would find nothing to move onto,
+        // throw, and park the swap on stripe_price_sync — where
+        // clupilot:sync-stripe-subscriptions retries it every hour forever,
+        // because no future sync run can ever fill in a price this family will
+        // never receive.
+        //
+        // Checked on the FLAG rather than on whether a price happens to resolve
+        // right now, even though the latter is more general and closer to the
+        // actual damage: a perfectly ordinary, still-sellable family can be
+        // between publish and its first stripe:sync-catalogue run too, and that
+        // gap is exactly what the park-and-retry path exists for — one sync run
+        // closes it (see the test right above this guard in
+        // StripePlanChangeTest). Refusing on unresolvability alone would treat
+        // that transient, self-healing gap the same as a permanent one and
+        // reject a change that would have gone through fine an hour later. The
+        // flag is the only signal that tells "will never be fixed by syncing
+        // again" apart from "has simply not been synced yet".
+        //
+        // A granted contract carries no `stripe_subscription_id` at all — see
+        // MoveStripeSubscriptionPrice's own early return — so there is nothing
+        // for it to disagree with Stripe about, and moving one onto an internal
+        // family (which is, after all, how such a package is normally handed
+        // out) is left alone here.
+        //
+        // Checked BEFORE the transaction below, not after: refusing once the
+        // contract, the register and the machine have already moved would
+        // leave the change half-done, which is worse than the sweep this
+        // replaces.
+        if ($subscription->stripe_subscription_id !== null
+            && PlanFamily::query()->where('key', $targetPlan)->value('internal')) {
+            Log::error('Cannot move a Stripe-billed contract onto an internal package: Stripe has no price for it and never will while it stays internal.', [
+                'subscription' => $subscription->uuid, 'plan' => $targetPlan,
+            ]);
+
+            return null;
+        }
+
+        $instance = $this->instanceOf($subscription);
+
+        // Read BEFORE the snapshot moves: the resize step has to know what the
+        // machine had, to tell a change of CPU or RAM from a change that only
+        // touched storage or price.
+        $before = [
+            'plan' => (string) $subscription->plan,
+            'cores' => (int) ($instance?->cores ?? $subscription->cores),
+            'ram_mb' => (int) ($instance?->ram_mb ?? $subscription->ram_mb),
+        ];
+
+        $run = DB::transaction(function () use ($subscription, $target, $targetPlan, $change, $order, $instance, $before, $at) {
+            $subscription->applyPlanSnapshot($target);
+
+            // A booked change is spent the moment the contract moves — whether it
+            // was this one arriving on its date, or a move in the other direction
+            // overtaking it. This is where the shop used to do it: an upgrade CLICK
+            // cleared a booked downgrade, in the cart, before a cent had been paid,
+            // and since nothing marks a cart order paid the customer lost the
+            // booking and got nothing in exchange. The contradiction is real —
+            // a downgrade left booked would come due months later and quietly undo
+            // the bigger package — but it is only real once the bigger package is
+            // actually theirs, which is here.
+            //
+            // Cleared AFTER PlanChange::evaluate() above, which reads the booked
+            // due date to decide whether a downgrade is allowed yet.
+            $subscription->clearPendingPlanChange();
+
+            // The register row is written from the contract that has just been
+            // moved, so the evidence and the contract cannot describe different
+            // packages — the same order OpenSubscription writes a purchase in.
+            ($this->record)(
+                event: $change->isUpgrade
+                    ? SubscriptionRecord::EVENT_UPGRADE
+                    : SubscriptionRecord::EVENT_DOWNGRADE,
+                subscription: $subscription,
+                // Zero, because a plan change moves TERMS and no money at all.
+                // Stripe settles the difference on a proration invoice of its
+                // own (PRORATE_IMMEDIATELY below), and that invoice arrives here
+                // as its own EVENT_INVOICE_PAID row carrying the real figure. An
+                // amount on this row as well counted one upgrade's money twice in
+                // any sum over the register.
+                //
+                // What the move is WORTH is not lost — it goes into the snapshot
+                // below, which is where the question "what were they quoted?"
+                // belongs. Deliberately NOT the order's amount_cents either:
+                // that is the shop's headline price for the whole package, and
+                // recording it for a move made on the sixteenth would state a sum
+                // nobody agreed to.
+                netCents: 0,
+                at: $at,
+                extra: ['plan_change' => [
+                    'from_plan' => $before['plan'],
+                    'to_plan' => $targetPlan,
+                    'remaining_days' => $change->remainingDays,
+                    'term_days' => $change->termDays,
+                    // The preview's pro-rata difference, and what the till would
+                    // take from THIS customer for it. Both, because PlanChange
+                    // prorates the NET catalogue figures while the Stripe Price it
+                    // prorates against is the one that customer is billed on — so
+                    // for anybody who is charged VAT the net figure alone reads as
+                    // a fifth less than the proration invoice that follows, and
+                    // somebody reconciling the two needs the number to compare.
+                    // For a reverse-charge business the two are equal, and saying
+                    // so is what stops a reader looking for a missing fifth.
+                    'prorated_net_cents' => $change->chargeCents,
+                    'prorated_charge_cents' => TaxTreatment::for($subscription->customer)
+                        ->chargeCents($change->chargeCents),
+                ]],
+                // Nothing has been charged AT THIS EVENT. Left null rather than
+                // reported as zero, which the register would read as a free sale.
+                chargedGrossCents: null,
+                order: $order,
+                // One row per order, enforced by the unique index rather than by
+                // a check two concurrent triggers could both pass.
+                eventKey: $order !== null ? 'plan-change:order:'.$order->id : null,
+            );
+
+            $this->resizeInstance($instance, $target, $targetPlan);
+            $this->consume($order);
+
+            return $this->startResize($instance, $targetPlan, $before, $change->isUpgrade, $order);
+        });
+
+        // After the run exists, never before. settleCustomDomain() withdraws a
+        // domain the new package no longer carries, and withdrawing one asks
+        // ReapplyInstanceAddress for a run to stop serving it — which finds this
+        // run already in flight against the same order and stands aside, because
+        // this pipeline carries the address steps itself. The other way round
+        // there would be two runs writing one router.
+        PlanChange::settleCustomDomain($subscription);
+
+        // Stripe bills the next term, so it has to be told which package that
+        // is — without this a customer who upgraded goes on paying for the one
+        // they left, every month, for as long as the contract runs.
+        //
+        // After the transaction and never inside it. The change has already
+        // landed on the contract and on the machine, and an unreachable or
+        // unconfigured Stripe must not roll any of that back: the action never
+        // throws, and parks what it could not do on the contract for the hourly
+        // sweep to pick up. A contract with no Stripe subscription behind it —
+        // a granted package — is left entirely alone.
+        //
+        // Resolved from the container here rather than injected, so a test that
+        // swaps the client in after this action exists still gets its fake.
+        app(MoveStripeSubscriptionPrice::class)(
+            $subscription,
+            $change->isUpgrade ? StripeClient::PRORATE_IMMEDIATELY : StripeClient::PRORATE_NONE,
+        );
+
+        if ($run !== null) {
+            AdvanceRunJob::dispatch($run->uuid); // after commit
+
+            Log::info('Applying a plan change.', [
+                'subscription' => $subscription->uuid,
+                'from' => $before['plan'],
+                'to' => $targetPlan,
+                'upgrade' => $change->isUpgrade,
+                'run' => $run->uuid,
+            ]);
+        }
+
+        return $run;
+    }
+
+    /**
+     * The order is spent. Anything but `pending` takes it out of the customer's
+     * cart, and `applied` says which way it went — it was never paid in the sense
+     * an invoice means, and calling it that would put a charge in the record that
+     * never happened.
+     */
+    private function consume(?Order $order): void
+    {
+        if ($order !== null && $order->status !== 'applied') {
+            $order->update(['status' => 'applied']);
+        }
+    }
+
+    /**
+     * Bring the machine's own row in line with the package it now serves.
+     *
+     * Everything except the disk. A disk cannot be shrunk — Proxmox grows one
+     * online and has no way back — so a downgrade leaves the guest exactly as
+     * large as it already is, and writing the smaller figure here would make this
+     * row claim a size the machine does not have. Two things read it and both
+     * would be wrong: the host's storage accounting, which would think it had
+     * space it does not, and the next resize, which would ask Proxmox to shrink.
+     *
+     * What actually shrinks is the QUOTA, which Nextcloud enforces and which is
+     * what was sold — see the plan-change pipeline's quota step. The disk is
+     * infrastructure; the quota is the product. The contract's own `disk_gb` still
+     * records what the smaller package includes, so nothing has been lost: this
+     * column is what the machine HAS, and that is all it has ever meant.
+     *
+     * @param  array<string, mixed>  $target
+     */
+    private function resizeInstance(?Instance $instance, array $target, string $targetPlan): void
+    {
+        $instance?->update([
+            'plan' => $targetPlan,
+            'quota_gb' => $target['quota_gb'],
+            'ram_mb' => $target['ram_mb'],
+            'cores' => $target['cores'],
+        ]);
+    }
+
+    /**
+     * Start the run that makes the machine match the package.
+     *
+     * Subject is the instance's own purchase order, exactly as the `address`
+     * pipeline does it — not the upgrade order. That is what CustomerStep::order()
+     * and ::subscription() resolve from, so the steps read this customer's
+     * contract rather than nothing; it is what ReapplyInstanceAddress checks for
+     * a run already in flight, so two runs cannot write one router; and it keeps
+     * RunRunner from marking a paid, running customer's order failed because a
+     * resize could not be applied (see ProvisioningSubject::provisioningPipeline).
+     *
+     * @param  array{plan: string, cores: int, ram_mb: int}  $before
+     */
+    private function startResize(?Instance $instance, string $targetPlan, array $before, bool $isUpgrade, ?Order $order): ?ProvisioningRun
+    {
+        // A contract with no machine — one still being built, one whose build
+        // failed, a package granted before provisioning ran — has nothing to
+        // resize. The contract has still moved, and the machine will be built
+        // from it whenever it is built.
+        if ($instance === null || ! $instance->hasLiveMachine()) {
+            return null;
+        }
+
+        return ProvisioningRun::create([
+            'subject_type' => Order::class,
+            'subject_id' => $instance->order_id,
+            'pipeline' => 'plan-change',
+            'status' => ProvisioningRun::STATUS_PENDING,
+            'current_step' => 0,
+            'context' => [
+                'instance_id' => $instance->id,
+                'host_id' => $instance->host_id,
+                'node' => $instance->host?->node,
+                'vmid' => $instance->vmid,
+                'subdomain' => $instance->subdomain,
+                // What the machine had before, so the resize step can tell which
+                // of its changes need the guest to come back round before they
+                // are true. Kept on the run rather than recomputed: by the time
+                // the step executes, the instance row already says the new size.
+                'plan_change' => [
+                    'order_id' => $order?->id,
+                    'from_plan' => $before['plan'],
+                    'to_plan' => $targetPlan,
+                    'from_cores' => $before['cores'],
+                    'from_ram_mb' => $before['ram_mb'],
+                    'upgrade' => $isUpgrade,
+                ],
+            ],
+        ]);
+    }
+
+    /**
+     * The machine this contract pays for: the link when provisioning has written
+     * it, and otherwise the customer's newest instance — the same fallback
+     * CustomDomainAccess makes, for the same reason.
+     */
+    private function instanceOf(Subscription $subscription): ?Instance
+    {
+        return $subscription->instance
+            ?? $subscription->customer?->instances()->latest('id')->first();
+    }
+}

app/Actions/ApplyStorageAllowance.php

@@ -0,0 +1,131 @@
+<?php
+
+namespace App\Actions;
+
+use App\Models\Instance;
+use App\Models\Order;
+use App\Models\ProvisioningRun;
+use App\Models\Subscription;
+use App\Provisioning\Jobs\AdvanceRunJob;
+use App\Provisioning\WorkInFlight;
+use Illuminate\Support\Facades\Cache;
+use Illuminate\Support\Facades\Log;
+
+/**
+ * Deliver the storage a customer has just bought — or take back what they have
+ * just cancelled.
+ *
+ * A booked pack was a row in `subscription_addons` and nothing else. It was
+ * priced, frozen, charged for every month and had no effect whatsoever on the
+ * machine: the disk stayed the size the package made it, the filesystem inside
+ * stayed the size the disk had been, and Nextcloud went on enforcing the
+ * package's own allowance. This is the missing half — the moment a booking
+ * becomes space.
+ *
+ * It does not do the work. Growing a disk, growing a guest's filesystem and
+ * writing an occ setting are remote work on a live machine, so they go through
+ * the same run machinery as everything else — see the `storage` pipeline — where
+ * they are retried, logged and visible in the console instead of happening
+ * inside whichever web request happened to book the pack.
+ *
+ * Called from the one place a pack becomes real or stops being real:
+ * App\Actions\BookAddon, on booking and on cancellation. Cancelling matters as
+ * much as booking — the allowance goes back down, and Nextcloud has to be told,
+ * or the customer would keep the storage they have stopped paying for.
+ */
+class ApplyStorageAllowance
+{
+    /** Start a storage run for the machine this contract pays for. */
+    public function __invoke(?Subscription $subscription): ?ProvisioningRun
+    {
+        if ($subscription === null) {
+            return null;
+        }
+
+        // The link when provisioning has written it, and otherwise the
+        // customer's newest instance — the same fallback ApplyPlanChange and
+        // CustomDomainAccess make, for the same reason.
+        return $this->forInstance(
+            $subscription->instance ?? $subscription->customer?->instances()->latest('id')->first()
+        );
+    }
+
+    /**
+     * Start a storage run for this instance, or return null when there is
+     * nothing to start.
+     *
+     * Null is the ordinary answer and not a failure: a machine still being
+     * built, one whose VM has gone, one whose service has ended, or one that
+     * already has a run in flight all deliver the allowance from that run
+     * instead — every pipeline that touches storage reads the allowance when it
+     * gets there, which is this state or newer.
+     */
+    public function forInstance(?Instance $instance): ?ProvisioningRun
+    {
+        if ($instance === null || ! $instance->hasLiveMachine()) {
+            return null;
+        }
+
+        // The same lock ReapplyInstanceAddress and RestartInstance take, for the
+        // same reason: two bookings can land in one instant — a double click, a
+        // webhook delivered twice, an operator granting a pack while the
+        // customer buys one — and two runs against one machine would resize the
+        // same disk and race each other's occ calls. Nobody waits for it: a run
+        // that lost the race has nothing to add, because the one that won reads
+        // the same allowance.
+        $lock = Cache::lock('instance-storage:'.$instance->uuid, 30);
+
+        if (! $lock->get()) {
+            return null;
+        }
+
+        try {
+            return $this->start($instance);
+        } finally {
+            $lock->release();
+        }
+    }
+
+    private function start(Instance $instance): ?ProvisioningRun
+    {
+        $order = $instance->order;
+
+        // Stand aside only for a run that will deliver the whole allowance: the
+        // disk, the filesystem inside it and the figure Nextcloud enforces. A
+        // plan change does all three and there is nothing to add. A `quota` run
+        // does only the last of them, and letting it stand for the booking would
+        // enforce a quota over a filesystem that never grew — space the machine
+        // does not have. `address` and `restart` do none of them, and standing
+        // aside for one of those was how a pack could be charged monthly and
+        // never delivered. See App\Provisioning\WorkInFlight.
+        if (app(WorkInFlight::class)->covers($order, 'storage')) {
+            return null;
+        }
+
+        $run = ProvisioningRun::create([
+            'subject_type' => Order::class,
+            'subject_id' => $order->id,
+            'pipeline' => 'storage',
+            'status' => ProvisioningRun::STATUS_PENDING,
+            'current_step' => 0,
+            // Everything the three steps read: instance_id is how CustomerStep
+            // finds the machine, node and vmid are how it reaches inside it.
+            'context' => [
+                'instance_id' => $instance->id,
+                'host_id' => $instance->host_id,
+                'node' => $instance->host?->node,
+                'vmid' => $instance->vmid,
+                'subdomain' => $instance->subdomain,
+            ],
+        ]);
+
+        AdvanceRunJob::dispatch($run->uuid);
+
+        Log::info('Delivering a changed storage allowance.', [
+            'instance' => $instance->uuid,
+            'run' => $run->uuid,
+        ]);
+
+        return $run;
+    }
+}

app/Actions/ApplyStripeBillingEvent.php

@@ -0,0 +1,660 @@
+<?php
+
+namespace App\Actions;
+
+use App\Models\DunningCase;
+use App\Models\StripePendingEvent;
+use App\Models\Subscription;
+use App\Models\SubscriptionRecord;
+use Illuminate\Database\UniqueConstraintViolationException;
+use Illuminate\Support\Carbon;
+use Illuminate\Support\Facades\DB;
+use Illuminate\Support\Facades\Log;
+use Throwable;
+
+/**
+ * What Stripe tells us about the billing cycle, applied to the contract.
+ *
+ * The division of labour: Stripe owns the money — retries, dunning, off-session
+ * SCA — and we own capability, because Stripe does not know how big the VM
+ * should be. So these handlers move period boundaries and status, and write the
+ * register. They never re-derive an amount: the invoice is the authority for
+ * what was charged, and recomputing it here from our own catalogue would produce
+ * a second, disagreeing answer.
+ *
+ * The one thing Stripe does NOT own is the document. Their invoice numbering is
+ * theirs and is not a lawful Austrian invoice series; ours is, and it is gapless
+ * because it has to be. So EVERY invoice Stripe reports as paid produces a
+ * document of our own and one mail carrying it — see App\Actions\IssueStripeInvoice,
+ * and invoicePaid() below for the two exceptions: the checkout's own invoice,
+ * which the purchase already has a document for, and a charge for a term that
+ * begins after the contract ended, which owes nobody anything — see
+ * owesADocument().
+ *
+ * Every handler is idempotent. Stripe retries a webhook until it gets a 2xx,
+ * and it also sends the same event to several endpoints — so "already applied"
+ * is the normal case, not the exception.
+ */
+class ApplyStripeBillingEvent
+{
+    /**
+     * Precedence when two events share a second — highest wins.
+     *
+     * Ordered by how much the event settles: a payment that went through is the
+     * last word, a snapshot of the subscription is a running picture, and a
+     * failed attempt is the least final of the three, since a retry may already
+     * have succeeded.
+     */
+    private const RANK_PAID = 3;
+
+    private const RANK_UPDATED = 2;
+
+    private const RANK_FAILED = 1;
+
+    public function __construct(
+        private RecordCommercialEvent $record,
+        private IssueStripeInvoice $issueStripeInvoice,
+    ) {}
+
+    /**
+     * A renewal was paid. Move the period on and enter it in the register.
+     *
+     * @param  array<string, mixed>  $invoice
+     */
+    public function invoicePaid(array $invoice, ?Carbon $eventAt = null): ?SubscriptionRecord
+    {
+        $subscription = $this->resolve($invoice['subscription'] ?? null);
+
+        if ($subscription === null) {
+            return null;
+        }
+
+        // Ein Mahnfall dieses Vertrags kann damit erledigt sein — geprüft
+        // wird aber gegen Stripes offene Rechnungen, nicht gegen diese eine:
+        // die Mahnspesen liegen auf eigenen Rechnungen daneben.
+        foreach (DunningCase::query()
+            ->where('subscription_id', $subscription->id)
+            ->whereNull('settled_at')
+            ->get() as $case) {
+            app(SettleDunningCase::class)($case);
+        }
+
+        $reason = (string) ($invoice['billing_reason'] ?? '');
+
+        // The checkout's own invoice is not a renewal — it is the purchase, and
+        // OpenSubscription has already entered it. Recording it again here
+        // would double every customer's first payment in the register.
+        if ($reason === 'subscription_create') {
+            return null;
+        }
+
+        // Only a cycle renewal moves the term on. Stripe also sends paid
+        // invoices for prorations and for charges raised by hand, and those are
+        // money received without being the start of a new month — calling them
+        // renewals would push the period forward on a top-up.
+        $isRenewal = $reason === 'subscription_cycle';
+        $invoiceId = (string) ($invoice['id'] ?? '');
+
+        [$start, $end] = $this->period($invoice);
+
+        // A contract that has ended stays ended (mutateInOrder refuses one), so
+        // a final invoice arriving after the deletion cannot hand a departed
+        // customer their service back. The payment is still entered in the
+        // register below; it did happen. Whether it also owes a DOCUMENT is a
+        // separate question with a separate answer — see owesADocument().
+        if ($isRenewal && $start !== null && $end !== null) {
+            $this->mutateInOrder($subscription, $eventAt, self::RANK_PAID, fn (Subscription $fresh) => $end
+                // Never backwards: a renewal delayed behind the next one would
+                // otherwise shorten the term the customer has already paid for.
+                ->greaterThanOrEqualTo($fresh->current_period_end)
+                    // Period boundaries are not part of the frozen snapshot:
+                    // what the customer is owed does not change, only which
+                    // month it is.
+                    ? [
+                        'current_period_start' => $start,
+                        'current_period_end' => $end,
+                        'status' => 'active',
+                        'stripe_status' => 'active',
+                    ]
+                    : null);
+        }
+
+        // One invoice, one entry — enforced by the unique index rather than by
+        // a check, because Stripe can deliver the same invoice twice at once
+        // and both deliveries would pass a check.
+        $event = $isRenewal ? SubscriptionRecord::EVENT_RENEWAL : SubscriptionRecord::EVENT_INVOICE_PAID;
+
+        $record = $this->recordOnce(
+            fn () => ($this->record)(
+                event: $event,
+                subscription: $subscription->refresh(),
+                // The whole term, modules included. A cycle invoice bills the
+                // package item AND one item per booked module, so what Stripe
+                // took is the gross of all of them — held against `price_cents`
+                // alone, every renewal on a contract with a single module was
+                // filed as charged at the wrong amount. Nothing is agreed for a
+                // proration or a hand-raised charge: what those are worth is
+                // whatever Stripe worked out, and it arrives as the charged
+                // figure below.
+                netCents: $isRenewal ? $subscription->termNetCents() : 0,
+                stripe: [
+                    'invoice' => $invoiceId ?: null,
+                    'subscription' => $subscription->stripe_subscription_id,
+                ],
+                // The exact kind, kept so a proration or a manual charge stays
+                // distinguishable from an ordinary renewal.
+                extra: ['billing_reason' => $reason ?: null],
+                // Stripe's total is what was actually taken, tax and all. Ours
+                // is what was agreed; the register states both.
+                chargedGrossCents: isset($invoice['amount_paid']) ? (int) $invoice['amount_paid'] : null,
+                eventKey: $invoiceId !== '' ? "{$event}:{$invoiceId}" : null,
+            )
+        );
+
+        if ($this->owesADocument($subscription->refresh(), $invoice, $start)) {
+            $this->invoicePayment($subscription, $invoice, $start, $end);
+        }
+
+        return $record;
+    }
+
+    /**
+     * Whether this charge is one the customer is still owed a document for.
+     *
+     * Nothing in this application could cancel a Stripe subscription, so a
+     * customer who cancelled and a customer who withdrew both stayed subscribed —
+     * and every month Stripe took another payment, `invoice.paid` arrived here,
+     * and a real invoice was drawn out of the gapless Austrian series and mailed,
+     * for a service that no longer existed. Cancelling the subscription is the
+     * first half of the fix; this is the second, because a subscription somebody
+     * failed to cancel, or one cancelled by hand in Stripe's dashboard, must not
+     * be able to mint numbers here either.
+     *
+     * ## The rule, and why it is not simply "refuse a cancelled contract"
+     *
+     * A perfectly legitimate FINAL invoice can arrive after the contract has
+     * ended, and refusing every one of them would lose a document the customer is
+     * legally owed. The commonest case: the cycle invoice for the term they were
+     * in went unpaid, Stripe's dunning ran for three weeks, the contract ended in
+     * the middle of it, and then the customer paid. That money is for a term they
+     * really did have a running cloud in.
+     *
+     * So the question is not WHEN the payment landed — Stripe's dunning makes that
+     * arbitrary — but WHAT it is for:
+     *
+     *   the period this invoice bills STARTED before the contract ended
+     *     → a term the customer was actually in. Document it.
+     *   the period begins at or after the moment the contract ended
+     *     → a term that does not exist. No document, no number, and an error in
+     *       the log, because a charge for a service that has ended means Stripe
+     *       was never stopped and somebody has to send that money back.
+     *
+     * The boundary case — a period starting exactly at `cancelled_at` — is the
+     * first month the customer does NOT have, so it is refused.
+     *
+     * A contract marked cancelled with no date on it, or an invoice carrying no
+     * period, cannot be judged by that rule at all, and both are refused. The
+     * asymmetry is deliberate and it is the same one IssueInvoice is built on: a
+     * missing document is recoverable — an operator issues it from the console —
+     * while a number handed out in error can never be withdrawn, only corrected by
+     * a cancellation document plus a new one.
+     *
+     * The register entry is written either way, above. The money moved; refusing
+     * to record that would hide it, and the register is where an operator finds
+     * the payments that need sending back.
+     *
+     * @param  array<string, mixed>  $invoice
+     */
+    private function owesADocument(Subscription $subscription, array $invoice, ?Carbon $periodStart): bool
+    {
+        if (! $subscription->hasEnded()) {
+            return true;
+        }
+
+        $endedAt = $subscription->cancelled_at;
+
+        if ($endedAt !== null && $periodStart !== null && $periodStart->lessThan($endedAt)) {
+            return true;
+        }
+
+        Log::error('Stripe charged for a contract that has ended, so no invoice was issued and no number was used. This money has to go back.', [
+            'subscription' => $subscription->uuid,
+            'stripe_subscription' => $subscription->stripe_subscription_id,
+            'stripe_invoice' => $invoice['id'] ?? null,
+            'billing_reason' => $invoice['billing_reason'] ?? null,
+            'amount_paid' => $invoice['amount_paid'] ?? null,
+            'contract_ended_at' => $endedAt?->toIso8601String(),
+            'billed_period_start' => $periodStart?->toIso8601String(),
+        ]);
+
+        return false;
+    }
+
+    /**
+     * The document this payment owes the customer, and the one mail that carries
+     * it.
+     *
+     * **Every paid invoice, not only a renewal.** The rule is one document per
+     * charge, so a proration, a module booked in the middle of a term and a
+     * charge raised by hand in Stripe's dashboard each get one — built from
+     * Stripe's own lines, which is what actually took the money. The single
+     * exception is the checkout's own invoice, which returns before this line:
+     * that purchase already has a document, and a second would put two invoices
+     * on one sale.
+     *
+     * Outside recordOnce() on purpose. The register entry and the invoice are
+     * two different obligations, and tying the second to the first succeeding
+     * would mean that a delivery which recorded the payment but could not issue
+     * the document — an incomplete company profile, a mail server that was down
+     * — could never be finished: every retry would find the register entry
+     * already there, return, and the customer would never get an invoice. The
+     * issuing is idempotent on its own, keyed on the Stripe invoice id.
+     *
+     * Caught here as well as inside the action. The action guards what it does;
+     * this guards the rest, because the rule is that no paperwork of ours may
+     * ever cost Stripe a 2xx — a retried webhook is a second attempt at
+     * everything, and one of those things moves the customer's term.
+     *
+     * @param  array<string, mixed>  $invoice
+     */
+    private function invoicePayment(Subscription $subscription, array $invoice, ?Carbon $start, ?Carbon $end): void
+    {
+        try {
+            ($this->issueStripeInvoice)($subscription->refresh(), $invoice, $start, $end);
+        } catch (Throwable $e) {
+            Log::error('Failed to invoice a Stripe payment that went through.', [
+                'subscription' => $subscription->uuid,
+                'stripe_invoice' => $invoice['id'] ?? null,
+                'error' => $e->getMessage(),
+            ]);
+        }
+    }
+
+    /**
+     * A renewal failed. Recorded, and nothing else: Stripe runs the dunning
+     * schedule, and cutting a customer off on the first failed attempt would
+     * punish an expired card as though it were a refusal to pay.
+     *
+     * @param  array<string, mixed>  $invoice
+     */
+    public function invoicePaymentFailed(array $invoice, ?Carbon $eventAt = null): ?SubscriptionRecord
+    {
+        $subscription = $this->resolve($invoice['subscription'] ?? null);
+
+        if ($subscription === null) {
+            return null;
+        }
+
+        $invoiceId = (string) ($invoice['id'] ?? '');
+
+        // Only if this is the newest word we have. A failed attempt delayed
+        // behind the successful retry would otherwise flip a customer who has
+        // since paid back to past_due.
+        $this->mutateInOrder($subscription, $eventAt, self::RANK_FAILED, fn () => ['stripe_status' => 'past_due']);
+
+        // Der Mahnfall. Bis hierher endete es an dieser Stelle: `past_due`
+        // gesetzt, Datensatz geschrieben, und niemand erfuhr davon — nicht der
+        // Kunde, nicht der Betreiber. Je Rechnung genau einmal, siehe
+        // OpenDunningCase.
+        if ($invoiceId !== '') {
+            app(OpenDunningCase::class)($subscription, $invoiceId);
+        }
+
+        return $this->recordOnce(
+            fn () => ($this->record)(
+                event: SubscriptionRecord::EVENT_PAYMENT_FAILED,
+                subscription: $subscription->refresh(),
+                netCents: 0,
+                stripe: [
+                    'invoice' => $invoiceId ?: null,
+                    'subscription' => $subscription->stripe_subscription_id,
+                ],
+                extra: ['attempt' => $invoice['attempt_count'] ?? null],
+                chargedGrossCents: 0,
+                // Per attempt, not per invoice: Stripe retries a failing
+                // payment on a schedule, and each attempt is its own event.
+                eventKey: $invoiceId !== ''
+                    ? 'payment_failed:'.$invoiceId.':'.($invoice['attempt_count'] ?? 0)
+                    : null,
+            )
+        );
+    }
+
+    /**
+     * Stripe's own status changed. Theirs is the authority on whether the money
+     * is arriving; we copy it, and leave what the customer may USE to our own
+     * status, which only a cancellation or an operator changes.
+     *
+     * @param  array<string, mixed>  $object
+     */
+    public function subscriptionUpdated(array $object, ?Carbon $eventAt = null): ?Subscription
+    {
+        $subscription = $this->resolve($object['id'] ?? null);
+
+        if ($subscription === null) {
+            return null;
+        }
+
+        [$start, $end] = $this->period($object);
+
+        $this->rememberItem($subscription, $object);
+
+        // Ended is ended, whatever order events arrive in — and an older
+        // snapshot must never overwrite a newer one it was delivered behind.
+        $this->mutateInOrder($subscription, $eventAt, self::RANK_UPDATED, fn () => array_filter([
+            'stripe_status' => $object['status'] ?? null,
+            'current_period_start' => $start,
+            'current_period_end' => $end,
+        ], fn ($value) => $value !== null));
+
+        return $subscription;
+    }
+
+    /**
+     * Keep the id of the item this subscription bills through.
+     *
+     * Stripe names it only on the subscription object, and moving a contract
+     * onto another price is impossible without it — the price hangs off the
+     * item, not off the subscription. Learnt here because this event arrives on
+     * its own for every status change and every renewal, so the ordinary running
+     * of a contract fills it in without anyone having to ask Stripe.
+     *
+     * Written outside the ordering guard on purpose: this is not part of the
+     * running picture. An item id does not go stale, does not change when the
+     * price on it does, and a stale event carries exactly the same one.
+     *
+     * @param  array<string, mixed>  $object
+     */
+    private function rememberItem(Subscription $subscription, array $object): void
+    {
+        if ($subscription->stripe_item_id !== null) {
+            return;
+        }
+
+        $itemId = $object['items']['data'][0]['id'] ?? null;
+
+        // One item, because one contract bills one package. A subscription with
+        // several would need a rule for which of them the package is, and there
+        // is nothing here to build one from — better to have none than to swap
+        // the price on whichever happened to be first.
+        if (is_string($itemId) && $itemId !== '' && count($object['items']['data'] ?? []) === 1) {
+            $subscription->update(['stripe_item_id' => $itemId]);
+        }
+    }
+
+    /**
+     * The subscription has ended at Stripe. That is the end of the contract,
+     * so it goes in the register — a cancellation nobody recorded is exactly
+     * the kind of gap the register exists to prevent.
+     *
+     * @param  array<string, mixed>  $object
+     */
+    public function subscriptionDeleted(array $object, ?Carbon $eventAt = null): ?SubscriptionRecord
+    {
+        $subscription = $this->resolve($object['id'] ?? null);
+
+        if ($subscription === null) {
+            return null;
+        }
+
+        $endedAt = isset($object['ended_at'])
+            ? Carbon::createFromTimestamp((int) $object['ended_at'])
+            : now();
+
+        // The ending and its entry in the register commit together. Marking the
+        // contract cancelled first and failing before the record would leave a
+        // retry seeing "already cancelled" and returning — and the end of a
+        // contract would never be entered at all.
+        return $this->recordOnce(fn () => DB::transaction(function () use ($subscription, $object, $endedAt, $eventAt) {
+            // Held while we decide, so a renewal arriving at the same moment
+            // cannot reactivate the contract between this and the write.
+            $subscription = Subscription::query()->whereKey($subscription->getKey())->lockForUpdate()->firstOrFail();
+
+            // No ordering guard: an ending is final, so a late delivery of it
+            // is still correct. Only the running picture can go stale.
+            //
+            // A booked plan change goes with the contract it was booked on. It
+            // could never be carried out — clupilot:apply-due-plan-changes only
+            // touches active contracts — but leaving the stamp behind would have
+            // the portal and the console go on announcing that a package which
+            // no longer exists is about to shrink.
+            $subscription->update([
+                'status' => 'cancelled',
+                'stripe_status' => $object['status'] ?? 'canceled',
+                'cancelled_at' => $endedAt,
+                'stripe_event_at' => $eventAt,
+                'pending_plan' => null,
+                'pending_effective_at' => null,
+            ]);
+
+            return ($this->record)(
+                event: SubscriptionRecord::EVENT_CANCELLATION,
+                subscription: $subscription->refresh(),
+                netCents: 0,
+                at: $endedAt,
+                stripe: ['subscription' => $subscription->stripe_subscription_id],
+                chargedGrossCents: 0,
+                // A contract ends once. Two deliveries arriving together would
+                // both pass a status check; only one can take this key.
+                eventKey: 'cancellation:'.$subscription->id,
+            );
+        }));
+    }
+
+    /**
+     * Whether this event is the newest word we have about the contract.
+     *
+     * Stripe does not guarantee delivery order, and the state here is a
+     * running picture rather than a log: applying a stale snapshot on top of a
+     * fresher one is how a paid-up customer ends up looking overdue. The
+     * register is unaffected — each entry is keyed by what it is about, so a
+     * late arrival still lands once, in its proper place.
+     */
+    /**
+     * Decide and write in one step, with the contract's row held.
+     *
+     * The ordering guard is only worth as much as its atomicity: two
+     * deliveries for the same contract can both read a stale copy, both pass
+     * the check, and the loser then overwrites the winner — a renewal
+     * reactivating a contract a deletion had just ended, or an old failure
+     * burying a payment that went through. So the row is re-read under a lock
+     * and re-judged inside the transaction that writes it.
+     *
+     * `$changes` returns the columns to set, or null to decline.
+     *
+     * @param  callable(Subscription): ?array<string, mixed>  $changes
+     */
+    private function mutateInOrder(Subscription $subscription, ?Carbon $eventAt, int $rank, callable $changes): void
+    {
+        DB::transaction(function () use ($subscription, $eventAt, $rank, $changes) {
+            $fresh = Subscription::query()->whereKey($subscription->getKey())->lockForUpdate()->first();
+
+            if ($fresh === null
+                || $fresh->status === 'cancelled'
+                || ! $this->appliesInOrder($fresh, $eventAt, $rank)) {
+                return;
+            }
+
+            $values = $changes($fresh);
+
+            if ($values === null) {
+                return;
+            }
+
+            if ($eventAt !== null) {
+                $values['stripe_event_at'] = $eventAt;
+                $values['stripe_event_rank'] = $rank;
+            }
+
+            $fresh->update($values);
+        });
+
+        $subscription->refresh();
+    }
+
+    private function appliesInOrder(Subscription $subscription, ?Carbon $eventAt, int $rank): bool
+    {
+        if ($eventAt === null || $subscription->stripe_event_at === null) {
+            return true;   // nothing to compare against
+        }
+
+        if ($eventAt->greaterThan($subscription->stripe_event_at)) {
+            return true;
+        }
+
+        if ($eventAt->lessThan($subscription->stripe_event_at)) {
+            return false;
+        }
+
+        // Same second, which Stripe's one-second timestamps make common enough
+        // to matter: a failed attempt and the retry that succeeded can share
+        // one. Decide by what the event says about the money.
+        return $rank >= (int) ($subscription->stripe_event_rank ?? 0);
+    }
+
+    /**
+     * Write a register entry, unless one already exists for this invoice and
+     * event.
+     *
+     * The uniqueness lives in the database, on (stripe_invoice_id, event).
+     * Checking first and inserting afterwards leaves a window that Stripe
+     * delivering the same invoice twice at once walks straight through — and a
+     * register that counts a payment twice is worse than one that is late.
+     *
+     * @param  callable(): SubscriptionRecord  $write
+     */
+    private function recordOnce(callable $write): ?SubscriptionRecord
+    {
+        try {
+            return $write();
+        } catch (UniqueConstraintViolationException) {
+            return null; // already recorded by a concurrent delivery
+        }
+    }
+
+    /**
+     * Hold an event whose contract does not exist yet, so it is not lost.
+     *
+     * @param  array<string, mixed>  $event
+     */
+    public function hold(array $event): void
+    {
+        $subscriptionId = $event['data']['object']['subscription']
+            ?? $event['data']['object']['id']
+            ?? null;
+
+        if (! is_string($subscriptionId) || ! is_string($event['id'] ?? null)) {
+            return;
+        }
+
+        // Only what we could not match. A handler returns null for several
+        // reasons — already recorded, or deliberately skipped, like every
+        // checkout's own invoice — and holding those would fill the table with
+        // rows that replayHeldFor() can never revisit, because their contract
+        // is right there. Nothing to wait for means nothing to hold.
+        if (Subscription::query()->where('stripe_subscription_id', $subscriptionId)->exists()) {
+            // Unless it appeared just now: the contract can be created between
+            // the handler missing it and this check, and the replay that would
+            // have collected it has then already been and gone. Apply it here
+            // instead of dropping it. Safe to repeat — the handlers are
+            // idempotent, so an event that was a no-op stays one.
+            $this->dispatch($event);
+
+            return;
+        }
+
+        StripePendingEvent::query()->updateOrCreate(
+            ['stripe_event_id' => $event['id']],
+            [
+                'stripe_subscription_id' => $subscriptionId,
+                'type' => (string) ($event['type'] ?? ''),
+                'raised_at' => isset($event['created']) && is_numeric($event['created'])
+                    ? Carbon::createFromTimestamp((int) $event['created'])
+                    : null,
+                'payload' => $event,
+            ],
+        );
+    }
+
+    /**
+     * Replay everything held for a contract that has just appeared.
+     *
+     * In their original order, so the ordering guard sees them as Stripe raised
+     * them rather than as they happened to be stored.
+     */
+    public function replayHeldFor(Subscription $subscription): int
+    {
+        if ($subscription->stripe_subscription_id === null) {
+            return 0;
+        }
+
+        $held = StripePendingEvent::query()
+            ->where('stripe_subscription_id', $subscription->stripe_subscription_id)
+            ->orderBy('raised_at')
+            ->orderBy('id')
+            ->get();
+
+        foreach ($held as $pending) {
+            $this->dispatch($pending->payload ?? []);
+            $pending->delete();
+        }
+
+        return $held->count();
+    }
+
+    /**
+     * Route one event to its handler. Returns false for a type we do not
+     * handle, so the caller can tell "not ours" from "nothing to do".
+     *
+     * @param  array<string, mixed>  $event
+     */
+    public function dispatch(array $event): mixed
+    {
+        $object = $event['data']['object'] ?? [];
+        $raisedAt = isset($event['created']) && is_numeric($event['created'])
+            ? Carbon::createFromTimestamp((int) $event['created'])
+            : null;
+
+        return match ($event['type'] ?? '') {
+            'invoice.paid' => $this->invoicePaid($object, $raisedAt),
+            'invoice.payment_failed' => $this->invoicePaymentFailed($object, $raisedAt),
+            'customer.subscription.updated' => $this->subscriptionUpdated($object, $raisedAt),
+            'customer.subscription.deleted' => $this->subscriptionDeleted($object, $raisedAt),
+            default => false,
+        };
+    }
+
+    /**
+     * Find the contract a Stripe event is about.
+     *
+     * An unknown id is logged and dropped rather than raised: Stripe delivers
+     * events for objects created by hand in the dashboard, and by other
+     * environments pointed at the same endpoint. Failing the webhook for those
+     * would have Stripe retry something that can never succeed.
+     */
+    private function resolve(mixed $stripeSubscriptionId): ?Subscription
+    {
+        $id = is_string($stripeSubscriptionId) ? $stripeSubscriptionId : null;
+
+        if ($id === null) {
+            return null;
+        }
+
+        return Subscription::query()->where('stripe_subscription_id', $id)->first();
+    }
+
+    /**
+     * @param  array<string, mixed>  $object
+     * @return array{0: ?Carbon, 1: ?Carbon}
+     */
+    private function period(array $object): array
+    {
+        $start = $object['period_start'] ?? $object['current_period_start'] ?? null;
+        $end = $object['period_end'] ?? $object['current_period_end'] ?? null;
+
+        return [
+            is_numeric($start) ? Carbon::createFromTimestamp((int) $start) : null,
+            is_numeric($end) ? Carbon::createFromTimestamp((int) $end) : null,
+        ];
+    }
+}

app/Actions/ArchiveAndTearDown.php

@@ -0,0 +1,577 @@
+<?php
+
+namespace App\Actions;
+
+use App\Models\Instance;
+use App\Services\Proxmox\ProxmoxClient;
+use Illuminate\Support\Carbon;
+use Illuminate\Support\Facades\Cache;
+use Illuminate\Support\Facades\Log;
+use Illuminate\Support\Sleep;
+use RuntimeException;
+use Throwable;
+
+/**
+ * Die Maschine einer gekündigten Instanz archivieren und dann abbauen.
+ *
+ * Gekündigte Kundenmaschinen wurden bisher nie abgebaut. `EndInstanceService`
+ * nimmt der Instanz am Laufzeitende die Adresse weg — Router, DNS-Eintrag,
+ * Zertifikatsflaggen — und lässt die virtuelle Maschine ausdrücklich stehen,
+ * weil das Zerstören fremder Platten keine Entscheidung ist, die ein
+ * Adress-Abbau nebenbei trifft. Danach kam nichts mehr: die Maschine lief für
+ * immer weiter und belegte einen Platz auf dem Host, den niemand mehr verkaufen
+ * kann. Dies ist der Schritt danach.
+ *
+ * ## Die eine Regel
+ *
+ * **Niemals löschen, bevor das Archiv nachweislich existiert.** Ein `vzdump`
+ * kann mit einer Auftragskennung enden und trotzdem nichts hinterlassen — volle
+ * Ablage, abgebrochener Lauf, ein Fehler im Gast. Wer der Kennung glaubt statt
+ * nachzusehen, löscht die Maschine eines Kunden, dem zwölf Monate Aufbewahrung
+ * zugesagt sind, und hat kein Archiv. Das ist durch keinen Wiederholungslauf zu
+ * heilen. Deshalb steht zwischen dem Sichern und dem Löschen eine echte
+ * Nachfrage auf der Ablage (`backupsFor()`), und jeder Riegel davor lässt den
+ * Lauf lieber stehen, als eine Stufe zu überspringen.
+ *
+ * ## Die Reihenfolge, und warum jede Stufe da steht, wo sie steht
+ *
+ * 1. **Ablage klären**, bevor irgendetwas angefasst wird — siehe unten.
+ * 2. **Herunterfahren**, sofern der Gast überhaupt läuft, und darauf warten.
+ *    Eine laufende Datenbank zu sichern und danach zu löschen hiesse, ein
+ *    Archiv mit halb geschriebenen Tabellen aufzubewahren. Es wird nie hart
+ *    ausgeschaltet: `ProxmoxClient` bietet den Stromstecker bewusst nicht an
+ *    (siehe dort), also ist die Frist eine Grenze fürs WARTEN und keine
+ *    Zündschnur. Ein Gast, der nicht geht, ist ein Fall für einen Menschen.
+ *    Das „sofern" ist kein Zierrat, sondern der Regelfall — die Begründung
+ *    steht am Riegel selbst.
+ * 3. **Sichern** über `backupNow()` und auf den Auftrag warten. Der Aufruf
+ *    liefert nur eine Kennung; der Dump läuft danach noch minutenlang. Ohne
+ *    dieses Warten fragte die Nachschau in Stufe 4 die Ablage, bevor das
+ *    Archiv darauf liegt — der Abbau schlüge jedes Mal fehl und liesse bei
+ *    jedem Lauf einen weiteren Dump auf der Ablage zurück.
+ * 4. **Nachsehen.** Liegt nichts da, wird nicht gelöscht.
+ * 5. **Löschen** — den Zerstörungsauftrag abwarten wie die beiden davor —, und
+ *    erst dann `torn_down_at` schreiben. Auch `deleteVm()` liefert nur eine
+ *    Kennung; `qmdestroy` läuft danach und kann scheitern. Ein „abgebaut" auf
+ *    einer stehenden Maschine ist der einzige Fehlschlag dieses Ablaufs, den
+ *    danach niemand mehr sieht.
+ *
+ * `archive_volid`/`archived_at` werden VOR dem Löschen geschrieben, nicht
+ * danach: das Archiv existiert ab Stufe 4 wirklich, und ein Absturz zwischen
+ * vier und fünf soll den bereits bezahlten Dump nicht vergessen. Genau dafür
+ * sind es zwei Zeitstempel (siehe die Wanderung der Spalten in der Migration).
+ *
+ * ## Die Ablage
+ *
+ * Der Name kommt aus der Einstellung `provisioning.proxmox.archive_storage`
+ * (Vorgabe `local`, wie sie die nächtlichen Sicherungen von `RegisterBackup`
+ * schon benutzen) UND wird gegen die Ablagen des Knotens geprüft: sie muss es
+ * geben, und sie muss `backup` tragen. Beides zusammen, weil beide Hälften
+ * allein nicht reichen — eine feste Zeichenkette wäre eine Annahme über die
+ * Einrichtung jedes Hosts, die erst beim ersten Abbau auffällt, und eine
+ * ungeprüfte Einstellung wäre dieselbe Annahme mit mehr Schritten. Fehlt die
+ * Ablage, bricht der Lauf VOR dem Herunterfahren ab, sagt im Klartext, welche
+ * Ablagen der Knoten stattdessen hat, und löscht nichts. Es wird ausdrücklich
+ * nicht geraten: eine Maschine auf eine Ablage zu sichern, die der Betreiber
+ * nicht gemeint hat, ist ein Archiv, das in zwölf Monaten niemand sucht.
+ *
+ * ## Was hier ausdrücklich NICHT passiert
+ *
+ * Nichts wirft. Dieser Ablauf läuft später in einem Zeitplan über viele
+ * Instanzen; eine geworfene Ausnahme risse die übrigen mit. Ein Fehlschlag ist
+ * `false` und ein Grund in `teardown_error` — dort, wo ein Betreiber ihn ohne
+ * Logdurchsicht findet.
+ *
+ * Das Archiv selbst wird nicht verwaltet. Die zwölf Monate Aufbewahrung und das
+ * Löschen des Dumps danach hängen an `archived_at` und gehören einem eigenen
+ * Lauf; hier wird nur festgehalten, wo das Archiv liegt.
+ *
+ * Adresse, DNS und Router werden nicht angefasst — das hat `EndInstanceService`
+ * beim Laufzeitende getan, und eine zweite Stelle, die dasselbe täte, würde
+ * beim ersten Auseinanderlaufen zur Frage, welche recht hat.
+ */
+class ArchiveAndTearDown
+{
+    /**
+     * Wie lange eine gekündigte Instanz nach dem Laufzeitende stehen bleibt.
+     *
+     * Vierzehn Tage sind die Rückfahrkarte. Ein Mensch, dessen Paket gestern
+     * ablief, überlegt es sich vielleicht gerade anders, und bis hierher ist
+     * seine Maschine unverändert da. Ab hier ist sie es nicht mehr.
+     */
+    public const GRACE_DAYS = 14;
+
+    /**
+     * Wie weit die Uhr des Hosts vorgehen darf, ohne dass ein frisches Archiv
+     * als altes gilt.
+     *
+     * `ctime` kommt von der Uhr des Proxmox-Knotens, die Startzeit dieses Laufs
+     * von der des Portals. Ohne Toleranz macht eine Sekunde Versatz aus dem
+     * gerade eben geschriebenen Dump ein „Archiv von gestern" und der Abbau
+     * bliebe für immer stehen. Fünf Minuten sind gross genug für jeden
+     * NTP-Versatz und klein genug, dass eine nächtliche Sicherung von gestern
+     * niemals hineinfällt.
+     */
+    private const CLOCK_SKEW_SECONDS = 300;
+
+    /**
+     * Wie lange auf das Herunterfahren des Gastes gewartet wird.
+     *
+     * Zehn Minuten, dieselbe Frist wie in ShutDownVirtualMachine und aus
+     * demselben Grund: eine Nextcloud, die sauber stoppt, ist in Sekunden bis
+     * wenigen Minuten fertig; was danach noch läuft, tut etwas.
+     */
+    public int $shutdownWaitSeconds = 600;
+
+    /**
+     * Wie lange auf den vzdump gewartet wird.
+     *
+     * Eine Stunde. Eine Kundenplatte von einigen hundert Gigabyte mit zstd
+     * gepackt liegt darunter; was länger braucht, hat ein Problem, das ein
+     * Betreiber ansehen soll. Öffentlich, damit ein Aufrufer (und eine Prüfung)
+     * die Grenze setzen kann, ohne die Uhr anzuhalten.
+     */
+    public int $backupWaitSeconds = 3600;
+
+    /**
+     * Wie lange auf das Zerstören der Maschine gewartet wird.
+     *
+     * Zehn Minuten. `qmdestroy` räumt jede Platte auf jeder Ablage weg; auf
+     * einem Thin-LVM sind das Sekunden, auf einer Verzeichnisablage mit einer
+     * grossen qcow2 Minuten, und eine Ablage, die gerade eine fremde nächtliche
+     * Sicherung schreibt, ist träge. Was danach noch läuft, hakt — und dann
+     * bleibt die Instanz lieber ohne `torn_down_at` stehen, damit der nächste
+     * Lauf erneut nachsieht.
+     */
+    public int $deleteWaitSeconds = 600;
+
+    /** Abstand zwischen zwei Nachfragen nach einem laufenden Auftrag. */
+    public int $pollSeconds = 15;
+
+    public function __construct(private ProxmoxClient $pve) {}
+
+    /**
+     * Ist diese Instanz wirklich fällig?
+     *
+     * Die Regel steht hier und nicht in der Abfrage des Zeitplans, damit die
+     * Auswahl und der Abbau dieselbe Frage stellen — zwei Fassungen von „ist
+     * es soweit" sind der Weg, auf dem die eine irgendwann einen Tag früher
+     * antwortet als die andere.
+     *
+     * `status === 'ended'` und nicht `cancellation_scheduled`: erst
+     * `EndInstanceService` setzt diesen Zustand, und er setzt ihn genau dann,
+     * wenn die Adresse schon weg ist. Eine Instanz ohne `service_ends_at` ist
+     * ein kaputter und kein abgelaufener Datensatz — ein geratenes Enddatum
+     * wäre genau der Zeitpunkt, den diese Frist schützen soll.
+     */
+    public function isDue(Instance $instance, ?Carbon $at = null): bool
+    {
+        return $instance->status === 'ended'
+            && $instance->torn_down_at === null
+            && $instance->service_ends_at !== null
+            && $instance->service_ends_at->lessThan(($at ?? now())->copy()->subDays(self::GRACE_DAYS));
+    }
+
+    /**
+     * Archivieren und abbauen, oder mit einem Grund stehen bleiben.
+     *
+     * @return bool ob diese Instanz jetzt abgebaut ist (auch dann, wenn ein
+     *              früherer Lauf sie abgebaut hat)
+     */
+    public function __invoke(Instance $instance): bool
+    {
+        // Wiederholbarkeit vor allem anderen: ein zweiter Lauf nach einem
+        // Absturz darf nicht versuchen, eine Maschine zu löschen, die es nicht
+        // mehr gibt.
+        if ($instance->torn_down_at !== null) {
+            return true;
+        }
+
+        if (! $this->isDue($instance)) {
+            return false;
+        }
+
+        $lock = null;
+
+        try {
+            // Zwei Läufe über dieselbe Instanz — der Zeitplan und ein Betreiber
+            // von Hand — würden zweimal sichern und zweimal löschen; der zweite
+            // fände dabei eine Maschine vor, die der erste gerade wegnimmt.
+            // Niemand wartet auf die Sperre: wer sie nicht bekommt, hat nichts
+            // hinzuzufügen, weil der Lauf, der sie hält, dasselbe tut.
+            //
+            // Innerhalb des try, nicht davor: im Betrieb ist der Sperrspeicher
+            // Redis, und ein Redis, das gerade nicht da ist, wirft schon beim
+            // Anlegen der Sperre — vor dem try nähme dieser Wurf im Zeitplan
+            // alle übrigen Instanzen mit.
+            $lock = Cache::lock('instance-teardown:'.$instance->uuid, $this->lockSeconds());
+
+            if (! $lock->get()) {
+                return false;
+            }
+
+            return $this->tearDown($instance);
+        } catch (Throwable $e) {
+            // Keine Ausnahme entkommt: dieser Ablauf läuft im Zeitplan über
+            // viele Instanzen, und ein Wurf hier nähme die übrigen mit.
+            $this->recordFailure($instance, $e);
+
+            return false;
+        } finally {
+            try {
+                $lock?->release();
+            } catch (Throwable) {
+                // Dieselbe Verbindung wie oben und derselbe Weg nach draussen —
+                // diesmal sogar am Erfolgsfall vorbei. Eine Sperre, die sich
+                // nicht freigeben lässt, läuft von selbst ab; ein Wurf von hier
+                // machte aus einem fertigen Abbau einen gescheiterten Zeitplan.
+            }
+        }
+    }
+
+    /**
+     * Wie lange die Sperre halten muss.
+     *
+     * Der ganze Lauf, nicht nur der Dump: im schlechtesten Fall wartet er erst
+     * die Frist fürs Herunterfahren, dann die fürs Sichern und zuletzt die fürs
+     * Zerstören ab. Eine kürzere Sperre liefe ausgerechnet während des Löschens
+     * aus — also genau dann, wenn ein zweiter Lauf am meisten Schaden
+     * anrichtet. Der Zuschlag deckt die Ablagenprüfung, die Nachschau und die
+     * HTTP-Umläufe dazwischen.
+     */
+    private function lockSeconds(): int
+    {
+        return $this->shutdownWaitSeconds + $this->backupWaitSeconds + $this->deleteWaitSeconds + 600;
+    }
+
+    /**
+     * Der eigentliche Ablauf. Jeder Riegel wirft, der Aufrufer oben fängt und
+     * schreibt den Grund an den Datensatz — ein Wurf ist hier Ablaufsteuerung
+     * und verlässt die Aktion nie.
+     */
+    private function tearDown(Instance $instance): bool
+    {
+        $host = $instance->host;
+        $vmid = $instance->vmid;
+
+        if ($host === null || $vmid === null) {
+            throw new RuntimeException(
+                'Zu dieser Instanz gehört keine erreichbare Maschine mehr (Host oder VMID fehlt). '
+                .'Es wird nichts gesichert und nichts gelöscht.'
+            );
+        }
+
+        $node = (string) ($host->node ?? 'pve');
+        $pve = $this->pve->forHost($host);
+        $vmid = (int) $vmid;
+
+        // Zuerst die Ablage, und das aus zwei Gründen. Der offensichtliche: eine
+        // Instanz, deren Archiv nirgends hin kann, wird gar nicht erst
+        // angefasst. Der wichtigere: `nodeStorage()` ruft `->throw()` und ist
+        // damit das Lebenszeichen des Knotens, das der Nachtrags-Zweig
+        // darunter braucht.
+        $storage = $this->archiveStorage($pve, $node);
+
+        // Der Weg zurück aus einem Absturz zwischen Löschen und Buchen: die
+        // Maschine ist fort, das Archiv steht aber schon am Datensatz. Ohne
+        // diesen Zweig versuchte jeder weitere Lauf, einen Geist
+        // herunterzufahren, und die Instanz bliebe für immer im Fehler stehen.
+        //
+        // Zwei Bedingungen, weil `vmExists()` allein die Frage nicht beantwortet:
+        // es ist `->get(…)->successful()` OHNE `->throw()`, und Proxmox antwortet
+        // auf die Konfiguration einer nicht vorhandenen VM mit 500 — demselben
+        // Code, den ein hakender Knoten liefert (siehe `isTemplate()` im
+        // Client). „Gibt es nicht" und „ich konnte nicht fragen" sehen also
+        // gleich aus. Ein verbrieftes `archive_volid` schliesst die Maschine
+        // aus, die nie archiviert wurde; die Ablagenprüfung darüber schliesst
+        // den Knoten aus, der gerade gar nichts beantwortet. Ohne beides würde
+        // hier eine LAUFENDE Kundenmaschine als abgebaut verbucht und danach
+        // nie wieder angesehen — der Zustand entsteht im Regelbetrieb, sobald
+        // ein Lauf nach dem Sichern am Löschen scheitert.
+        if ($instance->archive_volid !== null && ! $pve->vmExists($node, $vmid)) {
+            $instance->update(['torn_down_at' => now(), 'teardown_error' => null]);
+
+            Log::warning('Abbau: die Maschine war schon fort, das Archiv stand bereits fest.', [
+                'instance' => $instance->uuid,
+                'vmid' => $vmid,
+                'archive_volid' => $instance->archive_volid,
+            ]);
+
+            return true;
+        }
+
+        // Erst fragen, dann bitten — derselbe Riegel, den der Nachbarschritt
+        // `ShutDownVirtualMachine` seit jeher hat, und auf den sich der
+        // Kopfkommentar dieser Klasse beruft.
+        //
+        // `shutdownVm()` ruft im echten Client `->throw()`, und eine bereits
+        // stehende Maschine ist hier kein Rand, sondern ein gewöhnlicher
+        // Eingangszustand. Zwei Wege führen darauf:
+        //
+        // 1. Wegen offener Zahlung gesperrt. `SuspendInstance` fährt herunter
+        //    und lässt sie so stehen; kündigt dieser Kunde, ist der Gast beim
+        //    ERSTEN Abbauversuch seit Wochen gestoppt.
+        // 2. Wiederholung nach Teilfehlschlag. Jeder Fehlschlag ab dem Sichern
+        //    lässt die Maschine angehalten stehen — `mode=stop` startet sie
+        //    nicht wieder. In der nächsten Nacht ist das Herunterfahren die
+        //    erste Stufe und trifft einen gestoppten Gast.
+        //
+        // Ohne den Riegel wäre so eine Instanz unheilbar: jede Nacht derselbe
+        // Wurf, und der neue Grund (ein nacktes „HTTP request returned status
+        // code 500") überschriebe den echten, der noch am Datensatz stand.
+        if (($pve->vmStatus($node, $vmid)['status'] ?? '') === 'running') {
+            $shutdownUpid = $pve->shutdownVm($node, $vmid, $this->shutdownWaitSeconds);
+            $this->awaitTask($pve, $node, $shutdownUpid, $this->shutdownWaitSeconds, 'Das Herunterfahren');
+
+            // Die Auftragskennung ist keine Zusage. Ein Gast, der ACPI
+            // ignoriert, lässt den Auftrag auslaufen und läuft weiter —
+            // gesichert wird eine laufende Datenbank hier nicht, und gelöscht
+            // schon gar nicht.
+            if (($pve->vmStatus($node, $vmid)['status'] ?? '') === 'running') {
+                throw new RuntimeException(
+                    'Der Gast läuft nach der Bitte zum Herunterfahren weiter. Es wird nichts gesichert '
+                    .'und nichts gelöscht; die Maschine wird bewusst nicht hart ausgeschaltet.'
+                );
+            }
+        }
+
+        // Vor dem Dump abgelesen, nicht danach: die Zeit ist die Grenze, an der
+        // sich später „mein Archiv" von „das von gestern Nacht" unterscheidet.
+        $begonnen = now();
+
+        $backupUpid = $pve->backupNow($node, $vmid, $storage);
+        $this->awaitTask($pve, $node, $backupUpid, $this->backupWaitSeconds, 'Die Sicherung');
+
+        $volid = $this->verifiedArchive($pve, $node, $vmid, $storage, $begonnen);
+
+        // Das Archiv ist eine Tatsache, sobald es daliegt — festgehalten, bevor
+        // gelöscht wird.
+        $instance->update(['archive_volid' => $volid, 'archived_at' => now()]);
+
+        // Zwischen Sichern und Löschen liegen Minuten. Was in dieser Zeit an der
+        // Instanz passiert ist, entscheidet: eine wiederbelebte Instanz
+        // (`status` nicht mehr `ended`) ist keine, die gelöscht werden darf.
+        // Der Sperre ist dabei nicht zu trauen — sie hält nur andere LÄUFE ab,
+        // nicht einen Menschen in der Konsole.
+        $frisch = $instance->fresh();
+
+        if ($frisch === null || $frisch->torn_down_at !== null || $frisch->status !== 'ended') {
+            throw new RuntimeException(
+                'Die Instanz hat sich während der Sicherung geändert (Zustand "'
+                .($frisch?->status ?? 'gelöscht').'"). Das Archiv liegt und ist vermerkt, '
+                .'gelöscht wird die Maschine nicht.'
+            );
+        }
+
+        // Die eine unumkehrbare Stufe — und die einzige, die bis hierher einer
+        // Auftragskennung glaubte.
+        //
+        // `DELETE /nodes/…/qemu/…` prüft synchron nur Schutzflagge und
+        // HA-Verwendung, forkt dann `qmdestroy` und antwortet mit 200. Die
+        // Sperre, `check_running` und jede Platte auf jeder Ablage kommen
+        // danach und können scheitern. Wer den Abbau auf das 200 bucht, hat im
+        // schlimmsten Fall eine stehende Maschine mit einem Datensatz, der
+        // „abgebaut" sagt: der nächtliche Befehl filtert `torn_down_at` und
+        // sieht sie nie wieder, kein Kasten zeigt sie, niemand sieht sie je
+        // wieder an. Deshalb dasselbe Warten wie beim Herunterfahren und beim
+        // Sichern — ausgerechnet hier hatte es gefehlt.
+        $destroyUpid = $pve->deleteVm($node, $vmid);
+        $this->awaitTask($pve, $node, $destroyUpid, $this->deleteWaitSeconds, 'Das Löschen');
+
+        $instance->update(['torn_down_at' => now(), 'teardown_error' => null]);
+
+        Log::info('Gekündigte Instanz archiviert und abgebaut.', [
+            'instance' => $instance->uuid,
+            'vmid' => $vmid,
+            'node' => $node,
+            'archive_volid' => $volid,
+            'service_ended_at' => $instance->service_ends_at?->toIso8601String(),
+        ]);
+
+        return true;
+    }
+
+    /**
+     * Welche Ablage das Archiv trägt — als Name aus der Einstellung und als
+     * geprüfte Tatsache auf dem Knoten.
+     */
+    private function archiveStorage(ProxmoxClient $pve, string $node): string
+    {
+        $name = (string) config('provisioning.proxmox.archive_storage', 'local');
+
+        $vorhanden = collect($pve->nodeStorage($node));
+        $treffer = $vorhanden->firstWhere('storage', $name);
+
+        if ($treffer === null) {
+            throw new RuntimeException(
+                'Die Ablage "'.$name.'" gibt es auf dem Knoten '.$node.' nicht (vorhanden: '
+                .($vorhanden->pluck('storage')->filter()->implode(', ') ?: 'keine')
+                .'). Ohne Ziel für das Archiv wird nichts gelöscht.'
+            );
+        }
+
+        // `content` zählt auf, was eine Ablage überhaupt aufnehmen darf. Eine
+        // Ablage ohne `backup` nimmt den Dump nicht an — das fiele sonst erst
+        // beim vzdump auf, mit einer heruntergefahrenen Kundenmaschine daneben.
+        if (! in_array('backup', explode(',', (string) ($treffer['content'] ?? '')), true)) {
+            throw new RuntimeException(
+                'Die Ablage "'.$name.'" auf dem Knoten '.$node.' nimmt keine Sicherungen auf (content: "'
+                .((string) ($treffer['content'] ?? '')).'"). Es wird nichts gelöscht.'
+            );
+        }
+
+        return $name;
+    }
+
+    /**
+     * Auf einen Proxmox-Auftrag warten, bis er wirklich fertig ist.
+     *
+     * `shutdownVm()`, `backupNow()` und `deleteVm()` liefern alle drei nur eine
+     * Kennung; die Arbeit läuft danach. Ein Aufrufer, der sofort weiterliest,
+     * sieht den Zustand von vorher — beim Herunterfahren eine laufende
+     * Maschine, beim Sichern eine Ablage ohne das Archiv, das gerade
+     * geschrieben wird, und beim Löschen eine Platte, die noch daliegt.
+     */
+    private function awaitTask(ProxmoxClient $pve, string $node, string $upid, int $waitSeconds, string $was): void
+    {
+        $frist = now()->addSeconds($waitSeconds);
+
+        while (true) {
+            $status = $pve->taskStatus($node, $upid);
+
+            if (($status['status'] ?? '') !== 'running') {
+                $ende = (string) ($status['exitstatus'] ?? 'OK');
+
+                // Proxmox beendet einen vzdump auch dann mit "WARNINGS: n", wenn
+                // das Archiv sauber geschrieben wurde (eine übersprungene Platte,
+                // ein Hinweis aus dem Gast). Das als Fehlschlag zu lesen liesse
+                // den Abbau an einer Meldung hängen, die kein Archiv verhindert —
+                // und der Beweis, auf den es ankommt, ist ohnehin die Nachschau
+                // auf der Ablage, nicht diese Zeichenkette.
+                if ($ende !== 'OK' && ! str_starts_with($ende, 'WARNINGS')) {
+                    throw new RuntimeException($was.' endete mit "'.$ende.'". Es wird nichts gelöscht.');
+                }
+
+                if ($ende !== 'OK') {
+                    Log::warning('Abbau: Proxmox-Auftrag mit Hinweisen beendet.', [
+                        'node' => $node,
+                        'upid' => $upid,
+                        'exitstatus' => $ende,
+                    ]);
+                }
+
+                return;
+            }
+
+            if (now()->greaterThanOrEqualTo($frist)) {
+                throw new RuntimeException(
+                    $was.' lief nach '.$waitSeconds.' Sekunden noch. Es wird nichts gelöscht; '
+                    .'der nächste Lauf sieht erneut nach.'
+                );
+            }
+
+            Sleep::for($this->pollSeconds)->seconds();
+        }
+    }
+
+    /**
+     * Nachsehen, was wirklich auf der Ablage liegt — der Riegel, an dem alles
+     * hängt.
+     *
+     * @return string die Kennung des Archivs (volid)
+     */
+    private function verifiedArchive(ProxmoxClient $pve, string $node, int $vmid, string $storage, Carbon $begonnen): string
+    {
+        $eintraege = $pve->backupsFor($node, $vmid, $storage);
+
+        if ($eintraege === []) {
+            throw new RuntimeException(
+                'Nach der Sicherung liegt auf der Ablage "'.$storage.'" kein Archiv für VM '.$vmid.'. '
+                .'Die Maschine bleibt stehen und wird nicht gelöscht.'
+            );
+        }
+
+        /** @var array<string, mixed> $juengstes */
+        $juengstes = collect($eintraege)->sortBy(fn (array $e) => (int) ($e['ctime'] ?? 0))->last();
+
+        $ctime = $juengstes['ctime'] ?? null;
+
+        if ($ctime === null) {
+            // Ohne `ctime` ist das Alter eines Archivs nicht feststellbar. Ein
+            // EINZELNER solcher Eintrag wird angenommen statt abgelehnt: es
+            // liegt ein Archiv dieser VM da, und der Fall, den diese Aktion zu
+            // verhindern hat, ist das Löschen ohne jedes Archiv.
+            //
+            // MEHRERE dagegen nicht. Auf `local` liegen neben dem frischen Dump
+            // die nächtlichen Sicherungen derselben VM; ohne Zeitpunkt lassen
+            // sie sich nicht ordnen, und vermerkt würde irgendeiner davon —
+            // womöglich der von vorgestern. Eine Reihe, die sich nicht sortieren
+            // lässt, ist keine Grundlage für ein Löschen.
+            if (count($eintraege) > 1) {
+                throw new RuntimeException(
+                    'Auf "'.$storage.'" liegen '.count($eintraege).' Archive für VM '.$vmid
+                    .', und keines nennt einen Zeitpunkt. Welches davon die Sicherung dieses Laufes '
+                    .'ist, lässt sich nicht sagen; es wird nichts gelöscht.'
+                );
+            }
+
+            Log::warning('Abbau: das Archiv nennt keinen Zeitpunkt, sein Alter ist ungeprüft.', [
+                'vmid' => $vmid,
+                'storage' => $storage,
+            ]);
+        } elseif ((int) $ctime < $begonnen->getTimestamp() - self::CLOCK_SKEW_SECONDS) {
+            // Der Fall, den die reine Ja/Nein-Frage „liegt da etwas?" durchlässt:
+            // die nächtliche Sicherung von gestern. Gegen sie zu löschen hiesse,
+            // ein Archiv aufzubewahren, dem der letzte Tag fehlt — und niemand
+            // würde es je merken.
+            throw new RuntimeException(
+                'Das jüngste Archiv für VM '.$vmid.' auf "'.$storage.'" stammt vom '
+                .Carbon::createFromTimestamp((int) $ctime)->toIso8601String()
+                .' und damit von vor diesem Lauf. Die Sicherung dieses Laufs ist nicht auffindbar; '
+                .'es wird nichts gelöscht.'
+            );
+        }
+
+        $volid = (string) ($juengstes['volid'] ?? '');
+
+        if ($volid === '') {
+            throw new RuntimeException(
+                'Das Archiv für VM '.$vmid.' auf "'.$storage.'" hat keine Kennung (volid). '
+                .'Ein Archiv, dessen Ort nicht notiert werden kann, ist in zwölf Monaten keins — '
+                .'es wird nichts gelöscht.'
+            );
+        }
+
+        return $volid;
+    }
+
+    /**
+     * Der Grund gehört an den Datensatz, wo ein Betreiber ihn ohne
+     * Logdurchsicht findet.
+     *
+     * Beide Schritte einzeln abgesichert, und das ist kein Zierrat: diese
+     * Methode läuft IM `catch`. Ein Wurf von hier — eine Datenbank, die gerade
+     * nicht schreibt — ersetzte den gefangenen Fehlschlag und käme doch nach
+     * draussen, wo er im Zeitplan die übrigen Instanzen mitrisse.
+     */
+    private function recordFailure(Instance $instance, Throwable $e): void
+    {
+        try {
+            $instance->update(['teardown_error' => $e->getMessage()]);
+        } catch (Throwable) {
+            // Der Grund liess sich nicht vermerken. Mehr als der Eintrag unten
+            // geht dann nicht — und gelöscht hat dieser Lauf ohnehin nichts.
+        }
+
+        try {
+            Log::error('Abbau einer gekündigten Instanz gestoppt.', [
+                'instance' => $instance->uuid,
+                'vmid' => $instance->vmid,
+                'reason' => $e->getMessage(),
+            ]);
+        } catch (Throwable) {
+            // Auch das Protokoll ist nicht erreichbar. Dann schweigt dieser
+            // eine Lauf, statt den ganzen Zeitplan mitzunehmen.
+        }
+    }
+}

app/Actions/BookAddon.php

@@ -0,0 +1,498 @@
+<?php
+
+namespace App\Actions;
+
+use App\Models\Order;
+use App\Models\Subscription;
+use App\Models\SubscriptionAddon;
+use App\Models\SubscriptionRecord;
+use App\Services\Billing\AddonCatalogue;
+use App\Services\Billing\CustomDomainAccess;
+use Illuminate\Database\UniqueConstraintViolationException;
+use Illuminate\Support\Facades\DB;
+use RuntimeException;
+
+/**
+ * Books a module onto a contract at today's price, and freezes it there.
+ *
+ * Booking is the moment the module's price stops moving for this customer, for
+ * exactly the reason the plan's price does: they agreed to a figure. What they
+ * have NOT booked stays on the live catalogue — that is a sale still to be
+ * made, at whatever it costs now.
+ *
+ * It is also the one place that decides a module may not be booked at all. Two
+ * rules live here rather than in the pages that call it, because a rule enforced
+ * in markup is not enforced: not every package may have an own domain, and not
+ * every module may be held twice. Both fail closed, with the sentence the
+ * customer would be shown rather than a developer's, so whatever refuses —
+ * the portal, the console's grant screen, a webhook — says the same thing.
+ *
+ * It is also where a booking stops being only a row. Storage packs are the one
+ * module that changes what the machine has to be, and they were sold for months
+ * without anything anywhere acting on them — so booking or cancelling one asks
+ * ApplyStorageAllowance for the run that makes the disk, the guest's filesystem
+ * and Nextcloud's quota match what the customer now pays for. Every route into a
+ * booking goes through here — the shop, a webhook, an operator's grant — which
+ * is why the delivery hangs off this action and not off any one of them.
+ *
+ * `$overrides` exists for GrantAddon: a granted module is booked through this
+ * same action, with its price replaced by what the customer actually pays and
+ * its provenance stamped on the row. Empty for every ordinary booking. A grant
+ * is a booking like any other, so it is refused on the same terms — giving away
+ * a module the customer is already paying for would bill them for both.
+ *
+ * It is also where a booking becomes MONEY, every month, and not only in the
+ * month it was made. A module is an item on the Stripe subscription, so booking
+ * one adds it and cancelling one takes it off — see
+ * App\Actions\SyncStripeAddonItems, which is asked to bring the two into step
+ * after every change here. Like the storage delivery beside it, it never fails a
+ * booking: what it could not tell Stripe is parked on the contract and retried.
+ *
+ * Was hier bewusst NICHT gefragt wird: AddonCatalogue::saleRefusal() — ob ein
+ * Modul überhaupt im Verkauf ist, unabhängig vom Paket. Das ist eine Frage an
+ * einen KUNDEN, der die Preistafel oder die Abrechnungsseite liest, und die
+ * wird dort gestellt (App\Http\Controllers\LandingController,
+ * App\Livewire\Billing::purchase()) — nicht hier. Ein Bestandsfall bleibt
+ * buchbar, und ein Geschenk des Betreibers (App\Actions\GrantAddon, das über
+ * diese Aktion bucht) bleibt möglich, auch für ein Modul, das gerade nicht
+ * verkauft wird — beides ist kein Verkauf an einen Kunden, der die Preistafel
+ * liest.
+ */
+class BookAddon
+{
+    public function __construct(private RecordCommercialEvent $record) {}
+
+    /** @param  array<string, mixed>  $overrides */
+    public function __invoke(Subscription $subscription, string $addonKey, int $quantity = 1, ?Order $order = null, array $overrides = []): SubscriptionAddon
+    {
+        $price = app(AddonCatalogue::class)->priceCents($addonKey);
+
+        if ($price === null) {
+            throw new RuntimeException("Unknown add-on: {$addonKey}");
+        }
+
+        if ($quantity < 1) {
+            throw new RuntimeException('An add-on is booked at least once.');
+        }
+
+        // Not every module is for sale to everyone. The own domain is possible
+        // on some packages, included in others and impossible on the smallest,
+        // and the portal already leaves it out where it cannot be booked — but
+        // a hidden button is markup, and a rule enforced only in markup is not
+        // enforced. A stale tab, a second window or anything that can name this
+        // action arrives here too, so it fails closed, with the sentence the
+        // customer would be shown rather than a developer's.
+        $refusal = $addonKey === CustomDomainAccess::ADDON
+            ? app(CustomDomainAccess::class)->bookingRefusal($subscription)
+            : null;
+
+        if ($refusal !== null) {
+            throw new RuntimeException($refusal);
+        }
+
+        // Nicht jedes Paket kennt jedes Modul. Enterprise verkauft eine eigene
+        // Maschine, und ein 20-GB-Block ist darauf keine Antwort — dieselbe
+        // Prüfung, die GrantAddon über diese Aktion ebenfalls durchläuft, denn
+        // ein Geschenk ist eine Buchung wie jede andere.
+        $closed = app(AddonCatalogue::class)->availabilityRefusal($subscription, $addonKey);
+
+        if ($closed !== null) {
+            throw new RuntimeException($closed);
+        }
+
+        try {
+            $addon = $this->book($subscription, $addonKey, $quantity, $order, $price, $overrides);
+        } catch (UniqueConstraintViolationException) {
+            // A concurrent retry won. The unique index on (order_id, addon_key)
+            // is what actually enforces "one order books one module" — the
+            // lookup below is only the fast path, and two transactions can both
+            // pass it.
+            $addon = SubscriptionAddon::query()
+                ->where('order_id', $order?->id)
+                ->where('addon_key', $addonKey)
+                ->firstOrFail();
+        }
+
+        $this->deliverStorage($subscription, $addonKey);
+        $this->billThroughStripe($subscription);
+
+        return $addon;
+    }
+
+    /** @param  array<string, mixed>  $overrides */
+    private function book(Subscription $subscription, string $addonKey, int $quantity, ?Order $order, int $price, array $overrides = []): SubscriptionAddon
+    {
+        // The booking and its entry in the register commit together: if the
+        // record could fail afterwards, retrying the same order would find the
+        // add-on already there and skip the event for good.
+        return DB::transaction(function () use ($subscription, $addonKey, $quantity, $order, $price, $overrides) {
+            $catalogue = app(AddonCatalogue::class);
+
+            // Held while we look and write, for the same reason the shop holds
+            // the customer row: two bookings in flight would otherwise both
+            // find the old state and both write. ONE lock, taken for both
+            // reasons a booking can be refused on what the contract already
+            // holds — taking a second one further down would be a second wait
+            // for a row this transaction is already holding, and the two could
+            // only ever be taken in the wrong order.
+            //
+            // A module of which there may be one: the short-circuit and
+            // duplicateRefusal() below are read-then-write, and two clicks
+            // would both find nothing booked and both book.
+            //
+            // A CAPPED module: a second storage pack is meant to succeed, so
+            // this is deliberately not about serialising the booking — it is
+            // about the count below. Without the lock two different storage
+            // ORDERS near the cap both read the old total and both insert, and
+            // the unique index on (order_id, addon_key) never sees it: two
+            // orders are two different rows. That is a contract over the cap,
+            // written by two ordinary purchases.
+            //
+            // A module with neither property is left unlocked; there is
+            // nothing here that two of them could get wrong.
+            if ($catalogue->isEntitlement($addonKey) || $catalogue->maxQuantity($addonKey) !== null) {
+                Subscription::query()->whereKey($subscription->getKey())->lockForUpdate()->first();
+            }
+
+            // Idempotent against a retried webhook: one order books one module.
+            if ($order !== null) {
+                $existing = SubscriptionAddon::query()
+                    ->where('order_id', $order->id)
+                    ->where('addon_key', $addonKey)
+                    ->first();
+
+                if ($existing !== null) {
+                    return $existing;
+                }
+            }
+
+            // Der Deckel, an der Stelle, die ihn halten muss. Gezählt wird über
+            // ALLE laufenden Buchungen dieses Moduls, nicht je Buchung: drei
+            // Bestellungen à einem Block sind drei Blöcke, und eine Prüfung je
+            // Bestellung hätte jede einzeln durchgewinkt.
+            //
+            // HIER und nicht in __invoke(): gezählt werden darf erst unter der
+            // Sperre oben, sonst lesen zwei gleichzeitige Bestellungen
+            // denselben alten Stand und fügen beide ein — der eindeutige Index
+            // über (order_id, addon_key) fängt das nicht, weil es zwei
+            // verschiedene Bestellungen sind.
+            //
+            // Und wie die Kapazitätsprüfung darunter ABSICHTLICH hinter dem
+            // Kurzschluss: ein zweites Mal zugestellter Webhook bekommt seine
+            // bestehende Buchung zurück, statt gefragt zu werden, ob NOCH ein
+            // Block passt — es kommt ja keiner hinzu. Davor gefragt, hätte die
+            // Wiederholung ausgerechnet die Buchung abgelehnt, die den Deckel
+            // gerade ausgefüllt hat, also jede Buchung des letzten Blocks.
+            $overLimit = $catalogue->quantityRefusal($subscription, $addonKey, $quantity);
+
+            if ($overLimit !== null) {
+                throw new RuntimeException($overLimit);
+            }
+
+            // Platz auf DIESER Maschine, nicht irgendwo im Bestand: eine laufende
+            // Instanz zieht nicht um. Dünn belegter Speicher lässt eine
+            // Überbuchung sofort gelingen und erst auffallen, wenn die Gäste
+            // wirklich schreiben — also unter zahlenden Kunden.
+            //
+            // Ohne Maschine wird nicht gefragt: der Vertrag ist gerade erst
+            // geschlossen, und die Platzierung nimmt die Blöcke in
+            // ReserveResources mit auf.
+            //
+            // ABSICHTLICH hinter dem Kurzschluss oben, nicht in __invoke():
+            // ein Webhook, den Stripe ein zweites Mal zustellt, soll seine
+            // bestehende Buchung zurückbekommen, nicht erneut gefragt werden,
+            // ob NOCH ein Block passt — es kommt ja keiner hinzu. Vor dem
+            // Kurzschluss gefragt, hätte die Wiederholung genau dann geworfen,
+            // wenn der Host in der Zwischenzeit eng wurde: das Szenario, für
+            // das diese Prüfung gebaut ist, hätte ausgerechnet einen bereits
+            // bezahlten Vorgang mit einem Fehler quittiert.
+            if ($addonKey === AddonCatalogue::STORAGE) {
+                $host = $subscription->instance?->host;
+                $needs = $catalogue->packDiskGb() * $quantity;
+
+                if ($host !== null && ! $host->canTake($needs)) {
+                    throw new RuntimeException(__('billing.storage_no_room'));
+                }
+            }
+
+            // Asked AFTER the retry above, so a webhook delivered twice still
+            // gets its one booking back rather than an error: that is the same
+            // order arriving again, not a second purchase. What is refused here
+            // is a SECOND order for a module the contract already carries — a
+            // stale tab, a double click, an operator granting something the
+            // customer has bought. The unique index on (order_id, addon_key)
+            // never saw those: two orders are two different rows.
+            $refusal = $catalogue->duplicateRefusal($subscription, $addonKey);
+
+            if ($refusal !== null) {
+                throw new RuntimeException($refusal);
+            }
+
+            $addon = SubscriptionAddon::create(array_merge([
+                'subscription_id' => $subscription->id,
+                'order_id' => $order?->id,
+                'addon_key' => $addonKey,
+                'price_cents' => $price,
+                'currency' => Subscription::catalogueCurrency(),
+                'quantity' => $quantity,
+                'booked_at' => now(),
+                // What this pack weighs, at the moment of purchase. Without
+                // these two figures the size would be a view again.
+                'pack_gb' => $addonKey === AddonCatalogue::STORAGE ? $catalogue->packGb() : 0,
+                'pack_disk_gb' => $addonKey === AddonCatalogue::STORAGE ? $catalogue->packDiskGb() : 0,
+            ], $overrides));
+
+            ($this->record)(
+                event: SubscriptionRecord::EVENT_ADDON_BOOKED,
+                subscription: $subscription,
+                netCents: $addon->monthlyCents(),
+                extra: ['addon' => ['key' => $addonKey, 'quantity' => $quantity, 'price_cents' => $addon->price_cents]],
+                order: $order,
+                stripe: ['event' => $order?->stripe_event_id],
+                // What was actually charged for the module, on the same terms
+                // as a plan purchase: a discount or a free booking has to be
+                // reconcilable, not reconstructed from the catalogue.
+                chargedGrossCents: $order?->stripe_event_id !== null ? (int) $order->amount_cents : null,
+            );
+
+            return $addon;
+        });
+    }
+
+    /**
+     * Book the end of a module for the end of the term it is paid up to.
+     *
+     * The owner's rule for a module is the same as for a package: what has been
+     * paid for is kept. A customer cancelling on the tenth keeps the module
+     * until the cycle turns and gets no credit for the days they did not use —
+     * so the row stays active, `cancels_at` holds the appointment, and
+     * clupilot:end-cancelled-addons keeps it.
+     *
+     * Stripe is told at once all the same. Its item is only ever about what the
+     * NEXT cycle bills — the term in progress was paid in advance — and taking
+     * the item off with no proration moves no money while making sure the next
+     * invoice has no such line. Waiting for the boundary instead would be a race
+     * against Stripe raising that very invoice; see SyncStripeAddonItems.
+     *
+     * Ends the module outright when there is no term to wait for — a contract
+     * with no period end, or one that is already past. There is nothing to keep.
+     */
+    public function cancelAtPeriodEnd(SubscriptionAddon $addon): SubscriptionAddon
+    {
+        $subscription = $addon->subscription;
+        $endsOn = $subscription?->current_period_end;
+
+        if ($endsOn === null || $endsOn->isPast()) {
+            return $this->cancel($addon);
+        }
+
+        // Claimed conditionally, like the cancellation below: two requests
+        // arriving together would otherwise both write an appointment, and the
+        // second would move a date the customer had already been told.
+        $claimed = SubscriptionAddon::query()
+            ->whereKey($addon->getKey())
+            ->whereNull('cancelled_at')
+            ->whereNull('cancels_at')
+            ->update(['cancels_at' => $endsOn, 'updated_at' => now()]);
+
+        $addon->refresh();
+
+        if ($claimed === 0) {
+            return $addon;
+        }
+
+        $this->billThroughStripe($subscription);
+
+        return $addon;
+    }
+
+    /**
+     * Take back a cancellation that has not landed yet.
+     *
+     * The customer changed their mind again, which is allowed right up to the
+     * moment the appointment is kept: until then the module is still running and
+     * still theirs, and nothing has been undone that would have to be rebuilt.
+     * After it — `cancelled_at` set — this refuses, because the module has
+     * genuinely stopped and putting it back is a new booking at today's price.
+     *
+     * Claimed conditionally like the cancellation it undoes, so two clicks write
+     * one answer between them.
+     *
+     * **Nothing is charged for it.** The term this module was cancelled for was
+     * paid for in advance and the cancellation raised no credit — that is the
+     * owner's rule — so putting the item back must not raise a charge either.
+     * Left to its own devices the reconciler would add it with
+     * `always_invoice`, which is right for a module being bought in the middle
+     * of a term and wrong here: the customer would be billed a second time for
+     * days they have already paid for. So the reconciler is told, in the one
+     * place where the difference is known, that this addition is a restoration
+     * and not a sale.
+     */
+    public function undoCancelAtPeriodEnd(SubscriptionAddon $addon): SubscriptionAddon
+    {
+        $claimed = SubscriptionAddon::query()
+            ->whereKey($addon->getKey())
+            ->whereNull('cancelled_at')
+            ->whereNotNull('cancels_at')
+            ->update(['cancels_at' => null, 'updated_at' => now()]);
+
+        $addon->refresh();
+
+        if ($claimed === 0) {
+            return $addon;
+        }
+
+        $subscription = $addon->subscription;
+
+        if ($subscription !== null) {
+            app(SyncStripeAddonItems::class)($subscription->refresh(), chargeForAdditions: false);
+        }
+
+        return $addon;
+    }
+
+    /**
+     * Stop charging for a module now, without losing what it cost.
+     *
+     * Cancelled, not deleted: what a customer was paying, and until when, is
+     * part of the same record as what they bought.
+     *
+     * This is the immediate end, and it is not what a customer's own
+     * cancellation does — see cancelAtPeriodEnd() above. It is what happens when
+     * a module stops being POSSIBLE rather than wanted: a downgrade onto a
+     * package that cannot have an own domain takes the module with it, and
+     * leaving the customer billed for a feature that has already gone is a
+     * complaint we would deserve. It is also the appointment being kept, once
+     * cancelAtPeriodEnd()'s date has passed.
+     */
+    public function cancel(SubscriptionAddon $addon): SubscriptionAddon
+    {
+        $cancelled = DB::transaction(function () use ($addon) {
+            // Claim the cancellation conditionally, so two requests arriving
+            // together write one event between them. Checking `isActive()` on
+            // separate instances and updating afterwards lets both through, and
+            // the register would show a module cancelled twice.
+            $claimed = SubscriptionAddon::query()
+                ->whereKey($addon->getKey())
+                ->whereNull('cancelled_at')
+                ->update(['cancelled_at' => now(), 'updated_at' => now()]);
+
+            if ($claimed === 0) {
+                return $addon->refresh();
+            }
+
+            $addon->refresh();
+
+            ($this->record)(
+                event: SubscriptionRecord::EVENT_ADDON_CANCELLED,
+                subscription: $addon->subscription,
+                netCents: -$addon->monthlyCents(),
+                extra: ['addon' => ['key' => $addon->addon_key, 'quantity' => $addon->quantity]],
+                order: $addon->order,
+            );
+
+            return $addon;
+        });
+
+        $this->deliverStorage($cancelled->subscription, (string) $cancelled->addon_key);
+        $this->settleCustomDomain($cancelled->subscription, (string) $cancelled->addon_key);
+        $this->billThroughStripe($cancelled->subscription);
+
+        return $cancelled;
+    }
+
+    /**
+     * Eine eigene Domain, die niemand mehr bezahlt, wirklich von der Maschine
+     * nehmen.
+     *
+     * Das Gegenstück zu deliverStorage(): dort wird aus einem Paket
+     * Plattenplatz, hier hört eine Adresse auf, eine zu sein. Solange nur die
+     * Zeile in `subscription_addons` gekündigt war, nannte Traefik den Namen
+     * weiter und Nextcloud vertraute ihm weiter — der Kunde zahlte nicht mehr
+     * und bekam die Leistung trotzdem, und legte er die Domain später woanders
+     * hin, zeigte unser Host weiter darauf.
+     *
+     * Der Paketwechsel hatte diesen Griff längst (PlanChange::settleCustomDomain
+     * über CustomDomainAccess::enforce()). Die Kündigung des Moduls selbst hatte
+     * ihn nicht — und das ist der zweite, häufigere Weg, auf dem das Recht auf
+     * eine eigene Domain verfällt: der Kunde bucht sie in der Abrechnung ab,
+     * clupilot:end-cancelled-addons hält den Termin am Ende des bezahlten
+     * Zeitraums, und danach fragte niemand mehr nach der Adresse.
+     *
+     * Gefragt wird hier nicht „war das die Domain?", sondern die ganze Regel:
+     * enforce() lässt alles stehen, solange der Vertrag die Domain nach dieser
+     * Kündigung immer noch trägt. Ein Kunde, der von Team auf Business
+     * aufgestuft hat und sein altes Modul loswird, verliert nichts, weil das
+     * Paket sie jetzt selbst enthält — ein blindes Abräumen an dieser Stelle
+     * würde ihm die Adresse nehmen, für die er weiter bezahlt.
+     *
+     * enforce() kündigt seinerseits noch laufende Buchungen desselben Moduls
+     * durch genau diese Aktion. Das ist nur erreichbar, wenn ein Vertrag mehr
+     * als eine hält (was die Buchungssperre verhindert), und jede Runde kündigt
+     * eine davon — es endet also, und zwar nach der ersten.
+     *
+     * Nach der Transaktion und aus demselben Grund wie die beiden Nachbarn: den
+     * Lauf, den enforce() anstösst, nimmt ein Arbeiter in einem anderen Prozess
+     * auf, und einer, der zuerst da wäre, läse die Buchung so, wie sie einen
+     * Moment vorher war.
+     */
+    private function settleCustomDomain(?Subscription $subscription, string $addonKey): void
+    {
+        if ($addonKey !== CustomDomainAccess::ADDON || $subscription === null) {
+            return;
+        }
+
+        app(CustomDomainAccess::class)->enforce($subscription->refresh());
+    }
+
+    /**
+     * Make a change to the storage packs real on the machine.
+     *
+     * Storage is the one module whose booking changes what the machine has to
+     * BE: a pack is a hundred gigabytes the disk, the guest's filesystem and
+     * Nextcloud's quota all have to grow to, and cancelling one is the same
+     * sentence read backwards. Every other module is a licence, a support tier
+     * or a flag — nothing on the machine moves when one is booked. Die eigene
+     * Domain ist die eine Ausnahme in der Gegenrichtung: gebucht ändert sie
+     * nichts, gekündigt schon — siehe settleCustomDomain() unten.
+     *
+     * Deliberately AFTER the transaction has committed, never inside it. The run
+     * this starts is picked up by a queue worker in another process, and a
+     * worker that arrived first would read a contract whose booking had not been
+     * written yet — and would then deliver the allowance as it was a moment ago.
+     *
+     * Nothing here fails a booking. ApplyStorageAllowance returns null for every
+     * ordinary "not now" — no machine, one still being built, a run already in
+     * flight — and that run applies the same allowance when it gets there.
+     */
+    private function deliverStorage(?Subscription $subscription, string $addonKey): void
+    {
+        if ($addonKey !== AddonCatalogue::STORAGE) {
+            return;
+        }
+
+        app(ApplyStorageAllowance::class)($subscription);
+    }
+
+    /**
+     * Put what the contract now holds in front of Stripe.
+     *
+     * After the transaction for the same reason the storage delivery is: the
+     * reconciler reads the bookings back out of the database, and one running
+     * inside the transaction that wrote them would settle on the state as it was
+     * a moment ago.
+     *
+     * Nothing here fails a booking either. The module has been booked and, if it
+     * was storage, already delivered to the machine; Stripe being unreachable
+     * parks the difference on the contract and clupilot:sync-stripe-subscriptions
+     * finishes it.
+     */
+    private function billThroughStripe(?Subscription $subscription): void
+    {
+        if ($subscription === null) {
+            return;
+        }
+
+        app(SyncStripeAddonItems::class)($subscription->refresh());
+    }
+}

app/Actions/EndInstanceService.php

@@ -0,0 +1,136 @@
+<?php
+
+namespace App\Actions;
+
+use App\Models\Instance;
+use App\Services\Dns\HetznerDnsClient;
+use App\Services\Traefik\TraefikWriter;
+use Illuminate\Support\Carbon;
+use Illuminate\Support\Facades\Log;
+
+/**
+ * Take an instance's address down when its service has genuinely ended.
+ *
+ * `TraefikWriter::remove()` had no caller anywhere in the application. Every
+ * router this platform ever wrote was written for good: the file stayed on the
+ * serving host, the hostname kept resolving, and it kept being routed to a guest
+ * address that the host is free to hand to somebody else's VM later. That is not
+ * a tidiness problem — it is one customer's hostname pointing at another
+ * customer's Nextcloud, with a valid certificate on it.
+ *
+ * ## What "ended" means here
+ *
+ * Exactly one thing: the instance is `cancellation_scheduled` AND its
+ * `service_ends_at` has passed. Not the moment somebody cancels — a customer who
+ * schedules a cancellation on the second of the month has paid to the end of the
+ * month and must keep working through it, and pulling their address that
+ * afternoon would be a serious fault, worse than the leak this closes. Not a
+ * `failed` build either: those never got as far as a router, and the ones that
+ * did are being retried from the console. A `cancellation_scheduled` row without
+ * a `service_ends_at` at all is left alone on purpose — that is a broken record
+ * rather than an expired one, and guessing an end date for it would invent the
+ * very moment this action exists to respect.
+ *
+ * ## The DNS record goes with the route
+ *
+ * Deliberately, and for the same reason the route does. The A record for
+ * `{subdomain}.{zone}` is in OUR zone and points at the serving host's public
+ * address — a host that goes on serving other customers. Left published it is a
+ * name we own, resolving to a live machine, with nothing behind it that belongs
+ * to the person it is named after: the shape of every subdomain-takeover there
+ * has ever been. It also keeps the customer's old address looking alive, and it
+ * would collide the day the same subdomain is issued again. Removing the route
+ * without the record would leave the worse half standing.
+ *
+ * The CUSTOM domain is the opposite case and nothing is done to it. Its A record
+ * lives in the customer's own zone, which we have never had access to and never
+ * will; it is theirs, it stops reaching us the moment the router goes, and it is
+ * for them to point somewhere else.
+ *
+ * The virtual machine is NOT touched. The founder's cancellation flow promises a
+ * finished data export before deprovisioning, and destroying somebody's disks is
+ * not a decision this action gets to make on the way past. It takes the address
+ * away — which is what was leaking — and leaves the machine for whatever carries
+ * out that flow.
+ */
+class EndInstanceService
+{
+    public function __construct(
+        private TraefikWriter $traefik,
+        private HetznerDnsClient $dns,
+    ) {}
+
+    /**
+     * Has this instance's paid service actually run out?
+     *
+     * The rule lives here rather than in the command's query so that anything
+     * else that ever ends an instance asks the same question — a second copy of
+     * "is it over yet" is how one caller ends up a month out from the other.
+     */
+    public function hasEnded(Instance $instance, ?Carbon $at = null): bool
+    {
+        return $instance->status === 'cancellation_scheduled'
+            && $instance->service_ends_at !== null
+            && $instance->service_ends_at->lessThanOrEqualTo($at ?? now());
+    }
+
+    /**
+     * Tear the address down and mark the instance ended.
+     *
+     * Re-entrant: removing a router file that is not there is `rm -f`, a record
+     * id that has already been deleted is deleted again for nothing, and an
+     * instance already marked `ended` is returned false straight away. A DNS
+     * failure is deliberately not swallowed — the record id survives on its row,
+     * so a retry can finish the job, and a provider that is permanently broken
+     * becomes a visible failure rather than a silent leak.
+     *
+     * @return bool whether this call was the one that ended it
+     */
+    public function __invoke(Instance $instance): bool
+    {
+        if (! $this->hasEnded($instance)) {
+            return false;
+        }
+
+        $host = $instance->host;
+
+        if ($host !== null) {
+            // The host that actually serves the traffic — DNS points at it, and
+            // it is where ConfigureDnsAndTls wrote the file in the first place.
+            $this->traefik->remove($host->wg_ip ?? $host->public_ip, $instance->subdomain);
+        } else {
+            // No host left to reach: the router file went with the machine it
+            // lived on. Said out loud rather than passed over, because it means
+            // this teardown is only doing half of what it usually does.
+            Log::warning('Ending an instance whose host is gone — no router to remove.', [
+                'instance' => $instance->uuid,
+            ]);
+        }
+
+        foreach ($instance->dnsRecords()->get() as $record) {
+            $this->dns->deleteRecord($record->record_id);
+            $record->delete();
+        }
+
+        $instance->update([
+            'status' => 'ended',
+            // The address state has to go with the address. Left as it was, a
+            // later run would read `route_written` plus a matching hostname list
+            // and decide there was nothing to write — so an instance that was
+            // ever revived would be announced and routed nowhere.
+            'route_written' => false,
+            'routed_hostnames' => null,
+            'routed_backend' => null,
+            'cert_ok' => false,
+            'domain_cert_ok' => false,
+        ]);
+
+        Log::info('Instance service ended; address withdrawn.', [
+            'instance' => $instance->uuid,
+            'subdomain' => $instance->subdomain,
+            'service_ended_at' => $instance->service_ends_at?->toIso8601String(),
+        ]);
+
+        return true;
+    }
+}

app/Actions/Fortify/CreateNewUser.php

@@ -0,0 +1,81 @@
+<?php
+
+namespace App\Actions\Fortify;
+
+use App\Models\Customer;
+use App\Models\Operator;
+use App\Models\User;
+use Illuminate\Support\Facades\DB;
+use Illuminate\Support\Facades\Hash;
+use Illuminate\Support\Facades\Validator;
+use Illuminate\Validation\Rule;
+use Illuminate\Validation\ValidationException;
+use Laravel\Fortify\Contracts\CreatesNewUsers;
+
+class CreateNewUser implements CreatesNewUsers
+{
+    use PasswordValidationRules;
+
+    /**
+     * Validate and create a newly registered user.
+     *
+     * @param  array<string, string>  $input
+     *
+     * @throws ValidationException
+     */
+    public function create(array $input): User
+    {
+        Validator::make($input, [
+            'name' => ['required', 'string', 'max:255'],
+            'email' => [
+                'required',
+                'string',
+                'email',
+                'max:255',
+                Rule::unique(User::class),
+                // Never let public signup claim an existing (possibly not-yet-
+                // provisioned) customer's email — ensureUser() would later link
+                // that account and hand over the customer's portal.
+                Rule::unique(Customer::class, 'email'),
+                // Nor an operator's — R21: one address must not represent both
+                // identities. No dedicated message: Laravel's stock "already
+                // taken" line (translated in both languages already) is what
+                // the two rules above fall back to as well, and telling a
+                // public visitor specifically that an address belongs to
+                // STAFF would be a worse leak than the generic refusal every
+                // other collision here already gives them.
+                Rule::unique(Operator::class, 'email'),
+            ],
+            // Asked, never inferred. Everything downstream turns on it — the
+            // fourteen-day right of withdrawal, the wording of the invoice,
+            // whether reverse charge can apply — and a VAT number cannot stand
+            // in for it: plenty of businesses have none, and no consumer has
+            // one. Required, because the alternative is a field that is empty
+            // for most customers and therefore answers nothing.
+            'customer_type' => ['required', Rule::in(Customer::TYPES)],
+            'password' => $this->passwordRules(),
+        ])->validate();
+
+        // Create the user and its linked customer atomically — a public signup is
+        // a customer, and the portal (Billing::purchase, Settings, …) needs one.
+        // Either both exist or neither, so a failure never orphans a user.
+        return DB::transaction(function () use ($input) {
+            $user = User::create([
+                'name' => $input['name'],
+                'email' => $input['email'],
+                'password' => Hash::make($input['password']),
+            ]);
+
+            Customer::query()->create([
+                'user_id' => $user->id,
+                'name' => $input['name'],
+                'email' => $input['email'],
+                'customer_type' => $input['customer_type'],
+                'locale' => app()->getLocale(),
+                'status' => 'active',
+            ]);
+
+            return $user;
+        });
+    }
+}

app/Actions/Fortify/PasswordValidationRules.php

@@ -0,0 +1,19 @@
+<?php
+
+namespace App\Actions\Fortify;
+
+use App\Support\PasswordPolicy;
+use Illuminate\Contracts\Validation\Rule;
+
+trait PasswordValidationRules
+{
+    /**
+     * Get the validation rules used to validate passwords.
+     *
+     * @return array<int, Rule|array<mixed>|string>
+     */
+    protected function passwordRules(): array
+    {
+        return [...PasswordPolicy::rules(), 'confirmed'];
+    }
+}

app/Actions/Fortify/ResetUserPassword.php

@@ -0,0 +1,32 @@
+<?php
+
+namespace App\Actions\Fortify;
+
+use App\Models\User;
+use Illuminate\Support\Facades\Hash;
+use Illuminate\Support\Facades\Validator;
+use Illuminate\Validation\ValidationException;
+use Laravel\Fortify\Contracts\ResetsUserPasswords;
+
+class ResetUserPassword implements ResetsUserPasswords
+{
+    use PasswordValidationRules;
+
+    /**
+     * Validate and reset the user's forgotten password.
+     *
+     * @param  array<string, string>  $input
+     *
+     * @throws ValidationException
+     */
+    public function reset(User $user, array $input): void
+    {
+        Validator::make($input, [
+            'password' => $this->passwordRules(),
+        ])->validate();
+
+        $user->forceFill([
+            'password' => Hash::make($input['password']),
+        ])->save();
+    }
+}

app/Actions/Fortify/UpdateUserPassword.php

@@ -0,0 +1,35 @@
+<?php
+
+namespace App\Actions\Fortify;
+
+use App\Models\User;
+use Illuminate\Support\Facades\Hash;
+use Illuminate\Support\Facades\Validator;
+use Illuminate\Validation\ValidationException;
+use Laravel\Fortify\Contracts\UpdatesUserPasswords;
+
+class UpdateUserPassword implements UpdatesUserPasswords
+{
+    use PasswordValidationRules;
+
+    /**
+     * Validate and update the user's password.
+     *
+     * @param  array<string, string>  $input
+     *
+     * @throws ValidationException
+     */
+    public function update(User $user, array $input): void
+    {
+        Validator::make($input, [
+            'current_password' => ['required', 'string', 'current_password:web'],
+            'password' => $this->passwordRules(),
+        ], [
+            'current_password.current_password' => __('The provided password does not match your current password.'),
+        ])->validateWithBag('updatePassword');
+
+        $user->forceFill([
+            'password' => Hash::make($input['password']),
+        ])->save();
+    }
+}

app/Actions/Fortify/UpdateUserProfileInformation.php

@@ -0,0 +1,61 @@
+<?php
+
+namespace App\Actions\Fortify;
+
+use App\Models\User;
+use Illuminate\Contracts\Auth\MustVerifyEmail;
+use Illuminate\Support\Facades\Validator;
+use Illuminate\Validation\Rule;
+use Illuminate\Validation\ValidationException;
+use Laravel\Fortify\Contracts\UpdatesUserProfileInformation;
+
+class UpdateUserProfileInformation implements UpdatesUserProfileInformation
+{
+    /**
+     * Validate and update the given user's profile information.
+     *
+     * @param  array<string, string>  $input
+     *
+     * @throws ValidationException
+     */
+    public function update(User $user, array $input): void
+    {
+        Validator::make($input, [
+            'name' => ['required', 'string', 'max:255'],
+
+            'email' => [
+                'required',
+                'string',
+                'email',
+                'max:255',
+                Rule::unique('users')->ignore($user->id),
+            ],
+        ])->validateWithBag('updateProfileInformation');
+
+        if ($input['email'] !== $user->email &&
+            $user instanceof MustVerifyEmail) {
+            $this->updateVerifiedUser($user, $input);
+        } else {
+            $user->forceFill([
+                'name' => $input['name'],
+                'email' => $input['email'],
+            ])->save();
+        }
+    }
+
+    /**
+     * Update the given verified user's profile information.
+     *
+     * @param  array<string, string>  $input
+     */
+    protected function updateVerifiedUser(User $user, array $input): void
+    {
+        $user->forceFill([
+            'name' => $input['name'],
+            'email' => $input['email'],
+            'email_verified_at' => null,
+        ])->save();
+
+        $user->sendEmailVerificationNotification();
+    }
+}

app/Actions/GrantAddon.php

@@ -0,0 +1,77 @@
+<?php
+
+namespace App\Actions;
+
+use App\Models\Operator;
+use App\Models\Order;
+use App\Models\Subscription;
+use App\Models\SubscriptionAddon;
+use App\Services\Billing\AddonCatalogue;
+use Illuminate\Support\Carbon;
+use Illuminate\Support\Facades\DB;
+use RuntimeException;
+
+/**
+ * Gives a customer a module without a payment — "ein Plugin schenken".
+ *
+ * Books through the same BookAddon a paid order uses, on a synthetic Order
+ * (no Stripe id, price set to what the customer actually pays) so the module
+ * ends up frozen on `subscription_addons` exactly like a real booking would.
+ */
+class GrantAddon
+{
+    public function __construct(private BookAddon $bookAddon) {}
+
+    public function __invoke(
+        Subscription $subscription,
+        Operator $grantedBy,
+        string $addonKey,
+        int $priceCents,
+        int $quantity = 1,
+        ?string $note = null,
+        ?Carbon $until = null,
+    ): SubscriptionAddon {
+        $cataloguePrice = app(AddonCatalogue::class)->priceCents($addonKey);
+
+        if ($cataloguePrice === null) {
+            throw new RuntimeException("Unknown add-on: {$addonKey}");
+        }
+
+        if ($priceCents < 0 || $priceCents > $cataloguePrice) {
+            throw new RuntimeException('A grant cannot charge more than the catalogue price.');
+        }
+
+        // Vestigial for a module — nothing is provisioned at a datacenter for
+        // it — but the column is not nullable, and the contract's own order
+        // already carries the right one.
+        $datacenter = $subscription->order?->datacenter ?? 'fsn';
+
+        // The order and the booking together, or neither. Booking can refuse —
+        // not every module is for sale on every package — and an order left
+        // behind on its own is a paid purchase of nothing: it shows up in the
+        // customer's orders and on their invoice, for a module they never got.
+        return DB::transaction(function () use ($subscription, $grantedBy, $addonKey, $priceCents, $quantity, $note, $until, $cataloguePrice, $datacenter) {
+            $order = Order::create([
+                'customer_id' => $subscription->customer_id,
+                'plan' => $subscription->plan,
+                'type' => 'addon',
+                'addon_key' => $addonKey,
+                'amount_cents' => $priceCents,
+                'currency' => Subscription::catalogueCurrency(),
+                'datacenter' => $datacenter,
+                'stripe_event_id' => null,
+                'stripe_subscription_id' => null,
+                'status' => 'paid',
+            ]);
+
+            return ($this->bookAddon)($subscription, $addonKey, $quantity, $order, [
+                'price_cents' => $priceCents,
+                'granted_by' => $grantedBy->id,
+                'granted_at' => now(),
+                'grant_note' => $note,
+                'granted_until' => $until,
+                'catalogue_price_cents' => $cataloguePrice,
+            ]);
+        });
+    }
+}

app/Actions/GrantSubscription.php

@@ -0,0 +1,116 @@
+<?php
+
+namespace App\Actions;
+
+use App\Models\Customer;
+use App\Models\Operator;
+use App\Models\Order;
+use App\Models\ProvisioningRun;
+use App\Models\Subscription;
+use App\Provisioning\Jobs\AdvanceRunJob;
+use App\Services\Billing\PlanCatalogue;
+use Illuminate\Support\Carbon;
+use Illuminate\Support\Facades\DB;
+use RuntimeException;
+
+/**
+ * Gives a customer a package without a payment.
+ *
+ * A grant is an order without money, not a second code path: this creates the
+ * exact Order → ProvisioningRun → Subscription rows a Stripe purchase does —
+ * same pipeline, same OpenSubscription — with `stripe_subscription_id` left
+ * null and `price_cents` set to whatever the customer actually pays (0 for a
+ * full gift, less than the catalogue price for a discount). Provisioning,
+ * DowngradeCheck, seats, quotas, cancellation: all of it reads an ordinary
+ * Subscription row afterwards and never learns this one was free.
+ */
+class GrantSubscription
+{
+    public function __construct(private OpenSubscription $openSubscription) {}
+
+    /**
+     * @param  array{quota_gb?:int,seats?:int,traffic_gb?:int}  $bonus  Beyond what the plan tier already includes.
+     */
+    public function __invoke(
+        Customer $customer,
+        Operator $grantedBy,
+        string $plan,
+        string $term,
+        string $datacenter,
+        int $priceCents,
+        array $bonus = [],
+        ?string $note = null,
+        ?Carbon $until = null,
+    ): Subscription {
+        if (! Subscription::knowsPlan($plan)) {
+            throw new RuntimeException("Plan '{$plan}' is not sellable, so it cannot be granted either.");
+        }
+
+        $version = app(PlanCatalogue::class)->currentVersion($plan);
+        $cataloguePrice = $version->priceFor($term);
+
+        if ($cataloguePrice === null) {
+            throw new RuntimeException("Plan '{$plan}' is not sold on a {$term} term.");
+        }
+
+        // A "grant" that charges more than the plan actually costs is not a
+        // grant — that path already exists, and it goes through Stripe.
+        if ($priceCents < 0 || $priceCents > $cataloguePrice->amount_cents) {
+            throw new RuntimeException('A grant cannot charge more than the catalogue price.');
+        }
+
+        [$run, $subscription] = DB::transaction(function () use (
+            $customer, $grantedBy, $plan, $term, $datacenter, $priceCents, $bonus, $note, $until, $cataloguePrice,
+        ) {
+            $order = Order::create([
+                'customer_id' => $customer->id,
+                'plan' => $plan,
+                'type' => 'new',
+                'amount_cents' => $priceCents,
+                'currency' => Subscription::catalogueCurrency(),
+                'datacenter' => $datacenter,
+                // Never Stripe's: this purchase never went through Stripe at
+                // all, which is the whole point, and is also what tells
+                // IssueInvoice and the revenue figures this row apart from an
+                // ordinary (possibly also zero-priced) checkout.
+                'stripe_event_id' => null,
+                'stripe_subscription_id' => null,
+                'status' => 'paid',
+            ]);
+
+            $run = ProvisioningRun::create([
+                'subject_type' => Order::class,
+                'subject_id' => $order->id,
+                'pipeline' => 'customer',
+                'status' => ProvisioningRun::STATUS_PENDING,
+                'current_step' => 0,
+                'context' => ['branding' => $customer->brandingResolved()],
+            ]);
+
+            $overrides = array_filter([
+                'price_cents' => $priceCents,
+                'quota_gb' => $bonus['quota_gb'] ?? null,
+                'seats' => $bonus['seats'] ?? null,
+                'traffic_gb' => $bonus['traffic_gb'] ?? null,
+            ], fn ($value) => $value !== null);
+
+            $overrides += [
+                'granted_by' => $grantedBy->id,
+                'granted_at' => now(),
+                'grant_note' => $note,
+                'granted_until' => $until,
+                'catalogue_price_cents' => $cataloguePrice->amount_cents,
+            ];
+
+            $subscription = ($this->openSubscription)($order, $term, $overrides);
+
+            return [$run, $subscription];
+        });
+
+        // After the commit, never inside it — a worker can pick the run up
+        // before the transaction lands (see StartCustomerProvisioning).
+        AdvanceRunJob::dispatch($run->uuid);
+
+        return $subscription;
+    }
+}

app/Actions/IssueStripeInvoice.php

@@ -0,0 +1,316 @@
+<?php
+
+namespace App\Actions;
+
+use App\Mail\InvoiceMail;
+use App\Models\Invoice;
+use App\Models\Subscription;
+use App\Services\Billing\IssueInvoice;
+use App\Services\Stripe\StripeClient;
+use Illuminate\Database\UniqueConstraintViolationException;
+use Illuminate\Support\Carbon;
+use Illuminate\Support\Facades\Log;
+use Illuminate\Support\Facades\Mail;
+use Throwable;
+
+/**
+ * The document a paid Stripe invoice owes the customer, and the one mail that
+ * carries it.
+ *
+ * **One document per charge.** That is the owner's rule and it is a legal one,
+ * not a preference: every amount taken from a customer needs its own invoice
+ * with its own number. Two months of package, a storage module booked in the
+ * middle of month three, and the cycle that follows are four charges and four
+ * documents — the fourth being the one that carries package and storage
+ * together, because they were charged together.
+ *
+ * This used to issue for `subscription_cycle` alone, and everything else — a
+ * proration, a module, a charge raised by hand — was money received that no
+ * paper of ours covered. It was written down as a decision and it was the wrong
+ * one: Stripe charged for those, so they need documents.
+ *
+ * **Never allowed to fail the webhook.** Stripe retries anything that is not a
+ * 2xx, and there is nothing a retry could fix about an incomplete company
+ * profile or a mail server that is down — it would simply arrive again, fail
+ * again, and eventually be given up on, taking the register entry's retry with
+ * it. So everything here is caught and logged. The payment is recorded whatever
+ * happens to the paperwork; a missing document is recoverable, a lost payment is
+ * not.
+ *
+ * **Idempotent against the Stripe invoice.** An invoice number comes out of a
+ * gapless series and can never be handed out twice, so the guard is the unique
+ * `invoices.stripe_invoice_id` rather than a check — two deliveries arriving
+ * together would both pass a check. The number is drawn inside the same
+ * transaction the row is written in, so a collision takes the number back with
+ * it and the series keeps its sequence.
+ *
+ * Issuing and mailing are separate steps on purpose. `sent_at` records that the
+ * mail was handed to the mailer, so a delivery arriving after the document was
+ * written but before the mail went out finishes the job instead of skipping it —
+ * and one that arrives afterwards does neither twice.
+ */
+class IssueStripeInvoice
+{
+    /**
+     * @param  array<string, mixed>  $stripeInvoice  the invoice as Stripe sent it
+     * @param  Carbon|null  $from  the term this invoice billed, for the fallback below
+     * @return Invoice|null the document, or null when there is not one and could not be one
+     */
+    public function __invoke(
+        Subscription $subscription,
+        array $stripeInvoice,
+        ?Carbon $from = null,
+        ?Carbon $to = null,
+    ): ?Invoice {
+        $stripeInvoiceId = (string) ($stripeInvoice['id'] ?? '');
+
+        if ($stripeInvoiceId === '') {
+            // Without it there is no way to tell a redelivery from a second
+            // charge, and guessing wrong costs an invoice number.
+            Log::warning('Not issuing a document: the Stripe invoice carries no id, so issuing it could not be made idempotent.', [
+                'subscription' => $subscription->uuid,
+            ]);
+
+            return null;
+        }
+
+        $invoice = $this->issue($subscription, $stripeInvoiceId, $stripeInvoice, $from, $to);
+
+        if ($invoice === null || $invoice->sent_at !== null) {
+            return $invoice;
+        }
+
+        $this->send($subscription, $invoice);
+
+        return $invoice;
+    }
+
+    /** @param  array<string, mixed>  $stripeInvoice */
+    private function issue(
+        Subscription $subscription,
+        string $stripeInvoiceId,
+        array $stripeInvoice,
+        ?Carbon $from,
+        ?Carbon $to,
+    ): ?Invoice {
+        $existing = Invoice::query()->where('stripe_invoice_id', $stripeInvoiceId)->first();
+
+        if ($existing !== null) {
+            return $existing;
+        }
+
+        try {
+            $lines = $this->lines($stripeInvoiceId, $stripeInvoice);
+        } catch (Throwable $e) {
+            // Deliberately no document at all rather than a partial one. The
+            // total would still be right and the reader would have no way to see
+            // what they had paid for, which is the kind of invoice that gets
+            // rejected at an audit. A later redelivery or a replay can still
+            // issue it.
+            Log::error('Could not read the lines of a paid Stripe invoice, so no document was issued for it.', [
+                'subscription' => $subscription->uuid,
+                'stripe_invoice' => $stripeInvoiceId,
+                'exception' => $e->getMessage(),
+            ]);
+
+            return null;
+        }
+
+        try {
+            if ($lines === []) {
+                return $this->fromContract($subscription, $stripeInvoiceId, $stripeInvoice, $from, $to);
+            }
+
+            $unnamed = [];
+
+            $invoice = app(IssueInvoice::class)->forStripeInvoice(
+                subscription: $subscription,
+                stripeInvoiceId: $stripeInvoiceId,
+                lines: $lines,
+                currency: is_string($stripeInvoice['currency'] ?? null) ? $stripeInvoice['currency'] : null,
+                unnamed: $unnamed,
+            );
+
+            $this->reportUnnamed($subscription, $stripeInvoiceId, $unnamed);
+            $this->reportMismatch($invoice, $stripeInvoice);
+
+            return $invoice;
+        } catch (UniqueConstraintViolationException) {
+            // A concurrent delivery won the race. Its document is the one to
+            // send; this one's invoice number went back into the series when the
+            // transaction rolled back.
+            return Invoice::query()->where('stripe_invoice_id', $stripeInvoiceId)->first();
+        } catch (Throwable $e) {
+            // Refuses while the company details are incomplete, which is the
+            // correct outcome — see IssueInvoice. The payment itself stands: it
+            // is in the register, and the document can be issued once the
+            // details are there.
+            Log::warning('Could not issue a document for this paid Stripe invoice.', [
+                'subscription' => $subscription->uuid,
+                'stripe_invoice' => $stripeInvoiceId,
+                'exception' => $e->getMessage(),
+            ]);
+
+            return null;
+        }
+    }
+
+    /**
+     * Every line Stripe charged for, complete.
+     *
+     * The event carries them already. It does not always carry ALL of them — a
+     * contract with enough modules on it passes the number Stripe puts in a
+     * webhook — and `has_more` is how it says so. A document missing a charged
+     * line is worse than an extra API call, so the complete list is fetched
+     * whenever Stripe admits to holding one.
+     *
+     * @param  array<string, mixed>  $stripeInvoice
+     * @return array<int, array<string, mixed>>
+     */
+    private function lines(string $stripeInvoiceId, array $stripeInvoice): array
+    {
+        $lines = (array) ($stripeInvoice['lines']['data'] ?? []);
+
+        if (($stripeInvoice['lines']['has_more'] ?? false) !== true) {
+            return $lines;
+        }
+
+        return app(StripeClient::class)->invoiceLines($stripeInvoiceId);
+    }
+
+    /**
+     * The document for a cycle invoice that arrived without any line detail.
+     *
+     * The contract's own frozen price is an honest description of the term that
+     * was billed, and better than leaving a paid renewal with no paper at all.
+     * Only for a cycle: a proration or a charge raised by hand describes
+     * something the contract cannot answer for, and a line invented for those
+     * would be a guess printed on a document nobody can correct afterwards.
+     *
+     * @param  array<string, mixed>  $stripeInvoice
+     */
+    private function fromContract(
+        Subscription $subscription,
+        string $stripeInvoiceId,
+        array $stripeInvoice,
+        ?Carbon $from,
+        ?Carbon $to,
+    ): ?Invoice {
+        $isCycle = (string) ($stripeInvoice['billing_reason'] ?? '') === 'subscription_cycle';
+
+        if (! $isCycle || $from === null || $to === null) {
+            Log::warning('A paid Stripe invoice carried no lines, so no document could be built from it.', [
+                'subscription' => $subscription->uuid,
+                'stripe_invoice' => $stripeInvoiceId,
+                'billing_reason' => $stripeInvoice['billing_reason'] ?? null,
+            ]);
+
+            return null;
+        }
+
+        // The total Stripe took, where it said so. A document has to add up to
+        // the money, and the contract's own price at today's rate is only the
+        // next best answer — it would miss a cycle billed before a rate change.
+        $total = $stripeInvoice['total'] ?? $stripeInvoice['amount_paid'] ?? null;
+
+        return app(IssueInvoice::class)->forBilledPeriod(
+            $subscription,
+            $from,
+            $to,
+            $stripeInvoiceId,
+            chargedCents: is_numeric($total) ? (int) $total : null,
+        );
+    }
+
+    /**
+     * Say out loud that a line was charged which the catalogue could not name.
+     *
+     * The line is on the document either way, carrying whatever description
+     * Stripe sent. This is the trail for whoever has to work out what was sold —
+     * a Price created by hand in Stripe's dashboard, or a module removed from
+     * the catalogue while somebody was still paying for it.
+     *
+     * @param  array<int, string>  $unnamed
+     */
+    private function reportUnnamed(Subscription $subscription, string $stripeInvoiceId, array $unnamed): void
+    {
+        if ($unnamed === []) {
+            return;
+        }
+
+        Log::warning('A charged line was put on an invoice under Stripe’s own description, because this catalogue could not name it.', [
+            'subscription' => $subscription->uuid,
+            'stripe_invoice' => $stripeInvoiceId,
+            'prices' => $unnamed,
+        ]);
+    }
+
+    /**
+     * Say out loud when the document and the money do not agree.
+     *
+     * Our catalogue is pushed to Stripe as GROSS, so the line amounts that come
+     * back are what the customer paid and the document divides that sum rather
+     * than adding a rate to it. Stripe's total and our gross must therefore be
+     * the SAME NUMBER, to the cent, for every customer — including a
+     * reverse-charge one, whose whole charged amount is stated as net at 0 %.
+     *
+     * This used to accept our net as an alternative, on the grounds that an
+     * account might not collect tax for us. That tolerance is what let the
+     * defect run: 179,00 € taken against a document for 214,80 € matched the
+     * "net" branch and was never reported. Anything but equality is now worth a
+     * warning, and the likeliest cause is a Price that stripe:sync-catalogue has
+     * replaced with nobody having run stripe:reprice-subscriptions.
+     *
+     * Never an exception. The document is issued and the payment is recorded;
+     * raising here would only cost Stripe its 2xx and change nothing.
+     *
+     * @param  array<string, mixed>  $stripeInvoice
+     */
+    private function reportMismatch(Invoice $invoice, array $stripeInvoice): void
+    {
+        $total = $stripeInvoice['total'] ?? $stripeInvoice['amount_paid'] ?? null;
+
+        if (! is_numeric($total)) {
+            return;
+        }
+
+        $total = (int) $total;
+
+        if ($total === $invoice->gross_cents) {
+            return;
+        }
+
+        Log::warning('An invoice was issued for a sum Stripe did not charge.', [
+            'invoice' => $invoice->number,
+            'stripe_invoice' => $invoice->stripe_invoice_id,
+            'stripe_total' => $total,
+            'net' => $invoice->net_cents,
+            'gross' => $invoice->gross_cents,
+        ]);
+    }
+
+    private function send(Subscription $subscription, Invoice $invoice): void
+    {
+        $customer = $subscription->customer;
+        $address = $customer?->email;
+
+        if (! is_string($address) || $address === '') {
+            return;
+        }
+
+        try {
+            $mail = new InvoiceMail($invoice, (string) $customer->name);
+            Mail::mailer($mail->mailer)->to($address)->queue($mail);
+
+            // Only once it is actually with the mailer. Stamped so a redelivery
+            // does not send the same invoice a second time, and left unstamped
+            // on a failure so that one still can.
+            $invoice->update(['sent_at' => now()]);
+        } catch (Throwable $e) {
+            Log::warning('Could not queue the invoice mail for this payment.', [
+                'invoice' => $invoice->number,
+                'exception' => $e->getMessage(),
+            ]);
+        }
+    }
+}

app/Actions/MoveStripeSubscriptionPrice.php

@@ -0,0 +1,224 @@
+<?php
+
+namespace App\Actions;
+
+use App\Models\Subscription;
+use App\Services\Billing\PlanPrices;
+use App\Services\Stripe\StripeClient;
+use Illuminate\Support\Facades\Log;
+use RuntimeException;
+use Throwable;
+
+/**
+ * Telling Stripe that the contract now bills for a different package.
+ *
+ * A plan change moved the contract, the entitlements and the machine, and left
+ * Stripe billing the old price — so a customer who upgraded in March went on
+ * paying for the smaller package every month afterwards, and one who downgraded
+ * went on paying for the bigger one. This is what closes that.
+ *
+ * **Proration, per direction, chosen here and nowhere else.**
+ *
+ *  - An **upgrade** is settled immediately (`always_invoice`). PlanChange's own
+ *    docblock already says Stripe's proration invoice is the authority for what
+ *    an upgrade costs, and that is only true if there IS one — the alternative,
+ *    letting the proration ride along on the next cycle invoice, would make the
+ *    cycle charge bigger than the renewal document we issue from the contract's
+ *    frozen price, and a document that does not match the money taken is not a
+ *    document. Immediate also matches what the customer was shown: they get the
+ *    bigger package now and pay for the days that are left.
+ *  - A **downgrade** settles nothing (`none`). It lands exactly at the period
+ *    end, so there is nothing left of the term to prorate; anything other than
+ *    `none` at a boundary risks a stray credit line for a fraction of a day.
+ *    From the next cycle Stripe simply bills the smaller price, which is what
+ *    the renewal document will say.
+ *
+ * Between them the register and Stripe cannot claim different money: the upgrade
+ * row records what was AGREED (with nothing charged), Stripe's proration invoice
+ * comes back through the webhook as an `invoice_paid` row recording what was
+ * TAKEN, and the cycle invoice stays exactly the contract price on both sides.
+ *
+ * **Never throws.** The change has already been applied to the contract and to
+ * the machine by the time this runs, and Stripe being unreachable, unconfigured
+ * or out of step with the catalogue must not undo any of that. What it must not
+ * do either is disappear: the failure is parked on the contract in
+ * `stripe_price_sync`, logged as an error, and retried hourly by
+ * clupilot:sync-stripe-subscriptions.
+ */
+class MoveStripeSubscriptionPrice
+{
+    public function __construct(
+        private StripeClient $stripe,
+        private PlanPrices $prices,
+    ) {}
+
+    /**
+     * @param  string  $behaviour  one of StripeClient::PRORATE_*
+     * @return bool whether Stripe now agrees with the contract
+     */
+    public function __invoke(Subscription $subscription, string $behaviour): bool
+    {
+        // A granted package was never sold through Stripe — GrantSubscription
+        // leaves stripe_subscription_id null on purpose — so there is nothing
+        // there to move and nothing has gone wrong. Answered before anything
+        // else so that no call is made and no failure is recorded.
+        if ($subscription->stripe_subscription_id === null) {
+            return true;
+        }
+
+        $priceId = null;
+
+        try {
+            $priceId = $this->targetPrice($subscription);
+
+            if ($priceId === null) {
+                throw new RuntimeException(
+                    'The catalogue has no Stripe price for this plan version on this term. Run stripe:sync-catalogue.'
+                );
+            }
+
+            // Already billing it. A retry of a swap that in fact went through,
+            // or a second change back onto the price Stripe is on: either way
+            // asking again would raise a proration for a move that is not one.
+            if ($subscription->stripe_price_id === $priceId) {
+                $this->settled($subscription, $priceId);
+
+                return true;
+            }
+
+            if (! $this->stripe->isConfigured()) {
+                throw new RuntimeException('Stripe is not configured (STRIPE_SECRET is empty).');
+            }
+
+            $itemId = $this->itemId($subscription);
+
+            if ($itemId === null) {
+                throw new RuntimeException(
+                    'Stripe reports no item on this subscription, so there is nothing to put another price on.'
+                );
+            }
+
+            $this->stripe->updateSubscriptionPrice(
+                $subscription->stripe_subscription_id,
+                $itemId,
+                $priceId,
+                $behaviour,
+            );
+
+            $this->settled($subscription, $priceId);
+
+            return true;
+        } catch (Throwable $e) {
+            $this->park($subscription, $priceId, $behaviour, $e);
+
+            return false;
+        }
+    }
+
+    /**
+     * Try a parked swap again.
+     *
+     * The target price is worked out afresh from the contract rather than read
+     * back from the parked record: another change may have landed in between,
+     * and the contract is the authority on which package the customer is on.
+     * The BEHAVIOUR is the one that was chosen at the time, because it belongs
+     * to the direction the move went, which cannot be read off the contract
+     * once it has moved.
+     *
+     * A retried upgrade prorates from the moment Stripe finally hears about it,
+     * not from the moment the change landed here — so a long outage charges the
+     * customer for slightly fewer days than they had the bigger package. In
+     * their favour, and preferable to the alternative of back-dating a charge.
+     */
+    public function retry(Subscription $subscription): bool
+    {
+        $parked = (array) ($subscription->stripe_price_sync ?? []);
+
+        return $this($subscription, (string) ($parked['behaviour'] ?? StripeClient::PRORATE_NONE));
+    }
+
+    /**
+     * The Stripe Price for the package the contract is on now, for the customer
+     * who is paying for it.
+     *
+     * By plan VERSION and term, which is what a Stripe Price is: one per priced
+     * row and per tax treatment, written by stripe:sync-catalogue. Resolving it by
+     * plan name would hand back today's terms for a contract that is
+     * grandfathered on older ones.
+     *
+     * The treatment is part of the answer, which is what makes a verification
+     * converge: a business whose VAT id is confirmed the week after they bought
+     * belongs on the net Price from that moment, and one whose registration has
+     * lapsed belongs back on the gross one. Neither is a change of package, so
+     * nothing here looks like one — the move is made with PRORATE_NONE by the
+     * sweep that finds it, because the term is already paid for.
+     */
+    private function targetPrice(Subscription $subscription): ?string
+    {
+        return $this->prices->liveForSubscription($subscription);
+    }
+
+    /**
+     * The item the subscription bills through.
+     *
+     * Stored when we have it — a `customer.subscription.updated` event carries
+     * it and ApplyStripeBillingEvent keeps it. A contract older than that column
+     * has none, so Stripe is asked once and the answer is kept: the item id
+     * survives a price swap, so this happens at most once per contract.
+     */
+    private function itemId(Subscription $subscription): ?string
+    {
+        if ($subscription->stripe_item_id !== null) {
+            return $subscription->stripe_item_id;
+        }
+
+        $itemId = $this->stripe->subscriptionItemId((string) $subscription->stripe_subscription_id);
+
+        if ($itemId !== null) {
+            $subscription->update(['stripe_item_id' => $itemId]);
+        }
+
+        return $itemId;
+    }
+
+    /** Stripe and the contract agree; nothing is outstanding. */
+    private function settled(Subscription $subscription, string $priceId): void
+    {
+        $subscription->update([
+            'stripe_price_id' => $priceId,
+            'stripe_price_synced_at' => now(),
+            'stripe_price_sync' => null,
+        ]);
+    }
+
+    /**
+     * The change landed here and did not reach Stripe.
+     *
+     * Recorded on the contract rather than only logged: a log line scrolls away,
+     * and what this describes is a customer being charged for a package they are
+     * no longer on. The row is what the retry sweep reads and what an operator
+     * can be shown.
+     */
+    private function park(Subscription $subscription, ?string $priceId, string $behaviour, Throwable $e): void
+    {
+        $parked = (array) ($subscription->stripe_price_sync ?? []);
+        $attempts = (int) ($parked['attempts'] ?? 0) + 1;
+
+        Log::error('A plan change landed but did not reach Stripe: this contract is still being billed at the old price.', [
+            'subscription' => $subscription->uuid,
+            'plan' => $subscription->plan,
+            'stripe_subscription' => $subscription->stripe_subscription_id,
+            'stripe_price' => $priceId,
+            'attempts' => $attempts,
+            'error' => $e->getMessage(),
+        ]);
+
+        $subscription->update(['stripe_price_sync' => [
+            'price' => $priceId,
+            'behaviour' => $behaviour,
+            'error' => mb_substr($e->getMessage(), 0, 250),
+            'failed_at' => now()->toIso8601String(),
+            'attempts' => $attempts,
+        ]]);
+    }
+}

app/Actions/OpenDunningCase.php

@@ -0,0 +1,66 @@
+<?php
+
+namespace App\Actions;
+
+use App\Models\DunningCase;
+use App\Models\Subscription;
+use App\Services\Billing\DunningMailer;
+use App\Services\Billing\DunningSchedule;
+use Illuminate\Support\Carbon;
+
+/**
+ * Der Fall, der entsteht, wenn eine Abbuchung zum ersten Mal scheitert.
+ *
+ * Hängt an ApplyStripeBillingEvent::invoicePaymentFailed(), das bis hierher
+ * `past_due` setzte und schwieg. Der Kunde erfuhr davon erst, wenn seine Cloud
+ * stand.
+ *
+ * JE RECHNUNG GENAU EINMAL. Stripe versucht dieselbe Rechnung mehrfach, und
+ * jeder Versuch ist ein eigenes Ereignis — ohne diese Bedingung entstünden drei
+ * Fälle für eine Schuld, mit drei Mahnläufen und dreifachen Gebühren. Die
+ * Eindeutigkeit steht zusätzlich als Index in der Tabelle, damit zwei
+ * gleichzeitig eintreffende Ereignisse sie nicht umgehen können.
+ *
+ * Eröffnet wird auf Stufe 0 — dem HINWEIS. Keine Mahnung, keine Gebühr: eine
+ * abgelaufene Karte ist keine Zahlungsverweigerung.
+ */
+class OpenDunningCase
+{
+    public function __invoke(Subscription $subscription, string $invoiceId): ?DunningCase
+    {
+        if ($invoiceId === '') {
+            return null;
+        }
+
+        $now = Carbon::now();
+
+        $case = DunningCase::query()->firstOrCreate(
+            ['stripe_invoice_id' => $invoiceId],
+            [
+                'subscription_id' => $subscription->id,
+                'level' => 0,
+                'opened_at' => $now,
+                // Die erste Mahnung, nicht der Hinweis: der geht sofort hinaus.
+                'next_step_at' => $now->copy()->addDays(DunningSchedule::dayOfLevel(1)),
+                'fee_invoice_ids' => [],
+                'notified_levels' => [],
+            ],
+        );
+
+        // Der Hinweis geht SOFORT hinaus, nicht erst mit dem Tageslauf: der
+        // Kunde soll von der gescheiterten Abbuchung erfahren, solange er noch
+        // weiss, wovon die Rede ist. Nur beim ERSTEN Mal — wasRecentlyCreated
+        // unterscheidet das Eröffnen vom Wiedersehen derselben Rechnung.
+        if ($case->wasRecentlyCreated) {
+            app(DunningMailer::class)->level($case->load('subscription.customer'), 0);
+
+            // VERMERKEN, sonst hält der Nachhol-Lauf des nächsten Tages diese
+            // Nachricht für verloren und schickt dem Kunden dieselbe Mail ein
+            // zweites Mal. Erst nach dem Einreihen: andersherum stünde hier
+            // eine Nachricht, die nie einging.
+            $case->update(['notified_levels' => [0]]);
+        }
+
+        return $case;
+    }
+}

app/Actions/OpenSubscription.php

@@ -0,0 +1,134 @@
+<?php
+
+namespace App\Actions;
+
+use App\Models\Order;
+use App\Models\Subscription;
+use App\Models\SubscriptionRecord;
+use App\Services\Billing\WithdrawalRight;
+use Illuminate\Support\Carbon;
+use Illuminate\Support\Facades\DB;
+
+/**
+ * Opens the contract a paid order bought.
+ *
+ * This is the moment the catalogue stops applying. Everything the customer is
+ * owed — price, quotas, seats, the hardware behind the plan — is copied onto
+ * the subscription here and never read from the catalogue again. Provisioning
+ * sizes the machine from this row, so an operator editing a plan afterwards
+ * cannot reach a customer who has already paid.
+ *
+ * `price_cents` is the catalogue's NET price, which is what PlanChange prorates
+ * against — deliberately not `Order::amount_cents`, which holds the total Stripe
+ * actually charged, whichever of a package's two Prices this customer was sold on.
+ * The two can legitimately differ (VAT, and later coupons) — and for a
+ * reverse-charge business they legitimately agree, because no VAT is owed to us at
+ * all — and reconciling them is not this action's job: the proof register
+ * records what was charged per event, and Stripe's invoice is the authority for
+ * the amount. Copying a gross total into this net field would silently corrupt
+ * every pro-rata calculation that reads it.
+ *
+ * `$overrides` exists for exactly one caller, GrantSubscription: a grant opens
+ * a contract through this same action rather than a second one, but needs to
+ * set what the customer actually pays (0, or less than the catalogue price)
+ * and stamp who granted it. Passed straight through to Subscription::create()
+ * on top of the catalogue snapshot — empty for every ordinary purchase, which
+ * is the whole reason this stays a parameter and not a new method.
+ */
+class OpenSubscription
+{
+    public function __construct(private RecordCommercialEvent $record) {}
+
+    /** @param  array<string, mixed>  $overrides */
+    public function __invoke(Order $order, string $term = Subscription::TERM_MONTHLY, array $overrides = []): Subscription
+    {
+        // A retried webhook must not open a second contract for one purchase.
+        $existing = Subscription::query()->where('order_id', $order->id)->first();
+
+        if ($existing !== null) {
+            return $existing;
+        }
+
+        $start = now();
+
+        // The contract and its entry in the register commit together. If the
+        // record could fail after the subscription is in, the next webhook
+        // retry would find the contract, return early, and leave a paid sale
+        // permanently missing from the evidence.
+        return DB::transaction(fn () => $this->open($order, $term, $start, $overrides));
+    }
+
+    /** @param  array<string, mixed>  $overrides */
+    private function open(Order $order, string $term, Carbon $start, array $overrides = []): Subscription
+    {
+        $subscription = Subscription::create(array_merge(
+            // The version the order carries, when the checkout recorded one:
+            // what the customer saw beats what happens to be on sale by the
+            // time their payment reaches us.
+            Subscription::snapshotFrom($order->plan, $term, $order->plan_version_id),
+            [
+                'customer_id' => $order->customer_id,
+                'order_id' => $order->id,
+                // Carried from the checkout: from here on, Stripe's events
+                // name this and nothing else.
+                'stripe_subscription_id' => $order->stripe_subscription_id,
+                'started_at' => $start,
+                'current_period_start' => $start,
+                'current_period_end' => $term === Subscription::TERM_YEARLY
+                    ? $start->copy()->addYear()
+                    : $start->copy()->addMonth(),
+                // The fourteen days a consumer may withdraw in, stamped at the
+                // moment the contract is concluded rather than derived on every
+                // read. A statutory deadline is a date the customer was told,
+                // and a date that is recomputed is a date that can move.
+                //
+                // Stamped for a business customer too. Whether the right exists
+                // is WithdrawalRight's question and it asks the customer, not
+                // this column — and a customer can correct their recorded type
+                // afterwards, at which point the window has to have been running
+                // all along rather than starting from the correction.
+                'withdrawal_ends_at' => $start->copy()->addDays(WithdrawalRight::WINDOW_DAYS),
+                // Carried from the purchase, where it was given. Nothing reads
+                // it to decide anything any more — a withdrawing consumer gets
+                // the whole amount back — so this is a record of what was agreed
+                // at the checkout and not a gate. See Order's own cast.
+                'immediate_start_consent_at' => $order->immediate_start_consent_at,
+                'status' => 'active',
+            ],
+            // Last, so a grant's price and provenance win over the catalogue
+            // snapshot above rather than the other way round.
+            $overrides,
+        ));
+
+        // The sale, entered in the register the moment it happens. Written from
+        // the contract that was just frozen, so the evidence and the contract
+        // cannot describe different purchases.
+        ($this->record)(
+            event: SubscriptionRecord::EVENT_PURCHASE,
+            subscription: $subscription,
+            netCents: $subscription->price_cents,
+            at: $start,
+            stripe: ['event' => $order->stripe_event_id],
+            // The order carries what Stripe actually took, including whatever tax
+            // or discount applied on the day. The contract price is what was
+            // agreed; this is what was paid, and the register has to be able to
+            // state both — which for a reverse-charge business is the same figure,
+            // because their Price carries the bare net.
+            //
+            // Keyed on the Stripe id, not on the amount being non-zero: a fully
+            // discounted checkout charges zero, and reading that as "no amount
+            // recorded" would file a free sale as though it had been paid for
+            // in full. An order without a Stripe id was never charged through
+            // a checkout at all, and has nothing to report.
+            // packageChargedCents(), not the whole total: a first purchase can
+            // carry the one-off setup fee on the same Stripe session, and that fee
+            // buys the setting-up rather than the package. Held against the
+            // contract price it would report every sale with a fee on it as charged
+            // at the wrong amount, which is precisely what the register's flag is
+            // for and precisely why it must not fire on a correct sale.
+            chargedGrossCents: $order->stripe_event_id !== null ? $order->packageChargedCents() : null,
+        );
+
+        return $subscription;
+    }
+}

app/Actions/ReapplyInstanceAddress.php

@@ -0,0 +1,121 @@
+<?php
+
+namespace App\Actions;
+
+use App\Models\Instance;
+use App\Models\Order;
+use App\Models\ProvisioningRun;
+use App\Provisioning\Jobs\AdvanceRunJob;
+use App\Provisioning\WorkInFlight;
+use Illuminate\Support\Facades\Cache;
+use Illuminate\Support\Facades\Log;
+
+/**
+ * Make an instance's address true again — the router, the certificate and the
+ * hostname Nextcloud answers to — without touching anything else about it.
+ *
+ * A custom domain used to be announced and never served: the portal, the
+ * credentials mail and Instance::address() all reported it the moment its TXT
+ * proof appeared, while the only thing that ever wrote a route was the initial
+ * provisioning run, and it wrote the platform subdomain. This is the missing
+ * half — the moment a proven domain becomes an address, and the moment a
+ * withdrawn one stops being one.
+ *
+ * Called from the three places the address can change: the nightly proof check
+ * when verification flips, the customer's own domain page, and a package change
+ * that takes the right to a domain away. Deliberately not called from anywhere
+ * that merely LOOKS at the domain — a re-apply is remote work on a live
+ * machine, so it happens on a change and not on a schedule.
+ */
+class ReapplyInstanceAddress
+{
+    /**
+     * Start an address run for this instance, or return null when there is
+     * nothing to start.
+     *
+     * Null is the ordinary answer, not a failure: an instance still being
+     * built, one whose machine no longer exists, or one that already has a run
+     * in flight all have their address applied by that run instead.
+     */
+    public function __invoke(?Instance $instance): ?ProvisioningRun
+    {
+        if ($instance === null || ! $this->isReapplyable($instance)) {
+            return null;
+        }
+
+        // The lock closes the window between asking whether a run exists and
+        // creating one. Two requests can reach this in the same instant — the
+        // customer's own "check now" and the nightly command are the obvious
+        // pair — and two runs against one machine would write the same router
+        // twice and race each other's occ calls. Nobody waits for the lock: a
+        // re-apply that lost the race has nothing to add, because the run that
+        // won reads the same domain state it would have.
+        $lock = Cache::lock('instance-address:'.$instance->uuid, 30);
+
+        if (! $lock->get()) {
+            return null;
+        }
+
+        try {
+            return $this->start($instance);
+        } finally {
+            $lock->release();
+        }
+    }
+
+    private function start(Instance $instance): ?ProvisioningRun
+    {
+        $order = $instance->order;
+
+        // A run already under way applies whatever the domain state says when it
+        // gets to the step — but only if it HAS the step. Asked of the two steps
+        // this pipeline consists of rather than of the mere existence of a run:
+        // `customer` and `plan-change` both carry them and there is nothing to
+        // add, while `restart`, `storage` and `quota` carry neither, and standing
+        // aside for one of those was how a domain proven during a restart stayed
+        // unrouted for good. See App\Provisioning\WorkInFlight.
+        if (app(WorkInFlight::class)->covers($order, 'address')) {
+            return null;
+        }
+
+        $run = ProvisioningRun::create([
+            'subject_type' => Order::class,
+            'subject_id' => $order->id,
+            'pipeline' => 'address',
+            'status' => ProvisioningRun::STATUS_PENDING,
+            'current_step' => 0,
+            // Everything the two steps read. instance_id is how CustomerStep
+            // finds the machine; node and vmid are how it reaches inside it.
+            'context' => [
+                'instance_id' => $instance->id,
+                'host_id' => $instance->host_id,
+                'node' => $instance->host?->node,
+                'vmid' => $instance->vmid,
+                'subdomain' => $instance->subdomain,
+            ],
+        ]);
+
+        AdvanceRunJob::dispatch($run->uuid);
+
+        Log::info('Re-applying an instance address.', [
+            'instance' => $instance->uuid,
+            'domain' => $instance->custom_domain,
+            'verified' => $instance->domainIsVerified(),
+            'run' => $run->uuid,
+        ]);
+
+        return $run;
+    }
+
+    /**
+     * Is there a machine here whose address can be re-applied at all?
+     *
+     * The question is not this action's alone — a plan change asks exactly the
+     * same one before it starts a run against a live machine — so the rule sits
+     * on the model and both read it there. See Instance::hasLiveMachine().
+     */
+    private function isReapplyable(Instance $instance): bool
+    {
+        return $instance->hasLiveMachine();
+    }
+}

app/Actions/RecordCommercialEvent.php

@@ -0,0 +1,171 @@
+<?php
+
+namespace App\Actions;
+
+use App\Models\Order;
+use App\Models\Subscription;
+use App\Models\SubscriptionRecord;
+use App\Services\Billing\TaxTreatment;
+use Illuminate\Support\Carbon;
+
+/**
+ * Writes one row into the proof register.
+ *
+ * Every commercial event goes through here so that the flat columns are filled
+ * the same way each time — an evidence table where the amount means one thing
+ * in one row and another in the next is not evidence.
+ *
+ * Amounts are stated three ways on purpose. Net is what the catalogue and the
+ * contract deal in; gross is what was actually charged; the tax between them
+ * depends on the customer and on the day, and recomputing it later from a rate
+ * that has since changed would produce a different answer to the one on the
+ * invoice.
+ */
+class RecordCommercialEvent
+{
+    /**
+     * @param  array<string, mixed>  $extra  merged into the JSON snapshot
+     * @param  array<string, string|null>  $stripe  event / invoice / subscription ids
+     */
+    public function __invoke(
+        string $event,
+        Subscription $subscription,
+        int $netCents,
+        ?Carbon $at = null,
+        array $extra = [],
+        array $stripe = [],
+        ?int $chargedGrossCents = null,
+        ?Order $order = null,
+        ?string $eventKey = null,
+    ): SubscriptionRecord {
+        $at ??= now();
+        $customer = $subscription->customer;
+        $tax = TaxTreatment::for($customer);
+
+        $agreedNet = $netCents;
+
+        // What the till would take from THIS customer for this catalogue figure:
+        // the domestic gross for everybody who is charged VAT, the bare net for a
+        // reverse-charge business, because that is the Stripe Price their checkout
+        // used. Asked of the treatment rather than of a single domestic figure,
+        // which is what it used to be — and every reverse-charge sale, charged
+        // exactly the amount it should have been, was then reported as a mismatch
+        // by the one flag whose job is "somebody must look at this".
+        //
+        // chargeCents() is the single place the amount taken is formed, and it is
+        // what the Stripe Price carries — so this is the figure the charge can
+        // honestly be held against.
+        $expectedGross = $tax->chargeCents($agreedNet);
+
+        // The flat columns describe the TRANSACTION, not the contract: gross is
+        // what was taken from the customer, and net and tax are that gross
+        // split by the rate that applied on the day.
+        //
+        // Split, not subtracted from the agreed price. A discount lowers the
+        // taxable amount; it does not create negative VAT, and recording
+        // 14900 charged against a 179,00 contract as "minus 30,00 tax" would
+        // make the register wrong in exactly the case someone audits.
+        if ($chargedGrossCents !== null) {
+            $gross = $chargedGrossCents;
+            $net = (int) round($gross / (1 + $tax->rate));
+        } else {
+            // Nothing was charged at this event. The columns still state what the
+            // terms are worth, split by this customer's own rate — a
+            // reverse-charge contract owes no VAT and must not have any invented
+            // for it here.
+            $net = $agreedNet;
+            $gross = $tax->grossCents($agreedNet);
+        }
+
+        $version = $subscription->planVersion;
+
+        return SubscriptionRecord::create([
+            'event' => $event,
+            // What makes this event "the same one" if it arrives again. Unique
+            // where set, so a duplicate delivery collides in the database
+            // rather than in a check that two of them can both pass.
+            'event_key' => $eventKey,
+
+            'customer_id' => $subscription->customer_id,
+            'subscription_id' => $subscription->id,
+            // The order this event belongs to — a booked module has its own,
+            // and pointing it at the original plan purchase would file every
+            // add-on under the wrong transaction.
+            'order_id' => $order?->id ?? $subscription->order_id,
+            'plan_version_id' => $subscription->plan_version_id,
+
+            // Copied rather than joined: these have to still answer the question
+            // after the customer, the plan or the version have gone.
+            'customer_name' => $customer?->name,
+            'plan_key' => $subscription->plan,
+            'plan_version' => $version?->version,
+            'term' => $subscription->term,
+
+            'net_cents' => $net,
+            'tax_cents' => $gross - $net,
+            'gross_cents' => $gross,
+            'currency' => $subscription->currency,
+            'tax_rate' => round($tax->rate * 100, 2),
+            'reverse_charge' => $tax->reverseCharge,
+
+            'stripe_event_id' => $stripe['event'] ?? null,
+            'stripe_invoice_id' => $stripe['invoice'] ?? null,
+            'stripe_subscription_id' => $stripe['subscription'] ?? null,
+
+            'occurred_at' => $at,
+
+            'snapshot_version' => SubscriptionRecord::SNAPSHOT_VERSION,
+            // The long tail: everything nobody has thought to ask about yet.
+            // The flat columns above are what gets queried.
+            'snapshot' => array_merge([
+                'subscription' => $subscription->only(Subscription::FROZEN),
+                'plan' => [
+                    'key' => $subscription->plan,
+                    'version' => $version?->version,
+                    'version_id' => $subscription->plan_version_id,
+                    'family' => $version?->family?->name,
+                    'capabilities' => $version?->capabilities(),
+                ],
+                'period' => [
+                    'start' => $subscription->current_period_start?->toIso8601String(),
+                    'end' => $subscription->current_period_end?->toIso8601String(),
+                ],
+                'addons' => $subscription->addons()->active()->get()
+                    ->map(fn ($addon) => [
+                        'key' => $addon->addon_key,
+                        'price_cents' => $addon->price_cents,
+                        'quantity' => $addon->quantity,
+                        'booked_at' => $addon->booked_at?->toIso8601String(),
+                    ])->all(),
+                'customer' => [
+                    'name' => $customer?->name,
+                    'email' => $customer?->email,
+                    'vat_id' => $customer?->vat_id,
+                ],
+                // Kept even when they agree. A charge that differs from the
+                // catalogue plus tax is exactly the thing someone will ask
+                // about later, and reconciling it silently would erase the
+                // question along with the answer.
+                'amounts' => [
+                    // What was agreed, beside what was actually taken. The
+                    // flat columns state the transaction; this states whether
+                    // it came out at the contract price, which is the question
+                    // someone asks a year later.
+                    'agreed_net_cents' => $agreedNet,
+                    'expected_gross_cents' => $expectedGross,
+                    // Null where no money moved at this event, and the flag with
+                    // it. Stamping the expected figure into the charged column
+                    // made a plan change — where the terms move and Stripe raises
+                    // its proration invoice afterwards — claim it had been paid
+                    // for, and then agree with itself. A row that answers "was
+                    // the right amount taken?" with "yes" when nothing was taken
+                    // is worse than one that says it does not know.
+                    'charged_gross_cents' => $chargedGrossCents,
+                    'matches_catalogue' => $chargedGrossCents === null
+                        ? null
+                        : $chargedGrossCents === $expectedGross,
+                ],
+            ], $extra),
+        ]);
+    }
+}

app/Actions/RestartInstance.php

@@ -0,0 +1,160 @@
+<?php
+
+namespace App\Actions;
+
+use App\Models\Customer;
+use App\Models\Instance;
+use App\Models\Order;
+use App\Models\ProvisioningRun;
+use App\Provisioning\Jobs\AdvanceRunJob;
+use Illuminate\Auth\Access\AuthorizationException;
+use Illuminate\Support\Facades\Auth;
+use Illuminate\Support\Facades\Cache;
+use Illuminate\Support\Facades\Log;
+
+/**
+ * Take a customer's machine round once — properly.
+ *
+ * The product could not restart anything at all. ProxmoxClient had startVm and
+ * nothing else, the cloud page's "Neu starten" was a toast, and
+ * `restart_required_since` — set by every plan change that touches CPU or memory
+ * on a running guest — could only ever be cleared by a resize step that happened
+ * to find the machine stopped. Nothing could stop it. So a paid upgrade's cores
+ * and RAM were written into the VM's definition and could stay unreached for the
+ * life of the contract.
+ *
+ * This is the missing trigger. It does not do the work: a restart is remote work
+ * on a live machine, so it goes through the same run machinery as everything
+ * else — see the `restart` pipeline — where it is retried, logged, and visible
+ * in the console instead of happening inside a web request.
+ */
+class RestartInstance
+{
+    /**
+     * May whoever is signed in RIGHT NOW restart this machine?
+     *
+     * Asked here and not only where the button is drawn. A Livewire action is
+     * reachable by anyone who can POST to /livewire/update with a component
+     * snapshot — hiding a button hides a button, it does not close a door — so
+     * the rule has to be re-checked at the point the run is created.
+     *
+     * Two identities, two answers (R21): an operator holding `instances.restart`
+     * may restart any machine on the estate, because that is what the console is
+     * for; a portal user may restart their own and nobody else's. Both guards
+     * are read, and either may say yes — the two sessions coexist in one browser
+     * by design (see config/auth.php), so asking only the console guard would
+     * refuse an operator their own cloud, and asking only the portal guard would
+     * refuse every operator everything.
+     *
+     * The customer is resolved from the signed-in user rather than taken from
+     * the caller: a caller that passes the customer is a caller that can pass
+     * the wrong one.
+     */
+    public function allows(Instance $instance): bool
+    {
+        $operator = Auth::guard('operator')->user();
+
+        if ($operator !== null && $operator->isActive() && $operator->can('instances.restart')) {
+            return true;
+        }
+
+        $customer = Customer::forUser(Auth::guard('web')->user());
+
+        return $customer !== null && (int) $instance->customer_id === (int) $customer->id;
+    }
+
+    /**
+     * Start a restart run for this instance, or return null when there is
+     * nothing to start.
+     *
+     * Null is the ordinary "no" and not a failure — a machine that is still
+     * being built, one whose VM has gone, one whose service has ended, or one
+     * that already has a run in flight all have a better reason to be left
+     * alone than a restart has to interrupt them. A refusal on AUTHORISATION is
+     * the one case that throws, because it is not an ordinary outcome and the
+     * caller must not be able to mistake it for one.
+     *
+     * @throws AuthorizationException
+     */
+    public function __invoke(Instance $instance): ?ProvisioningRun
+    {
+        if (! $this->allows($instance)) {
+            throw new AuthorizationException;
+        }
+
+        if (! $instance->hasLiveMachine()) {
+            return null;
+        }
+
+        // The same lock ReapplyInstanceAddress takes, for the same reason: two
+        // requests can reach this in one instant — the customer pressing the
+        // button while an operator presses it for them is the obvious pair —
+        // and two restart runs against one machine would have the second one
+        // shutting the guest down while the first waits for it to come back.
+        // Nobody waits for the lock: a restart that lost the race has nothing
+        // to add, because the run that won does exactly the same thing.
+        $lock = Cache::lock('instance-restart:'.$instance->uuid, 30);
+
+        if (! $lock->get()) {
+            return null;
+        }
+
+        try {
+            return $this->start($instance);
+        } finally {
+            $lock->release();
+        }
+    }
+
+    private function start(Instance $instance): ?ProvisioningRun
+    {
+        $order = $instance->order;
+
+        // Checked against the ORDER, because that is the subject every customer
+        // pipeline shares. ANY run, and deliberately not the narrower "does it do
+        // this work?" question ReapplyInstanceAddress and ApplyStorageAllowance
+        // ask: taking the guest away underneath a run is harmful to every one of
+        // them, and unlike a proven domain or a booked pack a restart is somebody
+        // pressing a button, so it can be pressed again once the run is done
+        // rather than needing to be remembered for them.
+        if ($this->hasRunInFlight($order)) {
+            return null;
+        }
+
+        $run = ProvisioningRun::create([
+            'subject_type' => Order::class,
+            'subject_id' => $order->id,
+            'pipeline' => 'restart',
+            'status' => ProvisioningRun::STATUS_PENDING,
+            'current_step' => 0,
+            // Everything the four steps read: instance_id is how CustomerStep
+            // finds the machine, node and vmid are how it reaches it.
+            'context' => [
+                'instance_id' => $instance->id,
+                'host_id' => $instance->host_id,
+                'node' => $instance->host?->node,
+                'vmid' => $instance->vmid,
+                'subdomain' => $instance->subdomain,
+            ],
+        ]);
+
+        AdvanceRunJob::dispatch($run->uuid);
+
+        Log::info('Restarting a customer instance.', [
+            'instance' => $instance->uuid,
+            'restart_pending_since' => $instance->restart_required_since?->toIso8601String(),
+            'run' => $run->uuid,
+        ]);
+
+        return $run;
+    }
+
+    private function hasRunInFlight(Order $order): bool
+    {
+        return ProvisioningRun::query()
+            ->where('subject_type', Order::class)
+            ->where('subject_id', $order->id)
+            ->inFlight()
+            ->exists();
+    }
+}

app/Actions/ResumeInstance.php

@@ -0,0 +1,43 @@
+<?php
+
+namespace App\Actions;
+
+use App\Models\Instance;
+use App\Services\Proxmox\ProxmoxClient;
+use Illuminate\Support\Facades\Log;
+
+/**
+ * Die Cloud nach der Begleichung wieder hochfahren.
+ *
+ * Das Gegenstück zu SuspendInstance, und bewusst zusammen mit ihm gebaut:
+ * getrennt gäbe es einen Weg hinunter und keinen zurück — und der einzige
+ * Zustand, aus dem ein Kunde nicht selbst herausfindet, ist der, in dem seine
+ * Cloud steht.
+ */
+class ResumeInstance
+{
+    public function __invoke(Instance $instance): void
+    {
+        if ($instance->suspended_at === null) {
+            return;
+        }
+
+        $vmid = $instance->vmid;
+        $node = $instance->host?->node ?? 'pve';
+
+        if ($vmid !== null) {
+            app(ProxmoxClient::class)->startVm($node, (int) $vmid);
+        }
+
+        // Die Marke fällt, NACHDEM gestartet wurde. Andersherum sähe ein
+        // gleichzeitiger Tageslauf eine nicht gesperrte Instanz, die noch
+        // steht — und ein Neustart, der scheitert, hinterliesse eine Cloud,
+        // die niemand mehr als gesperrt erkennt.
+        $instance->update(['suspended_at' => null]);
+
+        Log::info('Cloud nach Begleichung wieder hochgefahren', [
+            'instance' => $instance->uuid,
+            'vmid' => $vmid,
+        ]);
+    }
+}

app/Actions/SettleDunningCase.php

@@ -0,0 +1,80 @@
+<?php
+
+namespace App\Actions;
+
+use App\Console\Commands\AdvanceDunning;
+use App\Models\DunningCase;
+use App\Services\Billing\DunningMailer;
+use App\Services\Billing\DunningSchedule;
+use App\Services\Stripe\StripeClient;
+use Illuminate\Support\Carbon;
+
+/**
+ * Einen Mahnfall schliessen — aber erst, wenn WIRKLICH alles bezahlt ist.
+ *
+ * Die Bedingung des Betreibers lautete „bis der Betrag + Mahngebühren beglichen
+ * ist". Wer den Rückstand zahlt und die Mahnspesen offen lässt, ist damit nicht
+ * fertig, und seine Cloud bleibt aus.
+ *
+ * Gefragt wird STRIPE, nicht der eigene Zustand: die offenen Rechnungen des
+ * Kunden sind die Wahrheit über das, was noch aussteht. Ein eigenes Feld
+ * „bezahlt" je Gebührenrechnung wäre eine zweite Buchhaltung, die mit der
+ * ersten auseinanderläuft — und zwar genau dann, wenn eine Zahlung ausserhalb
+ * unseres Ablaufs eingeht.
+ */
+class SettleDunningCase
+{
+    public function __invoke(DunningCase $case): bool
+    {
+        if (! $case->isOpen()) {
+            return false;
+        }
+
+        $customerId = $case->subscription?->customer?->stripe_customer_id;
+
+        if (blank($customerId)) {
+            return false;
+        }
+
+        $offen = array_column(app(StripeClient::class)->openInvoices((string) $customerId), 'id');
+
+        // Platzhalter zählen nicht mit: sie sind keine Stripe-ID, und wogegen
+        // man sie prüfen sollte, weiss niemand. Sie stehen im Fall und auf der
+        // Seite — dort kann ein Mensch nachsehen. Sie hier als „offen" zu
+        // werten hiesse, den Fall für immer festzuhalten.
+        $unsere = array_values(array_filter(
+            array_merge([$case->stripe_invoice_id], array_values($case->fee_invoice_ids ?? [])),
+            fn (string $id) => $id !== AdvanceDunning::PENDING,
+        ));
+
+        // Steht noch eine davon offen, ist der Fall nicht zu.
+        if (array_intersect($unsere, $offen) !== []) {
+            return false;
+        }
+
+        $case->update(['settled_at' => Carbon::now()]);
+
+        $stand = $case->level;
+
+        // Und die Cloud kommt zurück — NUR die dieses Vertrags.
+        //
+        // Vorher holte eine Zahlung auf Vertrag A jede gesperrte Cloud des
+        // Kunden zurück, auch die, für die noch geschuldet wird (Codex P1).
+        // Ein Kunde mit zwei Verträgen hätte durch das Begleichen des einen
+        // den anderen freibekommen.
+        $instance = $case->instance();
+
+        if ($instance !== null && $instance->suspended_at !== null) {
+            app(ResumeInstance::class)($instance);
+        }
+
+        // Nur wer wirklich stand, bekommt die Entwarnung. Wer auf Stufe 1
+        // bezahlt hat, hat nie eine Sperre gesehen — ihm zu schreiben, seine
+        // Cloud laufe wieder, wäre eine Nachricht über etwas, das nie war.
+        if ($stand >= DunningSchedule::SUSPENDED) {
+            app(DunningMailer::class)->resumed($case);
+        }
+
+        return true;
+    }
+}

app/Actions/StartCustomerProvisioning.php

@@ -0,0 +1,438 @@
+<?php
+
+namespace App\Actions;
+
+use App\Exceptions\IdentityCollisionException;
+use App\Mail\InvoiceMail;
+use App\Mail\OrderConfirmationMail;
+use App\Models\Customer;
+use App\Models\Invoice;
+use App\Models\Order;
+use App\Models\ProvisioningRun;
+use App\Models\Subscription;
+use App\Provisioning\Jobs\AdvanceRunJob;
+use App\Services\Billing\IssueInvoice;
+use App\Services\Billing\PlanCatalogue;
+use Illuminate\Database\UniqueConstraintViolationException;
+use Illuminate\Support\Facades\DB;
+use Illuminate\Support\Facades\Log;
+use Illuminate\Support\Facades\Mail;
+use Throwable;
+
+/**
+ * Turns a paid Stripe event into a customer + order + provisioning run. The
+ * order's unique stripe_event_id is the idempotency key: a duplicate webhook
+ * never starts a second run.
+ */
+class StartCustomerProvisioning
+{
+    public function __construct(
+        private OpenSubscription $openSubscription,
+        private ApplyStripeBillingEvent $billing,
+    ) {}
+
+    /**
+     * @param  array{id:string,email:string,name:?string,stripe_customer_id:?string,plan:string,datacenter:string,amount_cents:int,setup_fee_cents?:int,currency:string,immediate_start_consent?:bool}  $event
+     */
+    public function fromStripeEvent(array $event): ?Order
+    {
+        $existing = Order::query()->where('stripe_event_id', $event['id'])->first();
+
+        if ($existing !== null) {
+            $this->resume($existing);
+
+            return null;
+        }
+
+        $customer = $this->resolveCustomer($event);
+
+        try {
+            $customer->ensureUser(); // portal login (also enables admin impersonation)
+        } catch (IdentityCollisionException) {
+            // Same principle as openContract() below: the order is the record
+            // that money changed hands, so a paid order still gets recorded
+            // and provisioned. Only the colliding portal LOGIN is withheld —
+            // R21 — until an operator resolves the address conflict by hand
+            // (rename the operator, or the customer). Until then this
+            // customer has no self-service sign-in and cannot be
+            // impersonated either; both call ensureUser() the same way.
+            Log::error('Portal login withheld: this customer email already belongs to an operator account.', [
+                'customer_id' => $customer->id, 'email' => $customer->email,
+            ]);
+        }
+
+        try {
+            [$order, $run] = DB::transaction(function () use ($event, $customer) {
+                $order = Order::create([
+                    'customer_id' => $customer->id,
+                    'plan' => $event['plan'],
+                    // Set once Stripe checkout carries it (phase 5). Null means
+                    // "whatever is on sale when the webhook lands", which is
+                    // what this did before the column existed.
+                    'plan_version_id' => $event['plan_version_id'] ?? null,
+                    'amount_cents' => $event['amount_cents'],
+                    // How much of `amount_cents` was the one-off setup fee. Kept
+                    // beside the total rather than subtracted from it: a withdrawal
+                    // sends back everything that was taken and the confirmation
+                    // mail states everything that was taken, while the register and
+                    // the invoice need the package and the fee apart — see
+                    // Order::packageChargedCents().
+                    'setup_fee_cents' => (int) ($event['setup_fee_cents'] ?? 0),
+                    'currency' => $event['currency'],
+                    'datacenter' => $event['datacenter'],
+                    'stripe_event_id' => $event['id'],
+                    'stripe_subscription_id' => $event['stripe_subscription_id'] ?? null,
+                    // Kept so a withdrawal has something to refund against; see
+                    // App\Actions\WithdrawContract.
+                    'stripe_payment_intent_id' => $event['stripe_payment_intent_id'] ?? null,
+                    'stripe_invoice_id' => $event['stripe_invoice_id'] ?? null,
+                    // Stamped only where the consumer actually gave it. Nothing
+                    // turns on it any more: a withdrawal refunds the whole
+                    // amount whether it is there or not, because the owner has
+                    // decided not to charge for the days the cloud ran. Kept as
+                    // a record of what the customer was shown and ticked.
+                    'immediate_start_consent_at' => ($event['immediate_start_consent'] ?? false) === true ? now() : null,
+                    'status' => 'paid',
+                ]);
+
+                $run = ProvisioningRun::create([
+                    'subject_type' => Order::class,
+                    'subject_id' => $order->id,
+                    'pipeline' => 'customer',
+                    'status' => ProvisioningRun::STATUS_PENDING,
+                    'current_step' => 0,
+                    // Snapshot resolved branding so retries apply identical inputs
+                    // (unset customer → CluPilot defaults, resolved once here).
+                    'context' => ['branding' => $customer->brandingResolved()],
+                ]);
+
+                return [$order, $run];
+            });
+        } catch (UniqueConstraintViolationException) {
+            // A concurrent delivery won the race. Both requests will answer
+            // Stripe with a 2xx, so this is the last look anyone takes at this
+            // payment — if the winner then dies before opening the contract, no
+            // retry is coming to fix it. So finish its work rather than just
+            // stepping aside. The unique index on subscriptions.order_id keeps
+            // both from opening one.
+            $winner = Order::query()->where('stripe_event_id', $event['id'])->first();
+
+            if ($winner !== null) {
+                $this->resume($winner);
+            }
+
+            return null;
+        }
+
+        $this->openContract($order);
+
+        AdvanceRunJob::dispatch($run->uuid); // after commit
+
+        $this->confirmByMail($order, $customer);
+
+        return $order;
+    }
+
+    /**
+     * Invoice the payment, and tell the customer once.
+     *
+     * Both halves are idempotent and live in invoiceOnce() and mailInvoiceOnce()
+     * below, because this is not the only caller any more: resume() has to be able
+     * to finish exactly this work when a crash cut it off, and two copies of "have
+     * we invoiced this yet" would be two answers.
+     *
+     * Sent here rather than when provisioning finishes: those are minutes apart
+     * at best and can be much longer, and somebody who has just been charged
+     * and heard nothing assumes the worst about both the charge and the
+     * product. CloudReady announces the end; this announces the beginning.
+     *
+     * After the transaction, never inside it: a queued job can be picked up by
+     * a worker before the commit lands, and it would then read an order that
+     * does not exist yet.
+     *
+     * Never allowed to fail the webhook. Stripe retries anything that is not a
+     * 2xx, and a retry here would re-enter provisioning — a second machine
+     * built — over a mail server or a missing VAT number.
+     */
+    private function confirmByMail(Order $order, Customer $customer): void
+    {
+        $invoice = $this->invoiceOnce($order, $customer);
+
+        if ($invoice !== null) {
+            $this->mailInvoiceOnce($invoice, $customer);
+
+            return;
+        }
+
+        $address = $customer->email;
+
+        if (! is_string($address) || $address === '') {
+            return;
+        }
+
+        // No invoice, and there could not be one: an incomplete company profile,
+        // or a purchase that was a full gift. The confirmation says what it can.
+        //
+        // Sent from HERE only, never from resume(). It has nothing to stamp — an
+        // order carries no `sent_at` — so a redelivery could not tell that it had
+        // already gone out, and Stripe redelivers until it gets a 2xx. The invoice
+        // mail is the one a crash must not lose, and that one is stamped.
+        try {
+            $mail = new OrderConfirmationMail($order, (string) $customer->name);
+            Mail::mailer($mail->mailer)->to($address)->queue($mail);
+        } catch (Throwable $e) {
+            Log::warning('Could not queue the purchase confirmation', [
+                'order' => $order->id,
+                'exception' => $e->getMessage(),
+            ]);
+        }
+    }
+
+    /**
+     * The document this purchase owes, issued exactly once however often we are
+     * asked.
+     *
+     * The guard is the invoice already filed against this order, because an
+     * invoice number comes out of a gapless series and can never be handed out
+     * twice. Cancellations are excluded from the search: a Storno carries the same
+     * `order_id` as the document it takes back, so counting one would leave a
+     * withdrawn purchase looking as though it had been invoiced by its own
+     * cancellation.
+     *
+     * Not a database-level guard, and it cannot be one — `invoices.order_id` is
+     * legitimately shared by an invoice and its Storno, so it can never be unique.
+     * What this closes is the case that actually happens: Stripe redelivering the
+     * same event, one delivery after another.
+     */
+    private function invoiceOnce(Order $order, Customer $customer): ?Invoice
+    {
+        $existing = Invoice::query()
+            ->where('order_id', $order->id)
+            ->whereNull('cancels_invoice_id')
+            ->orderBy('id')
+            ->first();
+
+        if ($existing !== null) {
+            return $existing;
+        }
+
+        try {
+            // Refuses while the company details are incomplete, which is the
+            // correct outcome — an invoice without a registered name or a VAT
+            // number is not a valid invoice, and issuing one consumes a number
+            // that can never be handed out again. The purchase is unaffected:
+            // the order stands, the machine gets built, and the invoice can be
+            // issued from the console once the details are there.
+            return app(IssueInvoice::class)->forOrders($customer, collect([$order]));
+        } catch (Throwable $e) {
+            Log::warning('Could not issue an invoice for this order', [
+                'order' => $order->id,
+                'exception' => $e->getMessage(),
+            ]);
+
+            return null;
+        }
+    }
+
+    /**
+     * Hand the invoice to the mailer, once.
+     *
+     * `sent_at` is the stamp, the same one App\Actions\IssueStripeInvoice uses,
+     * and it is written only after the mailer has accepted the message — so a
+     * redelivery arriving after the document was written but before the mail went
+     * out finishes the job, and one arriving afterwards does neither twice.
+     *
+     * ONE mail, not two. The invoice is issued at the moment the money lands, so
+     * an order confirmation and an invoice mail would otherwise go out in the same
+     * second for the same event. The invoice mail says everything the confirmation
+     * said and carries the document, so it replaces it whenever there is one.
+     */
+    private function mailInvoiceOnce(Invoice $invoice, Customer $customer): void
+    {
+        $address = $customer->email;
+
+        if (! is_string($address) || $address === '' || $invoice->sent_at !== null) {
+            return;
+        }
+
+        try {
+            $mail = new InvoiceMail($invoice, (string) $customer->name);
+            Mail::mailer($mail->mailer)->to($address)->queue($mail);
+
+            $invoice->update(['sent_at' => now()]);
+        } catch (Throwable $e) {
+            Log::warning('Could not queue the invoice mail for this purchase', [
+                'order' => $invoice->order_id,
+                'invoice' => $invoice->number,
+                'exception' => $e->getMessage(),
+            ]);
+        }
+    }
+
+    /**
+     * Finish what a crash interrupted.
+     *
+     * The order commits before the contract is opened, so that a failure there
+     * can never erase the record of a payment — but that leaves a window in
+     * which a paid order exists with no contract and nothing running. Stripe
+     * retries until it gets a 2xx, so a retry is exactly the chance to close
+     * that window. Simply returning "already processed" would strand a paying
+     * customer permanently, because no later webhook would ever look again.
+     *
+     * Safe to run on every duplicate: opening a contract is idempotent. A run
+     * that was merely never dispatched needs no nudge from here — the scheduler
+     * tick sweeps pending runs. A run that already ran and FAILED for want of
+     * the contract does, because nothing sweeps failed runs.
+     *
+     * ## The invoice is the other half, and it used to be the half that was lost
+     *
+     * This returned as soon as a contract existed, and the only production call to
+     * IssueInvoice::forOrders() is in confirmByMail() — which runs AFTER the
+     * order commits. A worker killed in between left a paid purchase with no
+     * invoice, for good and in silence: the next redelivery found the contract
+     * already open, returned here, and nothing anywhere sweeps for an uninvoiced
+     * order. So the invoice and its mail are finished here too, on every
+     * redelivery, and the guards in invoiceOnce()/mailInvoiceOnce() are what make
+     * "however many times Stripe asks" come out as one invoice, one number and
+     * one mail.
+     */
+    private function resume(Order $order): void
+    {
+        if (! $order->subscription()->exists()) {
+            $this->openContract($order);
+
+            if ($order->subscription()->exists()) {
+                $this->reviveRunStrandedWithoutAContract($order);
+            }
+        }
+
+        $customer = $order->customer;
+
+        if ($customer === null) {
+            return;
+        }
+
+        $invoice = $this->invoiceOnce($order, $customer);
+
+        if ($invoice !== null) {
+            $this->mailInvoiceOnce($invoice, $customer);
+        }
+    }
+
+    /**
+     * Restart a run that failed only because the contract was missing.
+     *
+     * Narrow on purpose. `no_subscription` is returned before anything is built
+     * — the run never got past validating the order or reserving resources — so
+     * there is nothing half-made to trip over. A run that failed for any other
+     * reason failed at something a contract does not fix, and restarting it
+     * would just repeat whatever went wrong.
+     */
+    private function reviveRunStrandedWithoutAContract(Order $order): void
+    {
+        $run = $order->runs()->where('pipeline', 'customer')->latest('id')->first();
+
+        if ($run?->status !== ProvisioningRun::STATUS_FAILED
+            || ! str_contains((string) $run->error, 'no_subscription')) {
+            return;
+        }
+
+        // onProvisioningFailed() marked the order failed on the way down.
+        $order->update(['status' => 'paid']);
+
+        $run->update([
+            'status' => ProvisioningRun::STATUS_PENDING,
+            'current_step' => 0,
+            'attempt' => 0,
+            'next_attempt_at' => null,
+            'error' => null,
+        ]);
+
+        AdvanceRunJob::dispatch($run->uuid);
+
+        Log::info('Restarted a run that was stranded without a contract.', [
+            'order_id' => $order->id, 'run' => $run->uuid,
+        ]);
+    }
+
+    /**
+     * Freeze what they bought, while the catalogue still says what they were
+     * shown.
+     *
+     * Deliberately AFTER the order is committed, and deliberately swallowing
+     * its failure. The order is the record that money changed hands: if opening
+     * the contract could roll it back, an unsellable plan, a missing price or
+     * any unforeseen fault would erase the evidence of a payment we have
+     * already taken — and Stripe, seeing no 2xx, would retry a webhook that can
+     * never succeed. A missing contract is recoverable and loud: the run stops
+     * at ValidateOrder with `no_subscription`, in the operator's face.
+     *
+     * Two cases are expected to land here: a plan the catalogue cannot sell,
+     * and a payment in a currency it cannot price — freezing a EUR price onto a
+     * CHF payment would put the contract and the payment in permanent
+     * disagreement.
+     */
+    private function openContract(Order $order): void
+    {
+        try {
+            // A checkout that recorded its version is owed THAT version, even
+            // if the window has closed or the plan has been withdrawn since —
+            // they paid for what they were shown. Only a purchase with no
+            // recorded version has to ask what is on sale now.
+            $deliverable = $order->plan_version_id !== null
+                ? app(PlanCatalogue::class)->isDeliverable($order->plan, $order->plan_version_id)
+                : Subscription::knowsPlan($order->plan);
+
+            $sellable = $deliverable
+                && strtoupper((string) $order->currency) === Subscription::catalogueCurrency();
+
+            if (! $sellable) {
+                Log::warning('No contract opened: the catalogue cannot sell this order.', [
+                    'order_id' => $order->id, 'plan' => $order->plan, 'currency' => $order->currency,
+                ]);
+
+                return;
+            }
+
+            $subscription = ($this->openSubscription)($order);
+
+            // Anything Stripe sent about this contract before it existed —
+            // a renewal, a failure, a cancellation — applied now, in the order
+            // they were raised.
+            $this->billing->replayHeldFor($subscription);
+        } catch (Throwable $e) {
+            Log::error('Failed to open a contract for a paid order.', [
+                'order_id' => $order->id, 'plan' => $order->plan, 'error' => $e->getMessage(),
+            ]);
+        }
+    }
+
+    /**
+     * Find or create the customer, race-safe against the unique email index so a
+     * concurrent first-time purchase can't create two customers for one email.
+     *
+     * `customer_type` is deliberately NOT set here, and that is a decision
+     * rather than an omission. Nobody in this code path has asked the question:
+     * a Stripe event carries a name, an address and a payment, and none of those
+     * says whether the person buying is a consumer or a business. Writing either
+     * answer would be inventing one — so the column stays NULL, which every
+     * reader treats as a consumer, which is the protective answer. Ordinarily
+     * there is nothing to invent: the buyer signed up first and was asked then
+     * (App\Actions\Fortify\CreateNewUser). This branch is the customer whose
+     * Stripe email differs from the one they registered with, and the operator
+     * or the customer can record the answer afterwards in the portal settings.
+     *
+     * @param  array{email:string,name:?string,stripe_customer_id:?string}  $event
+     */
+    private function resolveCustomer(array $event): Customer
+    {
+        try {
+            return Customer::query()->firstOrCreate(
+                ['email' => $event['email']],
+                ['name' => $event['name'] ?? $event['email'], 'stripe_customer_id' => $event['stripe_customer_id'] ?? null],
+            );
+        } catch (UniqueConstraintViolationException) {
+            return Customer::query()->where('email', $event['email'])->firstOrFail();
+        }
+    }
+}

app/Actions/StartHostOnboarding.php

@@ -0,0 +1,55 @@
+<?php
+
+namespace App\Actions;
+
+use App\Models\Host;
+use App\Models\ProvisioningRun;
+use App\Provisioning\Jobs\AdvanceRunJob;
+use App\Support\HostName;
+use Illuminate\Support\Facades\Crypt;
+use Illuminate\Support\Facades\DB;
+
+/**
+ * Registers a fresh host and kicks off its onboarding run. The one-time root
+ * password lives encrypted in the run context and is scrubbed after SSH trust
+ * is established.
+ */
+class StartHostOnboarding
+{
+    /**
+     * @param  array{datacenter: string, public_ip: string, root_password: string}  $input
+     */
+    public function run(array $input): Host
+    {
+        // Host + run are created atomically; a partial insert would otherwise
+        // leave a permanently pending host with no run.
+        [$host, $run] = DB::transaction(function () use ($input) {
+            $host = Host::create([
+                // Den Namen vergibt CluPilot, nicht der Betreiber. Innerhalb
+                // DIESER Transaktion, weil HostName::claim die
+                // Rechenzentrums-Zeile sperrt und die Sperre nur bis zu deren
+                // Ende hält — außerhalb bekämen zwei gleichzeitige
+                // Anlegen-Vorgänge dieselbe Nummer.
+                'name' => HostName::claim($input['datacenter']),
+                'datacenter' => $input['datacenter'],
+                'public_ip' => $input['public_ip'],
+                'status' => 'pending',
+            ]);
+
+            $run = ProvisioningRun::create([
+                'subject_type' => Host::class,
+                'subject_id' => $host->id,
+                'pipeline' => 'host',
+                'status' => ProvisioningRun::STATUS_PENDING,
+                'current_step' => 0,
+                'context' => ['root_password' => Crypt::encryptString($input['root_password'])],
+            ]);
+
+            return [$host, $run];
+        });
+
+        AdvanceRunJob::dispatch($run->uuid); // after commit — the run definitely exists
+
+        return $host;
+    }
+}

app/Actions/SuspendInstance.php

@@ -0,0 +1,47 @@
+<?php
+
+namespace App\Actions;
+
+use App\Models\Instance;
+use App\Services\Proxmox\ProxmoxClient;
+use Illuminate\Support\Carbon;
+use Illuminate\Support\Facades\Log;
+
+/**
+ * Die Cloud eines Kunden abschalten, weil bezahlt werden muss.
+ *
+ * **Abschalten heisst abschalten.** Geordnet heruntergefahren, mit Zeitlimit,
+ * und NICHTS wird gelöscht: keine Platte angefasst, keine Instanz beendet, kein
+ * DNS-Eintrag entfernt, kein Backup verworfen. Alles kommt zurück, sobald
+ * bezahlt ist — das ist der Unterschied zwischen einer Sperre und einer
+ * Kündigung, und er darf im Code nicht verschwimmen.
+ *
+ * Ein Zustand, kein Ereignis: ein zweiter Tageslauf oder ein neu gestarteter
+ * Arbeiterprozess fährt nichts ein zweites Mal herunter.
+ */
+class SuspendInstance
+{
+    public function __invoke(Instance $instance): void
+    {
+        if ($instance->suspended_at !== null) {
+            return;
+        }
+
+        $vmid = $instance->vmid;
+        $node = $instance->host?->node ?? 'pve';
+
+        if ($vmid !== null) {
+            // Geordnet, nicht abgewürgt: dem Kunden gehören die Daten darin,
+            // und ein hartes Ausschalten riskiert ein beschädigtes Dateisystem
+            // für einen Rückstand von ein paar Euro.
+            app(ProxmoxClient::class)->shutdownVm($node, (int) $vmid, 120);
+        }
+
+        $instance->update(['suspended_at' => Carbon::now()]);
+
+        Log::info('Cloud wegen offener Zahlung abgeschaltet', [
+            'instance' => $instance->uuid,
+            'vmid' => $vmid,
+        ]);
+    }
+}

app/Actions/SyncStripeAddonItems.php

@@ -0,0 +1,421 @@
+<?php
+
+namespace App\Actions;
+
+use App\Models\Subscription;
+use App\Models\SubscriptionAddon;
+use App\Services\Billing\AddonPrices;
+use App\Services\Billing\TaxTreatment;
+use App\Services\Stripe\StripeClient;
+use Illuminate\Support\Collection;
+use Illuminate\Support\Facades\Log;
+use RuntimeException;
+use Throwable;
+
+/**
+ * Telling Stripe which modules a contract is paying for.
+ *
+ * A booked module was a row here and a line on the customer's first invoice, and
+ * nothing at all on the Stripe subscription — so it was charged once, in the
+ * month it was booked, and never again. This is what closes that: every module
+ * still running becomes an item on the subscription, and Stripe bills it beside
+ * the package on the same invoice, every cycle, for as long as the customer
+ * keeps it.
+ *
+ * **It reconciles rather than replays.** Not "booking adds an item, cancelling
+ * removes one": the desired state is derivable from the bookings themselves —
+ * which modules are running, at which frozen price, how many of each — and the
+ * state Stripe is in is stamped on those same rows. So this can be run at any
+ * moment, from a booking, from a cancellation or from the hourly sweep, and it
+ * settles on the same answer. That is also what makes the retry honest: a
+ * booking that could not reach Stripe leaves an active row with no item id, and
+ * there is nothing else to remember.
+ *
+ * **Proration, per direction, chosen here and nowhere else.**
+ *
+ *  - **Booking** — and taking more of a pack — settles immediately
+ *    (`always_invoice`). The owner has decided a mid-period booking is prorated
+ *    by days, and `always_invoice` is the behaviour that does exactly that AND
+ *    charges it there and then: Stripe raises its own invoice for the days that
+ *    are left and takes the money. That invoice comes back as `invoice.paid`
+ *    and is the fourth document in the owner's example. The alternative,
+ *    `create_prorations`, would park the amount as a credit line on the next
+ *    cycle invoice, and the customer would get one document a month later
+ *    carrying two different things.
+ *  - **Cancelling** — and taking fewer of a pack — settles nothing (`none`).
+ *    The customer keeps the module to the end of the term they have already paid
+ *    for and gets no credit, so there is nothing to settle; the item comes off
+ *    now and the next cycle is simply smaller.
+ *
+ * **Why the item comes off at cancellation rather than at the period end.**
+ * Stripe can cancel a SUBSCRIPTION at a period end; an item has no such thing.
+ * Waiting for the boundary and removing it then is a race against Stripe's own
+ * invoice generation, which happens at that same instant — lose it and the
+ * customer is charged a full month for a module they cancelled, which is the one
+ * mistake that costs real money. Removing it now with `none` moves no money at
+ * all: the current term is already paid for, no credit is raised, and the next
+ * cycle invoice simply has no such line. What the customer KEEPS until the
+ * period end is the module itself, and that is held on the booking as
+ * `cancels_at` and ended by clupilot:end-cancelled-addons.
+ *
+ * **Never throws.** The booking has already been made and delivered to the
+ * machine by the time this runs — a storage pack is a bigger disk before Stripe
+ * hears a word about it — and Stripe being unreachable must not undo any of
+ * that. The failure is parked on the contract in `stripe_addon_sync`, logged,
+ * and retried by clupilot:sync-stripe-subscriptions beside the plan swaps.
+ */
+class SyncStripeAddonItems
+{
+    public function __construct(
+        private StripeClient $stripe,
+        private AddonPrices $prices,
+    ) {}
+
+    /**
+     * @param  bool  $chargeForAdditions  false when an item is being PUT BACK rather than
+     *                                    bought: a cancellation taken back inside the term
+     *                                    restores something the customer has already paid
+     *                                    for, and charging the proration again would bill
+     *                                    them twice for the same days. See
+     *                                    App\Actions\BookAddon::undoCancelAtPeriodEnd().
+     * @return bool whether Stripe now bills exactly the modules this contract holds
+     */
+    public function __invoke(Subscription $subscription, bool $chargeForAdditions = true): bool
+    {
+        // A granted package was never sold through Stripe — GrantSubscription
+        // leaves stripe_subscription_id null on purpose — so there is nothing
+        // there to put an item on and nothing has gone wrong. Answered before
+        // anything else, so no call is made and no failure is recorded.
+        if ($subscription->stripe_subscription_id === null) {
+            $this->settled($subscription);
+
+            return true;
+        }
+
+        try {
+            foreach ($this->groups($subscription) as $group) {
+                $this->reconcile($subscription, $group, $chargeForAdditions);
+            }
+
+            $this->settled($subscription);
+
+            return true;
+        } catch (Throwable $e) {
+            $this->park($subscription, $e);
+
+            return false;
+        }
+    }
+
+    /**
+     * Move every module item this contract carries onto the Price that charges
+     * today's figure for it, to the customer who is paying for it.
+     *
+     * Two reasons an item is on the wrong Price, and __invoke() above finds
+     * neither of them: the item exists and the quantity is right, so it has
+     * nothing to reconcile. This is the deliberate second pass, run by
+     * stripe:reprice-subscriptions.
+     *
+     * The first is a change of figure — the catalogue moved from pushing NET
+     * amounts to Stripe to pushing the amount actually charged, and a Stripe Price
+     * cannot be edited, so every running module was on a Price that takes too
+     * little. The second is a change of CUSTOMER: a business whose VAT id is
+     * verified after they booked owes no VAT on the module either, and belongs on
+     * its net Price from then on — the reverse too, when a registration lapses.
+     *
+     * PRORATE_NONE throughout. The customer has already paid for the term they
+     * are in, at whatever was taken then; charging the difference for days
+     * already served would be a bill nobody agreed to. From the next cycle
+     * Stripe simply takes the right amount.
+     *
+     * The module's own frozen `price_cents` is untouched, because that is what
+     * the customer agreed to pay net and it is what every pro-rata sum reads.
+     *
+     * @return array<int, array{addon: string, from: ?string, to: ?string}> what moved, for the command's output
+     */
+    public function reprice(Subscription $subscription, bool $dryRun = false): array
+    {
+        if ($subscription->stripe_subscription_id === null) {
+            return [];
+        }
+
+        $moved = [];
+
+        foreach ($this->groups($subscription) as $group) {
+            $billable = $group->filter(
+                fn (SubscriptionAddon $addon) => $addon->cancelled_at === null && $addon->cancels_at === null
+            );
+
+            $stamped = $group->filter(fn (SubscriptionAddon $addon) => $addon->stripe_item_id !== null);
+            $itemId = $stamped->first()?->stripe_item_id;
+            $first = $billable->first();
+
+            // Nothing Stripe is billing, or nothing it should be: __invoke()
+            // owns both of those cases and would undo whatever this did.
+            if ($itemId === null || $first === null || (int) $first->price_cents <= 0) {
+                continue;
+            }
+
+            $target = $this->prices->liveFor(
+                (string) $first->addon_key,
+                (int) $first->price_cents,
+                (string) $first->currency,
+                (string) $subscription->term,
+                TaxTreatment::for($subscription->customer),
+            );
+
+            $current = $stamped->first()?->stripe_price_id;
+
+            if ($target !== null && $target === $current) {
+                continue;
+            }
+
+            $moved[] = ['addon' => (string) $first->addon_key, 'from' => $current, 'to' => $target];
+
+            if ($dryRun) {
+                continue;
+            }
+
+            $this->guardConfigured();
+
+            // Minted here where the sweep left a figure the catalogue no longer
+            // pre-creates — a grandfathered booking, or a discounted grant.
+            $target ??= $this->prices->ensure(
+                (string) $first->addon_key,
+                (int) $first->price_cents,
+                (string) $first->currency,
+                (string) $subscription->term,
+                TaxTreatment::for($subscription->customer),
+            );
+
+            if ($target === null) {
+                // Nothing to bill for it after all — a module given away. Taken
+                // back out of the report rather than announced as a move.
+                array_pop($moved);
+
+                continue;
+            }
+
+            $moved[count($moved) - 1]['to'] = $target;
+
+            $this->stripe->updateSubscriptionPrice(
+                (string) $subscription->stripe_subscription_id,
+                $itemId,
+                $target,
+                StripeClient::PRORATE_NONE,
+            );
+
+            $this->stamp($group, $itemId, $target);
+        }
+
+        return $moved;
+    }
+
+    /**
+     * The bookings that matter, grouped into the items they should be.
+     *
+     * By module AND by frozen price, because that pair is what a Stripe Price
+     * is: two packs booked at the same money are one item with a quantity of
+     * two, and a third booked after the catalogue moved is a second item at the
+     * price that customer agreed to. Grouping by module alone would have to pick
+     * one of two prices and charge everybody that.
+     *
+     * Cancelled bookings are in here as long as they still carry an item id —
+     * that is the only record of what Stripe was last told, and without it the
+     * quantity could never be brought back down.
+     *
+     * @return Collection<string, Collection<int, SubscriptionAddon>>
+     */
+    private function groups(Subscription $subscription): Collection
+    {
+        return SubscriptionAddon::query()
+            ->where('subscription_id', $subscription->id)
+            ->where(fn ($q) => $q->whereNull('cancelled_at')->orWhereNotNull('stripe_item_id'))
+            ->orderBy('id')
+            ->get()
+            ->groupBy(fn (SubscriptionAddon $addon) => $addon->addon_key.'@'.$addon->price_cents);
+    }
+
+    /**
+     * Bring one module's item into step with what the contract holds.
+     *
+     * @param  Collection<int, SubscriptionAddon>  $group
+     */
+    private function reconcile(Subscription $subscription, Collection $group, bool $chargeForAdditions = true): void
+    {
+        // What Stripe should bill: every booking still running and not already
+        // on its way out. A module with `cancels_at` set is deliberately absent
+        // — the customer keeps it, nobody is billed for it again.
+        $billable = $group->filter(
+            fn (SubscriptionAddon $addon) => $addon->cancelled_at === null && $addon->cancels_at === null
+        );
+
+        // What Stripe was last told, read off the rows that carry the item id.
+        $stamped = $group->filter(fn (SubscriptionAddon $addon) => $addon->stripe_item_id !== null);
+
+        $desired = (int) $billable->sum('quantity');
+        $known = (int) $stamped->sum('quantity');
+        $itemId = $stamped->first()?->stripe_item_id;
+
+        $first = $group->first();
+
+        // A module given away costs nothing, so there is nothing for Stripe to
+        // bill — and a zero-amount item would put a line saying so on every
+        // invoice the customer ever gets. Treated exactly like a module that is
+        // no longer held: if one was ever billed, it comes off.
+        if ($desired === 0 || (int) $first->price_cents <= 0) {
+            if ($itemId !== null) {
+                $this->guardConfigured();
+                $this->stripe->removeSubscriptionItem($itemId, StripeClient::PRORATE_NONE);
+            }
+
+            $this->stamp($group, null, null);
+
+            return;
+        }
+
+        // Stripe already bills exactly this. Only the bookings are restamped —
+        // one may have been cancelled while another was booked in the same
+        // breath, which leaves the quantity right and the rows out of date.
+        if ($itemId !== null && $known === $desired) {
+            $this->stamp($group, $itemId, $stamped->first()?->stripe_price_id);
+
+            return;
+        }
+
+        // Asked for only now that something is going to be said to Stripe: an
+        // unconfigured account must fail here, where it is parked and retried,
+        // rather than while resolving a Price nobody is going to use.
+        $this->guardConfigured();
+
+        $priceId = $this->prices->ensure(
+            (string) $first->addon_key,
+            (int) $first->price_cents,
+            (string) $first->currency,
+            (string) $subscription->term,
+            // Whoever holds the contract decides which of the module's Prices its
+            // item bills through: the domestic gross, or the bare net where the
+            // customer is a verified business in another member state. A module is
+            // a supply like the package beside it and cannot be taxed differently
+            // from it on the same invoice.
+            TaxTreatment::for($subscription->customer),
+        );
+
+        if ($priceId === null) {
+            $this->stamp($group, null, null);
+
+            return;
+        }
+
+        if ($itemId === null) {
+            $itemId = $this->stripe->addSubscriptionItem(
+                (string) $subscription->stripe_subscription_id,
+                $priceId,
+                $desired,
+                $chargeForAdditions ? StripeClient::PRORATE_IMMEDIATELY : StripeClient::PRORATE_NONE,
+                // Keyed on the contract, the module and how many of it: a retry
+                // after a timeout that in fact went through replays Stripe's
+                // first answer instead of adding the module a second time.
+                idempotencyKey: sprintf(
+                    'clupilot-addon-item-%d-%s-%d-%d',
+                    $subscription->id,
+                    $first->addon_key,
+                    $first->price_cents,
+                    $desired,
+                ),
+            );
+        } else {
+            $this->stripe->updateSubscriptionItemQuantity(
+                $itemId,
+                $desired,
+                // More of a pack is bought now and paid for the days that are
+                // left; fewer is a cancellation, which earns no credit. A
+                // restoration is neither and settles nothing.
+                $desired > $known && $chargeForAdditions
+                    ? StripeClient::PRORATE_IMMEDIATELY
+                    : StripeClient::PRORATE_NONE,
+            );
+        }
+
+        $this->stamp($group, $itemId, $priceId);
+    }
+
+    /**
+     * Write down what Stripe now bills, on the bookings it bills.
+     *
+     * Every running booking in the group carries the item id, so a second pack
+     * booked tomorrow can see that it is joining an item rather than starting
+     * one. A booking that has stopped gives its id back, because the quantity
+     * has already been taken down by it and counting it again would take the
+     * same pack off twice.
+     *
+     * Through the query builder: none of these columns is part of what the
+     * booking froze, and the model would otherwise have to be re-read first.
+     *
+     * @param  Collection<int, SubscriptionAddon>  $group
+     */
+    private function stamp(Collection $group, ?string $itemId, ?string $priceId): void
+    {
+        foreach ($group as $addon) {
+            $billed = $itemId !== null && $addon->cancelled_at === null && $addon->cancels_at === null;
+
+            $values = [
+                'stripe_item_id' => $billed ? $itemId : null,
+                'stripe_price_id' => $billed ? $priceId : null,
+            ];
+
+            if ($addon->stripe_item_id === $values['stripe_item_id']
+                && $addon->stripe_price_id === $values['stripe_price_id']) {
+                continue;
+            }
+
+            SubscriptionAddon::query()->whereKey($addon->getKey())->update($values + ['updated_at' => now()]);
+
+            $addon->forceFill($values)->syncOriginal();
+        }
+    }
+
+    private function guardConfigured(): void
+    {
+        if (! $this->stripe->isConfigured()) {
+            throw new RuntimeException('Stripe is not configured (STRIPE_SECRET is empty).');
+        }
+    }
+
+    /** Stripe bills exactly what the contract holds; nothing is outstanding. */
+    private function settled(Subscription $subscription): void
+    {
+        if ($subscription->stripe_addon_sync === null) {
+            return;
+        }
+
+        $subscription->update(['stripe_addon_sync' => null]);
+    }
+
+    /**
+     * A module was booked or cancelled here and Stripe was not told.
+     *
+     * On the contract rather than only in a log line, for the same reason as
+     * `stripe_price_sync` beside it: what this describes is a customer holding a
+     * module nobody is billing them for — or being billed for one they gave up —
+     * and a log line scrolls away.
+     */
+    private function park(Subscription $subscription, Throwable $e): void
+    {
+        $parked = (array) ($subscription->stripe_addon_sync ?? []);
+        $attempts = (int) ($parked['attempts'] ?? 0) + 1;
+
+        Log::error('A module booking landed but did not reach Stripe: this contract is not billed for what it holds.', [
+            'subscription' => $subscription->uuid,
+            'stripe_subscription' => $subscription->stripe_subscription_id,
+            'attempts' => $attempts,
+            'error' => $e->getMessage(),
+        ]);
+
+        $subscription->update(['stripe_addon_sync' => [
+            'error' => mb_substr($e->getMessage(), 0, 250),
+            'failed_at' => now()->toIso8601String(),
+            'attempts' => $attempts,
+        ]]);
+    }
+}

app/Actions/VerifyCustomerVatId.php

@@ -0,0 +1,84 @@
+<?php
+
+namespace App\Actions;
+
+use App\Models\Customer;
+use App\Services\Tax\VatIdCheck;
+use App\Services\Tax\VatIdVerifier;
+
+/**
+ * Ask the register about a customer's VAT number and record what it said.
+ *
+ * The one place a check becomes a stored verification, so the portal form, the
+ * console and the nightly re-check cannot disagree about what counts. It decides
+ * nothing about tax: TaxTreatment reads the stored verification and applies the
+ * reverse-charge rule. This only answers "is the number real".
+ *
+ * Deliberately not gated on the customer's recorded type. Whether a verified
+ * number earns reverse charge is TaxTreatment's question — it already refuses a
+ * customer who has recorded themselves as a private person — and a number that
+ * is registered is registered whoever holds it. Splitting that decision across
+ * two files is how the two would drift.
+ */
+class VerifyCustomerVatId
+{
+    public function __construct(private VatIdVerifier $verifier) {}
+
+    /**
+     * Returns what the register said, so the caller can tell the customer.
+     *
+     * Null when there is no number to check at all — not an outcome, an absence,
+     * and a caller showing "invalid" for an empty field would be wrong.
+     */
+    public function __invoke(Customer $customer): ?VatIdCheck
+    {
+        $vatId = $customer->normalisedVatId();
+
+        if ($vatId === '') {
+            // Removing the number removes the verification with it. Otherwise the
+            // stamp would sit on the record with nothing to compare against, and
+            // the next number typed in would look pre-verified for one save.
+            $this->clear($customer);
+
+            return null;
+        }
+
+        $check = $this->verifier->check($vatId);
+
+        // The whole reason VatIdCheck has three outcomes. An outage tells us
+        // nothing, so nothing is written: a verification that has been standing
+        // for months must not be cleared — and a customer's invoices changed —
+        // because a national register was down for the night.
+        if ($check->isUnavailable()) {
+            return $check;
+        }
+
+        if ($check->isInvalid()) {
+            $this->clear($customer);
+
+            return $check;
+        }
+
+        // Bound to the value that was checked, not to a flag. Customer::
+        // hasVerifiedVatId() compares the two, so editing the number afterwards
+        // cannot inherit this confirmation whichever code path does the editing.
+        $customer->forceFill([
+            'vat_id_verified_at' => now(),
+            'vat_id_verified_value' => $vatId,
+        ])->save();
+
+        return $check;
+    }
+
+    private function clear(Customer $customer): void
+    {
+        if ($customer->vat_id_verified_at === null && $customer->vat_id_verified_value === null) {
+            return;
+        }
+
+        $customer->forceFill([
+            'vat_id_verified_at' => null,
+            'vat_id_verified_value' => null,
+        ])->save();
+    }
+}

app/Actions/WithdrawContract.php

@@ -0,0 +1,548 @@
+<?php
+
+namespace App\Actions;
+
+use App\Models\Instance;
+use App\Models\Invoice;
+use App\Models\Operator;
+use App\Models\Subscription;
+use App\Models\SubscriptionAddon;
+use App\Models\SubscriptionRecord;
+use App\Services\Billing\IssueInvoice;
+use App\Services\Billing\WithdrawalRight;
+use App\Services\Stripe\StripeClient;
+use Illuminate\Support\Carbon;
+use Illuminate\Support\Collection;
+use Illuminate\Support\Facades\Log;
+use RuntimeException;
+use Throwable;
+
+/**
+ * A consumer changes their mind inside fourteen days, and everything that
+ * follows from it.
+ *
+ * One action, because a withdrawal is one event with four consequences and
+ * three of them are irreversible. Split across a controller, a command and a
+ * page, they would come apart: a service ended with no credit note, a refund
+ * sent for a contract still running, a document issued twice by two clicks.
+ *
+ * In order, and the order is the design:
+ *
+ *  1. **The right is checked**, by WithdrawalRight and nowhere else. A business
+ *     customer is refused here, on the server, whatever the page did or did not
+ *     show — every door into this action is the same door.
+ *  2. **The withdrawal is claimed**, conditionally, on the contract. Two clicks
+ *     in flight write one withdrawal between them; the loser is told it has
+ *     already happened rather than sending a second refund.
+ *  3. **The paperwork**: EVERY invoice raised inside the window is CANCELLED by a
+ *     Storno with its own number — never edited, never deleted. That is the
+ *     established rule for correcting an issued document, and a withdrawal is the
+ *     clearest case there is for it. Every one of them, and not just the opening
+ *     purchase: a module booked on day three and a renewal that fell inside the
+ *     fourteen days are charges too, and they used to be left standing because
+ *     they carry no `order_id` — see chargesInsideTheWindow().
+ *  4. **The money**, which falls out of the paperwork rather than being
+ *     computed beside it: the whole of what each cancelled document said, sent
+ *     back against the payment that actually took it. FAGG §16 would let us keep
+ *     the pro-rata value of the days the cloud ran, and the owner has decided not
+ *     to — a withdrawing consumer gets everything back. Two sums that must agree
+ *     cannot disagree if only one of them is ever calculated, and here there is
+ *     only the one: the Stornos'.
+ *  5. **The service ends**, through App\Actions\EndInstanceService and the
+ *     `cancellation_scheduled` machinery it already reads — the address comes
+ *     down, the DNS record goes, the instance is marked ended. No second way
+ *     for an instance to stop being served. Stripe is told to stop billing in
+ *     the same breath, immediately: a withdrawal unwinds the contract, so there
+ *     is no paid-up term to run out and no next cycle to raise.
+ *
+ * ## What happens when the money side fails
+ *
+ * It is caught, written onto the contract and logged as an error — and the
+ * withdrawal still stands. The customer's declaration is what ends the
+ * contract; a payment provider being unreachable does not un-declare it, and
+ * leaving the service running because a refund timed out would charge them for
+ * days they have withdrawn from. `withdrawal_refund_error` is where an operator
+ * finds the ones that need a hand.
+ */
+class WithdrawContract
+{
+    /** Recorded by the customer themselves, in the portal. */
+    public const CHANNEL_PORTAL = 'portal';
+
+    /** Taken by telephone or post and typed in by an operator. */
+    public const CHANNEL_OPERATOR = 'operator';
+
+    public function __construct(
+        private EndInstanceService $endService,
+        private BookAddon $bookAddon,
+        private IssueInvoice $invoices,
+        private StripeClient $stripe,
+        private RecordCommercialEvent $record,
+    ) {}
+
+    /**
+     * @param  string  $channel  one of the CHANNEL_* constants
+     * @param  Operator|null  $by  the operator who took the declaration, when it did not come from the portal
+     *
+     * @throws RuntimeException with the sentence the customer is shown, when the right does not apply
+     */
+    public function __invoke(
+        Subscription $subscription,
+        string $channel = self::CHANNEL_PORTAL,
+        ?Operator $by = null,
+        ?Carbon $at = null,
+    ): Subscription {
+        $at ??= now();
+
+        $right = WithdrawalRight::for($subscription);
+
+        if (! $right->open) {
+            // The refusal is the customer's own sentence, not a developer's:
+            // whatever refuses — the portal, the console, a stale tab — says
+            // the same thing, in the same words.
+            throw new RuntimeException((string) ($right->refusal ?? __('withdrawal.refusal_expired')));
+        }
+
+        // The one atomic gate. Everything below happens exactly once because
+        // exactly one caller can turn this column over.
+        $claimed = Subscription::query()
+            ->whereKey($subscription->getKey())
+            ->whereNull('withdrawn_at')
+            ->update([
+                'withdrawn_at' => $at,
+                'withdrawal_channel' => $channel,
+                'withdrawal_recorded_by' => $by?->id,
+                'updated_at' => now(),
+            ]);
+
+        $subscription->refresh();
+
+        if ($claimed === 0) {
+            throw new RuntimeException(__('withdrawal.refusal_already'));
+        }
+
+        $refunded = $this->settle($subscription, $at);
+
+        $this->endEverything($subscription, $at);
+
+        $this->enterInRegister($subscription, $refunded, $at);
+
+        return $subscription->refresh();
+    }
+
+    /**
+     * The paperwork and the money, for every charge inside the window.
+     *
+     * One Storno per document and one refund per payment, because that is what
+     * each of the two things IS: a Storno mirrors exactly one invoice and carries
+     * its number, and a Stripe refund goes against exactly one payment. A single
+     * refund for the whole sum, sent against the opening payment, would be
+     * refused by Stripe for exceeding it — which is the trap the old one-invoice
+     * version was hiding behind.
+     *
+     * Each charge is settled in its own try, so a module invoice whose payment
+     * cannot be reached does not stop the opening purchase from being refunded.
+     * What actually went back is totalled from the refunds that succeeded, never
+     * from what was intended — a contract claiming money moved that did not is
+     * the one state nobody may discover three weeks later.
+     *
+     * @return int what actually went back to the customer, gross, in cents
+     */
+    private function settle(Subscription $subscription, Carbon $at): int
+    {
+        $charges = $this->chargesInsideTheWindow($subscription, $at);
+        $refunded = 0;
+        $references = [];
+        $failed = false;
+
+        if ($charges->isEmpty()) {
+            // No document was ever issued for this purchase — the company
+            // details were incomplete when it was made, or it was a grant. There
+            // is nothing to cancel, so the refund is worked out from what was
+            // charged instead. Stated here rather than silently skipped: a
+            // withdrawal without paperwork is a withdrawal an accountant will
+            // ask about.
+            try {
+                $gross = max(0, $subscription->order?->chargedCents() ?? 0);
+
+                $reference = $this->refund(
+                    $subscription,
+                    $gross,
+                    $this->paymentBehind(null, $subscription),
+                    'clupilot-withdrawal-'.$subscription->uuid,
+                    $at,
+                );
+
+                if ($reference !== null) {
+                    $refunded += $gross;
+                    $references[] = $reference;
+                }
+            } catch (Throwable $e) {
+                $this->parkMoneyFailure($subscription, $e);
+                $failed = true;
+            }
+        }
+
+        foreach ($charges as $invoice) {
+            try {
+                // Taken back in full, with its own gapless number, pointing at
+                // the one it cancels. The original keeps its number for ever.
+                $storno = $this->invoices->cancelling($invoice);
+
+                // The refund IS what the cancellation took back — never a second
+                // figure computed beside it, which would have to agree with the
+                // document and one day would not.
+                $gross = max(0, -(int) $storno->gross_cents);
+
+                $reference = $this->refund(
+                    $subscription,
+                    $gross,
+                    $this->paymentBehind($invoice, $subscription),
+                    // Keyed per DOCUMENT and not per contract. One key for the
+                    // whole withdrawal would have Stripe replay the first
+                    // refund's answer for the second, and the second charge
+                    // would silently never be sent back at all.
+                    'clupilot-withdrawal-'.$subscription->uuid.'-invoice-'.$invoice->id,
+                    $at,
+                );
+
+                if ($reference !== null) {
+                    $refunded += $gross;
+                    $references[] = $reference;
+                }
+            } catch (Throwable $e) {
+                $this->parkMoneyFailure($subscription, $e);
+                $failed = true;
+            }
+        }
+
+        $subscription->update([
+            'withdrawal_refund_cents' => $refunded,
+            // Every reference, because there is a refund per charge and an
+            // operator reconciling this against Stripe needs all of them.
+            'withdrawal_refund_reference' => $references === []
+                ? null
+                : mb_substr(implode(',', $references), 0, 250),
+            // Cleared only when nothing went wrong. parkMoneyFailure() has
+            // already written the reason otherwise, and clearing it here would
+            // erase the one note saying this withdrawal needs a hand.
+            ...($failed ? [] : ['withdrawal_refund_error' => null]),
+        ]);
+
+        return $refunded;
+    }
+
+    /**
+     * Every charge this contract raised inside the withdrawal window.
+     *
+     * `invoices.order_id` alone was the defect: only the opening purchase carries
+     * one. A renewal and a Stripe-invoice document are written against the
+     * CONTRACT and leave `order_id` null on purpose — see
+     * IssueInvoice::forBilledPeriod() and forStripeInvoice(), which say why — so a
+     * customer who booked a storage pack on day three and withdrew on day ten had
+     * that pack neither cancelled nor refunded. The owner's rule is that a
+     * withdrawing consumer gets EVERYTHING back, so every document has to be in
+     * this list.
+     *
+     * Both links, therefore, and both are needed: the opening invoice has an
+     * `order_id` and no `subscription_id`, and everything after it is the other
+     * way round.
+     *
+     * Cancellations are excluded by construction — one is not an invoice that can
+     * be taken back — and so is anything that already carries a Storno.
+     * IssueInvoice::cancelling() refuses the latter in its own right; excluding it
+     * here as well means a second withdrawal attempt finds nothing to do rather
+     * than raising an exception that would be parked as a money failure.
+     *
+     * Bounded at the moment of withdrawal rather than at fourteen days. It is the
+     * same set — a withdrawal can only be declared inside the window, so every
+     * document this contract has is inside it — and the bound that matters is
+     * "before the customer changed their mind", which is what `$at` is.
+     *
+     * @return Collection<int, Invoice>
+     */
+    private function chargesInsideTheWindow(Subscription $subscription, Carbon $at): Collection
+    {
+        return Invoice::query()
+            ->where(function ($query) use ($subscription) {
+                $query->where('subscription_id', $subscription->id);
+
+                if ($subscription->order_id !== null) {
+                    $query->orWhere('order_id', $subscription->order_id);
+                }
+            })
+            ->whereNull('cancels_invoice_id')
+            ->whereNotIn(
+                'id',
+                Invoice::query()->whereNotNull('cancels_invoice_id')->select('cancels_invoice_id')
+            )
+            ->where('created_at', '<=', $at)
+            ->orderBy('id')
+            ->get();
+    }
+
+    /**
+     * The Stripe payment a charge was settled by.
+     *
+     * Stripe refunds a PAYMENT, not a subscription and not an invoice, and each
+     * charge inside the window was a different payment: the checkout, a renewal,
+     * a module prorated in the middle of a term. So every document is sent back
+     * against the money that actually paid for it.
+     *
+     * The opening purchase is the one document with no Stripe invoice of its own —
+     * it is written from the ORDER, which is where the checkout's PaymentIntent
+     * was recorded, falling back to the invoice that charged the card, resolved
+     * through Stripe once. A contract with neither was never paid for through
+     * Stripe at all (a grant, a contract opened by hand), and there is nothing to
+     * send back.
+     */
+    private function paymentBehind(?Invoice $invoice, Subscription $subscription): ?string
+    {
+        if ($invoice?->stripe_invoice_id !== null) {
+            return $this->stripe->invoicePaymentReference((string) $invoice->stripe_invoice_id);
+        }
+
+        $order = $subscription->order;
+        $reference = $order?->stripe_payment_intent_id;
+
+        if ($reference === null && $order?->stripe_invoice_id !== null) {
+            $reference = $this->stripe->invoicePaymentReference((string) $order->stripe_invoice_id);
+        }
+
+        return $reference;
+    }
+
+    /**
+     * Put one charge's money back where it came from.
+     *
+     * @return string|null Stripe's reference for the refund, or null when there
+     *                     was nothing to send back
+     */
+    private function refund(
+        Subscription $subscription,
+        int $grossCents,
+        ?string $reference,
+        string $idempotencyKey,
+        Carbon $at,
+    ): ?string {
+        if ($grossCents <= 0) {
+            return null;
+        }
+
+        if ($reference === null) {
+            throw new RuntimeException(
+                'No Stripe payment is recorded for this charge, so the refund has to be sent by hand.'
+            );
+        }
+
+        // A retry after a timeout that in fact went through replays Stripe's
+        // first answer rather than sending the money a second time — which is
+        // the single most expensive mistake this file could make.
+        $refundId = $this->stripe->refund($reference, $grossCents, idempotencyKey: $idempotencyKey);
+
+        Log::info('Refunded a withdrawal.', [
+            'subscription' => $subscription->uuid,
+            'refund' => $refundId,
+            'gross_cents' => $grossCents,
+            'withdrawn_at' => $at->toIso8601String(),
+        ]);
+
+        return $refundId;
+    }
+
+    /**
+     * A withdrawn contract ends: the modules stop, the address comes down and
+     * the contract is closed.
+     *
+     * Through the machinery that already does this, never beside it. The
+     * instance is put into `cancellation_scheduled` with its service ending NOW
+     * — which is what a withdrawal means, unlike a cancellation, where the
+     * customer keeps the term they paid for — and EndInstanceService is asked
+     * the same question it is asked by the nightly sweep.
+     *
+     * The modules are ended outright rather than at the period end, for the same
+     * reason: there is no term left to keep. The customer has withdrawn from the
+     * contract the modules hang off, and BookAddon::cancel() takes them off
+     * Stripe and out of the register.
+     *
+     * The order of the two Stripe calls is the reason the subscription is stopped
+     * LAST and not first. BookAddon::cancel() takes each module's item off the
+     * subscription, and an item cannot be removed from a subscription that no
+     * longer exists — so cancelling the whole thing first would make every one of
+     * those removals fail and park a sync error on a contract that is already
+     * over.
+     */
+    private function endEverything(Subscription $subscription, Carbon $at): void
+    {
+        foreach (SubscriptionAddon::query()->where('subscription_id', $subscription->id)->active()->get() as $addon) {
+            $this->bookAddon->cancel($addon);
+        }
+
+        $this->stopBilling($subscription);
+
+        $instance = $this->instanceOf($subscription);
+
+        if ($instance !== null && $instance->status !== 'ended') {
+            $instance->update([
+                'status' => 'cancellation_scheduled',
+                'cancel_requested_at' => $at,
+                // Now, not the end of the term. A withdrawal unwinds the
+                // contract; there is no paid-up period to run out.
+                'service_ends_at' => $at,
+            ]);
+
+            ($this->endService)($instance->refresh());
+        }
+
+        $subscription->update([
+            'status' => 'cancelled',
+            'cancelled_at' => $at,
+        ]);
+    }
+
+    /**
+     * Tell Stripe to stop, now.
+     *
+     * The call nothing in this application used to make. A withdrawal marked the
+     * contract cancelled, ended the service and sent the money back, and the
+     * subscription at Stripe went on charging the card every month — for a
+     * machine that had been switched off, with `invoice.paid` arriving here each
+     * time and drawing a real invoice number for it.
+     *
+     * Immediately and not at the period end, which is the whole difference
+     * between this and a customer's own cancellation: a withdrawal unwinds the
+     * contract from the beginning, the entire amount has just gone back, and
+     * there is no paid-up term left for the customer to use up.
+     *
+     * A failure does not un-declare the withdrawal — same principle as the refund,
+     * for the same reason — but it is the most urgent thing on this contract, so
+     * it is said on the contract as well as in the log. Written after settle(),
+     * so the note cannot be cleared by a refund that succeeded.
+     */
+    private function stopBilling(Subscription $subscription): void
+    {
+        // Nothing to stop, and nothing has gone wrong. A granted package was
+        // never sold through Stripe — GrantSubscription leaves the id null on
+        // purpose — and neither was a contract opened by hand.
+        if ($subscription->stripe_subscription_id === null) {
+            return;
+        }
+
+        try {
+            $this->stripe->cancelSubscription(
+                (string) $subscription->stripe_subscription_id,
+                StripeClient::CANCEL_IMMEDIATELY,
+                // Keyed on the contract, because a contract is withdrawn from
+                // once. A retry after a timeout replays Stripe's first answer.
+                idempotencyKey: 'clupilot-withdrawal-stop-'.$subscription->uuid,
+            );
+        } catch (Throwable $e) {
+            Log::error('A withdrawal was declared and Stripe was not told to stop charging for it.', [
+                'subscription' => $subscription->uuid,
+                'stripe_subscription' => $subscription->stripe_subscription_id,
+                'error' => $e->getMessage(),
+            ]);
+
+            $this->note($subscription, 'Stripe was not told to stop: '.$e->getMessage());
+        }
+    }
+
+    /**
+     * The machine this contract pays for.
+     *
+     * `subscriptions.instance_id` is the link, and it is written when resources
+     * are reserved — so a contract withdrawn from before the build got that far
+     * has none. The order and then the customer are the fallbacks, in that
+     * order, because an order belongs to exactly one purchase and a customer can
+     * have more than one instance behind them.
+     */
+    private function instanceOf(Subscription $subscription): ?Instance
+    {
+        if ($subscription->instance !== null) {
+            return $subscription->instance;
+        }
+
+        if ($subscription->order_id !== null) {
+            $byOrder = Instance::query()->where('order_id', $subscription->order_id)->latest('id')->first();
+
+            if ($byOrder !== null) {
+                return $byOrder;
+            }
+        }
+
+        return Instance::query()
+            ->where('customer_id', $subscription->customer_id)
+            ->whereIn('status', ['active', 'provisioning', 'cancellation_scheduled'])
+            ->latest('id')
+            ->first();
+    }
+
+    /**
+     * The refund did not go out. Said on the contract, not only in a log.
+     *
+     * What this describes is a customer who has withdrawn, whose service has
+     * stopped, and who has not had their money back — the one state nobody may
+     * discover from a log file three weeks later.
+     */
+    private function parkMoneyFailure(Subscription $subscription, Throwable $e): void
+    {
+        Log::error('A withdrawal was declared but the money did not go back.', [
+            'subscription' => $subscription->uuid,
+            'customer' => $subscription->customer_id,
+            'error' => $e->getMessage(),
+        ]);
+
+        $this->note($subscription, $e->getMessage());
+    }
+
+    /**
+     * Write a sentence an operator has to read onto the contract itself.
+     *
+     * Appended rather than overwritten, because a withdrawal can go wrong in more
+     * than one way at once — a module invoice whose payment could not be reached
+     * AND an order to stop billing that Stripe refused — and an operator who read
+     * only the last of them would send the money back and leave the customer
+     * subscribed.
+     */
+    private function note(Subscription $subscription, string $sentence): void
+    {
+        $existing = trim((string) $subscription->withdrawal_refund_error);
+
+        $subscription->update([
+            'withdrawal_refund_error' => mb_substr(
+                $existing === '' ? $sentence : $existing.' | '.$sentence,
+                0,
+                250,
+            ),
+        ]);
+    }
+
+    /**
+     * The entry that says this happened, in the register that cannot be edited.
+     *
+     * Negative, because it is revenue leaving. The gross is what actually went
+     * back, so a withdrawal that could not be refunded records a zero and the
+     * `withdrawal_refund_error` beside it says why — rather than claiming money
+     * moved that did not.
+     */
+    private function enterInRegister(Subscription $subscription, int $refundedGross, Carbon $at): void
+    {
+        ($this->record)(
+            event: SubscriptionRecord::EVENT_WITHDRAWAL,
+            subscription: $subscription->refresh(),
+            netCents: -(int) $subscription->price_cents,
+            at: $at,
+            extra: ['withdrawal' => [
+                'channel' => $subscription->withdrawal_channel,
+                // Nothing is charged for them — the refund is the whole amount —
+                // but how long the service actually ran is a fact about this
+                // contract, and the register is where facts about it are kept.
+                'delivered_days' => WithdrawalRight::deliveredDays($subscription, $at),
+                'term_days' => WithdrawalRight::termDays($subscription),
+                'refunded_gross_cents' => $refundedGross,
+            ]],
+            chargedGrossCents: -$refundedGross,
+            eventKey: 'withdrawal:'.$subscription->uuid,
+        );
+    }
+}

app/Console/Commands/AdvanceDunning.php

@@ -0,0 +1,237 @@
+<?php
+
+namespace App\Console\Commands;
+
+use App\Actions\SuspendInstance;
+use App\Models\DunningCase;
+use App\Services\Billing\DunningMailer;
+use App\Services\Billing\DunningSchedule;
+use App\Services\Stripe\StripeClient;
+use Illuminate\Console\Command;
+use Illuminate\Support\Carbon;
+use Illuminate\Support\Facades\Log;
+use Throwable;
+
+/**
+ * Der Tageslauf des Mahnwesens: fällige Fälle eine Stufe weiter.
+ *
+ * Eine Stufe je Lauf, nie zwei. Der Zeitplaner ruft das täglich, und ein
+ * Betreiber ruft es von Hand dazwischen — zwei Stufen an einem Tag wären zwei
+ * Mahnungen und zwei Gebühren für denselben Rückstand.
+ *
+ * **Die nächste Frist rechnet vom BEGINN des Falls, nicht von heute.** Sonst
+ * verschöbe sich der ganze Plan mit jedem Lauf, der einen Tag zu spät kommt:
+ * aus 24 Tagen bis zur Sperre würden unbemerkt dreissig, und der Kunde bekäme
+ * seine dritte Mahnung, wenn er längst mit einem Anwalt spricht.
+ *
+ * Ein Fall, der stolpert, hält die anderen nicht auf. Stripe kann für einen
+ * Kunden ausfallen, während es für alle anderen antwortet — und ein Mahnlauf,
+ * der beim ersten Fehler abbricht, lässt genau die Fälle liegen, die am
+ * längsten offen sind.
+ */
+class AdvanceDunning extends Command
+{
+    protected $signature = 'clupilot:advance-dunning {--dry-run : Nur zeigen, was geschähe}';
+
+    protected $description = 'Fällige Mahnfälle eine Stufe weiterschalten';
+
+    /**
+     * Was in `fee_invoice_ids` steht, solange die Antwort von Stripe fehlt.
+     *
+     * Der Eintrag entsteht VOR dem Aufruf und verhindert damit eine zweite
+     * Buchung derselben Stufe — auch dann, wenn niemand mehr erfährt, welche
+     * Rechnung dabei entstanden ist.
+     */
+    public const PENDING = 'pending';
+
+    public function handle(StripeClient $stripe): int
+    {
+        $now = Carbon::now();
+        $dryRun = (bool) $this->option('dry-run');
+
+        // Zuerst nachholen, was nie hinausging. Ein Fall, dessen Mail
+        // scheiterte, rückte trotzdem weiter — der Kunde wurde gemahnt und
+        // später abgeschaltet, ohne es je zu erfahren. Das läuft VOR dem
+        // Weiterrücken, damit eine nachgeholte Nachricht nicht sofort von der
+        // nächsten Stufe überholt wird.
+        //
+        // Im Trockenlauf NICHT. Meine erste Fassung stellte diesen Aufruf vor
+        // die Abfrage auf --dry-run: ein Befehl, der „nur zeigt, was geschähe",
+        // verschickte damit Kundenmails und schrieb in die Datenbank.
+        $this->catchUpNotices($dryRun);
+
+        $faellig = DunningCase::query()
+            ->whereNull('settled_at')
+            ->where('level', '<', DunningSchedule::SUSPENDED)
+            ->whereNotNull('next_step_at')
+            ->where('next_step_at', '<=', $now)
+            ->with('subscription.customer')
+            ->get();
+
+        if ($faellig->isEmpty()) {
+            $this->info('Kein Mahnfall ist fällig.');
+
+            return self::SUCCESS;
+        }
+
+        $gestolpert = 0;
+
+        foreach ($faellig as $case) {
+            $stufe = $case->level + 1;
+            $kunde = $case->subscription?->customer?->name ?? $case->subscription_id;
+
+            $this->line(sprintf('  %-28s Stufe %d → %d', $kunde, $case->level, $stufe));
+
+            if ($dryRun) {
+                continue;
+            }
+
+            try {
+                $this->advance($case, $stufe, $stripe);
+            } catch (Throwable $e) {
+                // Laut, aber nicht abbrechend: ein Fall, der stolpert, darf die
+                // übrigen nicht liegen lassen.
+                $gestolpert++;
+                $this->error(sprintf('  %-28s %s', $kunde, $e->getMessage()));
+                Log::error('Ein Mahnfall liess sich nicht weiterschalten', [
+                    'case' => $case->id,
+                    'level' => $stufe,
+                    'exception' => $e->getMessage(),
+                ]);
+            }
+        }
+
+        if ($dryRun) {
+            $this->newLine();
+            $this->comment(sprintf('Trockenlauf — %d Fall/Fälle wären weitergeschaltet worden.', $faellig->count()));
+        }
+
+        return $gestolpert === 0 ? self::SUCCESS : self::FAILURE;
+    }
+
+    /**
+     * Nachrichten, die nie hinausgingen, nachreichen.
+     *
+     * `notified_levels` hält fest, welche Stufe dem Kunden wirklich mitgeteilt
+     * wurde. Ohne diese Liste liess sich eine verlorene Mail nicht einmal
+     * nachträglich feststellen: sie hinterlässt nirgends eine Spur.
+     */
+    private function catchUpNotices(bool $dryRun): void
+    {
+        $offen = DunningCase::query()
+            ->whereNull('settled_at')
+            ->with('subscription.customer')
+            ->get()
+            ->filter(fn (DunningCase $case) => ! in_array($case->level, $case->notified_levels ?? [], true));
+
+        foreach ($offen as $case) {
+            $kunde = $case->subscription?->customer?->name ?? $case->subscription_id;
+
+            $this->line(sprintf('  %-28s Nachricht zu Stufe %d %s',
+                $kunde, $case->level, $dryRun ? 'wäre nachgeholt worden' : 'nachgeholt'));
+
+            if ($dryRun) {
+                continue;
+            }
+
+            try {
+                $this->notify($case, $case->level);
+            } catch (Throwable $e) {
+                // Dieselbe Zusicherung wie beim Weiterrücken: ein Fall, der
+                // stolpert, darf die übrigen nicht liegen lassen. Meine erste
+                // Fassung liess die Ausnahme durch und brach damit den ganzen
+                // Lauf ab — einschliesslich der fälligen Stufen danach.
+                $this->error(sprintf('  %-28s %s', $kunde, $e->getMessage()));
+                Log::error('Eine nachzuholende Mahnungs-Nachricht scheiterte', [
+                    'case' => $case->id,
+                    'level' => $case->level,
+                    'exception' => $e->getMessage(),
+                ]);
+            }
+        }
+    }
+
+    /**
+     * Die Nachricht zu einer Stufe, und der Vermerk darüber.
+     *
+     * Vermerkt wird erst NACH dem Einreihen: andersherum stünde in der Liste
+     * eine Nachricht, die nie einging, und niemand holte sie je nach.
+     */
+    private function notify(DunningCase $case, int $level): void
+    {
+        $mailer = app(DunningMailer::class);
+
+        $level >= DunningSchedule::SUSPENDED
+            ? $mailer->suspended($case)
+            : $mailer->level($case, $level);
+
+        $case->update([
+            'notified_levels' => array_values(array_unique(array_merge($case->notified_levels ?? [], [$level]))),
+        ]);
+    }
+
+    private function advance(DunningCase $case, int $level, StripeClient $stripe): void
+    {
+        $gebuehr = DunningSchedule::feeCents($level);
+        $rechnungen = $case->fee_invoice_ids ?? [];
+
+        // Je Stufe genau einmal. Ein zweiter Lauf am selben Tag, ein
+        // abgebrochener Lauf, ein Neustart des Arbeiterprozesses — die Gebühr
+        // darf nur einmal entstehen, und der Schlüssel ist die Stufe.
+        if ($gebuehr > 0 && ! array_key_exists((string) $level, $rechnungen)) {
+            $kunde = $case->subscription?->customer?->stripe_customer_id;
+
+            if (filled($kunde)) {
+                // Die Stufe wird VERMERKT, BEVOR Stripe gefragt wird
+                // (Codex P1). Stirbt der Prozess zwischen dem Anlegen und dem
+                // Speichern, sähe der nächste Lauf sonst eine unvermerkte
+                // Stufe und buchte dieselbe Mahngebühr ein zweites Mal. Fünf
+                // Euro doppelt sind wenig Geld und viel Vertrauensverlust —
+                // eine nicht verrechnete Gebühr ist der günstigere Ausgang.
+                $rechnungen[(string) $level] = self::PENDING;
+                $case->update(['fee_invoice_ids' => $rechnungen]);
+
+                $rechnungen[(string) $level] = $stripe->createFeeInvoice(
+                    (string) $kunde,
+                    $gebuehr,
+                    'EUR',
+                    __('dunning.fee_description', ['level' => $level]),
+                    // Deckt zusätzlich den Wiederholungsversuch innerhalb von
+                    // 24 Stunden ab: Stripe antwortet dann mit derselben
+                    // Rechnung statt einer zweiten.
+                    idempotencyKey: sprintf('clupilot-dunning-fee-%d-%d', $case->id, $level),
+                );
+            }
+        }
+
+        // Die letzte Stufe schaltet ab. Nur die Clouds des betroffenen Kunden,
+        // und gelöscht wird nichts — siehe SuspendInstance.
+        // NUR die Cloud dieses Vertrags. Vorher traf es jede Cloud des
+        // Kunden — ein zweiter, bezahlter Vertrag stand mit, und das ist der
+        // Anruf, den man nicht will. Ausdrücklich so vereinbart: die Sperre
+        // trifft den betroffenen Vertrag, nicht das Konto.
+        if ($level >= DunningSchedule::SUSPENDED) {
+            $instance = $case->instance();
+
+            if ($instance !== null && $instance->suspended_at === null) {
+                app(SuspendInstance::class)($instance);
+            }
+        }
+
+        $gesperrt = $level >= DunningSchedule::SUSPENDED;
+
+        $case->update([
+            'level' => $level,
+            'fee_invoice_ids' => $rechnungen,
+            // Vom BEGINN gerechnet, nicht von heute — siehe Kopfkommentar.
+            'next_step_at' => $level >= DunningSchedule::SUSPENDED
+                ? null
+                : $case->opened_at->copy()->addDays(DunningSchedule::dayOfLevel($level + 1)),
+        ]);
+
+        // Erst wenn der Zustand steht, dann die Nachricht. Andersherum stünde
+        // im Postfach des Kunden eine Sperre, die es nicht gibt, weil das
+        // Speichern danach scheiterte.
+        $this->notify($case->refresh(), $level);
+    }
+}

app/Console/Commands/ApplyDuePlanChanges.php

@@ -0,0 +1,118 @@
+<?php
+
+namespace App\Console\Commands;
+
+use App\Actions\ApplyPlanChange;
+use App\Models\Order;
+use App\Models\Subscription;
+use Illuminate\Console\Command;
+use Throwable;
+
+/**
+ * Carries out the plan changes whose moment has come.
+ *
+ * An upgrade lands when it is paid for — see App\Observers\OrderObserver. A
+ * downgrade cannot: someone on a yearly contract bought a year, so moving them
+ * down in month three would take away what they have already paid for. It waits
+ * for the end of the term, and nothing was waiting with it. This is what does.
+ *
+ * **How a pending downgrade is known.** By the contract, which carries the
+ * package it is moving to and the date that move comes due — `pending_plan` and
+ * `pending_effective_at`, stamped by the shop the moment the customer books it.
+ *
+ * This used to be read off the pending Order instead, with the due date worked
+ * out from `subscriptions.current_period_end` on every tick. That date is not a
+ * fact about the booking, it is a fact about the billing cycle, and Stripe moves
+ * it forward on every renewal: a downgrade booked in March was pushed to the end
+ * of April by April's renewal, then to the end of May by May's, and the customer
+ * went on paying for the package they had asked to leave. A due date has to be
+ * decided once, at the moment the customer decides — so it is stamped then, and
+ * only read afterwards.
+ *
+ * The order is still the customer's own record of the request — it is what the
+ * cart shows them and what they remove to change their mind — so it is consumed
+ * here alongside the contract, and removing it clears the stamp (see
+ * App\Livewire\ConfirmRemoveOrder). What it no longer does is decide WHEN.
+ *
+ * **Safe to run as often as the scheduler likes.** A contract is picked up only
+ * while its stamped date has passed and it is still active, and the stamp is
+ * cleared the moment the change has landed — so a second tick finds nothing
+ * left to do rather than doing it again.
+ */
+class ApplyDuePlanChanges extends Command
+{
+    protected $signature = 'clupilot:apply-due-plan-changes';
+
+    protected $description = 'Apply scheduled downgrades whose term has run out';
+
+    public function handle(ApplyPlanChange $apply): int
+    {
+        $applied = 0;
+        $due = 0;
+
+        // Cancelled contracts are left where they are, and not merely because
+        // ApplyPlanChange would refuse them: a customer who has left is not
+        // moved onto a smaller package on their way out, and the booking they
+        // made goes with the contract it was made on.
+        $contracts = Subscription::query()
+            ->whereNotNull('pending_plan')
+            ->whereNotNull('pending_effective_at')
+            ->where('pending_effective_at', '<=', now())
+            ->where('status', 'active')
+            ->with('customer')
+            ->orderBy('id')
+            ->cursor();
+
+        foreach ($contracts as $subscription) {
+            $due++;
+            $plan = (string) $subscription->pending_plan;
+
+            try {
+                $apply($subscription, $plan, $this->orderFor($subscription, $plan));
+
+                // Read back rather than assumed: a package the catalogue has
+                // since withdrawn cannot be moved onto, and ApplyPlanChange
+                // says so by logging and leaving the contract alone. Clearing
+                // the stamp there would drop the customer's request silently,
+                // so it stays booked and this says so on every tick.
+                $subscription->refresh();
+
+                if ((string) $subscription->plan !== $plan) {
+                    $this->warn("Contract {$subscription->uuid}: still on {$subscription->plan}, {$plan} was not applied.");
+
+                    continue;
+                }
+
+                $subscription->clearPendingPlanChange();
+                $applied++;
+            } catch (Throwable $e) {
+                // One customer's withdrawn package must not stop everybody
+                // else's downgrade from landing.
+                $this->warn("Contract {$subscription->uuid}: {$e->getMessage()}");
+            }
+        }
+
+        $this->info("{$due} downgrade(s) due, {$applied} applied.");
+
+        return self::SUCCESS;
+    }
+
+    /**
+     * The cart entry this booking came from, so it is consumed with the change
+     * and the register row files under it.
+     *
+     * Null is a perfectly ordinary answer — an operator can book a change
+     * without a purchase, and the contract is the authority on what was agreed
+     * either way.
+     */
+    private function orderFor(Subscription $subscription, string $plan): ?Order
+    {
+        return Order::query()
+            ->where('customer_id', $subscription->customer_id)
+            ->where('type', 'downgrade')
+            ->where('status', 'pending')
+            ->where('plan', $plan)
+            ->orderBy('id')
+            ->first();
+    }
+}

app/Console/Commands/ApplyStorageQuotas.php

@@ -0,0 +1,175 @@
+<?php
+
+namespace App\Console\Commands;
+
+use App\Models\Instance;
+use App\Models\Order;
+use App\Models\ProvisioningRun;
+use App\Provisioning\Jobs\AdvanceRunJob;
+use App\Services\Billing\StorageAllowance;
+use Illuminate\Console\Command;
+
+/**
+ * Give the existing estate the storage allowance it was already sold.
+ *
+ * ApplyStorageQuota now runs in the `customer` and `plan-change` pipelines, so
+ * everything built or changed from here on is enforced on the machine. Every
+ * instance from before that is not: `quota_gb` reached the row and stopped
+ * there, Nextcloud was never told, and those customers still have the whole disk
+ * whatever they are paying for. Nothing in the product could reach them, because
+ * the two pipelines only run on a build or a change and these machines are
+ * having neither.
+ *
+ * This is the sweep, and it is a REPAIR, not a routine. It is deliberately NOT
+ * in the scheduler:
+ *
+ *  - the hole it closes is finite and closes for good. Once an instance's
+ *    allowance is enforced and recorded, both pipelines keep it that way;
+ *  - a nightly sweep would be a second authority writing the same value onto
+ *    live machines on a timer, and the day the step in the pipeline silently
+ *    stopped working the sweep would quietly cover for it — the failure would
+ *    never surface, which is how the original hole survived as long as it did;
+ *  - a repair the owner runs is a repair the owner can read the output of. This
+ *    one prints what it did and what it did not, and refuses to touch anything
+ *    at all under --dry-run.
+ *
+ * The work itself goes through the `quota` pipeline rather than reaching into
+ * guests here: one run per instance, retried, logged and visible in the console
+ * like every other piece of remote work, and running the exact same step the
+ * other two pipelines run so a second implementation cannot drift from it.
+ */
+class ApplyStorageQuotas extends Command
+{
+    protected $signature = 'clupilot:apply-quotas
+        {--dry-run : list what would happen and change nothing}
+        {--instance= : one instance uuid, for a single repair}';
+
+    protected $description = 'Apply the sold storage allowance to instances whose Nextcloud was never told about it';
+
+    public function handle(): int
+    {
+        $dryRun = (bool) $this->option('dry-run');
+        $started = 0;
+
+        /** @var array<string, int> reason => count */
+        $skipped = [];
+
+        $query = Instance::query()->with(['order', 'host']);
+
+        if ($uuid = $this->option('instance')) {
+            $query->where('uuid', $uuid);
+        }
+
+        foreach ($query->cursor() as $instance) {
+            $reason = $this->reasonToSkip($instance);
+
+            if ($reason !== null) {
+                $skipped[$reason] = ($skipped[$reason] ?? 0) + 1;
+
+                continue;
+            }
+
+            $started++;
+
+            // The whole allowance, packs included — the figure the run will
+            // actually write. Printing `quota_gb` would report the package while
+            // the sweep applied something larger.
+            $owed = StorageAllowance::for($instance)->totalGb();
+
+            $this->line(($dryRun ? '[dry-run] ' : '')
+                ."{$instance->subdomain}: {$owed} GB "
+                .'('.($instance->quota_applied_gb === null ? 'noch nie gesetzt' : "zuletzt {$instance->quota_applied_gb} GB").')');
+
+            if (! $dryRun) {
+                $this->startQuotaRun($instance);
+            }
+        }
+
+        foreach ($skipped as $reason => $count) {
+            $this->line("übersprungen ({$reason}): {$count}");
+        }
+
+        $this->info($dryRun
+            ? "Probelauf: {$started} Instanz(en) bekämen ihr Kontingent, ".array_sum($skipped).' übersprungen. Nichts wurde geändert.'
+            : "{$started} Kontingent-Lauf/Läufe gestartet, ".array_sum($skipped).' übersprungen.');
+
+        return self::SUCCESS;
+    }
+
+    /**
+     * Why this instance is being left alone, or null when it is not.
+     *
+     * The reason is the report — a sweep that says "skipped 34" and nothing else
+     * is a sweep nobody can act on, because "34 machines have no allowance
+     * enforced" and "34 machines are already fine" look identical from here.
+     */
+    private function reasonToSkip(Instance $instance): ?string
+    {
+        // Nothing remote work can reach: a reservation with no VM, a failed
+        // build, an ended service. The same rule every other maintenance action
+        // asks — see Instance::hasLiveMachine().
+        if (! $instance->hasLiveMachine()) {
+            return 'keine erreichbare Maschine';
+        }
+
+        // No allowance on the row at all. Writing "0 GB" would lock the customer
+        // out of their own files, which is a far worse answer than leaving what
+        // is there and letting somebody notice — the same decision the step
+        // itself makes, made here too so the machine is not visited for nothing.
+        if ((int) $instance->quota_gb <= 0) {
+            return 'kein Kontingent hinterlegt';
+        }
+
+        if ($instance->quotaIsEnforced()) {
+            return 'bereits gesetzt';
+        }
+
+        // Whatever is in flight against this order gets to finish. A quota run
+        // beside an unfinished build would race the same occ calls, and the
+        // build applies the quota itself anyway.
+        if ($this->hasRunInFlight($instance)) {
+            return 'anderer Lauf aktiv';
+        }
+
+        return null;
+    }
+
+    private function startQuotaRun(Instance $instance): void
+    {
+        $run = ProvisioningRun::create([
+            // The instance's own purchase order, as every customer pipeline
+            // uses — that is what CustomerStep::order() and ::instance()
+            // resolve from, and what the in-flight check above looks at.
+            'subject_type' => Order::class,
+            'subject_id' => $instance->order_id,
+            'pipeline' => 'quota',
+            'status' => ProvisioningRun::STATUS_PENDING,
+            'current_step' => 0,
+            'context' => [
+                'instance_id' => $instance->id,
+                'host_id' => $instance->host_id,
+                'node' => $instance->host?->node,
+                'vmid' => $instance->vmid,
+                'subdomain' => $instance->subdomain,
+            ],
+        ]);
+
+        AdvanceRunJob::dispatch($run->uuid);
+    }
+
+    /**
+     * ANY run, deliberately — unlike the narrower "will it do this work?" question
+     * App\Provisioning\WorkInFlight answers for the two actions that must not lose
+     * a change they were asked to make. This is a repair sweep: it runs again, it
+     * skips instances whose quota is already enforced, and an instance passed over
+     * today is picked up on the next pass. Nothing is forgotten by waiting.
+     */
+    private function hasRunInFlight(Instance $instance): bool
+    {
+        return ProvisioningRun::query()
+            ->where('subject_type', Order::class)
+            ->where('subject_id', $instance->order_id)
+            ->inFlight()
+            ->exists();
+    }
+}

app/Console/Commands/ArchiveUnexportedInvoices.php

@@ -0,0 +1,63 @@
+<?php
+
+namespace App\Console\Commands;
+
+use App\Jobs\ArchiveInvoice;
+use App\Models\Invoice;
+use App\Models\ExportTarget;
+use Illuminate\Console\Command;
+
+/**
+ * The sweep behind the copy-on-issue.
+ *
+ * Copying at issue is right and it is not enough. An invoice issued while the
+ * office connection was down never reaches the archive, the queue eventually
+ * gives up, and nothing about the invoice tells anybody — nobody opens an
+ * archive to check whether last Tuesday is in it. This picks up whatever is
+ * still missing, however long ago it was issued.
+ *
+ * Deliberately re-queues rather than writing here: the job already knows how to
+ * write one, and two code paths that both write an invoice into an archive is
+ * one more than the number that can be kept correct.
+ */
+class ArchiveUnexportedInvoices extends Command
+{
+    protected $signature = 'clupilot:archive-invoices {--limit=200}';
+
+    protected $description = 'Queue a copy of every invoice that is not on the archive yet';
+
+    public function handle(): int
+    {
+        $targets = ExportTarget::query()->where('active', true)->get();
+
+        if ($targets->isEmpty()) {
+            $this->line('No export target configured — nothing to do.');
+
+            return self::SUCCESS;
+        }
+
+        $queued = 0;
+
+        foreach ($targets as $target) {
+            // Per destination, because "arrived" is a fact about a pair. An
+            // invoice on the office NAS and not on the off-site box is exactly
+            // the case this exists to catch.
+            $pending = Invoice::query()
+                ->whereDoesntHave('exports', fn ($q) => $q
+                    ->where('export_target_id', $target->id)
+                    ->whereNotNull('exported_at'))
+                ->orderBy('id')
+                ->limit((int) $this->option('limit'))
+                ->get();
+
+            foreach ($pending as $invoice) {
+                ArchiveInvoice::dispatch($invoice, $target);
+                $queued++;
+            }
+        }
+
+        $this->line("Queued {$queued} copy/copies for {$targets->count()} destination(s).");
+
+        return self::SUCCESS;
+    }
+}

app/Console/Commands/AutoUpdate.php

@@ -0,0 +1,52 @@
+<?php
+
+namespace App\Console\Commands;
+
+use App\Services\Deployment\UpdateChannel;
+use App\Services\Deployment\UpdateWindow;
+use Illuminate\Console\Command;
+
+/**
+ * Takes an available update, inside the window, if the owner asked for that.
+ *
+ * It leaves exactly the same request the button leaves — same file, same agent,
+ * same run. There is no second path into a deployment, because a second path is
+ * a second set of rules to keep in step with the first.
+ *
+ * Nothing here checks whether an update already ran today. It does not need to:
+ * an installation that is current has nothing available, so an operator who
+ * pressed the button at four finds the five o'clock window with nothing to do.
+ */
+class AutoUpdate extends Command
+{
+    protected $signature = 'clupilot:auto-update {--force : ignore the window, for testing the wiring}';
+
+    protected $description = 'Install an available release during the configured update window';
+
+    public function handle(UpdateWindow $window, UpdateChannel $channel): int
+    {
+        if (! $window->enabled()) {
+            return self::SUCCESS;
+        }
+
+        if (! $this->option('force') && ! $window->isOpen()) {
+            return self::SUCCESS;
+        }
+
+        $state = $channel->state();
+
+        // The agent has to be alive, there has to be something to install, and
+        // nothing may be running. All three come from the same state the button
+        // is disabled by, so the automation cannot do what an operator is
+        // prevented from doing by hand.
+        if (! $state['agent_seen'] || ! $state['available'] || $state['running']) {
+            return self::SUCCESS;
+        }
+
+        if ($channel->request(__('admin_settings.update_by_schedule'))) {
+            $this->info('Requested an update inside the window.');
+        }
+
+        return self::SUCCESS;
+    }
+}

app/Console/Commands/BindHosts.php

@@ -0,0 +1,220 @@
+<?php
+
+namespace App\Console\Commands;
+
+use App\Services\Env\EnvFileEditor;
+use App\Services\Env\InvalidEnvContentException;
+use App\Support\HostnamePattern;
+use Illuminate\Console\Command;
+
+/**
+ * Trägt die Hostnamen in eine bestehende .env nach.
+ *
+ * `install.sh` schreibt die .env nur bei einer NEUEN Installation („Keeping the
+ * existing .env"). Jede Maschine, die es schon gibt, bekommt die vier Schlüssel
+ * also nie — und ohne sie laufen die Route::domain()-Gruppen host-unabhängig
+ * und antworten überall. Das ist kein Schönheitsfehler: der Betreiber erreicht
+ * dann die Website unter app. und die Anmeldung unter www.
+ *
+ * Über EnvFileEditor und nicht mit einem eigenen `sed`: die Datei hält jedes
+ * Geheimnis dieser Installation, und der Editor prüft den neuen Inhalt Zeile
+ * für Zeile und legt vorher eine Kopie mit Zeitstempel daneben.
+ *
+ * Was gesetzt ist, bleibt. Was leer ist, gilt als fehlend — .env.example
+ * liefert die vier Schlüssel leer aus, und ein Befehl, der leere Zeilen als
+ * „steht ja schon da" behandelt, hilft genau auf den Installationen nicht, für
+ * die es ihn gibt.
+ */
+class BindHosts extends Command
+{
+    protected $signature = 'clupilot:bind-hosts
+        {--app= : Hostname des Kundenportals, z. B. app.clupilot.com}
+        {--site= : Hostnamen der Website, kommagetrennt, der erste ist kanonisch}
+        {--status= : Hostname der Statusseite}
+        {--files= : Hostname für Downloads}
+        {--dry-run : Nur zeigen, was geschähe}
+        {--force : Ohne Rückfrage schreiben}';
+
+    protected $description = 'Trägt APP_HOST, SITE_HOST, STATUS_HOST und FILES_HOST in eine bestehende .env nach';
+
+    public function handle(EnvFileEditor $env): int
+    {
+        $content = $env->read();
+
+        if (trim($content) === '') {
+            $this->error("Keine .env unter {$env->path()}.");
+
+            return self::FAILURE;
+        }
+
+        $wanted = [
+            'APP_HOST' => (string) ($this->option('app') ?: $this->hostOf($content)),
+            'SITE_HOST' => (string) $this->option('site'),
+            'STATUS_HOST' => (string) $this->option('status'),
+            'FILES_HOST' => (string) $this->option('files'),
+        ];
+
+        foreach ($wanted as $key => $value) {
+            if ($value !== '' && ! $this->isHostList($value)) {
+                $this->error("{$key}: „{$value}“ ist kein Hostname.");
+                $this->line('Erwartet wird ein Name wie app.example.com, mehrere kommagetrennt.');
+
+                return self::FAILURE;
+            }
+        }
+
+        $missing = [];
+
+        foreach ($wanted as $key => $value) {
+            if ($value === '' || $this->valueOf($content, $key) !== '') {
+                continue;
+            }
+
+            $missing[$key] = $value;
+        }
+
+        if ($missing === []) {
+            $this->info('Nichts nachzutragen — jeder angegebene Hostname steht bereits in der Datei.');
+
+            return self::SUCCESS;
+        }
+
+        $this->line('In '.$env->path().':');
+
+        foreach ($missing as $key => $value) {
+            $this->line("  {$key}={$value}");
+        }
+
+        // Der Satz, der einen Ausfall verhindert. Ein Hostname wird durch das
+        // Binden zur EINZIGEN Adresse, unter der diese Routen noch antworten —
+        // steht dafür kein DNS-Eintrag und kein Block im Reverse Proxy, ist der
+        // Bereich danach schlicht nicht mehr erreichbar.
+        $this->newLine();
+        $this->warn('Jeder dieser Namen braucht einen DNS-Eintrag und einen Block im Reverse Proxy.');
+        $this->warn('Ohne den ist der jeweilige Bereich nach dem Neuladen der Konfiguration nicht mehr erreichbar.');
+        $this->newLine();
+
+        if ($this->option('dry-run')) {
+            $this->info('--dry-run: nichts geschrieben.');
+
+            return self::SUCCESS;
+        }
+
+        if (! $this->option('force') && ! $this->confirm('Diese Namen jetzt binden?')) {
+            $this->line('Nichts geschrieben.');
+
+            return self::FAILURE;
+        }
+
+        try {
+            $backup = $env->write($this->apply($content, $missing));
+        } catch (InvalidEnvContentException $e) {
+            // Abgelehnt heißt hier: NICHTS geschrieben, und die Sicherung ist
+            // erst gar nicht angelegt worden — der Editor prüft vor beidem.
+            // Der Betreiber soll das als Satz erfahren, nicht als Stapelabzug.
+            $this->error('Die Datei wurde nicht geschrieben: '.$e->getMessage());
+
+            return self::FAILURE;
+        }
+
+        $this->info('Geschrieben. Die vorherige Fassung liegt unter '.$backup);
+        $this->line('Danach: php artisan config:cache && php artisan route:cache');
+
+        return self::SUCCESS;
+    }
+
+    /** Eine Komma-Liste, in der JEDER Eintrag ein Hostname ist. */
+    private function isHostList(string $value): bool
+    {
+        // `explode(',', $value)` liefert nie ein leeres Array — selbst für
+        // `''` steht `['']` da, und das faengt der `in_array('', …)` gleich
+        // darunter ab.
+        $names = array_map('trim', explode(',', $value));
+
+        if (in_array('', $names, true)) {
+            return false;
+        }
+
+        foreach ($names as $name) {
+            if (! $this->isHost($name)) {
+                return false;
+            }
+        }
+
+        return true;
+    }
+
+    /**
+     * Dasselbe Muster, das der root-eigene Helfer in `apply-proxy-hosts`
+     * benutzt, bevor er einen Namen in die Proxy-Konfiguration schreibt
+     * (deploy/install-agent.sh) — jetzt in HostnamePattern, denn
+     * PublishTunnelNames braucht dieselbe Prüfung fürs Lesen, ohne diese
+     * Klasse dafür kennen zu müssen.
+     *
+     * Der Anlass ist konkret: `[www.example.com](https://www.example.com)` ist
+     * als Hostname offensichtlich Unsinn und wurde trotzdem geschrieben, weil
+     * die Zeile die Form KEY=value hatte. Das Repo kennt diese Falle schon —
+     * RestrictConsoleNetwork::isNetwork() gibt es, weil ein Eintrag, der nichts
+     * trifft, sonst „stored happily and reports success".
+     */
+    private function isHost(string $name): bool
+    {
+        return HostnamePattern::matches($name);
+    }
+
+    /**
+     * Der Wert eines Schlüssels, oder '' wenn er fehlt ODER leer ist.
+     *
+     * Beides zusammen, absichtlich: siehe Klassenkommentar.
+     */
+    private function valueOf(string $content, string $key): string
+    {
+        return preg_match('/^'.preg_quote($key, '/').'=(.*)$/m', $content, $matches) === 1
+            ? trim($matches[1])
+            : '';
+    }
+
+    /** Der Hostname aus APP_URL — die Antwort für APP_HOST steht schon in der Datei. */
+    private function hostOf(string $content): string
+    {
+        return (string) parse_url($this->valueOf($content, 'APP_URL'), PHP_URL_HOST);
+    }
+
+    /**
+     * Vorhandene Zeile ersetzen, sonst anhängen.
+     *
+     * Zeilenweise und ohne `preg_replace`: der Wert kommt von der Befehlszeile,
+     * und `preg_replace` deutet `$1`, `\1` und `\\` im ERSATZ als Rückverweise.
+     * Aus `--site 'www.example.test$1'` würde still `SITE_HOST=www.example.test`
+     * — und diese Datei hält jedes Geheimnis dieser Installation. Ein leise
+     * verstümmelter Wert darin ist schlimmer als eine Fehlermeldung.
+     *
+     * Ersetzen und nicht nur anhängen, weil ein leerer Schlüssel als fehlend
+     * gilt: `APP_HOST=` steht dann schon da, und ein zweites `APP_HOST=…`
+     * darunter wäre eine Datei mit zwei Antworten auf dieselbe Frage.
+     *
+     * @param  array<string, string>  $values
+     */
+    private function apply(string $content, array $values): string
+    {
+        $lines = preg_split('/\R/', rtrim($content, "\r\n"));
+
+        foreach ($values as $key => $value) {
+            $replaced = false;
+
+            foreach ($lines as $index => $line) {
+                if (str_starts_with($line, $key.'=')) {
+                    $lines[$index] = $key.'='.$value;
+                    $replaced = true;
+                    break;
+                }
+            }
+
+            if (! $replaced) {
+                $lines[] = $key.'='.$value;
+            }
+        }
+
+        return implode("\n", $lines)."\n";
+    }
+}

app/Console/Commands/CheckCertificates.php

@@ -0,0 +1,36 @@
+<?php
+
+namespace App\Console\Commands;
+
+use App\Services\Proxy\CertificateSweep;
+use Illuminate\Console\Command;
+
+/**
+ * Täglich: welche Namen bedient diese Installation, und wie lange gelten ihre
+ * Zertifikate noch.
+ *
+ * Nach Zeitplan und nicht nur auf Knopfdruck, weil die Frage, auf die es
+ * ankommt, nicht „ist es gerade gültig" lautet, sondern „läuft die Erneuerung".
+ * Die beantwortet nur eine Messung, die auch dann läuft, wenn niemand hinsieht.
+ */
+class CheckCertificates extends Command
+{
+    protected $signature = 'clupilot:check-certificates';
+
+    protected $description = 'Syncs the known hostnames and measures their certificates';
+
+    public function handle(CertificateSweep $sweep): int
+    {
+        $added = $sweep->sync();
+        $result = $sweep->check();
+
+        $this->info(sprintf(
+            '%d hostname(s) added, %d checked, %d without a valid certificate',
+            $added,
+            $result['checked'],
+            $result['failing'],
+        ));
+
+        return self::SUCCESS;
+    }
+}

app/Console/Commands/CheckDnsZone.php

@@ -0,0 +1,75 @@
+<?php
+
+namespace App\Console\Commands;
+
+use App\Models\DnsRecord;
+use App\Models\Instance;
+use App\Models\MonitoringTarget;
+use App\Support\ProvisioningSettings;
+use Illuminate\Console\Command;
+
+/**
+ * What changing the instance zone would touch, before anything is touched.
+ *
+ * The zone is one setting, and changing it silently re-addresses every
+ * instance: `subdomain` holds only the label, and every caller composes
+ * `label.zone` at read time. So the moment the setting changes, the console,
+ * the portal, the acceptance checks and the mails all name an address that
+ * does not resolve — while the DNS records, the certificates and Nextcloud's
+ * trusted_domains still hold the old one.
+ *
+ * Harmless with no instances, which is exactly why it is worth doing now. This
+ * says which it is.
+ */
+class CheckDnsZone extends Command
+{
+    protected $signature = 'clupilot:check-zone {zone? : the zone you are considering}';
+
+    protected $description = 'Report what a change of the instance DNS zone would affect';
+
+    public function handle(): int
+    {
+        $current = ProvisioningSettings::dnsZone();
+        $target = (string) ($this->argument('zone') ?? '');
+
+        $this->line('');
+        $this->line("  Current zone:  <options=bold>{$current}</>");
+        $this->line('  Proposed zone: '.($target !== '' ? "<options=bold>{$target}</>" : '<comment>none given</comment>'));
+        $this->line('');
+
+        $instances = Instance::query()
+            ->whereIn('status', ['active', 'provisioning', 'cancellation_scheduled'])
+            ->get();
+
+        if ($instances->isEmpty()) {
+            $this->info('  No instances in service. The zone can be changed with nothing to migrate.');
+            $this->line('');
+
+            return self::SUCCESS;
+        }
+
+        $this->warn("  {$instances->count()} instance(s) are addressed under the current zone.");
+        $this->line('');
+        $this->line('  Each of these carries the old name in places this setting does NOT reach:');
+        $this->line('');
+
+        $records = DnsRecord::query()->whereIn('instance_id', $instances->pluck('id'))->count();
+        $targets = MonitoringTarget::query()->whereIn('instance_id', $instances->pluck('id'))->count();
+        $verified = $instances->filter(fn (Instance $i) => $i->domainIsVerified())->count();
+
+        $this->table(['What', 'Count', 'Consequence of changing the zone'], [
+            ['DNS records (dns_records.fqdn)', $records, 'still point the OLD name at the host'],
+            ['Monitoring targets', $targets, 'keep watching the old URL and report down'],
+            ['TLS certificates', $instances->count(), 'issued for the old name; the new one has none'],
+            ['Nextcloud trusted_domains', $instances->count(), 'rejects the new name until rewritten'],
+            ['Instances on their own domain', $verified, 'unaffected — they are served at custom_domain'],
+        ]);
+
+        $this->line('');
+        $this->line('  A change now is a migration with an outage, not a setting. Either do it');
+        $this->line('  before the first customer, or plan it as a maintenance window.');
+        $this->line('');
+
+        return self::SUCCESS;
+    }
+}

app/Console/Commands/CheckPlanCatalogue.php

@@ -0,0 +1,99 @@
+<?php
+
+namespace App\Console\Commands;
+
+use App\Models\PlanFamily;
+use App\Models\PlanVersion;
+use App\Models\Subscription;
+use Illuminate\Console\Command;
+
+/**
+ * Tells the owner whether the catalogue is in a state that can actually sell.
+ *
+ * Everything here is computed at read time, which means a broken window or a
+ * missing price does not announce itself until a customer hits it. This is the
+ * thing to run after editing plans — before finding out from a failed checkout.
+ */
+class CheckPlanCatalogue extends Command
+{
+    protected $signature = 'plans:check';
+
+    protected $description = 'Check the plan catalogue for overlaps, gaps and missing prices';
+
+    public function handle(): int
+    {
+        $currency = Subscription::catalogueCurrency();
+        $problems = [];
+        $now = now();
+
+        $families = PlanFamily::query()->with('versions.prices')->orderBy('tier')->get();
+
+        if ($families->isEmpty()) {
+            $this->error('The catalogue is empty. Nothing can be sold.');
+
+            return self::FAILURE;
+        }
+
+        foreach ($families as $family) {
+            $live = $family->versions->filter(fn (PlanVersion $v) => $v->isAvailableAt($now));
+
+            if ($live->count() > 1) {
+                $problems[] = "{$family->key}: {$live->count()} versions on sale at once (".
+                    $live->pluck('version')->implode(', ').') — overlapping windows.';
+            }
+
+            if ($family->sales_enabled && $live->isEmpty()) {
+                $problems[] = "{$family->key}: on sale, but no version is available right now.";
+            }
+
+            foreach ($family->versions as $version) {
+                if (! $version->isPublished()) {
+                    continue;
+                }
+
+                foreach ([Subscription::TERM_MONTHLY, Subscription::TERM_YEARLY] as $term) {
+                    $priced = $version->prices
+                        ->first(fn ($p) => $p->term === $term && $p->currency === $currency);
+
+                    if ($priced === null) {
+                        $problems[] = "{$family->key} v{$version->version}: no {$term} price in {$currency}.";
+                    }
+                }
+            }
+        }
+
+        // A contract that cannot say which version it was sold under has lost
+        // its provenance, which is the one thing the version table is for.
+        $orphaned = Subscription::query()->whereNull('plan_version_id')->count();
+
+        if ($orphaned > 0) {
+            $problems[] = "{$orphaned} subscription(s) have no plan version recorded.";
+        }
+
+        foreach ($families as $family) {
+            $state = $family->sales_enabled ? 'on sale' : 'withdrawn';
+            $version = $family->versions->first(fn (PlanVersion $v) => $v->isAvailableAt($now));
+            $this->line(sprintf(
+                '  %-12s tier %d  %-10s %s',
+                $family->key,
+                $family->tier,
+                $state,
+                $version !== null ? "v{$version->version}" : '—',
+            ));
+        }
+
+        if ($problems === []) {
+            $this->newLine();
+            $this->info('Catalogue is consistent.');
+
+            return self::SUCCESS;
+        }
+
+        $this->newLine();
+        foreach ($problems as $problem) {
+            $this->error('  '.$problem);
+        }
+
+        return self::FAILURE;
+    }
+}

app/Console/Commands/ConfigureInstanceMail.php

@@ -0,0 +1,130 @@
+<?php
+
+namespace App\Console\Commands;
+
+use App\Models\Instance;
+use App\Models\ProvisioningRun;
+use App\Provisioning\Jobs\AdvanceRunJob;
+use Illuminate\Console\Command;
+
+/**
+ * Traegt bestehenden Instanzen den Mailversand nach.
+ *
+ * Der Anlass: der Versand kam erst mit der Mitarbeiterverwaltung in die
+ * Pipeline. Jede vorher gebaute Instanz kann bis heute keine Mail verschicken
+ * — und die Einladung an einen Mitarbeiter geht von DORT aus, nicht von
+ * CluPilot. Ohne diesen Lauf bliebe die Verwaltung fuer alle Altkunden tot.
+ *
+ * Ein Befehl und kein Zeitplan, aus derselben Begruendung wie bei
+ * `clupilot:refresh-host-firewall`: das Loch ist endlich und schliesst sich
+ * endgueltig; ein naechtlicher Lauf wuerde am Tag, an dem der Schritt in der
+ * Pipeline still kaputtginge, fuer ihn einspringen und das Versagen
+ * verbergen; und eine Reparatur, die der Betreiber anstoesst, ist eine, deren
+ * Ausgabe er liest.
+ */
+class ConfigureInstanceMail extends Command
+{
+    protected $signature = 'clupilot:configure-instance-mail
+        {--dry-run : auflisten, was liefe, und nichts anfassen}
+        {--instance= : nur diese eine Instanz, per uuid}';
+
+    protected $description = 'Traegt bestehenden Kundeninstanzen den Mailversand nach';
+
+    public function handle(): int
+    {
+        $dryRun = (bool) $this->option('dry-run');
+        $started = 0;
+
+        /** @var array<string, int> reason => count */
+        $skipped = [];
+
+        $query = Instance::query()->where('status', 'active');
+
+        if ($uuid = $this->option('instance')) {
+            $query->where('uuid', $uuid);
+        }
+
+        foreach ($query->with('host')->get() as $instance) {
+            $reason = $this->reasonToSkip($instance);
+
+            if ($reason !== null) {
+                $skipped[$reason] = ($skipped[$reason] ?? 0) + 1;
+
+                continue;
+            }
+
+            $started++;
+
+            if ($dryRun) {
+                $this->line("{$instance->uuid}: würde nachgetragen");
+
+                continue;
+            }
+
+            $run = ProvisioningRun::create([
+                'pipeline' => 'instance-mail',
+                'subject_type' => Instance::class,
+                'subject_id' => $instance->id,
+                'status' => ProvisioningRun::STATUS_PENDING,
+                'current_step' => 0,
+                'context' => [
+                    'instance_id' => $instance->id,
+                    'node' => $instance->host->node ?? 'pve',
+                    'vmid' => (int) $instance->vmid,
+                ],
+            ]);
+
+            AdvanceRunJob::dispatch($run->uuid);
+            $this->info("{$instance->uuid}: Lauf {$run->id} gestartet");
+        }
+
+        foreach ($skipped as $reason => $count) {
+            $this->line("übersprungen ({$reason}): {$count}");
+        }
+
+        $this->info($dryRun
+            ? "Probelauf: {$started} Instanz(en) bekämen den Mailversand, ".array_sum($skipped).' übersprungen. Nichts wurde geändert.'
+            : "{$started} Lauf/Läufe gestartet, ".array_sum($skipped).' übersprungen.');
+
+        return self::SUCCESS;
+    }
+
+    /**
+     * Warum diese Instanz uebergangen wird, oder null.
+     *
+     * Der Grund IST der Bericht: „2 uebergangen" allein ist keine Auskunft,
+     * mit der jemand etwas anfangen kann — „2 haben keinen Host" und „2 laufen
+     * bereits" sehen von hier aus gleich aus, sind aber völlig verschiedene
+     * Reparaturen.
+     */
+    private function reasonToSkip(Instance $instance): ?string
+    {
+        if ($instance->host === null) {
+            return 'kein Host';
+        }
+
+        if (blank($instance->vmid)) {
+            return 'keine VMID';
+        }
+
+        if ($this->hasRunInFlight($instance)) {
+            return 'anderer Lauf aktiv';
+        }
+
+        return null;
+    }
+
+    /**
+     * JEDER Lauf gegen diese Instanz, absichtlich weit gefasst: das hier ist ein
+     * Reparatur-Durchgang. Er läuft wieder, und eine heute übergangene Instanz ist
+     * beim nächsten Aufruf dran. Nichts geht durch Warten verloren.
+     */
+    private function hasRunInFlight(Instance $instance): bool
+    {
+        return ProvisioningRun::query()
+            ->where('subject_type', Instance::class)
+            ->where('subject_id', $instance->id)
+            ->inFlight()
+            ->exists();
+    }
+}

app/Console/Commands/ConsoleAccess.php

@@ -0,0 +1,145 @@
+<?php
+
+namespace App\Console\Commands;
+
+use App\Http\Middleware\RestrictConsoleNetwork;
+use App\Support\Settings;
+use Illuminate\Console\Command;
+
+/**
+ * The way back in when the console has locked its owner out.
+ *
+ * The allowlist is managed in the console — which is fine until the address you
+ * manage it from changes, and then the page that would fix the problem is the
+ * page the problem blocks. Every gate needs a door that does not depend on
+ * itself, and on a server that door is a shell.
+ */
+class ConsoleAccess extends Command
+{
+    protected $signature = 'clupilot:console-access
+                            {action=show : show|allow|deny|open|close|caddy}
+                            {value? : an address or CIDR, for allow and deny}';
+
+    protected $description = 'Show or change who may reach the operator console';
+
+    public function handle(): int
+    {
+        $action = (string) $this->argument('action');
+        $value = trim((string) $this->argument('value'));
+
+        return match ($action) {
+            'show' => $this->show(),
+            'allow' => $this->allow($value),
+            'deny' => $this->deny($value),
+            'open' => $this->setRestricted(false),
+            'close' => $this->setRestricted(true),
+            'caddy' => $this->caddy(),
+            default => $this->refuse("Unknown action: {$action}"),
+        };
+    }
+
+    /**
+     * The allowlist as a Caddy matcher, for the reverse proxy to import.
+     *
+     * The proxy has its own allowlist, hard-coded, and it runs FIRST — so
+     * everything the owner adds in the console has no effect whatsoever, and
+     * the console's own access page is a decoration. Worse, when the owner's
+     * address changes they are turned away by the proxy before the application
+     * they could have fixed it in is ever reached.
+     *
+     * Emitting the matcher from the same list the console manages makes the
+     * console the single authority. The agent on the host writes this out and
+     * reloads the proxy.
+     */
+    private function caddy(): int
+    {
+        // Always the allowlist — never 0.0.0.0/0, not even when the console's
+        // own restriction is switched off.
+        //
+        // The owner's rule is absolute: the console is reachable over the
+        // management VPN, or from an address they have listed, and from nowhere
+        // else. Letting the console's "open" switch also open the PROXY would
+        // put the console on the public internet with one click, which is
+        // exactly the state that rule exists to prevent. Switching it off
+        // relaxes the application's own check; the proxy keeps its list.
+        $ranges = RestrictConsoleNetwork::allowedRanges();
+
+        // Never empty: an empty remote_ip matcher matches NOTHING in Caddy, and
+        // the console would become unreachable from anywhere at all — including
+        // from the place someone would fix it. Loopback always survives, so a
+        // shell on the box is always a way back.
+        if ($ranges === []) {
+            $ranges = ['127.0.0.1', '::1'];
+        }
+
+        $this->line('# Generated from the console allowlist — do not edit by hand.');
+        $this->line('# Regenerated by deploy/update-agent.sh; edit it in the console.');
+        $this->line('@allowed remote_ip '.implode(' ', $ranges));
+
+        return self::SUCCESS;
+    }
+
+    private function show(): int
+    {
+        $this->line('  restricted : '.(RestrictConsoleNetwork::isRestricted() ? 'yes' : 'no — anyone reaching the hostname gets in'));
+        $this->line('  always     : '.implode(', ', (array) config('admin_access.trusted_ranges', [])).'  (VPN, not removable)');
+
+        $own = (array) Settings::get('console.allowed_ips', []);
+        $this->line('  additional : '.($own === [] ? '(none)' : implode(', ', $own)));
+
+        return self::SUCCESS;
+    }
+
+    private function allow(string $value): int
+    {
+        if ($value === '') {
+            return $this->refuse('Give an address or range: clupilot:console-access allow 203.0.113.7');
+        }
+
+        // An entry that matches nothing would be stored, reported as success,
+        // and leave whoever is recovering still locked out.
+        if (! RestrictConsoleNetwork::isNetwork($value)) {
+            return $this->refuse("Not an address or a range: {$value}");
+        }
+
+        $list = (array) Settings::get('console.allowed_ips', []);
+
+        if (! in_array($value, $list, true)) {
+            $list[] = $value;
+            Settings::set('console.allowed_ips', array_values($list));
+        }
+
+        $this->info("{$value} may now reach the console.");
+
+        return $this->show();
+    }
+
+    private function deny(string $value): int
+    {
+        Settings::set('console.allowed_ips', array_values(array_filter(
+            (array) Settings::get('console.allowed_ips', []),
+            fn ($entry) => $entry !== $value,
+        )));
+
+        $this->info("{$value} removed.");
+
+        return $this->show();
+    }
+
+    private function setRestricted(bool $on): int
+    {
+        // No lock-out check here on purpose: this command IS the recovery path,
+        // and it is only reachable by someone who already has the server.
+        Settings::set('console.network_restricted', $on);
+        $this->info($on ? 'Console restricted to the VPN and the listed addresses.' : 'Restriction lifted.');
+
+        return $this->show();
+    }
+
+    private function refuse(string $message): int
+    {
+        $this->error($message);
+
+        return self::FAILURE;
+    }
+}

app/Console/Commands/CreateAdmin.php

@@ -0,0 +1,84 @@
+<?php
+
+namespace App\Console\Commands;
+
+use App\Models\Customer;
+use App\Models\Operator;
+use App\Support\PasswordPolicy;
+use Illuminate\Console\Command;
+use Illuminate\Support\Facades\Hash;
+use Illuminate\Support\Facades\Validator;
+use Spatie\Permission\PermissionRegistrar;
+
+/**
+ * Creates (or promotes) an operator with the Owner role — the account the
+ * installer sets up so a fresh server is usable immediately.
+ *
+ * Promotion is deliberate: running this twice with the same address should fix
+ * a lost role, not fail with "email already taken".
+ *
+ * Renamed from clupilot:create-admin now that the account this creates is an
+ * Operator, not a User with is_admin set — the old name stays reachable as an
+ * alias so existing install scripts and muscle memory keep working.
+ */
+class CreateAdmin extends Command
+{
+    protected $signature = 'clupilot:create-operator
+                            {--email= : Login address}
+                            {--name= : Display name}
+                            {--password= : Leave empty to be prompted}';
+
+    protected $aliases = ['clupilot:create-admin'];
+
+    protected $description = 'Create or promote an operator account with the Owner role';
+
+    public function handle(): int
+    {
+        $email = $this->option('email') ?: $this->ask('Email');
+        $name = $this->option('name') ?: $this->ask('Name', 'Administrator');
+        $password = $this->option('password') ?: $this->secret('Password');
+
+        $validator = Validator::make(
+            ['email' => $email, 'name' => $name, 'password' => $password],
+            [
+                'email' => 'required|email|max:255',
+                'name' => 'required|string|max:255',
+                'password' => PasswordPolicy::rules(),
+            ],
+        );
+
+        if ($validator->fails()) {
+            foreach ($validator->errors()->all() as $error) {
+                $this->error($error);
+            }
+
+            return self::FAILURE;
+        }
+
+        // An operator address that also belongs to a customer would block that
+        // customer from ever getting a portal login. Checked directly against
+        // `users`, not only `customers`: see Customer::emailTaken().
+        if (Customer::emailTaken($email)) {
+            $this->error('That address already belongs to a customer.');
+
+            return self::FAILURE;
+        }
+
+        $operator = Operator::query()->firstOrNew(['email' => $email]);
+        $existed = $operator->exists;
+
+        $operator->fill([
+            'name' => $name,
+            'password' => Hash::make($password),
+        ])->save();
+
+        $operator->syncRoles(['Owner']);
+        app(PermissionRegistrar::class)->forgetCachedPermissions();
+
+        $this->info($existed
+            ? "Existing account {$email} promoted to Owner and password reset."
+            : "Owner account {$email} created.");
+
+        return self::SUCCESS;
+    }
+}

app/Console/Commands/EndCancelledAddons.php

@@ -0,0 +1,75 @@
+<?php
+
+namespace App\Console\Commands;
+
+use App\Actions\BookAddon;
+use App\Models\SubscriptionAddon;
+use Illuminate\Console\Command;
+use Throwable;
+
+/**
+ * End the modules whose cancellation date has arrived.
+ *
+ * A module is cancelled monthly and the cancellation lands at the end of the
+ * term the customer has already paid for — the same rule a package downgrade
+ * follows, and for the same reason: what has been paid for is kept. So
+ * BookAddon::cancelAtPeriodEnd() writes an appointment on the booking and leaves
+ * the module running. This keeps it.
+ *
+ * Stripe has already been told at the moment of cancellation; there is no item
+ * left to remove here. What ends now is the module itself — the entitlement, and
+ * for a storage pack the space on the machine — and the entry in the proof
+ * register that says the customer stopped paying for it.
+ *
+ * Safe to run as often as the scheduler likes: BookAddon::cancel() claims the
+ * cancellation conditionally, so a second tick over a module that has already
+ * ended writes nothing and records nothing.
+ */
+class EndCancelledAddons extends Command
+{
+    protected $signature = 'clupilot:end-cancelled-addons
+        {--dry-run : list what would end and change nothing}';
+
+    protected $description = 'End the booked modules whose cancellation date has passed';
+
+    public function handle(BookAddon $bookAddon): int
+    {
+        $dryRun = (bool) $this->option('dry-run');
+        $ended = 0;
+
+        $due = SubscriptionAddon::query()
+            ->whereNull('cancelled_at')
+            ->whereNotNull('cancels_at')
+            ->where('cancels_at', '<=', now())
+            ->with('subscription')
+            ->orderBy('id')
+            ->get();
+
+        foreach ($due as $addon) {
+            $this->line(sprintf(
+                '  %s on contract %s',
+                (string) $addon->addon_key,
+                (string) ($addon->subscription?->uuid ?? '—'),
+            ));
+
+            if ($dryRun) {
+                continue;
+            }
+
+            try {
+                $bookAddon->cancel($addon);
+                $ended++;
+            } catch (Throwable $e) {
+                // One customer's module must not stop everybody else's from
+                // ending. It stays due and the next tick tries again.
+                $this->warn("  {$addon->uuid}: {$e->getMessage()}");
+            }
+        }
+
+        $this->info($dryRun
+            ? "{$due->count()} module(s) due to end. Run without --dry-run to end them."
+            : "{$due->count()} module(s) due, {$ended} ended.");
+
+        return self::SUCCESS;
+    }
+}

app/Console/Commands/EndDueServices.php

@@ -0,0 +1,74 @@
+<?php
+
+namespace App\Console\Commands;
+
+use App\Actions\EndInstanceService;
+use App\Models\Instance;
+use Illuminate\Console\Command;
+
+/**
+ * End the services whose cancellation date has arrived.
+ *
+ * ConfirmCancelPackage schedules an ending — status `cancellation_scheduled`,
+ * `service_ends_at` at the close of the paid period — and nothing in the
+ * application ever kept the appointment. That is why `TraefikWriter::remove()`
+ * had no caller: there was no moment at which an instance ended, so there was
+ * never a moment at which its router came down. Cancelled instances kept their
+ * hostname, their certificate and their route to a guest address the host may
+ * later hand to a different customer.
+ *
+ * This is the appointment. It ends nothing early: EndInstanceService::hasEnded()
+ * is the whole rule and a `cancellation_scheduled` instance whose date is still
+ * in the future is left exactly alone — see that class for why that distinction
+ * is the important one here.
+ *
+ * Hourly. The end of a paid term is a moment, and a sweep that ran once a night
+ * would hand out up to a day of service nobody decided to give — while running
+ * it every minute would mean a provider's bad five seconds became a failed job
+ * sixty times over. Nothing here is taken away that the customer did not
+ * themselves ask to give up, on a date they were shown, so there is no bad hour
+ * for it.
+ */
+class EndDueServices extends Command
+{
+    protected $signature = 'clupilot:end-due-services
+        {--dry-run : list what would end and change nothing}';
+
+    protected $description = 'Withdraw the address of every instance whose cancellation date has passed';
+
+    public function handle(EndInstanceService $end): int
+    {
+        $dryRun = (bool) $this->option('dry-run');
+        $ended = 0;
+
+        // Narrowed in the query for the sake of the database, decided by
+        // hasEnded() for the sake of the rule: the query is an index, not a
+        // second opinion.
+        $due = Instance::query()
+            ->with(['host', 'dnsRecords'])
+            ->where('status', 'cancellation_scheduled')
+            ->whereNotNull('service_ends_at')
+            ->where('service_ends_at', '<=', now())
+            ->cursor();
+
+        foreach ($due as $instance) {
+            if (! $end->hasEnded($instance)) {
+                continue;
+            }
+
+            $this->line(($dryRun ? '[dry-run] ' : '')
+                ."{$instance->subdomain}: Laufzeit endete am "
+                .$instance->service_ends_at->local()->isoFormat('LLL'));
+
+            if ($dryRun || $end($instance)) {
+                $ended++;
+            }
+        }
+
+        $this->info($dryRun
+            ? "Probelauf: {$ended} Dienst(e) würden beendet. Nichts wurde geändert."
+            : "{$ended} Dienst(e) beendet.");
+
+        return self::SUCCESS;
+    }
+}

app/Console/Commands/FetchInboundMail.php

@@ -0,0 +1,29 @@
+<?php
+
+namespace App\Console\Commands;
+
+use App\Services\Mail\IngestInboundMail;
+use Illuminate\Console\Command;
+
+/**
+ * Read the support mailbox into the console.
+ *
+ * Runs on the scheduler. A mail server has no way to tell us a message arrived
+ * — IMAP is a mailbox you look in — so this is polling, and the interval is the
+ * honest answer to "how long until I see it".
+ */
+class FetchInboundMail extends Command
+{
+    protected $signature = 'clupilot:fetch-mail {--limit=50 : How many messages to take in one run}';
+
+    protected $description = 'Fetch new customer mail from the support mailbox';
+
+    public function handle(IngestInboundMail $ingest): int
+    {
+        $taken = $ingest((int) $this->option('limit'));
+
+        $this->info($taken === 0 ? 'Nothing new.' : $taken.' new message(s).');
+
+        return self::SUCCESS;
+    }
+}

app/Console/Commands/ProxyHostList.php

@@ -0,0 +1,38 @@
+<?php
+
+namespace App\Console\Commands;
+
+use App\Models\ProxyHost;
+use Illuminate\Console\Command;
+
+/**
+ * Gibt die Hostnamen aus, die der Reverse Proxy bedienen soll — eine je Zeile,
+ * mit ihrem Zweck.
+ *
+ * NUR die Liste, nicht die fertige Caddy-Konfiguration. Das ist der ganze Punkt.
+ *
+ * `install-agent.sh` begründet für die sudoers-Freigabe: „a grant is only worth
+ * anything if the holder cannot change what it grants." Dürfte diese Anwendung
+ * Caddy-Blöcke schreiben, die ein root-Helfer ungeprüft einbaut, hätte sie über
+ * den Umweg der Konfiguration alles, was der Proxy kann — Weiterleitungen
+ * irgendwohin, Dateiauslieferung aus jedem Verzeichnis. Sie gibt deshalb NAMEN
+ * aus, und die Vorlage darum herum steht im root-eigenen Helfer, wo diese
+ * Anwendung sie nicht anfassen kann.
+ *
+ * Format je Zeile: `<hostname> <purpose>`.
+ */
+class ProxyHostList extends Command
+{
+    protected $signature = 'clupilot:proxy-hosts';
+
+    protected $description = 'Lists the hostnames the reverse proxy should serve, one per line';
+
+    public function handle(): int
+    {
+        foreach (ProxyHost::query()->orderBy('hostname')->get() as $host) {
+            $this->line($host->hostname.' '.$host->purpose);
+        }
+
+        return self::SUCCESS;
+    }
+}

app/Console/Commands/PruneDormantAccounts.php

@@ -0,0 +1,207 @@
+<?php
+
+namespace App\Console\Commands;
+
+use App\Mail\DormantAccountWarningMail;
+use App\Models\User;
+use App\Models\UserDevice;
+use Illuminate\Console\Command;
+use Illuminate\Support\Carbon;
+use Illuminate\Support\Facades\Log;
+use Illuminate\Support\Facades\Mail;
+use Throwable;
+
+/**
+ * A confirmed account that has never had a package, removed after a year.
+ *
+ * The other sweep (PruneUnverifiedAccounts) is about registrations nobody
+ * confirmed and takes five days. This one is about the opposite case: somebody
+ * confirmed their address, looked around, never bought anything, and never came
+ * back. A year later there is a login, an address and a password hash on file
+ * for no purpose at all — which is a data-protection question, not tidiness.
+ *
+ * ## What "no package" means, and why it is drawn this wide
+ *
+ * No instance, no contract, no order, no invoice — ever, not merely "not now".
+ * A customer who cancelled last month has invoices, and invoices have to be kept
+ * for seven years (§ 132 BAO). Their login is part of how they reach those
+ * invoices, so nothing with commercial history is touched here. Both links
+ * between `users` and `customers` count, by id and by address, for the same
+ * reason as in the other sweep.
+ *
+ * ## The clock is reset by signing in
+ *
+ * Measured from the LATEST of the registration and the last time any device was
+ * seen (`user_devices.last_seen_at`) — so a person who signs in once a year
+ * keeps their account, which is what the terms promise. There is no
+ * `last_login_at` on users, and the device rows already carry exactly this.
+ *
+ * ## Nobody is deleted without being told
+ *
+ * A warning goes out a fortnight before, once, and `dormant_warned_at` records
+ * it. An account is only removed when that warning is on file and old enough —
+ * so a run that has never warned anybody deletes nobody, and a mail server that
+ * was down that night delays the deletion instead of skipping the warning.
+ */
+class PruneDormantAccounts extends Command
+{
+    /** How long an account with no package is kept. */
+    public const AFTER_DAYS = 365;
+
+    /** How long before that the warning goes out. */
+    public const WARN_DAYS_BEFORE = 14;
+
+    protected $signature = 'clupilot:prune-dormant {--dry-run : Only say what would happen}';
+
+    protected $description = 'Warn, then delete confirmed accounts that never had a package';
+
+    public function handle(): int
+    {
+        $dry = (bool) $this->option('dry-run');
+
+        $warned = $this->sendWarnings($dry);
+        $removed = $this->remove($dry);
+
+        $this->info($dry
+            ? "would warn {$warned}, would remove {$removed}."
+            : "{$warned} warned, {$removed} removed.");
+
+        return self::SUCCESS;
+    }
+
+    /**
+     * The fortnight's notice.
+     *
+     * Not called warn(): Command::warn() is the framework's "print a warning
+     * line" and overriding it with something private breaks the class outright.
+     */
+    private function sendWarnings(bool $dry): int
+    {
+        $due = $this->dormant()
+            ->whereNull('dormant_warned_at')
+            ->get()
+            ->filter(fn (User $user) => $this->dormantSince($user)
+                ->lte(now()->subDays(self::AFTER_DAYS - self::WARN_DAYS_BEFORE)));
+
+        foreach ($due as $user) {
+            if ($dry) {
+                $this->line('would warn: '.$user->email);
+
+                continue;
+            }
+
+            try {
+                $mail = new DormantAccountWarningMail($user, self::WARN_DAYS_BEFORE);
+                Mail::mailer($mail->mailer)->to($user->email)->queue($mail);
+            } catch (Throwable $e) {
+                // Not stamped: the stamp is what permits the deletion, and
+                // stamping a mail that never went out would delete an account
+                // whose owner was never told.
+                Log::warning('Could not warn a dormant account', [
+                    'email' => $user->email,
+                    'exception' => $e->getMessage(),
+                ]);
+
+                continue;
+            }
+
+            $user->forceFill(['dormant_warned_at' => now()])->save();
+        }
+
+        return $due->count();
+    }
+
+    /** The deletion itself, a fortnight after the warning at the earliest. */
+    private function remove(bool $dry): int
+    {
+        $due = $this->dormant()
+            ->whereNotNull('dormant_warned_at')
+            ->where('dormant_warned_at', '<=', now()->subDays(self::WARN_DAYS_BEFORE))
+            ->get()
+            ->filter(fn (User $user) => $this->dormantSince($user)
+                ->lte(now()->subDays(self::AFTER_DAYS)));
+
+        foreach ($due as $user) {
+            if ($dry) {
+                $this->line('would remove: '.$user->email.' (dormant since '.$this->dormantSince($user)->toDateString().')');
+
+                continue;
+            }
+
+            // Logged individually rather than as a count: an address that
+            // disappears is the kind of thing somebody asks about later, and a
+            // number in a log answers nothing.
+            Log::info('Removing a dormant account', [
+                'email' => $user->email,
+                'registered_at' => $user->created_at?->toIso8601String(),
+                'warned_at' => $user->dormant_warned_at?->toIso8601String(),
+            ]);
+
+            $user->delete();
+        }
+
+        return $due->count();
+    }
+
+    /**
+     * Confirmed, and with no customer record behind it at all.
+     *
+     * Drawn at the customer record rather than at "has no live package on
+     * record", and deliberately wider than it has to be:
+     *
+     *  - A customer record means somebody in the business knows this person —
+     *    an operator entered them, or a checkout created them. Removing the
+     *    login of a record we keep is half a deletion.
+     *  - Anything commercial (an order, a contract, an instance, an invoice)
+     *    hangs off a customer record, and invoices have to be kept for seven
+     *    years (§ 132 BAO). Skipping every customer record skips all of that
+     *    without having to enumerate it and without a new table sneaking past
+     *    the enumeration later.
+     *
+     * What is left is exactly the case this exists for: somebody registered,
+     * confirmed their address, never bought anything, and never came back.
+     * Registration alone creates no customer record.
+     *
+     * Both links count, by id and by address — see Customer::emailTaken for why
+     * one can exist without the other.
+     *
+     * @return \Illuminate\Database\Eloquent\Builder<User>
+     */
+    private function dormant()
+    {
+        return User::query()
+            ->whereNotNull('email_verified_at')
+            // Old enough to be worth looking at. The precise cut-off is applied
+            // per user afterwards, because it depends on the devices — and this
+            // one is <=, not <: a timestamp exactly at the threshold is stored to
+            // the second, and a stricter pre-filter would drop the very account
+            // the per-user check was about to catch.
+            ->where('created_at', '<=', now()->subDays(self::AFTER_DAYS - self::WARN_DAYS_BEFORE))
+            ->whereNotExists(fn ($q) => $q->selectRaw('1')->from('customers')
+                ->whereColumn('customers.user_id', 'users.id'))
+            ->whereNotExists(fn ($q) => $q->selectRaw('1')->from('customers')
+                ->whereColumn('customers.email', 'users.email'));
+    }
+
+    /**
+     * Since when this account has been doing nothing.
+     *
+     * The later of the registration and the last time any of its devices was
+     * seen: signing in resets the clock, which is what the terms say.
+     */
+    private function dormantSince(User $user): Carbon
+    {
+        // Scoped by guard as well as by id: operator 1 is not customer 1 (R21),
+        // and there is no devices() relation on User to hide that behind.
+        $lastSeen = UserDevice::query()
+            ->where('guard', 'web')
+            ->where('authenticatable_id', $user->id)
+            ->max('last_seen_at');
+
+        $since = $user->created_at ?? now();
+
+        return $lastSeen === null
+            ? $since
+            : Carbon::parse($lastSeen)->max($since);
+    }
+}

app/Console/Commands/PruneExportFolders.php

@@ -0,0 +1,129 @@
+<?php
+
+namespace App\Console\Commands;
+
+use App\Models\ExportTarget;
+use Illuminate\Console\Command;
+use Illuminate\Support\Carbon;
+
+/**
+ * Empty a handover directory of folders nobody needs any more.
+ *
+ * Only where a destination asks for it — keep_days is null by default, because
+ * a retention rule nobody configured is a deletion nobody expected.
+ *
+ * Safe in a way deleting usually is not: the invoice lives in the database as a
+ * frozen document and its PDF is rendered from that on demand, so anything
+ * removed here can be produced again and re-exported. The directory is a
+ * handover point, not the record.
+ *
+ * Only ever removes folders whose NAME is a date it can parse and that are old
+ * enough. Anything else in there — a stray file, a directory somebody made by
+ * hand, a folder from a different layout — is left alone. A prune that deletes
+ * what it does not recognise is how an archive loses something nobody was
+ * watching.
+ */
+class PruneExportFolders extends Command
+{
+    protected $signature = 'clupilot:prune-exports {--dry-run}';
+
+    protected $description = 'Remove dated folders older than a destination keeps them';
+
+    public function handle(): int
+    {
+        $targets = ExportTarget::query()
+            ->whereNotNull('keep_days')
+            ->where('keep_days', '>', 0)
+            // Only where this machine can see the files. An SFTP destination is
+            // somebody else's disk with somebody else's retention on it.
+            ->where('driver', ExportTarget::LOCAL)
+            ->get();
+
+        foreach ($targets as $target) {
+            $this->prune($target);
+        }
+
+        return self::SUCCESS;
+    }
+
+    private function prune(ExportTarget $target): void
+    {
+        $root = rtrim($target->path, '/');
+
+        if (! is_dir($root)) {
+            // The mount is gone. Saying nothing and doing nothing is right:
+            // this is a cleanup, and a cleanup must never be the thing that
+            // reports a broken mount — nor act on whatever is underneath it.
+            $this->warn("{$target->name}: path is not there, skipping ({$root})");
+
+            return;
+        }
+
+        $cutoff = now()->subDays((int) $target->keep_days)->startOfDay();
+        $removed = 0;
+
+        foreach ((array) scandir($root) as $entry) {
+            if ($entry === '.' || $entry === '..' || ! is_dir($root.'/'.$entry)) {
+                continue;
+            }
+
+            $date = $this->dateFrom($entry);
+
+            // Not a dated folder: left alone, deliberately. A prune that
+            // deletes what it does not recognise is how an archive loses
+            // something nobody was watching.
+            if ($date === null || $date->gte($cutoff)) {
+                continue;
+            }
+
+            if ($this->option('dry-run')) {
+                $this->line("would remove {$root}/{$entry}");
+                $removed++;
+
+                continue;
+            }
+
+            $this->removeTree($root.'/'.$entry);
+            $removed++;
+        }
+
+        $this->line("{$target->name}: {$removed} folder(s) older than {$target->keep_days} days.");
+    }
+
+    /**
+     * Only the exact shapes this application writes.
+     *
+     * Matched with a pattern BEFORE parsing, not by asking Carbon and catching
+     * what it does with nonsense: under strict mode createFromFormat throws
+     * rather than returning false, so a folder somebody made by hand would end
+     * the whole prune instead of being skipped. The pattern also says plainly
+     * which two shapes are recognised, which is the thing a reader wants to
+     * know here.
+     */
+    private function dateFrom(string $name): ?Carbon
+    {
+        if (preg_match('/^(\d{4})-(\d{2})-(\d{2})$/', $name, $m)) {
+            return Carbon::createFromFormat('Y-m-d', $name)?->startOfDay();
+        }
+
+        if (preg_match('/^\d{4}$/', $name)) {
+            return Carbon::createFromFormat('Y-m-d', $name.'-12-31')?->startOfDay();
+        }
+
+        return null;
+    }
+
+    private function removeTree(string $directory): void
+    {
+        foreach ((array) scandir($directory) as $entry) {
+            if ($entry === '.' || $entry === '..') {
+                continue;
+            }
+
+            $path = $directory.'/'.$entry;
+            is_dir($path) ? $this->removeTree($path) : @unlink($path);
+        }
+
+        @rmdir($directory);
+    }
+}

app/Console/Commands/PruneHostDns.php

@@ -0,0 +1,72 @@
+<?php
+
+namespace App\Console\Commands;
+
+use App\Models\Host;
+use App\Services\Dns\HetznerDnsClient;
+use Illuminate\Console\Command;
+use Throwable;
+
+/**
+ * Cleans up host DNS records this app published in the PUBLIC Hetzner zone
+ * before RegisterHostDns moved to the internal vpn-dns hostsdir — a host's
+ * WireGuard address in public DNS hands every scanner the internal subnet.
+ *
+ * The ids are whatever is still sitting in hosts.dns_record_id (PurgeHost
+ * already clears this column for any host removed normally; what remains
+ * belongs to hosts that are still active).
+ *
+ * Never deletes anything on its own: this runs against a live DNS account, a
+ * migration is the wrong place to make that call unattended, and a stale id
+ * could by now point at a record this app no longer owns. Without --force
+ * this only reports what it would remove.
+ */
+class PruneHostDns extends Command
+{
+    protected $signature = 'clupilot:prune-host-dns {--force : Actually delete the records}';
+
+    protected $description = 'List (and, with --force, delete) public Hetzner DNS records this app published for a host';
+
+    public function handle(HetznerDnsClient $dns): int
+    {
+        $hosts = Host::query()->whereNotNull('dns_record_id')->orderBy('name')->get();
+
+        if ($hosts->isEmpty()) {
+            $this->info('No host carries a public dns_record_id. Nothing to do.');
+
+            return self::SUCCESS;
+        }
+
+        $force = (bool) $this->option('force');
+        $failed = 0;
+
+        foreach ($hosts as $host) {
+            $label = $host->name !== '' && $host->name !== null ? $host->name : $host->uuid;
+            $recordId = $host->dns_record_id;
+
+            if (! $force) {
+                $this->line("  would delete  {$label}  record={$recordId}");
+
+                continue;
+            }
+
+            try {
+                $dns->deleteRecord($recordId);
+                $host->update(['dns_record_id' => null]);
+                $this->info("  deleted       {$label}  record={$recordId}");
+            } catch (Throwable $e) {
+                $failed++;
+                $this->error("  failed        {$label}  record={$recordId}: {$e->getMessage()}");
+            }
+        }
+
+        if (! $force) {
+            $this->newLine();
+            $this->comment(sprintf('Dry run — %d record(s) found, nothing changed. Re-run with --force to delete.', $hosts->count()));
+
+            return self::SUCCESS;
+        }
+
+        return $failed === 0 ? self::SUCCESS : self::FAILURE;
+    }
+}

app/Console/Commands/PruneUnverifiedAccounts.php

@@ -0,0 +1,82 @@
+<?php
+
+namespace App\Console\Commands;
+
+use App\Models\Customer;
+use App\Models\User;
+use Illuminate\Console\Command;
+use Illuminate\Support\Facades\Log;
+
+/**
+ * Registrations nobody ever confirmed, removed.
+ *
+ * An abandoned attempt used to stay in `users` for ever, and it holds the
+ * address hostage while it does: the unique index means the same person cannot
+ * register again with the address they meant. "Abmelden und neu registrieren"
+ * was therefore advice that could not work — signing out frees nothing.
+ *
+ * Five days, because that is long enough for somebody who registered on a
+ * Friday, found the mail in a spam folder on Monday, and clicked it — and short
+ * enough that a typo does not block the correct address for a month.
+ *
+ * What it will NOT touch, and this is the important half:
+ *
+ *  - a confirmed account, whatever else is true of it;
+ *  - an account with a customer record behind it. A paid checkout creates the
+ *    login through the webhook, and such a user can sit unconfirmed while
+ *    already having a contract. Deleting that is data loss, not housekeeping.
+ */
+class PruneUnverifiedAccounts extends Command
+{
+    /** How long an unconfirmed registration is kept. */
+    public const AFTER_DAYS = 5;
+
+    protected $signature = 'clupilot:prune-unverified {--dry-run : Only say what would go}';
+
+    protected $description = 'Delete registrations that were never confirmed';
+
+    public function handle(): int
+    {
+        $stale = User::query()
+            ->whereNull('email_verified_at')
+            ->where('created_at', '<', now()->subDays(self::AFTER_DAYS))
+            // Not a join: the two tables are linked by user_id OR by address
+            // (see Customer::emailTaken — a row can predate or outlive the
+            // other), and either one means somebody is a customer.
+            ->whereNotExists(fn ($q) => $q->selectRaw('1')->from('customers')
+                ->whereColumn('customers.user_id', 'users.id'))
+            ->whereNotExists(fn ($q) => $q->selectRaw('1')->from('customers')
+                ->whereColumn('customers.email', 'users.email'))
+            ->get();
+
+        if ($stale->isEmpty()) {
+            $this->info('Nothing to remove.');
+
+            return self::SUCCESS;
+        }
+
+        if ($this->option('dry-run')) {
+            foreach ($stale as $user) {
+                $this->line('would remove: '.$user->email.' (registered '.$user->created_at->toDateString().')');
+            }
+
+            return self::SUCCESS;
+        }
+
+        foreach ($stale as $user) {
+            // Logged individually rather than as a count: an address that
+            // disappears is the kind of thing somebody asks about later, and a
+            // number in a log answers nothing.
+            Log::info('Removing an unconfirmed registration', [
+                'email' => $user->email,
+                'registered_at' => $user->created_at?->toIso8601String(),
+            ]);
+
+            $user->delete();
+        }
+
+        $this->info($stale->count().' unconfirmed registration(s) removed.');
+
+        return self::SUCCESS;
+    }
+}

app/Console/Commands/PublishProcessingAgreement.php

@@ -0,0 +1,85 @@
+<?php
+
+namespace App\Console\Commands;
+
+use App\Models\DpaVersion;
+use App\Services\Legal\DpaRenderer;
+use Illuminate\Console\Command;
+use Illuminate\Support\Facades\Storage;
+
+/**
+ * Render the processing agreement and its annex, store them, put them in force.
+ *
+ * The documents are generated from the repository (resources/views/legal/dpa),
+ * so a change to the wording is a change somebody can review in a diff — and the
+ * company name, the sub-processors and the deletion deadlines come from the same
+ * places the rest of the application reads them, which is what stops the
+ * agreement drifting away from what the software does.
+ *
+ * The console's upload form still exists and is unchanged: a lawyer's revision
+ * arrives as a PDF and becomes a version like any other. This command is for the
+ * version this application maintains itself.
+ */
+class PublishProcessingAgreement extends Command
+{
+    protected $signature = 'clupilot:publish-dpa
+        {version : What the document calls itself, e.g. 1.0}
+        {--draft : Store it without putting it in force}';
+
+    protected $description = 'Render the processing agreement and its annex, and put them in force';
+
+    public function handle(DpaRenderer $renderer): int
+    {
+        $version = (string) $this->argument('version');
+
+        if (DpaVersion::query()->where('version', $version)->exists()) {
+            $this->error("Version {$version} already exists. Pick another name — two documents under one name makes every acceptance ambiguous.");
+
+            return self::FAILURE;
+        }
+
+        $agreementPath = 'dpa/av-vertrag-'.$this->slug($version).'.pdf';
+        $measuresPath = 'dpa/tom-'.$this->slug($version).'.pdf';
+
+        // Visibility "public" is about the FILE MODE, not about the web: this
+        // disk's root is outside the document root and nothing here becomes
+        // reachable by URL. What it changes is 0755/0644 instead of 0700/0600 —
+        // and that is the difference between a document the web process can read
+        // and one it cannot.
+        //
+        // It matters because this command is normally run as root (an artisan
+        // call in a container is root; PHP-FPM is www-data). The first run left
+        // a directory only root could enter, the route's exists() check answered
+        // false, and every link on the page 404'd with nothing in any log to say
+        // why.
+        Storage::disk('local')->put($agreementPath, $renderer->agreement($version), 'public');
+        Storage::disk('local')->put($measuresPath, $renderer->measures($version), 'public');
+
+        $row = DpaVersion::query()->create([
+            'version' => $version,
+            'agreement_path' => $agreementPath,
+            'measures_path' => $measuresPath,
+            // Publishing is the point of the command; --draft is for looking at
+            // it first. Every customer who accepted an earlier version is
+            // outstanding again from this moment.
+            'published_at' => $this->option('draft') ? null : now(),
+        ]);
+
+        foreach ([$agreementPath, $measuresPath] as $path) {
+            if (Storage::disk('local')->getVisibility($path) !== 'public') {
+                $this->warn("{$path} is not readable by the web process. Run this as the user PHP runs as, or fix the mode — the page will 404 otherwise.");
+            }
+        }
+
+        $this->info(($this->option('draft') ? 'Drafted' : 'Published').' version '.$row->version.'.');
+        $this->line('  '.$agreementPath.' ('.number_format(strlen(Storage::disk('local')->get($agreementPath)) / 1024, 0).' KB)');
+        $this->line('  '.$measuresPath.' ('.number_format(strlen(Storage::disk('local')->get($measuresPath)) / 1024, 0).' KB)');
+
+        return self::SUCCESS;
+    }
+
+    private function slug(string $version): string
+    {
+        return preg_replace('/[^a-z0-9.-]+/i', '-', $version) ?: 'version';
+    }
+}

app/Console/Commands/PublishTunnelNames.php

@@ -0,0 +1,111 @@
+<?php
+
+namespace App\Console\Commands;
+
+use App\Services\Dns\HostDnsDirectory;
+use App\Support\HostnamePattern;
+use Illuminate\Console\Command;
+use Symfony\Component\Console\Output\ConsoleOutputInterface;
+
+/**
+ * Macht Portal, Website und Statusseite im Management-Tunnel auflösbar.
+ *
+ * Ohne das trägt der Tunnel nur `10.66.0.0/24`, und diese Namen zeigen auf die
+ * öffentliche Adresse des Servers — der Verkehr geht also am Tunnel vorbei, und
+ * die Anwendung sieht die öffentliche Adresse des Anrufers statt seiner
+ * `10.66.0.x`. Genau daran scheiterte „über VPN die verborgene Seite ansehen":
+ * die Konsole ging, weil ihr Name als einziger umgebogen war.
+ *
+ * `files.` steht bewusst NICHT in der Liste. Dort holt ein Server im
+ * Rettungssystem sein Bootstrap-Archiv, und der ist per Definition nicht im
+ * Tunnel — bögen wir den Namen um, holte er es nie.
+ *
+ * Die Datei landet in demselben Verzeichnis, das dnsmasq mit `--hostsdir`
+ * überwacht, und in dem RegisterHostDns schon die Host-Namen ablegt. Kein
+ * Neustart, kein Reload: das Erscheinen der Datei IST die Veröffentlichung.
+ */
+class PublishTunnelNames extends Command
+{
+    /** Eine Datei für die ganze Gruppe — siehe HostDnsDirectory::writeMany(). */
+    private const KEY = 'platform';
+
+    protected $signature = 'clupilot:publish-tunnel-names';
+
+    protected $description = 'Macht Portal, Website und Statusseite im Management-Tunnel auflösbar';
+
+    public function handle(HostDnsDirectory $dns): int
+    {
+        // Ohne Tunnel gibt es keinen Gateway, der diese Namen bedienen könnte.
+        // Eine hosts-Datei für einen Resolver, den niemand startet, ist nur
+        // etwas, das beim späteren Einschalten falsch sein kann.
+        if ((string) config('admin_access.vpn_internal_host') === '') {
+            $dns->writeMany(self::KEY, [], '');
+            $this->info('Kein Tunnel konfiguriert — nichts veröffentlicht.');
+
+            return self::SUCCESS;
+        }
+
+        $candidates = array_values(array_unique(array_filter(array_merge(
+            [(string) config('admin_access.app_host')],
+            array_map('strval', (array) config('admin_access.site_hosts', [])),
+            [(string) config('admin_access.status_host')],
+        ))));
+
+        // `bind-hosts` weist einen NEUEN Wert dieser Form inzwischen zurück,
+        // aendert aber nichts an einem, der schon in der .env steht. Auf der
+        // Produktivmaschine stand dort bereits ein Markdown-Link aus einem
+        // Kopiervorgang (`[www.clupilot.com](https://www.clupilot.com)`), von
+        // VOR dieser Prüfung — geschrieben, weil EnvFileEditor nur prüft, ob
+        // die ZEILE die Form KEY=value hat. Ungeprüft ginge so ein Wert in
+        // `platform.hosts`, und der Resolver böge einen Unsinns-Namen um.
+        $names = [];
+
+        foreach ($candidates as $candidate) {
+            if (HostnamePattern::matches($candidate)) {
+                $names[] = $candidate;
+
+                continue;
+            }
+
+            $this->skipped($candidate);
+        }
+
+        $hub = (string) config('provisioning.wireguard.hub_address');
+
+        $dns->writeMany(self::KEY, $names, $hub);
+
+        if ($names === []) {
+            $this->info('Keine Hostnamen konfiguriert — nichts veröffentlicht.');
+
+            return self::SUCCESS;
+        }
+
+        foreach ($names as $name) {
+            $this->line("  {$hub} {$name}");
+        }
+
+        return self::SUCCESS;
+    }
+
+    /**
+     * Nicht still: eine ausgelassene `.env`-Altlast soll auffallen, auch wenn
+     * niemand die Ausgabe dieses Befehls Zeile für Zeile liest.
+     *
+     * Auf STDERR statt über `$this->error()` — das faerbt nur denselben Strom
+     * rot ein, den auch `$this->line()` benutzt. `deploy/update.sh` ruft
+     * diesen Befehl mit `2>&1` auf und sieht den Unterschied nicht, aber ein
+     * Betreiber, der ihn von Hand startet und nur STDOUT protokolliert, soll
+     * die Meldung trotzdem bekommen. `getOutput()` liefert in einem echten
+     * CLI-Lauf die `ConsoleOutput`, die einen echten zweiten Strom hat; im
+     * Testlauf ist es der gepufferte Mock aus PendingCommand, der keiner ist
+     * — dort faellt das auf den normalen Strom zurück, und Tests sehen die
+     * Meldung trotzdem.
+     */
+    private function skipped(string $value): void
+    {
+        $stream = $this->output->getOutput();
+        $target = $stream instanceof ConsoleOutputInterface ? $stream->getErrorOutput() : $stream;
+
+        $target->writeln("  uebersprungen: „{$value}“ ist kein Hostname.");
+    }
+}

app/Console/Commands/RefreshHostFirewall.php

@@ -0,0 +1,149 @@
+<?php
+
+namespace App\Console\Commands;
+
+use App\Models\Host;
+use App\Models\ProvisioningRun;
+use App\Provisioning\Jobs\AdvanceRunJob;
+use Illuminate\Console\Command;
+
+/**
+ * Schreibt einem bereits übernommenen Host sein nftables-Regelwerk neu.
+ *
+ * Der Anlass: die beiden Sperrmengen `clupilot_blocked`/`clupilot_blocked6`
+ * kamen mit dem Frühwarnsystem ins Regelwerk. Jeder Host, der VORHER übernommen
+ * wurde, trägt noch die alte Datei — dort scheitert `nft add element` bei jedem
+ * Versuch, und die Sperre steht in Datenbank, Portal, Konsole und in der Mail
+ * an den Kunden als aktiv, in der Firewall aber nie. `HostFirewall` meldet
+ * diesen Fall inzwischen (`report()`); DAS hier ist der Griff, mit dem man ihn
+ * abstellt.
+ *
+ * Warum ein Befehl und kein Zeitplan — dieselbe Begründung wie bei
+ * `clupilot:apply-quotas`, an dem sich dieser hier orientiert:
+ *
+ *  - das Loch ist endlich und schließt sich endgültig. Jeder ab jetzt
+ *    übernommene Host bekommt die Mengen im Onboarding;
+ *  - ein nächtlicher Lauf wäre eine zweite Instanz, die dieselbe Datei auf
+ *    laufende Maschinen schreibt, und würde am Tag, an dem der Schritt in der
+ *    Pipeline still kaputtginge, für ihn einspringen — das Versagen käme nie
+ *    ans Licht;
+ *  - eine Reparatur, die der Betreiber anstößt, ist eine, deren Ausgabe er
+ *    liest. Dieser Befehl sagt, was er anfasst und was nicht, und rührt unter
+ *    `--dry-run` nichts an.
+ *
+ * Die Arbeit selbst läuft über die `host-firewall`-Pipeline, also über
+ * denselben `SecureHostFirewall`-Schritt, den auch das Onboarding fährt —
+ * gedrosselt, wiederholt, protokolliert und in der Konsole sichtbar wie jede
+ * andere Fernarbeit. Ein zweiter Weg, dieselbe Datei zu schreiben, würde
+ * driften.
+ *
+ * Der Schritt prüft von der Hostseite aus selbst nach, dass der Tunnel steht,
+ * und fasst nichts an, wenn nicht. Ein Host, der gerade nicht erreichbar ist,
+ * wird also nicht halb umgestellt.
+ */
+class RefreshHostFirewall extends Command
+{
+    protected $signature = 'clupilot:refresh-host-firewall
+        {--dry-run : auflisten, was liefe, und nichts anfassen}
+        {--host= : nur dieser eine Host, per Name oder oeffentlicher Adresse}';
+
+    protected $description = 'Schreibt uebernommenen Hosts ihr nftables-Regelwerk neu — inklusive der Sperrmengen';
+
+    public function handle(): int
+    {
+        $dryRun = (bool) $this->option('dry-run');
+        $started = 0;
+
+        /** @var array<string, int> Grund => Anzahl */
+        $skipped = [];
+
+        $query = Host::query();
+
+        if ($name = $this->option('host')) {
+            $query->where(fn ($q) => $q->where('name', $name)->orWhere('public_ip', $name));
+        }
+
+        foreach ($query->cursor() as $host) {
+            $reason = $this->reasonToSkip($host);
+
+            if ($reason !== null) {
+                $skipped[$reason] = ($skipped[$reason] ?? 0) + 1;
+
+                continue;
+            }
+
+            $started++;
+            $this->line(($dryRun ? '[Probelauf] ' : '')."{$host->name} ({$host->public_ip}) über {$host->wg_ip}");
+
+            if (! $dryRun) {
+                $this->startRun($host);
+            }
+        }
+
+        foreach ($skipped as $reason => $count) {
+            $this->line("übersprungen ({$reason}): {$count}");
+        }
+
+        $this->info($dryRun
+            ? "Probelauf: {$started} Host(s) bekämen ihr Regelwerk neu, ".array_sum($skipped).' übersprungen. Nichts wurde geändert.'
+            : "{$started} Lauf/Läufe gestartet, ".array_sum($skipped).' übersprungen.');
+
+        return self::SUCCESS;
+    }
+
+    /**
+     * Warum dieser Host in Ruhe gelassen wird, oder null.
+     *
+     * Der Grund IST der Bericht: „12 übersprungen" und sonst nichts ist keine
+     * Auskunft, mit der jemand etwas anfangen kann — „12 sind noch in der
+     * Übernahme" und „12 haben keinen Tunnel" sehen von hier aus gleich aus.
+     */
+    private function reasonToSkip(Host $host): ?string
+    {
+        // Der Schritt verbindet sich über die WireGuard-Adresse und prüft den
+        // Tunnel von der Hostseite. Ohne beides gibt es nichts nachzuziehen.
+        if (blank($host->wg_ip) || blank($host->ssh_host_key)) {
+            return 'kein Tunnel, kein gepinnter Schlüssel';
+        }
+
+        // Ein Host mitten in der Übernahme bekommt sein Regelwerk ohnehin
+        // gleich — und ein zweiter Lauf daneben schriebe dieselbe Datei.
+        if (! in_array($host->status, ['active', 'disabled'], true)) {
+            return 'nicht übernommen (Status '.$host->status.')';
+        }
+
+        if ($this->hasRunInFlight($host)) {
+            return 'anderer Lauf aktiv';
+        }
+
+        return null;
+    }
+
+    private function startRun(Host $host): void
+    {
+        $run = ProvisioningRun::create([
+            'subject_type' => Host::class,
+            'subject_id' => $host->id,
+            'pipeline' => 'host-firewall',
+            'status' => ProvisioningRun::STATUS_PENDING,
+            'current_step' => 0,
+            'context' => [],
+        ]);
+
+        AdvanceRunJob::dispatch($run->uuid);
+    }
+
+    /**
+     * JEDER Lauf gegen diesen Host, absichtlich weit gefasst: das hier ist ein
+     * Reparatur-Durchgang. Er läuft wieder, und ein heute übergangener Host ist
+     * beim nächsten Aufruf dran. Nichts geht durch Warten verloren.
+     */
+    private function hasRunInFlight(Host $host): bool
+    {
+        return ProvisioningRun::query()
+            ->where('subject_type', Host::class)
+            ->where('subject_id', $host->id)
+            ->inFlight()
+            ->exists();
+    }
+}

app/Console/Commands/RemindEndingServices.php

@@ -0,0 +1,123 @@
+<?php
+
+namespace App\Console\Commands;
+
+use App\Mail\ServiceEndingSoonMail;
+use App\Models\Instance;
+use Illuminate\Console\Command;
+use Illuminate\Support\Facades\Log;
+use Illuminate\Support\Facades\Mail;
+use Throwable;
+
+/**
+ * Die Erinnerung, bevor EndInstanceService die Adresse einzieht.
+ *
+ * Am Laufzeitende zieht EndInstanceService die Route und den DNS-Eintrag
+ * einer gekündigten Instanz ein — richtig so, das bleibt unangetastet. Die
+ * Folge, die bisher niemand aussprach: ab genau diesem Moment kommt der Kunde
+ * selbst nicht mehr an seine Nextcloud. Wer eigene Dateien herunterladen
+ * will, muss es VORHER tun, und dieser Befehl ist der einzige Ort im Bestand,
+ * der ihm das vorher sagt.
+ *
+ * Das Gegenstück zu App\Console\Commands\EndDueServices — der beendet, was
+ * fällig ist, dieser hier kündigt an, was demnächst fällig wird. Dieselbe
+ * Bauform: `--dry-run`, eine Zeile pro betroffener Instanz, eine
+ * zusammenfassende Meldung am Ende.
+ *
+ * ## Die Auswahl: höchstens sieben Tage, nicht genau sieben
+ *
+ * Ein Gleichheitsvergleich auf einen Tag verfehlt jede Instanz, die zwischen
+ * zwei täglichen Läufen durchrutscht — ein Lauf, der einen Tag ausfällt,
+ * oder eine Instanz, die mit kurzer Frist gekündigt wurde und deren Ende von
+ * Anfang an weniger als sieben Tage entfernt lag. Der Preis eines verfehlten
+ * Vergleichs ist, dass jemand ausgesperrt wird, ohne es gewusst zu haben —
+ * lieber spät erinnert als gar nicht. `export_reminded_at` sorgt dafür, dass
+ * daraus trotzdem nur EINE Mail wird: eine Erinnerung im Sechserpack liest
+ * sich als Mahnung.
+ */
+class RemindEndingServices extends Command
+{
+    protected $signature = 'clupilot:remind-ending-services
+        {--dry-run : listet auf, wer erinnert würde, und ändert nichts}';
+
+    protected $description = 'Erinnert Kunden einmalig ans Selbst-Herunterladen, bevor ihre gekündigte Cloud unerreichbar wird';
+
+    public function handle(): int
+    {
+        $dryRun = (bool) $this->option('dry-run');
+        $reminded = 0;
+
+        $due = Instance::query()
+            ->with('customer')
+            ->where('status', 'cancellation_scheduled')
+            ->whereNotNull('service_ends_at')
+            // In der Zukunft und höchstens sieben Tage entfernt — siehe
+            // Kopfkommentar. Eine bereits abgelaufene Instanz gehört
+            // EndDueServices, nicht mehr dieser Erinnerung.
+            ->where('service_ends_at', '>', now())
+            ->where('service_ends_at', '<=', now()->addDays(7))
+            ->whereNull('export_reminded_at')
+            ->cursor();
+
+        foreach ($due as $instance) {
+            $customer = $instance->customer;
+
+            if ($customer === null || blank($customer->email)) {
+                // $customer === null ist über die Anwendung praktisch
+                // unerreichbar: instances.customer_id ist ein
+                // Pflicht-Fremdschlüssel mit Kaskade, und customers.email ist
+                // NOT NULL. Trotzdem abgefangen statt vorausgesetzt — eine
+                // Instanz ohne ansprechbaren Kunden soll den ganzen Lauf
+                // nicht mitreißen, welcher Zustand sie auch dorthin gebracht
+                // hätte. Laut, aber ohne export_reminded_at zu setzen: eine
+                // Mail, die nie eine Adresse hatte, ist keine, die verschickt
+                // wurde.
+                Log::warning('Instanz nähert sich dem Laufzeitende, aber kein erreichbarer Kunde dahinter.', [
+                    'instance' => $instance->uuid,
+                ]);
+
+                continue;
+            }
+
+            $this->line(($dryRun ? '[dry-run] ' : '')
+                ."{$instance->subdomain}: Laufzeit endet am "
+                .$instance->service_ends_at->local()->isoFormat('LL'));
+
+            if ($dryRun) {
+                $reminded++;
+
+                continue;
+            }
+
+            try {
+                $mail = new ServiceEndingSoonMail($instance);
+                Mail::mailer($mail->mailer)->to($customer->email)->queue($mail);
+
+                // In DERSELBEN Absicherung wie der Versand, nicht danach:
+                // hinge ausgerechnet dieser Schreibzugriff (Datenbank kurz
+                // weg), bliebe die Marke leer, obwohl die Mail schon
+                // eingereiht ist — derselbe Kunde bekäme morgen eine zweite.
+                // Und ein ungefangener Fehler hier würde den ganzen Lauf
+                // abbrechen, statt nur diese eine Instanz zu überspringen —
+                // die restlichen Instanzen des Tages kämen erst morgen an
+                // die Reihe, ein Siebtel der sieben Tage Vorlauf verloren.
+                $instance->update(['export_reminded_at' => now()]);
+            } catch (Throwable $e) {
+                Log::warning('Die Erinnerung vor dem Laufzeitende ließ sich nicht einreihen oder nicht vermerken.', [
+                    'instance' => $instance->uuid,
+                    'exception' => $e->getMessage(),
+                ]);
+
+                continue;
+            }
+
+            $reminded++;
+        }
+
+        $this->info($dryRun
+            ? "Probelauf: {$reminded} Erinnerung(en) würden verschickt. Nichts wurde geändert."
+            : "{$reminded} Erinnerung(en) verschickt.");
+
+        return self::SUCCESS;
+    }
+}

app/Console/Commands/RepriceStripeSubscriptions.php

@@ -0,0 +1,152 @@
+<?php
+
+namespace App\Console\Commands;
+
+use App\Actions\MoveStripeSubscriptionPrice;
+use App\Actions\SyncStripeAddonItems;
+use App\Models\Subscription;
+use App\Services\Billing\PlanPrices;
+use App\Services\Stripe\StripeClient;
+use Illuminate\Console\Command;
+
+/**
+ * Move contracts that are still billing on a superseded Stripe Price.
+ *
+ * stripe:sync-catalogue mints the Price that charges today's figure and archives
+ * the one it replaces — and that is all it does. Archiving a Price in Stripe
+ * stops it being SOLD; every subscription already on it goes on being billed at
+ * the old amount for ever. This is the second half, and it is a command of its
+ * own because it touches live contracts and money, which is a decision an owner
+ * makes deliberately rather than a side effect of syncing a price list.
+ *
+ * Run it after every stripe:sync-catalogue that reported a change:
+ *
+ *     php artisan stripe:sync-catalogue --dry-run
+ *     php artisan stripe:sync-catalogue
+ *     php artisan stripe:reprice-subscriptions --dry-run
+ *     php artisan stripe:reprice-subscriptions
+ *
+ * **Nothing is prorated.** The customer has already paid for the term they are
+ * in, at whatever was taken at the time; charging the difference for days already
+ * served would be a bill nobody agreed to, and Stripe's own default would raise
+ * exactly that. From the next cycle the right amount is taken.
+ *
+ * **Safe to re-run.** Both halves ask whether the contract is already on the
+ * right Price and do nothing when it is, so a second run is free and a run
+ * interrupted halfway finishes on the next attempt. The package half never
+ * throws — MoveStripeSubscriptionPrice parks its failures on the contract and
+ * clupilot:sync-stripe-subscriptions retries them hourly.
+ *
+ * **Two reasons a contract moves, not one.** The first is a change of FIGURE, as
+ * above. The second is a change of CUSTOMER: a business whose VAT id is verified
+ * the week after they bought must be billed the net Price from then on, because
+ * reverse charge means they owe no VAT to us at all — and one whose registration
+ * has lapsed must go back onto the gross one. Neither is a change of package, so
+ * nothing else in the system would ever notice, and both converge here on the next
+ * run. PlanPrices::liveForSubscription() answers "which Price does this contract
+ * belong on?" for both, which is why this command has no resolver of its own: two
+ * places working that out is how they come to disagree.
+ *
+ * The contract's own `price_cents` is not touched by any of this. It is the
+ * catalogue's NET figure, it is frozen, and PlanChange prorates against it.
+ */
+class RepriceStripeSubscriptions extends Command
+{
+    protected $signature = 'stripe:reprice-subscriptions
+        {--dry-run : Show which contracts would move without touching Stripe}
+        {--limit=500 : How many contracts to look at in one run}';
+
+    protected $description = 'Move live contracts onto the Stripe prices the catalogue now sells';
+
+    public function handle(
+        StripeClient $stripe,
+        MoveStripeSubscriptionPrice $move,
+        SyncStripeAddonItems $modules,
+        PlanPrices $prices,
+    ): int {
+        $dryRun = (bool) $this->option('dry-run');
+
+        if (! $dryRun && ! $stripe->isConfigured()) {
+            $this->error('Stripe is not configured (STRIPE_SECRET is empty). Nothing was moved.');
+
+            return self::FAILURE;
+        }
+
+        // Active contracts Stripe actually bills. A cancelled one is not billed
+        // again, and a granted one has no Stripe subscription at all — moving
+        // either would be housekeeping on something that charges nobody.
+        $contracts = Subscription::query()
+            ->whereNotNull('stripe_subscription_id')
+            ->where('status', 'active')
+            ->orderBy('id')
+            ->limit((int) $this->option('limit'))
+            ->get();
+
+        $packages = 0;
+        $items = 0;
+        $failed = 0;
+
+        foreach ($contracts as $contract) {
+            // Whether the catalogue prices this contract's package at all, asked
+            // separately from WHICH Price it should be on. A version that was never
+            // priced is a contract this command has nothing to say about; one that
+            // is priced but has no Stripe Price for this customer's treatment is a
+            // contract that must move, and the move is what mints it.
+            $priced = $prices->rowFor($contract) !== null;
+            $target = $priced ? $prices->liveForSubscription($contract) : null;
+
+            if ($priced && $contract->stripe_price_id !== $target) {
+                $this->line(sprintf(
+                    '  package  %s  %s → %s',
+                    $contract->uuid,
+                    $contract->stripe_price_id ?? '(unknown)',
+                    // Null where the catalogue has no Price for what this customer
+                    // should be charged. Said out loud rather than skipped: the move
+                    // below parks the reason on the contract and the run warns about
+                    // it, and the cure is one command.
+                    $target ?? '(not synced)',
+                ));
+                $packages++;
+
+                // PRORATE_NONE: the term in progress is paid for. See the class
+                // comment — this must never raise a charge for days already
+                // served at the old figure.
+                if (! $dryRun && ! $move($contract, StripeClient::PRORATE_NONE)) {
+                    $failed++;
+                }
+            }
+
+            foreach ($modules->reprice($contract, $dryRun) as $item) {
+                $this->line(sprintf(
+                    '  module   %s  %s  %s → %s',
+                    $contract->uuid,
+                    $item['addon'],
+                    $item['from'] ?? '(none)',
+                    $item['to'] ?? '(to be created)',
+                ));
+                $items++;
+            }
+        }
+
+        $this->newLine();
+
+        if ($packages === 0 && $items === 0) {
+            $this->info('Every live contract is already on the price the catalogue sells.');
+
+            return self::SUCCESS;
+        }
+
+        $this->info($dryRun
+            ? "{$packages} package(s) and {$items} module item(s) would move. Run without --dry-run to move them."
+            : "{$packages} package(s) and {$items} module item(s) moved.");
+
+        if ($failed > 0) {
+            // Parked on the contract by the action and retried hourly by
+            // clupilot:sync-stripe-subscriptions, so this is a warning and not a
+            // failure — but somebody watching the output has to be told.
+            $this->warn("{$failed} package move(s) did not reach Stripe and are parked for the hourly retry.");
+        }
+
+        return self::SUCCESS;
+    }
+}

app/Console/Commands/SampleServiceStatus.php

@@ -0,0 +1,78 @@
+<?php
+
+namespace App\Console\Commands;
+
+use App\Models\StatusDay;
+use App\Services\Status\ServiceHealth;
+use Illuminate\Console\Command;
+use Illuminate\Support\Carbon;
+use Illuminate\Support\Facades\DB;
+
+/**
+ * Writes one sample of every public component into today's row.
+ *
+ * The ninety-day bar on the status page is the one figure a reader checks
+ * against their own memory, so it has to come from something that was actually
+ * recorded at the time. There is no way to reconstruct it afterwards: the
+ * monitoring table holds the LAST verdict per instance, not a history, and by
+ * the time anybody asks about last Tuesday that verdict is about today.
+ *
+ * Runs on the scheduler beside the monitoring sync it depends on. A missed run
+ * costs one sample out of roughly three hundred in a day; a missed DAY leaves
+ * no row at all, and the page draws that as "not recorded" rather than
+ * inventing a colour for it.
+ */
+class SampleServiceStatus extends Command
+{
+    protected $signature = 'clupilot:sample-status';
+
+    protected $description = 'Record the current state of every public status component into the daily history';
+
+    public function handle(ServiceHealth $health): int
+    {
+        // The wall clock, not UTC: the bar is labelled with days a reader
+        // recognises, and a sample taken at 01:30 local belongs to the day they
+        // would call it (R19).
+        $day = Carbon::now()->local()->toDateString();
+
+        foreach ($health->components() as $component) {
+            $state = $component['state'];
+
+            // One statement, so two schedulers racing on the same minute cannot
+            // read-modify-write over each other. The counters are increments,
+            // never assignments — a sample is a thing that happened, and a
+            // later run must not be able to undo it.
+            DB::table('status_days')->upsert(
+                [[
+                    'day' => $day,
+                    'component' => $component['key'],
+                    'samples' => 1,
+                    'operational' => $state === 'operational' ? 1 : 0,
+                    'degraded' => $state === 'degraded' ? 1 : 0,
+                    'down' => $state === 'down' ? 1 : 0,
+                    'unknown' => $state === 'unknown' ? 1 : 0,
+                    'created_at' => now(),
+                    'updated_at' => now(),
+                ]],
+                ['day', 'component'],
+                [
+                    'samples' => DB::raw('samples + 1'),
+                    'operational' => DB::raw('operational + '.($state === 'operational' ? 1 : 0)),
+                    'degraded' => DB::raw('degraded + '.($state === 'degraded' ? 1 : 0)),
+                    'down' => DB::raw('down + '.($state === 'down' ? 1 : 0)),
+                    'unknown' => DB::raw('unknown + '.($state === 'unknown' ? 1 : 0)),
+                    'updated_at' => DB::raw('CURRENT_TIMESTAMP'),
+                ],
+            );
+        }
+
+        // Beyond the window the page can draw, the rows are only weight. Kept a
+        // fortnight longer than the ninety days shown so a change of window
+        // does not immediately hit an empty table.
+        StatusDay::query()
+            ->where('day', '<', Carbon::now()->local()->subDays(104)->toDateString())
+            ->delete();
+
+        return self::SUCCESS;
+    }
+}

app/Console/Commands/ServerTerminalKey.php

@@ -0,0 +1,50 @@
+<?php
+
+namespace App\Console\Commands;
+
+use App\Services\Terminal\ServerIdentity;
+use Illuminate\Console\Command;
+
+/**
+ * Die öffentliche Hälfte der Serverkennung, eine Zeile, sonst nichts.
+ *
+ * Gerufen von `/usr/local/sbin/clupilot-host-step install-server-terminal` —
+ * der root-eigenen Hälfte auf dem Wirt, die daraus einen Eintrag in
+ * `/root/.ssh/authorized_keys` macht. Nach demselben Muster wie
+ * `apply-proxy-hosts`: der privilegierte Schritt HOLT sich den Wert selbst,
+ * statt ihn vom Dienstkonto gereicht zu bekommen, und prüft ihn dann hart.
+ *
+ * Nur die öffentliche Hälfte. Ausgabe eines Kommandos wandert in Protokolle
+ * und Terminalverläufe; was hier herauskommt, stünde ohnehin in jeder
+ * authorized_keys.
+ *
+ * Kein Erzeugen auf Zuruf: gibt es keine Kennung, endet das Kommando mit 3 und
+ * einem Satz, der sagt, wo sie entsteht. Ein Kommando, das im Vorbeigehen einen
+ * Schlüssel mintet, täte es unter niemandes Namen — und der Tresor hält fest,
+ * WER einen Wert gesetzt hat.
+ */
+class ServerTerminalKey extends Command
+{
+    protected $signature = 'clupilot:server-terminal-key';
+
+    protected $description = 'Print the public half of the server terminal SSH identity';
+
+    public function handle(): int
+    {
+        $publicKey = ServerIdentity::publicKey();
+
+        if ($publicKey === null) {
+            $this->getOutput()->writeln(
+                '<error>Für den Server ist keine SSH-Kennung erzeugt. In der Konsole unter Einstellungen → Terminal zum Server anlegen.</error>',
+            );
+
+            return 3;
+        }
+
+        // Nur die Zeile, ohne Rahmen und ohne Farbe: der Aufrufer ist ein
+        // Skript, das sie zeichengenau weiterverarbeitet.
+        $this->getOutput()->writeln($publicKey);
+
+        return self::SUCCESS;
+    }
+}

app/Console/Commands/SweepOrphanStripePrices.php

@@ -0,0 +1,156 @@
+<?php
+
+namespace App\Console\Commands;
+
+use App\Models\PlanFamily;
+use App\Models\StripeAddonPrice;
+use App\Models\StripePlanPrice;
+use App\Services\Stripe\StripeClient;
+use Illuminate\Console\Command;
+
+/**
+ * The Prices at our Products that no row of ours knows.
+ *
+ * App\Services\Billing\AdoptStripePrice takes over an orphan it can prove is
+ * ours. What it will not take over — a Price carrying none of our metadata, or
+ * one that charges in a way we never mint — it names in the log and leaves,
+ * because adopting a stranger's Price is worse than minting a second one. That
+ * was the right call and it left an operator with a log line and no way to act
+ * on it.
+ *
+ * **What this lists is wider than that log line.** Every active RECURRING Price
+ * at one of our Products that no row of ours knows — adoptable or not. The only
+ * question asked below is whether a register row holds the id; nothing here
+ * re-asks AdoptStripePrice whether it would have taken the Price over.
+ *
+ * Recurring, because activePricesFor() sends `type: recurring` as well as
+ * `active: true`. That filter can hide somebody else's one-time Price from the
+ * list; it can never hide one of ours. createPrice() always sends
+ * `recurring[interval]`, and it is the only call that mints a Price at one of
+ * our Products at all — the setup fee is priced inline at the checkout, under an
+ * ad-hoc Product of its own. So the filter errs toward listing too little, never
+ * toward missing an orphan of ours.
+ *
+ * **So stripe:sync-catalogue runs first.** Until it has, an orphan listed here
+ * may be one the next sync would simply have adopted, and --archive on that one
+ * is worse than it looks. Archiving it makes it invisible to the very step that
+ * would have rescued it: activePricesFor() asks Stripe for ACTIVE prices only,
+ * so adoption finds nothing and the sync falls through to createPrice() — under
+ * the same idempotency key the crashed run used, because the key is built from
+ * what is being sold and everything the call puts on the wire (see
+ * App\Services\Stripe\IdempotencyKey), and nothing about either has changed. For
+ * twenty-four hours Stripe answers a repeated key by replaying the response it
+ * stored rather than doing anything: the archived Price's id, in the body it had
+ * while it was still live. The register writes that id down as the live Price
+ * for the row, and a checkout on it is refused.
+ *
+ * Without --archive this reports and touches nothing. With it, the orphans are
+ * archived at Stripe, which is harmless for everything THIS codebase sells, for
+ * the reason it always is here: Stripe goes on billing every subscription
+ * already on an archived Price, it only stops being SOLD — and nothing this
+ * codebase sells is sold on a Price no row knows. That reasoning reaches no
+ * further than this codebase. A Price an operator wired up by hand — a
+ * SUBSCRIPTION payment link built in Stripe's own dashboard against one of our
+ * Products — is exactly the Price carrying none of our metadata described above,
+ * and --archive withdraws it too. A one-time link is the other side of the
+ * recurring filter: neither listed nor archived, and so neither protected nor
+ * disturbed by this command.
+ */
+class SweepOrphanStripePrices extends Command
+{
+    protected $signature = 'stripe:sweep-orphan-prices
+        {--archive : Stop selling the orphans instead of only listing them}
+        {--dry-run : Show what would be archived without touching Stripe}';
+
+    protected $description = 'List the Stripe prices at our products that no row knows, and optionally archive them — run stripe:sync-catalogue first';
+
+    public function handle(StripeClient $stripe): int
+    {
+        $dryRun = (bool) $this->option('dry-run');
+        $archive = (bool) $this->option('archive');
+
+        // Checked on EVERY path, unlike stripe:sync-catalogue's --dry-run,
+        // which touches nothing because everything it compares is already in
+        // our own tables. This command has no local-only mode: the report —
+        // the whole point of it, dry-run or not — is activePricesFor(), a
+        // live call. Skipping this check under --dry-run would not skip the
+        // call, only the graceful error in front of it.
+        if (! $stripe->isConfigured()) {
+            $this->error('Stripe is not configured (STRIPE_SECRET is empty). Nothing was read.');
+
+            return self::FAILURE;
+        }
+
+        $known = StripeAddonPrice::query()->pluck('stripe_price_id')
+            ->merge(StripePlanPrice::query()->pluck('stripe_price_id'))
+            ->filter()
+            ->flip();
+
+        $found = 0;
+
+        foreach ($this->products() as $productId) {
+            foreach ($stripe->activePricesFor($productId) as $price) {
+                if ($known->has($price['id'])) {
+                    continue;
+                }
+
+                $found++;
+
+                $this->line(sprintf(
+                    '  orphan   %s  %d %s %s  product %s  %s',
+                    $price['id'],
+                    $price['unit_amount'],
+                    $price['currency'],
+                    $price['interval'],
+                    $productId,
+                    $price['metadata'] === [] ? 'no metadata' : json_encode($price['metadata']),
+                ));
+
+                if ($archive && ! $dryRun) {
+                    $stripe->archivePrice($price['id']);
+                }
+            }
+        }
+
+        $this->newLine();
+
+        if ($found === 0) {
+            $this->info('Every active price at our products is accounted for.');
+
+            return self::SUCCESS;
+        }
+
+        // Said on every path that found something, including after --archive
+        // has already run: the only question asked above is whether a row holds
+        // the id, so an orphan in this list may be one stripe:sync-catalogue
+        // would have adopted. Archiving that one is the failure this class's
+        // docblock describes, and an operator who has just done it needs to
+        // know as much as one who is about to.
+        $this->warn('  Run stripe:sync-catalogue first — an orphan listed here may be one the next sync would adopt.');
+
+        $this->info(match (true) {
+            $dryRun && $archive => "{$found} orphan(s) would be archived. Run without --dry-run to archive them.",
+            $archive => "{$found} orphan(s) archived. Existing subscriptions on them keep billing.",
+            default => "{$found} orphan(s) found. Once the sync has run, --archive stops selling what is still listed.",
+        });
+
+        return self::SUCCESS;
+    }
+
+    /**
+     * Every Stripe Product this platform owns: one per plan family, one per
+     * module. Read from our own rows rather than from Stripe, because a Product
+     * we do not know is not one whose Prices we can judge.
+     *
+     * @return array<int, string>
+     */
+    private function products(): array
+    {
+        return PlanFamily::query()->whereNotNull('stripe_product_id')->pluck('stripe_product_id')
+            ->merge(StripeAddonPrice::query()->pluck('stripe_product_id'))
+            ->filter()
+            ->unique()
+            ->values()
+            ->all();
+    }
+}

app/Console/Commands/SyncStripeCatalogue.php

@@ -0,0 +1,448 @@
+<?php
+
+namespace App\Console\Commands;
+
+use App\Models\PlanFamily;
+use App\Models\PlanPrice;
+use App\Models\PlanVersion;
+use App\Models\Subscription;
+use App\Services\Billing\AddonCatalogue;
+use App\Services\Billing\AddonPrices;
+use App\Services\Billing\AdoptStripePrice;
+use App\Services\Billing\AdoptStripeProduct;
+use App\Services\Billing\PlanPrices;
+use App\Services\Billing\TaxTreatment;
+use App\Services\Stripe\StripeClient;
+use App\Support\OperatingMode;
+use App\Support\StripeCatalogueMode;
+use Illuminate\Console\Command;
+
+/**
+ * Mirrors our catalogue into Stripe: a Product per plan family, a Price per
+ * priced row — and the same for every module we sell.
+ *
+ * Stripe owns the recurring billing — retries, dunning, off-session SCA,
+ * invoice numbering — so it needs to know what it is billing for. It does not
+ * need to know how big the VM is, and it is not asked.
+ *
+ * **It pushes TWO Prices for everything it sells.** The catalogue's `amount_cents`
+ * is net and stays net — it is frozen onto every contract and PlanChange prorates
+ * against it — and what Stripe is asked to take from it depends on who is buying:
+ *
+ *  - the DOMESTIC GROSS, which is the figure on the website and what everybody
+ *    who is charged VAT pays, private and business alike. Pushing the net was the
+ *    original defect: a customer quoted 214,80 € paid 179,00 € and was then
+ *    invoiced 179,00 € plus 35,80 € VAT that nobody had collected;
+ *  - the BARE NET, for a business in another member state whose VAT id is
+ *    verified. Reverse charge means no VAT is owed to us at all, so the net is
+ *    the whole of what they owe. Charging them the gross was a flat 20 % surcharge
+ *    with no VAT line on the document for them to reclaim.
+ *
+ * Which of the two a checkout uses is TaxTreatment's decision — see
+ * App\Services\Billing\PlanPrices, which owns the plan half of the mirror, and
+ * App\Services\Billing\AddonPrices, which owns the module half.
+ *
+ * Stripe's `automatic_tax` is deliberately NOT used. TaxTreatment is the single
+ * tax authority here; a second rate computed by Stripe would charge a German
+ * consumer 19 % while our document said 20 %.
+ *
+ * Idempotent by construction, and safe to re-run after a rate change: a row
+ * whose live Price already charges the right figure is skipped, and one that
+ * does not gets a NEW Price with the old one archived. A rate change moves the
+ * gross Price of each pair and leaves the net one untouched, because the net does
+ * not depend on the rate. That matters more here than usual, because a Stripe
+ * Price cannot be edited, so a run that minted duplicates would leave two live
+ * prices for one plan at one figure and no way to tell which a customer is on.
+ *
+ * It does not move anybody. Archiving a Price stops it being SOLD and leaves
+ * every subscription already on it exactly where it was — moving those is
+ * stripe:reprice-subscriptions, which is a separate decision because it touches
+ * live contracts.
+ *
+ * Only PUBLISHED versions are synced. A draft has promised nothing, and a
+ * Product for it would be a price list entry for something that may never
+ * exist.
+ *
+ * Nor is an INTERNAL family (`plan_families.internal`) — handed out by hand,
+ * never sold, never billed. A Stripe Price cannot be deleted once minted, so a
+ * package nobody is ever charged for stays out of the mirror entirely, on a
+ * dry run and for real. A family that already carries Stripe ids from before
+ * it was marked internal keeps them; this only stops anything new being added.
+ *
+ * **A run belongs to ONE Stripe account, and it says which.** Products and
+ * Prices are account-bound, and the operating mode picks the key — so the mode
+ * a run worked in is recorded (App\Support\StripeCatalogueMode) and a run into
+ * a catalogue that belongs to the other account is refused rather than allowed
+ * to skip its way to "already in step". Without that, switching to live left
+ * every stored id pointing at test objects while the readiness page went on
+ * reporting a synced catalogue, and the first real order met "No such price".
+ *
+ * **Modules were missing from this entirely**, which is why a booked module was
+ * charged in the month it was booked and never again: nothing in Stripe existed
+ * to put on the subscription. They are pushed at today's catalogue price on both
+ * terms — a Stripe Price carries its own interval, so a module on a yearly
+ * contract needs a yearly one. What this run cannot cover is a customer
+ * grandfathered on an older figure or holding a discounted grant; those mint
+ * their own Price at the moment they are billed. See App\Services\Billing\AddonPrices.
+ */
+class SyncStripeCatalogue extends Command
+{
+    protected $signature = 'stripe:sync-catalogue {--dry-run : Show what would be created without touching Stripe}';
+
+    protected $description = 'Create the Stripe products and prices for the plan catalogue';
+
+    public function handle(StripeClient $stripe): int
+    {
+        $dryRun = (bool) $this->option('dry-run');
+
+        if (! $dryRun && ! $stripe->isConfigured()) {
+            $this->error('Stripe is not configured (STRIPE_SECRET is empty). Nothing was created.');
+
+            return self::FAILURE;
+        }
+
+        if (StripeCatalogueMode::hasStoredObjects() && StripeCatalogueMode::belongsToAnotherMode()) {
+            $this->error($this->staleCatalogueMessage());
+
+            // Auch der Trockenlauf endet hier, und mit FAILURE: er zählt, was
+            // FEHLT, und in diesem Zustand fehlt nichts — jede Zeile trägt
+            // schon eine ID, nur eine aus dem falschen Konto. „0 object(s)
+            // would be created" wäre die beruhigende Antwort auf die
+            // gefährliche Lage.
+            return self::FAILURE;
+        }
+
+        // VOR der Anlegeschleife, nicht danach. Hier ist bereits bewiesen, dass
+        // entweder nichts liegt oder das Vorhandene dem aktiven Konto gehört —
+        // der Zeitpunkt trägt die Aussage also genauso gut. Am Ende von
+        // handle() trug er sie NICHT: createProduct() und ensure() werfen
+        // ungefangen, und ein Lauf, der nach dem ersten angelegten Objekt
+        // stirbt, hinterließ IDs ohne Herkunft. Der nächste Lauf hielt das für
+        // ein fremdes Konto und trug dem Betreiber auf, einen Katalog zu leeren,
+        // an dem laufende Verträge abgerechnet werden — statt schlicht
+        // wiederaufzusetzen, wofür die Idempotenzschlüssel unten gebaut sind.
+        if (! $dryRun) {
+            if (StripeCatalogueMode::recorded() === null && StripeCatalogueMode::hasStoredObjects()) {
+                $this->line('  note     taking up a catalogue whose account was never recorded; nothing is replaced.');
+            }
+
+            StripeCatalogueMode::record();
+        }
+
+        // Beide Seiten setzen hier an, und beide werden gebraucht.
+        // Die Modus-Sperre oben steht zuerst, weil sie VERWEIGERT: sie darf
+        // nicht hinter etwas laufen, das schon Zustand aufgebaut hat. Die
+        // Zähler darunter müssen nur vor der Anlegeschleife stehen, und das
+        // tun sie hier auch.
+        // Resolved once, as singletons: each counts across the WHOLE run, and a
+        // count taken before ensure()/the adoption call runs can never itself
+        // distinguish "created" from "adopted" — see AdoptStripePrice.
+        $adoptPrices = app(AdoptStripePrice::class);
+        $adoptProducts = app(AdoptStripeProduct::class);
+        $adoptedPricesBefore = $adoptPrices->adoptions;
+        // Duplicates accumulate on the SAME singleton across the whole process,
+        // not only this run — without this, a second handle() in one process
+        // would print a duplicate a previous run already reported.
+        $duplicatesBefore = count($adoptProducts->duplicates);
+
+        $created = 0;
+        // Counted here, locally, rather than on AdoptStripeProduct itself: the
+        // very same class also adopts a MODULE's Product, from
+        // AddonPrices::product() inside syncModules() below, and a module's
+        // Product is never counted as an intent at all — unlike a family's,
+        // which gets its own "product …" line and $created++ right where this
+        // is incremented. A single counter on the class could not tell the two
+        // apart; counting only at the one call site that also counts the
+        // intent avoids the question entirely.
+        $adoptedFamilyProducts = 0;
+
+        foreach (PlanFamily::query()->with('versions.prices')->orderBy('tier')->get() as $family) {
+            // An internal family is never billed through Stripe — handed out by
+            // hand (the internal test package, Enterprise once a machine is
+            // built for it) and never bought. A Stripe Price cannot be deleted,
+            // only archived, so whatever a live run mints here stays in the
+            // operator's account for good — and a package nobody is ever
+            // charged for is not worth that. Skipped here, ahead of the
+            // published-version check below and everything after it, so a
+            // family that already carries Stripe ids from when it WAS sellable
+            // (Enterprise, precisely) is left untouched: nothing is cleared,
+            // nothing is replaced, and nothing new is ever added for it.
+            if ($family->internal) {
+                continue;
+            }
+
+            $published = $family->versions->filter(fn (PlanVersion $version) => $version->isPublished());
+
+            // A family whose versions are all drafts has promised nothing, so
+            // it has no business appearing in Stripe's price list yet.
+            if ($published->isEmpty()) {
+                continue;
+            }
+
+            $productId = $family->stripe_product_id;
+
+            if ($productId === null) {
+                $this->line("  product  {$family->key} — {$family->name}");
+                $created++;
+
+                if (! $dryRun) {
+                    $metadata = ['plan_family' => $family->key, 'plan_family_id' => (string) $family->id];
+
+                    // Asked BEFORE minting, for the same reason the Price side
+                    // asks: a run that died between Stripe's create and our
+                    // update left a Product this row does not know, and the key
+                    // below stops protecting it after twenty-four hours.
+                    // plan_family_id is what proves such a Product is this
+                    // family's.
+                    $productId = $adoptProducts($metadata, ['plan_family_id']);
+
+                    if ($productId !== null) {
+                        // The intent was counted three lines up, so — unlike a
+                        // module's Product — an adoption here may honestly be
+                        // subtracted back out of it below.
+                        $adoptedFamilyProducts++;
+                    }
+
+                    $productId ??= $stripe->createProduct(
+                        $family->name,
+                        $metadata,
+                        // Covers a RETRY, for twenty-four hours, and nothing
+                        // beyond them. What stops a second Product for one
+                        // family is the adoption step above.
+                        idempotencyKey: "clupilot-product-{$family->id}",
+                    );
+
+                    $family->update(['stripe_product_id' => $productId]);
+                }
+            }
+
+            foreach ($published as $version) {
+                foreach ($version->prices as $price) {
+                    $created += $this->syncPrice($family, $version, $price, $productId, $dryRun);
+                }
+            }
+        }
+
+        $created += $this->syncModules($dryRun);
+
+        $this->newLine();
+
+        // $adopted may only subtract what $created actually counted as an
+        // intent. Every price is one, family or module — syncPrice() and
+        // syncModules() both increment $created before knowing whether ensure()
+        // will mint or adopt, so the full price-adoption delta is honest. A
+        // family's Product is one too, counted above, so $adoptedFamilyProducts
+        // is honest for the same reason. A module's Product is NOT one — it
+        // prints no line of its own and increments nothing in syncModules(),
+        // however AdoptStripeProduct answers it — so its adoption stays out of
+        // both figures entirely. Subtracting it would report fewer objects
+        // created than Stripe actually gained.
+        $adopted = ($adoptPrices->adoptions - $adoptedPricesBefore) + $adoptedFamilyProducts;
+        $minted = max(0, $created - $adopted);
+
+        // Sliced to what THIS run added — the list lives on the same
+        // process-wide singleton as the count above, so without the same
+        // before/after care a second handle() in one process would print a
+        // duplicate a previous run already reported.
+        foreach (array_slice($adoptProducts->duplicates, $duplicatesBefore) as $duplicate) {
+            // Named here as well as in the log: an operator running the sweep
+            // reads this, and a second Product for one family is something only
+            // a person can resolve — we deliberately do not deactivate it.
+            $this->warn("  duplicate product {$duplicate} — left active, a product's prices become unsellable if it is deactivated");
+        }
+
+        if ($created === 0) {
+            $this->info('Stripe is already in step with the catalogue.');
+
+            return self::SUCCESS;
+        }
+
+        // "or adopted" on the dry run, and only there. A dry run counts intents
+        // without ever calling ensure(), so it cannot know which of them Stripe
+        // already holds a Price for — and a dry run is the first thing an
+        // operator runs after an interrupted one, which is exactly when some of
+        // these will be adopted rather than minted. The live line below has
+        // both figures because by then the adoption step has answered.
+        $this->info($dryRun
+            ? "{$created} object(s) would be created or adopted. Run without --dry-run to create them."
+            : "{$minted} object(s) created, {$adopted} adopted in Stripe.");
+
+        return self::SUCCESS;
+    }
+
+    /**
+     * Why a run is refused outright rather than left to skip its way through.
+     *
+     * A Stripe Product and a Stripe Price belong to the ACCOUNT that issued
+     * them, and a test account and a live account are two accounts. This
+     * command skips every row that already carries an id (PlanPrices::inStep()
+     * asks the register, not Stripe), so a run after the switch would report
+     * "already in step" and change nothing — while recording that the
+     * catalogue now belongs to the account it never touched.
+     *
+     * The registers have to go too, not only the two columns: inStep() takes
+     * a registered row as proof on its own for the reverse-charge half, so a
+     * cleared pointer with the register left behind would leave exactly that
+     * half pointing at the old account, and nothing would say so.
+     *
+     * Only reached where the OTHER account is established fact. A catalogue
+     * whose account was never recorded is a different state with a different
+     * cure — see StripeCatalogueMode::belongsToAnotherMode(). Telling that
+     * operator to clear anything would be telling them to delete a catalogue
+     * their live contracts bill on.
+     */
+    private function staleCatalogueMessage(): string
+    {
+        return sprintf(
+            'The stored catalogue was created in the [%s] account; this installation is now in [%s] mode. '
+            .'Stripe objects belong to the account that issued them, and this command skips every row that '
+            .'already carries an id — so it cannot repair this by running again. Clear '
+            .'plan_families.stripe_product_id, plan_prices.stripe_price_id and the stripe_plan_prices / '
+            .'stripe_addon_prices registers first, then run it. Nothing was created.',
+            StripeCatalogueMode::recorded()?->value,
+            OperatingMode::current()->value,
+        );
+    }
+
+    /**
+     * The Stripe Prices one priced catalogue row is sold on, brought into step.
+     *
+     * Both treatments, always: the domestic gross AND the bare net a
+     * reverse-charge business is charged. Unconditionally, rather than only when
+     * such a customer exists — the Price has to be there BEFORE the checkout that
+     * needs it, and a verified business meeting a refused checkout is worse than
+     * an unused Price sitting in Stripe.
+     *
+     * What "in step" means, and the find-or-mint-or-replace that follows from it,
+     * belongs to PlanPrices: it is the same question the checkout and the plan
+     * swap ask, and asking it in two places is how they come to disagree. All
+     * this adds is the reporting, because an operator running a sync has to be
+     * able to see which half of which pair moved.
+     *
+     * Archiving stops a Price being offered and leaves every subscription on it
+     * untouched, which is exactly what is wanted: those are moved deliberately,
+     * by stripe:reprice-subscriptions.
+     *
+     * @return int how many objects this row changed, for the run's own count
+     */
+    private function syncPrice(
+        PlanFamily $family,
+        PlanVersion $version,
+        PlanPrice $price,
+        ?string $productId,
+        bool $dryRun,
+    ): int {
+        $prices = app(PlanPrices::class);
+        $changed = 0;
+
+        foreach ($this->treatments() as $label => $treatment) {
+            if ($prices->inStep($price, $treatment)) {
+                continue;
+            }
+
+            $this->line(sprintf(
+                '  price    %s v%d %s %s %d %s net → %d %s charged',
+                $family->key, $version->version, $price->term, $label,
+                $price->amount_cents, $price->currency,
+                PlanPrices::chargedCents($price, $treatment), $price->currency,
+            ));
+            $changed++;
+
+            // Nothing to create against: the Product for this family is minted
+            // by the caller, and on a dry run it does not exist yet either.
+            if ($dryRun || $productId === null) {
+                continue;
+            }
+
+            $prices->ensure($price, $treatment);
+        }
+
+        return $changed;
+    }
+
+    /**
+     * A Product and four Prices for every module on sale: monthly and yearly,
+     * each at the domestic gross and at the bare net.
+     *
+     * Both terms and both treatments, unconditionally, rather than only the ones
+     * somebody has bought a contract on: the Price has to exist BEFORE the booking
+     * that needs it, and a customer on a yearly package booking their first module
+     * would otherwise discover the gap at the moment their money was due.
+     *
+     * @return int how many objects were created, for the run's own count
+     */
+    private function syncModules(bool $dryRun): int
+    {
+        $catalogue = app(AddonCatalogue::class);
+        $prices = app(AddonPrices::class);
+        $currency = Subscription::catalogueCurrency();
+        $created = 0;
+
+        $keys = array_merge(array_keys((array) config('provisioning.addons')), [AddonCatalogue::STORAGE]);
+
+        foreach ($keys as $key) {
+            $monthly = $catalogue->priceCents($key);
+
+            // Nothing to bill and nothing to mirror. A module priced at zero is
+            // either a placeholder or included, and an item at no money would
+            // put a line saying so on every invoice a customer ever gets.
+            if ($monthly === null || $monthly <= 0) {
+                continue;
+            }
+
+            foreach ([Subscription::TERM_MONTHLY, Subscription::TERM_YEARLY] as $term) {
+                foreach ($this->treatments() as $label => $treatment) {
+                    // Asked of the CHARGED figure, so a rate change is seen as a
+                    // Price that has to be replaced rather than as one that is
+                    // already there.
+                    if ($prices->liveFor($key, $monthly, $currency, $term, $treatment) !== null) {
+                        continue;
+                    }
+
+                    $this->line(sprintf(
+                        '  module   %s %s %s %d %s net → %d %s charged',
+                        $key, $term, $label,
+                        AddonPrices::termNetCents($monthly, $term), $currency,
+                        AddonPrices::chargedCents($monthly, $term, $treatment), $currency,
+                    ));
+                    $created++;
+
+                    if ($dryRun) {
+                        continue;
+                    }
+
+                    $prices->ensure($key, $monthly, $currency, $term, $treatment);
+                }
+            }
+        }
+
+        return $created;
+    }
+
+    /**
+     * The two customers everything on sale is mirrored for, labelled for the
+     * output so an operator reading a run can see which of a pair moved.
+     *
+     * Built from TaxTreatment rather than from a rate written down here: it is the
+     * single tax authority, and a second list of treatments is how the catalogue
+     * would come to sell a figure no invoice agrees with.
+     *
+     * @return array<string, TaxTreatment>
+     */
+    private function treatments(): array
+    {
+        return [
+            'domestic' => TaxTreatment::domestic(),
+            'reverse-charge' => TaxTreatment::reverseCharge(),
+        ];
+    }
+
+    /** Versions whose prices are live in Stripe, for the status line. */
+    public static function syncedVersions(): int
+    {
+        return PlanVersion::query()
+            ->whereNotNull('published_at')
+            ->whereHas('prices', fn ($q) => $q->whereNotNull('stripe_price_id'))
+            ->count();
+    }
+}

app/Console/Commands/SyncStripeSubscriptions.php

@@ -0,0 +1,137 @@
+<?php
+
+namespace App\Console\Commands;
+
+use App\Actions\MoveStripeSubscriptionPrice;
+use App\Actions\SyncStripeAddonItems;
+use App\Models\Subscription;
+use App\Models\SubscriptionAddon;
+use Illuminate\Console\Command;
+
+/**
+ * The sweep behind the plan change — and behind the module booking.
+ *
+ * Moving Stripe onto the new price at the moment the change lands is right and
+ * it is not enough. Stripe can be unreachable, the key can have been rotated,
+ * the catalogue can be a sync behind — and the change has already happened to
+ * the contract and to the machine by then, so it is not rolled back. What is
+ * left is a customer being charged for a package they are no longer on, and
+ * nothing about the contract would ever say so again.
+ *
+ * ApplyPlanChange parks exactly that on the contract. This picks it up, however
+ * long ago it happened.
+ *
+ * A module booking is the same failure wearing different clothes: the pack is
+ * already a bigger disk, the entitlement is already switched on, and if Stripe
+ * never heard about it the customer holds a module nobody is billing them for.
+ * So it is swept from here too rather than from a second command — one sweep,
+ * one schedule entry, one place to look when Stripe has been away.
+ *
+ * Deliberately hands the work back to the actions rather than doing it here:
+ * they own which price, which item and which proration behaviour, and two code
+ * paths that both move a subscription is one more than the number that can be
+ * kept in agreement.
+ */
+class SyncStripeSubscriptions extends Command
+{
+    protected $signature = 'clupilot:sync-stripe-subscriptions {--limit=100}';
+
+    protected $description = 'Retry the plan changes and module bookings that landed here but never reached Stripe';
+
+    public function handle(MoveStripeSubscriptionPrice $move, SyncStripeAddonItems $modules): int
+    {
+        $status = $this->sweepPlans($move);
+        $this->sweepModules($modules);
+
+        return $status;
+    }
+
+    private function sweepPlans(MoveStripeSubscriptionPrice $move): int
+    {
+        // Active contracts only. A cancelled one is not billed again, so moving
+        // it onto another price would be housekeeping on something Stripe has
+        // already finished with — and an upgrade's proration raised against a
+        // contract that has ended would charge a departed customer.
+        $parked = Subscription::query()
+            ->whereNotNull('stripe_price_sync')
+            ->whereNotNull('stripe_subscription_id')
+            ->where('status', 'active')
+            ->orderBy('id')
+            ->limit((int) $this->option('limit'))
+            ->get();
+
+        $moved = 0;
+
+        foreach ($parked as $subscription) {
+            if ($move->retry($subscription)) {
+                $moved++;
+
+                continue;
+            }
+
+            // The action has already logged why and counted the attempt. Said
+            // again here because somebody is watching this command's output
+            // and not the log.
+            $this->warn(sprintf(
+                'Contract %s: still billed at the old price — %s',
+                $subscription->uuid,
+                (string) ($subscription->fresh()?->stripe_price_sync['error'] ?? 'unknown'),
+            ));
+        }
+
+        $this->info("{$parked->count()} contract(s) out of step with Stripe, {$moved} moved.");
+
+        return self::SUCCESS;
+    }
+
+    /**
+     * Contracts whose modules Stripe is not billing.
+     *
+     * Found from the BOOKINGS rather than from a parked marker, because the
+     * bookings are the authority: a module still running with no item id was
+     * never put on the subscription, and one that has stopped while still
+     * carrying an item id is being billed after it ended. `stripe_addon_sync` is
+     * the record of what went wrong and how often — it is not where the work
+     * lives, so a contract whose failure was never written down (a worker killed
+     * mid-booking) is still found here.
+     */
+    private function sweepModules(SyncStripeAddonItems $modules): void
+    {
+        $outstanding = SubscriptionAddon::query()
+            ->where(fn ($q) => $q
+                ->where(fn ($active) => $active->whereNull('cancelled_at')->whereNull('cancels_at')->whereNull('stripe_item_id'))
+                ->orWhere(fn ($gone) => $gone->whereNotNull('stripe_item_id')
+                    ->where(fn ($ended) => $ended->whereNotNull('cancelled_at')->orWhereNotNull('cancels_at'))))
+            ->select('subscription_id')
+            ->distinct();
+
+        // Active contracts that Stripe actually bills. A granted contract has no
+        // Stripe subscription at all and its bookings will never carry an item
+        // id — sweeping those would retry, and log, something that is not wrong.
+        $contracts = Subscription::query()
+            ->whereIn('id', $outstanding)
+            ->whereNotNull('stripe_subscription_id')
+            ->where('status', 'active')
+            ->orderBy('id')
+            ->limit((int) $this->option('limit'))
+            ->get();
+
+        $settled = 0;
+
+        foreach ($contracts as $subscription) {
+            if ($modules($subscription)) {
+                $settled++;
+
+                continue;
+            }
+
+            $this->warn(sprintf(
+                'Contract %s: modules not billed by Stripe — %s',
+                $subscription->uuid,
+                (string) ($subscription->fresh()?->stripe_addon_sync['error'] ?? 'unknown'),
+            ));
+        }
+
+        $this->info("{$contracts->count()} contract(s) with modules out of step, {$settled} settled.");
+    }
+}

app/Console/Commands/TearDownEndedInstances.php

@@ -0,0 +1,168 @@
+<?php
+
+namespace App\Console\Commands;
+
+use App\Actions\ArchiveAndTearDown;
+use App\Models\Instance;
+use App\Provisioning\Jobs\TearDownInstance;
+use Illuminate\Console\Command;
+use Throwable;
+
+/**
+ * Die Maschinen abbauen, deren Laufzeit vor mehr als vierzehn Tagen endete.
+ *
+ * Der Schritt nach `EndDueServices`. Der nimmt einer gekündigten Instanz am
+ * Laufzeitende die Adresse weg und lässt die virtuelle Maschine ausdrücklich
+ * stehen; danach kam nichts mehr. Die Maschine lief für immer weiter und
+ * belegte einen Platz auf dem Host, den niemand mehr verkaufen kann. Dieser
+ * Befehl ist der Termin, der das beendet.
+ *
+ * ## Was hier NICHT passiert
+ *
+ * Der Abbau selbst. Dieser Befehl fasst keine Maschine an — er wählt aus und
+ * reiht ein. Der Grund steht im Kopf von `TearDownInstance` und ist keine
+ * Stilfrage: der `scheduler`-Container, in dem dieser Befehl läuft, hängt nicht
+ * im WireGuard-Tunnel und erreicht die Management-Adresse eines Hosts gar
+ * nicht. Was von hier aus mit Proxmox spräche, liefe in eine
+ * Zeitüberschreitung, jedes Mal.
+ *
+ * ## Warum es eine Obergrenze gibt
+ *
+ * `provisioning` ist EINE Warteschlange mit EINEM Arbeiter, und dieselbe, über
+ * die eine bezahlte Bestellung ihre Maschine bekommt. Ein Abbau darf bis zu
+ * fünfunddreissig Minuten belegen. Ohne Grenze reihte der erste Lauf nach dem
+ * Ausrollen den ganzen Rückstand auf einmal ein — und ein Kunde, der heute
+ * bezahlt, wartete einen Tag auf seine Nextcloud, weil vor ihm vierzig
+ * Kündigungen stehen. Fünf am Tag räumen jeden realistischen Rückstand in
+ * anderthalb Wochen ab und lassen die Warteschlange dazwischen frei.
+ *
+ * ## Die Reihenfolge, und warum sie nicht die naheliegende ist
+ *
+ * „Am längsten fällig zuerst" allein ist eine Aushungerungsfalle: eine Instanz,
+ * deren Abbau jede Nacht an derselben Sache scheitert, ist am nächsten Tag
+ * wieder die am längsten fällige. Fünf davon, und keine sechste käme je an die
+ * Reihe. Deshalb kommen zuerst die, an denen noch kein Grund klebt, und erst
+ * darunter wird nach Fälligkeit sortiert.
+ */
+class TearDownEndedInstances extends Command
+{
+    protected $signature = 'clupilot:tear-down-ended-instances
+        {--dry-run : nennen, was abgebaut würde, und nichts anfassen}
+        {--limit=5 : wie viele Instanzen ein Lauf höchstens einreiht}';
+
+    protected $description = 'Gekündigte Maschinen vierzehn Tage nach dem Laufzeitende archivieren und abbauen';
+
+    public function handle(ArchiveAndTearDown $abbau): int
+    {
+        $probelauf = (bool) $this->option('dry-run');
+        $obergrenze = max(1, (int) $this->option('limit'));
+
+        $eingereiht = 0;
+        $uebersprungen = 0;
+        $warten = 0;
+
+        // In der Abfrage eingegrenzt für die Datenbank, entschieden von
+        // isDue() für die Regel — dieselbe Arbeitsteilung wie beim Nachbarn
+        // EndDueServices. Die Abfrage ist ein Index, keine zweite Meinung: es
+        // gibt genau eine Stelle, die sagt, wann eine Instanz fällig ist, und
+        // die steht in der Aktion.
+        $kandidaten = Instance::query()
+            ->with('host')
+            ->where('status', 'ended')
+            ->whereNull('torn_down_at')
+            ->whereNotNull('service_ends_at')
+            ->where('service_ends_at', '<', now()->subDays(ArchiveAndTearDown::GRACE_DAYS))
+            // Siehe Kopf: noch nie gescheiterte zuerst, damit ein Dauerfall die
+            // Obergrenze nicht Nacht für Nacht allein belegt.
+            ->orderByRaw('(teardown_error is null) desc')
+            ->orderBy('service_ends_at')
+            ->cursor();
+
+        foreach ($kandidaten as $instance) {
+            if (! $abbau->isDue($instance)) {
+                continue;
+            }
+
+            if ($instance->host === null || $instance->vmid === null) {
+                $uebersprungen++;
+                $this->uebersprungen($instance, $probelauf);
+
+                continue;
+            }
+
+            // Erst hier, nicht in der Abfrage: eine übersprungene Instanz kostet
+            // die Warteschlange nichts und soll deshalb auch keinen der fünf
+            // Plätze verbrauchen.
+            if ($eingereiht >= $obergrenze) {
+                $warten++;
+
+                continue;
+            }
+
+            $this->line(($probelauf ? '[Probelauf] ' : '')
+                ."{$instance->subdomain}: Laufzeit endete am "
+                .$instance->service_ends_at->local()->isoFormat('LL')
+                .' — Abbau auf '.($instance->host->name ?? '?').' (VMID '.$instance->vmid.')');
+
+            if ($probelauf) {
+                $eingereiht++;
+
+                continue;
+            }
+
+            try {
+                TearDownInstance::dispatch($instance->uuid);
+            } catch (Throwable $e) {
+                // Ein Redis, das gerade nicht antwortet, darf nicht die
+                // restlichen Instanzen dieses Laufes mitnehmen — dieselbe
+                // Regel, nach der die Aktion selbst nie wirft.
+                $uebersprungen++;
+                $this->error("{$instance->subdomain}: liess sich nicht einreihen — ".$e->getMessage());
+
+                continue;
+            }
+
+            $eingereiht++;
+        }
+
+        $this->info($probelauf
+            ? "Probelauf: {$eingereiht} Instanz(en) würden abgebaut, {$uebersprungen} übersprungen, "
+                ."{$warten} warten auf den nächsten Lauf. Nichts wurde geändert."
+            : "{$eingereiht} Instanz(en) zum Abbau eingereiht, {$uebersprungen} übersprungen, "
+                ."{$warten} warten auf den nächsten Lauf.");
+
+        return self::SUCCESS;
+    }
+
+    /**
+     * Eine Instanz, zu der keine erreichbare Maschine mehr gehört.
+     *
+     * Der Grund wird nicht nur gesagt, sondern vermerkt — ausser im Probelauf.
+     * Eine Zeile im Protokoll des Zeitplans liest niemand; `teardown_error` ist
+     * das Feld, das die Konsole über der Instanzliste anzeigt. Ohne den Vermerk
+     * bliebe diese Instanz für immer in der Auswahl stehen, würde jede Nacht
+     * erneut übersprungen, und niemand erführe davon.
+     *
+     * Wortgleich mit dem, was `ArchiveAndTearDown` in derselben Lage wirft: es
+     * ist derselbe Sachverhalt, und zwei Formulierungen dafür wären zwei
+     * Sachverhalte, sobald jemand nach dem Text sucht.
+     */
+    private function uebersprungen(Instance $instance, bool $probelauf): void
+    {
+        $grund = 'Zu dieser Instanz gehört keine erreichbare Maschine mehr (Host oder VMID fehlt). '
+            .'Es wird nichts gesichert und nichts gelöscht.';
+
+        $this->warn(($probelauf ? '[Probelauf] ' : '')."{$instance->subdomain}: übersprungen — ".$grund);
+
+        if ($probelauf) {
+            return;
+        }
+
+        try {
+            $instance->update(['teardown_error' => $grund]);
+        } catch (Throwable) {
+            // Der Vermerk liess sich nicht schreiben. Gesagt ist er trotzdem,
+            // und angefasst hat dieser Zweig ohnehin keine Maschine.
+        }
+    }
+}

app/Console/Commands/VerifyCustomDomains.php

@@ -0,0 +1,101 @@
+<?php
+
+namespace App\Console\Commands;
+
+use App\Actions\ReapplyInstanceAddress;
+use App\Models\Instance;
+use App\Services\Domains\DomainVerifier;
+use Illuminate\Console\Command;
+
+/**
+ * Re-reads every custom domain's proof, nightly.
+ *
+ * Asked for in exactly these words: the token must be checked again and again,
+ * so that nobody puts it in, passes the check, and takes it straight back out.
+ * At night, because a domain that is withdrawn is a domain that stops being
+ * served, and that is not a thing to do to somebody at eleven in the morning.
+ *
+ * Three consecutive misses before a verified domain is withdrawn. One failed
+ * lookup is a nameserver having a bad minute; taking a working Nextcloud
+ * offline over a hiccup would be far worse than the hole it closes.
+ */
+class VerifyCustomDomains extends Command
+{
+    protected $signature = 'clupilot:verify-domains {--instance= : one instance uuid, for checking on demand}';
+
+    protected $description = 'Re-read the DNS proof for every custom domain and withdraw the ones that lost it';
+
+    public function handle(DomainVerifier $verifier, ReapplyInstanceAddress $reapply): int
+    {
+        $query = Instance::query()->whereNotNull('custom_domain')->whereNotNull('domain_token');
+
+        if ($uuid = $this->option('instance')) {
+            $query->where('uuid', $uuid);
+        }
+
+        $checked = 0;
+        $withdrawn = 0;
+
+        foreach ($query->cursor() as $instance) {
+            $checked++;
+            $present = $verifier->proofPresent($instance);
+
+            // What was true before this check, so the CHANGE can be acted on
+            // rather than the state. Re-applying an address is remote work on a
+            // live machine; doing it nightly for every domain that is simply
+            // still fine would be a hundred pointless runs a night.
+            $wasVerified = $instance->domainIsVerified();
+
+            if ($present) {
+                $instance->forceFill([
+                    'domain_verified_at' => $instance->domain_verified_at ?? now(),
+                    'domain_checked_at' => now(),
+                    'domain_error' => null,
+                    'domain_failures' => 0,
+                ])->save();
+
+                // A domain that has just become provable is a domain nothing is
+                // serving yet: the router was written without it and Nextcloud
+                // does not trust it. This is where it becomes an address.
+                if (! $wasVerified) {
+                    $reapply($instance);
+                }
+
+                continue;
+            }
+
+            $failures = $instance->domain_failures + 1;
+
+            // Withdrawal clears verified_at, which is the single flag every
+            // consumer reads. Nothing else is deleted: the domain and its token
+            // stay on the row, so the customer sees what is wrong and can put
+            // the record back rather than starting over.
+            $withdraw = $instance->domain_verified_at !== null
+                && $failures >= DomainVerifier::FAILURES_BEFORE_WITHDRAWAL;
+
+            $instance->forceFill([
+                'domain_checked_at' => now(),
+                'domain_error' => 'missing_txt',
+                'domain_failures' => $failures,
+                'domain_verified_at' => $withdraw ? null : $instance->domain_verified_at,
+                'domain_cert_ok' => $withdraw ? false : $instance->domain_cert_ok,
+            ])->save();
+
+            if ($withdraw) {
+                $withdrawn++;
+
+                // The other half of the flip, and the one that actually takes
+                // the domain away: the router stops carrying it and Nextcloud
+                // stops trusting it. Clearing verified_at alone only stops us
+                // TELLING people about it.
+                $reapply($instance);
+
+                $this->warn("Withdrew {$instance->custom_domain}: proof missing on {$failures} consecutive checks.");
+            }
+        }
+
+        $this->info("Checked {$checked} domain(s), withdrew {$withdrawn}.");
+
+        return self::SUCCESS;
+    }
+}

app/Console/Commands/VerifyVatIds.php

@@ -0,0 +1,118 @@
+<?php
+
+namespace App\Console\Commands;
+
+use App\Actions\VerifyCustomerVatId;
+use App\Models\Customer;
+use Illuminate\Console\Command;
+
+/**
+ * Re-ask the register about the VAT numbers we are relying on.
+ *
+ * A number is not verified once and for ever. A company is wound up, a
+ * registration is withdrawn, a member state removes it — and from that moment we
+ * are zero-rating an invoice against a number that no longer exists, which is our
+ * liability and not the customer's. So the ones reverse charge actually rests on
+ * are asked again.
+ *
+ * It also picks up the numbers nobody has checked yet: every number entered
+ * before this check existed is unverified, so those customers are on the domestic
+ * rate today whether or not they are entitled to reverse charge.
+ *
+ * ## Scheduled monthly, and why that is not the owner's decision to inherit
+ *
+ * This used to say it was deliberately NOT scheduled, and to point at a note in
+ * routes/console.php that did not exist — so an owner reading the schedule could
+ * not learn the command was there at all, and reverse charge went on resting on a
+ * one-off answer for ever.
+ *
+ * It is scheduled now, because the exposure is the SELLER's. A registration that
+ * is withdrawn keeps earning rate 0 on every invoice we issue afterwards, and the
+ * unpaid VAT on those is ours to make good, not the customer's — so the cadence is
+ * not a preference but the width of the window in which that can happen unnoticed.
+ * Monthly, on the first, because that is the rhythm the VAT return is filed on: a
+ * number that lapsed in March is caught before the March return is prepared.
+ *
+ * The public service's concurrency limit is answered by `--limit` rather than by
+ * not running: the query takes the longest-unchecked first, so a customer base
+ * larger than one run rotates through it instead of starving. `--dry-run` and
+ * `--customer` are for the by-hand run before a return.
+ */
+class VerifyVatIds extends Command
+{
+    protected $signature = 'clupilot:verify-vat-ids
+        {--dry-run : Show what would be asked without touching the register or any record}
+        {--customer= : One customer, by uuid}
+        {--limit=200 : How many to look at in one run}';
+
+    protected $description = 'Check customer VAT numbers against the EU VIES register';
+
+    public function handle(VerifyCustomerVatId $verify): int
+    {
+        $customers = Customer::query()
+            ->whereNotNull('vat_id')
+            ->where('vat_id', '!=', '')
+            ->when($this->option('customer'), fn ($q, $uuid) => $q->where('uuid', $uuid))
+            // Longest unchecked first, so a short run covers the ones we know
+            // least about rather than the ones checked yesterday. A plain
+            // ascending sort does that on its own — never-checked rows are NULL
+            // and both engines sort those first — which is why there is no raw
+            // SQL here: MariaDB and SQLite would need different expressions for
+            // it, and a query that only runs on one of them makes the test
+            // database a different product from the live one.
+            ->orderBy('vat_id_verified_at')
+            ->limit((int) $this->option('limit'))
+            ->get();
+
+        if ($customers->isEmpty()) {
+            $this->info('No VAT numbers on record.');
+
+            return self::SUCCESS;
+        }
+
+        $counts = ['verified' => 0, 'rejected' => 0, 'unchecked' => 0];
+
+        foreach ($customers as $customer) {
+            if ($this->option('dry-run')) {
+                $this->line(sprintf('would ask: %s (%s)', $customer->normalisedVatId(), $customer->name));
+
+                continue;
+            }
+
+            $check = $verify($customer);
+
+            match (true) {
+                $check === null => null,
+                $check->isValid() => $counts['verified']++,
+                $check->isInvalid() => $counts['rejected']++,
+                default => $counts['unchecked']++,
+            };
+
+            if ($check?->isInvalid()) {
+                // Named individually, because this one needs a person: an invoice
+                // already issued at 0 % against a number the register now rejects
+                // has to be looked at, and a count in a summary hides that.
+                $this->warn(sprintf(
+                    'not registered: %s (%s) — reverse charge no longer applies',
+                    $customer->normalisedVatId(),
+                    $customer->name,
+                ));
+            }
+        }
+
+        if ($this->option('dry-run')) {
+            $this->info($customers->count().' number(s) would be asked about.');
+
+            return self::SUCCESS;
+        }
+
+        $this->info(sprintf(
+            '%d confirmed, %d rejected, %d could not be checked (register unavailable — nothing changed for those).',
+            $counts['verified'],
+            $counts['rejected'],
+            $counts['unchecked'],
+        ));
+
+        return self::SUCCESS;
+    }
+}

app/Console/TickProvisioning.php

@@ -0,0 +1,46 @@
+<?php
+
+namespace App\Console;
+
+use App\Models\ProvisioningRun;
+use App\Provisioning\Jobs\AdvanceRunJob;
+
+/**
+ * Scheduler tick (every minute): dispatch an advance job for every run that is
+ * due. Immediate dispatch on advance handles the fast path; this catches
+ * waiting/retrying runs and anything a crashed worker left behind.
+ *
+ * PENDING counts as left behind. A run is created and dispatched in two steps,
+ * and a process that dies between them leaves a paid customer with a run that
+ * nothing will ever pick up. Re-dispatching one that is merely fresh is free —
+ * the runner takes a per-run lock and the second job returns immediately.
+ */
+class TickProvisioning
+{
+    /**
+     * How long a run may sit pending before it counts as stranded.
+     *
+     * Long enough that an ordinary queue backlog is not mistaken for a crash:
+     * sweeping a run whose first job is merely still queued would start a
+     * second chain of continuations alongside the first, and both would keep
+     * dispatching for the rest of the pipeline.
+     */
+    private const STRANDED_AFTER_MINUTES = 5;
+
+    public function __invoke(): void
+    {
+        ProvisioningRun::query()
+            ->where(function ($q) {
+                $q
+                    ->whereIn('status', [ProvisioningRun::STATUS_RUNNING, ProvisioningRun::STATUS_WAITING])
+                    ->orWhere(fn ($stranded) => $stranded
+                        ->where('status', ProvisioningRun::STATUS_PENDING)
+                        ->where('created_at', '<=', now()->subMinutes(self::STRANDED_AFTER_MINUTES)));
+            })
+            ->where(function ($q) {
+                $q->whereNull('next_attempt_at')->orWhere('next_attempt_at', '<=', now());
+            })
+            ->get()
+            ->each(fn (ProvisioningRun $run) => AdvanceRunJob::dispatch($run->uuid));
+    }
+}

app/Exceptions/IdentityCollisionException.php

@@ -0,0 +1,21 @@
+<?php
+
+namespace App\Exceptions;
+
+use RuntimeException;
+
+/**
+ * Refused: this address already belongs to the other identity table.
+ *
+ * R21 — operators and customers are two groups of people, never one row that
+ * could pass for both. Keyed on the address itself, not on who happens to be
+ * signed in when the check runs (see the deleted Customer::assertNotAdmin(),
+ * which checked the caller's session and mis-fired for exactly that reason).
+ */
+class IdentityCollisionException extends RuntimeException
+{
+    public function __construct(public readonly string $email)
+    {
+        parent::__construct("Refusing to create or link a portal login for {$email}: that address already belongs to an operator (R21).");
+    }
+}

app/Exceptions/StripeNotConfigured.php

@@ -0,0 +1,20 @@
+<?php
+
+namespace App\Exceptions;
+
+use RuntimeException;
+
+/**
+ * Der aktive Betriebsmodus hat keinen Stripe-Schlüssel.
+ *
+ * Eine eigene Klasse, damit Aufrufer und Tests genau diesen Fall greifen können
+ * statt „irgendetwas ging schief" — und damit die Kasse ihn in einen Satz
+ * übersetzen kann, den ein Kunde lesen kann.
+ */
+class StripeNotConfigured extends RuntimeException
+{
+    public static function forMode(string $mode): self
+    {
+        return new self("No Stripe secret is stored for the [{$mode}] operating mode.");
+    }
+}

app/Http/Controllers/BootstrapArchiveController.php

@@ -0,0 +1,133 @@
+<?php
+
+namespace App\Http\Controllers;
+
+use App\Support\HostEnrolment;
+use Illuminate\Http\Request;
+use Symfony\Component\HttpFoundation\BinaryFileResponse;
+use Symfony\Component\Process\Process;
+
+/**
+ * Liefert das Bootstrap-Skript als Archiv aus.
+ *
+ * Das ist der einzige Weg, auf dem das Skript auf eine nackte Maschine kommt:
+ * ein Rettungssystem hat nichts als curl. Es ist eine STATISCHE Datei und kein
+ * Endpunkt, der Auskunft gibt — Spec §5 bleibt damit unangetastet. Es steht
+ * nichts Vertrauliches darin; alle Geheimnisse reist der Betreiber in der
+ * Befehlszeile mit, nicht im Archiv.
+ *
+ * Als Archiv und nicht als eine Datei, weil `curl … | sh` keine `lib/` haben
+ * kann und der Skript-Plan getrennte Dateien verlangt: `network.sh` und
+ * `template.sh` sollen einzeln nachlesbar und wiederholbar bleiben, wenn auf
+ * einer Maschine um drei Uhr morgens etwas klemmt.
+ *
+ * Gebaut wird beim ersten Abruf und danach nur, wenn sich unter `deploy/bootstrap`
+ * etwas geändert hat. Ein Archiv, das im Repo läge, wäre die Fassung von dem
+ * Tag, an dem jemand zuletzt daran gedacht hat, es neu zu bauen.
+ */
+class BootstrapArchiveController extends Controller
+{
+    public function __invoke(Request $request): BinaryFileResponse
+    {
+        // Der Ausweis ist der Einmal-Code, der ohnehin schon in der kopierten
+        // Zeile steht. Kein zweites Geheimnis: ein eigener Download-Token liefe
+        // nie ab, stünde für immer in Shell-Historien, und er reiste in
+        // derselben Zeile wie der WireGuard-Schlüssel — er schützte also das
+        // Unwichtigste mit derselben Aussetzung wie das Wichtigste.
+        //
+        // `resolve()` und nicht `claim()`: der Code wird hier NICHT verbraucht.
+        // Er wird nach dem Herunterladen noch für jede Fortschrittsmeldung und
+        // zuletzt für die Registrierung gebraucht.
+        //
+        // 404 und nicht 403, dieselbe Regel wie bei der Konsole: ein Fremder
+        // soll nicht erfahren, dass es hier etwas gibt.
+        $code = (string) ($request->query('code') ?? $request->header('X-CluPilot-Code', ''));
+
+        if (HostEnrolment::resolve($code) === null) {
+            abort(404);
+        }
+
+        $archive = storage_path('app/bootstrap.tar.gz');
+
+        if ($this->isStale($archive)) {
+            $this->build($archive);
+        }
+
+        return response()
+            ->file($archive, [
+                'Content-Type' => 'application/gzip',
+                'Content-Disposition' => 'attachment; filename="bootstrap.tar.gz"',
+                // Nicht in den Index. Die Adresse ist ohne Code wertlos, aber
+                // eine Suchmaschine, die sie kennt, verrät immerhin, dass es
+                // sie gibt.
+                'X-Robots-Tag' => 'noindex, nofollow',
+            ]);
+    }
+
+    /**
+     * Neuer als alles, was drinsteckt?
+     *
+     * Über die Änderungszeit und nicht über einen Hash: das Verzeichnis ist
+     * klein, der Vergleich läuft bei jedem Abruf, und ein Hash über alle Dateien
+     * kostete bei jedem Abruf mehr als das Packen gelegentlich kostet.
+     */
+    private function isStale(string $archive): bool
+    {
+        if (! is_file($archive)) {
+            return true;
+        }
+
+        $built = filemtime($archive);
+
+        foreach ($this->sourceFiles() as $file) {
+            if (filemtime($file) > $built) {
+                return true;
+            }
+        }
+
+        return false;
+    }
+
+    /** @return list<string> */
+    private function sourceFiles(): array
+    {
+        $root = base_path('deploy/bootstrap');
+
+        if (! is_dir($root)) {
+            return [];
+        }
+
+        $files = [];
+        $iterator = new \RecursiveIteratorIterator(
+            new \RecursiveDirectoryIterator($root, \FilesystemIterator::SKIP_DOTS)
+        );
+
+        foreach ($iterator as $file) {
+            if ($file->isFile()) {
+                $files[] = $file->getPathname();
+            }
+        }
+
+        return $files;
+    }
+
+    /**
+     * Mit GNU tar und nicht mit PharData: `phar.readonly` steht in diesem
+     * Container auf 1, und das Ausführbar-Bit soll erhalten bleiben.
+     *
+     * Der oberste Eintrag heißt `bootstrap/`, damit die kopierte Befehlszeile
+     * mit `tar xz -C /opt/clupilot` genau `/opt/clupilot/bootstrap` ergibt —
+     * der Ort, an dem das Skript sich selbst und seine Bibliothek erwartet.
+     */
+    private function build(string $archive): void
+    {
+        @mkdir(dirname($archive), 0755, true);
+
+        $process = new Process(
+            ['tar', 'czf', $archive, '-C', base_path('deploy'), 'bootstrap'],
+            timeout: 60,
+        );
+
+        $process->mustRun();
+    }
+}

app/Http/Controllers/CheckoutController.php

@@ -0,0 +1,222 @@
+<?php
+
+namespace App\Http\Controllers;
+
+use App\Models\Customer;
+use App\Models\PlanFamily;
+use App\Models\Subscription;
+use App\Services\Billing\PlanCatalogue;
+use App\Services\Billing\PlanPrices;
+use App\Services\Billing\SetupFee;
+use App\Services\Billing\TaxTreatment;
+use App\Services\Provisioning\HostCapacity;
+use App\Services\Stripe\StripeClient;
+use Illuminate\Http\RedirectResponse;
+use Illuminate\Http\Request;
+use Illuminate\Support\Facades\Log;
+use RuntimeException;
+use Throwable;
+
+/**
+ * Buying a package, without anyone having to write an email about it.
+ *
+ * The site used to end every path in "anfragen": a mailto: link and a promise
+ * to answer the same working day. That is a person's afternoon per customer,
+ * for a product whose entire point is that the machine does the work — and it
+ * scales exactly as far as the operator's inbox does.
+ *
+ * So: a signed-in customer picks a package, pays, and provisioning starts by
+ * itself. Where no host has room the order is parked rather than refused (see
+ * ReserveResources) — that is the ONE case that still needs a human, and it
+ * needs them to buy a server, not to answer a mail.
+ *
+ * This class does not take money and does not create a contract. It opens a
+ * Stripe hosted checkout and gets out of the way; the purchase becomes real
+ * when Stripe says so, on the webhook, which is the only place that may believe
+ * a payment happened. A "thank you" page proves nothing — the customer can open
+ * it by typing the URL.
+ */
+class CheckoutController extends Controller
+{
+    /**
+     * Send the customer to Stripe for one package.
+     *
+     * Everything here is re-derived from the catalogue: the plan key arrives
+     * from a form, and a form field is a string somebody can retype. The price
+     * charged is the one the catalogue holds for the version on sale right now,
+     * never a figure carried in the request.
+     */
+    public function start(
+        Request $request,
+        StripeClient $stripe,
+        PlanCatalogue $catalogue,
+        PlanPrices $planPrices,
+    ): RedirectResponse {
+        $data = $request->validate([
+            'plan' => ['required', 'string', 'max:64'],
+            'term' => ['nullable', 'in:'.Subscription::TERM_MONTHLY.','.Subscription::TERM_YEARLY],
+            // Acceptance of the terms, which is where everything about this
+            // sale is regulated: the delivery, the price, the fourteen-day
+            // withdrawal right, and the consumer's express request that we
+            // begin inside that window (FAGG §16, §356 BGB) — a cloud is built
+            // the moment the payment lands, so that request cannot be avoided
+            // and is stated on the checkbox as well as in the terms.
+            //
+            // Required. An order cannot be submitted without it: the box is the
+            // declaration, and the browser only disables the button — this is
+            // the line that actually refuses.
+            'terms_accepted' => ['accepted'],
+        ], [
+            'terms_accepted.accepted' => __('checkout.terms_required'),
+        ]);
+
+        $term = $data['term'] ?? Subscription::TERM_MONTHLY;
+        $user = $request->user();
+
+        // Read once and handed to everything below that has to know who is
+        // buying. Which of a package's two Stripe Prices this session uses is
+        // decided from it, and a second lookup is a second chance to decide it
+        // differently.
+        $customer = $user === null
+            ? null
+            : Customer::query()->where('email', $user->email)->first();
+
+        // Somebody who already has a running contract is not buying a second
+        // one by accident: changing package is a plan change, which prorates
+        // and keeps their data where it is. A second checkout would build them
+        // a second, empty cloud and bill for both.
+        if ($this->hasLiveContract($customer)) {
+            return redirect()->route('billing')->with('status', __('checkout.already_customer'));
+        }
+
+        if (! $stripe->isConfigured()) {
+            // Nothing to send them to. Better a plain sentence than a redirect
+            // into an error page on somebody else's domain.
+            Log::error('Checkout attempted while Stripe is not configured.');
+
+            return back()->withErrors(['plan' => __('checkout.unavailable')]);
+        }
+
+        try {
+            // Die einzige Stelle, an der ein Paketschlüssel VON AUSSEN in
+            // currentVersion() läuft. Dass ein internes Paket in keiner Liste
+            // steht, ist kein Schutz — eine URL ist keine Liste. Geworfen statt
+            // sofort abgelehnt, damit es genau in den Fang darunter fällt und
+            // dieselbe Antwort bekommt wie ein Schlüssel, den es gar nicht
+            // gibt: wer die Preisliste nicht kennt, soll aus der Antwort nicht
+            // lernen können, dass es dieses Paket gibt.
+            if (PlanFamily::query()->where('key', $data['plan'])->value('internal')) {
+                throw new RuntimeException("Plan '{$data['plan']}' is internal and not sold at checkout.");
+            }
+
+            $version = $catalogue->currentVersion($data['plan']);
+            $price = $version->prices->firstWhere('term', $term);
+        } catch (Throwable $e) {
+            // An unknown, withdrawn or overlapping plan. The catalogue throws
+            // by design; a shop must not guess which of two versions was meant.
+            Log::warning('Checkout for an unavailable plan', ['plan' => $data['plan'], 'exception' => $e]);
+
+            return back()->withErrors(['plan' => __('checkout.plan_gone')]);
+        }
+
+        // WHO is buying decides WHICH of the package's two Stripe Prices this
+        // session uses: the domestic gross for everybody who is charged VAT, the
+        // bare net for a business in another member state whose VAT id is
+        // verified, because reverse charge means no VAT is owed to us at all.
+        // Decided by TaxTreatment and read from PlanPrices — nothing about the
+        // customer is examined here, or there would be two answers to one
+        // question and no way to tell which an invoice was written against.
+        $treatment = TaxTreatment::for($customer);
+        $priceId = $price === null ? null : $planPrices->liveFor($price, $treatment);
+
+        // A Price Stripe has never been told about. Sending the customer on would
+        // open a checkout for nothing — and for a reverse-charge business, refusing
+        // is the only safe answer even though a Price does exist: the domestic one
+        // would take a fifth more than they owe, which is the overcharge this whole
+        // rule exists to end. A refused checkout is loud, one command cures it, and
+        // the log line names the command.
+        if ($priceId === null) {
+            Log::error('Checkout for a plan that is not on sale in Stripe. Run stripe:sync-catalogue.', [
+                'plan' => $data['plan'],
+                'term' => $term,
+                'reverse_charge' => $treatment->reverseCharge,
+            ]);
+
+            return back()->withErrors(['plan' => __('checkout.plan_gone')]);
+        }
+
+        // The one-off setup fee as this customer is charged it, or null where the
+        // operator has set none. Advertised on the price sheet and on the booking
+        // page for months and charged to nobody; it rides along as a second,
+        // non-recurring line on this session, which Stripe puts on the initial
+        // invoice only. Subject to the same rule as the package: a reverse-charge
+        // business pays the bare net of it.
+        $setup = SetupFee::checkoutLine((string) $price->currency, $treatment);
+
+        try {
+            $url = $stripe->createCheckoutSession(
+                priceId: $priceId,
+                successUrl: route('checkout.done'),
+                cancelUrl: route('order'),
+                // Exactly the keys StripeWebhookController reads back. The
+                // VERSION goes along, so the contract is opened on what the
+                // customer was shown even if a new version is published while
+                // they are typing their card number.
+                metadata: [
+                    'plan' => $version->family->key,
+                    'plan_version_id' => (string) $version->id,
+                    'datacenter' => app(HostCapacity::class)->preferredDatacenter(),
+                    // Exactly '1', because StripeWebhookController compares
+                    // against exactly that: a consent that can be produced by a
+                    // typo is not a consent. It travels through Stripe rather
+                    // than being stamped here — the contract only exists once
+                    // the payment does, and a consent recorded for a checkout
+                    // somebody abandoned would be a consent to nothing.
+                    //
+                    // The KEY keeps its old name deliberately. The form field it
+                    // came from is called terms_accepted now, but a checkout
+                    // session opened before a deploy is paid after it, and the
+                    // webhook would find nothing under a new name. What it
+                    // records is unchanged: the customer declared, at this
+                    // moment, that we may start at once.
+                    'immediate_start' => '1',
+                    // What part of Stripe's amount_total is the setup fee, so the
+                    // webhook can tell the two apart again: the package's charge
+                    // is what the register holds against the contract price, and
+                    // the fee is a line of its own on the first invoice.
+                    'setup_fee_cents' => (string) ($setup['amount_cents'] ?? 0),
+                ],
+                customerEmail: $user?->email,
+                oneOff: $setup,
+            );
+        } catch (Throwable $e) {
+            Log::error('Stripe would not open a checkout session', ['exception' => $e]);
+
+            return back()->withErrors(['plan' => __('checkout.unavailable')]);
+        }
+
+        return redirect()->away($url);
+    }
+
+    /**
+     * Where Stripe sends them back to.
+     *
+     * Deliberately says "we are building it", not "you have paid": this page is
+     * a redirect target, and a redirect target is a URL anybody can type. What
+     * the customer actually sees underneath is the provisioning card on their
+     * dashboard, which is driven by a run that only the webhook can start.
+     */
+    public function done(): RedirectResponse
+    {
+        return redirect()->route('dashboard')->with('status', __('checkout.thanks'));
+    }
+
+    /** Does this customer already have a contract that is being billed? */
+    private function hasLiveContract(?Customer $customer): bool
+    {
+        return $customer !== null && Subscription::query()
+            ->where('customer_id', $customer->id)
+            ->whereIn('status', ['active', 'past_due'])
+            ->exists();
+    }
+}

app/Http/Controllers/ContactController.php

@@ -0,0 +1,144 @@
+<?php
+
+namespace App\Http\Controllers;
+
+use App\Mail\ContactRequestMail;
+use App\Models\Customer;
+use App\Models\InboundMail;
+use Illuminate\Http\RedirectResponse;
+use Illuminate\Http\Request;
+use Illuminate\Support\Facades\Mail;
+use Illuminate\Support\Str;
+use Illuminate\View\View;
+
+/**
+ * „Sprechen Sie uns an" als Seite, nicht als `mailto:`.
+ *
+ * Der Knopf unter den Paketen zeigte auf `mailto:`, und der tut auf den meisten
+ * Geräten nichts Sichtbares: ohne eingerichtetes Mailprogramm passiert gar
+ * nichts, im Browser öffnet sich bestenfalls ein Dialog, den niemand erwartet
+ * hat. Das ist ausgerechnet an der Stelle fatal, an der das Selbstbedienen
+ * aufhört und ein Gespräch beginnen soll — wer hier klickt, hat sich schon
+ * entschieden zu fragen.
+ *
+ * Eine Seite statt eines Modals: die öffentliche Website lädt kein Livewire,
+ * ein gewöhnlicher Formular-POST kommt also auch dann an, wenn JavaScript
+ * scheitert. Und eine Seite hat eine Adresse — sie lässt sich aus einer Mail
+ * heraus verlinken, ein Modal nicht.
+ */
+class ContactController extends Controller
+{
+    /** Themen, die das Formular kennt. Alles andere wird zu `general`. */
+    private const TOPICS = ['enterprise', 'general'];
+
+    public function show(Request $request): View
+    {
+        $topic = (string) $request->query('thema', 'general');
+
+        return view('contact', [
+            'topic' => in_array($topic, self::TOPICS, true) ? $topic : 'general',
+            'sent' => $request->session()->get('contact.sent', false),
+        ]);
+    }
+
+    public function send(Request $request): RedirectResponse
+    {
+        $data = $request->validate([
+            'company' => ['nullable', 'string', 'max:120'],
+            'name' => ['required', 'string', 'max:120'],
+            'email' => ['required', 'email:rfc', 'max:190'],
+            'phone' => ['nullable', 'string', 'max:60'],
+            'message' => ['required', 'string', 'min:10', 'max:4000'],
+            'topic' => ['nullable', 'string', 'in:'.implode(',', self::TOPICS)],
+            // Honigtopf: ein Feld, das im Browser niemand sieht und ein
+            // Formularroboter trotzdem ausfüllt. `filled` statt einer eigenen
+            // Regel, damit die Meldung, die ein Mensch nie zu sehen bekommt,
+            // auch keine eigene Übersetzung braucht.
+            'website' => ['nullable', 'prohibited'],
+        ], [], [
+            'name' => 'Name',
+            'email' => 'E-Mail-Adresse',
+            'message' => 'Nachricht',
+        ]);
+
+        $enquiry = [
+            'company' => $data['company'] ?? null,
+            'name' => $data['name'],
+            'email' => $data['email'],
+            'phone' => $data['phone'] ?? null,
+            'message' => $data['message'],
+            'topic' => $data['topic'] ?? 'general',
+        ];
+
+        // ZUERST festhalten, dann erst benachrichtigen.
+        //
+        // Die Mail war anfangs die einzige Ablage, und das ging in dem Moment
+        // schief, in dem der Versand scheiterte: der Besucher las „Ihre Anfrage
+        // ist da", und die Anfrage lag in `failed_jobs`, wo niemand nachsieht.
+        // Genau so ist es hier beim ersten Versuch passiert — das Postfach
+        // support@ hatte kein eigenes SMTP-Konto, und der Server wies den
+        // Absender ab.
+        //
+        // Der Posteingang der Konsole ist ohnehin die richtige Ablage: er
+        // existiert für „was Kunden uns geschrieben haben", zeigt Nicht-
+        // Zugeordnetes zuerst und nennt in seinem eigenen Kopfkommentar die
+        // neue Anfrage von einer unbekannten Adresse als den Fall, der nicht
+        // untergehen darf. Eine Website-Anfrage IST dieser Fall.
+        $this->record($enquiry);
+
+        // Die Mail ist ab hier eine Benachrichtigung, kein Ablageort. Scheitert
+        // sie, steht die Anfrage trotzdem in der Konsole.
+        Mail::send(new ContactRequestMail($enquiry));
+
+        // Zurück auf dieselbe Seite, mit einer Fahne in der Sitzung statt einer
+        // Kennung in der Adresse: ein Neuladen zeigt danach wieder das leere
+        // Formular und nicht dauerhaft eine Bestätigung für etwas, das längst
+        // erledigt ist.
+        return redirect()
+            ->route('contact')
+            ->with('contact.sent', true);
+    }
+
+    /**
+     * Die Anfrage in den Posteingang der Konsole legen.
+     *
+     * @param  array{company: ?string, name: string, email: string, phone: ?string, message: string, topic: ?string}  $enquiry
+     */
+    private function record(array $enquiry): void
+    {
+        InboundMail::create([
+            // Dieselbe Zuordnungsregel wie beim Abholen echter Mail
+            // (IngestInboundMail): schreibt ein bestehender Kunde über das
+            // Formular, hängt die Anfrage an ihm. Sonst bleibt sie ohne
+            // Zuordnung — und steht damit im Posteingang ganz oben.
+            'customer_id' => Customer::query()->where('email', $enquiry['email'])->value('id'),
+            // Synthetisch, weil eine Formularanfrage keine echte Message-ID hat
+            // und die Spalte eindeutig sein muss. Das Präfix macht später
+            // erkennbar, dass dieser Eintrag nicht aus dem Postfach kam.
+            'message_id' => 'web-'.Str::uuid().'@'.(parse_url((string) config('app.url'), PHP_URL_HOST) ?: 'clupilot'),
+            'from_email' => $enquiry['email'],
+            'from_name' => $enquiry['company']
+                ? $enquiry['name'].' · '.$enquiry['company']
+                : $enquiry['name'],
+            'subject' => ContactRequestMail::subjectFor($enquiry),
+            'body' => $this->bodyFor($enquiry),
+            'received_at' => now(),
+        ]);
+    }
+
+    /**
+     * Was der Posteingang als Nachricht zeigt.
+     *
+     * Die Telefonnummer gehört mit hinein: `inbound_mails` hat kein Feld dafür,
+     * und eine Nummer, die jemand extra angegeben hat, im Formular zu verlieren
+     * hieße, ihn nicht anrufen zu können.
+     *
+     * @param  array{phone: ?string, message: string}  $enquiry
+     */
+    private function bodyFor(array $enquiry): string
+    {
+        return $enquiry['phone']
+            ? $enquiry['message']."\n\n—\nTelefon: ".$enquiry['phone']
+            : $enquiry['message'];
+    }
+}

app/Http/Controllers/Controller.php

@@ -2,7 +2,9 @@
 
 namespace App\Http\Controllers;
 
+use Illuminate\Foundation\Auth\Access\AuthorizesRequests;
+
 abstract class Controller
 {
-    //
+    use AuthorizesRequests;
 }

app/Http/Controllers/ImpersonationController.php

@@ -0,0 +1,116 @@
+<?php
+
+namespace App\Http\Controllers;
+
+use App\Exceptions\IdentityCollisionException;
+use App\Models\Customer;
+use App\Models\Operator;
+use Illuminate\Http\RedirectResponse;
+use Illuminate\Http\Request;
+use Illuminate\Support\Facades\Auth;
+use Illuminate\Support\Facades\Cache;
+use Illuminate\Support\Facades\URL;
+
+/**
+ * Looking at a customer's portal as that customer.
+ *
+ * Not a shared cookie. Once the console has a hostname of its own, a session
+ * cookie set on the console host never reaches the portal host — SESSION_DOMAIN
+ * is null and cookies are host-bound. So the handover is a signed, single-use
+ * link: it works regardless of cookie scope, it expires, and it leaves a record
+ * of who looked at whom.
+ */
+class ImpersonationController extends Controller
+{
+    /** Sixty seconds is a handover, not a credential. */
+    private const WINDOW = 60;
+
+    public function start(Customer $customer): RedirectResponse
+    {
+        $this->authorize('customers.impersonate');
+
+        $operator = Auth::guard('operator')->user();
+
+        // impersonate.enter carries no domain of its own — a portal route,
+        // reached wherever the portal already answers. Its SIGNATURE is
+        // computed over the full absolute URL: UrlGenerator::signedRoute()
+        // hashes the generated URL string, host included, and
+        // hasCorrectSignature() re-hashes $request->url() — the ACTUAL request
+        // URL — on the way back. Left alone, "the generated URL" means
+        // whichever host issued THIS request: the console's, once it has an
+        // exclusive hostname of its own. RestrictAdminHost then 404s every
+        // non-console route reached through the console's exclusive host,
+        // including this one — so the link would die before the customer ever
+        // saw it, the exact cross-host failure this controller exists to fix.
+        //
+        // Forced to the portal's own configured root instead, derived from
+        // config('app.url') rather than hardcoded, and restored immediately
+        // after: nothing else generated later in this request should inherit
+        // the override.
+        $portalRoot = rtrim((string) config('app.url'), '/');
+
+        URL::forceRootUrl($portalRoot);
+
+        try {
+            $signed = URL::temporarySignedRoute(
+                'impersonate.enter',
+                now()->addSeconds(self::WINDOW),
+                // Addressed by CUSTOMER uuid, not user: `users` has no uuid
+                // column, and naming the integer key in a URL is what R11
+                // forbids. The portal end resolves the account the same way
+                // this end would have.
+                ['customer' => $customer->uuid, 'operator' => $operator->uuid],
+            );
+        } finally {
+            URL::forceRootUrl(null);
+        }
+
+        return redirect()->away($signed);
+    }
+
+    /** The portal end of the handover. Signed, and good exactly once. */
+    public function enter(Request $request, string $customer, string $operator): RedirectResponse
+    {
+        abort_unless($request->hasValidSignature(), 403);
+
+        // Single use: the signature's own hash is the key, and it lives exactly
+        // as long as the link could. Redis, not the database — the marker is as
+        // short-lived as the link and should not need tidying up.
+        $marker = 'impersonate:'.hash('sha256', (string) $request->query('signature'));
+
+        abort_unless(Cache::add($marker, true, self::WINDOW), 403);
+
+        // Stale data, not a normal outcome: a customer row sharing its email
+        // with an operator should never have been possible to reach this far
+        // (see Customer::ensureUser() and CreateNewUser, R21) — refuse rather
+        // than hand the operator's own address a portal session.
+        try {
+            $target = Customer::where('uuid', $customer)->firstOrFail()->ensureUser();
+        } catch (IdentityCollisionException) {
+            abort(409);
+        }
+        $who = Operator::where('uuid', $operator)->firstOrFail();
+
+        Auth::guard('web')->login($target);
+        session(['impersonator_id' => $who->id]);
+
+        return redirect()->route('dashboard');
+    }
+
+    /** Back out of the customer's portal. The operator session was never touched. */
+    public function leave(): RedirectResponse
+    {
+        session()->forget('impersonator_id');
+        Auth::guard('web')->logout();
+
+        // By NAME, not AdminArea::home(): this route is reached on the
+        // PORTAL's host, and home() is a bare path ('/' in exclusive mode) —
+        // resolved against whatever host the request is already on, which is
+        // the portal's, not the console's. admin.overview is domain-bound to
+        // the console in exclusive mode, so route() generates the correct
+        // cross-host, absolute URL back to it; in shared mode it resolves
+        // against the current host same as home() would, so nothing changes
+        // there.
+        return redirect()->route('admin.overview');
+    }
+}

app/Http/Controllers/LandingController.php

@@ -0,0 +1,771 @@
+<?php
+
+namespace App\Http\Controllers;
+
+use App\Models\Subscription;
+use App\Services\Billing\AddonCatalogue;
+use App\Services\Billing\CustomDomainAccess;
+use App\Services\Billing\PlanCatalogue;
+use App\Services\Billing\SetupFee;
+use App\Services\Billing\TaxTreatment;
+use App\Services\Provisioning\HostCapacity;
+use App\Support\CompanyProfile;
+use App\Support\ProvisioningSettings;
+use Illuminate\Contracts\View\View;
+use Illuminate\Support\Facades\Log;
+use Throwable;
+
+/**
+ * The public price sheet.
+ *
+ * Prices, storage and seat counts are read from the catalogue rather than
+ * written into the page. They were hard-coded here once, and the page and the
+ * catalogue had already drifted apart on three of four plans — a visitor was
+ * quoted 249 € for a plan that charged 399 € at checkout. The marketing site is
+ * a reader of the catalogue like every other caller.
+ *
+ * The catalogue fails loudly by design: an empty or overlapping catalogue is an
+ * outage for commerce, not something to paper over. But a public website is not
+ * commerce — a mistyped availability window must not take the company's front
+ * page down with it. So the failure is caught HERE and only here: the page
+ * still renders, the price sheet is replaced by "on request", and nobody is
+ * shown a number the checkout would not honour.
+ *
+ * The sheet is three blocks, not one matrix. A single grid of ticks was being
+ * asked to carry three different kinds of sentence at once, and it made all
+ * three unreadable: what every package has (a tick straight down every column,
+ * which is no information at all), what tells the packages apart, and what
+ * costs extra. Worse, two of the columns were lying by construction — support
+ * was modelled as two independent booleans, so the top plan rendered a dash
+ * where the middle one had a tick, and the platform address was modelled as if
+ * an own domain replaced it, when provisioning issues both. Each block now
+ * makes one kind of statement: BASELINE what everyone gets, the comparison
+ * table what differs, ADDONS what is for sale on top.
+ *
+ * A fourth block, ENTERPRISE, sits beside the comparison table rather than
+ * inside it: once a family drops out of PlanCatalogue::sellable() it has no
+ * price left to compare, and a dash would say "not included" about something
+ * that is not for sale at any figure. See enterprise() for when it shows.
+ */
+class LandingController extends Controller
+{
+    // Ob Office schon verkauft wird — die Konstante selbst und die
+    // vollständige Begründung stehen in
+    // App\Services\Billing\AddonCatalogue::OFFICE_ON_SALE, nicht mehr hier.
+    // Sie stand ursprünglich in diesem Controller, bis auffiel, dass ein
+    // eingeloggter Kunde `collabora_pro` trotzdem über die Abrechnungsseite
+    // hätte buchen können (App\Livewire\Billing::purchase() kannte den
+    // Schalter nicht) — verschoben an die Stelle, die Preistafel UND
+    // Abrechnungsseite kennen, damit ein Schalter beide Wege schließt. Hier
+    // reicht die Kurzfassung: modulePrices() unten nimmt die Zeile
+    // `collabora_pro` aus der Modulliste, solange die Konstante false ist,
+    // und __invoke() reicht sie der View als `officeOnSale` weiter, die
+    // damit dieselbe Kachel „Office im Browser" aus der Aufzählung „Was
+    // enthalten ist" filtert.
+    //
+    // Derselbe Riegel sperrt seit derselben Stelle auch `extra_backups`
+    // (App\Services\Billing\AddonCatalogue::EXTRA_BACKUPS_ON_SALE) — ohne
+    // eigenen View-Schalter wie `officeOnSale`, weil der zweite
+    // Sicherungsort in keiner Aufzählung „Was enthalten ist" steht, sondern
+    // nur in der Modulliste. modulePrices() unten reicht dafür allein.
+
+    /**
+     * Catalogue feature keys, in the words a customer uses.
+     *
+     * Deliberately separate from the operator-facing labels in
+     * lang/*\/billing.php's `feature` array, which name the same keys for the
+     * console's checkboxes. The two are different registers for different
+     * readers — "Protokollierung der Zugriffe" here versus "Audit-Log" there —
+     * and features are catalogue-wide, not per-plan, so there is nowhere on a
+     * plan family or version to hang an editable customer-facing label
+     * without re-introducing a shared feature table. That table
+     * (`plan_features`) existed once and was deliberately removed in the
+     * catalogue rebuild that closed the pricing split-brain; bringing it back
+     * for wording alone is a bigger, separate decision.
+     */
+    private const FEATURES = [
+        'managed_updates' => 'Updates & Wartung',
+        'daily_backups' => 'Tägliche Sicherung',
+        'monitoring' => 'Überwachung rund um die Uhr',
+        // Filled in from the configured zone by zone(), reached through
+        // label(), because a hard-coded domain here is the same
+        // two-sources-of-truth mistake as a hard-coded price — and it shipped
+        // naming clupilot.cloud, a domain the company does not own, while
+        // provisioning was issuing addresses under whatever CLUPILOT_DNS_ZONE
+        // said.
+        'subdomain' => 'Adresse auf :zone',
+        'custom_domain' => 'Eigene Domain',
+        'office' => 'Office im Browser',
+        'branding' => 'Ihr Logo & Ihre Farben',
+        'priority_support' => 'Bevorzugter Support',
+        'premium_sla' => 'Vereinbarte Reaktionszeiten',
+        'extended_retention' => 'Verlängerte Aufbewahrung',
+        'audit_log' => 'Protokollierung der Zugriffe',
+        'onboarding' => 'Begleitete Einführung',
+    ];
+
+    /**
+     * What every package carries, said once above the table.
+     *
+     * Each of these was a row of ticks running straight down all four columns
+     * — a comparison that compares nothing — and the same promises were then
+     * repeated in a prose line under the table. `key` names the catalogue
+     * feature the claim stands on: it keeps the row out of the comparison
+     * table, and, unless the claim is `issued`, the whole item is dropped
+     * should a plan ever stop carrying it. The page must not promise for
+     * "jedes Paket" what one package does not have.
+     *
+     * The last two have no key because the catalogue does not model them. They
+     * are the promises the prose line under the table made, kept word for word
+     * rather than reworded on the way in.
+     */
+    private const BASELINE = [
+        [
+            'icon' => 'refresh',
+            'label' => 'Updates & Wartung',
+            'detail' => 'Betriebssystem und Anwendung, eingespielt außerhalb Ihrer Arbeitszeit.',
+            'key' => 'managed_updates',
+        ],
+        [
+            'icon' => 'database',
+            'label' => 'Tägliche verschlüsselte Sicherung',
+            'detail' => 'Mit monatlichem Wiederherstellungstest, protokolliert.',
+            'key' => 'daily_backups',
+        ],
+        [
+            'icon' => 'activity',
+            'label' => 'Überwachung rund um die Uhr',
+            'detail' => 'Erreichbarkeit, Speicher und Dienste — Alarm, bevor Sie es merken.',
+            'key' => 'monitoring',
+        ],
+        [
+            'icon' => 'globe',
+            'label' => 'Ihre Adresse ab der ersten Minute',
+            // The shape, not the word for it. "Eigene Subdomain" tells a
+            // customer nothing; the address they will actually type does.
+            'detail' => 'ihrefirma.:zone',
+            'mono' => true,
+            // Issued, not sold: ConfigureDnsAndTls gives every instance its
+            // platform address whatever `subdomain` says on the plan version
+            // that was frozen years ago — business and enterprise do not carry
+            // the flag and get the address anyway. The key is named so the row
+            // leaves the comparison table; the promise does not hang on it.
+            'key' => 'subdomain',
+            'issued' => true,
+        ],
+        [
+            'icon' => 'file-text',
+            'label' => 'AV-Vertrag & TOM-Dokumentation',
+            'detail' => 'Schriftlich, für Ihre eigene Dokumentation und Prüfung.',
+        ],
+        [
+            'icon' => 'life-buoy',
+            'label' => 'Persönlicher Support',
+            'detail' => 'Antwort am selben Werktag, ohne Warteschleife.',
+        ],
+    ];
+
+    /**
+     * The support level a plan carries, strongest first.
+     *
+     * One axis, not two. `priority_support` and `premium_sla` are steps on the
+     * same ladder, and as independent tick boxes they made the top plan look
+     * worse than the middle one: enterprise carries the SLA and not the
+     * priority flag, so it rendered "Bevorzugter Support —" while team
+     * rendered a tick. No plan carrying either is not an absence — standard
+     * support is a real level, and the baseline block above says what it is.
+     */
+    private const SUPPORT = [
+        'premium_sla' => ['level' => 'Premium', 'note' => 'mit zugesagter Reaktionszeit'],
+        'priority_support' => ['level' => 'Bevorzugt', 'note' => 'Anfragen werden vorgezogen'],
+    ];
+
+    private const SUPPORT_STANDARD = ['level' => 'Standard', 'note' => 'Antwort am selben Werktag'];
+
+    /**
+     * The modules we sell on top of a package, in the words a customer uses.
+     *
+     * Same split as FEATURES and for the same reason: lang/*\/billing.php names
+     * these for the portal's booking cards ("Collabora Online Pro"), which is
+     * the register of somebody who already bought. A visitor deciding has not
+     * heard of Collabora. The prices are never written here — they come from
+     * AddonCatalogue, so the sheet and the booking page cannot disagree.
+     */
+    private const ADDONS = [
+        'extra_backups' => [
+            'name' => 'Zweiter Sicherungsort',
+            'body' => 'Eine zusätzliche verschlüsselte Kopie Ihrer Daten, getrennt vom ersten Ort gelagert.',
+        ],
+        'priority_support' => [
+            'name' => 'Bevorzugter Support',
+            'body' => 'Ihre Anfragen werden vorgezogen — Reaktion innerhalb einer Stunde statt am selben Werktag.',
+        ],
+        // Aus dem Verkauf genommen, solange AddonCatalogue::OFFICE_ON_SALE
+        // false ist — der Text bleibt stehen, modulePrices() liefert für
+        // diesen Schlüssel aber keinen Preis mehr, solange die Konstante
+        // steht, und ohne Preis taucht der Eintrag in addons() gar nicht
+        // erst auf.
+        'collabora_pro' => [
+            'name' => 'Office mit vollem Funktionsumfang',
+            'body' => 'Mehr gleichzeitige Bearbeiter und die erweiterten Funktionen der Office-Integration.',
+        ],
+        'custom_domain' => [
+            'name' => 'Eigene Domain',
+            'body' => 'Ihre Cloud unter Ihrer eigenen Adresse, samt Zertifikat und Einrichtung.',
+        ],
+        AddonCatalogue::STORAGE => [
+            'name' => 'Zusatzspeicher',
+            'body' => 'Ein Paket mit :size — jederzeit ergänzbar, ohne Umzug Ihrer Daten.',
+        ],
+    ];
+
+    public function __invoke(): View
+    {
+        $plans = $this->plans();
+
+        // Read once and handed to both blocks that quote a module price, so the
+        // "optional" cell in the table and the module list underneath it cannot
+        // print two different figures for the same thing.
+        $modules = $this->modulePrices();
+
+        $tax = CompanyProfile::taxRate();
+        // Through SetupFee, which is also what the checkout charges. The sentence
+        // on this page named a figure that nothing collected for months; now the
+        // quote and the charge come out of one place, so a change to either the fee
+        // or the rate cannot move one without moving the other.
+        $setupNet = SetupFee::netCents();
+
+        return view('landing', [
+            'plans' => $plans,
+            // What the page has to say about tax and about the one-off fee, in
+            // one place. Both are console-editable figures, and both were
+            // previously sentences on the page: "Netto pro Monat" and "zzgl.
+            // einmaliger Einrichtung" — the second of which never named a
+            // number at all, so a visitor learned only that there was one.
+            'vat' => [
+                'rate' => $tax,
+                'label' => rtrim(rtrim(number_format($tax, 1, ',', '.'), '0'), ','),
+            ],
+            'setup' => $setupNet === 0 ? null : [
+                'gross' => $this->money(SetupFee::chargedCents(TaxTreatment::domestic()), Subscription::catalogueCurrency()),
+                'net' => $this->money($setupNet, Subscription::catalogueCurrency()),
+            ],
+            'baseline' => $this->baseline($plans),
+            'comparison' => $this->comparison($plans, $modules),
+            'addons' => $this->addons($modules),
+            'enterprise' => $this->enterprise($plans),
+            // Der einzige Schalter für die Office-Kachel in der Aufzählung
+            // „Was enthalten ist" — siehe AddonCatalogue::OFFICE_ON_SALE.
+            'officeOnSale' => AddonCatalogue::OFFICE_ON_SALE,
+        ]);
+    }
+
+    /**
+     * The promises that hold for every package on sale.
+     *
+     * @param  array<int, array<string, mixed>>  $plans
+     * @return array<int, array<string, mixed>>
+     */
+    private function baseline(array $plans): array
+    {
+        return array_values(array_filter(
+            array_map(fn (array $item) => [...$item, 'detail' => $this->zone($item['detail'])], self::BASELINE),
+            function (array $item) use ($plans) {
+                $key = $item['key'] ?? null;
+
+                if ($key === null || ($item['issued'] ?? false)) {
+                    return true;
+                }
+
+                // "In jedem Paket" is a claim about all of them, so one plan
+                // without the feature retires the claim rather than weakening
+                // it to a footnote nobody reads.
+                foreach ($plans as $plan) {
+                    if (! in_array($key, $plan['keys'], true)) {
+                        return false;
+                    }
+                }
+
+                return true;
+            },
+        ));
+    }
+
+    /**
+     * The rows on which the packages actually differ, each cell in one of three
+     * states: carried, buyable, or neither.
+     *
+     * Two states could not tell "you do not get this" apart from "you can have
+     * it for nine euros", so the sheet said the first about four things we
+     * would happily have sold — which is how the page came to mention none of
+     * the modules at all.
+     *
+     * Built from what is on sale rather than from the full feature list, so a
+     * feature no current plan offers does not appear as an empty row.
+     *
+     * @param  array<int, array<string, mixed>>  $plans
+     * @param  array<string, int>  $modules
+     * @return array<int, array{label: string, cells: array<string, array<string, mixed>>}>
+     */
+    private function comparison(array $plans, array $modules): array
+    {
+        $baselineKeys = array_column(self::BASELINE, 'key');
+        $rows = [];
+        $supportPlaced = false;
+
+        foreach (array_keys(self::FEATURES) as $key) {
+            if (in_array($key, $baselineKeys, true)) {
+                continue;
+            }
+
+            // The support row takes the place of the first of the two keys it
+            // replaces, so the sheet keeps the catalogue's narrative order
+            // rather than growing an appendix at the bottom.
+            if (isset(self::SUPPORT[$key])) {
+                $row = $supportPlaced ? null : $this->supportRow($plans, $modules);
+                $supportPlaced = true;
+
+                if ($row !== null) {
+                    $rows[] = $row;
+                }
+
+                continue;
+            }
+
+            $offered = array_filter($plans, fn (array $plan) => in_array($key, $plan['keys'], true));
+
+            if ($offered === []) {
+                continue;
+            }
+
+            $cells = [];
+
+            foreach ($plans as $plan) {
+                $cells[$plan['key']] = match (true) {
+                    in_array($key, $plan['keys'], true) => ['state' => 'included'],
+                    // Not carried, but on sale TO THIS PACKAGE — the only
+                    // honest third answer. A module we do not sell stays a
+                    // dash, however easy it would be to invent a price for it,
+                    // and so does one this package may not book: an own domain
+                    // is impossible on the entry package, so quoting nine euros
+                    // there would be selling something we would then refuse.
+                    isset($modules[$key]) && $this->bookableOn($key, $plan) => ['state' => 'optional', 'price' => $this->modulePrice($modules[$key])],
+                    default => ['state' => 'absent'],
+                };
+            }
+
+            $rows[] = ['label' => (string) $this->label($key), 'cells' => $cells];
+        }
+
+        return $rows;
+    }
+
+    /**
+     * Whether a package could actually book this module.
+     *
+     * Only the own domain has such a rule today, and the rule is not restated
+     * here: CustomDomainAccess owns it, and the sheet asks. A page that decided
+     * for itself which packages may buy a domain would be a second answer to a
+     * question the shop already answers, and the two would part company the
+     * first time the owner changed one of them.
+     *
+     * @param  array<string, mixed>  $plan
+     */
+    private function bookableOn(string $key, array $plan): bool
+    {
+        if ($key !== CustomDomainAccess::ADDON) {
+            return true;
+        }
+
+        return app(CustomDomainAccess::class)->bookableOnPlan((string) $plan['key'], $plan['keys']);
+    }
+
+    /**
+     * Support as one row of levels.
+     *
+     * Omitted entirely when no plan carries either key: four columns all
+     * reading "Standard" is the row of identical ticks this rebuild removed,
+     * and the baseline block has already said what standard support is.
+     *
+     * @param  array<int, array<string, mixed>>  $plans
+     * @param  array<string, int>  $modules
+     * @return array{label: string, cells: array<string, array<string, mixed>>}|null
+     */
+    private function supportRow(array $plans, array $modules): ?array
+    {
+        $cells = [];
+        $differs = false;
+
+        foreach ($plans as $plan) {
+            $carried = self::SUPPORT_STANDARD;
+
+            // Strongest first: a plan carrying both is shown at the level it
+            // actually answers at, not at whichever key was checked first.
+            foreach (self::SUPPORT as $key => $level) {
+                if (in_array($key, $plan['keys'], true)) {
+                    $carried = $level;
+                    $differs = true;
+
+                    break;
+                }
+            }
+
+            $cells[$plan['key']] = [
+                'state' => 'level',
+                'text' => $carried['level'],
+                // The upgrade displaces the level's own qualifier: a customer
+                // reading the standard cell is better served by what the next
+                // step costs than by a restatement of the line above.
+                'note' => $carried === self::SUPPORT_STANDARD && isset($modules['priority_support'])
+                    ? 'bevorzugt ab '.$this->modulePrice($modules['priority_support'])
+                    : $carried['note'],
+            ];
+        }
+
+        return $differs ? ['label' => 'Support', 'cells' => $cells] : null;
+    }
+
+    /**
+     * Today's price for every module actually on sale, in cents.
+     *
+     * Swallowed like the plan catalogue and for the same reason (see the class
+     * docblock): an empty or unreadable module list costs the page a block, not
+     * the page. Every caller then reads a plain array, so a module that is not
+     * in it is simply not for sale — which is exactly what the dash in the
+     * table means.
+     *
+     * @return array<string, int>
+     */
+    private function modulePrices(): array
+    {
+        try {
+            $catalogue = app(AddonCatalogue::class);
+            $keys = [...array_keys((array) config('provisioning.addons', [])), AddonCatalogue::STORAGE];
+            $prices = [];
+
+            foreach ($keys as $key) {
+                // Office ist vom Markt genommen (siehe
+                // AddonCatalogue::OFFICE_ON_SALE) — die Pro-Stufe einer
+                // Grundfunktion, die es nicht gibt, gehört so wenig auf die
+                // Preistafel wie das Grundmodul selbst.
+                if ($key === 'collabora_pro' && ! AddonCatalogue::OFFICE_ON_SALE) {
+                    continue;
+                }
+
+                // Der zweite Sicherungsort ist vom Markt genommen (siehe
+                // AddonCatalogue::EXTRA_BACKUPS_ON_SALE), solange der
+                // Speicherserver für das zweite Ziel fehlt — ein eigener
+                // Schalter, weil dieses Modul aus einem anderen Grund als
+                // Office nicht verkauft wird und zu einem anderen Zeitpunkt
+                // zurückkommt.
+                if ($key === 'extra_backups' && ! AddonCatalogue::EXTRA_BACKUPS_ON_SALE) {
+                    continue;
+                }
+
+                $cents = $catalogue->priceCents((string) $key);
+
+                // Nothing is sold for nothing. An entry without a price reads
+                // back as 0 cents, and "optional · 0 €" on a public price sheet
+                // is an offer somebody would hold us to.
+                if ($cents === null || $cents <= 0) {
+                    continue;
+                }
+
+                // The storage pack is sold by the pack, so a pack of no size is
+                // not a product either.
+                if ($key === AddonCatalogue::STORAGE && (int) config('provisioning.storage_addon.gb', 0) <= 0) {
+                    continue;
+                }
+
+                $prices[(string) $key] = $cents;
+            }
+
+            return $prices;
+        } catch (Throwable $e) {
+            Log::error('Landing page could not read the add-on catalogue', ['exception' => $e]);
+
+            return [];
+        }
+    }
+
+    /**
+     * The modules, in the order the catalogue lists them, with today's prices.
+     *
+     * @param  array<string, int>  $modules
+     * @return array<int, array{name: string, body: string, price: string}>
+     */
+    private function addons(array $modules): array
+    {
+        $rows = [];
+
+        foreach ($modules as $key => $cents) {
+            $copy = self::ADDONS[$key] ?? null;
+
+            // Same rule as an unknown feature key: a module nobody has written
+            // up is left out rather than advertised as "collabora_pro".
+            if ($copy === null) {
+                continue;
+            }
+
+            $rows[] = [
+                'name' => $copy['name'],
+                'body' => str_replace(
+                    ':size',
+                    $this->storage((int) config('provisioning.storage_addon.gb', 0)),
+                    $copy['body'],
+                ),
+                'price' => $this->modulePrice($cents),
+            ];
+        }
+
+        return $rows;
+    }
+
+    /**
+     * The request-a-quote block that replaces Enterprise's column once the
+     * family is no longer a priced catalogue entry.
+     *
+     * Null in two cases. While Enterprise is still in `$plans` — today's
+     * state, and the one every install starts in — the sheet renders exactly
+     * as before this method existed. And when `$plans` itself is empty: that
+     * is the catalogue-read-failed state the class docblock already covers,
+     * the sheet already says "Preise derzeit auf Anfrage" for it, and there
+     * is no "largest sellable package" to measure the heading against —
+     * inventing a size here (or worse, `max()` on an empty array) would be
+     * the same lie in a new place, not a fix for the empty one.
+     *
+     * Read off `$plans` rather than queried again from PlanFamily or
+     * PlanVersion: `$plans` already IS PlanCatalogue::sellable()'s answer for
+     * this request, and a second "how big is the largest package" question
+     * here could drift from it the moment either changed — the same
+     * split-brain this class exists to avoid.
+     *
+     * The heading names the largest sellable quota rather than a number typed
+     * into the language file, for the same reason: a plan restructure changes
+     * what the largest package holds (the pricing rebuild this task is part
+     * of does exactly that to Business), and a fixed figure would go on
+     * quietly naming the wrong ceiling with nothing to catch it. There is
+     * deliberately no SECOND, lower threshold ("ab 500 GB") in the copy any
+     * more either — the dedicated machine starts exactly where the largest
+     * sellable package ends; how big any particular one becomes is a
+     * hardware question answered per quote, not a second number on the price
+     * sheet.
+     *
+     * The rest of the copy is fixed rather than pulled from the catalogue:
+     * there is no price to quote for a machine that is not built yet, and
+     * Enterprise cannot simply become a normal catalogue row again either —
+     * placeableIn() finds no host on the 388 GB a shared machine actually has
+     * to give away, so a checkout would take the payment and only then
+     * discover it cannot deliver.
+     *
+     * @param  array<int, array<string, mixed>>  $plans
+     * @return array{title: string, body: string, cta: string, href: string}|null
+     */
+    private function enterprise(array $plans): ?array
+    {
+        if ($plans === [] || in_array('enterprise', array_column($plans, 'key'), true)) {
+            return null;
+        }
+
+        return [
+            'title' => __('landing.enterprise_title', [
+                'quota' => $this->storage((int) max(array_column($plans, 'quota_gb'))),
+            ]),
+            'body' => __('landing.enterprise_body'),
+            'cta' => __('landing.enterprise_cta'),
+            // Bis hierher stand hier `mailto:office@clupilot.com`, mit der
+            // Begründung, es gebe keine Kontaktseite und eine anzulegen sei zu
+            // viel für einen Knopf. Der Knopf tat damit auf den meisten Geräten
+            // sichtbar nichts — ohne eingerichtetes Mailprogramm passiert
+            // schlicht gar nichts. Ausgerechnet an der Stelle, an der das
+            // Selbstbedienen aufhört und jemand von sich aus fragen will.
+            //
+            // Mit `thema=enterprise`, damit die Seite weiß, wonach gefragt wird:
+            // sie stellt dann die Frage nach Speicher und Personenzahl, statt
+            // ein leeres Feld hinzustellen.
+            'href' => route('contact', ['thema' => 'enterprise']),
+        ];
+    }
+
+    /**
+     * @return array<int, array<string, mixed>> empty when the catalogue cannot be read
+     */
+    private function plans(): array
+    {
+        try {
+            $sellable = app(PlanCatalogue::class)->sellable();
+        } catch (Throwable $e) {
+            // Deliberately swallowed: see the class docblock. Logged at error
+            // level because a shop that cannot list its plans is not selling.
+            Log::error('Landing page could not read the plan catalogue', ['exception' => $e]);
+
+            return [];
+        }
+
+        $plans = [];
+        $capacity = app(HostCapacity::class);
+
+        foreach ($sellable as $key => $plan) {
+            $plans[] = [
+                'key' => $key,
+                'name' => $plan['name'],
+                // How soon this package can actually be delivered, read from
+                // the estate rather than from a sentence somebody typed. Where
+                // a host has room it rolls out on its own within the hour;
+                // where none has, a machine has to be bought first — and
+                // saying "sofort" in that case is a promise the very next
+                // customer catches us breaking.
+                'delivery' => $capacity->deliveryFor((int) ($plan['disk_gb'] ?? 0)),
+                // Console-edited, from the family the plan belongs to — a
+                // family that has none yet (created but not written up) gets
+                // an empty string rather than a missing array key, and the
+                // template renders that sensibly instead of an empty gap.
+                'audience' => (string) ($plan['audience'] ?? ''),
+                'note' => (string) ($plan['note'] ?? ''),
+                // GROSS, because a private customer must never be quoted a
+                // figure that grows at checkout. A business reads the net one
+                // underneath and gets the VAT back anyway; a consumer does not,
+                // and for them the net figure was simply the wrong number.
+                'price' => $this->money($this->gross((int) $plan['price_cents']), (string) $plan['currency']),
+                'price_net' => $this->money((int) $plan['price_cents'], (string) $plan['currency']),
+                // Paying for a year, in the same three figures the order page
+                // shows: what leaves the account once, what that works out to
+                // per month, and what twelve monthly payments would have been.
+                // A sheet that quotes only the monthly price cannot mention a
+                // saving, and the saving is the reason to offer the term.
+                'price_yearly' => $this->money(
+                    $yearlyGross = $this->gross((int) ($plan['yearly_price_cents'] ?? 0)),
+                    (string) $plan['currency'],
+                ),
+                'price_yearly_net' => $this->money((int) ($plan['yearly_price_cents'] ?? 0), (string) $plan['currency']),
+                // intdiv, so the headline never claims a tenth of a cent nobody
+                // is charged; the total beside it is the amount actually taken.
+                'price_yearly_monthly' => $this->money(intdiv($yearlyGross, 12), (string) $plan['currency']),
+                'price_twelve_months' => $this->money($this->gross((int) $plan['price_cents']) * 12, (string) $plan['currency']),
+                'free_months' => (int) ($plan['free_months'] ?? 0),
+                'storage' => $this->storage((int) $plan['quota_gb']),
+                // The raw figure beside its formatted twin, same reason as
+                // 'keys' beside 'features': enterprise() has to find the
+                // largest sellable quota to name in its heading, and a second
+                // catalogue read to get an unformatted number back out of a
+                // "500 GB" string would be worse than carrying the int along.
+                'quota_gb' => (int) $plan['quota_gb'],
+                'traffic' => $this->storage((int) $plan['traffic_gb']),
+                'seats' => (int) $plan['seats'],
+                'features' => $this->features($plan['features'] ?? []),
+                // The raw keys alongside the wording. Everything that has to
+                // decide something — which row this plan fills, which support
+                // level it answers at — asks the key; only the card bullets
+                // read the words. Deciding on the words matched until the
+                // first label gained a placeholder, and then quietly stopped.
+                'keys' => array_values((array) ($plan['features'] ?? [])),
+                'recommended' => (bool) ($plan['recommended'] ?? false),
+            ];
+        }
+
+        return $plans;
+    }
+
+    /**
+     * One feature, in the words a customer uses.
+     *
+     * The address the platform hands out is a setting, not a constant — a
+     * server can be installed against any zone — so the sentence naming it is
+     * assembled rather than written down twice.
+     */
+    private function label(string $key): ?string
+    {
+        $label = self::FEATURES[$key] ?? null;
+
+        return $label === null ? null : $this->zone($label);
+    }
+
+    /** The configured zone, wherever a sentence names it. */
+    private function zone(string $text): string
+    {
+        return str_replace(':zone', ProvisioningSettings::dnsZone(), $text);
+    }
+
+    /** Currencies we have a symbol for; anything else prints its ISO code. */
+    private const SYMBOLS = ['EUR' => '€', 'CHF' => 'CHF', 'USD' => '$', 'GBP' => '£'];
+
+    /**
+     * A price as the sheet prints it, currency included.
+     *
+     * The symbol comes from the catalogue rather than from the template: the
+     * currency is configurable (CLUPILOT_CURRENCY), and a page that says "€"
+     * while the checkout charges francs is the same two-sources-of-truth
+     * mistake as a hard-coded amount, only harder to notice.
+     *
+     * Whole units when the amount is whole — a price sheet reads "179", not
+     * "179,00".
+     */
+    /**
+     * A net figure as the ordinary customer is charged it.
+     *
+     * Handed straight to TaxTreatment rather than worked out here. It is the same
+     * call the domestic Stripe Price is formed with, so the figure on this page and
+     * the figure on the card statement cannot drift apart. It used to be a
+     * multiplication of its own, which is a second source of the same number and
+     * therefore a second answer waiting to happen.
+     *
+     * This page is read by visitors nobody has met, so the domestic gross is the
+     * only honest figure to put on it. A business in another member state with a
+     * verified VAT id is charged less — the bare net, no VAT owed to us at all —
+     * and learns that on the pages that know who they are, not here, where
+     * advertising it would quote every private visitor a price they cannot have.
+     */
+    private function gross(int $netCents): int
+    {
+        return TaxTreatment::advertisedCents($netCents);
+    }
+
+    private function money(int $cents, string $currency): string
+    {
+        $amount = $cents % 100 === 0
+            ? number_format($cents / 100, 0, ',', '.')
+            : number_format($cents / 100, 2, ',', '.');
+
+        // Non-breaking: in a narrow table column "49 €" otherwise wraps, and the
+        // currency ends up on a line of its own under the number.
+        return $amount."\u{00A0}".(self::SYMBOLS[strtoupper($currency)] ?? strtoupper($currency));
+    }
+
+    /**
+     * A module price.
+     *
+     * A plan price carries its own currency from the catalogue; a module does
+     * not, and cannot — config holds one net amount. The one currency the
+     * catalogue is priced in is therefore the honest answer, and it is the same
+     * one the booking page charges in.
+     */
+    private function modulePrice(int $cents): string
+    {
+        // Gross, like every other figure on this page. A sheet that quotes the
+        // package with VAT and the module without it is a sheet where the two
+        // numbers cannot be added up.
+        return $this->money($this->gross($cents), Subscription::catalogueCurrency());
+    }
+
+    private function storage(int $gb): string
+    {
+        return $gb >= 1000 && $gb % 1000 === 0
+            ? ($gb / 1000).' TB'
+            : $gb.' GB';
+    }
+
+    /**
+     * @param  array<int, string>  $keys
+     * @return array<int, string>
+     */
+    private function features(array $keys): array
+    {
+        // Unknown keys are dropped rather than printed raw: a feature added to
+        // the catalogue without a translation would otherwise appear on the
+        // public page as "premium_sla".
+        return array_values(array_filter(array_map(
+            fn (string $key) => $this->label($key),
+            $keys,
+        )));
+    }
+}

app/Http/Controllers/PublicFileController.php

@@ -0,0 +1,68 @@
+<?php
+
+namespace App\Http\Controllers;
+
+use Symfony\Component\HttpFoundation\BinaryFileResponse;
+
+/**
+ * Dateien, die jeder herunterladen darf: AGB, Auftragsverarbeitungsvertrag,
+ * technische und organisatorische Maßnahmen, Preisblätter.
+ *
+ * Sie liegen in `storage/app/files/public/` und werden ausgeliefert, wie sie
+ * sind. Kein Verwaltungsbereich, keine Datenbanktabelle: eine Datei ablegen
+ * genügt, und was nicht dort liegt, gibt es nicht.
+ *
+ * ---------------------------------------------------------------------------
+ * Warum eine eigene Adresse
+ * ---------------------------------------------------------------------------
+ *
+ * Diese Dateien stehen in Verträgen und auf Rechnungen. Eine Adresse, die beim
+ * nächsten Umbau des Portals wandert, macht aus jedem dieser Verweise einen
+ * toten Link — und zwar rückwirkend, in Dokumenten, die längst verschickt sind.
+ * Ein eigener Hostname ist die einzige Zusage, die sich einhalten lässt.
+ *
+ * ---------------------------------------------------------------------------
+ * Versionierte Dateinamen
+ * ---------------------------------------------------------------------------
+ *
+ * `agb-2026-01.pdf`, nicht `agb.pdf`. Eine Fassung, auf die ein Vertrag
+ * verweist, darf sich unter derselben Adresse NIE ändern — sonst zeigt der
+ * Verweis in einem Vertrag vom Januar plötzlich auf Bedingungen vom Juli, und
+ * niemand kann mehr sagen, was vereinbart war. Neue Fassung heißt neue Datei.
+ *
+ * Erzwungen wird das hier nicht — eine Regel, die eine Datei mit dem falschen
+ * Namen abweist, hilft niemandem, der eine hochladen will. Sie steht hier, weil
+ * dies die Stelle ist, an der jemand nachsieht.
+ */
+class PublicFileController extends Controller
+{
+    private const ROOT = 'app/files/public';
+
+    public function __invoke(string $file): BinaryFileResponse
+    {
+        // NUR der Dateiname, ohne Pfad. `basename()` macht aus
+        // `../../.env` ein `.env`, und das liegt in diesem Verzeichnis nicht —
+        // damit ist der Pfad-Ausbruch beantwortet, bevor er anfängt. Ein
+        // Verzeichnisbaum unter `public/` gibt es absichtlich nicht: er wäre
+        // die zweite Gelegenheit für denselben Fehler.
+        $name = basename($file);
+
+        // Ein Punktdatei-Name kommt hier nicht durch. Sie sind in diesem
+        // Verzeichnis nicht vorgesehen, und ihr Vorkommen wäre ein Versehen.
+        if ($name === '' || str_starts_with($name, '.')) {
+            abort(404);
+        }
+
+        $path = storage_path(self::ROOT.'/'.$name);
+
+        if (! is_file($path)) {
+            abort(404);
+        }
+
+        // Inline, nicht als Anhang: eine AGB, die der Browser anzeigt, wird
+        // gelesen; eine, die er herunterlädt, wird weggeklickt.
+        return response()->file($path, [
+            'Content-Disposition' => 'inline; filename="'.$name.'"',
+        ]);
+    }
+}

app/Http/Controllers/StatusController.php

@@ -0,0 +1,192 @@
+<?php
+
+namespace App\Http\Controllers;
+
+use App\Models\Incident;
+use App\Models\MaintenanceWindow;
+use App\Models\StatusDay;
+use App\Services\Status\ServiceHealth;
+use Illuminate\Contracts\View\View;
+use Illuminate\Support\Carbon;
+use Illuminate\Support\Collection;
+
+/**
+ * The public service status page.
+ *
+ * It answers three questions, and they are different questions: what is
+ * happening now, what has happened, and what is about to happen. The page used
+ * to answer only the first, which is the version of a status page that is of no
+ * use the morning after — "Alle Dienste in Betrieb" is true and says nothing to
+ * somebody who was locked out the evening before.
+ *
+ * The measurement itself lives in ServiceHealth, shared with the sampler that
+ * writes the history, so the banner and the bars cannot disagree.
+ *
+ * Aggregate only: counts, never customer names, instance addresses or host
+ * names. This page is world-readable and the estate is not public information.
+ */
+class StatusController extends Controller
+{
+    /** How much history the bars show. Ninety days is the convention. */
+    private const HISTORY_DAYS = 90;
+
+    /** How far back the written record goes on this page. */
+    private const INCIDENT_DAYS = 90;
+
+    public function __invoke(ServiceHealth $health): View
+    {
+        $components = $health->components();
+
+        // An ongoing incident overrides the measurement. Monitoring can be
+        // perfectly happy while something is broken in a way it does not look
+        // at, and in that situation the operator's word beats the probe's.
+        $ongoing = Incident::query()
+            ->published()->ongoing()
+            ->with('updates')
+            ->orderByDesc('started_at')
+            ->get();
+
+        $components = $this->applyIncidents($components, $ongoing);
+
+        return view('status', [
+            'components' => $components,
+            'overall' => $health->overall($components),
+            'history' => $this->history(),
+            'ongoing' => $ongoing,
+            'past' => $this->past(),
+            'maintenance' => $this->maintenance(),
+            'checkedAt' => Carbon::now(),
+            'historyDays' => self::HISTORY_DAYS,
+        ]);
+    }
+
+    /**
+     * Let an open incident set the state of the components it names.
+     *
+     * Only downwards. An incident cannot make a component look better than the
+     * probes found it — that direction is how a status page ends up being used
+     * to hide something.
+     *
+     * @param  array<int, array<string, mixed>>  $components
+     * @param  Collection<int, Incident>  $ongoing
+     * @return array<int, array<string, mixed>>
+     */
+    private function applyIncidents(array $components, Collection $ongoing): array
+    {
+        $rank = ['operational' => 0, 'unknown' => 1, 'degraded' => 2, 'down' => 3];
+
+        foreach ($components as $i => $component) {
+            foreach ($ongoing as $incident) {
+                if (! in_array($component['key'], $incident->components ?? [], true)) {
+                    continue;
+                }
+
+                // Maintenance is announced work, not a fault. It shows on the
+                // component without claiming anything is broken.
+                $state = $incident->impact === Incident::IMPACT_MAINTENANCE ? 'degraded' : $incident->impact;
+
+                if (($rank[$state] ?? 0) > ($rank[$component['state']] ?? 0)) {
+                    $components[$i]['state'] = $state;
+                    $components[$i]['detail'] = null;
+                }
+
+                $components[$i]['incident'] = $incident;
+            }
+        }
+
+        return $components;
+    }
+
+    /**
+     * The daily bars, one array per component, oldest first.
+     *
+     * Every day in the window appears, including the ones nobody measured —
+     * they come back as null and are drawn as a gap. Filling them in from the
+     * days around them would be inventing the only number on this page a reader
+     * can check against their own memory.
+     *
+     * @return array<string, array{days: array<int, array<string, mixed>>, uptime: float|null}>
+     */
+    private function history(): array
+    {
+        $from = Carbon::now()->local()->startOfDay()->subDays(self::HISTORY_DAYS - 1);
+
+        $rows = StatusDay::query()
+            ->where('day', '>=', $from->toDateString())
+            ->get()
+            ->groupBy('component');
+
+        $history = [];
+
+        foreach (ServiceHealth::COMPONENTS as $component) {
+            $byDay = ($rows[$component] ?? collect())->keyBy(fn (StatusDay $d) => $d->day->toDateString());
+
+            $days = [];
+            $measured = 0;
+            $up = 0;
+
+            for ($i = 0; $i < self::HISTORY_DAYS; $i++) {
+                $date = $from->copy()->addDays($i);
+                $row = $byDay[$date->toDateString()] ?? null;
+
+                $days[] = [
+                    'date' => $date,
+                    'state' => $row?->worst(),
+                    'uptime' => $row?->uptimePercent(),
+                ];
+
+                if ($row !== null) {
+                    $measured += $row->samples - $row->unknown;
+                    $up += $row->operational + $row->degraded;
+                }
+            }
+
+            $history[$component] = [
+                'days' => $days,
+                // Over the whole window, not the mean of the daily figures: a
+                // day with four samples must not weigh the same as a day with
+                // three hundred.
+                'uptime' => $measured > 0 ? round($up / $measured * 100, 2) : null,
+            ];
+        }
+
+        return $history;
+    }
+
+    /**
+     * Resolved incidents, newest first, grouped by the day they started.
+     *
+     * @return Collection<string, Collection<int, Incident>>
+     */
+    private function past(): Collection
+    {
+        return Incident::query()
+            ->published()
+            ->whereNotNull('resolved_at')
+            ->where('started_at', '>=', Carbon::now()->subDays(self::INCIDENT_DAYS))
+            ->with('updates')
+            ->orderByDesc('started_at')
+            ->get()
+            ->groupBy(fn (Incident $incident) => $incident->started_at->local()->toDateString());
+    }
+
+    /**
+     * Announced work that has not finished yet.
+     *
+     * Taken from the maintenance windows the console already keeps rather than
+     * from a second list somebody has to remember to fill in. Published ones
+     * only: a draft is a plan, not an announcement.
+     *
+     * @return Collection<int, MaintenanceWindow>
+     */
+    private function maintenance(): Collection
+    {
+        return MaintenanceWindow::query()
+            ->whereNotNull('published_at')
+            ->whereNull('cancelled_at')
+            ->where('state', '!=', 'draft')
+            ->where('ends_at', '>=', Carbon::now())
+            ->orderBy('starts_at')
+            ->get();
+    }
+}

app/Http/Controllers/StripeWebhookController.php

@@ -0,0 +1,214 @@
+<?php
+
+namespace App\Http\Controllers;
+
+use App\Actions\ApplyStripeBillingEvent;
+use App\Actions\StartCustomerProvisioning;
+use App\Models\FailedCheckout;
+use App\Support\StripeWebhookSecret;
+use Illuminate\Http\JsonResponse;
+use Illuminate\Http\Request;
+
+/**
+ * Stripe webhook: verifies the signature (when a secret is configured) and turns
+ * a paid checkout into a provisioning run. Idempotent via the order's
+ * stripe_event_id — Stripe retries a webhook until it gets a 2xx.
+ */
+class StripeWebhookController extends Controller
+{
+    public function __invoke(
+        Request $request,
+        StartCustomerProvisioning $action,
+        ApplyStripeBillingEvent $billing,
+    ): JsonResponse {
+        $payload = $request->getContent();
+        $secret = StripeWebhookSecret::current();
+
+        if (blank($secret)) {
+            // Fail closed: an unconfigured secret must not authorize provisioning
+            // outside local/testing.
+            abort_unless(app()->environment('local', 'testing'), 400, 'Stripe webhook secret not configured');
+        } elseif (! $this->signatureValid($payload, (string) $request->header('Stripe-Signature'), $secret)) {
+            abort(400, 'invalid signature');
+        }
+
+        $event = json_decode($payload, true) ?: [];
+        $object = $event['data']['object'] ?? [];
+        $type = $event['type'] ?? '';
+
+        // The billing cycle is Stripe's: once a contract exists, they decide
+        // when it renews, when a payment failed, and when it has ended. Handled
+        // before the checkout branch because none of these are checkouts.
+        $applied = $billing->dispatch($event);
+
+        if ($applied !== false) {
+            if ($applied === null) {
+                // Either already applied, or about a contract that does not
+                // exist yet — a checkout takes a moment to become one, and
+                // Stripe does not deliver in order. Holding it costs a row and
+                // saves a cancellation we would otherwise never hear about
+                // again; a replay is a no-op if it was simply a duplicate.
+                $billing->hold($event);
+            }
+
+            // 2xx either way. Stripe retrying would not change the answer, and
+            // anything worth replaying is now held rather than dropped.
+            return response()->json(['handled' => $type, 'applied' => $applied !== null]);
+        }
+
+        // Paid triggers: a synchronous checkout (completed + paid) OR an async
+        // method clearing later (async_payment_succeeded). Ignore everything else,
+        // including the still-unpaid completed event for async methods.
+        // Eine Zahlung, die Tage später platzt. Bei SEPA oder
+        // Sofortüberweisung klärt sie erst nach dem Abschluss; klärt sie
+        // nicht, kommt genau dieses Ereignis — bis zum 31.7.2026 empfangen
+        // und ignoriert. Dass daraus KEIN Auftrag entsteht, war richtig und
+        // bleibt so. Falsch war, dass gar nichts entstand: ein verlorener
+        // Verkauf, von dem niemand hört.
+        if ($type === 'checkout.session.async_payment_failed') {
+            return response()->json(['recorded' => $this->recordFailedCheckout($object)]);
+        }
+
+        $paid = ($type === 'checkout.session.completed' && ($object['payment_status'] ?? null) === 'paid')
+            || $type === 'checkout.session.async_payment_succeeded';
+        if (! $paid) {
+            return response()->json(['ignored' => true]);
+        }
+
+        $meta = $object['metadata'] ?? [];
+
+        // A real email is required — never merge unrelated customers under a
+        // manufactured address or send credentials into the void.
+        $email = $object['customer_details']['email'] ?? $object['customer_email'] ?? ($meta['email'] ?? null);
+        if (blank($email)) {
+            return response()->json(['ignored' => 'no_customer_email']);
+        }
+
+        $action->fromStripeEvent([
+            // Deduplicate on the checkout session id (stable across the completed
+            // and async-succeeded events for one purchase), not the event id.
+            'id' => (string) ($object['id'] ?? $event['id'] ?? ''),
+            'email' => $email,
+            'name' => $object['customer_details']['name'] ?? ($meta['name'] ?? null),
+            'stripe_customer_id' => $object['customer'] ?? null,
+            // The handle every later billing event arrives with. Without it an
+            // invoice.paid cannot be matched to the contract it renews.
+            'stripe_subscription_id' => is_string($object['subscription'] ?? null) ? $object['subscription'] : null,
+            // What a refund would have to be issued against, kept at the only
+            // moment Stripe tells us. A subscription checkout charges through
+            // an invoice and usually reports no PaymentIntent at all, so both
+            // are taken and App\Actions\WithdrawContract uses whichever it has.
+            'stripe_payment_intent_id' => is_string($object['payment_intent'] ?? null) ? $object['payment_intent'] : null,
+            'stripe_invoice_id' => is_string($object['invoice'] ?? null) ? $object['invoice'] : null,
+            // The consumer's express request that the service begin inside the
+            // fourteen-day withdrawal window. Set on the session metadata by the
+            // checkout; anything other than the exact string is a no, because a
+            // consent that can be produced by a typo is not a consent.
+            //
+            // Nothing decides anything on it now — a withdrawal refunds the
+            // whole amount either way — so it is carried as a record of what was
+            // agreed rather than as a gate. See App\Models\Order.
+            'immediate_start_consent' => ($meta['immediate_start'] ?? null) === '1',
+            'plan' => $meta['plan'] ?? 'start',
+            // What the customer was actually shown. Absent on a session created
+            // before phase 5 put it there, and then the version on sale applies.
+            'plan_version_id' => isset($meta['plan_version_id']) ? (int) $meta['plan_version_id'] : null,
+            'datacenter' => $meta['datacenter'] ?? 'fsn',
+            'amount_cents' => (int) ($object['amount_total'] ?? $object['amount'] ?? 0),
+            // How much of that total was the one-off setup fee, which rode along
+            // as a second line item on the session. From OUR metadata rather than
+            // from Stripe's line items: this is the figure we asked for, we asked
+            // for it once, and reading it back from the amounts would mean
+            // guessing which line was which.
+            //
+            // Clamped to the total. A negative or oversized value could only come
+            // from a session that was not ours, and the package's charge is derived
+            // by subtracting this — a wild figure there would put a negative price
+            // on the contract's own line.
+            'setup_fee_cents' => max(0, min(
+                (int) ($object['amount_total'] ?? $object['amount'] ?? 0),
+                (int) ($meta['setup_fee_cents'] ?? 0),
+            )),
+            'currency' => strtoupper($object['currency'] ?? 'eur'),
+        ]);
+
+        return response()->json(['ok' => true]);
+    }
+
+    /** Stripe's default replay tolerance, in seconds. */
+    private const SIGNATURE_TOLERANCE = 300;
+
+    /** Verify Stripe's `t=…,v1=…` signature: HMAC-SHA256 of "{t}.{payload}". */
+    private function signatureValid(string $payload, string $header, string $secret): bool
+    {
+        if (blank($header)) {
+            return false;
+        }
+
+        $timestamp = null;
+        $signatures = [];
+        foreach (explode(',', $header) as $segment) {
+            [$key, $value] = array_pad(explode('=', $segment, 2), 2, '');
+            if ($key === 't') {
+                $timestamp = $value;
+            } elseif ($key === 'v1') {
+                $signatures[] = $value; // keep every v1 (secret rotation sends several)
+            }
+        }
+
+        if ($timestamp === null || $signatures === []) {
+            return false;
+        }
+
+        // Reject replays outside the tolerance window.
+        if (abs(time() - (int) $timestamp) > self::SIGNATURE_TOLERANCE) {
+            return false;
+        }
+
+        $expected = hash_hmac('sha256', $timestamp.'.'.$payload, $secret);
+
+        foreach ($signatures as $signature) {
+            if (hash_equals($expected, $signature)) {
+                return true;
+            }
+        }
+
+        return false;
+    }
+
+    /**
+     * Den geplatzten Kauf festhalten — so viel, wie nötig ist, um jemanden
+     * zurückzurufen, und keine Zeile mehr.
+     *
+     * Ohne E-Mail-Adresse gar nicht: eine Zeile, die niemanden benennt, ist
+     * für den Betreiber nicht handhabbar und für den Kunden folgenlos.
+     *
+     * @param  array<string, mixed>  $object
+     */
+    private function recordFailedCheckout(array $object): bool
+    {
+        $email = $object['customer_details']['email'] ?? $object['customer_email'] ?? null;
+        $sessionId = (string) ($object['id'] ?? '');
+
+        if (blank($email) || $sessionId === '') {
+            return false;
+        }
+
+        // firstOrCreate, weil Stripe einen Webhook wiederholt, bis er ein 2xx
+        // bekommt — sonst stünde derselbe verlorene Verkauf dreimal da. Die
+        // Eindeutigkeit steht zusätzlich als Index in der Tabelle.
+        FailedCheckout::query()->firstOrCreate(
+            ['stripe_session_id' => $sessionId],
+            [
+                'email' => (string) $email,
+                'name' => $object['customer_details']['name'] ?? null,
+                'plan' => $object['metadata']['plan'] ?? null,
+                'amount_cents' => (int) ($object['amount_total'] ?? 0),
+                'currency' => strtoupper((string) ($object['currency'] ?? 'eur')),
+                'failed_at' => now(),
+            ],
+        );
+
+        return true;
+    }
+}

app/Http/Middleware/EnsureAdmin.php

@@ -0,0 +1,26 @@
+<?php
+
+namespace App\Http\Middleware;
+
+use Closure;
+use Illuminate\Http\Request;
+use Illuminate\Support\Facades\Auth;
+use Symfony\Component\HttpFoundation\Response;
+
+class EnsureAdmin
+{
+    /**
+     * Only operators with the console.view capability may reach the admin
+     * console. Checked on the operator guard explicitly, never on the default
+     * (`web`) guard's user — a portal account can no longer hold a role at all,
+     * so trusting the default guard here would just mean nobody ever gets in.
+     */
+    public function handle(Request $request, Closure $next): Response
+    {
+        $operator = Auth::guard('operator')->user();
+
+        abort_unless($operator !== null && $operator->isActive() && $operator->can('console.view'), 403);
+
+        return $next($request);
+    }
+}

app/Http/Middleware/EnsureCustomerActive.php

@@ -0,0 +1,54 @@
+<?php
+
+namespace App\Http\Middleware;
+
+use App\Models\Customer;
+use Closure;
+use Illuminate\Http\Request;
+use Illuminate\Support\Facades\Auth;
+use Symfony\Component\HttpFoundation\Response;
+
+/**
+ * Enforce customer account lifecycle on portal requests: a suspended or closed
+ * customer must lose access. An active impersonation session is exempt so
+ * operators can still inspect a suspended customer's portal. There is no
+ * operator special case here any more: a `web`-guard user can never be an
+ * operator, so the only thing left to exempt is an impersonation session.
+ */
+class EnsureCustomerActive
+{
+    public function handle(Request $request, Closure $next): Response
+    {
+        $user = $request->user();
+
+        if ($user !== null && ! $request->session()->has('impersonator_id')) {
+            $customer = Customer::query()->where('user_id', $user->id)->first()
+                ?? Customer::query()->where('email', $user->email)->first();
+
+            if ($customer !== null && ($customer->status === 'suspended' || $customer->status === 'closed' || $customer->closed_at !== null)) {
+                Auth::logout();
+
+                // NOT session()->invalidate(): where the console and the portal
+                // share a host (shared/fallback mode — this VM's own mode), both
+                // guards keep their login key in the SAME session. invalidate()
+                // is flush() + migrate(true) — it discards every attribute in the
+                // session, not just the 'web' guard's, so it would silently sign
+                // an operator elsewhere in that same browser out of the console
+                // too. regenerate() issues a new session id (no fixation risk)
+                // without touching the other attributes, so the 'operator'
+                // guard's own login key — untouched by the Auth::logout() call
+                // above, which only logs out the default ('web') guard —
+                // survives untouched. Same fix as routes/admin.php's own
+                // /logout route, mirrored the other way round.
+                $request->session()->regenerate();
+                $request->session()->regenerateToken();
+
+                $key = $customer->closed_at !== null || $customer->status === 'closed' ? 'auth.account_closed' : 'auth.account_suspended';
+
+                return redirect()->route('login')->withErrors(['email' => __($key)]);
+            }
+        }
+
+        return $next($request);
+    }
+}

app/Http/Middleware/PublicSiteGate.php

@@ -0,0 +1,135 @@
+<?php
+
+namespace App\Http\Middleware;
+
+use App\Support\AdminArea;
+use App\Support\Settings;
+use Closure;
+use Illuminate\Http\Request;
+use Illuminate\Support\Facades\Auth;
+use Symfony\Component\HttpFoundation\Response;
+
+/**
+ * Hides the marketing site and the customer portal while the product is still
+ * being built, without hiding it from us.
+ *
+ * Switched from the console (site.public). Anyone coming through the management
+ * VPN, and any signed-in operator, sees the real thing; everyone else — crawlers
+ * included — gets a placeholder.
+ *
+ * Answers 503 with Retry-After and X-Robots-Tag rather than 200: a 200 would
+ * invite search engines to index the placeholder as the site's content, and
+ * getting that out of an index again is much harder than keeping it out.
+ */
+class PublicSiteGate
+{
+    /**
+     * Paths that must keep working regardless: the console itself (otherwise the
+     * switch could not be flipped back), Stripe's webhook, and the health check.
+     *
+     * Livewire is deliberately NOT in this list. Its endpoint is shared by the
+     * console and the portal, so exempting it would leave a signed-in customer
+     * able to drive portal components — including billing — while the portal is
+     * supposed to be offline. Operators pass the check below anyway, which is
+     * what the console actually needs.
+     *
+     * Nor is /login, and that has a consequence worth knowing before you hide
+     * the site: /admin sends a guest to /login, which is not the console, so
+     * SIGNING IN while hidden needs the request to come from a trusted range —
+     * the management VPN, or an address put in TRUSTED_RANGES for the initial
+     * setup. Exempting the login flow by hostname instead would mean trusting a
+     * Host header, which the caller chooses, and one forged header would unhide
+     * the entire portal.
+     */
+    private const ALWAYS_ALLOWED = ['webhooks/*', 'up', 'robots.txt'];
+
+    public function handle(Request $request, Closure $next): Response
+    {
+        // The console is exempt wherever it currently lives. This used to be
+        // the literal paths 'admin' and 'admin/*', which stops matching the
+        // moment the console moves to the root of its own hostname — and the
+        // result would be 503 on the sign-in page of the console, which is the
+        // only place the switch can be turned back on. Asking AdminArea keeps
+        // the exemption attached to the console rather than to a path that
+        // happened to be true once.
+        if (AdminArea::isConsole($request) || $request->is(...self::ALWAYS_ALLOWED) || Settings::bool('site.public', true)) {
+            return $next($request);
+        }
+
+        if ($this->isDownload($request)) {
+            return $next($request);
+        }
+
+        if ($this->fromManagementNetwork($request) || $this->isActiveOperator()) {
+            return $next($request);
+        }
+
+        return response()->view('coming-soon', [], 503)->withHeaders([
+            'Retry-After' => 3600,
+            'X-Robots-Tag' => 'noindex, nofollow, noarchive',
+            'Cache-Control' => 'no-store',
+        ]);
+    }
+
+    /**
+     * Die Datei-Domain bleibt erreichbar, auch solange die Website verborgen ist.
+     *
+     * Sonst bricht jede Host-Übernahme, und zwar unsichtbar: ein Server im
+     * Rettungssystem holt das Archiv mit `curl … | tar xz`, bekäme hier die
+     * 503-Platzhalterseite und schöbe sie in `tar`. Der Betreiber sähe einen
+     * Entpackfehler auf einer Maschine, an die er nur noch über die
+     * Anbieterkonsole kommt — und nichts davon deutete auf einen Schalter in
+     * der Konsole hin. Er ist per Definition weder in einem verwalteten Netz
+     * noch angemeldet: das ist ja gerade der Zustand, den er verlassen will.
+     *
+     * Über den ROUTENNAMEN, nicht über den Pfad: die Route existiert nur, wenn
+     * die Domain gebunden hat. Der Docblock oben warnt zu Recht davor, per
+     * Hostname auszunehmen — dort ginge es aber um das gesamte Portal, und ein
+     * gefälschter Host-Header hätte es aufgedeckt. Hier stehen zwei Routen
+     * dahinter: die Rechtsdokumente, die ohnehin öffentlich sind, und das
+     * Archiv, das ohne gültigen Einmal-Code mit 404 antwortet. Wer den Header
+     * fälscht, gewinnt damit nichts, was er nicht auch nach dem Start hätte.
+     */
+    private function isDownload(Request $request): bool
+    {
+        return in_array($request->route()?->getName(), ['bootstrap.archive', 'files.public'], true);
+    }
+
+    /**
+     * Dieselbe Frage wie das Konsolentor, aus derselben Quelle.
+     *
+     * Hier stand eine EIGENE Liste (`admin_access.trusted_ranges`), während
+     * `RestrictConsoleNetwork` das VPN-Subnetz PLUS die Freigabeliste liest,
+     * die der Betreiber in der Konsole pflegt. Zwei Vorstellungen davon, wer
+     * „wir" sind — und wer seine Büroadresse eingetragen hatte, kam auf
+     * `admin.` und auf `www.`/`app.`/`status.` nicht. Er stand also vor der
+     * Baustellenseite seines eigenen Portals und hielt das VPN für kaputt.
+     *
+     * Eine Liste, ein Tor. Wer die Konsole sehen darf, darf die versteckte
+     * Seite auch sehen — das ist dieselbe Person.
+     */
+    private function fromManagementNetwork(Request $request): bool
+    {
+        return RestrictConsoleNetwork::allows((string) $request->ip());
+    }
+
+    /**
+     * Same standard as EnsureAdmin: an active operator holding a console role.
+     * A bare `check()` stays true for a disabled operator's live session —
+     * disabling someone did not sign them out, so it never stopped this gate
+     * from waving them through indefinitely.
+     *
+     * Deliberately checked, not enforced by logging out: this gate only
+     * decides what ONE request sees, and destroying the session would ripple
+     * into whatever else that session is doing (a concurrent console tab,
+     * mid-task) — a much bigger side effect than a visibility check exists to
+     * have. EnsureAdmin sets the precedent: it also 403s a disabled operator
+     * per request without touching their session.
+     */
+    private function isActiveOperator(): bool
+    {
+        $operator = Auth::guard('operator')->user();
+
+        return $operator !== null && $operator->isActive() && $operator->can('console.view');
+    }
+}

app/Http/Middleware/RequireOperatorTwoFactor.php

@@ -0,0 +1,56 @@
+<?php
+
+namespace App\Http\Middleware;
+
+use App\Support\AdminArea;
+use App\Support\Settings;
+use Closure;
+use Illuminate\Http\Request;
+use Illuminate\Support\Facades\Auth;
+use Symfony\Component\HttpFoundation\Response;
+
+/**
+ * Two-factor for operators, when the owner has made it compulsory.
+ *
+ * Off by default. ENROLMENT (admin.two-factor-setup) is exempt, because it is
+ * where the operator sets two-factor up — gating it would leave nobody able
+ * to satisfy the requirement. Nothing else is.
+ *
+ * This used to exempt the whole of admin.settings, on the theory that it was
+ * "the page where two-factor is set up". That component also carries staff
+ * management, site visibility, network restrictions, account changes, and
+ * the two-factor policy switch itself — so an unenrolled operator got
+ * unrestricted access to all of that, not just enrolment (Codex R15, P1b).
+ * Enrolment has its own route and component for exactly this reason: one
+ * page to exempt is one decision, not eight actions each needing to
+ * remember to check.
+ */
+class RequireOperatorTwoFactor
+{
+    public function handle(Request $request, Closure $next): Response
+    {
+        if (! Settings::bool('console.require_2fa', false)) {
+            return $next($request);
+        }
+
+        $operator = Auth::guard('operator')->user();
+
+        if ($operator === null || $operator->two_factor_confirmed_at !== null) {
+            return $next($request);
+        }
+
+        // The two pages that must stay reachable: where two-factor is
+        // enrolled, and signing out. Both through AdminArea::routeIs(), not
+        // a bare $request->routeIs() — a recovery hostname's routes are
+        // named admin.viaN.*, and a bare check matches only the canonical
+        // name, which would leave an unenrolled operator unable to sign out
+        // on exactly the host that exists because the canonical one is not
+        // working.
+        if (AdminArea::routeIs('admin.two-factor-setup') || AdminArea::routeIs('admin.logout')) {
+            return $next($request);
+        }
+
+        return redirect()->route('admin.two-factor-setup')
+            ->with('status', __('admin_settings.two_factor_required'));
+    }
+}

app/Http/Middleware/RestrictAdminHost.php

@@ -0,0 +1,103 @@
+<?php
+
+namespace App\Http\Middleware;
+
+use App\Support\AdminArea;
+use Closure;
+use Illuminate\Http\Request;
+use Symfony\Component\HttpFoundation\Response;
+
+/**
+ * The console answers only on its own hostname — and that hostname answers
+ * only the console.
+ *
+ * Both halves matter. The first keeps the console off the public domains. The
+ * second is what actually separates the two products: binding the console
+ * routes to a hostname does not stop the CUSTOMER routes from answering there
+ * as well, because they are registered without a hostname. Without this,
+ * app.clupilot.com and admin.clupilot.com would still serve each other's pages
+ * wherever the paths did not collide.
+ *
+ * 404 in both directions, never 403: a stranger must not learn that a console
+ * lives here, and an operator on the wrong host should see the same nothing a
+ * stranger does.
+ *
+ * A handful of endpoints are shared by both sides and must answer on either
+ * host — Livewire's own endpoints and the authentication actions. They are
+ * listed explicitly below, because the failure mode of getting that list wrong
+ * is "the console is broken" rather than "the rule is wrong", and a list you
+ * can read is easier to correct than a rule you have to infer.
+ */
+class RestrictAdminHost
+{
+    /**
+     * Endpoints both the console and the portal need, on whichever host the
+     * caller is currently on.
+     *
+     * `login`, `logout` and `two-factor-challenge` used to be here, from when
+     * one sign-in page served both. They are gone: the console has its own at
+     * `admin.login`, and leaving the portal's here is what put a registration
+     * link in front of an operator — with a 404 behind it, because `register`
+     * was never in this list and could not be, since the console has no
+     * registration by design.
+     *
+     * Livewire's component endpoint is guarded separately and more strictly:
+     * the console's own middleware is registered as persistent, so an action
+     * posted to /livewire/update is re-checked against the component's real
+     * route. Letting the path through here does not let anything through there.
+     */
+    private const SHARED = [
+        'livewire/*',
+        'up',
+        // The console's own live-provisioning feed authorizes here (see
+        // routes/channels.php, admin.runs) — a route Laravel registers
+        // without any admin.* name, so isConsoleRoute() alone would not
+        // exempt it, and in exclusive mode it would 404 on the console host
+        // exactly like a stranger's request would.
+        'broadcasting/auth',
+    ];
+
+    public function handle(Request $request, Closure $next): Response
+    {
+        // Not host-bound (development, a fresh checkout): the console keeps its
+        // /admin prefix on any host and nothing is separated. Upgrading must
+        // not lock anyone out of a system that was working.
+        if (! AdminArea::isHostBound()) {
+            return $next($request);
+        }
+
+        $isConsoleRoute = $this->isConsoleRoute($request);
+        $onConsoleHost = AdminArea::covers($request->getHost());
+
+        // The console, reached through a hostname that is not the console's.
+        if ($isConsoleRoute && ! $onConsoleHost) {
+            abort(404);
+        }
+
+        // The portal or the public site, reached through the console's
+        // hostname. Only once exclusivity is switched on: a machine that lists
+        // its own IP in ADMIN_HOSTS so the console is reachable without DNS
+        // still has to serve the portal from that same address.
+        if (AdminArea::isExclusive() && $onConsoleHost && ! $isConsoleRoute && ! $request->is(...self::SHARED)) {
+            abort(404);
+        }
+
+        return $next($request);
+    }
+
+    /**
+     * Console routes are the ones named `admin.*`.
+     *
+     * By name rather than by path: the path is exactly what changes between
+     * host-bound and fallback mode, and a rule written against it would be
+     * wrong in one of them.
+     */
+    private function isConsoleRoute(Request $request): bool
+    {
+        $name = $request->route()?->getName();
+
+        // Covers admin.* and the alternate-host registrations (admin.viaN.*),
+        // which are the same console reached by a recovery hostname.
+        return $name !== null && str_starts_with($name, 'admin.');
+    }
+}

app/Http/Middleware/RestrictConsoleNetwork.php

@@ -0,0 +1,134 @@
+<?php
+
+namespace App\Http\Middleware;
+
+use App\Support\AdminArea;
+use App\Support\Settings;
+use Closure;
+use Illuminate\Http\Request;
+use Symfony\Component\HttpFoundation\IpUtils;
+use Symfony\Component\HttpFoundation\Response;
+
+/**
+ * Who may reach the operator console, by network address.
+ *
+ * RestrictAdminHost answers "under which NAME does the console respond" — and a
+ * Host header is chosen by the caller, so it can never answer "who is asking".
+ * This one can: the client address behind a trusted proxy is not something the
+ * client gets to pick.
+ *
+ * The management VPN always counts. Beyond that the owner keeps a list — an
+ * office line, a home connection — so being away from the VPN does not mean
+ * being locked out. That list lives in the console rather than in a proxy
+ * config file, because the person who needs to change it is the person sitting
+ * in the console.
+ *
+ * 404, never 403: a stranger must not learn that a console lives here.
+ *
+ * This is not a substitute for a firewall. It runs after PHP has started, so it
+ * bounds who can USE the console, not who can make the server work. Where a
+ * network-level ACL is also possible, both belong there.
+ */
+class RestrictConsoleNetwork
+{
+    public function handle(Request $request, Closure $next): Response
+    {
+        // Scoped to the console, wherever the console currently is. Asking
+        // AdminArea rather than testing the path: once the console moves to the
+        // root of its own hostname there is no `/admin` left to match, and a
+        // guard that silently stops matching is worse than no guard.
+        if (! AdminArea::isConsole($request)) {
+            return $next($request);
+        }
+
+        if (! self::isRestricted()) {
+            return $next($request);
+        }
+
+        if (! self::allows((string) $request->ip())) {
+            abort(404);
+        }
+
+        return $next($request);
+    }
+
+    /** Whether the owner has switched the restriction on at all. */
+    public static function isRestricted(): bool
+    {
+        return Settings::bool('console.network_restricted', false);
+    }
+
+    /**
+     * Every network that may reach the console.
+     *
+     * The VPN is always in it and is not removable — it is the one path that
+     * exists independently of whatever the owner has typed into the list, and
+     * without it a bad entry would leave nobody able to fix the entry.
+     *
+     * @return array<int, string>
+     */
+    public static function allowedRanges(): array
+    {
+        $vpn = (array) config('admin_access.trusted_ranges', []);
+        $own = (array) Settings::get('console.allowed_ips', []);
+
+        return array_values(array_unique(array_filter(array_merge(
+            $vpn,
+            array_map('trim', array_map('strval', $own)),
+        ))));
+    }
+
+    public static function allows(string $ip): bool
+    {
+        return self::covers($ip, self::allowedRanges());
+    }
+
+    /**
+     * Would this address still get in, given that list?
+     *
+     * Split out so the "you are about to lock yourself out" decision can be
+     * made — and tested — without a request: it is the one check whose failure
+     * mode is that nobody can reach the page that would fix it.
+     *
+     * @param  array<int, string>  $extra  the owner's list AFTER the change
+     */
+    public static function wouldStillAllow(string $ip, array $extra): bool
+    {
+        $vpn = (array) config('admin_access.trusted_ranges', []);
+
+        return self::covers($ip, array_merge($vpn, $extra));
+    }
+
+    /**
+     * Whether a value is an address or a CIDR range at all.
+     *
+     * Shared by the console and the recovery command on purpose: an entry that
+     * matches nothing is stored happily and reports success, and the operator
+     * then switches the restriction on believing they are covered. That is the
+     * exact situation the recovery command exists to get out of.
+     */
+    public static function isNetwork(string $value): bool
+    {
+        [$address, $prefix] = array_pad(explode('/', $value, 2), 2, null);
+
+        if (filter_var($address, FILTER_VALIDATE_IP) === false) {
+            return false;
+        }
+
+        if ($prefix === null) {
+            return true;
+        }
+
+        $max = str_contains((string) $address, ':') ? 128 : 32;
+
+        return ctype_digit((string) $prefix) && (int) $prefix >= 0 && (int) $prefix <= $max;
+    }
+
+    /** @param array<int, string> $ranges */
+    private static function covers(string $ip, array $ranges): bool
+    {
+        $ranges = array_values(array_filter($ranges));
+
+        return $ranges !== [] && $ip !== '' && IpUtils::checkIp($ip, $ranges);
+    }
+}

app/Http/Middleware/TouchLoginSession.php

@@ -0,0 +1,74 @@
+<?php
+
+namespace App\Http\Middleware;
+
+use App\Models\LoginSession;
+use Closure;
+use Illuminate\Http\Request;
+use Illuminate\Support\Facades\DB;
+use Symfony\Component\HttpFoundation\Response;
+
+/**
+ * Keeps a session row pointing at the session it describes.
+ *
+ * Laravel rotates the session id on every sign-in and on every regenerate().
+ * A row that stored the id once stops matching within a request or two — and
+ * the list would then show sessions that cannot be ended and hide the one the
+ * reader is sitting in. The uuid inside the payload is what survives; the id is
+ * refreshed from it here.
+ *
+ * Also the only thing that keeps "last seen" honest. Without it the list
+ * reports the moment somebody signed in, which for a browser left open for a
+ * fortnight is the least useful timestamp available.
+ *
+ * Written at most once a minute. This runs on every authenticated request, and
+ * a write per request would turn a page of thumbnails into forty updates of the
+ * same row.
+ */
+class TouchLoginSession
+{
+    private const THROTTLE_SECONDS = 60;
+
+    public function handle(Request $request, Closure $next): Response
+    {
+        $response = $next($request);
+
+        if (! $request->hasSession()) {
+            return $response;
+        }
+
+        $uuid = $request->session()->get(LoginSession::KEY);
+
+        if (! is_string($uuid) || $uuid === '') {
+            return $response;
+        }
+
+        $current = $request->session()->getId();
+
+        // A bare update rather than a model round-trip: this is on the path of
+        // every authenticated request, and the row is not needed, only moved.
+        DB::table('login_sessions')
+            ->where('uuid', $uuid)
+            ->where(function ($q) use ($current) {
+                // A CHANGED id is never throttled. Both sign-in paths raise the
+                // Login event before calling session()->regenerate(), so the row
+                // is written against an id that is dead a moment later. Held
+                // back by the throttle, the row would point at nothing for the
+                // first minute of every session — the one it describes missing
+                // from the list, and "end this one" deleting a session that no
+                // longer exists.
+                $q->where('session_id', '!=', $current)
+                    ->orWhereNull('session_id')
+                    ->orWhereNull('last_seen_at')
+                    ->orWhere('last_seen_at', '<=', now()->subSeconds(self::THROTTLE_SECONDS));
+            })
+            ->update([
+                'session_id' => $current,
+                'ip_address' => $request->ip(),
+                'last_seen_at' => now(),
+                'updated_at' => now(),
+            ]);
+
+        return $response;
+    }
+}

app/Jobs/ArchiveInvoice.php

@@ -0,0 +1,70 @@
+<?php
+
+namespace App\Jobs;
+
+use App\Models\ExportTarget;
+use App\Models\Invoice;
+use App\Models\InvoiceExport;
+use App\Services\Billing\InvoiceArchive;
+use Illuminate\Contracts\Queue\ShouldQueue;
+use Illuminate\Foundation\Queue\Queueable;
+use Throwable;
+
+/**
+ * Put one invoice on ONE destination, and keep trying if that one is away.
+ *
+ * One job per pair rather than one per invoice: the reason for having a second
+ * destination is that the first can fail, and a job that writes to both would
+ * retry the one that worked every time the other did not — and would report a
+ * single outcome for two different things.
+ *
+ * Queued rather than done during the request that issued the invoice: a network
+ * mount can block for its whole timeout, and an invoice must not fail to be
+ * issued because a NAS in an office is rebooting.
+ */
+class ArchiveInvoice implements ShouldQueue
+{
+    use Queueable;
+
+    public int $tries = 5;
+
+    /** A destination that is gone is usually gone for a while. */
+    public array $backoff = [60, 300, 900, 3600];
+
+    public function __construct(public Invoice $invoice, public ExportTarget $target) {}
+
+    public function handle(InvoiceArchive $archive): void
+    {
+        if (! $this->target->active) {
+            return;
+        }
+
+        $record = InvoiceExport::query()->firstOrNew([
+            'invoice_id' => $this->invoice->id,
+            'export_target_id' => $this->target->id,
+        ]);
+
+        // Already there. A retry after a timeout that in fact succeeded must
+        // not write it a second time.
+        if ($record->exists && $record->exported_at !== null) {
+            return;
+        }
+
+        $record->attempts = (int) $record->attempts + 1;
+        $record->save();
+
+        $archive->store($this->invoice, $this->target);
+
+        $record->forceFill(['exported_at' => now(), 'error' => null])->save();
+    }
+
+    public function failed(?Throwable $e): void
+    {
+        // Against the pair, not the invoice: "on the office NAS, not on the
+        // off-site box" is the thing somebody needs to be told.
+        InvoiceExport::query()->updateOrCreate(
+            ['invoice_id' => $this->invoice->id, 'export_target_id' => $this->target->id],
+            ['error' => mb_substr((string) $e?->getMessage(), 0, 250)],
+        );
+    }
+}

app/Jobs/PacedMail.php

@@ -0,0 +1,132 @@
+<?php
+
+namespace App\Jobs;
+
+use App\Services\Mail\MailLane;
+use App\Support\Settings;
+use Illuminate\Mail\SendQueuedMailable;
+use Illuminate\Queue\Middleware\RateLimited;
+
+/**
+ * Der Auftrag, der eine Mail im Takt ihrer Spur verschickt.
+ *
+ * `SendQueuedMailable` selbst hat keine `middleware()` — nachgezählt im
+ * Framework: handle, backoff, retryUntil, failed, displayName, __clone. Der
+ * eigene Auftrag ist trotzdem nicht der einzige Weg: eine `middleware()` auf
+ * der MAILKLASSE wird sehr wohl gelesen, weil `Mailable::newQueuedJob()` sie
+ * einsammelt und per `->through()` an den Auftrag weiterreicht.
+ *
+ * Der Takt sitzt hier statt im Trait, weil er dann auch für Mailklassen greift,
+ * die den Trait NICHT benutzen (Pakete, Fortify) — und weil er sich mit einer
+ * Mailable-eigenen `middleware()` verträgt, statt sie zu verdrängen: die
+ * Bindung im Container tauscht den Auftrag für jede Mail aus, ohne dass eine
+ * einzige Absendestelle sich ändert.
+ *
+ * Zur Falle mit den Versuchen: der Arbeiter läuft mit --tries=3, und eine
+ * gedrosselte Rückstellung zählt als Versuch. Deshalb `retryUntil()` statt
+ * eines Versuchszählers — aber nur dort, wo wirklich gedrosselt wird.
+ */
+class PacedMail extends SendQueuedMailable
+{
+    /** @return array<int, object> */
+    public function middleware(): array
+    {
+        $spur = $this->gedrosselteSpur();
+
+        return $spur === null ? [] : [new RateLimited($spur)];
+    }
+
+    /**
+     * Sechs Stunden statt eines Versuchszählers — auf den gedrosselten Spuren.
+     *
+     * Der Arbeiter prüft `retryUntil` VOR `--tries`: liegt sie in der Zukunft,
+     * steigt er aus, bevor er `attempts()` gegen die Versuchszahl hält. Genau
+     * das wird hier gebraucht, denn ein Zähler könnte nicht zwischen „dreimal
+     * zurückgelegt" und „dreimal gescheitert" unterscheiden — die Rechnung, die
+     * am Abend an der Drossel ansteht, wäre nach dem dritten Mal endgültig
+     * gescheitert statt verschickt.
+     *
+     * Und genau deshalb hängt die Grenze an derselben Bedingung wie die
+     * Drossel. Ein Zeitfenster hebelt `--tries` nicht bloß für Rückstellungen
+     * aus, sondern GANZ: `Worker::markJobAsFailedIfWillExceedMaxAttempts`
+     * prüft die Versuchszahl ausdrücklich nur `if (! $job->retryUntil())`. Wo
+     * nie gedrosselt wird — Direktspur, Notschalter aus —, gibt es keine
+     * Rückstellungen abzufangen, wohl aber eine Mail, die aus echtem Grund
+     * wirft: die würde sechs Stunden lang wiederholt statt nach drei Versuchen
+     * abgelegt. Ohne Pause obendrein, weil der Arbeiter ohne `--backoff` läuft
+     * und `Worker::calculateBackoff` dann auf null Sekunden fällt. Ihr Fehler
+     * stünde sechs Stunden lang nicht in `failed_jobs` und wäre für jede
+     * Alarmierung nicht vorhanden; auf der Direktspur zöge der Arbeiter sie
+     * obendrein bei jedem Durchlauf zuerst — sechs Stunden lang keine
+     * Kennwort-Zurücksetzung.
+     *
+     * Sechs Stunden ist weit genug, dass auch ein Lauf über die ganze Nacht
+     * durchkommt, und eng genug, dass eine Mail, die dann noch nicht draußen
+     * ist, nicht am nächsten Tag zwischen den neuen auftaucht.
+     *
+     * Ohne eigene Rückgabeangabe, wie die Elternklasse: die lässt neben einem
+     * Zeitpunkt auch einen Zeitstempel zu (`Queue::getJobExpiration` behandelt
+     * beides), und eine engere Angabe hier zerbräche eine Mailklasse, die von
+     * diesem Spielraum Gebrauch macht.
+     *
+     * @return \DateTimeInterface|int|null
+     */
+    public function retryUntil()
+    {
+        // Die Mailklasse zuerst: die Elternklasse reicht an
+        // `$this->mailable->retryUntil` weiter. Heute deklariert das keine der
+        // vierzehn — aber eine Überschreibung, die nicht zurückfragt, nähme
+        // der nächsten ihre Entscheidung still weg.
+        if (($eigene = parent::retryUntil()) !== null) {
+            return $eigene;
+        }
+
+        return $this->gedrosselteSpur() === null ? null : now()->addHours(6);
+    }
+
+    /**
+     * Die Spur, deren Drossel für diesen Auftrag gilt — oder null.
+     *
+     * Eine Stelle für beide Fragen, weil `middleware()` und `retryUntil()`
+     * sonst auseinanderlaufen könnten. Beide Richtungen tun weh: ein
+     * Zeitfenster ohne Drossel nimmt die Versuchszahl weg, ohne etwas dafür zu
+     * geben, und eine Drossel ohne Zeitfenster ist genau die Falle, um die es
+     * in dieser Aufgabe geht.
+     */
+    private function gedrosselteSpur(): ?string
+    {
+        if (! Settings::bool('mail.pace.enabled', true)) {
+            return null;
+        }
+
+        // Zuerst die Schlange am Mailable: das ist der Name, den
+        // `Mailable::queue()` an `pushOn()` gegeben hat — die Spur, in der
+        // dieser Auftrag TATSÄCHLICH liegt. `MailLane::for(...)` allein wäre
+        // hier falsch, weil es die Einstellungen erst im Arbeiter läse: würde
+        // der Betreiber die Rechnung von ruhig auf wichtig schieben, während
+        // zweihundert davon in der ruhigen Schlange warten, drosselte sie ab
+        // diesem Moment das falsche Kontingent.
+        //
+        // Steht dort nichts, kommt die Mail von auswärts — aus einem Paket,
+        // aus Fortify, aus irgendetwas, das jemand eingebunden hat. Sie kennt
+        // `RidesALane` nicht, hat also keine Spur und liegt auf `default`.
+        // Dann entscheidet `MailLane::for(...)`, und das ist Absicht: Aufgabe 1
+        // lässt eine unbekannte Klasse ausdrücklich in die ruhige Spur fallen,
+        // weil eine zu langsam verschickte Mail ein kleinerer Fehler ist als
+        // ein ungedrosselter Schub, den niemand vorhergesehen hat. Ohne diesen
+        // Rückgriff fiele sie am Auftrag in die Gegenrichtung.
+        //
+        // Schlange und Takt fallen für so eine Mail auseinander — sie bleibt
+        // auf `default` und fährt trotzdem im ruhigen Takt. Das ist kein
+        // Versehen, sondern die Arbeitsteilung: die Schlange wählt der Trait,
+        // den Takt wählt dieser Auftrag, und für eine fremde Mailklasse greift
+        // nur das zweite.
+        $spur = $this->mailable->queue ?? MailLane::for($this->mailable::class);
+
+        return match ($spur) {
+            MailLane::URGENT => MailLane::URGENT,
+            MailLane::CALM => MailLane::CALM,
+            default => null,
+        };
+    }
+}

app/Jobs/RunCatalogueSync.php

@@ -0,0 +1,73 @@
+<?php
+
+namespace App\Jobs;
+
+use App\Services\Billing\CatalogueSyncStatus;
+use Illuminate\Contracts\Queue\ShouldQueue;
+use Illuminate\Foundation\Queue\Queueable;
+use Illuminate\Support\Facades\Artisan;
+use Throwable;
+
+/**
+ * Run `stripe:sync-catalogue` from the console, on the queue.
+ *
+ * Queued rather than done inside the Livewire call that asked for it: the
+ * command talks to Stripe, creates a Product per plan family and a Price per
+ * priced row on both tax treatments, and a first run on a full catalogue is
+ * seconds to minutes of network. A synchronous button would hold the request
+ * open for all of it and hand the operator a gateway timeout for an answer,
+ * with the run still going somewhere behind it.
+ *
+ * No agent, unlike UpdateChannel's requests: this needs nothing root can do and
+ * nothing outside the container. It is an artisan command this very application
+ * already ships, run by this very application's worker.
+ *
+ * NOT retried. Every other job here backs off and tries again; this one must
+ * not. The command is idempotent about Stripe objects, but a re-run after a
+ * failure would overwrite the recorded output with a second attempt's — and
+ * the output is the whole point: the refusal that names three columns to clear
+ * would be replaced by whatever the retry happened to say. An operator pressing
+ * the button again is the retry, and they will have read the first answer.
+ */
+class RunCatalogueSync implements ShouldQueue
+{
+    use Queueable;
+
+    public int $tries = 1;
+
+    public function __construct(
+        public bool $dryRun,
+        public string $by,
+    ) {}
+
+    public function handle(): void
+    {
+        $status = app(CatalogueSyncStatus::class);
+
+        try {
+            $exit = Artisan::call('stripe:sync-catalogue', $this->dryRun ? ['--dry-run' => true] : []);
+            $output = Artisan::output();
+        } catch (Throwable $e) {
+            // A throw is an outcome too, and it has to reach the page. Left
+            // uncaught this would be a failed job in a table nobody on this
+            // page can see, under a "sync running" note that never resolves.
+            $status->record(
+                ok: false,
+                dryRun: $this->dryRun,
+                output: $e->getMessage(),
+                by: $this->by,
+            );
+
+            return;
+        }
+
+        $status->record(
+            ok: $exit === 0,
+            dryRun: $this->dryRun,
+            // Whole and unedited — see CatalogueSyncStatus. The command's own
+            // refusals are instructions, not statuses.
+            output: trim($output),
+            by: $this->by,
+        );
+    }
+}

app/Listeners/RecordSentMail.php

@@ -0,0 +1,89 @@
+<?php
+
+namespace App\Listeners;
+
+use App\Models\Customer;
+use App\Models\SentMail;
+use Illuminate\Mail\Events\MessageSent;
+use Illuminate\Support\Facades\Log;
+use Throwable;
+
+/**
+ * Write every outgoing mail into the register.
+ *
+ * On MessageSent rather than MessageSending: a row here means the transport
+ * accepted the message. Recording the intention instead would fill the register
+ * with mails that never left, which is worse than no register — an operator
+ * would show a customer a line proving something was sent that was not.
+ *
+ * One listener for every mailable in the application, rather than a call in
+ * each of them. A register that has to be remembered at each call site is a
+ * register with holes in it, and the holes are exactly the mails nobody thought
+ * about.
+ */
+class RecordSentMail
+{
+    /**
+     * Mails that are not worth a row.
+     *
+     * The verification and reset mails go to an address that has not been
+     * confirmed to belong to anybody yet, and both are sent in bulk by anyone
+     * who can type an address into a form. Recording them would let a stranger
+     * write lines into the operator's register at will.
+     */
+    private const IGNORED = [
+        \App\Mail\VerifyEmailMail::class,
+        \App\Mail\ResetPasswordMail::class,
+    ];
+
+    public function handle(MessageSent $event): void
+    {
+        try {
+            $this->record($event);
+        } catch (Throwable $e) {
+            // A register that cannot be written must never be the reason a mail
+            // fails. The send already happened by the time this runs, and
+            // throwing here would turn a delivered message into a failed job
+            // that gets delivered a second time on retry.
+            Log::error('Could not record a sent mail', ['exception' => $e]);
+        }
+    }
+
+    private function record(MessageSent $event): void
+    {
+        $mailable = $event->data['__laravel_mailable'] ?? null;
+
+        if ($mailable !== null && in_array($mailable, self::IGNORED, true)) {
+            return;
+        }
+
+        $message = $event->message;
+        $to = collect($message->getTo())->map(fn ($address) => $address->getAddress())->all();
+
+        if ($to === []) {
+            return;
+        }
+
+        // One row per recipient. A mail to three addresses is three deliveries,
+        // and an operator asking "what did this customer get" must not have to
+        // read someone else's row to find out.
+        foreach ($to as $address) {
+            SentMail::create([
+                'customer_id' => $this->customerFor($address)?->id,
+                'to' => $address,
+                'subject' => (string) $message->getSubject(),
+                'mailable' => $mailable,
+                // Set by the console when an operator writes one themselves;
+                // see Admin\CustomerMessage, which fills the body in afterwards.
+                'from_operator' => false,
+                'sent_at' => now(),
+            ]);
+        }
+    }
+
+    /** Whose mail this was, where the address belongs to somebody we know. */
+    private function customerFor(string $address): ?Customer
+    {
+        return Customer::query()->where('email', $address)->first();
+    }
+}

app/Listeners/RecordSignInDevice.php

@@ -0,0 +1,67 @@
+<?php
+
+namespace App\Listeners;
+
+use App\Mail\NewDeviceSignInMail;
+use App\Services\Devices\DeviceRecognition;
+use Illuminate\Auth\Events\Login;
+use Illuminate\Http\Request;
+use Illuminate\Support\Facades\Log;
+use Illuminate\Support\Facades\Mail;
+use Throwable;
+
+/**
+ * One listener for both ways in.
+ *
+ * The console signs in through App\Livewire\Auth\OperatorLogin and the portal
+ * through Fortify — two code paths that share nothing. Both raise Laravel's
+ * Login event, and it carries the guard, which is the one thing that tells
+ * operators and customers apart (R21). Hooking the event rather than the two
+ * controllers means neither can be changed in a way that quietly stops
+ * recording sign-ins.
+ *
+ * Nothing here may prevent a sign-in. Recognising a device is a safeguard, and
+ * a safeguard that locks the owner out when it breaks has stopped being one —
+ * so a failure is logged and swallowed. This is a deliberate exception to
+ * failing loudly, and the reason is written here so nobody removes it as an
+ * oversight.
+ */
+class RecordSignInDevice
+{
+    public function __construct(
+        private readonly DeviceRecognition $devices,
+        private readonly Request $request,
+    ) {}
+
+    public function handle(Login $event): void
+    {
+        try {
+            $outcome = $this->devices->recognise($event->user, $event->guard, $this->request);
+            $this->devices->attachSession($outcome->device, $this->request);
+
+            if (! $outcome->shouldWarn) {
+                return;
+            }
+
+            $address = $event->user->getAttribute('email');
+
+            if (! is_string($address) || $address === '') {
+                return;
+            }
+
+            // Queued: a sign-in must not wait on a mail server, and this one
+            // runs while somebody is looking at a spinner on the login button.
+            $mail = new NewDeviceSignInMail(
+                name: (string) ($event->user->getAttribute('name') ?? ''),
+                device: $outcome->device,
+                guard: $event->guard,
+            );
+            Mail::mailer($mail->mailer)->to($address)->queue($mail);
+        } catch (Throwable $e) {
+            Log::warning('Could not record the device for a sign-in', [
+                'guard' => $event->guard,
+                'exception' => $e->getMessage(),
+            ]);
+        }
+    }
+}

app/Livewire/Admin/Capacity.php

@@ -0,0 +1,151 @@
+<?php
+
+namespace App\Livewire\Admin;
+
+use App\Models\Host;
+use App\Services\Provisioning\HostCapacity;
+use App\Services\Provisioning\ServerMarket;
+use Livewire\Attributes\Layout;
+use Livewire\Component;
+
+/**
+ * Who is waiting for a machine, and what machine would clear them.
+ *
+ * A paid order that cannot be placed is parked rather than failed — the
+ * customer has paid, and "no host has room" is a purchasing decision, not a
+ * fault. This is where that decision is taken: what is queued, what the
+ * roomiest host still has, what the queue needs, and what such a machine costs
+ * today.
+ *
+ * Nothing here buys anything. Ordering a server is a contract; a bug in a
+ * capacity calculation must not be able to sign one.
+ */
+#[Layout('layouts.admin')]
+class Capacity extends Component
+{
+    /**
+     * Look again now.
+     *
+     * The runner retries every couple of minutes on its own. This is for the
+     * operator who has just finished onboarding a host and does not want to
+     * wait for the tick to see the queue drain.
+     */
+    public function recheck(): void
+    {
+        $this->authorize('hosts.manage');
+
+        // Through the same query that FINDS them, so "look again" can never
+        // mean a different set of runs than the table above it is showing.
+        app(HostCapacity::class)->parkedRuns()->update(['next_attempt_at' => now()]);
+
+        $this->dispatch('notify', message: __('capacity.rechecked'));
+    }
+
+    /**
+     * Decide which parked order goes on which host.
+     *
+     * The queue is read by somebody who knows things the placement rule does
+     * not — that this customer belongs beside that one, that a machine is about
+     * to be taken out of service, that the big order should have the new box
+     * and the small ones can share. The rule stays in charge when nobody says
+     * otherwise; an empty choice hands it back.
+     *
+     * Only the preference is written. The reservation still happens in the
+     * provisioning step, under the placement lock, and still checks the host
+     * has room — a console that created the instance itself would be a second
+     * placement path with no lock and its own arithmetic.
+     */
+    public function pin(int $runId, string $hostId): void
+    {
+        $this->authorize('hosts.manage');
+
+        // Only a run that is actually parked. Writing a host preference onto a
+        // run that has moved on would sit in its context for ever and take
+        // effect on a re-run months later, on a host chosen for a queue that no
+        // longer exists.
+        $run = app(HostCapacity::class)->parkedRuns()->whereKey($runId)->first();
+
+        if ($run === null) {
+            return;
+        }
+
+        if ($hostId === '') {
+            $run->forgetContext('preferred_host_id');
+            $this->dispatch('notify', message: __('capacity.pin_cleared'));
+
+            return;
+        }
+
+        // Nur ein Host, auf dem diese Bestellung auch landen dürfte:
+        // unreserviert oder ihrem eigenen Kunden reserviert, über denselben
+        // Scope, den die Platzierung im Schritt benutzt. Eine reservierte
+        // Maschine gehört ihrem Kunden — sie hier anheften zu lassen hieße, die
+        // Zusage über die Konsole wieder aufzumachen, und der Schritt lehnte
+        // die Bestellung danach ohnehin ab.
+        $host = Host::query()
+            ->where('status', 'active')
+            ->unreserved($run->subject?->customer_id)
+            ->find((int) $hostId);
+
+        if ($host === null) {
+            return;
+        }
+
+        $run->mergeContext(['preferred_host_id' => $host->id]);
+        // Taken up now rather than at the next tick: an operator who has just
+        // said where it goes is watching for it to go there.
+        $run->forceFill(['next_attempt_at' => now()])->save();
+
+        $this->dispatch('notify', message: __('capacity.pinned', ['host' => $host->name]));
+    }
+
+    public function render()
+    {
+        $this->authorize('hosts.manage');
+
+        $capacity = app(HostCapacity::class);
+        $demand = $capacity->queueDemand();
+        $parked = $capacity->parked();
+
+        // Die Auswahl je Bestellung, nicht eine Liste für alle: welcher Host in
+        // Frage kommt, hängt am Kunden dieser Bestellung. Gefragt wird über
+        // denselben Scope wie in der Platzierung — im eigenen Rechenzentrum
+        // (der Schritt lehnt einen Pin von anderswo ab) und nicht jemand
+        // anderem reserviert. Ein Auswahlfeld, das anbietet, was die Aktion
+        // danach ablehnt, ist eine Falle.
+        //
+        // Eine Abfrage je Rechenzentrum/Kunde-Paar statt je Zeile: die
+        // Warteschlange ist die Liste bezahlter Bestellungen ohne Maschine, also
+        // kurz, und mehrere davon gehören meist demselben Rechenzentrum.
+        $choices = [];
+
+        foreach ($parked as $index => $entry) {
+            $customerId = $entry['order']->customer_id;
+            $key = $entry['datacenter'].'|'.$customerId;
+
+            $choices[$key] ??= Host::query()
+                ->where('status', 'active')
+                ->where('datacenter', $entry['datacenter'])
+                ->unreserved($customerId)
+                ->orderBy('name')
+                ->get();
+
+            $parked[$index]['choices'] = $choices[$key];
+        }
+
+        return view('livewire.admin.capacity', [
+            'parked' => $parked,
+            'demand' => $demand,
+            'unplaceable' => $capacity->unplaceablePlans(),
+            // reservedFor eager-loaded: die Tafel "was die Hosts noch
+            // aufnehmen" weist eine reservierte Maschine als solche aus,
+            // statt sie kommentarlos neben dem allgemeinen Bestand zu zeigen.
+            'hosts' => Host::query()->where('status', 'active')->orderBy('name')->with('reservedFor')->get(),
+            // Only when something is actually waiting. A shopping list on an
+            // idle estate is an invitation to spend money for no reason.
+            'offers' => $demand['count'] > 0
+                ? app(ServerMarket::class)->offers($demand['largest'])
+                : [],
+        ]);
+    }
+}

app/Livewire/Admin/CheckResult.php

@@ -0,0 +1,49 @@
+<?php
+
+namespace App\Livewire\Admin;
+
+use App\Services\Secrets\SecretVault;
+use LivewireUI\Modal\ModalComponent;
+
+/**
+ * Die Antwort einer Verbindungsprüfung, als Modal.
+ *
+ * Vorher stand sie am Seitenende, hinter allen Karten und hinter dem
+ * Speichern-Knopf. Der Testknopf sitzt oben in der Karte; wer ihn drückte, sah
+ * gar nichts, weil die Antwort ausserhalb des Bildschirms erschien. Gemeldet
+ * wurde das zweimal — erst als „der Knopf tut nichts", dann als „runterscrollen
+ * tut niemand, wenn man es nicht weiss".
+ *
+ * Das Ergebnis wird als Argument hereingereicht, nicht hier neu erhoben. Zwei
+ * Gründe: die Prüfung läuft gegen den EINGETIPPTEN, noch nicht gespeicherten
+ * Wert, den dieses Modal nicht sieht — und DnsTokenCheck schreibt bei jedem
+ * Lauf einen Probeeintrag in die echte Zone. Ein Modal, das beim Öffnen prüft,
+ * legte bei jedem Blick einen neuen an.
+ *
+ * Durch den Browser gereicht zu werden ist hier unbedenklich: das Ergebnis
+ * trägt Kontoname, Betriebsmodus und die Webhook-Liste — keinen Schlüssel.
+ */
+class CheckResult extends ModalComponent
+{
+    public string $entryKey = '';
+
+    /** @var array<string, mixed> */
+    public array $result = [];
+
+    /** @param  array<string, mixed>  $result */
+    public function mount(string $entryKey, array $result): void
+    {
+        $this->authorize('secrets.manage');
+        abort_if(! array_key_exists($entryKey, SecretVault::REGISTRY), 404);
+
+        $this->entryKey = $entryKey;
+        $this->result = $result;
+    }
+
+    public function render()
+    {
+        return view('livewire.admin.check-result', [
+            'label' => __(SecretVault::REGISTRY[$this->entryKey]['label']),
+        ]);
+    }
+}

app/Livewire/Admin/CloseDunningCase.php

@@ -0,0 +1,49 @@
+<?php
+
+namespace App\Livewire\Admin;
+
+use App\Models\DunningCase;
+use LivewireUI\Modal\ModalComponent;
+
+/**
+ * Ein Eingriff von Hand in einen laufenden Mahnfall (R20: Eingabefeld, also
+ * Modal).
+ *
+ * Mutiert nichts selbst (R23) — der Bestätigen-Knopf löst ein Ereignis aus,
+ * das Admin\PaymentProblems auffängt. Die Berechtigungsprüfung bleibt damit an
+ * der einen Stelle, an der sie schon stand; hier wird sie zusätzlich gestellt,
+ * weil ein Modal ohne die Route-Middleware der Seite erreichbar ist.
+ */
+class CloseDunningCase extends ModalComponent
+{
+    public int $id;
+
+    public string $note = '';
+
+    public int|string $days = 7;
+
+    public string $label = '';
+
+    public function mount(int $id): void
+    {
+        $this->authorize('billing.manage');
+
+        $case = DunningCase::query()->with('subscription.customer')->findOr($id, fn () => abort(404));
+
+        $this->id = $case->id;
+        $this->label = $case->subscription?->customer?->name ?? '—';
+    }
+
+    public function confirm(): void
+    {
+        $this->authorize('billing.manage');
+
+        $this->dispatch('dunning-case-closed', id: $this->id, days: (int) $this->days, note: $this->note);
+        $this->closeModal();
+    }
+
+    public function render()
+    {
+        return view('livewire.admin.close-dunning-case');
+    }
+}

app/Livewire/Admin/ConfirmDeleteDatacenter.php

@@ -0,0 +1,60 @@
+<?php
+
+namespace App\Livewire\Admin;
+
+use App\Models\Datacenter;
+use App\Models\Host;
+use Illuminate\Database\QueryException;
+use LivewireUI\Modal\ModalComponent;
+
+/**
+ * Confirmation for deleting a datacenter (R5). Guarded: a datacenter that still
+ * has hosts cannot be deleted — it would orphan host placement — so the modal
+ * blocks and explains instead. Otherwise it is safe to hard-delete an unused code.
+ */
+class ConfirmDeleteDatacenter extends ModalComponent
+{
+    public string $uuid;
+
+    public string $name = '';
+
+    public int $hostCount = 0;
+
+    public function mount(string $uuid): void
+    {
+        $this->authorize('datacenters.manage'); // modals are reachable without the route middleware
+        $dc = Datacenter::query()->where('uuid', $uuid)->withCount('hosts')->firstOrFail();
+        $this->uuid = $uuid;
+        $this->name = $dc->name;
+        $this->hostCount = $dc->hosts_count;
+    }
+
+    public function delete()
+    {
+        $this->authorize('datacenters.manage');
+        $dc = Datacenter::query()->where('uuid', $this->uuid)->first();
+        if ($dc === null) {
+            return $this->redirectRoute('admin.datacenters', navigate: true);
+        }
+
+        // The hosts.datacenter → datacenters.code foreign key (restrictOnDelete)
+        // is the source of truth: the DB refuses to orphan a host. We pre-check
+        // for a friendly message and catch the constraint as the race backstop.
+        if (Host::query()->where('datacenter', $dc->code)->exists()) {
+            return $this->redirectRoute('admin.datacenters', navigate: true);
+        }
+
+        try {
+            $dc->delete();
+        } catch (QueryException) {
+            // A host was created for this code concurrently — leave it intact.
+        }
+
+        return $this->redirectRoute('admin.datacenters', navigate: true);
+    }
+
+    public function render()
+    {
+        return view('livewire.admin.confirm-delete-datacenter');
+    }
+}

app/Livewire/Admin/ConfirmDeleteIncident.php

@@ -0,0 +1,40 @@
+<?php
+
+namespace App\Livewire\Admin;
+
+use App\Models\Incident;
+use LivewireUI\Modal\ModalComponent;
+
+/**
+ * "Really remove this incident?"
+ *
+ * In the product's own dialog, not the browser's (R23). The modal mutates
+ * nothing itself: it dispatches, and Admin\Incidents — which already holds the
+ * capability check — does the work. Duplicating the authorisation here would
+ * mean two places to keep right.
+ */
+class ConfirmDeleteIncident extends ModalComponent
+{
+    public string $uuid = '';
+
+    public string $title = '';
+
+    public function mount(string $uuid): void
+    {
+        $incident = Incident::query()->where('uuid', $uuid)->firstOrFail();
+
+        $this->uuid = $incident->uuid;
+        $this->title = $incident->title;
+    }
+
+    public function confirm(): void
+    {
+        $this->dispatch('incident-delete-confirmed', uuid: $this->uuid);
+        $this->closeModal();
+    }
+
+    public function render()
+    {
+        return view('livewire.admin.confirm-delete-incident');
+    }
+}

app/Livewire/Admin/ConfirmDeletePlanDraft.php

@@ -0,0 +1,60 @@
+<?php
+
+namespace App\Livewire\Admin;
+
+use App\Models\PlanVersion;
+use App\Services\Billing\PlanCatalogue;
+use LivewireUI\Modal\ModalComponent;
+
+/**
+ * Confirmation for discarding an unpublished plan version.
+ *
+ * Only a draft can be discarded at all — a published version is what customers
+ * are contracted to, and the model refuses to delete one. So this is a small
+ * destructive action, and the modal says which one it is rather than leaving
+ * "delete" next to a row that might be either.
+ */
+class ConfirmDeletePlanDraft extends ModalComponent
+{
+    public string $uuid;
+
+    public int $version;
+
+    public string $plan = '';
+
+    public function mount(string $uuid): void
+    {
+        // Modals are reachable without the page's guards, so this is the real
+        // check, not a convenience one.
+        $this->authorize('plans.manage');
+
+        $version = PlanVersion::query()->with('family')->where('uuid', $uuid)->firstOrFail();
+        abort_if($version->isPublished(), 403);
+
+        $this->uuid = $uuid;
+        $this->version = $version->version;
+        $this->plan = $version->family->name;
+    }
+
+    public function delete(): void
+    {
+        $this->authorize('plans.manage');
+
+        $version = PlanVersion::query()->where('uuid', $this->uuid)->first();
+
+        // The catalogue decides, in one conditional statement. Checking here and
+        // deleting afterwards would leave a window in which the version is
+        // published between the two — and a published version must never go.
+        if ($version !== null && ! app(PlanCatalogue::class)->discardDraft($version)) {
+            $this->dispatch('notify', message: __('plans.discard_too_late'));
+        }
+
+        $this->dispatch('plan-draft-deleted');
+        $this->closeModal();
+    }
+
+    public function render()
+    {
+        return view('livewire.admin.confirm-delete-plan-draft');
+    }
+}

app/Livewire/Admin/ConfirmDeleteVpnPeer.php

@@ -0,0 +1,58 @@
+<?php
+
+namespace App\Livewire\Admin;
+
+use App\Models\VpnPeer;
+use App\Provisioning\Jobs\ApplyVpnPeer;
+use LivewireUI\Modal\ModalComponent;
+
+/**
+ * Confirmation for revoking a VPN access for good (R5). Deleting a peer that
+ * belongs to a host cuts CluPilot's own management path to that machine, so the
+ * modal says so plainly rather than hiding the option.
+ */
+class ConfirmDeleteVpnPeer extends ModalComponent
+{
+    public string $uuid;
+
+    public string $name = '';
+
+    public ?string $hostName = null;
+
+    public function mount(string $uuid): void
+    {
+        // Modals are reachable without the route middleware, so this is the
+        // real guard, not a convenience check.
+        $peer = VpnPeer::query()->with('host')->where('uuid', $uuid)->firstOrFail();
+        $this->authorize('delete', $peer);
+        $this->uuid = $uuid;
+        $this->name = $peer->name;
+        $this->hostName = $peer->host?->name;
+    }
+
+    public function delete(): void
+    {
+        $peer = VpnPeer::query()->where('uuid', $this->uuid)->first();
+        if ($peer !== null) {
+            $this->authorize('delete', $peer);
+
+            // A tombstone that still carries a usable private key is a liability.
+            $peer->purgeSecret();
+            // Soft-delete, so the row survives as a tombstone until the hub has
+            // actually dropped the peer. A hard delete here would let the next
+            // sync adopt the still-present peer back as a live access —
+            // silently restoring what was just revoked. ApplyVpnPeer purges the
+            // tombstone once removal succeeded; SyncVpnPeers retries if not.
+            $peer->delete();
+            ApplyVpnPeer::dispatch($peer->public_key, null, false);
+        }
+
+        $this->dispatch('vpn-peer-deleted');
+        $this->closeModal();
+    }
+
+    public function render()
+    {
+        return view('livewire.admin.confirm-delete-vpn-peer');
+    }
+}

app/Livewire/Admin/ConfirmDisableTwoFactor.php

@@ -0,0 +1,24 @@
+<?php
+
+namespace App\Livewire\Admin;
+
+use LivewireUI\Modal\ModalComponent;
+
+/**
+ * Confirmation before an operator's own two-factor login is removed (R23).
+ * No mutation here — TwoFactorSetup::disableTwoFactor() still runs its own
+ * requireConfirmedPassword() check, unchanged.
+ */
+class ConfirmDisableTwoFactor extends ModalComponent
+{
+    public function confirm(): void
+    {
+        $this->dispatch('two-factor-disable-confirmed');
+        $this->closeModal();
+    }
+
+    public function render()
+    {
+        return view('livewire.admin.confirm-disable-two-factor');
+    }
+}

app/Livewire/Admin/ConfirmEndOtherSessions.php

@@ -0,0 +1,24 @@
+<?php
+
+namespace App\Livewire\Admin;
+
+use LivewireUI\Modal\ModalComponent;
+
+/**
+ * Confirmation before an operator signs every other browser out (R23). The
+ * console's own, because operators and customers are two identities (R21) and
+ * one shared modal would raise an event both sides listen for.
+ */
+class ConfirmEndOtherSessions extends ModalComponent
+{
+    public function confirm(): void
+    {
+        $this->dispatch('sessions-end-others-confirmed');
+        $this->closeModal();
+    }
+
+    public function render()
+    {
+        return view('livewire.admin.confirm-end-other-sessions');
+    }
+}

app/Livewire/Admin/ConfirmForgetSecret.php

@@ -0,0 +1,39 @@
+<?php
+
+namespace App\Livewire\Admin;
+
+use App\Services\Secrets\SecretVault;
+use LivewireUI\Modal\ModalComponent;
+
+/**
+ * Confirmation before a stored override is removed (R23), reverting the key
+ * to whatever the server file provides. No mutation here — it dispatches
+ * back to Secrets, whose forget() is unchanged.
+ */
+class ConfirmForgetSecret extends ModalComponent
+{
+    public string $key;
+
+    public string $label = '';
+
+    public function mount(string $key): void
+    {
+        $this->authorize('secrets.manage');
+        abort_if(! array_key_exists($key, SecretVault::REGISTRY), 404);
+
+        $this->key = $key;
+        $this->label = __(SecretVault::REGISTRY[$key]['label']);
+    }
+
+    public function confirm(): void
+    {
+        $this->authorize('secrets.manage');
+        $this->dispatch('secret-forget-confirmed', key: $this->key);
+        $this->closeModal();
+    }
+
+    public function render()
+    {
+        return view('livewire.admin.confirm-forget-secret');
+    }
+}