Merge pull request 'Fix field-length saves, student wp-admin access, and empty instructor picker' (#111) from fix/field-length-student-admin-instructor-picker into main

Reviewed-on: #111

CHANGELOG.md

@@ -11,13 +11,31 @@ When a `v*` tag is pushed, `.gitea/workflows/release.yml` publishes the matching
 the plugin to the next patch version and adds a fresh section here for it. Record
 each change under the current top section as you work.
 
-## [1.1.3]
+## [1.2.1]
+
+### Fixed
+- Registration questions, offering titles/notes, and policy names longer than their storage limit are no longer silently discarded. Previously typing a fixed-size field past its maximum length reported success but saved nothing — the database quietly rejected the over-long value. These fields now cap the input in the form, and the API rejects an over-long value with a clear error.
+- Students can no longer reach the WordPress dashboard. A student who navigates to `wp-admin` is redirected to the site front end and the admin toolbar is hidden for them, so they only ever see the studio's booking pages. Anyone who runs the studio — administrators, studio admins, and instructors — keeps full `wp-admin` access.
+- The instructor picker on the **Add/Edit Offering** form no longer comes up empty for a solo studio owner. When the person running the studio teaches from a WordPress administrator account (the default single-account setup), they now appear in the instructor dropdown and can be assigned to a class.
+
+## [1.2.0]
 
 ### Added
+- Offerings can now bill on a schedule: **weekly** (a pending payment 24 hours before each lesson) or **monthly** (one payment on the 1st for that month's lessons), alongside the existing one-time and full-term modes. Applies to both private lessons and group classes. A daily job generates due payments, and each student receives one consolidated itemised email per scan; batched payments share a reference so the admin Payments queue groups them with a lump-sum total for e-transfer reconciliation. Cancelling a lesson never voids a scheduled payment.
+- Cancelling a lesson that was **already paid for** now credits the student that money instead of leaving it as a manual refund. The credit is one lesson's share of what they paid — the whole amount for a single lesson, or a per-lesson slice of a monthly charge or a full-term series. The daily billing scan automatically applies any available credit against a student's upcoming weekly/monthly charges before emailing their notice, which shows the credit applied and the reduced total due; a charge fully covered by credit is settled and leaves the admin Payments queue. A student's outstanding credit balance is shown on their **student detail** page in the studio admin. Still-pending (unpaid) payments continue to be voided on cancellation as before.
 - Group classes now carry an **enrolment deadline** the instructor sets on the offering. It defaults to the first day of the class, and once it passes students can no longer enrol — the enrolment page shows the class as closed and the API rejects late enrolments. While enrolment is open, each class card shows an "Enrol by" date.
+- Group classes now also carry a **withdrawal deadline** the instructor sets per class. Up to that day a student can withdraw themselves from the class (the group-class page shows a **Withdraw** button) — this frees their seat and voids any pending payment but does **not** credit their account. After the deadline self-withdrawal closes and the student must ask the studio, who can still withdraw them by hand from the student detail page. Leaving the deadline blank keeps self-withdrawal open indefinitely.
+- The **Add/Edit Offering** form now shows only the fields relevant to the selected kind: the group-class settings (capacity, dates, times, enrolment/withdrawal deadlines, sessions, schedule note, invite-only) appear only for a group class, and the weekly-reservation option only for a private lesson.
 - Instructors can add students to any group class by hand from its details page (**Add students directly**), which now appears for public classes too, not just invite-only ones. This bypasses the enrolment deadline and capacity, so a student can be enrolled as a **late enrolment** after the class has closed to self-enrolment.
+- Studio admins and instructors can open a **lesson detail view** from the Scheduler and My Lessons lists, showing the offering booked, the policy versions the student accepted (with acceptance time and IP), and their intake answers. On My Lessons an instructor may only open their own lessons; the studio Scheduler may open any.
+- The **Student Registration** block's "registration is by invitation only" message is now customisable, under a new **Invitation-only notice** panel (shortcode: `invite_only_message`). Leaving it blank keeps the default wording.
 
-## [1.1.2]
+### Changed
+- The student **upcoming lessons** panel now shows each booked offering's name and length beside the time, and lists only the soonest five lessons with a "Show all" reveal. The Scheduler and My Lessons week/list views likewise show the booked offering.
+
+### Fixed
+- Accepting an invitation now keeps the student signed in. Previously the registration form processed the submission after the page had started rendering, so the sign-in cookie was never sent and the new student was bounced back to the (logged-out) registration page; it is now handled before any output, and the student lands logged in.
+- Account-registration questions now save. On sites first installed before account-scope questions existed, the `us_questions.offering_id` column was left `NOT NULL` (the schema migration relied on `dbDelta`, which does not reliably relax a column to allow `NULL`), so saving an account question failed with "Column 'offering_id' cannot be null". A one-time, self-healing migration relaxes the column on the next load.
 
 ## [1.1.1]
 

assets/js/blocks.js

@@ -5,7 +5,7 @@
     const { registerBlockType } = wp.blocks;
     const { createElement: el, useState, useEffect } = wp.element;
     const { useBlockProps, InspectorControls } = wp.blockEditor;
-    const { PanelBody, SelectControl, ToggleControl } = wp.components;
+    const { PanelBody, SelectControl, ToggleControl, TextareaControl } = wp.components;
     const { useSelect } = wp.data;
     const apiFetch = wp.apiFetch;
     const ServerSideRender = wp.serverSideRender;
@@ -151,10 +151,12 @@
             shortcode: 'us_student_register',
             attributes: {
                 loginPageId: { type: 'number', default: 0 },
+                inviteOnlyMessage: { type: 'string', default: '' },
             },
-            inspector: (attributes, setAttributes) => el(
+            inspector: (attributes, setAttributes) => [
+                el(
                     PanelBody,
-                { title: __('After email confirmation', 'unsupervised-schedular') },
+                    { title: __('After email confirmation', 'unsupervised-schedular'), key: 'confirmation' },
                     el(PageSelect, {
                         label: __('Sign-in page', 'unsupervised-schedular'),
                         help: __('Where the sign-in link shown after a student confirms their email address sends them.', 'unsupervised-schedular'),
@@ -163,6 +165,17 @@
                         onChange: (loginPageId) => setAttributes({ loginPageId }),
                     })
                 ),
+                el(
+                    PanelBody,
+                    { title: __('Invitation-only notice', 'unsupervised-schedular'), key: 'invite-only' },
+                    el(TextareaControl, {
+                        label: __('Message', 'unsupervised-schedular'),
+                        help: __('Shown when registration is invite-only and the visitor has no valid invite link. Leave blank to use the default wording.', 'unsupervised-schedular'),
+                        value: attributes.inviteOnlyMessage,
+                        onChange: (inviteOnlyMessage) => setAttributes({ inviteOnlyMessage }),
+                    })
+                ),
+            ],
         },
         {
             name: 'us-scheduler/group-classes',

assets/js/group-classes.js

@@ -123,7 +123,14 @@
         return !deadline || todayYmd() <= deadline;
     }
 
-    function renderClasses(offerings, enrolledOfferingIds) {
+    // Self-withdrawal closes at the end of the withdrawal-deadline day. Unlike
+    // enrolment there is no implicit default: an unset deadline keeps withdrawal
+    // open. Mirrors the server-side Offering::isWithdrawalOpen() gate.
+    function isWithdrawalOpen(o) {
+        return !o.withdrawal_deadline || todayYmd() <= o.withdrawal_deadline;
+    }
+
+    function renderClasses(offerings, enrolledMap) {
         let groups = offerings.filter((o) => o.kind === 'group_class');
         if (singleOfferingId) {
             groups = groups.filter((o) => Number(o.id) === singleOfferingId);
@@ -143,11 +150,14 @@
                 ${o.schedule_note ? `<p>${escHtml(o.schedule_note)}</p>` : ''}
                 ${o.description ? `<p>${escHtml(o.description)}</p>` : ''}
                 <p>${escHtml(Number(o.price).toFixed(2))} ${escHtml(o.currency)}</p>
-                ${!enrolledOfferingIds.has(Number(o.id)) && isEnrollmentOpen(o) && enrolmentDeadline(o)
+                ${!enrolledMap.has(Number(o.id)) && isEnrollmentOpen(o) && enrolmentDeadline(o)
         ? `<p class="us-enrol-deadline">Enrol by ${escHtml(formatDate(enrolmentDeadline(o)))}</p>`
         : ''}
-                ${enrolledOfferingIds.has(Number(o.id))
-        ? '<p class="us-enrolled"><strong>You are enrolled in this class.</strong></p>'
+                ${enrolledMap.has(Number(o.id))
+        ? `<p class="us-enrolled"><strong>You are enrolled in this class.</strong></p>
+                ${isWithdrawalOpen(o)
+            ? `<button data-enrollment-id="${enrolledMap.get(Number(o.id))}" class="us-withdraw-btn">Withdraw</button>`
+            : '<p class="us-withdraw-closed">Withdrawal has closed — contact the studio to withdraw.</p>'}`
         : (isEnrollmentOpen(o)
             ? `<button data-offering-id="${o.id}" class="us-enrol-btn">Enrol</button>`
             : '<p class="us-enrol-closed"><strong>Enrolment has closed.</strong></p>')}
@@ -158,6 +168,20 @@
             const offering = groups.find((o) => String(o.id) === btn.dataset.offeringId);
             btn.addEventListener('click', () => openEnrolment(offering));
         });
+
+        list.querySelectorAll('.us-withdraw-btn').forEach((btn) => {
+            btn.addEventListener('click', () => withdraw(btn.dataset.enrollmentId));
+        });
+    }
+
+    function withdraw(enrollmentId) {
+        clearError();
+        if (!window.confirm('Withdraw from this class? Your seat is released and any pending payment is cancelled.')) {
+            return;
+        }
+        apiFetch(`enrollments/${enrollmentId}/withdraw`, { method: 'POST' })
+            .then(loadClasses)
+            .catch((err) => showError(err.message));
     }
 
     function openEnrolment(offering) {
@@ -240,9 +264,9 @@
         ])
             .then(([offerings, enrollments]) => renderClasses(
                 offerings,
-                new Set(enrollments
+                new Map(enrollments
                     .filter((e) => e.status === 'active')
-                    .map((e) => Number(e.offering_id)))
+                    .map((e) => [Number(e.offering_id), e.id]))
             ))
             .catch((err) => showError(err.message));
     }

docs/features/account-registration.md

@@ -97,7 +97,7 @@ recorded in `us_policy_acceptances` with `registration_type = account` and
 1. Studio admin opens **Invites** (`manage_students`) and invites an email; an invite row is created storing the token's SHA-256 hash, and the registration link (with the raw token) is shown **once** in a notice. To re-send a lost link, revoke and re-invite.
 2. The invitee opens `[us_student_register]` with the token (`?us_invite=<token>`); the lookup hashes the submitted token and matches it against the stored hash.
 3. The form shows the invited email **pre-filled and read-only** (the server always uses the invite's address on submit, so a tampered value is ignored) and collects a display name and password, and renders the signup-scoped published policies, each with a required acceptance checkbox. A token that is no longer redeemable (expired / accepted / revoked) renders the normal editable email field instead when open registration is on.
-4. On submit, the token is re-validated (hashed lookup); a `us_student` user is created, the policy acceptances are recorded (`account` type), the invite is marked `accepted`, and the user is logged in. If the invite carries an `offering_id` (a group-class email invite), the new account is linked to the matching access grant so the invite-only class becomes enrollable for them — see `group-classes.md`.
+4. On submit, the token is re-validated (hashed lookup); a `us_student` user is created, the policy acceptances are recorded (`account` type), the invite is marked `accepted`, and the user is logged in. The submission is processed on `template_redirect` (`RegistrationPage::maybeHandleSubmit()`) **before** any page output so `wp_set_auth_cookie()` actually persists — it then post/redirect/gets back to the page with `?us_registered=invite`, where the now-logged-in student sees the "created and logged in" confirmation. (Processing the form inside `render()`, which runs during `the_content`, sent the cookie after headers and left the student logged out on the next view.) If the invite carries an `offering_id` (a group-class email invite), the new account is linked to the matching access grant so the invite-only class becomes enrollable for them — see `group-classes.md`.
 
 ## Flow (self-approval mode)
 1. Studio admin enables **Studio Settings → Registration** and selects the registration page (shared with invites, `us_registration_page_id`).
@@ -126,6 +126,7 @@ recorded in `us_policy_acceptances` with `registration_type = account` and
 
 ## Frontend Shortcode
 - `[us_student_register]` — the registration page. In `invite` mode: shows the form for a valid pending invite, else an "by invitation only" message. In `self_approval` mode: shows the form to anyone (editable email), and renders confirmation-result notices from `?us_confirmed=1|expired`.
+- The invitation-only message is customisable: block attribute `inviteOnlyMessage` (set under the block's **Invitation-only notice** panel) / shortcode attribute `invite_only_message`. Blank falls back to the default wording (`RegistrationPage::inviteOnlyMessage()`).
 
 ## Token Redirect
 A `template_redirect` handler (`RegistrationPage::maybeRedirectToRegistrationPage()`)

docs/features/credits.md

@@ -0,0 +1,123 @@
+# Feature: Student Credits (cancelled paid lessons)
+
+## Overview
+When a lesson that has **already been paid for** is cancelled, the student is
+credited the amount they paid for *that lesson*. The credit sits on their account
+and is automatically applied against their future scheduled-billing charges
+(weekly / monthly) before they are asked to pay — so a cancelled-and-paid lesson
+becomes money toward the next one rather than a manual refund.
+
+This complements — it does not replace — the existing cancellation behaviour: a
+still-**pending** payment is voided (`PaymentService::voidPending`), and only a
+**paid** payment produces a credit.
+
+## Credit amount — one lesson's share
+The credit is one lesson's share of the covering payment's **total (including
+tax)**:
+
+| Covering payment | Lessons it covers | Credit on cancelling one |
+|------------------|-------------------|--------------------------|
+| Single booking (one-time / full-term single) | 1 | the whole total |
+| Weekly **scheduled** lesson | 1 (one payment per lesson) | the whole total |
+| Monthly **scheduled** charge | N lessons that month | `total ÷ N` |
+| Weekly reservation **series** paid upfront (full-term) | the whole series | `total ÷ series size` |
+
+The divisor is resolved in `PaymentService::coveredLessonCount`: a weekly series
+paid upfront (an *unscheduled* payment on a lesson that has a `series_id`) divides
+by the series size (`BookingRepository::countBySeries`); every other case divides
+by how many lessons point at the payment (`BookingRepository::countByPaymentId`),
+which is 1 for a single or weekly-scheduled lesson and N for a monthly charge.
+
+The original payment is **left untouched** — the studio keeps the money it
+collected; the credit is a forward-looking liability offset against future
+billing, never a refund of past revenue.
+
+### Guards
+- Only a **paid** payment credits; an unpaid/pending one is voided instead.
+- A lesson is credited **once** — `CreditRepository::existsForLesson` blocks a
+  second credit if the same lesson is cancelled again after being reinstated.
+- A non-anchor lesson in a series (no `payment_id` of its own) is credited through
+  the series anchor's payment.
+
+## Applying credit at billing time
+The daily scan (`Payment\ScheduledBillingRunner`) generates each student's due
+payments, then — before sending the notice — applies their available credit
+across those charges oldest-first (`PaymentService::applyCredits`):
+
+- Each payment's `us_payments.credit_applied` is raised by the amount covered,
+  reducing what the student owes (`Payment::netDue()`).
+- A payment **fully** covered by credit is marked **paid-by-credit** (status
+  `paid`, registration confirmed) so it drops out of the admin confirmation queue.
+- A payment **partially** covered stays `pending` at its reduced net due, shown in
+  the admin Payments queue and on the notice.
+- The credit ledger is drawn down by the total applied
+  (`CreditRepository::consume`, FIFO), marking each spent credit `consumed`.
+
+The consolidated notice email (`Payment\PaymentDueMailer`) lists each charge at
+its full amount, then an **"Account credit applied: -X"** line and the reduced
+**Total due**. When the balance is zero the notice still goes out (so the student
+knows their credit covered it) but carries no e-transfer destination or reference.
+
+## Admin visibility
+The studio admin sees a student's credit on their **student detail** page (gated by
+`manage_billing`, like the payment history). An **Account credit** section shows the
+available balance and a table of every credit — date, reason, original amount,
+remaining, and status (`available` / `consumed`). Built by
+`Auth\StudentHistory::creditBalance` / `::credits`.
+
+## Data model — `{prefix}us_credits`
+
+| Column              | Type            | Notes                                             |
+|---------------------|-----------------|---------------------------------------------------|
+| `id`                | BIGINT UNSIGNED | Primary key                                       |
+| `student_id`        | BIGINT UNSIGNED | WordPress user ID                                 |
+| `amount`            | DECIMAL(10,2)   | Original credit amount                            |
+| `remaining`         | DECIMAL(10,2)   | Unused balance                                    |
+| `currency`          | VARCHAR(3)      | ISO 4217                                          |
+| `source_payment_id` | BIGINT UNSIGNED | Payment that paid for the cancelled lesson        |
+| `source_lesson_id`  | BIGINT UNSIGNED | The cancelled lesson (dedup key)                  |
+| `reason`            | VARCHAR(191)    | Human-readable note                               |
+| `status`            | VARCHAR(20)     | `available` / `consumed`                          |
+| `created_at`        | DATETIME        | Insertion time                                    |
+| `updated_at`        | DATETIME        | Last draw-down; NULL until first consumed         |
+
+A new column on `{prefix}us_payments`:
+
+| Column           | Type          | Notes                                                     |
+|------------------|---------------|-----------------------------------------------------------|
+| `credit_applied` | DECIMAL(10,2) | Account credit applied to this payment; `netDue = total − credit_applied` |
+
+> **Schema change:** `us_credits` and `us_payments.credit_applied` ship as part of
+> the (as-yet-unreleased) **1.2.0** — the same release as scheduled billing — so
+> `Installer`/`dbDelta` create them when a pre-1.2.0 site upgrades. If you are on a
+> 1.2.0 *dev* build that predates this feature, the stored `us_schedular_version`
+> already matches `USC_VERSION`, so `Plugin::boot()` will not re-run the installer;
+> reactivate the plugin (or bump the version) to pick the new table/column up.
+
+## Reporting caveat
+Credits never touch past revenue and a credit-covered future charge is still
+marked `paid`, so `PaymentReport` (which sums `status = paid`) counts the original
+paid lesson and the later credit-covered lesson as gross revenue. This mirrors the
+design choice to leave the original payment intact rather than represent a partial
+refund of a shared payment.
+
+## Implementation
+- Model: `Unsupervised\Schedular\Payment\Credit`
+- Repository: `Unsupervised\Schedular\Payment\CreditRepository`
+- Issue on cancel: `PaymentService::creditForCancelledLesson`
+  (called from `Booking\BookingEndpoint::cancel` and `::updateStatus`)
+- Apply at billing: `PaymentService::applyCredits`, driven by
+  `Payment\ScheduledBillingRunner::sendNotices`
+- Net due: `Payment::netDue()`, `PaymentRepository::addCreditApplied`
+- Lesson counts: `Booking\BookingRepository::countByPaymentId` / `countBySeries`
+- Admin view: `Auth\StudentHistory::creditBalance` / `::credits`, rendered in
+  `templates/admin/student-detail.php`
+
+## Tests
+- `tests/Unit/Payment/CreditRepositoryTest.php`
+- `tests/Unit/Payment/PaymentServiceTest.php` (`creditForCancelledLesson`, `applyCredits`)
+- `tests/Unit/Payment/ScheduledBillingRunnerTest.php` (credit applied to a run)
+- `tests/Unit/Payment/PaymentDueMailerTest.php` (credit line + reduced total)
+- `tests/Unit/Payment/PaymentTest.php` (`netDue`)
+- `tests/Unit/Booking/BookingEndpointTest.php` (credit issued on cancel)
+- `tests/Unit/Auth/StudentHistoryTest.php` (`creditBalance`, `credits`)

docs/features/group-classes.md

@@ -62,11 +62,34 @@ deadline (and capacity) so a **late enrolment** can be added after the class has
 closed. Past the deadline the details page labels these as late enrolments. See
 **Admin Interface** below.
 
+## Withdrawal Flow
+A student may withdraw themselves from a class they are enrolled in through the same
+group-class page: an active enrolment shows a **Withdraw** button.
+`POST /enrollments/{id}/withdraw` marks the enrolment `cancelled` (freeing its
+capacity seat) and voids any still-pending payment. It **never issues an account
+credit** — a timely withdrawal is a clean exit, not a refund (credits are reserved
+for cancelled lessons; see `credits.md`).
+
+Self-withdrawal is bounded by the class's **withdrawal deadline** (the instructor's
+`withdrawal_deadline`; see `offerings.md`). Unlike the enrolment deadline it has no
+implicit default — a class with no deadline set stays open to withdrawal for its
+whole life. Past the deadline `POST /enrollments/{id}/withdraw` rejects the request
+with `403 withdrawal_closed`, and the class card shows "Withdrawal has closed —
+contact the studio to withdraw." in place of the Withdraw button. The endpoint also
+returns `404 not_found` for an unknown enrolment and `403 forbidden` when the
+enrolment is not the caller's own; a withdrawal of an already-cancelled enrolment is
+idempotent.
+
+The deadline only bounds student **self**-withdrawal. A studio admin can withdraw a
+student at any time from the **student detail page** (`Auth\StudentActions::withdrawEnrollment`),
+which is never subject to the deadline.
+
 ## REST API
 | Method   | Endpoint                                        | Permission                       |
-|----------|----------------------------------------------|----------------------------------|
+|----------|-------------------------------------------------|----------------------------------|
 | `GET`    | `/wp-json/us-scheduler/v1/enrollments`          | Any logged-in user               |
 | `POST`   | `/wp-json/us-scheduler/v1/enrollments`          | `book_lesson`                    |
+| `POST`   | `/wp-json/us-scheduler/v1/enrollments/{id}/withdraw` | Owner (the enrolled student) |
 
 `POST /enrollments` body: `offering_id`, `answers[]` (`question_id` → value),
 `accepted_policy_version_ids[]`, and payment data (see `payments.md`). The

docs/features/offerings.md

@@ -22,6 +22,7 @@ An offering is anything a student can register for: a private-lesson type (30 or
 | `term_end`         | DATE             | Group / term offerings — last day; NULL otherwise           |
 | `class_time`       | TIME             | Group only — time of day each session starts; NULL otherwise |
 | `enrollment_deadline` | DATE          | Group only — last day students may enrol; NULL defaults to `term_start` (the first class day) |
+| `withdrawal_deadline` | DATE          | Group only — last day a student may withdraw themselves; NULL keeps self-withdrawal open indefinitely |
 | `schedule_note`    | VARCHAR(191)     | Group only — human-readable schedule, e.g. "Tuesdays 4:00pm"|
 | `cancellation_cutoff_hours` | SMALLINT UNSIGNED | Optional per-offering cancellation cutoff in hours; NULL inherits the studio default (see `cancellation-cutoff.md`) |
 | `access_mode`      | VARCHAR(20)      | `public` (listed in the catalog) or `invite_only` (group classes hidden from the catalog — see `group-classes.md`) |
@@ -68,6 +69,20 @@ against that effective deadline (inclusive — the deadline day is still open).
 enrolment endpoint enforces it (`403 enrollment_closed`) and the front-end
 group-class list mirrors the same rule; see `group-classes.md`.
 
+## Withdrawal deadline
+A group class also carries an optional `withdrawal_deadline` — the last day a
+student may withdraw *themselves* from the class. Unlike the enrolment deadline it
+has **no implicit default**: `Offering::isWithdrawalOpen($today)` treats an unset
+(NULL) deadline as always open, so a class only closes to self-withdrawal once the
+instructor sets a date and it passes (comparison is inclusive — the deadline day is
+still open). A withdrawal made while open frees the seat and voids any still-pending
+payment but **never issues an account credit** (credits are reserved for cancelled
+lessons; see `credits.md`). Once the deadline passes the student must contact the
+studio, and an admin withdraws them by hand from the student detail page — the admin
+path is never subject to the deadline. The student endpoint enforces it
+(`403 withdrawal_closed`) and the front-end group-class list mirrors the rule; see
+`group-classes.md`.
+
 ## Instructor assignment
 Every offering has an owning `instructor_id`. A studio admin
 (`manage_instructors`) sees an **Instructor** picker on the offering form and may

docs/features/payments.md

@@ -118,6 +118,11 @@ notice per scan (`Payment\PaymentDueMailer`). Because these payments are schedul
 monthly charge (and every other lesson it covers) untouched, and never rebills. Full
 model, dedup, and the four generation cases are documented in `scheduled-billing.md`.
 
+Cancelling a lesson that was **already paid** issues the student an account credit for
+that lesson's share of what they paid; the next daily scan applies any available credit
+against their due charges (reducing `us_payments.credit_applied` → `Payment::netDue()`)
+before emailing the notice. See `credits.md`.
+
 ## REST API
 | Method  | Endpoint                                    | Permission                  |
 |---------|---------------------------------------------|-----------------------------|

docs/features/registration-questions.md

@@ -80,6 +80,7 @@ through the server-rendered admin page and read directly by `RegistrationPage`.
 - Signup step two: `Unsupervised\Schedular\Auth\RegistrationPage`, `templates/frontend/register-page.php`, `assets/js/register.js`
 - Admin review: `Unsupervised\Schedular\Auth\StudentHistory::registrationInfo()`, `templates/admin/student-detail.php`
 - Schema: `us_questions.scope` + nullable `us_questions.offering_id` (requires a plugin version bump so `dbDelta` runs)
+- Nullability repair: `dbDelta` does **not** reliably relax a column from `NOT NULL` to `NULL`, so sites created before account-scope questions kept `offering_id NOT NULL` and rejected account inserts. `QuestionRepository::ensureOfferingNullable()` re-applies the nullable definition (idempotent `ALTER … MODIFY`); `Plugin::boot()` runs it once, guarded by the `us_questions_offering_nullable` option rather than the version gate (affected sites may already be on the current version)
 
 ## Tests
 - `tests/Unit/Registration/QuestionRepositoryTest.php`

docs/features/scheduled-billing.md

@@ -69,8 +69,12 @@ at-registration payments have no batch and appear on their own.
 ## Cancellation
 Scheduled payments are never auto-voided. `PaymentService::voidPending` acts only on
 legacy at-registration payments (`! Payment::isScheduled()`), so cancelling one lesson
-never voids a shared monthly charge, never refunds, and never rebills. Refunds/credits
-are a manual, admin-side decision.
+never voids a shared monthly charge, never refunds, and never rebills.
+
+Cancelling a lesson that was **already paid** credits the student one lesson's share
+of what they paid (`PaymentService::creditForCancelledLesson`), and the next scan
+applies that credit against their due charges before emailing the notice
+(`PaymentService::applyCredits`). See `credits.md` for the full model.
 
 ## Implementation
 - Runner: `Unsupervised\Schedular\Payment\ScheduledBillingRunner`

docs/features/student-administration.md

@@ -33,6 +33,10 @@ No new tables. The views are composed from existing data:
     and when it was accepted.
   - **Intake answers** — every registration-question answer, newest first:
     question label, answer, and the registration it was given for.
+  - **Account credit** (`manage_billing` only) — the student's available credit
+    balance plus every credit (date, reason, amount, remaining, status). Credit
+    comes from cancelled paid lessons and is applied automatically to upcoming
+    scheduled billing. See `credits.md`.
   - **Payment history** (`manage_billing` only) — every payment, newest first:
     date, context, method, status, subtotal, HST, total, and receipt number.
 
@@ -44,7 +48,8 @@ All actions are nonce-protected POSTs handled on the detail page:
 - **Cancel lesson** — on any non-cancelled upcoming lesson. Uses the same path
   as student-initiated cancellation: the lesson is marked `cancelled`, the
   availability slot is freed for rebooking, and a still-pending payment is
-  voided. Paid lessons keep their payment — refunds stay a manual decision (#72).
+  voided. A paid lesson is credited back to the student's account (see
+  `credits.md`) rather than refunded.
 - **Withdraw** — on an active group-class enrolment: marked `cancelled` (freeing
   its capacity seat), with the same pending-payment voiding.
 

src/AdminMenu.php

@@ -25,6 +25,7 @@ use Unsupervised\Schedular\Offering\ClassSlotReconciler;
 use Unsupervised\Schedular\Offering\OfferingController;
 use Unsupervised\Schedular\Offering\OfferingRepository;
 use Unsupervised\Schedular\Payment\BillingMethodResolver;
+use Unsupervised\Schedular\Payment\CreditRepository;
 use Unsupervised\Schedular\Payment\PaymentController;
 use Unsupervised\Schedular\Payment\PaymentReportController;
 use Unsupervised\Schedular\Payment\PaymentRepository;
@@ -56,7 +57,7 @@ class AdminMenu {
 	private PaymentController $paymentController;
 	private PaymentReportController $paymentReportController;
 
-	public function __construct( AvailabilityRepository $availability, BookingRepository $bookings, OfferingRepository $offerings, QuestionRepository $questions, AnswerRepository $answers, PolicyRepository $policies, PolicyVersionRepository $policyVersions, PolicyService $policyService, AcceptanceRepository $acceptances, InviteRepository $invites, EnrollmentRepository $enrollments, GroupAccessRepository $groupAccess, StudioSettings $settings, PaymentRepository $payments, PaymentService $paymentService, BillingMethodResolver $resolver, RegistrationMailer $registrationMailer ) {
+	public function __construct( AvailabilityRepository $availability, BookingRepository $bookings, OfferingRepository $offerings, QuestionRepository $questions, AnswerRepository $answers, PolicyRepository $policies, PolicyVersionRepository $policyVersions, PolicyService $policyService, AcceptanceRepository $acceptances, InviteRepository $invites, EnrollmentRepository $enrollments, GroupAccessRepository $groupAccess, StudioSettings $settings, PaymentRepository $payments, PaymentService $paymentService, BillingMethodResolver $resolver, RegistrationMailer $registrationMailer, CreditRepository $credits ) {
 		$this->availabilityController         = new AvailabilityController( $availability, $offerings );
 		$this->lessonController               = new LessonController( $bookings, $payments, $availability, $offerings, new LessonDetail( $answers, $questions, $acceptances, $policies, $policyVersions ) );
 		$this->offeringController             = new OfferingController( $offerings, new ClassSlotReconciler( $availability ) );
@@ -65,7 +66,7 @@ class AdminMenu {
 		$this->registrationController         = new RegistrationController( $invites );
 		$this->registrationApprovalController = new RegistrationApprovalController( $registrationMailer );
 		$this->groupClassController           = new GroupClassController( $enrollments, $offerings, $payments, $groupAccess, $paymentService, $invites, $registrationMailer );
-		$this->studentController              = new StudentController( $bookings, $availability, $offerings, $enrollments, $resolver, new StudentHistory( $acceptances, $policies, $policyVersions, $answers, $questions, $payments ), new StudentActions( $bookings, $availability, $enrollments, $paymentService ) );
+		$this->studentController              = new StudentController( $bookings, $availability, $offerings, $enrollments, $resolver, new StudentHistory( $acceptances, $policies, $policyVersions, $answers, $questions, $payments, $credits ), new StudentActions( $bookings, $availability, $enrollments, $paymentService ) );
 		$this->instructorController           = new InstructorController();
 		$this->settings                       = $settings;
 		$this->accessSettings                 = new AccessSettings();

src/Auth/RegistrationPage.php

@@ -30,6 +30,13 @@ class RegistrationPage {
 	 */
 	private const RESULT_CONFIRM_GROUP = 'confirm_group';
 
+	/**
+	 * Validation error from the most recent submission processed on
+	 * `template_redirect`, carried over to {@see render()} so it can be shown
+	 * inline with the form. Empty when the last submit succeeded or none ran.
+	 */
+	private string $submitError = '';
+
 	public function __construct(
 		private InviteRepository $invites,
 		private PolicyRepository $policies,
@@ -45,15 +52,29 @@ class RegistrationPage {
 	/**
 	 * Renders the student registration shortcode output.
 	 *
-	 * @param array<int|string, mixed> $atts Block attributes (`loginPageId`) or
-	 *                                       shortcode attributes (`login_page_id`).
+	 * @param array<int|string, mixed> $atts Block attributes (`loginPageId`,
+	 *                                       `inviteOnlyMessage`) or shortcode
+	 *                                       attributes (`login_page_id`,
+	 *                                       `invite_only_message`).
 	 */
 	public function render( array $atts ): string {
+		// A just-completed invite signup is redirected back here already logged
+		// in (see maybeHandleSubmit); its success flag distinguishes that from a
+		// visitor who simply happens to be signed in already.
+		// phpcs:ignore WordPress.Security.NonceVerification.Recommended -- read-only display flag; the submit that set it was nonce-checked.
+		$registered = sanitize_key( Val::string( wp_unslash( $_GET['us_registered'] ?? '' ) ) );
+
 		if ( is_user_logged_in() ) {
+			if ( self::RESULT_INVITE === $registered ) {
+				return '<div class="us-register-form"><p class="us-success">'
+					. esc_html__( 'Your account has been created and you are now logged in.', 'unsupervised-schedular' )
+					. '</p></div>';
+			}
+
 			return '<p>' . esc_html__( 'You already have an account and are logged in.', 'unsupervised-schedular' ) . '</p>';
 		}
 
-		// phpcs:ignore WordPress.Security.NonceVerification.Recommended -- token identifies the invite; the form submit is nonce-checked below.
+		// phpcs:ignore WordPress.Security.NonceVerification.Recommended -- token identifies the invite; the form submit is nonce-checked in maybeHandleSubmit.
 		$token = sanitize_text_field( Val::string( wp_unslash( $_REQUEST['us_invite'] ?? '' ) ) );
 		// Only the token's hash is stored, so hash the submitted token for lookup.
 		$invite = '' !== $token ? $this->invites->findByToken( Invite::hashToken( $token ) ) : null;
@@ -65,17 +86,12 @@ class RegistrationPage {
 		// fail to submit — the stale invite's address.
 		$inviteValid = null !== $invite && $invite->isAcceptable( current_time( 'mysql' ) );
 
-		$error       = '';
-		$successType = '';
-
-		if ( isset( $_POST['us_register'] ) && check_admin_referer( 'us_student_register' ) ) {
-			$result = $this->handleSubmit( $invite, $open );
-			if ( in_array( $result, [ self::RESULT_INVITE, self::RESULT_CONFIRM, self::RESULT_CONFIRM_GROUP ], true ) ) {
-				$successType = $result;
-			} else {
-				$error = $result;
-			}
-		}
+		// The submission itself is processed in maybeHandleSubmit on
+		// template_redirect (before any output), so the invite auto-login cookie
+		// is actually sent. Its success signal returns here as ?us_registered;
+		// only a validation error is carried on the instance to show inline.
+		$successType = in_array( $registered, [ self::RESULT_CONFIRM, self::RESULT_CONFIRM_GROUP ], true ) ? $registered : '';
+		$error       = $this->submitError;
 
 		// Result of an email-confirmation link (set by EmailConfirmationHandler's redirect).
 		// phpcs:ignore WordPress.Security.NonceVerification.Recommended -- read-only display flag, not a state change.
@@ -87,6 +103,7 @@ class RegistrationPage {
 		$policyForms       = $this->signupPolicies();
 		$accountQuestions  = $this->questions->findByScope( Question::SCOPE_ACCOUNT, activeOnly: true );
 		$canRegister       = $open || $inviteValid;
+		$inviteOnlyMessage = $this->inviteOnlyMessage( $atts );
 
 		// The two-step script only matters when there is a second step to reveal.
 		if ( $canRegister && '' === $successType && [] !== $accountQuestions ) {
@@ -98,6 +115,77 @@ class RegistrationPage {
 		return (string) ob_get_clean();
 	}
 
+	/**
+	 * Process a submitted registration on `template_redirect`, before any page
+	 * output. Running here (rather than inside {@see render()}, which fires
+	 * during `the_content` after headers are sent) is what lets the invite
+	 * branch's `wp_set_auth_cookie()` actually persist — otherwise the student
+	 * appears logged in for a single render and is logged out on the next view.
+	 *
+	 * On success the request is redirected (post/redirect/get) with a
+	 * `?us_registered` flag so a refresh cannot resubmit; a validation error is
+	 * stashed for {@see render()} to show inline with the form.
+	 */
+	public function maybeHandleSubmit(): void {
+		if ( ! isset( $_POST['us_register'] ) || is_user_logged_in() ) {
+			return;
+		}
+
+		if ( ! check_admin_referer( 'us_student_register' ) ) {
+			return;
+		}
+
+		// phpcs:ignore WordPress.Security.NonceVerification.Missing -- verified by check_admin_referer above.
+		$token  = sanitize_text_field( Val::string( wp_unslash( $_REQUEST['us_invite'] ?? '' ) ) );
+		$invite = '' !== $token ? $this->invites->findByToken( Invite::hashToken( $token ) ) : null;
+		$open   = $this->settings->openRegistrationEnabled();
+
+		$result = $this->handleSubmit( $invite, $open );
+
+		if ( in_array( $result, [ self::RESULT_INVITE, self::RESULT_CONFIRM, self::RESULT_CONFIRM_GROUP ], true ) ) {
+			$this->redirect( add_query_arg( 'us_registered', $result, $this->currentUrl() ) );
+			return;
+		}
+
+		$this->submitError = $result;
+	}
+
+	/**
+	 * The current page's clean permalink, used as the post/redirect/get target
+	 * so the invite token and any stale flags are dropped from the URL.
+	 */
+	private function currentUrl(): string {
+		$url = get_permalink();
+
+		return is_string( $url ) ? $url : home_url( '/' );
+	}
+
+	/**
+	 * Issues the post-submit redirect and stops the request. Split out so tests
+	 * can observe the target without the process exiting.
+	 */
+	protected function redirect( string $url ): void {
+		wp_safe_redirect( $url );
+		exit;
+	}
+
+	/**
+	 * The message shown when registration is closed and no valid invite is
+	 * present. Studios can override the default via the block
+	 * (`inviteOnlyMessage`) or shortcode (`invite_only_message`) attribute.
+	 *
+	 * @param array<int|string, mixed> $atts
+	 */
+	private function inviteOnlyMessage( array $atts ): string {
+		$custom = trim( Val::string( $atts['inviteOnlyMessage'] ?? $atts['invite_only_message'] ?? '' ) );
+
+		if ( '' !== $custom ) {
+			return $custom;
+		}
+
+		return esc_html__( 'Registration is by invitation only. Please use the link from your invitation email, or contact the studio.', 'unsupervised-schedular' );
+	}
+
 	/**
 	 * Redirect to the configured registration page when an invite token lands
 	 * elsewhere (e.g. a link generated before the page was selected). Hooked on

src/Auth/StudentActions.php

@@ -27,8 +27,9 @@ class StudentActions {
 
 	/**
 	 * Cancel a lesson on the student's behalf: marks it cancelled, frees the
-	 * slot for rebooking, and voids a still-pending payment. Paid lessons keep
-	 * their payment — refunds are a manual, admin-side decision.
+	 * slot for rebooking, and voids a still-pending payment. A paid lesson is
+	 * credited back to the student's account (a per-lesson share of what they
+	 * paid) to offset their future scheduled billing.
 	 */
 	public function cancelLesson( int $lessonId, int $studentId ): bool {
 		$lesson = $this->bookings->findById( $lessonId );
@@ -40,6 +41,7 @@ class StudentActions {
 		$this->bookings->updateStatus( $lessonId, Lesson::STATUS_CANCELLED );
 		$this->availability->release( $lesson->slotId );
 		$this->payments->voidPending( $lesson->paymentId );
+		$this->payments->creditForCancelledLesson( $lesson );
 
 		return true;
 	}

src/Auth/StudentAdminGuard.php

@@ -0,0 +1,103 @@
+<?php
+declare(strict_types=1);
+
+namespace Unsupervised\Schedular\Auth;
+
+/**
+ * Keeps front-end-only users (students) out of wp-admin entirely.
+ *
+ * Students authenticate through the front-end login shortcode and do all of
+ * their work — booking, viewing lessons, paying — on the site's public pages.
+ * They have no reason to see the WordPress dashboard, profile screen, or admin
+ * bar, so this guard redirects them to the front end if they reach wp-admin and
+ * hides the admin bar for them everywhere.
+ *
+ * Access is decided by capability, not role: anyone holding a back-office
+ * capability (a WordPress administrator, studio admin, or instructor) keeps full
+ * wp-admin access, while a user with none of them is treated as front-end only.
+ */
+class StudentAdminGuard {
+
+	/**
+	 * Capabilities that grant a genuine reason to be in wp-admin. A user holding
+	 * none of these is front-end only and is kept out of the dashboard.
+	 *
+	 * @var list<string>
+	 */
+	private const BACK_OFFICE_CAPS = [
+		'manage_options',
+		RoleManager::CAP_MANAGE_INSTRUCTORS,
+		RoleManager::CAP_MANAGE_STUDENTS,
+		RoleManager::CAP_MANAGE_OFFERINGS,
+		RoleManager::CAP_MANAGE_QUESTIONS,
+		RoleManager::CAP_MANAGE_POLICIES,
+		RoleManager::CAP_MANAGE_BILLING,
+		RoleManager::CAP_MANAGE_AVAILABILITY,
+		RoleManager::CAP_VIEW_ALL_LESSONS,
+		RoleManager::CAP_VIEW_ALL_PAYMENTS,
+		RoleManager::CAP_VIEW_OWN_PAYMENTS,
+		RoleManager::CAP_EXPORT_PAYMENTS,
+	];
+
+	public function register(): void {
+		add_action( 'admin_init', [ $this, 'redirectFromDashboard' ] );
+		add_filter( 'show_admin_bar', [ $this, 'hideAdminBar' ] );
+	}
+
+	/**
+	 * Redirect a front-end-only user away from any wp-admin page to the site
+	 * home, so the dashboard and profile screens are never reachable.
+	 */
+	public function redirectFromDashboard(): void {
+		if ( ! $this->shouldBlockAdminAccess() ) {
+			return;
+		}
+
+		wp_safe_redirect( home_url( '/' ) );
+		exit;
+	}
+
+	/**
+	 * Whether the current request into wp-admin should be bounced to the front
+	 * end. AJAX requests are always allowed through so front-end features that
+	 * call admin-ajax keep working.
+	 */
+	public function shouldBlockAdminAccess(): bool {
+		if ( wp_doing_ajax() ) {
+			return false;
+		}
+
+		if ( ! is_user_logged_in() ) {
+			return false;
+		}
+
+		return ! $this->hasBackOfficeAccess();
+	}
+
+	/**
+	 * Hide the admin bar for front-end-only users; leave it untouched for anyone
+	 * with back-office access.
+	 *
+	 * @param bool $show Whether WordPress would otherwise show the admin bar.
+	 */
+	public function hideAdminBar( bool $show ): bool {
+		if ( is_user_logged_in() && ! $this->hasBackOfficeAccess() ) {
+			return false;
+		}
+
+		return $show;
+	}
+
+	/**
+	 * Whether the current user holds any capability that warrants wp-admin access.
+	 */
+	private function hasBackOfficeAccess(): bool {
+		foreach ( self::BACK_OFFICE_CAPS as $cap ) {
+			if ( current_user_can( $cap ) ) {
+				return true;
+			}
+		}
+
+		return false;
+	}
+}

src/Auth/StudentController.php

@@ -149,11 +149,24 @@ class StudentController {
 		$registrationInfo = $this->history->registrationInfo( (int) $student->ID );
 		$intake           = $this->history->intakeAnswers( (int) $student->ID );
 		$payments         = $canBilling ? $this->history->payments( (int) $student->ID ) : [];
+		$credits          = $canBilling ? $this->history->credits( (int) $student->ID ) : [];
+		$creditBalance    = $canBilling ? $this->history->creditBalance( (int) $student->ID ) : 0.0;
+		$creditCurrency   = $this->creditCurrency( $credits );
 
 		$backUrl = admin_url( 'admin.php?page=us-students' );
 		include USC_PLUGIN_DIR . 'templates/admin/student-detail.php';
 	}
 
+	/**
+	 * Currency to label the credit balance with — taken from the student's credits
+	 * (they share a currency in practice), defaulting to CAD when they have none.
+	 *
+	 * @param list<array{created_at: string, amount: float, remaining: float, currency: string, reason: string, status: string}> $credits
+	 */
+	private function creditCurrency( array $credits ): string {
+		return [] !== $credits ? (string) $credits[0]['currency'] : 'CAD';
+	}
+
 	/**
 	 * Build a display row for a lesson (slot time, offering, instructor, status).
 	 *

src/Auth/StudentHistory.php

@@ -3,6 +3,8 @@ declare(strict_types=1);
 
 namespace Unsupervised\Schedular\Auth;
 
+use Unsupervised\Schedular\Payment\Credit;
+use Unsupervised\Schedular\Payment\CreditRepository;
 use Unsupervised\Schedular\Payment\Payment;
 use Unsupervised\Schedular\Payment\PaymentRepository;
 use Unsupervised\Schedular\Policy\AcceptanceRepository;
@@ -27,6 +29,7 @@ class StudentHistory {
 		private AnswerRepository $answers,
 		private QuestionRepository $questions,
 		private PaymentRepository $payments,
+		private CreditRepository $credits,
 	) {}
 
 	/**
@@ -129,6 +132,34 @@ class StudentHistory {
 		);
 	}
 
+	/**
+	 * The student's total unused credit balance (from cancelled paid lessons),
+	 * applied automatically against future scheduled-billing charges.
+	 */
+	public function creditBalance( int $studentId ): float {
+		return $this->credits->availableBalance( $studentId );
+	}
+
+	/**
+	 * Every credit the student has been issued, newest first, with the amount, what
+	 * remains, and its state.
+	 *
+	 * @return list<array{created_at: string, amount: float, remaining: float, currency: string, reason: string, status: string}>
+	 */
+	public function credits( int $studentId ): array {
+		return array_map(
+			static fn( Credit $credit ): array => [
+				'created_at' => $credit->createdAt ?? '',
+				'amount'     => $credit->amount,
+				'remaining'  => $credit->remaining,
+				'currency'   => $credit->currency,
+				'reason'     => $credit->reason ?? '—',
+				'status'     => $credit->status,
+			],
+			$this->credits->findByStudent( $studentId )
+		);
+	}
+
 	/**
 	 * Human label for a polymorphic registration target.
 	 */

src/BlockRegistrar.php

@@ -109,6 +109,10 @@ class BlockRegistrar {
 						'type'    => 'number',
 						'default' => 0,
 					],
+					'inviteOnlyMessage' => [
+						'type'    => 'string',
+						'default' => '',
+					],
 				],
 			],
 			'us-scheduler/group-classes'    => [

src/Booking/BookingEndpoint.php

@@ -343,8 +343,9 @@ class BookingEndpoint {
 
 	/**
 	 * Student-initiated cancellation of their own lesson: marks it cancelled,
-	 * frees the slot for rebooking, and voids any still-pending payment. Paid
-	 * lessons keep their payment — refunds are a manual, admin-side decision.
+	 * frees the slot for rebooking, and voids any still-pending payment. A lesson
+	 * already paid for is credited back to the student's account (a per-lesson
+	 * share of the covering payment) to offset their future scheduled billing.
 	 */
 	public function cancel( \WP_REST_Request $request ): \WP_REST_Response|\WP_Error {
 		$id     = absint( Val::int( $request->get_param( 'id' ) ) );
@@ -379,6 +380,7 @@ class BookingEndpoint {
 			$this->bookings->updateStatus( $id, Lesson::STATUS_CANCELLED );
 			$this->availability->release( $lesson->slotId );
 			$this->payments->voidPending( $lesson->paymentId );
+			$this->payments->creditForCancelledLesson( $lesson );
 		}
 
 		return new \WP_REST_Response(
@@ -407,6 +409,7 @@ class BookingEndpoint {
 		if ( Lesson::STATUS_CANCELLED === $status && Lesson::STATUS_CANCELLED !== $lesson->status ) {
 			$this->availability->release( $lesson->slotId );
 			$this->payments->voidPending( $lesson->paymentId );
+			$this->payments->creditForCancelledLesson( $lesson );
 		} elseif ( Lesson::STATUS_CANCELLED === $lesson->status && Lesson::STATUS_CANCELLED !== $status && ! $this->availability->claim( $lesson->slotId ) ) {
 			// Reinstating a cancelled lesson must re-reserve its slot, and
 			// someone else may have booked the freed time in the meantime.

src/Booking/BookingRepository.php

@@ -243,6 +243,37 @@ class BookingRepository {
 		return $rows ?? [];
 	}
 
+	/**
+	 * How many lessons a payment covers — every lesson pointed at it, cancelled or
+	 * not, since the payment was billed for all of them. Used to split a paid
+	 * payment's total into a per-lesson share when one covered lesson is cancelled
+	 * and credited. Never below zero.
+	 */
+	public function countByPaymentId( int $paymentId ): int {
+		return (int) $this->db->get_var(
+			$this->db->prepare(
+				'SELECT COUNT(*) FROM %i WHERE payment_id = %d',
+				$this->table,
+				$paymentId
+			)
+		);
+	}
+
+	/**
+	 * How many lessons belong to a weekly series — the whole reservation an upfront
+	 * (full-term) payment covers, so cancelling one lesson credits its per-lesson
+	 * share. Counts every lesson in the series, cancelled or not.
+	 */
+	public function countBySeries( int $seriesId ): int {
+		return (int) $this->db->get_var(
+			$this->db->prepare(
+				'SELECT COUNT(*) FROM %i WHERE series_id = %d',
+				$this->table,
+				$seriesId
+			)
+		);
+	}
+
 	public function setPaymentId( int $id, int $paymentId ): bool {
 		return false !== $this->db->update(
 			$this->table,

src/GroupClass/EnrollmentEndpoint.php

@@ -59,6 +59,18 @@ class EnrollmentEndpoint {
 				],
 			]
 		);
+
+		register_rest_route(
+			$route_namespace,
+			'/enrollments/(?P<id>\d+)/withdraw',
+			[
+				[
+					'methods'             => \WP_REST_Server::CREATABLE,
+					'callback'            => [ $this, 'withdraw' ],
+					'permission_callback' => [ $this, 'isLoggedIn' ],
+				],
+			]
+		);
 	}
 
 	public function index( \WP_REST_Request $request ): \WP_REST_Response { // phpcs:ignore Generic.CodeAnalysis.UnusedFunctionParameter.Found
@@ -148,6 +160,50 @@ class EnrollmentEndpoint {
 		);
 	}
 
+	/**
+	 * Withdraw the current student from a group class they enrolled in. Allowed
+	 * only while the offering's withdrawal deadline is open (a class with no
+	 * deadline set stays open indefinitely); once it passes, the student must
+	 * contact the studio and an admin withdraws them by hand. A timely withdrawal
+	 * frees the seat and voids any still-pending payment but never issues an
+	 * account credit — that is reserved for cancelled lessons.
+	 */
+	public function withdraw( \WP_REST_Request $request ): \WP_REST_Response|\WP_Error {
+		$id         = absint( Val::int( $request->get_param( 'id' ) ) );
+		$enrollment = $this->enrollments->findById( $id );
+
+		if ( null === $enrollment ) {
+			return new \WP_Error( 'not_found', __( 'Enrolment not found.', 'unsupervised-schedular' ), [ 'status' => 404 ] );
+		}
+
+		if ( get_current_user_id() !== $enrollment->studentId ) {
+			return new \WP_Error( 'forbidden', __( 'You cannot withdraw from this class.', 'unsupervised-schedular' ), [ 'status' => 403 ] );
+		}
+
+		if ( Enrollment::STATUS_ACTIVE === $enrollment->status ) {
+			$offering = $this->offerings->findById( $enrollment->offeringId );
+
+			if ( null !== $offering && ! $offering->isWithdrawalOpen( Val::string( current_time( 'Y-m-d' ) ) ) ) {
+				return new \WP_Error(
+					'withdrawal_closed',
+					__( 'Withdrawal for this class has closed. Please contact the studio.', 'unsupervised-schedular' ),
+					[ 'status' => 403 ]
+				);
+			}
+
+			$this->enrollments->updateStatus( $id, Enrollment::STATUS_CANCELLED );
+			$this->payments->voidPending( $enrollment->paymentId );
+		}
+
+		return new \WP_REST_Response(
+			[
+				'id'     => $id,
+				'status' => Enrollment::STATUS_CANCELLED,
+			],
+			200
+		);
+	}
+
 	public function isLoggedIn(): bool {
 		return is_user_logged_in();
 	}

src/Offering/Offering.php

@@ -54,6 +54,15 @@ class Offering {
 	 */
 	public const VALID_ACCESS_MODES = [ self::ACCESS_PUBLIC, self::ACCESS_INVITE_ONLY ];
 
+	/** Maximum length of the title, matching the `title` VARCHAR(191) column. */
+	public const MAX_TITLE_LENGTH = 191;
+
+	/** Maximum length of the schedule note, matching the `schedule_note` VARCHAR(191) column. */
+	public const MAX_SCHEDULE_NOTE_LENGTH = 191;
+
+	/** Maximum length of the e-transfer email, matching the `etransfer_email` VARCHAR(191) column. */
+	public const MAX_ETRANSFER_EMAIL_LENGTH = 191;
+
 	public function __construct(
 		public readonly int $instructorId,
 		public readonly string $kind,
@@ -69,6 +78,7 @@ class Offering {
 		public readonly ?string $termEnd = null,
 		public readonly ?string $classTime = null,
 		public readonly ?string $enrollmentDeadline = null,
+		public readonly ?string $withdrawalDeadline = null,
 		public readonly ?string $scheduleNote = null,
 		public readonly ?string $etransferEmail = null,
 		public readonly ?int $cancellationCutoffHours = null,
@@ -114,6 +124,19 @@ class Offering {
 		return null === $deadline || $today <= $deadline;
 	}
 
+	/**
+	 * Whether a student may still withdraw themselves from this group class on
+	 * `$today` (a `Y-m-d` date). Withdrawal stays open through the end of the
+	 * deadline day. Unlike the enrolment deadline there is no implicit default: a
+	 * class with no withdrawal deadline set stays open to withdrawal for its whole
+	 * life, so the instructor must set a date to lock students in. A withdrawal
+	 * made while open never issues an account credit — it only frees the seat and
+	 * voids any still-pending payment.
+	 */
+	public function isWithdrawalOpen( string $today ): bool {
+		return null === $this->withdrawalDeadline || $today <= $this->withdrawalDeadline;
+	}
+
 	/**
 	 * Normalise a submitted term date to canonical `Y-m-d`, or null when it is
 	 * not a real calendar date. Round-trips through DateTimeImmutable so
@@ -214,6 +237,7 @@ class Offering {
 			termEnd:         Val::stringOrNull( $row->term_end ),
 			classTime:       Val::stringOrNull( $row->class_time ?? null ),
 			enrollmentDeadline: Val::stringOrNull( $row->enrollment_deadline ?? null ),
+			withdrawalDeadline: Val::stringOrNull( $row->withdrawal_deadline ?? null ),
 			scheduleNote:    Val::stringOrNull( $row->schedule_note ),
 			etransferEmail:  Val::stringOrNull( $row->etransfer_email ),
 			cancellationCutoffHours: Val::intOrNull( $row->cancellation_cutoff_hours ),
@@ -249,6 +273,7 @@ class Offering {
 			'term_end'                  => $this->termEnd,
 			'class_time'                => $this->classTime,
 			'enrollment_deadline'       => $this->enrollmentDeadline,
+			'withdrawal_deadline'       => $this->withdrawalDeadline,
 			'schedule_note'             => $this->scheduleNote,
 			'cancellation_cutoff_hours' => $this->cancellationCutoffHours,
 			'access_mode'               => $this->accessMode,

src/Offering/OfferingController.php

@@ -3,6 +3,7 @@ declare(strict_types=1);
 
 namespace Unsupervised\Schedular\Offering;
 
+use Unsupervised\Schedular\Auth\AccessSettings;
 use Unsupervised\Schedular\Auth\RoleManager;
 use Unsupervised\Schedular\Val;
 
@@ -11,6 +12,7 @@ class OfferingController {
 	public function __construct(
 		private OfferingRepository $repository,
 		private ClassSlotReconciler $reconciler,
+		private AccessSettings $access = new AccessSettings(),
 	) {}
 
 	public function renderPage(): void {
@@ -137,15 +139,26 @@ class OfferingController {
 	}
 
 	/**
-	 * Registered instructors offered in the assignment select, by display name.
+	 * Instructors offered in the assignment select, by display name.
+	 *
+	 * Includes everyone holding the `us_instructor` role plus, when the site owner
+	 * has left administrators acting as instructors (the default single-account
+	 * setup), WordPress administrators — who teach through the dynamic capability
+	 * grant rather than the role. Without them a solo studio owner running the
+	 * business from an admin account would find no one to assign a class to.
 	 *
 	 * @return list<array{id: int, name: string}>
 	 */
 	private function instructorOptions(): array {
+		$roles = [ RoleManager::INSTRUCTOR ];
+		if ( $this->access->adminsAreInstructors() ) {
+			$roles[] = 'administrator';
+		}
+
 		$users = array_filter(
 			get_users(
 				[
-					'role'    => RoleManager::INSTRUCTOR,
+					'role__in' => $roles,
 					'orderby'  => 'display_name',
 					'order'    => 'ASC',
 				]
@@ -184,6 +197,17 @@ class OfferingController {
 			return null;
 		}
 
+		$scheduleNote   = $this->nullableText( sanitize_text_field( Val::string( wp_unslash( $_POST['schedule_note'] ?? '' ) ) ) );
+		$etransferEmail = $this->nullableText( sanitize_email( Val::string( wp_unslash( $_POST['etransfer_email'] ?? '' ) ) ) );
+
+		// Reject over-long fixed-size fields rather than let the DB silently drop them.
+		if ( mb_strlen( $title ) > Offering::MAX_TITLE_LENGTH
+			|| ( null !== $scheduleNote && mb_strlen( $scheduleNote ) > Offering::MAX_SCHEDULE_NOTE_LENGTH )
+			|| ( null !== $etransferEmail && mb_strlen( $etransferEmail ) > Offering::MAX_ETRANSFER_EMAIL_LENGTH )
+		) {
+			return null;
+		}
+
 		$billingMode = sanitize_key( Val::string( wp_unslash( $_POST['billing_mode'] ?? Offering::BILLING_ONE_TIME ) ) );
 		if ( ! in_array( $billingMode, Offering::VALID_BILLING_MODES, true ) ) {
 			$billingMode = Offering::BILLING_ONE_TIME;
@@ -213,6 +237,11 @@ class OfferingController {
 		// day (term_start), applied by Offering::effectiveEnrollmentDeadline().
 		$enrollmentDeadline = Offering::normalizeDate( sanitize_text_field( Val::string( wp_unslash( $_POST['enrollment_deadline'] ?? '' ) ) ) );
 
+		// A blank (or invalid) withdrawal deadline leaves the column NULL, which
+		// keeps self-withdrawal open for the class's whole life
+		// (Offering::isWithdrawalOpen()). A set date closes it after that day.
+		$withdrawalDeadline = Offering::normalizeDate( sanitize_text_field( Val::string( wp_unslash( $_POST['withdrawal_deadline'] ?? '' ) ) ) );
+
 		return new Offering(
 			instructorId:    $this->resolveInstructorId( $instructorId, $manageAll, $existing ),
 			kind:            $kind,
@@ -228,8 +257,9 @@ class OfferingController {
 			termEnd:         $termEnd,
 			classTime:       $classTime,
 			enrollmentDeadline: $enrollmentDeadline,
-			scheduleNote:    $this->nullableText( sanitize_text_field( Val::string( wp_unslash( $_POST['schedule_note'] ?? '' ) ) ) ),
-			etransferEmail:  $this->nullableText( sanitize_email( Val::string( wp_unslash( $_POST['etransfer_email'] ?? '' ) ) ) ),
+			withdrawalDeadline: $withdrawalDeadline,
+			scheduleNote:    $scheduleNote,
+			etransferEmail:  $etransferEmail,
 			cancellationCutoffHours: $cutoffHours,
 			accessMode:      isset( $_POST['invite_only'] ) ? Offering::ACCESS_INVITE_ONLY : Offering::ACCESS_PUBLIC,
 			isActive:        isset( $_POST['is_active'] ),

src/Offering/OfferingEndpoint.php

@@ -148,6 +148,14 @@ class OfferingEndpoint {
 			return $this->invalid( __( 'Invalid billing mode.', 'unsupervised-schedular' ) );
 		}
 
+		$scheduleNote   = $this->nullableText( $request->get_param( 'schedule_note' ) );
+		$etransferEmail = $this->nullableEmail( $request->get_param( 'etransfer_email' ) );
+
+		$lengthError = $this->checkLengths( $title, $scheduleNote, $etransferEmail );
+		if ( $lengthError instanceof \WP_Error ) {
+			return $lengthError;
+		}
+
 		$offering = new Offering(
 			instructorId:    get_current_user_id(),
 			kind:            $kind,
@@ -162,8 +170,8 @@ class OfferingEndpoint {
 			termStart:       $this->nullableText( $request->get_param( 'term_start' ) ),
 			termEnd:         $this->nullableText( $request->get_param( 'term_end' ) ),
 			enrollmentDeadline: $this->nullableText( $request->get_param( 'enrollment_deadline' ) ),
-			scheduleNote:    $this->nullableText( $request->get_param( 'schedule_note' ) ),
-			etransferEmail:  $this->nullableEmail( $request->get_param( 'etransfer_email' ) ),
+			scheduleNote:    $scheduleNote,
+			etransferEmail:  $etransferEmail,
 			cancellationCutoffHours: $this->nullableInt( $request->get_param( 'cancellation_cutoff_hours' ) ),
 			accessMode:      $this->accessMode( $request->get_param( 'access_mode' ), Offering::ACCESS_PUBLIC ),
 			isActive:        null === $request->get_param( 'is_active' ) ? true : (bool) $request->get_param( 'is_active' ),
@@ -196,10 +204,19 @@ class OfferingEndpoint {
 			return $this->invalid( __( 'Invalid billing mode.', 'unsupervised-schedular' ) );
 		}
 
+		$title          = $request->has_param( 'title' ) ? sanitize_text_field( Val::string( $request->get_param( 'title' ) ) ) : $existing->title;
+		$scheduleNote   = $request->has_param( 'schedule_note' ) ? $this->nullableText( $request->get_param( 'schedule_note' ) ) : $existing->scheduleNote;
+		$etransferEmail = $request->has_param( 'etransfer_email' ) ? $this->nullableEmail( $request->get_param( 'etransfer_email' ) ) : $existing->etransferEmail;
+
+		$lengthError = $this->checkLengths( $title, $scheduleNote, $etransferEmail );
+		if ( $lengthError instanceof \WP_Error ) {
+			return $lengthError;
+		}
+
 		$offering = new Offering(
 			instructorId:    $existing->instructorId,
 			kind:            $kind,
-			title:           $request->has_param( 'title' ) ? sanitize_text_field( Val::string( $request->get_param( 'title' ) ) ) : $existing->title,
+			title:           $title,
 			price:           $request->has_param( 'price' ) ? $this->price( $request->get_param( 'price' ) ) : $existing->price,
 			currency:        $request->has_param( 'currency' ) ? sanitize_text_field( Val::string( $request->get_param( 'currency' ) ) ) : $existing->currency,
 			billingMode:     $billingMode,
@@ -210,8 +227,8 @@ class OfferingEndpoint {
 			termStart:       $request->has_param( 'term_start' ) ? $this->nullableText( $request->get_param( 'term_start' ) ) : $existing->termStart,
 			termEnd:         $request->has_param( 'term_end' ) ? $this->nullableText( $request->get_param( 'term_end' ) ) : $existing->termEnd,
 			enrollmentDeadline: $request->has_param( 'enrollment_deadline' ) ? $this->nullableText( $request->get_param( 'enrollment_deadline' ) ) : $existing->enrollmentDeadline,
-			scheduleNote:    $request->has_param( 'schedule_note' ) ? $this->nullableText( $request->get_param( 'schedule_note' ) ) : $existing->scheduleNote,
-			etransferEmail:  $request->has_param( 'etransfer_email' ) ? $this->nullableEmail( $request->get_param( 'etransfer_email' ) ) : $existing->etransferEmail,
+			scheduleNote:    $scheduleNote,
+			etransferEmail:  $etransferEmail,
 			cancellationCutoffHours: $request->has_param( 'cancellation_cutoff_hours' ) ? $this->nullableInt( $request->get_param( 'cancellation_cutoff_hours' ) ) : $existing->cancellationCutoffHours,
 			accessMode:      $request->has_param( 'access_mode' ) ? $this->accessMode( $request->get_param( 'access_mode' ), $existing->accessMode ) : $existing->accessMode,
 			isActive:        $request->has_param( 'is_active' ) ? (bool) $request->get_param( 'is_active' ) : $existing->isActive,
@@ -266,6 +283,34 @@ class OfferingEndpoint {
 		return new \WP_Error( 'invalid_offering', $message, [ 'status' => 400 ] );
 	}
 
+	/**
+	 * Reject any fixed-size field whose value exceeds its column length, so an
+	 * over-long value is refused with a clear 400 rather than silently dropped
+	 * by the database.
+	 */
+	private function checkLengths( string $title, ?string $scheduleNote, ?string $etransferEmail ): ?\WP_Error {
+		$fields = [
+			[ __( 'title', 'unsupervised-schedular' ), $title, Offering::MAX_TITLE_LENGTH ],
+			[ __( 'schedule note', 'unsupervised-schedular' ), $scheduleNote, Offering::MAX_SCHEDULE_NOTE_LENGTH ],
+			[ __( 'e-transfer email', 'unsupervised-schedular' ), $etransferEmail, Offering::MAX_ETRANSFER_EMAIL_LENGTH ],
+		];
+
+		foreach ( $fields as [ $name, $value, $max ] ) {
+			if ( null !== $value && mb_strlen( $value ) > $max ) {
+				return $this->invalid(
+					sprintf(
+						/* translators: 1: field name, 2: maximum character count. */
+						__( 'The %1$s must be %2$d characters or fewer.', 'unsupervised-schedular' ),
+						$name,
+						$max
+					)
+				);
+			}
+		}
+
+		return null;
+	}
+
 	private function price( mixed $value ): float {
 		return max( 0.0, Val::float( $value ) );
 	}

src/Offering/OfferingRepository.php

@@ -15,12 +15,12 @@ class OfferingRepository {
 	 * Column formats aligned to {@see columns()} (instructor_id, kind, title,
 	 * description, duration_minutes, price, currency, billing_mode, allow_weekly,
 	 * capacity, term_start, term_end, class_time, enrollment_deadline,
-	 * schedule_note, etransfer_email, cancellation_cutoff_hours, access_mode,
-	 * is_active).
+	 * withdrawal_deadline, schedule_note, etransfer_email,
+	 * cancellation_cutoff_hours, access_mode, is_active).
 	 *
 	 * @var list<string>
 	 */
-	private const COLUMN_FORMATS = [ '%d', '%s', '%s', '%s', '%d', '%f', '%s', '%s', '%d', '%d', '%s', '%s', '%s', '%s', '%s', '%s', '%d', '%s', '%d' ];
+	private const COLUMN_FORMATS = [ '%d', '%s', '%s', '%s', '%d', '%f', '%s', '%s', '%d', '%d', '%s', '%s', '%s', '%s', '%s', '%s', '%s', '%d', '%s', '%d' ];
 
 	public function insert( Offering $offering ): int {
 		$this->db->insert(
@@ -63,6 +63,7 @@ class OfferingRepository {
 			'term_end'                  => $offering->termEnd,
 			'class_time'                => $offering->classTime,
 			'enrollment_deadline'       => $offering->enrollmentDeadline,
+			'withdrawal_deadline'       => $offering->withdrawalDeadline,
 			'schedule_note'             => $offering->scheduleNote,
 			'etransfer_email'           => $offering->etransferEmail,
 			'cancellation_cutoff_hours' => $offering->cancellationCutoffHours,

src/Payment/Credit.php

@@ -0,0 +1,79 @@
+<?php
+declare(strict_types=1);
+
+namespace Unsupervised\Schedular\Payment;
+
+use Unsupervised\Schedular\Val;
+
+/**
+ * A studio credit held on a student's account — money already paid for a lesson
+ * that was later cancelled. Credits are consumed against future scheduled-billing
+ * charges (weekly / monthly) before the student is asked to pay, oldest first.
+ */
+class Credit {
+
+	public const STATUS_AVAILABLE = 'available';
+	public const STATUS_CONSUMED  = 'consumed';
+
+	/**
+	 * All valid credit statuses.
+	 *
+	 * @var list<string>
+	 */
+	public const VALID_STATUSES = [ self::STATUS_AVAILABLE, self::STATUS_CONSUMED ];
+
+	public function __construct(
+		public readonly int $studentId,
+		public readonly float $amount,
+		public readonly float $remaining,
+		public readonly string $currency = 'CAD',
+		public readonly ?int $sourcePaymentId = null,
+		public readonly ?int $sourceLessonId = null,
+		public readonly ?string $reason = null,
+		public readonly string $status = self::STATUS_AVAILABLE,
+		public readonly ?string $createdAt = null,
+		public readonly ?string $updatedAt = null,
+		public readonly ?int $id = null,
+	) {}
+
+	public static function fromRow( \stdClass $row ): self {
+		return new self(
+			studentId:       Val::int( $row->student_id ),
+			amount:          Val::float( $row->amount ),
+			remaining:       Val::float( $row->remaining ),
+			currency:        Val::string( $row->currency ),
+			sourcePaymentId: Val::intOrNull( $row->source_payment_id ?? null ),
+			sourceLessonId:  Val::intOrNull( $row->source_lesson_id ?? null ),
+			reason:          Val::stringOrNull( $row->reason ?? null ),
+			status:          Val::string( $row->status ),
+			createdAt:       Val::stringOrNull( $row->created_at ?? null ),
+			updatedAt:       Val::stringOrNull( $row->updated_at ?? null ),
+			id:              Val::int( $row->id ),
+		);
+	}
+
+	public function isAvailable(): bool {
+		return self::STATUS_AVAILABLE === $this->status && $this->remaining > 0.0;
+	}
+
+	/**
+	 * Returns a plain array representation of the credit.
+	 *
+	 * @return array<string, mixed>
+	 */
+	public function toArray(): array {
+		return [
+			'id'                => $this->id,
+			'student_id'        => $this->studentId,
+			'amount'            => $this->amount,
+			'remaining'         => $this->remaining,
+			'currency'          => $this->currency,
+			'source_payment_id' => $this->sourcePaymentId,
+			'source_lesson_id'  => $this->sourceLessonId,
+			'reason'            => $this->reason,
+			'status'            => $this->status,
+			'created_at'        => $this->createdAt,
+			'updated_at'        => $this->updatedAt,
+		];
+	}
+}

src/Payment/CreditRepository.php

@@ -0,0 +1,149 @@
+<?php
+declare(strict_types=1);
+
+namespace Unsupervised\Schedular\Payment;
+
+class CreditRepository {
+
+	private string $table;
+
+	public function __construct( private \wpdb $db ) {
+		$this->table = $db->prefix . 'us_credits';
+	}
+
+	public function insert( Credit $credit ): int {
+		$this->db->insert(
+			$this->table,
+			[
+				'student_id'        => $credit->studentId,
+				'amount'            => $credit->amount,
+				'remaining'         => $credit->remaining,
+				'currency'          => $credit->currency,
+				'source_payment_id' => $credit->sourcePaymentId,
+				'source_lesson_id'  => $credit->sourceLessonId,
+				'reason'            => $credit->reason,
+				'status'            => $credit->status,
+				'created_at'        => current_time( 'mysql' ),
+			],
+			[ '%d', '%f', '%f', '%s', '%d', '%d', '%s', '%s', '%s' ]
+		);
+
+		return $this->db->insert_id;
+	}
+
+	public function findById( int $id ): ?Credit {
+		$row = $this->db->get_row(
+			$this->db->prepare( 'SELECT * FROM %i WHERE id = %d', $this->table, $id )
+		);
+
+		return $row ? Credit::fromRow( $row ) : null;
+	}
+
+	/**
+	 * Whether a credit has already been issued for a cancelled lesson, so cancelling
+	 * (or re-cancelling) the same lesson never grants a second credit.
+	 */
+	public function existsForLesson( int $lessonId ): bool {
+		$found = $this->db->get_var(
+			$this->db->prepare(
+				'SELECT id FROM %i WHERE source_lesson_id = %d LIMIT 1',
+				$this->table,
+				$lessonId
+			)
+		);
+
+		return null !== $found;
+	}
+
+	/**
+	 * A student's total unused credit balance (sum of the remaining amounts of every
+	 * still-available credit).
+	 */
+	public function availableBalance( int $studentId ): float {
+		$total = $this->db->get_var(
+			$this->db->prepare(
+				'SELECT COALESCE( SUM( remaining ), 0 ) FROM %i WHERE student_id = %d AND status = %s',
+				$this->table,
+				$studentId,
+				Credit::STATUS_AVAILABLE
+			)
+		);
+
+		return round( (float) $total, 2 );
+	}
+
+	/**
+	 * A student's still-available credits, oldest first — the FIFO order they are
+	 * consumed in.
+	 *
+	 * @return list<Credit>
+	 */
+	public function findAvailableByStudent( int $studentId ): array {
+		$rows = $this->db->get_results(
+			$this->db->prepare(
+				'SELECT * FROM %i WHERE student_id = %d AND status = %s AND remaining > 0 ORDER BY created_at ASC, id ASC',
+				$this->table,
+				$studentId,
+				Credit::STATUS_AVAILABLE
+			)
+		);
+
+		return array_map( Credit::fromRow( ... ), $rows ?? [] );
+	}
+
+	/**
+	 * Every credit for a student, newest first (admin history).
+	 *
+	 * @return list<Credit>
+	 */
+	public function findByStudent( int $studentId ): array {
+		$rows = $this->db->get_results(
+			$this->db->prepare(
+				'SELECT * FROM %i WHERE student_id = %d ORDER BY created_at DESC, id DESC',
+				$this->table,
+				$studentId
+			)
+		);
+
+		return array_map( Credit::fromRow( ... ), $rows ?? [] );
+	}
+
+	/**
+	 * Draw down a student's credit balance by $amount, consuming their available
+	 * credits oldest first and marking each fully-spent credit `consumed`. Stops once
+	 * the amount is exhausted; a balance shorter than $amount simply drains to zero.
+	 */
+	public function consume( int $studentId, float $amount ): void {
+		$remaining = round( $amount, 2 );
+		if ( $remaining <= 0.0 ) {
+			return;
+		}
+
+		foreach ( $this->findAvailableByStudent( $studentId ) as $credit ) {
+			if ( $remaining <= 0.0 ) {
+				break;
+			}
+			if ( null === $credit->id ) {
+				continue;
+			}
+
+			$take         = min( $credit->remaining, $remaining );
+			$newRemaining = round( $credit->remaining - $take, 2 );
+			$status       = $newRemaining <= 0.0 ? Credit::STATUS_CONSUMED : Credit::STATUS_AVAILABLE;
+
+			$this->db->update(
+				$this->table,
+				[
+					'remaining'  => $newRemaining,
+					'status'     => $status,
+					'updated_at' => current_time( 'mysql' ),
+				],
+				[ 'id' => $credit->id ],
+				[ '%f', '%s', '%s' ],
+				[ '%d' ]
+			);
+
+			$remaining = round( $remaining - $take, 2 );
+		}
+	}
+}

src/Payment/Payment.php

@@ -44,6 +44,7 @@ class Payment {
 		public readonly string $status = self::STATUS_PENDING,
 		public readonly float $taxRate = 0.0,
 		public readonly float $taxAmount = 0.0,
+		public readonly float $creditApplied = 0.0,
 		public readonly ?string $dueDate = null,
 		public readonly ?string $periodKey = null,
 		public readonly ?string $noticeBatch = null,
@@ -68,6 +69,7 @@ class Payment {
 			status:                Val::string( $row->status ),
 			taxRate:               Val::float( $row->tax_rate ),
 			taxAmount:             Val::float( $row->tax_amount ),
+			creditApplied:         Val::float( $row->credit_applied ?? 0 ),
 			dueDate:               Val::stringOrNull( $row->due_date ?? null ),
 			periodKey:             Val::stringOrNull( $row->period_key ?? null ),
 			noticeBatch:           Val::stringOrNull( $row->notice_batch ?? null ),
@@ -101,6 +103,14 @@ class Payment {
 		return round( $this->amount + $this->taxAmount, 2 );
 	}
 
+	/**
+	 * What the student still owes after any account credit applied to this payment.
+	 * The full `total()` less `creditApplied`, floored at zero.
+	 */
+	public function netDue(): float {
+		return round( max( 0.0, $this->total() - $this->creditApplied ), 2 );
+	}
+
 	/**
 	 * Minimal payment info embedded in registration-creation responses: enough
 	 * for the front end to decide whether (and how) to run the payment step.
@@ -132,6 +142,8 @@ class Payment {
 			'tax_rate'          => $this->taxRate,
 			'tax_amount'        => $this->taxAmount,
 			'total'             => $this->total(),
+			'credit_applied'    => $this->creditApplied,
+			'net_due'           => $this->netDue(),
 			'currency'          => $this->currency,
 			'method'            => $this->method,
 			'status'            => $this->status,

src/Payment/PaymentController.php

@@ -65,11 +65,13 @@ class PaymentController {
 
 			$student = get_userdata( $payment->studentId );
 
-			$groups[ $key ]['total_raw'] += $payment->total();
+			// Show what the student still owes — the amount less any account credit
+			// already applied to this payment.
+			$groups[ $key ]['total_raw'] += $payment->netDue();
 			$groups[ $key ]['rows'][]     = [
 				'id'              => (int) $payment->id,
 				'student'         => $student ? $student->display_name : (string) $payment->studentId,
-				'amount'          => number_format( $payment->amount, 2 ) . ' ' . $payment->currency,
+				'amount'          => number_format( $payment->netDue(), 2 ) . ' ' . $payment->currency,
 				'method'          => $payment->method,
 				'for'             => $payment->registrationType . ' #' . $payment->registrationId,
 				'etransfer_email' => (string) $payment->etransferEmail,

src/Payment/PaymentDueMailer.php

@@ -17,9 +17,10 @@ class PaymentDueMailer {
 	 * on a lump-sum e-transfer so the studio can reconcile it to these payments.
 	 *
 	 * @param list<array{label: string, amount: float, currency: string, due_date: ?string, etransfer_email: ?string}> $items
+	 * @param float                                                                                                    $creditApplied Account credit deducted from the total this notice covers.
 	 * @return bool False when there is no recipient or nothing to bill.
 	 */
-	public function send( \WP_User $student, array $items, string $reference = '' ): bool {
+	public function send( \WP_User $student, array $items, string $reference = '', float $creditApplied = 0.0 ): bool {
 		if ( '' === (string) $student->user_email || [] === $items ) {
 			return false;
 		}
@@ -48,16 +49,30 @@ class PaymentDueMailer {
 			}
 		}
 
+		// Account credit (from an earlier cancelled paid lesson) offsets the total.
+		$creditApplied = round( min( $creditApplied, $total ), 2 );
+		$dueTotal      = round( $total - $creditApplied, 2 );
+
 		$body = __( 'You have upcoming payments due:', 'unsupervised-schedular' ) . "\n\n"
-			. implode( "\n", $lines ) . "\n\n"
-			. sprintf(
+			. implode( "\n", $lines );
+
+		if ( $creditApplied > 0.0 ) {
+			$body .= "\n\n" . sprintf(
+				/* translators: 1: currency, 2: credit amount */
+				__( 'Account credit applied: -%1$s %2$s', 'unsupervised-schedular' ),
+				$currency,
+				number_format( $creditApplied, 2 )
+			);
+		}
+
+		$body .= "\n\n" . sprintf(
 			/* translators: 1: currency, 2: total amount */
 			__( 'Total due: %1$s %2$s', 'unsupervised-schedular' ),
 			$currency,
-				number_format( $total, 2 )
+			number_format( $dueTotal, 2 )
 		);
 
-		if ( [] !== $emails ) {
+		if ( $dueTotal > 0.0 && [] !== $emails ) {
 			$body .= "\n\n" . sprintf(
 				/* translators: %s: e-transfer destination email address(es) */
 				__( 'Please send your e-transfer to: %s', 'unsupervised-schedular' ),

src/Payment/PaymentRepository.php

@@ -25,6 +25,7 @@ class PaymentRepository {
 				'status'                   => $payment->status,
 				'tax_rate'                 => $payment->taxRate,
 				'tax_amount'               => $payment->taxAmount,
+				'credit_applied'           => $payment->creditApplied,
 				'due_date'                 => $payment->dueDate,
 				'period_key'               => $payment->periodKey,
 				'notice_batch'             => $payment->noticeBatch,
@@ -35,7 +36,7 @@ class PaymentRepository {
 				'paid_at'                  => $payment->paidAt,
 				'created_at'               => current_time( 'mysql' ),
 			],
-			[ '%d', '%d', '%s', '%d', '%f', '%s', '%s', '%s', '%f', '%f', '%s', '%s', '%s', '%s', '%s', '%s', '%s', '%s', '%s' ]
+			[ '%d', '%d', '%s', '%d', '%f', '%s', '%s', '%s', '%f', '%f', '%f', '%s', '%s', '%s', '%s', '%s', '%s', '%s', '%s', '%s' ]
 		);
 
 		return $this->db->insert_id;
@@ -77,6 +78,22 @@ class PaymentRepository {
 		);
 	}
 
+	/**
+	 * Add to the account credit applied against a payment, reducing what the student
+	 * still owes on it (`Payment::netDue()`). Accumulates, so a second application
+	 * adds to the first.
+	 */
+	public function addCreditApplied( int $id, float $amount ): bool {
+		$sql = $this->db->prepare(
+			'UPDATE %i SET credit_applied = credit_applied + %f WHERE id = %d',
+			$this->table,
+			$amount,
+			$id
+		);
+
+		return null !== $sql && false !== $this->db->query( $sql );
+	}
+
 	/**
 	 * Set a payment's tax rate and recompute the tax amount from its subtotal.
 	 */

src/Payment/PaymentService.php

@@ -21,6 +21,7 @@ class PaymentService {
 		private EnrollmentRepository $enrollments,
 		private StudioSettings $settings,
 		private StripeGateway $stripe,
+		private CreditRepository $credits,
 	) {}
 
 	/**
@@ -134,6 +135,135 @@ class PaymentService {
 		}
 	}
 
+	/**
+	 * Credit a student for a cancelled lesson they had already paid for. The credit
+	 * is one lesson's share of the covering payment's total (including tax) — the
+	 * whole total for a single-lesson payment, or `total ÷ lessons covered` for a
+	 * payment that spans several (a monthly scheduled charge, or a weekly series paid
+	 * upfront). The original payment is left untouched; the credit is applied to the
+	 * student's future scheduled-billing charges. Returns null when the lesson was
+	 * never paid, has no covering payment, or was already credited.
+	 */
+	public function creditForCancelledLesson( Lesson $lesson ): ?Credit {
+		if ( null === $lesson->id ) {
+			return null;
+		}
+
+		$paymentId = $lesson->paymentId;
+		if ( null === $paymentId && null !== $lesson->seriesId ) {
+			// Series lessons other than the anchor carry no payment_id of their own;
+			// the whole reservation is paid through the anchor's payment.
+			$anchor    = $this->payments->findByRegistration( Payment::REG_LESSON, $lesson->seriesId );
+			$paymentId = $anchor?->id;
+		}
+		if ( null === $paymentId ) {
+			return null;
+		}
+
+		$payment = $this->payments->findById( $paymentId );
+		if ( null === $payment || ! $payment->isPaid() ) {
+			return null;
+		}
+
+		if ( $this->credits->existsForLesson( $lesson->id ) ) {
+			return null;
+		}
+
+		$share = round( $payment->total() / $this->coveredLessonCount( $lesson, $payment ), 2 );
+		if ( $share <= 0.0 ) {
+			return null;
+		}
+
+		$id = $this->credits->insert(
+			new Credit(
+				studentId:       $payment->studentId,
+				amount:          $share,
+				remaining:       $share,
+				currency:        $payment->currency,
+				sourcePaymentId: $payment->id,
+				sourceLessonId:  $lesson->id,
+				reason:          sprintf(
+					/* translators: %d: cancelled lesson id */
+					__( 'Credit for cancelled lesson #%d', 'unsupervised-schedular' ),
+					$lesson->id
+				),
+			)
+		);
+
+		return $this->credits->findById( $id );
+	}
+
+	/**
+	 * How many lessons the covering payment was billed for, so its total can be split
+	 * into a per-lesson credit. A weekly series paid upfront (unscheduled) covers the
+	 * whole series; every other case — a single booking, a weekly scheduled lesson
+	 * (one payment each), or a monthly scheduled charge (payment linked to each
+	 * lesson) — is answered by how many lessons point at the payment. Never below one.
+	 */
+	private function coveredLessonCount( Lesson $lesson, Payment $payment ): int {
+		if ( ! $payment->isScheduled() && null !== $lesson->seriesId ) {
+			return max( 1, $this->bookings->countBySeries( $lesson->seriesId ) );
+		}
+
+		return max( 1, $this->bookings->countByPaymentId( (int) $payment->id ) );
+	}
+
+	/**
+	 * Apply a student's available credit balance against a set of freshly-created
+	 * pending payments (the ones a billing scan just generated for them), oldest
+	 * charge first. Each payment's `credit_applied` is raised by the amount covered;
+	 * a payment fully covered is marked paid-by-credit and its registration confirmed
+	 * so it leaves the confirmation queue. The credit ledger is drawn down by the
+	 * total applied. Returns a map of payment id to the credit applied to it, so the
+	 * caller can reflect the reduction on the student's notice.
+	 *
+	 * @param list<Payment> $payments
+	 * @return array<int, float>
+	 */
+	public function applyCredits( int $studentId, array $payments ): array {
+		$balance = $this->credits->availableBalance( $studentId );
+		if ( $balance <= 0.0 ) {
+			return [];
+		}
+
+		$applied  = [];
+		$consumed = 0.0;
+
+		foreach ( $payments as $payment ) {
+			if ( null === $payment->id || $balance <= 0.0 ) {
+				continue;
+			}
+
+			$owing = $payment->netDue();
+			if ( $owing <= 0.0 ) {
+				continue;
+			}
+
+			$amount = round( min( $balance, $owing ), 2 );
+			if ( $amount <= 0.0 ) {
+				continue;
+			}
+
+			$this->payments->addCreditApplied( $payment->id, $amount );
+
+			// Fully covered by credit: settle it so it drops out of the pending queue.
+			if ( $amount >= $owing ) {
+				$this->payments->markPaid( $payment->id, 'USC-' . $payment->id );
+				$this->confirmRegistration( $payment->registrationType, $payment->registrationId );
+			}
+
+			$applied[ $payment->id ] = $amount;
+			$balance                 = round( $balance - $amount, 2 );
+			$consumed                = round( $consumed + $amount, 2 );
+		}
+
+		if ( $consumed > 0.0 ) {
+			$this->credits->consume( $studentId, $consumed );
+		}
+
+		return $applied;
+	}
+
 	/**
 	 * Resolve the client-side payment step for a freshly created registration.
 	 * For a card payment a Stripe PaymentIntent is created (or replayed

src/Payment/ScheduledBillingRunner.php

@@ -44,16 +44,16 @@ class ScheduledBillingRunner {
 
 		// One notice bucket per student, filled as pending payments are created and
 		// flushed to a single email at the end, so a student billed for several
-		// lessons on one day is emailed once — never once per lesson. $batchIds
-		// tracks the payment ids behind each student's bucket so they can be tagged
-		// with a shared reference for lump-sum e-transfer reconciliation.
+		// lessons on one day is emailed once — never once per lesson. Each entry keeps
+		// the created payment and its label; credits are applied across the whole
+		// bucket before the notice is built, so a student's account credit offsets the
+		// run's charges oldest-first.
 		$buckets = [];
-		$batchIds = [];
 
-		$this->billPrivateLessons( $now, $buckets, $batchIds );
-		$this->billGroupEnrollments( $now, $buckets, $batchIds );
+		$this->billPrivateLessons( $now, $buckets );
+		$this->billGroupEnrollments( $now, $buckets );
 
-		$this->sendNotices( $buckets, $batchIds );
+		$this->sendNotices( $buckets );
 	}
 
 	/**
@@ -61,10 +61,9 @@ class ScheduledBillingRunner {
 	 * are within 24 hours; monthly lessons are grouped per calendar month and billed
 	 * one payment for the month once its 1st has arrived.
 	 *
-	 * @param array<int, list<array{label: string, amount: float, currency: string, due_date: ?string, etransfer_email: ?string}>> $buckets
-	 * @param array<int, list<int>> $batchIds
+	 * @param array<int, list<array{payment: Payment, label: string}>> $buckets
 	 */
-	private function billPrivateLessons( \DateTimeImmutable $now, array &$buckets, array &$batchIds ): void {
+	private function billPrivateLessons( \DateTimeImmutable $now, array &$buckets ): void {
 		$today   = $now->format( 'Y-m-d' );
 		$monthly = [];
 
@@ -109,7 +108,6 @@ class ScheduledBillingRunner {
 
 			$this->bill(
 				$buckets,
-				$batchIds,
 				Payment::REG_LESSON,
 				$lessonId,
 				$studentId,
@@ -123,7 +121,7 @@ class ScheduledBillingRunner {
 			);
 		}
 
-		$this->billMonthlyLessonGroups( $today, $monthly, $buckets, $batchIds );
+		$this->billMonthlyLessonGroups( $today, $monthly, $buckets );
 	}
 
 	/**
@@ -132,10 +130,9 @@ class ScheduledBillingRunner {
 	 * lesson in the group; the rest are pointed at it so they are not re-billed.
 	 *
 	 * @param array<string, list<array{lesson_id: int, student_id: int, instructor_id: int, currency: string, etransfer: ?string, title: string, price: float, start: \DateTimeImmutable}>> $monthly
-	 * @param array<int, list<array{label: string, amount: float, currency: string, due_date: ?string, etransfer_email: ?string}>> $buckets
-	 * @param array<int, list<int>> $batchIds
+	 * @param array<int, list<array{payment: Payment, label: string}>> $buckets
 	 */
-	private function billMonthlyLessonGroups( string $today, array $monthly, array &$buckets, array &$batchIds ): void {
+	private function billMonthlyLessonGroups( string $today, array $monthly, array &$buckets ): void {
 		foreach ( $monthly as $group ) {
 			$first      = $group[0]['start'];
 			$monthStart = $first->format( 'Y-m-01' );
@@ -151,7 +148,6 @@ class ScheduledBillingRunner {
 
 			$payment = $this->bill(
 				$buckets,
-				$batchIds,
 				Payment::REG_LESSON,
 				$anchorId,
 				$group[0]['student_id'],
@@ -188,10 +184,9 @@ class ScheduledBillingRunner {
 	 * per month (on the 1st) for that month's sessions. Dedup is by `period_key`
 	 * since a single enrolment maps to many periodic charges.
 	 *
-	 * @param array<int, list<array{label: string, amount: float, currency: string, due_date: ?string, etransfer_email: ?string}>> $buckets
-	 * @param array<int, list<int>> $batchIds
+	 * @param array<int, list<array{payment: Payment, label: string}>> $buckets
 	 */
-	private function billGroupEnrollments( \DateTimeImmutable $now, array &$buckets, array &$batchIds ): void {
+	private function billGroupEnrollments( \DateTimeImmutable $now, array &$buckets ): void {
 		$today     = $now->format( 'Y-m-d' );
 		$offerings = [];
 
@@ -211,9 +206,9 @@ class ScheduledBillingRunner {
 			}
 
 			if ( Offering::BILLING_MONTHLY === $offering->billingMode ) {
-				$this->billGroupMonthly( $now, $today, $enrollment, $offering, $windows, $buckets, $batchIds );
+				$this->billGroupMonthly( $now, $today, $enrollment, $offering, $windows, $buckets );
 			} else {
-				$this->billGroupWeekly( $now, $enrollment, $offering, $windows, $buckets, $batchIds );
+				$this->billGroupWeekly( $now, $enrollment, $offering, $windows, $buckets );
 			}
 		}
 	}
@@ -222,10 +217,9 @@ class ScheduledBillingRunner {
 	 * Bill one payment per group-class session that is now within 24 hours.
 	 *
 	 * @param list<array{start: string, end: string}> $windows
-	 * @param array<int, list<array{label: string, amount: float, currency: string, due_date: ?string, etransfer_email: ?string}>> $buckets
-	 * @param array<int, list<int>> $batchIds
+	 * @param array<int, list<array{payment: Payment, label: string}>> $buckets
 	 */
-	private function billGroupWeekly( \DateTimeImmutable $now, Enrollment $enrollment, Offering $offering, array $windows, array &$buckets, array &$batchIds ): void {
+	private function billGroupWeekly( \DateTimeImmutable $now, Enrollment $enrollment, Offering $offering, array $windows, array &$buckets ): void {
 		foreach ( $windows as $window ) {
 			$start = new \DateTimeImmutable( $window['start'] );
 			$due   = $start->modify( '-1 day' );
@@ -240,7 +234,6 @@ class ScheduledBillingRunner {
 
 			$this->bill(
 				$buckets,
-				$batchIds,
 				Payment::REG_ENROLLMENT,
 				(int) $enrollment->id,
 				$enrollment->studentId,
@@ -259,10 +252,9 @@ class ScheduledBillingRunner {
 	 * Bill one payment per calendar month of a group class, once its 1st arrives.
 	 *
 	 * @param list<array{start: string, end: string}> $windows
-	 * @param array<int, list<array{label: string, amount: float, currency: string, due_date: ?string, etransfer_email: ?string}>> $buckets
-	 * @param array<int, list<int>> $batchIds
+	 * @param array<int, list<array{payment: Payment, label: string}>> $buckets
 	 */
-	private function billGroupMonthly( \DateTimeImmutable $now, string $today, Enrollment $enrollment, Offering $offering, array $windows, array &$buckets, array &$batchIds ): void { // phpcs:ignore Generic.CodeAnalysis.UnusedFunctionParameter.Found
+	private function billGroupMonthly( \DateTimeImmutable $now, string $today, Enrollment $enrollment, Offering $offering, array $windows, array &$buckets ): void { // phpcs:ignore Generic.CodeAnalysis.UnusedFunctionParameter.Found
 		// Count this enrolment's sessions per calendar month.
 		$months = [];
 		foreach ( $windows as $window ) {
@@ -282,7 +274,6 @@ class ScheduledBillingRunner {
 
 			$this->bill(
 				$buckets,
-				$batchIds,
 				Payment::REG_ENROLLMENT,
 				(int) $enrollment->id,
 				$enrollment->studentId,
@@ -305,46 +296,72 @@ class ScheduledBillingRunner {
 
 	/**
 	 * Create one scheduled payment and, when it is pending (not a comp auto-pay),
-	 * add an itemised line to the student's notice bucket and record its payment id
-	 * for the shared notice batch. Returns the created payment, or null when there
-	 * was nothing to charge.
+	 * add it to the student's notice bucket with the label to show on the notice.
+	 * Credits are applied later, once the whole bucket is known. Returns the created
+	 * payment, or null when there was nothing to charge.
 	 *
-	 * @param array<int, list<array{label: string, amount: float, currency: string, due_date: ?string, etransfer_email: ?string}>> $buckets
-	 * @param array<int, list<int>> $batchIds
+	 * @param array<int, list<array{payment: Payment, label: string}>> $buckets
 	 */
-	private function bill( array &$buckets, array &$batchIds, string $type, int $registrationId, int $studentId, int $instructorId, float $amount, string $currency, ?string $etransferEmail, string $dueDate, string $periodKey, string $label ): ?Payment {
+	private function bill( array &$buckets, string $type, int $registrationId, int $studentId, int $instructorId, float $amount, string $currency, ?string $etransferEmail, string $dueDate, string $periodKey, string $label ): ?Payment {
 		$payment = $this->payments->createForRegistration( $type, $registrationId, $studentId, $instructorId, $amount, $currency, $etransferEmail, $dueDate, $periodKey );
 
 		if ( null !== $payment && null !== $payment->id && Payment::STATUS_PENDING === $payment->status ) {
 			$buckets[ $studentId ][] = [
+				'payment' => $payment,
 				'label'   => $label,
-				'amount'          => $payment->total(),
-				'currency'        => $payment->currency,
-				'due_date'        => $payment->dueDate,
-				'etransfer_email' => $payment->etransferEmail,
 			];
-			$batchIds[ $studentId ][] = $payment->id;
 		}
 
 		return $payment;
 	}
 
 	/**
-	 * Tag each student's payments with a shared batch reference and email them one
-	 * itemised notice quoting it, so a lump-sum e-transfer can be reconciled to the
-	 * exact pending payments it covers.
+	 * For each student, apply any account credit they hold against the run's charges,
+	 * tag the payments they still owe with a shared batch reference, and email them
+	 * one itemised notice. The notice lists each charge at its full amount, then the
+	 * credit applied and the reduced total due; a charge fully covered by credit is
+	 * already settled and carries no reference. A lump-sum e-transfer for the balance
+	 * reconciles to the reference.
 	 *
-	 * @param array<int, list<array{label: string, amount: float, currency: string, due_date: ?string, etransfer_email: ?string}>> $buckets
-	 * @param array<int, list<int>> $batchIds
+	 * @param array<int, list<array{payment: Payment, label: string}>> $buckets
 	 */
-	private function sendNotices( array $buckets, array $batchIds ): void {
-		foreach ( $buckets as $studentId => $items ) {
-			$reference = $this->reference();
-			$this->payments->assignNoticeBatch( $batchIds[ $studentId ] ?? [], $reference );
+	private function sendNotices( array $buckets ): void {
+		foreach ( $buckets as $studentId => $entries ) {
+			$payments = array_map( static fn( array $entry ): Payment => $entry['payment'], $entries );
+			$applied  = $this->payments->applyCredits( $studentId, $payments );
+
+			$items       = [];
+			$batchIds    = [];
+			$creditTotal = 0.0;
+
+			foreach ( $entries as $entry ) {
+				$payment  = $entry['payment'];
+				$id       = (int) $payment->id;
+				$credited = $applied[ $id ] ?? 0.0;
+
+				$creditTotal += $credited;
+
+				$items[] = [
+					'label'           => $entry['label'],
+					'amount'          => $payment->total(),
+					'currency'        => $payment->currency,
+					'due_date'        => $payment->dueDate,
+					'etransfer_email' => $payment->etransferEmail,
+				];
+
+				// A charge still carrying a balance is what a lump-sum e-transfer covers;
+				// one fully settled by credit needs no reconciliation reference.
+				if ( round( $payment->total() - $credited, 2 ) > 0.0 ) {
+					$batchIds[] = $id;
+				}
+			}
+
+			$reference = [] !== $batchIds ? $this->reference() : '';
+			$this->payments->assignNoticeBatch( $batchIds, $reference );
 
 			$user = get_userdata( $studentId );
 			if ( $user instanceof \WP_User ) {
-				$this->mailer->send( $user, $items, $reference );
+				$this->mailer->send( $user, $items, $reference, round( $creditTotal, 2 ) );
 			}
 		}
 	}

src/Plugin.php

@@ -10,6 +10,7 @@ use Unsupervised\Schedular\Auth\RegistrationLoginGate;
 use Unsupervised\Schedular\Auth\RegistrationMailer;
 use Unsupervised\Schedular\Auth\RegistrationPage;
 use Unsupervised\Schedular\Auth\RoleManager;
+use Unsupervised\Schedular\Auth\StudentAdminGuard;
 use Unsupervised\Schedular\Booking\BookingPage;
 use Unsupervised\Schedular\Availability\AvailabilityRepository;
 use Unsupervised\Schedular\Booking\BookingRepository;
@@ -18,6 +19,7 @@ use Unsupervised\Schedular\GroupClass\GroupAccessRepository;
 use Unsupervised\Schedular\GroupClass\GroupClassPage;
 use Unsupervised\Schedular\Offering\OfferingRepository;
 use Unsupervised\Schedular\Payment\BillingMethodResolver;
+use Unsupervised\Schedular\Payment\CreditRepository;
 use Unsupervised\Schedular\Payment\PaymentRepository;
 use Unsupervised\Schedular\Payment\PaymentDueMailer;
 use Unsupervised\Schedular\Payment\PaymentService;
@@ -54,6 +56,16 @@ class Plugin {
 		$bookings     = new BookingRepository( $wpdb );
 		$offerings    = new OfferingRepository( $wpdb );
 		$questions    = new QuestionRepository( $wpdb );
+
+		// One-time repair for sites where dbDelta left us_questions.offering_id
+		// NOT NULL (it does not reliably relax NULL-ability), which breaks
+		// account-scope registration questions. Guarded by its own flag rather
+		// than the version gate, since affected sites may already be on the
+		// current version. The flag is only set once the ALTER succeeds.
+		if ( '1' !== get_option( 'us_questions_offering_nullable', '' ) && $questions->ensureOfferingNullable() ) {
+			update_option( 'us_questions_offering_nullable', '1' );
+		}
+
 		$answers          = new AnswerRepository( $wpdb );
 		$policies         = new PolicyRepository( $wpdb );
 		$policyVersions   = new PolicyVersionRepository( $wpdb );
@@ -65,10 +77,11 @@ class Plugin {
 		$registrationGate = new RegistrationGate( $questions, $answers, $policies, $policyVersions, $acceptances );
 
 		$paymentRepo    = new PaymentRepository( $wpdb );
+		$creditRepo     = new CreditRepository( $wpdb );
 		$settings       = new StudioSettings();
 		$resolver       = new BillingMethodResolver( $settings );
 		$stripe         = new StripeGateway( $settings );
-		$paymentService = new PaymentService( $paymentRepo, $resolver, new ReceiptMailer(), $bookings, $enrollments, $settings, $stripe );
+		$paymentService = new PaymentService( $paymentRepo, $resolver, new ReceiptMailer(), $bookings, $enrollments, $settings, $stripe, $creditRepo );
 
 		// The shortcode and block wrappers share the same page objects so
 		// front-end output is identical whichever way a page embeds them.
@@ -84,8 +97,9 @@ class Plugin {
 		( new UpdateChecker() )->register();
 		( new RoleManager() )->register();
 		( new RegistrationLoginGate() )->register();
+		( new StudentAdminGuard() )->register();
 		( new EmailConfirmationHandler( $settings, $registrationMailer ) )->register();
-		( new AdminMenu( $availability, $bookings, $offerings, $questions, $answers, $policies, $policyVersions, $policyService, $acceptances, $invites, $enrollments, $groupAccess, $settings, $paymentRepo, $paymentService, $resolver, $registrationMailer ) )->register();
+		( new AdminMenu( $availability, $bookings, $offerings, $questions, $answers, $policies, $policyVersions, $policyService, $acceptances, $invites, $enrollments, $groupAccess, $settings, $paymentRepo, $paymentService, $resolver, $registrationMailer, $creditRepo ) )->register();
 		( new RestRegistrar( $availability, $bookings, $offerings, $questions, $policies, $policyVersions, $policyService, $registrationGate, $enrollments, $groupAccess, $paymentService ) )->register();
 		( new ShortcodeRegistrar( $bookingPage, $loginPage, $registrationPage, $groupClassPage ) )->register();
 		( new BlockRegistrar( $bookingPage, $loginPage, $registrationPage, $groupClassPage ) )->register();

src/Policy/Policy.php

@@ -18,6 +18,12 @@ class Policy {
 	 */
 	public const VALID_SCOPES = [ self::SCOPE_SIGNUP, self::SCOPE_BOOKING, self::SCOPE_BOTH ];
 
+	/** Maximum length of the title, matching the `title` VARCHAR(191) column. */
+	public const MAX_TITLE_LENGTH = 191;
+
+	/** Maximum length of the slug, matching the `slug` VARCHAR(191) column. */
+	public const MAX_SLUG_LENGTH = 191;
+
 	public function __construct(
 		public readonly string $title,
 		public readonly string $slug,

src/Policy/PolicyController.php

@@ -47,7 +47,9 @@ class PolicyController {
 				$scope = Policy::SCOPE_BOOKING;
 			}
 
-			if ( '' !== $title && '' !== $slug && null === $this->policies->findBySlug( $slug ) ) {
+			$withinLimits = mb_strlen( $title ) <= Policy::MAX_TITLE_LENGTH && mb_strlen( $slug ) <= Policy::MAX_SLUG_LENGTH;
+
+			if ( '' !== $title && '' !== $slug && $withinLimits && null === $this->policies->findBySlug( $slug ) ) {
 				$this->service->createPolicy( $title, $slug, $scope );
 			}
 

src/Policy/PolicyEndpoint.php

@@ -118,12 +118,30 @@ class PolicyEndpoint {
 		if ( '' === $title ) {
 			return $this->invalid( __( 'A policy title is required.', 'unsupervised-schedular' ) );
 		}
+		if ( mb_strlen( $title ) > Policy::MAX_TITLE_LENGTH ) {
+			return $this->invalid(
+				sprintf(
+					/* translators: %d: maximum character count. */
+					__( 'The policy title must be %d characters or fewer.', 'unsupervised-schedular' ),
+					Policy::MAX_TITLE_LENGTH
+				)
+			);
+		}
 
 		$slugParam = sanitize_text_field( Val::string( $request->get_param( 'slug' ) ) );
 		$slug      = sanitize_title( '' !== $slugParam ? $slugParam : $title );
 		if ( '' === $slug ) {
 			return $this->invalid( __( 'A valid policy slug is required.', 'unsupervised-schedular' ) );
 		}
+		if ( mb_strlen( $slug ) > Policy::MAX_SLUG_LENGTH ) {
+			return $this->invalid(
+				sprintf(
+					/* translators: %d: maximum character count. */
+					__( 'The policy slug must be %d characters or fewer.', 'unsupervised-schedular' ),
+					Policy::MAX_SLUG_LENGTH
+				)
+			);
+		}
 
 		if ( null !== $this->policies->findBySlug( $slug ) ) {
 			return new \WP_Error( 'duplicate_slug', __( 'A policy with that slug already exists.', 'unsupervised-schedular' ), [ 'status' => 409 ] );

src/Registration/Question.php

@@ -12,6 +12,9 @@ class Question {
 	public const FIELD_SELECT   = 'select';
 	public const FIELD_CHECKBOX = 'checkbox';
 
+	/** Maximum length of a question label, matching the `label` VARCHAR(255) column. */
+	public const MAX_LABEL_LENGTH = 255;
+
 	/** Question is scoped to a single offering, asked at booking/enrolment time. */
 	public const SCOPE_OFFERING = 'offering';
 

src/Registration/QuestionController.php

@@ -85,7 +85,7 @@ class QuestionController {
 		$label     = sanitize_text_field( Val::string( wp_unslash( $_POST['label'] ?? '' ) ) );
 		$fieldType = sanitize_key( Val::string( wp_unslash( $_POST['field_type'] ?? Question::FIELD_TEXT ) ) );
 
-		if ( '' === $label || ! in_array( $fieldType, Question::VALID_FIELD_TYPES, true ) ) {
+		if ( '' === $label || mb_strlen( $label ) > Question::MAX_LABEL_LENGTH || ! in_array( $fieldType, Question::VALID_FIELD_TYPES, true ) ) {
 			return;
 		}
 

src/Registration/QuestionEndpoint.php

@@ -79,6 +79,9 @@ class QuestionEndpoint {
 		if ( '' === $label ) {
 			return $this->invalid( __( 'A question label is required.', 'unsupervised-schedular' ) );
 		}
+		if ( mb_strlen( $label ) > Question::MAX_LABEL_LENGTH ) {
+			return $this->invalid( $this->tooLongMessage( __( 'question', 'unsupervised-schedular' ), Question::MAX_LABEL_LENGTH ) );
+		}
 
 		$fieldType = Val::string( $request->get_param( 'field_type' ) ?? Question::FIELD_TEXT );
 		if ( ! in_array( $fieldType, Question::VALID_FIELD_TYPES, true ) ) {
@@ -118,9 +121,17 @@ class QuestionEndpoint {
 			return $this->invalid( __( 'Invalid field type.', 'unsupervised-schedular' ) );
 		}
 
+		$label = $request->has_param( 'label' ) ? sanitize_text_field( Val::string( $request->get_param( 'label' ) ) ) : $existing->label;
+		if ( '' === $label ) {
+			return $this->invalid( __( 'A question label is required.', 'unsupervised-schedular' ) );
+		}
+		if ( mb_strlen( $label ) > Question::MAX_LABEL_LENGTH ) {
+			return $this->invalid( $this->tooLongMessage( __( 'question', 'unsupervised-schedular' ), Question::MAX_LABEL_LENGTH ) );
+		}
+
 		$question = new Question(
 			offeringId: $existing->offeringId,
-			label:      $request->has_param( 'label' ) ? sanitize_text_field( Val::string( $request->get_param( 'label' ) ) ) : $existing->label,
+			label:      $label,
 			fieldType:  $fieldType,
 			options:    $request->has_param( 'options' ) ? $this->sanitizeOptions( $request->get_param( 'options' ) ) : $existing->options,
 			isRequired: $request->has_param( 'is_required' ) ? (bool) $request->get_param( 'is_required' ) : $existing->isRequired,
@@ -217,4 +228,16 @@ class QuestionEndpoint {
 	private function invalid( string $message ): \WP_Error {
 		return new \WP_Error( 'invalid_question', $message, [ 'status' => 400 ] );
 	}
+
+	/**
+	 * Build a uniform "too long" validation message for a named field.
+	 */
+	private function tooLongMessage( string $field, int $max ): string {
+		return sprintf(
+			/* translators: 1: field name, 2: maximum character count. */
+			__( 'The %1$s must be %2$d characters or fewer.', 'unsupervised-schedular' ),
+			$field,
+			$max
+		);
+	}
 }

src/Registration/QuestionRepository.php

@@ -106,4 +106,26 @@ class QuestionRepository {
 			[ '%d' ]
 		);
 	}
+
+	/**
+	 * Relax `offering_id` to allow NULL for account-scope questions (which are
+	 * not tied to an offering).
+	 *
+	 * The account-questions feature (v1.1.0) made the column nullable in the
+	 * schema, but dbDelta does not reliably change a column from NOT NULL to
+	 * NULL, so sites created before then keep the old NOT NULL column and reject
+	 * account-scope inserts with "Column 'offering_id' cannot be null". This
+	 * MODIFY is idempotent — re-applying the nullable definition is a no-op.
+	 *
+	 * @return bool True when the statement ran (or was already applied), false
+	 *              if it could not be prepared or the query failed.
+	 */
+	public function ensureOfferingNullable(): bool {
+		$sql = $this->db->prepare(
+			'ALTER TABLE %i MODIFY offering_id BIGINT UNSIGNED NULL DEFAULT NULL',
+			$this->table
+		);
+
+		return null !== $sql && false !== $this->db->query( $sql );
+	}
 }

src/Schema.php

@@ -65,6 +65,7 @@ class Schema {
                 term_end         DATE            DEFAULT NULL,
                 class_time       TIME            DEFAULT NULL,
                 enrollment_deadline DATE         DEFAULT NULL,
+                withdrawal_deadline DATE         DEFAULT NULL,
                 schedule_note    VARCHAR(191)    DEFAULT NULL,
                 etransfer_email  VARCHAR(191)    DEFAULT NULL,
                 cancellation_cutoff_hours SMALLINT UNSIGNED DEFAULT NULL,
@@ -159,6 +160,7 @@ class Schema {
                 status                   VARCHAR(20)     NOT NULL DEFAULT 'pending',
                 tax_rate                 DECIMAL(5,2)    NOT NULL DEFAULT 0,
                 tax_amount               DECIMAL(10,2)   NOT NULL DEFAULT 0,
+                credit_applied           DECIMAL(10,2)   NOT NULL DEFAULT 0,
                 due_date                 DATE            DEFAULT NULL,
                 period_key               VARCHAR(20)     DEFAULT NULL,
                 notice_batch             VARCHAR(32)     DEFAULT NULL,
@@ -175,6 +177,24 @@ class Schema {
                 KEY status (status)
             ) {$charset};",
 
+			"CREATE TABLE {$prefix}us_credits (
+                id                BIGINT UNSIGNED NOT NULL AUTO_INCREMENT,
+                student_id        BIGINT UNSIGNED NOT NULL,
+                amount            DECIMAL(10,2)   NOT NULL DEFAULT 0,
+                remaining         DECIMAL(10,2)   NOT NULL DEFAULT 0,
+                currency          VARCHAR(3)      NOT NULL DEFAULT 'CAD',
+                source_payment_id BIGINT UNSIGNED DEFAULT NULL,
+                source_lesson_id  BIGINT UNSIGNED DEFAULT NULL,
+                reason            VARCHAR(191)    DEFAULT NULL,
+                status            VARCHAR(20)     NOT NULL DEFAULT 'available',
+                created_at        DATETIME        NOT NULL,
+                updated_at        DATETIME        DEFAULT NULL,
+                PRIMARY KEY (id),
+                KEY student_id (student_id),
+                KEY status (status),
+                KEY source_lesson_id (source_lesson_id)
+            ) {$charset};",
+
 			"CREATE TABLE {$prefix}us_group_enrollments (
                 id            BIGINT UNSIGNED NOT NULL AUTO_INCREMENT,
                 offering_id   BIGINT UNSIGNED NOT NULL,

src/ShortcodeRegistrar.php

@@ -23,6 +23,9 @@ class ShortcodeRegistrar {
 		add_shortcode( 'us_student_login', self::shortcode( [ $this->loginPage, 'render' ] ) );
 		add_shortcode( 'us_student_register', self::shortcode( [ $this->registrationPage, 'render' ] ) );
 		add_shortcode( 'us_group_classes', self::shortcode( [ $this->groupClassPage, 'render' ] ) );
+		// Process registration submissions before output so the invite branch's
+		// auth cookie is actually sent (render() runs too late, during the_content).
+		add_action( 'template_redirect', [ $this->registrationPage, 'maybeHandleSubmit' ] );
 		add_action( 'template_redirect', [ $this->registrationPage, 'maybeRedirectToRegistrationPage' ] );
 		add_action( 'wp_enqueue_scripts', [ $this, 'enqueueAssets' ] );
 	}

templates/admin/offerings.php

@@ -45,7 +45,7 @@ if ($editing && null !== $editing->termStart && null !== $editing->termEnd && $e
         <table class="form-table">
             <tr>
                 <th><label for="title"><?php esc_html_e('Title', 'unsupervised-schedular'); ?></label></th>
-                <td><input type="text" name="title" id="title" class="regular-text" required value="<?php echo esc_attr($editing->title ?? ''); ?>"></td>
+                <td><input type="text" name="title" id="title" class="regular-text" maxlength="<?php echo esc_attr((string) Offering::MAX_TITLE_LENGTH); ?>" required value="<?php echo esc_attr($editing->title ?? ''); ?>"></td>
             </tr>
             <tr>
                 <th><label for="kind"><?php esc_html_e('Kind', 'unsupervised-schedular'); ?></label></th>
@@ -92,36 +92,43 @@ if ($editing && null !== $editing->termStart && null !== $editing->termEnd && $e
                     </select>
                 </td>
             </tr>
-            <tr>
+            <tr class="us-private-only">
                 <th><?php esc_html_e('Weekly reservation', 'unsupervised-schedular'); ?></th>
                 <td><label><input type="checkbox" name="allow_weekly" value="1" <?php echo $editing && $editing->allowWeekly ? 'checked' : ''; ?>> <?php esc_html_e('Allow weekly recurring reservation (private)', 'unsupervised-schedular'); ?></label></td>
             </tr>
-            <tr>
+            <tr class="us-group-only">
                 <th><label for="capacity"><?php esc_html_e('Capacity', 'unsupervised-schedular'); ?></label></th>
                 <td><input type="number" name="capacity" id="capacity" min="0" step="1" value="<?php echo esc_attr((string) ($editing->capacity ?? '')); ?>"> <span class="description"><?php esc_html_e('Group classes only', 'unsupervised-schedular'); ?></span></td>
             </tr>
-            <tr>
+            <tr class="us-group-only">
                 <th><label for="term_start"><?php esc_html_e('Start date', 'unsupervised-schedular'); ?></label></th>
                 <td>
                     <input type="date" name="term_start" id="term_start" value="<?php echo esc_attr($editing->termStart ?? ''); ?>">
                     <span class="description"><?php esc_html_e('Group classes only — date of the first class', 'unsupervised-schedular'); ?></span>
                 </td>
             </tr>
-            <tr>
+            <tr class="us-group-only">
                 <th><label for="class_time"><?php esc_html_e('Class time', 'unsupervised-schedular'); ?></label></th>
                 <td>
                     <input type="time" name="class_time" id="class_time" value="<?php echo esc_attr(null === ($editing->classTime ?? null) ? '' : substr((string) $editing->classTime, 0, 5)); ?>">
                     <span class="description"><?php esc_html_e('Group classes only — the time each session starts. Combined with the duration to block the instructor’s availability.', 'unsupervised-schedular'); ?></span>
                 </td>
             </tr>
-            <tr>
+            <tr class="us-group-only">
                 <th><label for="enrollment_deadline"><?php esc_html_e('Enrolment deadline', 'unsupervised-schedular'); ?></label></th>
                 <td>
                     <input type="date" name="enrollment_deadline" id="enrollment_deadline" value="<?php echo esc_attr($editing->enrollmentDeadline ?? ''); ?>">
                     <p class="description"><?php esc_html_e('Group classes only — the last day students may enrol. Leave blank to default to the first day of the class.', 'unsupervised-schedular'); ?></p>
                 </td>
             </tr>
-            <tr>
+            <tr class="us-group-only">
+                <th><label for="withdrawal_deadline"><?php esc_html_e('Withdrawal deadline', 'unsupervised-schedular'); ?></label></th>
+                <td>
+                    <input type="date" name="withdrawal_deadline" id="withdrawal_deadline" value="<?php echo esc_attr($editing->withdrawalDeadline ?? ''); ?>">
+                    <p class="description"><?php esc_html_e('Group classes only — the last day a student may withdraw themselves. A withdrawal on or before this day frees the seat and voids any pending payment without crediting the student; after it, students can no longer withdraw online. Leave blank to allow withdrawal any time.', 'unsupervised-schedular'); ?></p>
+                </td>
+            </tr>
+            <tr class="us-group-only">
                 <th><?php esc_html_e('Sessions', 'unsupervised-schedular'); ?></th>
                 <td>
                     <label><input type="radio" name="term_recurrence" value="single" <?php echo 'single' === $termRecurrence ? 'checked' : ''; ?>> <?php esc_html_e('One-off', 'unsupervised-schedular'); ?></label>
@@ -131,13 +138,13 @@ if ($editing && null !== $editing->termStart && null !== $editing->termEnd && $e
                     <p class="description"><?php esc_html_e('The end date is calculated from the start date and the number of weekly sessions.', 'unsupervised-schedular'); ?></p>
                 </td>
             </tr>
-            <tr>
+            <tr class="us-group-only">
                 <th><label for="schedule_note"><?php esc_html_e('Schedule note', 'unsupervised-schedular'); ?></label></th>
-                <td><input type="text" name="schedule_note" id="schedule_note" class="regular-text" placeholder="<?php esc_attr_e('e.g. Tuesdays 4:00pm', 'unsupervised-schedular'); ?>" value="<?php echo esc_attr($editing->scheduleNote ?? ''); ?>"></td>
+                <td><input type="text" name="schedule_note" id="schedule_note" class="regular-text" maxlength="<?php echo esc_attr((string) Offering::MAX_SCHEDULE_NOTE_LENGTH); ?>" placeholder="<?php esc_attr_e('e.g. Tuesdays 4:00pm', 'unsupervised-schedular'); ?>" value="<?php echo esc_attr($editing->scheduleNote ?? ''); ?>"></td>
             </tr>
             <tr>
                 <th><label for="etransfer_email"><?php esc_html_e('E-transfer email', 'unsupervised-schedular'); ?></label></th>
-                <td><input type="email" name="etransfer_email" id="etransfer_email" class="regular-text" placeholder="<?php esc_attr_e('Overrides the studio default', 'unsupervised-schedular'); ?>" value="<?php echo esc_attr($editing->etransferEmail ?? ''); ?>"></td>
+                <td><input type="email" name="etransfer_email" id="etransfer_email" class="regular-text" maxlength="<?php echo esc_attr((string) Offering::MAX_ETRANSFER_EMAIL_LENGTH); ?>" placeholder="<?php esc_attr_e('Overrides the studio default', 'unsupervised-schedular'); ?>" value="<?php echo esc_attr($editing->etransferEmail ?? ''); ?>"></td>
             </tr>
             <tr>
                 <th><label for="cancellation_cutoff_hours"><?php esc_html_e('Cancellation cutoff (hours)', 'unsupervised-schedular'); ?></label></th>
@@ -146,7 +153,7 @@ if ($editing && null !== $editing->termStart && null !== $editing->termEnd && $e
                     <p class="description"><?php esc_html_e('How many hours before a lesson a student may still cancel it. Leave blank to use the studio default; 0 lets students cancel any time.', 'unsupervised-schedular'); ?></p>
                 </td>
             </tr>
-            <tr>
+            <tr class="us-group-only">
                 <th><?php esc_html_e('Invite only', 'unsupervised-schedular'); ?></th>
                 <td>
                     <label><input type="checkbox" name="invite_only" value="1" <?php echo $editing && $editing->isInviteOnly() ? 'checked' : ''; ?>> <?php esc_html_e('Hide from the booking list — students join by invitation only (group classes)', 'unsupervised-schedular'); ?></label>
@@ -164,6 +171,25 @@ if ($editing && null !== $editing->termStart && null !== $editing->termEnd && $e
         <?php endif; ?>
     </form>
 
+    <?php // Progressive enhancement: only show the fields relevant to the chosen
+        // kind. Without JS every row stays visible (the pre-toggle behaviour), so
+        // the form is fully usable either way. ?>
+    <script>
+        (function () {
+            var kind = document.getElementById('kind');
+            if (!kind) return;
+            var groupOnly = document.querySelectorAll('.us-group-only');
+            var privateOnly = document.querySelectorAll('.us-private-only');
+            function sync() {
+                var isGroup = kind.value === '<?php echo esc_js(Offering::KIND_GROUP_CLASS); ?>';
+                groupOnly.forEach(function (row) { row.style.display = isGroup ? '' : 'none'; });
+                privateOnly.forEach(function (row) { row.style.display = isGroup ? 'none' : ''; });
+            }
+            kind.addEventListener('change', sync);
+            sync();
+        }());
+    </script>
+
     <h2><?php esc_html_e('Current Offerings', 'unsupervised-schedular'); ?></h2>
 
     <?php if (empty($offerings)) : ?>

templates/admin/policies.php

@@ -24,12 +24,12 @@ if (! defined('ABSPATH')) {
         <table class="form-table">
             <tr>
                 <th><label for="title"><?php esc_html_e('Title', 'unsupervised-schedular'); ?></label></th>
-                <td><input type="text" name="title" id="title" class="regular-text" required></td>
+                <td><input type="text" name="title" id="title" class="regular-text" maxlength="<?php echo esc_attr((string) Policy::MAX_TITLE_LENGTH); ?>" required></td>
             </tr>
             <tr>
                 <th><label for="slug"><?php esc_html_e('Slug', 'unsupervised-schedular'); ?></label></th>
                 <td>
-                    <input type="text" name="slug" id="slug" class="regular-text" placeholder="<?php esc_attr_e('e.g. cancellation (defaults from title)', 'unsupervised-schedular'); ?>">
+                    <input type="text" name="slug" id="slug" class="regular-text" maxlength="<?php echo esc_attr((string) Policy::MAX_SLUG_LENGTH); ?>" placeholder="<?php esc_attr_e('e.g. cancellation (defaults from title)', 'unsupervised-schedular'); ?>">
                 </td>
             </tr>
             <tr>

templates/admin/questions.php

@@ -53,7 +53,7 @@ if (! defined('ABSPATH')) {
             <table class="form-table">
                 <tr>
                     <th><label for="label"><?php esc_html_e('Question', 'unsupervised-schedular'); ?></label></th>
-                    <td><input type="text" name="label" id="label" class="regular-text" required></td>
+                    <td><input type="text" name="label" id="label" class="regular-text" maxlength="<?php echo esc_attr((string) Question::MAX_LABEL_LENGTH); ?>" required></td>
                 </tr>
                 <tr>
                     <th><label for="field_type"><?php esc_html_e('Field type', 'unsupervised-schedular'); ?></label></th>

templates/admin/student-detail.php

@@ -14,6 +14,9 @@ if (! defined('ABSPATH')) {
  * @var list<array{question: string, answer: string, required: bool}> $registrationInfo
  * @var list<array{question: string, answer: string, context: string}> $intake
  * @var list<array{created_at: string, context: string, method: string, status: string, amount: float, tax_amount: float, total: float, currency: string, receipt: string}> $payments
+ * @var list<array{created_at: string, amount: float, remaining: float, currency: string, reason: string, status: string}> $credits
+ * @var float  $creditBalance
+ * @var string $creditCurrency
  * @var string $backUrl
  * @var bool   $canBilling
  * @var string $billingOverride
@@ -241,6 +244,42 @@ $renderLessons = static function (array $rows, bool $withActions = false): void
     <?php endif; ?>
 
     <?php if ($canBilling) : ?>
+        <h2><?php esc_html_e('Account credit', 'unsupervised-schedular'); ?></h2>
+        <p>
+            <?php
+            printf(
+                /* translators: %s: available credit balance, e.g. "45.00 CAD" */
+                esc_html__('Available balance: %s', 'unsupervised-schedular'),
+                '<strong>' . esc_html(number_format_i18n($creditBalance, 2) . ' ' . $creditCurrency) . '</strong>'
+            );
+            ?>
+            <span class="description"><?php esc_html_e('Credit from cancelled paid lessons is applied automatically to upcoming scheduled billing.', 'unsupervised-schedular'); ?></span>
+        </p>
+        <?php if (! empty($credits)) : ?>
+            <table class="wp-list-table widefat fixed striped">
+                <thead>
+                    <tr>
+                        <th><?php esc_html_e('Date', 'unsupervised-schedular'); ?></th>
+                        <th><?php esc_html_e('Reason', 'unsupervised-schedular'); ?></th>
+                        <th><?php esc_html_e('Amount', 'unsupervised-schedular'); ?></th>
+                        <th><?php esc_html_e('Remaining', 'unsupervised-schedular'); ?></th>
+                        <th><?php esc_html_e('Status', 'unsupervised-schedular'); ?></th>
+                    </tr>
+                </thead>
+                <tbody>
+                    <?php foreach ($credits as $credit) : ?>
+                        <tr>
+                            <td><?php echo esc_html($credit['created_at'] !== '' ? (string) mysql2date('M j, Y g:i A', $credit['created_at']) : '—'); ?></td>
+                            <td><?php echo esc_html($credit['reason']); ?></td>
+                            <td><?php echo esc_html(number_format_i18n($credit['amount'], 2) . ' ' . $credit['currency']); ?></td>
+                            <td><?php echo esc_html(number_format_i18n($credit['remaining'], 2) . ' ' . $credit['currency']); ?></td>
+                            <td><?php echo esc_html($credit['status']); ?></td>
+                        </tr>
+                    <?php endforeach; ?>
+                </tbody>
+            </table>
+        <?php endif; ?>
+
         <h2><?php esc_html_e('Payment history', 'unsupervised-schedular'); ?></h2>
         <?php if (empty($payments)) : ?>
             <p><?php esc_html_e('None.', 'unsupervised-schedular'); ?></p>

templates/frontend/register-page.php

@@ -12,6 +12,7 @@ if (! defined('ABSPATH')) {
  * @var bool   $inviteValid Whether $invite can still be redeemed — only then is the email fixed.
  * @var string $token Raw invite token from the request (only its hash is stored).
  * @var bool   $canRegister
+ * @var string $inviteOnlyMessage Text shown when registration is closed and no valid invite is present.
  * @var bool   $open   Whether open (self-approval) registration is enabled.
  * @var string $successType '' | 'invite' (created + logged in) | 'confirm' (check email) | 'confirm_group' (check email; auto-approved on confirm).
  * @var string $confirmResult '' | '1' (email confirmed, awaiting approval) | 'ready' (confirmed + auto-approved) | 'expired'.
@@ -74,7 +75,7 @@ $renderQuestionField = static function (Question $question): void {
         <?php endif; ?>
 
         <?php if (! $canRegister) : ?>
-            <p><?php esc_html_e('Registration is by invitation only. Please use the link from your invitation email, or contact the studio.', 'unsupervised-schedular'); ?></p>
+            <p><?php echo esc_html($inviteOnlyMessage); ?></p>
         <?php else : ?>
             <?php if ($error !== '') : ?>
                 <p class="us-error" role="alert"><?php echo esc_html($error); ?></p>

tests/Unit/Auth/RegistrationPageTest.php

@@ -59,11 +59,14 @@ class RegistrationPageTest extends TestCase
             'settings'  => Mockery::mock(StudioSettings::class),
         ];
 
+        $this->ctx['versions']    = Mockery::mock(PolicyVersionRepository::class);
+        $this->ctx['acceptances'] = Mockery::mock(AcceptanceRepository::class);
+
         $this->ctx['page'] = new RegistrationPage(
             $invites,
             $policies,
-            Mockery::mock(PolicyVersionRepository::class),
-            Mockery::mock(AcceptanceRepository::class),
+            $this->ctx['versions'],
+            $this->ctx['acceptances'],
             $this->ctx['settings'],
             $this->ctx['mailer'],
             $questions,
@@ -403,4 +406,98 @@ class RegistrationPageTest extends TestCase
 
         self::assertSame('invite', $this->submit($invite, false));
     }
+
+    public function testMaybeHandleSubmitLogsInInviteAndRedirects(): void
+    {
+        $_POST    = [ 'us_register' => '1', 'password' => 'password123', 'display_name' => 'Ada' ];
+        $_REQUEST = [ 'us_invite' => 'raw-token' ];
+
+        Functions\when('is_user_logged_in')->justReturn(false);
+        Functions\when('check_admin_referer')->justReturn(true);
+        Functions\when('email_exists')->justReturn(false);
+        Functions\when('wp_insert_user')->justReturn(42);
+        Functions\when('is_wp_error')->justReturn(false);
+        Functions\when('get_permalink')->justReturn('http://home.test/register/');
+        Functions\when('add_query_arg')->alias(static fn (string $k, string $v, string $u): string => $u . '?' . $k . '=' . $v);
+
+        // The cookie must be set here — during template_redirect, before output —
+        // which is the whole point of processing the submit outside render().
+        Functions\expect('wp_set_current_user')->once()->with(42);
+        Functions\expect('wp_set_auth_cookie')->once()->with(42);
+
+        $invite = new Invite(email: '[email protected]', token: 'hash', createdAt: '2024-01-01 00:00:00', id: 9);
+        $this->ctx['invites']->shouldReceive('findByToken')->once()->andReturn($invite);
+        $this->ctx['invites']->shouldReceive('markAccepted')->once();
+        $this->ctx['settings']->shouldReceive('openRegistrationEnabled')->andReturn(false);
+
+        $page = Mockery::mock(
+            RegistrationPage::class,
+            [
+                $this->ctx['invites'],
+                $this->ctx['policies'],
+                $this->ctx['versions'],
+                $this->ctx['acceptances'],
+                $this->ctx['settings'],
+                $this->ctx['mailer'],
+                $this->ctx['questions'],
+                $this->ctx['answers'],
+                $this->ctx['access'],
+            ]
+        )->makePartial()->shouldAllowMockingProtectedMethods();
+
+        $captured = '';
+        $page->shouldReceive('redirect')->once()->with(Mockery::on(static function (string $url) use (&$captured): bool {
+            $captured = $url;
+            return true;
+        }));
+
+        $page->maybeHandleSubmit();
+
+        self::assertStringContainsString('us_registered=invite', $captured);
+    }
+
+    public function testMaybeHandleSubmitStoresValidationErrorWithoutRedirecting(): void
+    {
+        // Too-short password: handleSubmit returns an error and no redirect fires.
+        $_POST = [ 'us_register' => '1', 'password' => 'short', 'display_name' => 'Ada' ];
+
+        Functions\when('is_user_logged_in')->justReturn(false);
+        Functions\when('check_admin_referer')->justReturn(true);
+        $this->ctx['settings']->shouldReceive('openRegistrationEnabled')->andReturn(true);
+
+        // A redirect would call exit; reaching the assertion proves none happened.
+        $this->ctx['page']->maybeHandleSubmit();
+
+        $error = (new \ReflectionProperty(RegistrationPage::class, 'submitError'))->getValue($this->ctx['page']);
+        self::assertNotSame('', $error);
+    }
+
+    public function testInviteSuccessRedirectShowsLoggedInWelcome(): void
+    {
+        // After the PRG redirect the student is logged in; the us_registered flag
+        // distinguishes a just-completed signup from an already-logged-in visitor.
+        $_GET = [ 'us_registered' => 'invite' ];
+        Functions\when('is_user_logged_in')->justReturn(true);
+        Functions\when('sanitize_key')->alias(static fn ($v) => strtolower((string) $v));
+
+        $html = $this->ctx['page']->render([]);
+
+        self::assertStringContainsString('us-success', $html);
+        self::assertStringContainsString('now logged in', $html);
+    }
+
+    public function testInviteOnlyMessageCanBeCustomised(): void
+    {
+        // Closed registration and no invite → the invitation-only gate shows.
+        Functions\when('is_user_logged_in')->justReturn(false);
+        Functions\when('sanitize_key')->alias(static fn ($v) => strtolower((string) $v));
+        Functions\when('wp_login_url')->justReturn('http://home.test/wp-login.php');
+        Functions\when('wp_nonce_field')->justReturn('');
+        $this->ctx['settings']->shouldReceive('openRegistrationEnabled')->andReturn(false);
+
+        $html = $this->ctx['page']->render([ 'inviteOnlyMessage' => 'Ask the front desk for a link.' ]);
+
+        self::assertStringContainsString('Ask the front desk for a link.', $html);
+        self::assertStringNotContainsString('by invitation only', $html);
+    }
 }

tests/Unit/Auth/StudentActionsTest.php

@@ -42,6 +42,10 @@ class StudentActionsTest extends TestCase
         $this->bookings->shouldReceive('updateStatus')->once()->with(12, Lesson::STATUS_CANCELLED)->andReturn(true);
         $this->availability->shouldReceive('release')->once()->with(7)->andReturn(true);
         $this->payments->shouldReceive('voidPending')->once()->with(40);
+        // A paid lesson is credited; the cancelled lesson value object is handed over.
+        $this->payments->shouldReceive('creditForCancelledLesson')
+            ->once()
+            ->with(Mockery::on(static fn (Lesson $l): bool => $l->id === 12 && $l->paymentId === 40));
 
         self::assertTrue($this->actions->cancelLesson(12, 5));
     }

tests/Unit/Auth/StudentAdminGuardTest.php

@@ -0,0 +1,88 @@
+<?php
+declare(strict_types=1);
+
+namespace Unsupervised\Schedular\Tests\Unit\Auth;
+
+use Brain\Monkey\Functions;
+use Unsupervised\Schedular\Auth\RoleManager;
+use Unsupervised\Schedular\Auth\StudentAdminGuard;
+use Unsupervised\Schedular\Tests\Unit\TestCase;
+
+class StudentAdminGuardTest extends TestCase
+{
+    private StudentAdminGuard $guard;
+
+    protected function setUp(): void
+    {
+        parent::setUp();
+        $this->guard = new StudentAdminGuard();
+        Functions\when('wp_doing_ajax')->justReturn(false);
+    }
+
+    /**
+     * @param list<string> $held Capabilities the user is treated as holding.
+     */
+    private function stubUser(bool $loggedIn, array $held = []): void
+    {
+        Functions\when('is_user_logged_in')->justReturn($loggedIn);
+        Functions\when('current_user_can')->alias(static fn (string $cap): bool => in_array($cap, $held, true));
+    }
+
+    public function testBlocksStudentWithNoBackOfficeCapabilities(): void
+    {
+        // A student holds only front-end capabilities.
+        $this->stubUser(true, [RoleManager::CAP_BOOK_LESSON, RoleManager::CAP_VIEW_LESSONS]);
+
+        self::assertTrue($this->guard->shouldBlockAdminAccess());
+    }
+
+    public function testAllowsInstructor(): void
+    {
+        $this->stubUser(true, [RoleManager::CAP_MANAGE_AVAILABILITY]);
+
+        self::assertFalse($this->guard->shouldBlockAdminAccess());
+    }
+
+    public function testAllowsAdministrator(): void
+    {
+        $this->stubUser(true, ['manage_options']);
+
+        self::assertFalse($this->guard->shouldBlockAdminAccess());
+    }
+
+    public function testDoesNotBlockLoggedOutRequests(): void
+    {
+        $this->stubUser(false);
+
+        self::assertFalse($this->guard->shouldBlockAdminAccess());
+    }
+
+    public function testDoesNotBlockAjaxRequests(): void
+    {
+        Functions\when('wp_doing_ajax')->justReturn(true);
+        $this->stubUser(true, [RoleManager::CAP_BOOK_LESSON]);
+
+        self::assertFalse($this->guard->shouldBlockAdminAccess());
+    }
+
+    public function testHidesAdminBarForStudent(): void
+    {
+        $this->stubUser(true, [RoleManager::CAP_BOOK_LESSON]);
+
+        self::assertFalse($this->guard->hideAdminBar(true));
+    }
+
+    public function testKeepsAdminBarForInstructor(): void
+    {
+        $this->stubUser(true, [RoleManager::CAP_MANAGE_AVAILABILITY]);
+
+        self::assertTrue($this->guard->hideAdminBar(true));
+    }
+
+    public function testLeavesAdminBarUntouchedForLoggedOutVisitor(): void
+    {
+        $this->stubUser(false);
+
+        self::assertFalse($this->guard->hideAdminBar(false));
+    }
+}

tests/Unit/Auth/StudentHistoryTest.php

@@ -5,6 +5,8 @@ namespace Unsupervised\Schedular\Tests\Unit\Auth;
 
 use Mockery;
 use Unsupervised\Schedular\Auth\StudentHistory;
+use Unsupervised\Schedular\Payment\Credit;
+use Unsupervised\Schedular\Payment\CreditRepository;
 use Unsupervised\Schedular\Payment\Payment;
 use Unsupervised\Schedular\Payment\PaymentRepository;
 use Unsupervised\Schedular\Policy\AcceptanceRepository;
@@ -27,6 +29,7 @@ class StudentHistoryTest extends TestCase
     private AnswerRepository&Mockery\MockInterface $answers;
     private QuestionRepository&Mockery\MockInterface $questions;
     private PaymentRepository&Mockery\MockInterface $payments;
+    private CreditRepository&Mockery\MockInterface $credits;
     private StudentHistory $history;
 
     protected function setUp(): void
@@ -39,6 +42,7 @@ class StudentHistoryTest extends TestCase
         $this->answers        = Mockery::mock(AnswerRepository::class);
         $this->questions      = Mockery::mock(QuestionRepository::class);
         $this->payments       = Mockery::mock(PaymentRepository::class);
+        $this->credits        = Mockery::mock(CreditRepository::class);
 
         $this->history = new StudentHistory(
             $this->acceptances,
@@ -46,7 +50,8 @@ class StudentHistoryTest extends TestCase
             $this->policyVersions,
             $this->answers,
             $this->questions,
-            $this->payments
+            $this->payments,
+            $this->credits
         );
     }
 
@@ -215,4 +220,34 @@ class StudentHistoryTest extends TestCase
         self::assertSame('Enrolment #3', $rows[0]['context']);
         self::assertSame('—', $rows[0]['receipt']);
     }
+
+    public function testCreditBalanceDelegatesToRepository(): void
+    {
+        $this->credits->shouldReceive('availableBalance')->once()->with(5)->andReturn(45.0);
+
+        self::assertSame(45.0, $this->history->creditBalance(5));
+    }
+
+    public function testCreditsBuildDisplayRows(): void
+    {
+        $this->credits->shouldReceive('findByStudent')->once()->with(5)->andReturn([
+            new Credit(5, 33.00, 13.00, 'CAD', 12, 77, 'Credit for cancelled lesson #77', Credit::STATUS_AVAILABLE, '2026-07-01 09:00:00', id: 300),
+        ]);
+
+        $rows = $this->history->credits(5);
+
+        self::assertSame(
+            [
+                [
+                    'created_at' => '2026-07-01 09:00:00',
+                    'amount'     => 33.00,
+                    'remaining'  => 13.00,
+                    'currency'   => 'CAD',
+                    'reason'     => 'Credit for cancelled lesson #77',
+                    'status'     => Credit::STATUS_AVAILABLE,
+                ],
+            ],
+            $rows
+        );
+    }
 }

tests/Unit/BlockRegistrarTest.php

@@ -126,7 +126,7 @@ class BlockRegistrarTest extends TestCase
             array_keys($registered['us-scheduler/student-login']['attributes'])
         );
         self::assertSame(
-            ['loginPageId'],
+            ['loginPageId', 'inviteOnlyMessage'],
             array_keys($registered['us-scheduler/student-register']['attributes'])
         );
         self::assertSame(

tests/Unit/Booking/BookingEndpointTest.php

@@ -48,6 +48,9 @@ class BookingEndpointTest extends TestCase
         $this->payments     = Mockery::mock(PaymentService::class);
         $this->settings     = Mockery::mock(StudioSettings::class);
         $this->settings->shouldReceive('cancellationCutoffHours')->andReturn(24)->byDefault();
+        // Crediting a cancelled paid lesson is exercised in dedicated tests; other
+        // cancellation paths simply allow the call.
+        $this->payments->shouldReceive('creditForCancelledLesson')->andReturn(null)->byDefault();
 
         $this->endpoint = new BookingEndpoint(
             $this->availability,
@@ -472,6 +475,24 @@ class BookingEndpointTest extends TestCase
         self::assertSame(Lesson::STATUS_CANCELLED, $result->get_data()['status']);
     }
 
+    public function testCancelCreditsThePaidLesson(): void
+    {
+        $lesson = new Lesson(slotId: 10, studentId: 5, instructorId: 3, status: Lesson::STATUS_PENDING, paymentId: 12, id: 77);
+        $this->bookings->shouldReceive('findById')->with(77)->andReturn($lesson);
+        $this->availability->shouldReceive('findById')->with(10)->andReturn($this->slot(10, 3, null));
+        $this->bookings->shouldReceive('updateStatus')->with(77, Lesson::STATUS_CANCELLED)->once()->andReturn(true);
+        $this->availability->shouldReceive('release')->with(10)->once()->andReturn(true);
+        $this->payments->shouldReceive('voidPending')->with(12)->once();
+
+        // The cancelled lesson (the value object, so its payment_id is intact) is
+        // handed to the credit path.
+        $this->payments->shouldReceive('creditForCancelledLesson')
+            ->once()
+            ->with(Mockery::on(static fn (Lesson $l): bool => $l->id === 77 && $l->paymentId === 12));
+
+        $this->endpoint->cancel(new \WP_REST_Request(['id' => 77]));
+    }
+
     public function testCancelWithinStudioCutoffIsRejected(): void
     {
         // Now (2026-06-01 10:00) is only 24h before a slot at 2026-06-02 10:00,

tests/Unit/GroupClass/EnrollmentEndpointTest.php

@@ -5,6 +5,7 @@ namespace Unsupervised\Schedular\Tests\Unit\GroupClass;
 
 use Brain\Monkey\Functions;
 use Mockery;
+use Unsupervised\Schedular\GroupClass\Enrollment;
 use Unsupervised\Schedular\GroupClass\EnrollmentEndpoint;
 use Unsupervised\Schedular\GroupClass\EnrollmentRepository;
 use Unsupervised\Schedular\GroupClass\GroupAccessRepository;
@@ -181,4 +182,74 @@ class EnrollmentEndpointTest extends TestCase
         self::assertInstanceOf(\WP_REST_Response::class, $result);
         self::assertSame(201, $result->get_status());
     }
+
+    public function testWithdrawCancelsEnrolmentAndVoidsPendingWithoutCrediting(): void
+    {
+        // No withdrawal deadline set, so withdrawal is open. current_time is 2026-07-24.
+        $this->enrollments->shouldReceive('findById')->with(3)->andReturn(new Enrollment(8, 5, 3, Enrollment::STATUS_ACTIVE, 41, 3));
+        $this->offerings->shouldReceive('findById')->with(8)->andReturn($this->offering(120.0));
+        $this->enrollments->shouldReceive('updateStatus')->once()->with(3, Enrollment::STATUS_CANCELLED)->andReturn(true);
+        $this->payments->shouldReceive('voidPending')->once()->with(41);
+
+        $result = $this->endpoint->withdraw(new \WP_REST_Request(['id' => 3]));
+
+        self::assertInstanceOf(\WP_REST_Response::class, $result);
+        self::assertSame(200, $result->get_status());
+        self::assertSame(Enrollment::STATUS_CANCELLED, $result->get_data()['status']);
+    }
+
+    public function testWithdrawRejectedAfterDeadline(): void
+    {
+        // current_time is stubbed to 2026-07-24, past the 2026-07-10 deadline.
+        $offering = new Offering(instructorId: 3, kind: Offering::KIND_GROUP_CLASS, title: 'Choir', termStart: '2026-07-01', withdrawalDeadline: '2026-07-10', id: 8);
+        $this->enrollments->shouldReceive('findById')->with(3)->andReturn(new Enrollment(8, 5, 3, Enrollment::STATUS_ACTIVE, 41, 3));
+        $this->offerings->shouldReceive('findById')->with(8)->andReturn($offering);
+        $this->enrollments->shouldReceive('updateStatus')->never();
+        $this->payments->shouldReceive('voidPending')->never();
+
+        $result = $this->endpoint->withdraw(new \WP_REST_Request(['id' => 3]));
+
+        self::assertInstanceOf(\WP_Error::class, $result);
+        self::assertSame('withdrawal_closed', $result->get_error_code());
+        self::assertSame(403, $result->error_data['withdrawal_closed']['status']);
+    }
+
+    public function testWithdrawRejectsAnotherStudentsEnrolment(): void
+    {
+        // Enrolment belongs to student 9, but the caller is student 5.
+        $this->enrollments->shouldReceive('findById')->with(3)->andReturn(new Enrollment(8, 9, 3, Enrollment::STATUS_ACTIVE, 41, 3));
+        $this->enrollments->shouldReceive('updateStatus')->never();
+
+        $result = $this->endpoint->withdraw(new \WP_REST_Request(['id' => 3]));
+
+        self::assertInstanceOf(\WP_Error::class, $result);
+        self::assertSame('forbidden', $result->get_error_code());
+        self::assertSame(403, $result->error_data['forbidden']['status']);
+    }
+
+    public function testWithdrawReturnsNotFoundForUnknownEnrolment(): void
+    {
+        $this->enrollments->shouldReceive('findById')->with(3)->andReturn(null);
+
+        $result = $this->endpoint->withdraw(new \WP_REST_Request(['id' => 3]));
+
+        self::assertInstanceOf(\WP_Error::class, $result);
+        self::assertSame('not_found', $result->get_error_code());
+        self::assertSame(404, $result->error_data['not_found']['status']);
+    }
+
+    public function testWithdrawIsIdempotentForAlreadyCancelledEnrolment(): void
+    {
+        // Already cancelled: no status change, no deadline check, no payment void.
+        $this->enrollments->shouldReceive('findById')->with(3)->andReturn(new Enrollment(8, 5, 3, Enrollment::STATUS_CANCELLED, null, 3));
+        $this->offerings->shouldReceive('findById')->never();
+        $this->enrollments->shouldReceive('updateStatus')->never();
+        $this->payments->shouldReceive('voidPending')->never();
+
+        $result = $this->endpoint->withdraw(new \WP_REST_Request(['id' => 3]));
+
+        self::assertInstanceOf(\WP_REST_Response::class, $result);
+        self::assertSame(200, $result->get_status());
+        self::assertSame(Enrollment::STATUS_CANCELLED, $result->get_data()['status']);
+    }
 }

tests/Unit/Offering/OfferingControllerTest.php

@@ -32,6 +32,8 @@ class OfferingControllerTest extends TestCase
         Functions\when('current_user_can')->justReturn(true);
         Functions\when('get_current_user_id')->justReturn(3);
         Functions\when('get_users')->justReturn([]);
+        // Default single-account setup: admins act as instructors.
+        Functions\when('get_option')->justReturn('1');
         Functions\when('check_admin_referer')->justReturn(true);
         Functions\when('admin_url')->justReturn('admin.php?page=us-offerings');
         Functions\when('add_query_arg')->alias(
@@ -139,6 +141,43 @@ class OfferingControllerTest extends TestCase
         $this->render();
     }
 
+    public function testAddGroupClassStoresWithdrawalDeadline(): void
+    {
+        $_POST = [
+            'usc_action'          => 'add',
+            'title'               => 'Ballet Beginners',
+            'kind'                => Offering::KIND_GROUP_CLASS,
+            'term_start'          => '2026-09-08',
+            'withdrawal_deadline' => '2026-08-31',
+        ];
+
+        $this->repository->shouldReceive('insert')->once()->with(Mockery::on(
+            static fn (Offering $o) => '2026-08-31' === $o->withdrawalDeadline
+        ))->andReturn(1);
+        $this->repository->shouldReceive('findAll')->andReturn([]);
+        $this->reconciler->shouldReceive('reconcile')->once()->andReturn(['removed' => 0, 'conflicts' => []]);
+
+        $this->render();
+    }
+
+    public function testBlankWithdrawalDeadlineLeavesItNull(): void
+    {
+        $_POST = [
+            'usc_action' => 'add',
+            'title'      => 'Choir',
+            'kind'       => Offering::KIND_GROUP_CLASS,
+            'term_start' => '2026-09-08',
+        ];
+
+        $this->repository->shouldReceive('insert')->once()->with(Mockery::on(
+            static fn (Offering $o) => null === $o->withdrawalDeadline
+        ))->andReturn(1);
+        $this->repository->shouldReceive('findAll')->andReturn([]);
+        $this->reconciler->shouldReceive('reconcile')->once()->andReturn(['removed' => 0, 'conflicts' => []]);
+
+        $this->render();
+    }
+
     public function testGarbageClassTimeIsRejected(): void
     {
         $_POST = [
@@ -413,6 +452,51 @@ class OfferingControllerTest extends TestCase
         self::assertStringNotContainsString('Edit Offering', $html);
     }
 
+    public function testInstructorPickerIncludesAdministratorsWhenTheyActAsInstructors(): void
+    {
+        // The reported bug: a solo studio owner runs the business from a WordPress
+        // administrator account and teaches through the dynamic capability grant,
+        // so they never hold the us_instructor role. The picker must still list
+        // them, otherwise there is no one to assign a class to.
+        Functions\when('get_option')->justReturn('1');
+
+        $admin               = Mockery::mock(\WP_User::class);
+        $admin->ID           = 3;
+        $admin->display_name = 'Studio Owner';
+
+        $queriedRoles = [];
+        Functions\when('get_users')->alias(static function (array $args) use (&$queriedRoles, $admin): array {
+            $queriedRoles = $args['role__in'];
+            return [$admin];
+        });
+        $this->repository->shouldReceive('findAll')->andReturn([]);
+
+        $html = $this->render();
+
+        self::assertContains('us_instructor', $queriedRoles);
+        self::assertContains('administrator', $queriedRoles);
+        self::assertStringContainsString('Studio Owner', $html);
+        self::assertStringContainsString('<option value="3"', $html);
+    }
+
+    public function testInstructorPickerExcludesAdministratorsWhenGrantDisabled(): void
+    {
+        // With the "admins are instructors" toggle off, an admin is not a teacher,
+        // so only the explicit us_instructor role is queried.
+        Functions\when('get_option')->justReturn('0');
+
+        $queriedRoles = null;
+        Functions\when('get_users')->alias(static function (array $args) use (&$queriedRoles): array {
+            $queriedRoles = $args['role__in'];
+            return [];
+        });
+        $this->repository->shouldReceive('findAll')->andReturn([]);
+
+        $this->render();
+
+        self::assertSame(['us_instructor'], $queriedRoles);
+    }
+
     private function render(): string
     {
         ob_start();

tests/Unit/Offering/OfferingEndpointTest.php

@@ -118,4 +118,37 @@ class OfferingEndpointTest extends TestCase
 
         self::assertArrayNotHasKey('etransfer_email', $data[0]);
     }
+
+    public function testCreateRejectsTitleLongerThanColumnLimit(): void
+    {
+        Functions\when('sanitize_text_field')->returnArg();
+        Functions\when('sanitize_email')->returnArg();
+        $this->repository->shouldNotReceive('insert');
+
+        $request  = new \WP_REST_Request([
+            'kind'  => Offering::KIND_GROUP_CLASS,
+            'title' => str_repeat('a', Offering::MAX_TITLE_LENGTH + 1),
+        ]);
+        $response = $this->endpoint->create($request);
+
+        self::assertInstanceOf(\WP_Error::class, $response);
+        self::assertSame(400, $response->error_data['invalid_offering']['status']);
+    }
+
+    public function testCreateRejectsScheduleNoteLongerThanColumnLimit(): void
+    {
+        Functions\when('sanitize_text_field')->returnArg();
+        Functions\when('sanitize_email')->returnArg();
+        $this->repository->shouldNotReceive('insert');
+
+        $request  = new \WP_REST_Request([
+            'kind'          => Offering::KIND_GROUP_CLASS,
+            'title'         => 'Choir',
+            'schedule_note' => str_repeat('a', Offering::MAX_SCHEDULE_NOTE_LENGTH + 1),
+        ]);
+        $response = $this->endpoint->create($request);
+
+        self::assertInstanceOf(\WP_Error::class, $response);
+        self::assertSame(400, $response->error_data['invalid_offering']['status']);
+    }
 }

tests/Unit/Offering/OfferingRepositoryTest.php

@@ -192,6 +192,29 @@ class OfferingRepositoryTest extends TestCase
         self::assertSame(1, $this->repo->insert($offering));
     }
 
+    public function testInsertPersistsWithdrawalDeadline(): void
+    {
+        Functions\expect('current_time')->with('mysql')->andReturn('2026-04-01 12:00:00');
+
+        $this->db->shouldReceive('insert')
+            ->once()
+            ->with(
+                'wp_us_offerings',
+                Mockery::on(static fn (array $data): bool => $data['withdrawal_deadline'] === '2026-08-31'),
+                Mockery::type('array')
+            );
+        $this->db->insert_id = 1;
+
+        $offering = new Offering(
+            instructorId:       5,
+            kind:               Offering::KIND_GROUP_CLASS,
+            title:              'Choir',
+            withdrawalDeadline: '2026-08-31',
+        );
+
+        self::assertSame(1, $this->repo->insert($offering));
+    }
+
     public function testDeleteCallsWpdbDelete(): void
     {
         $this->db->shouldReceive('delete')

tests/Unit/Offering/OfferingTest.php

@@ -331,4 +331,29 @@ class OfferingTest extends TestCase
 
         self::assertSame('2026-08-31', $offering->toArray()['enrollment_deadline']);
     }
+
+    public function testIsWithdrawalOpenOnAndBeforeTheDeadlineDay(): void
+    {
+        $offering = new Offering(1, Offering::KIND_GROUP_CLASS, 'Choir', termStart: '2026-09-08', withdrawalDeadline: '2026-08-31');
+
+        self::assertTrue($offering->isWithdrawalOpen('2026-08-30'));
+        self::assertTrue($offering->isWithdrawalOpen('2026-08-31'));
+        self::assertFalse($offering->isWithdrawalOpen('2026-09-01'));
+    }
+
+    public function testIsWithdrawalOpenAlwaysTrueWithoutADeadline(): void
+    {
+        // Unlike the enrolment deadline, a withdrawal deadline has no default:
+        // an unset deadline leaves self-withdrawal open indefinitely.
+        $offering = new Offering(1, Offering::KIND_GROUP_CLASS, 'Choir', termStart: '2026-09-08');
+
+        self::assertTrue($offering->isWithdrawalOpen('2099-01-01'));
+    }
+
+    public function testToArrayIncludesWithdrawalDeadline(): void
+    {
+        $offering = new Offering(1, Offering::KIND_GROUP_CLASS, 'Choir', withdrawalDeadline: '2026-08-31', id: 10);
+
+        self::assertSame('2026-08-31', $offering->toArray()['withdrawal_deadline']);
+    }
 }

tests/Unit/Payment/CreditRepositoryTest.php

@@ -0,0 +1,111 @@
+<?php
+declare(strict_types=1);
+
+namespace Unsupervised\Schedular\Tests\Unit\Payment;
+
+use Brain\Monkey\Functions;
+use Mockery;
+use Unsupervised\Schedular\Payment\Credit;
+use Unsupervised\Schedular\Payment\CreditRepository;
+use Unsupervised\Schedular\Tests\Unit\TestCase;
+
+class CreditRepositoryTest extends TestCase
+{
+    private \wpdb $db;
+    private CreditRepository $repo;
+
+    protected function setUp(): void
+    {
+        parent::setUp();
+
+        $this->db         = Mockery::mock(\wpdb::class);
+        $this->db->prefix = 'wp_';
+        $this->repo       = new CreditRepository($this->db);
+    }
+
+    public function testInsertReturnsId(): void
+    {
+        Functions\expect('current_time')->with('mysql')->andReturn('2026-06-08 12:00:00');
+
+        $this->db->shouldReceive('insert')
+            ->once()
+            ->with(
+                'wp_us_credits',
+                Mockery::on(static function (array $d): bool {
+                    return $d['student_id'] === 5
+                        && $d['amount'] === 33.0
+                        && $d['remaining'] === 33.0
+                        && $d['source_lesson_id'] === 77
+                        && $d['status'] === Credit::STATUS_AVAILABLE;
+                }),
+                Mockery::type('array')
+            );
+        $this->db->insert_id = 300;
+
+        $credit = new Credit(5, 33.0, 33.0, 'CAD', 12, 77, 'Credit for cancelled lesson #77');
+        self::assertSame(300, $this->repo->insert($credit));
+    }
+
+    public function testExistsForLessonReturnsTrueWhenRowFound(): void
+    {
+        $this->db->shouldReceive('prepare')
+            ->once()
+            ->with(Mockery::pattern('/source_lesson_id = %d/'), 'wp_us_credits', 77)
+            ->andReturn('SELECT ...');
+        $this->db->shouldReceive('get_var')->once()->with('SELECT ...')->andReturn('300');
+
+        self::assertTrue($this->repo->existsForLesson(77));
+    }
+
+    public function testExistsForLessonReturnsFalseWhenNone(): void
+    {
+        $this->db->shouldReceive('prepare')->andReturn('SELECT ...');
+        $this->db->shouldReceive('get_var')->once()->andReturn(null);
+
+        self::assertFalse($this->repo->existsForLesson(77));
+    }
+
+    public function testAvailableBalanceSumsRemaining(): void
+    {
+        $this->db->shouldReceive('prepare')
+            ->once()
+            ->with(Mockery::pattern('/SUM\( remaining \)/'), 'wp_us_credits', 5, Credit::STATUS_AVAILABLE)
+            ->andReturn('SELECT ...');
+        $this->db->shouldReceive('get_var')->once()->with('SELECT ...')->andReturn('45.00');
+
+        self::assertSame(45.0, $this->repo->availableBalance(5));
+    }
+
+    public function testConsumeDrawsDownOldestFirstAndMarksSpentConsumed(): void
+    {
+        // Two available credits ($20 then $30); consuming $35 empties the first and
+        // takes $15 from the second, leaving it $15 and still available.
+        $rows = [
+            (object) ['id' => '1', 'student_id' => '5', 'amount' => '20.00', 'remaining' => '20.00', 'currency' => 'CAD', 'source_payment_id' => null, 'source_lesson_id' => null, 'reason' => null, 'status' => Credit::STATUS_AVAILABLE, 'created_at' => '2026-06-01 09:00:00', 'updated_at' => null],
+            (object) ['id' => '2', 'student_id' => '5', 'amount' => '30.00', 'remaining' => '30.00', 'currency' => 'CAD', 'source_payment_id' => null, 'source_lesson_id' => null, 'reason' => null, 'status' => Credit::STATUS_AVAILABLE, 'created_at' => '2026-06-02 09:00:00', 'updated_at' => null],
+        ];
+
+        Functions\expect('current_time')->with('mysql')->andReturn('2026-07-15 12:00:00');
+        $this->db->shouldReceive('prepare')->andReturn('SELECT ...');
+        $this->db->shouldReceive('get_results')->once()->with('SELECT ...')->andReturn($rows);
+
+        // First credit fully spent -> consumed.
+        $this->db->shouldReceive('update')
+            ->once()
+            ->with('wp_us_credits', Mockery::on(static fn (array $d): bool => $d['remaining'] === 0.0 && $d['status'] === Credit::STATUS_CONSUMED), ['id' => 1], Mockery::type('array'), Mockery::type('array'));
+        // Second credit partly spent -> stays available with $15 remaining.
+        $this->db->shouldReceive('update')
+            ->once()
+            ->with('wp_us_credits', Mockery::on(static fn (array $d): bool => $d['remaining'] === 15.0 && $d['status'] === Credit::STATUS_AVAILABLE), ['id' => 2], Mockery::type('array'), Mockery::type('array'));
+
+        $this->repo->consume(5, 35.0);
+    }
+
+    public function testConsumeIgnoresNonPositiveAmount(): void
+    {
+        $this->db->shouldNotReceive('get_results');
+        $this->db->shouldNotReceive('update');
+
+        $this->repo->consume(5, 0.0);
+    }
+}

tests/Unit/Payment/PaymentDueMailerTest.php

@@ -74,6 +74,46 @@ class PaymentDueMailerTest extends TestCase
         self::assertTrue((new PaymentDueMailer())->send($this->student('[email protected]'), $items, 'REF12345'));
     }
 
+    public function testCreditReducesTheTotalDue(): void
+    {
+        Functions\expect('wp_mail')
+            ->once()
+            ->with(
+                '[email protected]',
+                Mockery::type('string'),
+                Mockery::on(static function (string $body): bool {
+                    // Line shows the full 35.00; credit line shows -20.00; total due 15.00.
+                    return str_contains($body, '35.00')
+                        && str_contains($body, '-CAD 20.00')
+                        && str_contains($body, 'Total due: CAD 15.00');
+                })
+            )
+            ->andReturn(true);
+
+        $items = [[ 'label' => 'Piano', 'amount' => 35.0, 'currency' => 'CAD', 'due_date' => '2026-07-15', 'etransfer_email' => '[email protected]' ]];
+
+        self::assertTrue((new PaymentDueMailer())->send($this->student('[email protected]'), $items, 'REF1', 20.0));
+    }
+
+    public function testCreditCoveringEverythingLeavesZeroDueAndNoEtransferLine(): void
+    {
+        Functions\expect('wp_mail')
+            ->once()
+            ->with(
+                '[email protected]',
+                Mockery::type('string'),
+                Mockery::on(static function (string $body): bool {
+                    return str_contains($body, 'Total due: CAD 0.00')
+                        && ! str_contains($body, '[email protected]');
+                })
+            )
+            ->andReturn(true);
+
+        $items = [[ 'label' => 'Piano', 'amount' => 35.0, 'currency' => 'CAD', 'due_date' => '2026-07-15', 'etransfer_email' => '[email protected]' ]];
+
+        self::assertTrue((new PaymentDueMailer())->send($this->student('[email protected]'), $items, '', 35.0));
+    }
+
     public function testIncludesEtransferDestination(): void
     {
         Functions\expect('wp_mail')

tests/Unit/Payment/PaymentServiceTest.php

@@ -9,6 +9,8 @@ use Unsupervised\Schedular\Booking\BookingRepository;
 use Unsupervised\Schedular\Booking\Lesson;
 use Unsupervised\Schedular\GroupClass\EnrollmentRepository;
 use Unsupervised\Schedular\Payment\BillingMethodResolver;
+use Unsupervised\Schedular\Payment\Credit;
+use Unsupervised\Schedular\Payment\CreditRepository;
 use Unsupervised\Schedular\Payment\Payment;
 use Unsupervised\Schedular\Payment\PaymentRepository;
 use Unsupervised\Schedular\Payment\PaymentService;
@@ -26,6 +28,7 @@ class PaymentServiceTest extends TestCase
     private EnrollmentRepository $enrollments;
     private StudioSettings $settings;
     private StripeGateway $stripe;
+    private CreditRepository $credits;
     private PaymentService $service;
 
     protected function setUp(): void
@@ -39,6 +42,7 @@ class PaymentServiceTest extends TestCase
         $this->enrollments = Mockery::mock(EnrollmentRepository::class);
         $this->settings    = Mockery::mock(StudioSettings::class);
         $this->stripe      = Mockery::mock(StripeGateway::class);
+        $this->credits     = Mockery::mock(CreditRepository::class);
         $this->settings->shouldReceive('etransferEmail')->andReturn('');
         $this->settings->shouldReceive('hstRate')->andReturn(0.0)->byDefault();
         // Confirming a lesson looks it up to detect a weekly series; single
@@ -52,7 +56,8 @@ class PaymentServiceTest extends TestCase
             $this->bookings,
             $this->enrollments,
             $this->settings,
-            $this->stripe
+            $this->stripe,
+            $this->credits
         );
 
         Functions\when('get_userdata')->justReturn(false);
@@ -340,6 +345,151 @@ class PaymentServiceTest extends TestCase
         self::assertTrue($this->service->handleWebhook('{}', 'sig'));
     }
 
+    public function testCreditForCancelledLessonCreditsWholeTotalOfSingleLessonPayment(): void
+    {
+        // A paid single-lesson payment: the whole total (incl. tax) is credited.
+        $paid = new Payment(5, 3, Payment::REG_LESSON, 77, 30.00, 'CAD', Payment::METHOD_ETRANSFER, Payment::STATUS_PAID, taxRate: 10.0, taxAmount: 3.00, id: 12);
+        $this->payments->shouldReceive('findById')->with(12)->andReturn($paid);
+        $this->bookings->shouldReceive('countByPaymentId')->with(12)->andReturn(1);
+        $this->credits->shouldReceive('existsForLesson')->with(77)->andReturn(false);
+
+        $this->credits->shouldReceive('insert')
+            ->once()
+            ->with(Mockery::on(static fn (Credit $c): bool => $c->studentId === 5
+                && $c->amount === 33.00
+                && $c->remaining === 33.00
+                && $c->sourceLessonId === 77))
+            ->andReturn(300);
+        $this->credits->shouldReceive('findById')->with(300)->andReturn(
+            new Credit(5, 33.00, 33.00, 'CAD', 12, 77, id: 300)
+        );
+
+        $lesson = new Lesson(slotId: 10, studentId: 5, instructorId: 3, status: Lesson::STATUS_CANCELLED, paymentId: 12, id: 77);
+        self::assertNotNull($this->service->creditForCancelledLesson($lesson));
+    }
+
+    public function testCreditForCancelledLessonSplitsSharedMonthlyPayment(): void
+    {
+        // A monthly scheduled charge covering 3 lessons: one cancellation credits a third.
+        $paid = new Payment(5, 3, Payment::REG_LESSON, 201, 90.00, 'CAD', Payment::METHOD_ETRANSFER, Payment::STATUS_PAID, dueDate: '2026-07-01', id: 12);
+        $this->payments->shouldReceive('findById')->with(12)->andReturn($paid);
+        $this->bookings->shouldReceive('countByPaymentId')->with(12)->andReturn(3);
+        $this->credits->shouldReceive('existsForLesson')->with(202)->andReturn(false);
+
+        $this->credits->shouldReceive('insert')
+            ->once()
+            ->with(Mockery::on(static fn (Credit $c): bool => $c->amount === 30.00))
+            ->andReturn(301);
+        $this->credits->shouldReceive('findById')->with(301)->andReturn(new Credit(5, 30.00, 30.00, 'CAD', 12, 202, id: 301));
+
+        $lesson = new Lesson(slotId: 10, studentId: 5, instructorId: 3, status: Lesson::STATUS_CANCELLED, paymentId: 12, id: 202);
+        self::assertNotNull($this->service->creditForCancelledLesson($lesson));
+    }
+
+    public function testCreditForCancelledLessonSkipsUnpaidPayment(): void
+    {
+        $pending = new Payment(5, 3, Payment::REG_LESSON, 77, 30.00, 'CAD', Payment::METHOD_ETRANSFER, Payment::STATUS_PENDING, id: 12);
+        $this->payments->shouldReceive('findById')->with(12)->andReturn($pending);
+        $this->credits->shouldNotReceive('insert');
+
+        $lesson = new Lesson(slotId: 10, studentId: 5, instructorId: 3, paymentId: 12, id: 77);
+        self::assertNull($this->service->creditForCancelledLesson($lesson));
+    }
+
+    public function testCreditForCancelledLessonSkipsWhenNoPayment(): void
+    {
+        $this->credits->shouldNotReceive('insert');
+
+        $lesson = new Lesson(slotId: 10, studentId: 5, instructorId: 3, id: 77);
+        self::assertNull($this->service->creditForCancelledLesson($lesson));
+    }
+
+    public function testCreditForCancelledLessonSkipsAlreadyCredited(): void
+    {
+        $paid = new Payment(5, 3, Payment::REG_LESSON, 77, 30.00, 'CAD', Payment::METHOD_ETRANSFER, Payment::STATUS_PAID, id: 12);
+        $this->payments->shouldReceive('findById')->with(12)->andReturn($paid);
+        $this->bookings->shouldReceive('countByPaymentId')->with(12)->andReturn(1);
+        $this->credits->shouldReceive('existsForLesson')->with(77)->andReturn(true);
+        $this->credits->shouldNotReceive('insert');
+
+        $lesson = new Lesson(slotId: 10, studentId: 5, instructorId: 3, paymentId: 12, id: 77);
+        self::assertNull($this->service->creditForCancelledLesson($lesson));
+    }
+
+    public function testCreditForCancelledLessonUsesSeriesSizeForUpfrontSeries(): void
+    {
+        // A non-anchor series lesson has no payment_id of its own; the anchor's
+        // upfront (unscheduled) payment covers the whole 4-lesson series.
+        $anchorPayment = new Payment(5, 3, Payment::REG_LESSON, 40, 120.00, 'CAD', Payment::METHOD_ETRANSFER, Payment::STATUS_PAID, id: 12);
+        $this->payments->shouldReceive('findByRegistration')->with(Payment::REG_LESSON, 40)->andReturn($anchorPayment);
+        $this->payments->shouldReceive('findById')->with(12)->andReturn($anchorPayment);
+        $this->bookings->shouldReceive('countBySeries')->with(40)->andReturn(4);
+        $this->credits->shouldReceive('existsForLesson')->with(43)->andReturn(false);
+
+        $this->credits->shouldReceive('insert')
+            ->once()
+            ->with(Mockery::on(static fn (Credit $c): bool => $c->amount === 30.00))
+            ->andReturn(302);
+        $this->credits->shouldReceive('findById')->with(302)->andReturn(new Credit(5, 30.00, 30.00, 'CAD', 12, 43, id: 302));
+
+        $lesson = new Lesson(slotId: 10, studentId: 5, instructorId: 3, recurrence: Lesson::RECURRENCE_WEEKLY, seriesId: 40, paymentId: null, id: 43);
+        self::assertNotNull($this->service->creditForCancelledLesson($lesson));
+    }
+
+    public function testApplyCreditsReturnsEmptyWhenNoBalance(): void
+    {
+        $this->credits->shouldReceive('availableBalance')->with(5)->andReturn(0.0);
+
+        self::assertSame([], $this->service->applyCredits(5, [$this->pending(500, 40.00)]));
+    }
+
+    public function testApplyCreditsPartiallyCoversWithoutMarkingPaid(): void
+    {
+        // $30 credit against a $40 charge: applied but still owing, so it stays pending.
+        $this->credits->shouldReceive('availableBalance')->with(5)->andReturn(30.0);
+        $this->payments->shouldReceive('addCreditApplied')->once()->with(500, 30.0)->andReturn(true);
+        $this->payments->shouldNotReceive('markPaid');
+        $this->credits->shouldReceive('consume')->once()->with(5, 30.0);
+
+        $applied = $this->service->applyCredits(5, [$this->pending(500, 40.00)]);
+
+        self::assertSame([500 => 30.0], $applied);
+    }
+
+    public function testApplyCreditsFullyCoversMarksPaidByCreditAndConfirms(): void
+    {
+        // $50 credit against a $40 charge: fully covered -> settled + registration confirmed.
+        $this->credits->shouldReceive('availableBalance')->with(5)->andReturn(50.0);
+        $this->payments->shouldReceive('addCreditApplied')->once()->with(500, 40.0)->andReturn(true);
+        $this->payments->shouldReceive('markPaid')->once()->with(500, 'USC-500')->andReturn(true);
+        $this->bookings->shouldReceive('updateStatus')->once()->with(12, Lesson::STATUS_CONFIRMED)->andReturn(true);
+        $this->credits->shouldReceive('consume')->once()->with(5, 40.0);
+
+        $applied = $this->service->applyCredits(5, [$this->pending(500, 40.00)]);
+
+        self::assertSame([500 => 40.0], $applied);
+    }
+
+    public function testApplyCreditsSpreadsAcrossChargesOldestFirst(): void
+    {
+        // $50 balance across two $40 charges: first fully covered, second partly.
+        $this->credits->shouldReceive('availableBalance')->with(5)->andReturn(50.0);
+        $this->payments->shouldReceive('addCreditApplied')->once()->with(500, 40.0)->andReturn(true);
+        $this->payments->shouldReceive('markPaid')->once()->with(500, 'USC-500')->andReturn(true);
+        $this->bookings->shouldReceive('updateStatus')->once()->with(12, Lesson::STATUS_CONFIRMED)->andReturn(true);
+        $this->payments->shouldReceive('addCreditApplied')->once()->with(501, 10.0)->andReturn(true);
+        $this->credits->shouldReceive('consume')->once()->with(5, 50.0);
+
+        $applied = $this->service->applyCredits(5, [$this->pending(500, 40.00), $this->pending(501, 40.00)]);
+
+        self::assertSame([500 => 40.0, 501 => 10.0], $applied);
+    }
+
+    private function pending(int $id, float $amount): Payment
+    {
+        return new Payment(5, 3, Payment::REG_LESSON, 12, $amount, 'CAD', Payment::METHOD_ETRANSFER, Payment::STATUS_PENDING, dueDate: '2026-07-14', id: $id);
+    }
+
     private function intentEvent(string $type, string $intentId): \Stripe\Event
     {
         $intent = \Stripe\PaymentIntent::constructFrom(['id' => $intentId, 'object' => 'payment_intent']);

tests/Unit/Payment/PaymentTest.php

@@ -73,6 +73,28 @@ class PaymentTest extends TestCase
         self::assertSame(100.00, $payment->total());
     }
 
+    public function testNetDueSubtractsAppliedCredit(): void
+    {
+        $payment = new Payment(5, 3, Payment::REG_LESSON, 12, 100.00, taxRate: 13.0, taxAmount: 13.00, creditApplied: 40.00);
+
+        self::assertSame(113.00, $payment->total());
+        self::assertSame(73.00, $payment->netDue());
+    }
+
+    public function testNetDueFloorsAtZeroWhenCreditExceedsTotal(): void
+    {
+        $payment = new Payment(5, 3, Payment::REG_LESSON, 12, 30.00, creditApplied: 50.00);
+
+        self::assertSame(0.0, $payment->netDue());
+    }
+
+    public function testNetDueEqualsTotalWithoutCredit(): void
+    {
+        $payment = new Payment(5, 3, Payment::REG_LESSON, 12, 30.00);
+
+        self::assertSame(30.00, $payment->netDue());
+    }
+
     public function testToSummaryArrayContainsOnlyClientFacingFields(): void
     {
         $summary = (new Payment(5, 3, Payment::REG_LESSON, 12, 35.00, id: 7))->toSummaryArray();

tests/Unit/Payment/ScheduledBillingRunnerTest.php

@@ -40,6 +40,8 @@ class ScheduledBillingRunnerTest extends TestCase
         $this->enrollments->shouldReceive('findActiveByBillingModes')->andReturn([])->byDefault();
         $this->mailer->shouldReceive('send')->andReturn(true)->byDefault();
         $this->payments->shouldReceive('assignNoticeBatch')->byDefault();
+        // No account credit unless a test says otherwise.
+        $this->payments->shouldReceive('applyCredits')->andReturn([])->byDefault();
 
         Functions\when('wp_generate_uuid4')->justReturn('abcdef12-3456-7890-abcd-ef1234567890');
 
@@ -238,7 +240,52 @@ class ScheduledBillingRunnerTest extends TestCase
             ->with(Mockery::on(static fn (array $ids): bool => count($ids) === 2), Mockery::type('string'));
         $this->mailer->shouldReceive('send')
             ->once()
-            ->with(Mockery::type(\WP_User::class), Mockery::on(static fn (array $items): bool => count($items) === 2), Mockery::type('string'));
+            ->with(Mockery::type(\WP_User::class), Mockery::on(static fn (array $items): bool => count($items) === 2), Mockery::type('string'), 0.0);
+
+        $this->runner->run();
+    }
+
+    public function testAppliesAccountCreditToTheRun(): void
+    {
+        $this->now('2026-07-15 09:00:00');
+        $this->bookings->shouldReceive('findUnbilledScheduledLessons')
+            ->andReturn([ $this->lessonRow(101, Offering::BILLING_WEEKLY, '2026-07-15 18:00:00', 35.0) ]);
+
+        $payment = $this->pending(500, '2026-07-14');
+        $this->payments->shouldReceive('createForRegistration')->once()->andReturn($payment);
+
+        // Student holds $20 credit, applied to the one $35 charge — still $15 owing,
+        // so the payment stays in the notice batch and the notice quotes the credit.
+        $this->payments->shouldReceive('applyCredits')
+            ->once()
+            ->with(5, Mockery::on(static fn (array $p): bool => count($p) === 1))
+            ->andReturn([500 => 20.0]);
+        $this->payments->shouldReceive('assignNoticeBatch')
+            ->once()
+            ->with([500], Mockery::type('string'));
+        $this->mailer->shouldReceive('send')
+            ->once()
+            ->with(Mockery::type(\WP_User::class), Mockery::type('array'), Mockery::type('string'), 20.0);
+
+        $this->runner->run();
+    }
+
+    public function testCreditFullyCoveringAChargeLeavesItOutOfTheBatch(): void
+    {
+        $this->now('2026-07-15 09:00:00');
+        $this->bookings->shouldReceive('findUnbilledScheduledLessons')
+            ->andReturn([ $this->lessonRow(101, Offering::BILLING_WEEKLY, '2026-07-15 18:00:00', 35.0) ]);
+
+        $payment = $this->pending(500, '2026-07-14');
+        $this->payments->shouldReceive('createForRegistration')->once()->andReturn($payment);
+
+        // Credit covers the whole $35 charge: nothing owing, so no reconciliation
+        // batch and no reference on the (zero-balance) notice.
+        $this->payments->shouldReceive('applyCredits')->once()->andReturn([500 => 35.0]);
+        $this->payments->shouldReceive('assignNoticeBatch')->once()->with([], '');
+        $this->mailer->shouldReceive('send')
+            ->once()
+            ->with(Mockery::type(\WP_User::class), Mockery::type('array'), '', 35.0);
 
         $this->runner->run();
     }

tests/Unit/Policy/PolicyEndpointTest.php

@@ -0,0 +1,63 @@
+<?php
+declare(strict_types=1);
+
+namespace Unsupervised\Schedular\Tests\Unit\Policy;
+
+use Brain\Monkey\Functions;
+use Mockery;
+use Unsupervised\Schedular\Policy\Policy;
+use Unsupervised\Schedular\Policy\PolicyEndpoint;
+use Unsupervised\Schedular\Policy\PolicyRepository;
+use Unsupervised\Schedular\Policy\PolicyService;
+use Unsupervised\Schedular\Policy\PolicyVersionRepository;
+use Unsupervised\Schedular\Tests\Unit\TestCase;
+
+class PolicyEndpointTest extends TestCase
+{
+    private PolicyRepository&Mockery\MockInterface $policies;
+    private PolicyService&Mockery\MockInterface $service;
+    private PolicyEndpoint $endpoint;
+
+    protected function setUp(): void
+    {
+        parent::setUp();
+
+        Functions\when('sanitize_text_field')->returnArg();
+        Functions\when('sanitize_title')->returnArg();
+
+        $this->policies = Mockery::mock(PolicyRepository::class);
+        $this->service  = Mockery::mock(PolicyService::class);
+        $this->endpoint = new PolicyEndpoint(
+            $this->policies,
+            Mockery::mock(PolicyVersionRepository::class),
+            $this->service,
+        );
+    }
+
+    public function testCreateRejectsTitleLongerThanColumnLimit(): void
+    {
+        $this->service->shouldNotReceive('createPolicy');
+
+        $request  = new \WP_REST_Request([
+            'title' => str_repeat('a', Policy::MAX_TITLE_LENGTH + 1),
+        ]);
+        $response = $this->endpoint->create($request);
+
+        self::assertInstanceOf(\WP_Error::class, $response);
+        self::assertSame(400, $response->error_data['invalid_policy']['status']);
+    }
+
+    public function testCreateRejectsSlugLongerThanColumnLimit(): void
+    {
+        $this->service->shouldNotReceive('createPolicy');
+
+        $request  = new \WP_REST_Request([
+            'title' => 'Cancellation',
+            'slug'  => str_repeat('a', Policy::MAX_SLUG_LENGTH + 1),
+        ]);
+        $response = $this->endpoint->create($request);
+
+        self::assertInstanceOf(\WP_Error::class, $response);
+        self::assertSame(400, $response->error_data['invalid_policy']['status']);
+    }
+}

tests/Unit/Registration/QuestionEndpointTest.php

@@ -0,0 +1,70 @@
+<?php
+declare(strict_types=1);
+
+namespace Unsupervised\Schedular\Tests\Unit\Registration;
+
+use Brain\Monkey\Functions;
+use Mockery;
+use Unsupervised\Schedular\Offering\Offering;
+use Unsupervised\Schedular\Offering\OfferingRepository;
+use Unsupervised\Schedular\Registration\Question;
+use Unsupervised\Schedular\Registration\QuestionEndpoint;
+use Unsupervised\Schedular\Registration\QuestionRepository;
+use Unsupervised\Schedular\Tests\Unit\TestCase;
+
+class QuestionEndpointTest extends TestCase
+{
+    private QuestionRepository&Mockery\MockInterface $questions;
+    private OfferingRepository&Mockery\MockInterface $offerings;
+    private QuestionEndpoint $endpoint;
+
+    protected function setUp(): void
+    {
+        parent::setUp();
+
+        Functions\when('get_current_user_id')->justReturn(5);
+        Functions\when('current_user_can')->justReturn(false);
+        Functions\when('absint')->alias(static fn ($v): int => abs((int) $v));
+        Functions\when('sanitize_text_field')->returnArg();
+
+        $this->questions = Mockery::mock(QuestionRepository::class);
+        $this->offerings = Mockery::mock(OfferingRepository::class);
+        $this->endpoint  = new QuestionEndpoint($this->questions, $this->offerings);
+
+        // The caller (instructor 5) owns offering 9, so the ownership gate passes
+        // and validation is reached.
+        $this->offerings->shouldReceive('findById')->with(9)->andReturn(
+            new Offering(instructorId: 5, kind: Offering::KIND_GROUP_CLASS, title: 'Choir', id: 9)
+        );
+    }
+
+    public function testCreateRejectsLabelLongerThanColumnLimit(): void
+    {
+        // The insert must never be attempted for an over-long label — the bug was
+        // that it reached the DB, silently failed, and returned success anyway.
+        $this->questions->shouldNotReceive('insert');
+
+        $request  = new \WP_REST_Request([
+            'offering_id' => 9,
+            'label'       => str_repeat('a', Question::MAX_LABEL_LENGTH + 1),
+        ]);
+        $response = $this->endpoint->create($request);
+
+        self::assertInstanceOf(\WP_Error::class, $response);
+        self::assertSame(400, $response->error_data['invalid_question']['status']);
+    }
+
+    public function testCreateAcceptsLabelAtColumnLimit(): void
+    {
+        $this->questions->shouldReceive('insert')->once()->andReturn(42);
+
+        $request  = new \WP_REST_Request([
+            'offering_id' => 9,
+            'label'       => str_repeat('a', Question::MAX_LABEL_LENGTH),
+        ]);
+        $response = $this->endpoint->create($request);
+
+        self::assertInstanceOf(\WP_REST_Response::class, $response);
+        self::assertSame(201, $response->get_status());
+    }
+}

tests/Unit/Registration/QuestionRepositoryTest.php

@@ -212,4 +212,28 @@ class QuestionRepositoryTest extends TestCase
 
         self::assertTrue($this->repo->delete(4));
     }
+
+    public function testEnsureOfferingNullableRunsAlterAndReportsSuccess(): void
+    {
+        $this->db->shouldReceive('prepare')
+            ->once()
+            ->with(Mockery::pattern('/ALTER TABLE %i MODIFY offering_id .*NULL/'), 'wp_us_questions')
+            ->andReturn('ALTER TABLE `wp_us_questions` MODIFY offering_id BIGINT UNSIGNED NULL DEFAULT NULL');
+
+        $this->db->shouldReceive('query')
+            ->once()
+            ->with('ALTER TABLE `wp_us_questions` MODIFY offering_id BIGINT UNSIGNED NULL DEFAULT NULL')
+            ->andReturn(0);
+
+        // A successful DDL query returns 0 rows affected (not false).
+        self::assertTrue($this->repo->ensureOfferingNullable());
+    }
+
+    public function testEnsureOfferingNullableReportsFailureWhenQueryFails(): void
+    {
+        $this->db->shouldReceive('prepare')->once()->andReturn('ALTER ...');
+        $this->db->shouldReceive('query')->once()->andReturn(false);
+
+        self::assertFalse($this->repo->ensureOfferingNullable());
+    }
 }

unsupervised-schedular.php

@@ -3,7 +3,7 @@
  * Plugin Name: Unsupervised Scheduler
  * Plugin URI:  https://git.unsupervised.ca/Unsupervised/unsupervised-scheduler
  * Description: Instructor/student lesson scheduling for WordPress.
- * Version:     1.2.0
+ * Version:     1.2.1
  * Requires at least: 6.2
  * Requires PHP: 8.1
  * Author:      Unsupervised
@@ -21,7 +21,7 @@ if (! defined('ABSPATH')) {
     exit;
 }
 
-define('USC_VERSION', '1.2.0');
+define('USC_VERSION', '1.2.1');
 define('USC_PLUGIN_FILE', __FILE__);
 define('USC_PLUGIN_DIR', plugin_dir_path(__FILE__));
 define('USC_PLUGIN_URL', plugin_dir_url(__FILE__));