Demo follow-ups: editable policy name, one-page signup, group classes in upcoming lessons, deletion cleanup

Five items from the latest demo pass:

- A policy's title can be edited from the Policies screen. Only the title
  moves; the slug is what the gates resolve policies by, so a rename can
  never detach a policy from acceptances already recorded against it.
- Signup is one page again. The studio's registration questions move from
  a second step behind "Next" onto the main form, in an "About you" panel
  above the students being added, and that panel also asks an adult
  student for their birth year (the same us_birth_year meta a child's
  uses). register.js disables and hides the whole panel for a pure
  guardian, since the questions describe a student.
- The password is re-scored on submit, not only as it is typed. zxcvbn's
  dictionary arrives after page load, so a password typed straight away
  was never scored at all and the first the student heard of it was the
  server rejecting the whole form.
- Group-class sessions appear alongside lessons wherever upcoming lessons
  are listed: the [us_scheduler] panel (students and instructors) and the
  admin student detail page. GroupClass\SessionSchedule derives them from
  Offering::sessionWindows(), the same derivation the billing scan uses.
  They carry kind = 'group_class' and no Cancel action - a session is one
  date in a term, not a booked slot.
- Deleting a user releases what the account was holding: each upcoming
  lesson is cancelled, its slot freed for rebooking, its pending payment
  voided, and active class enrolments cancelled. Past lessons and paid
  history are left alone.

Tests: composer test (851), composer lint, composer cs all pass.

Co-Authored-By: Claude Opus 5 <[email protected]>

tests/Unit/Auth/DeletedUserCleanupTest.php

@@ -0,0 +1,137 @@
+<?php
+declare(strict_types=1);
+
+namespace Unsupervised\Schedular\Tests\Unit\Auth;
+
+use Brain\Monkey\Actions;
+use Mockery;
+use Unsupervised\Schedular\Auth\DeletedUserCleanup;
+use Unsupervised\Schedular\Availability\AvailabilityRepository;
+use Unsupervised\Schedular\Booking\BookingRepository;
+use Unsupervised\Schedular\Booking\Lesson;
+use Unsupervised\Schedular\GroupClass\Enrollment;
+use Unsupervised\Schedular\GroupClass\EnrollmentRepository;
+use Unsupervised\Schedular\Payment\PaymentService;
+use Unsupervised\Schedular\Tests\Unit\TestCase;
+
+class DeletedUserCleanupTest extends TestCase
+{
+    private BookingRepository&Mockery\MockInterface $bookings;
+    private AvailabilityRepository&Mockery\MockInterface $availability;
+    private EnrollmentRepository&Mockery\MockInterface $enrollments;
+    private PaymentService&Mockery\MockInterface $payments;
+    private DeletedUserCleanup $cleanup;
+
+    protected function setUp(): void
+    {
+        parent::setUp();
+
+        $this->bookings     = Mockery::mock(BookingRepository::class);
+        $this->availability = Mockery::mock(AvailabilityRepository::class);
+        $this->enrollments  = Mockery::mock(EnrollmentRepository::class);
+        $this->payments     = Mockery::mock(PaymentService::class);
+
+        $this->cleanup = new DeletedUserCleanup(
+            $this->bookings,
+            $this->availability,
+            $this->enrollments,
+            $this->payments
+        );
+    }
+
+    public function testHooksBothSingleSiteAndNetworkDeletion(): void
+    {
+        Actions\expectAdded('delete_user')->once();
+        Actions\expectAdded('wpmu_delete_user')->once();
+
+        $this->cleanup->register();
+    }
+
+    public function testEachUpcomingLessonIsCancelledItsSlotFreedAndItsPendingPaymentVoided(): void
+    {
+        $this->bookings->shouldReceive('findUpcomingForStudent')->with(5)->andReturn([
+            new Lesson(slotId: 7, studentId: 5, instructorId: 3, status: Lesson::STATUS_PENDING, paymentId: 40, id: 12),
+            new Lesson(slotId: 8, studentId: 5, instructorId: 3, status: Lesson::STATUS_CONFIRMED, paymentId: null, id: 13),
+        ]);
+        $this->enrollments->shouldReceive('findByStudent')->with(5)->andReturn([]);
+
+        $this->bookings->shouldReceive('updateStatus')->once()->with(12, Lesson::STATUS_CANCELLED)->andReturn(true);
+        $this->bookings->shouldReceive('updateStatus')->once()->with(13, Lesson::STATUS_CANCELLED)->andReturn(true);
+
+        // The point of the whole exercise: the times go back on sale.
+        $this->availability->shouldReceive('release')->once()->with(7)->andReturn(true);
+        $this->availability->shouldReceive('release')->once()->with(8)->andReturn(true);
+
+        $this->payments->shouldReceive('voidPending')->once()->with(40);
+        $this->payments->shouldReceive('voidPending')->once()->with(null);
+
+        $this->cleanup->releaseBookings(5);
+    }
+
+    /**
+     * A paid lesson is not credited back. The credit could only ever be spent on
+     * the account being deleted, so writing one would be book-keeping nobody can
+     * act on — a refund is the studio's call to make and record.
+     */
+    public function testNoCreditIsIssuedForAPaidLesson(): void
+    {
+        $this->bookings->shouldReceive('findUpcomingForStudent')->with(5)->andReturn([
+            new Lesson(slotId: 7, studentId: 5, instructorId: 3, status: Lesson::STATUS_CONFIRMED, paymentId: 40, id: 12),
+        ]);
+        $this->enrollments->shouldReceive('findByStudent')->with(5)->andReturn([]);
+
+        $this->bookings->shouldReceive('updateStatus')->andReturn(true);
+        $this->availability->shouldReceive('release')->andReturn(true);
+        $this->payments->shouldReceive('voidPending');
+
+        $this->payments->shouldNotReceive('creditForCancelledLesson');
+
+        $this->cleanup->releaseBookings(5);
+    }
+
+    public function testActiveEnrolmentsAreCancelledAndTheirPendingPaymentsVoided(): void
+    {
+        $this->bookings->shouldReceive('findUpcomingForStudent')->with(5)->andReturn([]);
+        $this->enrollments->shouldReceive('findByStudent')->with(5)->andReturn([
+            new Enrollment(offeringId: 8, studentId: 5, instructorId: 3, paymentId: 41, id: 40),
+            new Enrollment(
+                offeringId: 9,
+                studentId: 5,
+                instructorId: 3,
+                status: Enrollment::STATUS_CANCELLED,
+                paymentId: 42,
+                id: 41,
+            ),
+        ]);
+
+        // Only the active one: a withdrawn enrolment is already holding nothing.
+        $this->enrollments->shouldReceive('updateStatus')->once()->with(40, Enrollment::STATUS_CANCELLED)->andReturn(true);
+        $this->payments->shouldReceive('voidPending')->once()->with(41);
+
+        $this->cleanup->releaseBookings(5);
+    }
+
+    /**
+     * Past lessons happened and may have been paid for, so they stay exactly as
+     * they are — `findUpcomingForStudent` is what draws that line.
+     */
+    public function testNothingHappensWhenTheAccountHasNothingBookedAhead(): void
+    {
+        $this->bookings->shouldReceive('findUpcomingForStudent')->with(5)->andReturn([]);
+        $this->enrollments->shouldReceive('findByStudent')->with(5)->andReturn([]);
+
+        $this->bookings->shouldNotReceive('updateStatus');
+        $this->availability->shouldNotReceive('release');
+        $this->enrollments->shouldNotReceive('updateStatus');
+
+        $this->cleanup->releaseBookings(5);
+    }
+
+    public function testAnInvalidUserIdIsIgnored(): void
+    {
+        $this->bookings->shouldNotReceive('findUpcomingForStudent');
+        $this->enrollments->shouldNotReceive('findByStudent');
+
+        $this->cleanup->releaseBookings(0);
+    }
+}

tests/Unit/Auth/RegistrationPageTest.php

@@ -78,6 +78,7 @@ class RegistrationPageTest extends TestCase
         $this->ctx['guardians']   = Mockery::mock(GuardianService::class);
         // Recorded on every successful signup; the tests that care assert on it.
         $this->ctx['guardians']->shouldReceive('setGuardianOnly')->byDefault();
+        $this->ctx['guardians']->shouldReceive('setBirthYear')->byDefault();
 
         $this->ctx['page'] = new RegistrationPage(
             $invites,
@@ -133,7 +134,7 @@ class RegistrationPageTest extends TestCase
 
     public function testInviteBranchCreatesAndLogsInTheStudent(): void
     {
-        $_POST = [ 'password' => 'thistle-marrow-42', 'display_name' => 'Ada' ];
+        $_POST = [ 'password' => 'thistle-marrow-42', 'display_name' => 'Ada', 'birth_year' => '1990' ];
 
         Functions\when('email_exists')->justReturn(false);
         Functions\when('wp_insert_user')->justReturn(42);
@@ -150,7 +151,7 @@ class RegistrationPageTest extends TestCase
 
     public function testInviteAcceptanceLinksClassGrantForTheEmail(): void
     {
-        $_POST = [ 'password' => 'thistle-marrow-42', 'display_name' => 'Ada' ];
+        $_POST = [ 'password' => 'thistle-marrow-42', 'display_name' => 'Ada', 'birth_year' => '1990' ];
 
         Functions\when('email_exists')->justReturn(false);
         Functions\when('wp_insert_user')->justReturn(42);
@@ -170,7 +171,7 @@ class RegistrationPageTest extends TestCase
 
     public function testOpenBranchCreatesPendingWithoutLoginAndEmails(): void
     {
-        $_POST = [ 'password' => 'thistle-marrow-42', 'display_name' => 'Ada', 'email' => '[email protected]' ];
+        $_POST = [ 'password' => 'thistle-marrow-42', 'display_name' => 'Ada', 'email' => '[email protected]', 'birth_year' => '1990' ];
 
         Functions\when('is_email')->justReturn(true);
         Functions\when('email_exists')->justReturn(false);
@@ -197,7 +198,7 @@ class RegistrationPageTest extends TestCase
 
     public function testGroupInviteCreatesPendingAutoApproveAccountEvenWhenClosed(): void
     {
-        $_POST = [ 'password' => 'thistle-marrow-42', 'display_name' => 'Ada', 'email' => '[email protected]' ];
+        $_POST = [ 'password' => 'thistle-marrow-42', 'display_name' => 'Ada', 'email' => '[email protected]', 'birth_year' => '1990' ];
 
         Functions\when('is_email')->justReturn(true);
         Functions\when('email_exists')->justReturn(false);
@@ -365,7 +366,7 @@ class RegistrationPageTest extends TestCase
 
     public function testRejectsWhenARequiredPolicyIsUnaccepted(): void
     {
-        $_POST = [ 'password' => 'thistle-marrow-42', 'display_name' => 'Ada', 'email' => '[email protected]' ];
+        $_POST = [ 'password' => 'thistle-marrow-42', 'display_name' => 'Ada', 'email' => '[email protected]', 'birth_year' => '1990' ];
 
         Functions\when('is_email')->justReturn(true);
 
@@ -384,7 +385,7 @@ class RegistrationPageTest extends TestCase
 
     public function testRejectsWhenARequiredAccountQuestionIsUnanswered(): void
     {
-        $_POST = [ 'password' => 'thistle-marrow-42', 'display_name' => 'Ada', 'email' => '[email protected]' ];
+        $_POST = [ 'password' => 'thistle-marrow-42', 'display_name' => 'Ada', 'email' => '[email protected]', 'birth_year' => '1990' ];
 
         Functions\when('is_email')->justReturn(true);
 
@@ -406,6 +407,7 @@ class RegistrationPageTest extends TestCase
         $_POST = [
             'password'     => 'thistle-marrow-42',
             'display_name' => 'Ada',
+            'birth_year'   => '1990',
             'us_answers'   => [ '5' => 'By a friend' ],
         ];
 
@@ -438,7 +440,7 @@ class RegistrationPageTest extends TestCase
 
     public function testMaybeHandleSubmitLogsInInviteAndRedirects(): void
     {
-        $_POST    = [ 'us_register' => '1', 'password' => 'thistle-marrow-42', 'display_name' => 'Ada' ];
+        $_POST    = [ 'us_register' => '1', 'password' => 'thistle-marrow-42', 'display_name' => 'Ada', 'birth_year' => '1990' ];
         $_REQUEST = [ 'us_invite' => 'raw-token' ];
 
         Functions\when('is_user_logged_in')->justReturn(false);
@@ -756,6 +758,7 @@ class RegistrationPageTest extends TestCase
         $_POST = [
             'password'           => 'thistle-marrow-42',
             'display_name'       => 'Grace',
+            'birth_year'         => '1990',
             'us_registering_for' => $mode,
         ];
 
@@ -811,6 +814,7 @@ class RegistrationPageTest extends TestCase
         $_POST = [
             'password'           => 'thistle-marrow-42',
             'display_name'       => 'Grace',
+            'birth_year'         => '1990',
             'us_registering_for' => 'something-else',
             'children'           => [['name' => 'Ada', 'birth_year' => '2015', 'answers' => []]],
         ];
@@ -836,6 +840,7 @@ class RegistrationPageTest extends TestCase
         $_POST = [
             'password'           => 'thistle-marrow-42',
             'display_name'       => 'Grace',
+            'birth_year'         => '1990',
             'us_registering_for' => RegistrationPage::FOR_BOTH,
             'us_answers'         => ['7' => 'Cello'],
             'children'           => [['name' => 'Ada', 'birth_year' => '2015', 'answers' => [7 => 'Piano']]],
@@ -866,6 +871,7 @@ class RegistrationPageTest extends TestCase
         $_POST = [
             'password'           => 'thistle-marrow-42',
             'display_name'       => 'Grace',
+            'birth_year'         => '1990',
             'us_registering_for' => RegistrationPage::FOR_BOTH,
             'us_answers'         => ['7' => '   '],
             'children'           => [['name' => 'Ada', 'birth_year' => '2015', 'answers' => [7 => 'Piano']]],
@@ -1104,7 +1110,7 @@ class RegistrationPageTest extends TestCase
 
     public function testANonGuardianSignupIsUnchangedAndCreatesNoChildren(): void
     {
-        $_POST = ['password' => 'thistle-marrow-42', 'display_name' => 'Ada'];
+        $_POST = ['password' => 'thistle-marrow-42', 'display_name' => 'Ada', 'birth_year' => '1990'];
 
         Functions\when('email_exists')->justReturn(false);
         Functions\when('wp_insert_user')->justReturn(42);
@@ -1117,4 +1123,128 @@ class RegistrationPageTest extends TestCase
 
         self::assertSame('invite', $this->submit(new Invite(email: '[email protected]', token: 'hash'), false));
     }
+
+    /**
+     * The account holder is a student under "self" and "both", so they give the
+     * same birth year every other student does — and it is stored against their
+     * own account under the same meta key a child's uses.
+     *
+     * @dataProvider modesWhereTheAccountHolderIsAStudent
+     */
+    public function testTheAccountHoldersBirthYearIsRecordedWhenTheyAreAStudent(string $mode, bool $withChildren): void
+    {
+        $_POST = [
+            'password'           => 'thistle-marrow-42',
+            'display_name'       => 'Grace',
+            'birth_year'         => '1988',
+            'us_registering_for' => $mode,
+        ];
+
+        if ($withChildren) {
+            $_POST['children'] = [['name' => 'Ada', 'birth_year' => '2015', 'answers' => []]];
+            $this->ctx['guardians']->shouldReceive('createChild')->once()->andReturn(101);
+        }
+
+        $this->stubInviteSuccess();
+
+        $this->ctx['guardians']->shouldReceive('setBirthYear')->once()->with(42, '1988');
+
+        self::assertSame('invite', $this->submit(new Invite(email: '[email protected]', token: 'hash'), false));
+    }
+
+    /** @return array<string, array{string, bool}> */
+    public static function modesWhereTheAccountHolderIsAStudent(): array
+    {
+        return [
+            'just myself'         => [RegistrationPage::FOR_SELF, false],
+            'myself and students' => [RegistrationPage::FOR_BOTH, true],
+        ];
+    }
+
+    /**
+     * Missing or nonsense years are refused before a single user is created, the
+     * same way a student's is — the browser's `required` cannot be trusted here
+     * because the panel is hidden for a pure guardian.
+     *
+     * @dataProvider unusableBirthYears
+     */
+    public function testAnUnusableBirthYearForTheAccountHolderIsRejected(string $submitted): void
+    {
+        $_POST = [
+            'password'     => 'thistle-marrow-42',
+            'display_name' => 'Grace',
+            'birth_year'   => $submitted,
+        ];
+
+        Functions\when('email_exists')->justReturn(false);
+        Functions\expect('wp_insert_user')->never();
+
+        $result = $this->submit(new Invite(email: '[email protected]', token: 'hash'), false);
+
+        // Addressed to the person filling the form in, not to "each student".
+        self::assertStringContainsString('Please give your birth year', $result);
+        self::assertStringNotContainsString('each student', $result);
+    }
+
+    /** @return array<string, array{string}> */
+    public static function unusableBirthYears(): array
+    {
+        return [
+            'missing'    => [''],
+            'two digits' => ['88'],
+            'not a year' => ['nineteen'],
+            'in future'  => ['3000'],
+        ];
+    }
+
+    /**
+     * A pure guardian is not a student, so no birth year is asked of them and
+     * none is stored — anything posted for one is ignored, exactly as their
+     * answers are.
+     */
+    public function testNoBirthYearIsStoredForAGuardianWhoIsNotAStudent(): void
+    {
+        $_POST = [
+            'password'           => 'thistle-marrow-42',
+            'display_name'       => 'Grace',
+            'birth_year'         => 'should be ignored',
+            'us_registering_for' => RegistrationPage::FOR_STUDENTS,
+            'children'           => [['name' => 'Ada', 'birth_year' => '2015', 'answers' => []]],
+        ];
+
+        $this->ctx['guardians']->shouldReceive('createChild')->once()->andReturn(101);
+        $this->stubInviteSuccess();
+
+        $this->ctx['guardians']->shouldNotReceive('setBirthYear');
+
+        self::assertSame('invite', $this->submit(new Invite(email: '[email protected]', token: 'hash'), false));
+    }
+
+    /**
+     * Everything the studio needs is asked on one page: the account holder's own
+     * birth year and questions sit above the students they are adding, and there
+     * is no second step to advance to.
+     */
+    public function testTheFormAsksTheAccountHoldersQuestionsAboveTheStudents(): void
+    {
+        $this->stubRenderContext();
+
+        $question = new Question(null, 'Instrument', isRequired: true, scope: Question::SCOPE_ACCOUNT, id: 7);
+        $this->ctx['questions']->shouldReceive('findByScope')->with(Question::SCOPE_ACCOUNT, Mockery::any())->andReturn([$question]);
+
+        $html = $this->ctx['page']->render([]);
+
+        self::assertStringContainsString('name="birth_year"', $html);
+        self::assertStringContainsString('name="us_answers[7]"', $html);
+
+        // One page, one submit: no "Next", no step panels.
+        self::assertStringNotContainsString('us-reg-next', $html);
+        self::assertStringNotContainsString('data-step', $html);
+
+        self::assertLessThan(
+            strpos($html, 'id="us-children"'),
+            strpos($html, 'name="us_answers[7]"'),
+            'The account holder answers the questions above the students they are adding.'
+        );
+    }
 }

tests/Unit/Booking/BookingEndpointTest.php

@@ -11,6 +11,7 @@ use Unsupervised\Schedular\Booking\BookingEndpoint;
 use Unsupervised\Schedular\Booking\BookingRepository;
 use Unsupervised\Schedular\Booking\CancellationPolicy;
 use Unsupervised\Schedular\Booking\Lesson;
+use Unsupervised\Schedular\GroupClass\SessionSchedule;
 use Unsupervised\Schedular\Guardian\GuardianService;
 use Unsupervised\Schedular\Offering\Offering;
 use Unsupervised\Schedular\Offering\OfferingRepository;
@@ -30,6 +31,7 @@ class BookingEndpointTest extends TestCase
     private RegistrationGate $gate;
     private PaymentService $payments;
     private StudioSettings $settings;
+    private SessionSchedule&Mockery\MockInterface $sessions;
     private BookingEndpoint $endpoint;
 
     protected function setUp(): void
@@ -63,6 +65,11 @@ class BookingEndpointTest extends TestCase
         $this->guardians->shouldReceive('householdIds')->andReturnUsing(static fn (int $id): array => [$id])->byDefault();
         $this->guardians->shouldReceive('studentName')->andReturn('Ada')->byDefault();
 
+        $this->sessions = Mockery::mock(SessionSchedule::class);
+        // Most tests are about one-to-one lessons; the group-class ones say so.
+        $this->sessions->shouldReceive('upcomingForStudent')->andReturn([])->byDefault();
+        $this->sessions->shouldReceive('upcomingForInstructor')->andReturn([])->byDefault();
+
         $this->endpoint = new BookingEndpoint(
             $this->availability,
             $this->bookings,
@@ -71,6 +78,7 @@ class BookingEndpointTest extends TestCase
             $this->payments,
             new CancellationPolicy($this->settings),
             $this->guardians,
+            $this->sessions,
         );
     }
 
@@ -796,4 +804,93 @@ class BookingEndpointTest extends TestCase
         self::assertSame([77, 78], array_column($data, 'id'));
         self::assertSame(['Ada', 'Grace'], array_column($data, 'student_name'));
     }
+
+    /**
+     * A group class has no availability slot behind it, so it never appeared in
+     * this list at all — a student whose whole term was a group class saw an
+     * empty schedule. Its sessions now sort in among the booked lessons.
+     */
+    public function testMyLessonsInterleavesGroupClassSessionsWithLessons(): void
+    {
+        Functions\when('current_user_can')->justReturn(false);
+
+        $this->guardians->shouldReceive('householdIds')->with(5)->andReturn([5]);
+        $this->guardians->shouldReceive('studentName')->with(5)->andReturn('Grace');
+
+        // Slot 10 starts 2026-07-01 10:00 (the fixture), so the class on
+        // 2026-06-30 comes first and the one on 2026-07-07 last.
+        $lesson = new Lesson(slotId: 10, studentId: 5, instructorId: 3, status: Lesson::STATUS_CONFIRMED, id: 78);
+        $this->bookings->shouldReceive('findUpcomingForStudent')->with(5)->andReturn([$lesson]);
+        $this->availability->shouldReceive('findById')->with(10)->andReturn($this->slot(10, 3, null));
+
+        $this->sessions->shouldReceive('upcomingForStudent')->with(5, '2026-06-01 10:00:00')->andReturn([
+            [
+                'enrollment_id'    => 40,
+                'offering_id'      => 8,
+                'offering_title'   => 'Choir',
+                'instructor_id'    => 3,
+                'status'           => 'active',
+                'start_dt'         => '2026-06-30 16:00:00',
+                'end_dt'           => '2026-06-30 17:00:00',
+                'duration_minutes' => 60,
+            ],
+            [
+                'enrollment_id'    => 40,
+                'offering_id'      => 8,
+                'offering_title'   => 'Choir',
+                'instructor_id'    => 3,
+                'status'           => 'active',
+                'start_dt'         => '2026-07-07 16:00:00',
+                'end_dt'           => '2026-07-07 17:00:00',
+                'duration_minutes' => 60,
+            ],
+        ]);
+
+        $data = $this->endpoint->myLessons(new \WP_REST_Request([]))->get_data();
+
+        self::assertSame(
+            ['2026-06-30 16:00:00', '2026-07-01 10:00:00', '2026-07-07 16:00:00'],
+            array_column($data, 'start_dt')
+        );
+
+        // `kind` is what lets the panel withhold a Cancel button from a session
+        // that is a date in a term rather than a booked slot. A lesson carries no
+        // `kind` at all, which is the absence the panel reads as "cancellable".
+        self::assertSame('group_class', $data[0]['kind']);
+        self::assertSame('group_class', $data[2]['kind']);
+        self::assertSame('Choir', $data[0]['offering_title']);
+        self::assertSame('Grace', $data[0]['student_name']);
+        self::assertArrayNotHasKey('kind', $data[1]);
+    }
+
+    /**
+     * An instructor's own group classes join their schedule the same way, and
+     * one session is one row however many students are enrolled in it.
+     */
+    public function testMyLessonsAddsAnInstructorsOwnGroupClassSessions(): void
+    {
+        Functions\when('current_user_can')->justReturn(true);
+
+        $this->bookings->shouldReceive('findUpcomingForInstructor')->with(5)->andReturn([]);
+        $this->sessions->shouldReceive('upcomingForInstructor')->with(5, '2026-06-01 10:00:00')->andReturn([
+            [
+                'enrollment_id'    => 0,
+                'offering_id'      => 8,
+                'offering_title'   => 'Choir',
+                'instructor_id'    => 5,
+                'status'           => 'active',
+                'start_dt'         => '2026-06-30 16:00:00',
+                'end_dt'           => '2026-06-30 17:00:00',
+                'duration_minutes' => 60,
+            ],
+        ]);
+
+        $data = $this->endpoint->myLessons(new \WP_REST_Request([]))->get_data();
+
+        self::assertCount(1, $data);
+        self::assertSame('group_class', $data[0]['kind']);
+        self::assertSame('Choir', $data[0]['offering_title']);
+        // Nobody's name: the row is the class, not one student's place in it.
+        self::assertArrayNotHasKey('student_name', $data[0]);
+    }
 }

tests/Unit/GroupClass/SessionScheduleTest.php

@@ -0,0 +1,197 @@
+<?php
+declare(strict_types=1);
+
+namespace Unsupervised\Schedular\Tests\Unit\GroupClass;
+
+use Mockery;
+use Unsupervised\Schedular\GroupClass\Enrollment;
+use Unsupervised\Schedular\GroupClass\EnrollmentRepository;
+use Unsupervised\Schedular\GroupClass\SessionSchedule;
+use Unsupervised\Schedular\Offering\Offering;
+use Unsupervised\Schedular\Offering\OfferingRepository;
+use Unsupervised\Schedular\Tests\Unit\TestCase;
+
+class SessionScheduleTest extends TestCase
+{
+    private EnrollmentRepository&Mockery\MockInterface $enrollments;
+    private OfferingRepository&Mockery\MockInterface $offerings;
+    private SessionSchedule $schedule;
+
+    protected function setUp(): void
+    {
+        parent::setUp();
+
+        $this->enrollments = Mockery::mock(EnrollmentRepository::class);
+        $this->offerings   = Mockery::mock(OfferingRepository::class);
+        $this->schedule    = new SessionSchedule($this->enrollments, $this->offerings);
+    }
+
+    /** A three-week Tuesday class at 16:00, one hour long. */
+    private function choir(int $id = 8, string $title = 'Choir'): Offering
+    {
+        return new Offering(
+            instructorId:    3,
+            kind:            Offering::KIND_GROUP_CLASS,
+            title:           $title,
+            durationMinutes: 60,
+            termStart:       '2026-09-08',
+            termEnd:         '2026-09-22',
+            classTime:       '16:00:00',
+            id:              $id,
+        );
+    }
+
+    public function testAStudentsEnrolmentBecomesOneRowPerRemainingSession(): void
+    {
+        $this->enrollments->shouldReceive('findByStudent')->with(5)->andReturn([
+            new Enrollment(offeringId: 8, studentId: 5, instructorId: 3, id: 40),
+        ]);
+        $this->offerings->shouldReceive('findById')->with(8)->andReturn($this->choir());
+
+        $rows = $this->schedule->upcomingForStudent(5, '2026-09-01 00:00:00');
+
+        self::assertCount(3, $rows);
+        self::assertSame(
+            ['2026-09-08 16:00:00', '2026-09-15 16:00:00', '2026-09-22 16:00:00'],
+            array_column($rows, 'start_dt')
+        );
+        self::assertSame('2026-09-08 17:00:00', $rows[0]['end_dt']);
+        self::assertSame('Choir', $rows[0]['offering_title']);
+        self::assertSame(40, $rows[0]['enrollment_id']);
+        self::assertSame(3, $rows[0]['instructor_id']);
+        self::assertSame(60, $rows[0]['duration_minutes']);
+    }
+
+    public function testSessionsThatHaveAlreadyStartedAreLeftOut(): void
+    {
+        $this->enrollments->shouldReceive('findByStudent')->with(5)->andReturn([
+            new Enrollment(offeringId: 8, studentId: 5, instructorId: 3, id: 40),
+        ]);
+        $this->offerings->shouldReceive('findById')->with(8)->andReturn($this->choir());
+
+        // Mid-term: the first two dates are gone, the last is still to come.
+        $rows = $this->schedule->upcomingForStudent(5, '2026-09-16 09:00:00');
+
+        self::assertSame(['2026-09-22 16:00:00'], array_column($rows, 'start_dt'));
+    }
+
+    public function testAWithdrawnEnrolmentContributesNothing(): void
+    {
+        $this->enrollments->shouldReceive('findByStudent')->with(5)->andReturn([
+            new Enrollment(
+                offeringId: 8,
+                studentId: 5,
+                instructorId: 3,
+                status: Enrollment::STATUS_CANCELLED,
+                id: 40,
+            ),
+        ]);
+        $this->offerings->shouldNotReceive('findById');
+
+        self::assertSame([], $this->schedule->upcomingForStudent(5, '2026-09-01 00:00:00'));
+    }
+
+    /**
+     * "Completed" is a billing state, not a calendar one — the class may still
+     * have dates left to run, so its sessions stay on the list.
+     */
+    public function testACompletedEnrolmentStillListsItsRemainingSessions(): void
+    {
+        $this->enrollments->shouldReceive('findByStudent')->with(5)->andReturn([
+            new Enrollment(
+                offeringId: 8,
+                studentId: 5,
+                instructorId: 3,
+                status: Enrollment::STATUS_COMPLETED,
+                id: 40,
+            ),
+        ]);
+        $this->offerings->shouldReceive('findById')->with(8)->andReturn($this->choir());
+
+        $rows = $this->schedule->upcomingForStudent(5, '2026-09-01 00:00:00');
+
+        self::assertCount(3, $rows);
+        self::assertSame(Enrollment::STATUS_COMPLETED, $rows[0]['status']);
+    }
+
+    /**
+     * A class with no time set has no derivable sessions, so it is left out of a
+     * dated list rather than shown at a time nobody chose.
+     */
+    public function testAClassWithoutAScheduleYieldsNoRows(): void
+    {
+        $undated = new Offering(
+            instructorId:    3,
+            kind:            Offering::KIND_GROUP_CLASS,
+            title:           'Choir',
+            durationMinutes: 60,
+            termStart:       '2026-09-08',
+            id:              8,
+        );
+
+        $this->enrollments->shouldReceive('findByStudent')->with(5)->andReturn([
+            new Enrollment(offeringId: 8, studentId: 5, instructorId: 3, id: 40),
+        ]);
+        $this->offerings->shouldReceive('findById')->with(8)->andReturn($undated);
+
+        self::assertSame([], $this->schedule->upcomingForStudent(5, '2026-09-01 00:00:00'));
+    }
+
+    public function testADeletedOfferingIsSkippedRatherThanFatal(): void
+    {
+        $this->enrollments->shouldReceive('findByStudent')->with(5)->andReturn([
+            new Enrollment(offeringId: 8, studentId: 5, instructorId: 3, id: 40),
+        ]);
+        $this->offerings->shouldReceive('findById')->with(8)->andReturn(null);
+
+        self::assertSame([], $this->schedule->upcomingForStudent(5, '2026-09-01 00:00:00'));
+    }
+
+    public function testTwoEnrolmentsAreInterleavedByDate(): void
+    {
+        $band = new Offering(
+            instructorId:    3,
+            kind:            Offering::KIND_GROUP_CLASS,
+            title:           'Band',
+            durationMinutes: 45,
+            termStart:       '2026-09-10',
+            termEnd:         '2026-09-10',
+            classTime:       '09:00:00',
+            id:              9,
+        );
+
+        $this->enrollments->shouldReceive('findByStudent')->with(5)->andReturn([
+            new Enrollment(offeringId: 8, studentId: 5, instructorId: 3, id: 40),
+            new Enrollment(offeringId: 9, studentId: 5, instructorId: 3, id: 41),
+        ]);
+        $this->offerings->shouldReceive('findById')->with(8)->andReturn($this->choir());
+        $this->offerings->shouldReceive('findById')->with(9)->andReturn($band);
+
+        $rows = $this->schedule->upcomingForStudent(5, '2026-09-01 00:00:00');
+
+        self::assertSame(
+            ['Choir', 'Band', 'Choir', 'Choir'],
+            array_column($rows, 'offering_title')
+        );
+    }
+
+    /**
+     * An instructor's list is built from the classes they teach, not from who
+     * has signed up: a class with no enrolments yet is still on their schedule.
+     */
+    public function testAnInstructorSeesEachSessionOfTheirActiveClassesOnce(): void
+    {
+        $this->offerings->shouldReceive('findAll')
+            ->once()
+            ->with(3, Offering::KIND_GROUP_CLASS, true)
+            ->andReturn([$this->choir()]);
+        $this->enrollments->shouldNotReceive('findByStudent');
+
+        $rows = $this->schedule->upcomingForInstructor(3, '2026-09-01 00:00:00');
+
+        self::assertCount(3, $rows);
+        self::assertSame(0, $rows[0]['enrollment_id']);
+        self::assertSame(3, $rows[0]['instructor_id']);
+        self::assertSame('Choir', $rows[0]['offering_title']);
+    }
+}

tests/Unit/Policy/PolicyControllerTest.php

@@ -246,6 +246,74 @@ class PolicyControllerTest extends TestCase
         $this->render();
     }
 
+    public function testRenamingAPolicyUpdatesTheTitleAndLeavesTheSlugAlone(): void
+    {
+        $policy  = new Policy('Studio Policy', 'studio-policy', id: 4);
+        $renamed = new Policy('Terms of Enrolment', 'studio-policy', id: 4);
+
+        $_GET  = ['policy_id' => '4'];
+        $_POST = [
+            'usc_action' => 'rename_policy',
+            'policy_id'  => '4',
+            'title'      => 'Terms of Enrolment',
+        ];
+
+        // The lookups that guard the action see the old title; the page is
+        // rendered from a fresh read, so it shows the new one.
+        $this->policies->shouldReceive('findById')->with(4)->once()->andReturn($policy);
+        $this->policies->shouldReceive('updateTitle')->once()->with(4, 'Terms of Enrolment')->andReturn(true);
+        $this->policies->shouldReceive('findAll')->andReturn([$renamed]);
+        $this->policies->shouldReceive('findById')->with(4)->andReturn($renamed);
+        $this->versions->shouldReceive('findByPolicy')->with(4)->andReturn([]);
+
+        $html = $this->render();
+
+        self::assertStringContainsString('Policy renamed to "Terms of Enrolment"', $html);
+        self::assertStringContainsString('Versions of "Terms of Enrolment"', $html);
+    }
+
+    public function testRenamingAPolicyToNothingIsRejected(): void
+    {
+        $policy = new Policy('Studio Policy', 'studio-policy', id: 4);
+
+        $_GET  = ['policy_id' => '4'];
+        $_POST = [
+            'usc_action' => 'rename_policy',
+            'policy_id'  => '4',
+            'title'      => '   ',
+        ];
+
+        $this->policies->shouldReceive('findAll')->andReturn([$policy]);
+        $this->policies->shouldReceive('findById')->with(4)->andReturn($policy);
+        $this->versions->shouldReceive('findByPolicy')->with(4)->andReturn([]);
+
+        $this->policies->shouldNotReceive('updateTitle');
+
+        $html = $this->render();
+
+        self::assertStringContainsString('Versions of "Studio Policy"', $html);
+    }
+
+    public function testRenamingAPolicyBeyondTheColumnLengthIsRejected(): void
+    {
+        $policy = new Policy('Studio Policy', 'studio-policy', id: 4);
+
+        $_GET  = ['policy_id' => '4'];
+        $_POST = [
+            'usc_action' => 'rename_policy',
+            'policy_id'  => '4',
+            'title'      => str_repeat('a', Policy::MAX_TITLE_LENGTH + 1),
+        ];
+
+        $this->policies->shouldReceive('findAll')->andReturn([$policy]);
+        $this->policies->shouldReceive('findById')->with(4)->andReturn($policy);
+        $this->versions->shouldReceive('findByPolicy')->with(4)->andReturn([]);
+
+        $this->policies->shouldNotReceive('updateTitle');
+
+        $this->render();
+    }
+
     private function render(): string
     {
         ob_start();

tests/Unit/Policy/PolicyRepositoryTest.php

@@ -61,6 +61,23 @@ class PolicyRepositoryTest extends TestCase
         self::assertSame(Policy::SCOPE_SIGNUP, $found[0]->acceptanceScope);
     }
 
+    public function testUpdateTitleWritesOnlyTheTitle(): void
+    {
+        $this->db->shouldReceive('update')
+            ->once()
+            ->with('wp_us_policies', ['title' => 'Terms of Enrolment'], ['id' => 7], ['%s'], ['%d'])
+            ->andReturn(1);
+
+        self::assertTrue($this->repo->updateTitle(7, 'Terms of Enrolment'));
+    }
+
+    public function testUpdateTitleReportsFailure(): void
+    {
+        $this->db->shouldReceive('update')->once()->andReturn(false);
+
+        self::assertFalse($this->repo->updateTitle(7, 'Terms of Enrolment'));
+    }
+
     public function testUpdateCurrentVersion(): void
     {
         $this->db->shouldReceive('update')