Add AGENTS.md, point CLAUDE.md files at it

Reviewed-on: #199
Reviewed-by: James Griffin-Allwood <[email protected]>

.claude/settings.local.json

@@ -5,7 +5,8 @@
       "Bash(composer lint *)",
       "Bash(tea actions:*)",
       "Bash(tea issue *)",
-      "Bash(tea label *)"
+      "Bash(tea label *)",
+      "Bash(composer cs *)"
     ]
   }
 }

.gitea/workflows/ci.yml

@@ -7,24 +7,31 @@ on:
       - develop
   pull_request:
 
+# Jobs that need PHP run inside the shared CI images maintained in the
+# Unsupervised/ci-php repository. PHP, Composer, the intl and zip extensions
+# and the GNU CLI tools are already in the image, so there is no toolchain
+# setup step in any job here.
+#
+# The registry path is written out at each use because
+# jobs.<id>.container.image cannot read the `env` context.
+
 jobs:
-  lint:
+  phpcs:
     name: Coding Standards
     runs-on: ubuntu-latest
+    container:
+      image: git.unsupervised.ca/unsupervised/ci-php:8.3
     steps:
       - uses: actions/checkout@v4
 
-      - name: Setup PHP
-        uses: shivammathur/setup-php@v2
-        with:
-          php-version: '8.3'
-          tools: composer:v2
-
+      # COMPOSER_HOME is /composer in the image, so that is where the
+      # download cache lives. composer.lock is what fingerprints the
+      # dependency set.
       - name: Cache Composer packages
-        uses: actions/cache@v3
+        uses: actions/cache@v4
         with:
-          path: ~/.composer/cache
-          key: composer-${{ hashFiles('composer.json') }}
+          path: /composer/cache
+          key: composer-${{ hashFiles('composer.lock') }}
 
       - name: Install dependencies
         run: composer install --prefer-dist --no-progress --no-interaction
@@ -32,24 +39,19 @@ jobs:
       - name: Run PHPCS
         run: composer cs
 
-
-  static-analysis:
-    name: PHPStan
+  phpstan:
+    name: Static Analysis
     runs-on: ubuntu-latest
+    container:
+      image: git.unsupervised.ca/unsupervised/ci-php:8.3
     steps:
       - uses: actions/checkout@v4
 
-      - name: Setup PHP
-        uses: shivammathur/setup-php@v2
-        with:
-          php-version: '8.3'
-          tools: composer:v2
-
       - name: Cache Composer packages
-        uses: actions/cache@v3
+        uses: actions/cache@v4
         with:
-          path: ~/.composer/cache
-          key: composer-${{ hashFiles('composer.json') }}
+          path: /composer/cache
+          key: composer-${{ hashFiles('composer.lock') }}
 
       - name: Install dependencies
         run: composer install --prefer-dist --no-progress --no-interaction
@@ -60,29 +62,26 @@ jobs:
   test:
     name: Tests (PHP ${{ matrix.php }})
     runs-on: ubuntu-latest
+    container:
+      image: git.unsupervised.ca/unsupervised/ci-php:${{ matrix.php }}
     strategy:
       fail-fast: false
       matrix:
+        # A version can only be added here once ci-php publishes the matching
+        # tag.
         php:
           - '8.1'
           - '8.2'
           - '8.3'
+          - '8.5'
     steps:
       - uses: actions/checkout@v4
 
-      - name: Setup PHP
-        uses: shivammathur/setup-php@v2
-        with:
-          php-version: ${{ matrix.php }}
-          extensions: mbstring, intl
-          coverage: none
-          tools: composer:v2
-
       - name: Cache Composer packages
-        uses: actions/cache@v3
+        uses: actions/cache@v4
         with:
-          path: ~/.composer/cache
-          key: ${{ matrix.php }}-composer-${{ hashFiles('composer.json') }}
+          path: /composer/cache
+          key: ${{ matrix.php }}-composer-${{ hashFiles('composer.lock') }}
 
       - name: Install dependencies
         run: composer install --prefer-dist --no-progress --no-interaction
@@ -90,6 +89,8 @@ jobs:
       - name: Run PHPUnit
         run: composer test
 
+  # Runs on the runner image rather than a container: it needs no PHP, and it
+  # uses GNU grep's --include.
   no-debug:
     name: No Debug Code
     runs-on: ubuntu-latest
@@ -106,19 +107,15 @@ jobs:
   build:
     name: Build Plugin Zip
     runs-on: ubuntu-latest
+    container:
+      image: git.unsupervised.ca/unsupervised/ci-php:8.3
     # Only build a shippable artifact once changes land on main, and only
     # after the quality gates pass.
-    needs: [lint, static-analysis, test, no-debug]
+    needs: [phpcs, phpstan, test, no-debug]
     if: github.event_name == 'push' && github.ref == 'refs/heads/main'
     steps:
       - uses: actions/checkout@v4
 
-      - name: Setup PHP
-        uses: shivammathur/setup-php@v2
-        with:
-          php-version: '8.3'
-          tools: composer:v2
-
       - name: Build plugin zip
         run: composer build
 

.gitea/workflows/release.yml

@@ -15,15 +15,13 @@ jobs:
   release:
     name: Build and Publish Release
     runs-on: ubuntu-latest
+    # The shared CI image carries composer, curl, jq and the GNU coreutils
+    # the steps below shell out to. See docs/ci.md.
+    container:
+      image: git.unsupervised.ca/unsupervised/ci-php:8.3
     steps:
       - uses: actions/checkout@v4
 
-      - name: Setup PHP
-        uses: shivammathur/setup-php@v2
-        with:
-          php-version: '8.3'
-          tools: composer:v2
-
       # A tag that disagrees with the plugin header would make sites see a
       # phantom update forever (or never see a real one), so fail fast.
       - name: Verify tag matches plugin version
@@ -37,6 +35,14 @@ jobs:
           fi
           echo "version=${header_version}" >> "$GITHUB_OUTPUT"
 
+      # COMPOSER_HOME is /composer in the image, so that is where the
+      # download cache lives.
+      - name: Cache Composer packages
+        uses: actions/cache@v4
+        with:
+          path: /composer/cache
+          key: composer-${{ hashFiles('composer.lock') }}
+
       - name: Install dependencies
         run: composer install --prefer-dist --no-progress --no-interaction
 
@@ -143,6 +149,50 @@ jobs:
             { print }
           ' CHANGELOG.md > CHANGELOG.md.tmp && mv CHANGELOG.md.tmp CHANGELOG.md
 
+      # main requires signed commits, and Gitea refuses to merge a pull request
+      # that carries an unsigned one. The key Gitea signs merge commits with
+      # lives on the server and is not reachable from a runner, so the bump
+      # commit is signed here with a dedicated release-bot key that the instance
+      # trusts via TRUSTED_SSH_KEYS. Generating that key, trusting it and storing
+      # the secret is documented in docs/ci.md.
+      - name: Configure signing as Release Bot
+        env:
+          SIGNING_KEY: ${{ secrets.RELEASE_BOT_SIGNING_KEY }}
+        run: |
+          if [ -z "${SIGNING_KEY}" ]; then
+            echo "RELEASE_BOT_SIGNING_KEY is not set - the bump commit would be unsigned and unmergeable." >&2
+            exit 1
+          fi
+          if ! command -v ssh-keygen > /dev/null; then
+            echo "ssh-keygen is missing from the runner image; git cannot make SSH signatures without it." >&2
+            exit 1
+          fi
+
+          # The secret holds an OpenSSH private key ("-----BEGIN OPENSSH PRIVATE
+          # KEY-----"). git signs by shelling out to ssh-keygen, which wants that
+          # key on disk next to the .pub it is pointed at, readable only by us,
+          # and rejects it unless the final newline survived the round trip.
+          keydir="${RUNNER_TEMP:-${TMPDIR:-/tmp}}/release-bot-signing"
+          install -m 700 -d "${keydir}"
+          printf '%s\n' "${SIGNING_KEY}" | tr -d '\r' > "${keydir}/key"
+          chmod 600 "${keydir}/key"
+          # Doubles as a format check: a truncated or re-wrapped key fails here,
+          # with a clearer cause than "gpg failed to sign the data" later on.
+          if ! ssh-keygen -y -f "${keydir}/key" < /dev/null > "${keydir}/key.pub"; then
+            echo "RELEASE_BOT_SIGNING_KEY is not a usable OpenSSH private key (passphrase-protected, truncated, or re-wrapped on paste)." >&2
+            exit 1
+          fi
+
+          # No Gitea account backs this address; TRUSTED_SSH_KEYS verifies the
+          # signature without an account lookup, so it is a label, not an identity.
+          git config user.name 'Release Bot'
+          git config user.email '[email protected]'
+          # Named gpg.format for historical reasons; "ssh" is what switches git
+          # over to signing with the SSH key above rather than a GPG key.
+          git config gpg.format ssh
+          git config user.signingkey "${keydir}/key.pub"
+          git config commit.gpgsign true
+
       - name: Open pull request
         env:
           TOKEN: ${{ secrets.GITHUB_TOKEN }}
@@ -151,10 +201,14 @@ jobs:
           branch="release/bump-${next}"
           api="${GITHUB_SERVER_URL}/api/v1/repos/${GITHUB_REPOSITORY}"
 
-          git config user.name 'Release Bot'
-          git config user.email '[email protected]'
           git checkout -b "${branch}"
           git commit -am "Bump version to ${next} and open changelog section"
+          # A commit that came out unsigned would otherwise go unnoticed until
+          # someone tried to merge the PR, so fail here instead.
+          if ! git cat-file commit HEAD | grep -q '^gpgsig'; then
+            echo "Bump commit is unsigned; refusing to push it." >&2
+            exit 1
+          fi
           git push origin "${branch}"
 
           curl -fsS -X POST "${api}/pulls" \

.gitignore

@@ -1,5 +1,4 @@
 vendor/
-composer.lock
 coverage/
 .phpunit.result.cache
 *.log

AGENTS.md

@@ -0,0 +1,47 @@
+# AGENTS.md
+
+## Commands
+
+```bash
+composer install
+composer test                     # PHPUnit — run after every code change
+composer lint                     # PHPStan (level 10, `src/` only)
+composer cs                       # PHPCS (WordPress standard + exclusions in phpcs.xml.dist)
+composer cs:fix                   # auto-fix coding standards
+composer build                    # -> dist/unsupervised-schedular-<version>.zip
+
+./vendor/bin/phpunit tests/Unit/Offering/OfferingRepositoryTest.php
+./vendor/bin/phpunit --filter testInsertReturnsId
+```
+
+CI (`.gitea/workflows/ci.yml`): `phpcs`, `phpstan`, `test` (PHP 8.1/8.2/8.3/8.5), `no-debug`. Write only PHP 8.1-compatible syntax. No `var_dump|var_export|print_r|error_log|dd|dump(` in `src/` — CI greps and fails.
+
+## Architecture
+
+- WordPress plugin, no front-end build (vanilla JS/CSS in `assets/`). PSR-4 `Unsupervised\Schedular\` -> `src/`.
+- **Package-by-domain:** `src/<Domain>/` (Auth, Availability, Booking, GroupClass, Guardian, Offering, Payment, Policy, Registration) owns its repos, services, endpoints, pages. Cross-cutting wiring lives directly in `src/`: `Plugin`, `Installer`, `Schema`, `AdminMenu`, `RestRegistrar`, `ShortcodeRegistrar`, `BlockRegistrar`, `Val`.
+- Entry: `unsupervised-schedular.php` -> `Plugin::boot()` (wires all dependencies). **Slug is `schedular`, not `scheduler`** — filename, text domain (`unsupervised-schedular`), option `us_schedular_version`, table prefix `us_`. Never "fix" the spelling.
+- REST: `/wp-json/us-scheduler/v1/`, `permission_callback` uses capability checks, never role names.
+- DB: custom `us_*` tables via `dbDelta`; `Schema::tables()` is the source of truth. **All `$wpdb` access inside repository classes only.**
+- `src/Val.php` coerces untyped WP input (`Val::int()`, `Val::string()`, `...OrNull`, etc.). For PHPCS, `Val::int/float/bool/...` count as unslashing passthrough only — still wrap with a real sanitizer: `absint( Val::int( $_GET['id'] ?? 0 ) )`.
+
+## Schema changes (gotcha)
+
+- `Plugin::boot()` only re-runs `Installer`/migrations when stored `us_schedular_version !== USC_VERSION`. **Bump both the `Version:` header and `USC_VERSION` in `unsupervised-schedular.php` or the change never reaches existing sites.**
+- `dbDelta` does not reliably relax column NULL-ability. Follow the existing pattern in `Plugin::boot()`: repository repair method + own `us_*` option flag (e.g. `us_questions_offering_nullable`), not the version gate.
+
+## Tests
+
+- Brain Monkey + Mockery, no live WP. All test classes extend `tests/Unit/TestCase.php` (handles `Monkey\setUp/tearDown`, stubs translations/escaping/`checked`/`selected`).
+- Mirror layout: `tests/Unit/<Domain>/` mirrors `src/<Domain>/`.
+  - `Functions\when('fn')->alias(fn() => ...)` (never `returnUsing()`); `->justReturn($v)` for constants.
+  - Use `when()` not `expect()` for argument-dependent routing.
+  - No `\Mockery::type()` inside plain arrays passed to `with()` — use `\Mockery::on()` or `\Mockery::any()`.
+  - `$wpdb` mock needs `$mock->prefix = 'wp_'` as a property.
+
+## Adding a feature
+
+1. Spec first: `docs/features/<feature-name>.md` (data model, API, classes, test paths).
+2. Code in `src/<Domain>/`; templates in `templates/` if needed.
+3. Tests in `tests/Unit/<Domain>/`.
+4. `composer test` must pass (also `composer lint` + `composer cs` before finishing).

CHANGELOG.md

@@ -11,6 +11,129 @@ When a `v*` tag is pushed, `.gitea/workflows/release.yml` publishes the matching
 the plugin to the next patch version and adds a fresh section here for it. Record
 each change under the current top section as you work.
 
+## [1.5.7]
+
+## [1.5.6]
+
+### Security
+- **Signing in on the front end no longer hands out a session cookie that can travel over plain HTTP.** The studio's own login form told WordPress not to work out for itself whether the site was secure, and WordPress took that as "it is not" — so on an HTTPS site every student's session cookie was issued without the flag that keeps a browser from ever sending it unencrypted. Anyone able to watch the network and provoke a single `http://` request to the site could have lifted a signed-in session with it. The form now leaves that judgement to WordPress, which is what the standard login screen has always done. Nothing changes for you; existing sessions are unaffected.
+- **Plugin updates are now only accepted from the release server itself.** The update check asks the repository where to download the new version and used to take whatever answer came back. An answer that was not really the release server's — a hijacked hostname, a tampered response — could have pointed the site at any file on the internet, which WordPress would then have unpacked over the plugin. The download address must now be `https` on `git.unsupervised.ca` exactly; a lookalike, a subdomain, or an unencrypted address is refused and no update is offered. Ordinary updates are unaffected.
+- **A student can no longer tell a booking that is not theirs from one that does not exist.** Cancelling someone else's lesson was already refused, but the refusal was worded differently from "no such booking" — enough for a signed-in student to work through the numbers and learn how many lessons the studio holds. Both now answer identically. Withdrawing from a group class was the same and has had the same treatment.
+- **Students created by anything other than the studio's own signup form now wait for approval.** Turning on open registration switches on WordPress's site-wide "anyone can register" setting and makes Student the default role for new accounts — which is what the studio's registration page needs, but it also arms any *other* signup form the site happens to have. An account created that way arrived able to book and be billed immediately, with no email confirmed, no approval and no policies agreed to. Any student account that appears without going through the studio's own form is now held and listed under **Students → Pending Students**, exactly like a self-signup; it can sign in, but cannot book until you approve it. Students you add yourself from wp-admin, invited students, and the children a parent adds are all unaffected.
+
+### Added
+- **You can now decide what deleting the plugin takes with it, on Access → Plugin removal.** WordPress gives an uninstall nothing to ask you with, so the answer is given ahead of time. By default your records stay: delete the plugin and your lessons, enrolments, payments, credits, intake answers, policy agreements, invites and family links are still there when you reinstall, so a delete during a migration or a bit of troubleshooting costs you nothing. Ticking **Erase everything when the plugin is deleted** — which also asks you to type DELETE, because there is no undo — drops every table, setting and role the plugin made. Either way your Stripe secret key and webhook signing secret are now forgotten on deletion, where before they stayed in the database indefinitely: they take a minute to paste back in, and live keys on a site that no longer has the code to use them are worth nothing but risk. The two WordPress settings open registration borrows are put back as they were, too, so deleting the plugin can never leave the site quietly accepting signups into a role that no longer exists.
+
+## [1.5.5]
+
+### Changed
+- **Payments moved up to version 21 of Stripe's PHP library**, from version 17. Being four major versions behind also meant asking Stripe to behave like an older version of its API; the plugin now uses API version `2026-07-29.dahlia`. Taking a card payment and handling a webhook are unchanged — the same charge is raised, the same events are honoured, and a forged webhook is still rejected. Nothing to do on your side.
+
+## [1.5.4]
+
+### Fixed
+- **Adding students to a group class now checks that each one is actually a student.** **Add students directly** and **Make available** acted on whatever ids the form posted without confirming they named students at all, so a stale page — or a tampered submission — could put an instructor, an administrator, or an account that had since been deleted onto a class roster, raising a real payment against them. Both controls now skip anything that is not a student, and the "%d student(s) added" count tells you how many actually went through. Children and students awaiting approval are unaffected: they are students, and adding them is what these controls are for.
+- **A refused booking no longer empties the Book a lesson for a student form.** Whatever the reason it came back — the time taken while you were typing, a weekly reservation asked for on a time that does not repeat — the panel reopens with the student, time, lesson type, both ticks and your note exactly as you left them, so a correction is one field, not five. A booking that goes through still leaves an empty form behind for the next one.
+- **Booking a lesson for a child, or for a student you have not approved yet, no longer fails with "Choose a student to book for."** The **Book a lesson for a student** panel offered every student it could see, but then refused a good half of them: a parent's child and a self-signup still awaiting approval both appeared in the list, and both were rejected on submit — with an error that read as though no student had been chosen, and which cleared the form. Neither of those accounts is allowed to book *in their own name* (a child's is never signed in to at all, and an unapproved signup waits for you), and the panel was mistakenly applying that same restriction to the studio booking on their behalf, which is precisely the case it was built for. Anyone the panel offers can now be booked for.
+
+## [1.5.3]
+
+### Added
+- **Intake answers and policy agreements can now be recorded after the fact for a lesson the studio booked, or a student it added straight into a group class.** A lesson booked from wp-admin has no answers and no signed policies — nobody was at a keyboard to give them — and until now there was nowhere to put them once the studio did collect them at the first lesson or over the phone. The lesson's detail page now carries **Record intake collected elsewhere**, offering whatever is still outstanding: the unanswered questions and the policy versions with no acceptance on file. Fill in what you have, leave the rest, come back later — nothing already recorded can be overwritten, and a form posted twice cannot duplicate anything. Every recording must say **how** it was collected — a signed paper form, in person, over the phone, by email, or some other way you describe — and that answer is stamped on each entry along with your name. Both audit tables gained a **How it was given** column, so a policy accepted online and one transcribed from paper can never again look like the same thing. Only registrations the studio made have the panel: one a student made already holds their own answers, and those stay theirs alone. Group classes work the same way, reached from the new **Intake → View** link on each roster row of a class's detail page — a student added with **Add students directly** was never shown the enrolment form, and this is where what you collect instead now goes.
+- **You can now book a lesson for a student yourself, from Scheduler or My Lessons.** Group classes have always had **Add students directly**, but a private lesson could only be booked by the student — or by their parent, for a child — so a booking taken over the phone, or a make-up lesson an instructor wanted to slot in, had no way in short of asking the family to go and do it themselves. **Book a lesson for a student**, a panel at the top of both lesson pages, takes the student, an open time and the lesson type and books it there and then. Tick **Reserve this time weekly** to hold the same time for the rest of the term, or **No charge** for a make-up or goodwill lesson — that one skips payment entirely and confirms the lesson immediately, where an ordinary booking raises a pending payment at the lesson type's price and confirms when it settles, exactly as a student's own booking does. The **Scheduler** reaches every instructor's open times; **My Lessons** shows an instructor only their own. Booking this way does not ask the intake questions or record the policy agreements the student would give themselves — those stay theirs to answer, so a lesson booked for someone simply shows none on its detail page.
+
+## [1.5.2]
+
+### Added
+- **You can now choose which payment method the studio bills by, instead of it following your Stripe keys.** Saving Stripe keys used to move every student onto credit-card billing the moment they were entered — there was no way to have Stripe live and still bill by e-transfer while you satisfied yourself that card payments worked. **Studio Settings → Billing → Default payment method** now makes that an explicit choice between **Credit card** and **E-transfer**. Leaving it on E-transfer with Stripe configured lets you switch one student at a time to Credit card on their student detail page and watch their bookings charge for real; when you are satisfied, changing this one setting moves everyone over. Credit card remains the default, so a studio that adds keys and changes nothing else behaves exactly as before, and it still falls back to e-transfer until keys are saved — a card cannot be charged without them.
+- **Stripe can now be disconnected from Studio Settings.** Keys could be replaced but never removed, so a studio that set Stripe up to try it had no way back to e-transfer short of editing the database. **Clear Stripe configuration**, at the foot of the settings page whenever any Stripe value is stored, forgets the publishable key, the secret key and the webhook signing secret, and returns the mode to Test — billing falls back to e-transfer until keys are entered again. Payments already recorded are untouched, as are your currency, HST, e-transfer and registration settings. If you are disconnecting for good, delete the webhook endpoint in the Stripe Dashboard too, or it will keep sending events this site can no longer verify.
+
+## [1.5.1]
+
+### Fixed
+- **A parent can now enrol more than one child in the same group class.** Enrolling the first student worked, and then the class card switched to "You are enrolled in this class." with a **Withdraw** button — for the whole account. There was no way to sign up a second child short of withdrawing the first, even though nothing was ever actually full or forbidden: the class page was matching enrolments to the account rather than to the student, so one child's seat spoke for everybody. Each enrolled student now gets their own line on the card, named — "Ada is enrolled in this class." — with their own Withdraw button, and the Enrol button stays put, reading **Enrol another student**, until everyone on the account is in. The form's "Who is this for?" list offers only the students not yet enrolled, so the class cannot be double-booked for the same child by accident. Enrolments already recorded are unaffected; the seats were always separate on the studio's side, and this is the page catching up with that.
+
+## [1.5.0]
+
+### Added
+- **A registration question can now be asked of students only, and can be required of a student without being required of the account holder.** Every account-signup question was asked of everybody who registered, on the same terms — so "School and grade" had to be put to the adult signing themselves up, and a question a studio needed answered for a child could only be made required by demanding it of everyone. Each question now says who it is asked of — everyone, or only the students you register on behalf of — and carries its own **Required** setting for each: optional for you, required for every student you enrol, is now a thing a studio can ask for. Existing questions are untouched: they stay asked of everyone, and one that was required stays required of everyone.
+- **You can now edit your own details on the profile page**, not just your students'. The page is called **Your profile**, and until now the one person on it you could not change was yourself: a mistyped name at signup, or a name that had since changed, meant asking the studio to fix it. **Your details** now sits at the top of the page with your name, your birth year, and whether you take lessons yourself. Your email address is shown but not editable — it is also how you sign in, so changing it stays a studio-side job.
+- **"I take lessons myself" can be corrected after signup.** Signup asks whether you are registering just yourself, only on behalf of students, or both, and the answer decides whether you are offered as a student when booking. Choosing wrongly — or taking up lessons later alongside the children you book for — used to leave you asking the studio to change it. Ticking the box makes you bookable again and asks for your birth year like any other student; unticking it takes you back off the list without discarding the birth year you already gave, so ticking it back on costs you nothing.
+
+### Fixed
+- **A recurring lesson now shows the policies the student accepted on every week of it, not just the first.** Booking a weekly lesson reserves a series of them, and the student answers the intake questions and agrees to the studio's policies once, for the whole reservation. Opening any week after the first showed no answers and no policies accepted — as though nothing had been agreed to. Nothing was ever missing: the agreement was recorded against the first lesson of the series and every other week was looking for one of its own. Each week of a series now shows the intake answers and the full acceptance record — policy, version, when it was accepted, and from where — captured when the reservation was booked. Existing bookings read correctly straight away; there is nothing to re-collect from anyone.
+
+## [1.4.1]
+
+### Added
+- **Group classes now appear in "Your upcoming lessons".** A class is stored as a term rather than as bookable slots, so nothing that listed lessons could ever show one — a student whose whole term was a group class saw an empty schedule, and an instructor teaching one saw nothing on their My Lessons page. Each remaining session of a class you are enrolled in now sorts in among your lessons by date, labelled **group class**; instructors see every session of the classes they teach, one row per session however many students are in it. A session has no Cancel button, because there is no such thing as cancelling one date of a term — withdrawing from the class is still done from the class page.
+- A class you are enrolled in shows up **whether or not its schedule is pinned to a clock**. Class time and duration are both optional on the offering form, and the schedule note is there so a studio can simply write "Tuesdays 4:00pm" — so a class with a time but no duration lists its dates and says when each session starts rather than guessing when it ends, and a class with no time at all gets a single row carrying its schedule note (or its term dates) where the time would go. Only a class whose last day has passed drops off the list.
+- A student's admin detail page now shows **Booked by** in the Account section — the name of the parent or guardian who books and pays for them, linked to their own page. It was only stated further down under Profile, and only when there was one; the row is now always there, saying in words when a student books for themselves.
+- The same group-class sessions now appear in **Upcoming lessons** on a student's admin detail page, so one table answers "what are they booked into next week?". Only upcoming ones — the **Group-class enrolments** table below already holds the history.
+- **A policy can be renamed.** The title was fixed at creation, so a typo or a change of wording meant creating a second policy and re-collecting everyone's acceptance. Renaming changes only what students read above the policy text: the slug stays put, so every version already accepted stays attached.
+
+### Fixed
+- **People are named by their name again, not their email address.** Anywhere the plugin named a person it could show their email instead — "Managed by grace@example.com" in the students table, the same under **Booked by**, and instructor names on the class pages. WordPress starts a new account's nickname off as its username, and signup uses the email address as the username, so the address became the nickname of every self-registered account; the name they had typed was sitting in the account's display name the whole time. Names are now read from there when the nickname turns out to be an address, so existing accounts read correctly with nothing to fix by hand, and new signups store the name properly in the first place. Students added by a parent were never affected.
+- **Deleting a parent now removes the students they booked for.** A managed student account has no login of its own and exists only so its parent has somebody to book for — with the parent gone nobody can reach it, book for it, or be billed for it, so it was left stranded on the roster still holding lesson times. Deleting a parent now releases each of their students' upcoming lessons and enrolments on the same terms as their own, and deletes the accounts. Removing a student from the family screen is unchanged and still refuses one with lessons on record.
+- **The upcoming-lessons panel no longer collapses onto itself in some themes.** Rows could render on top of one another and the status badge's colour could stop short of the text inside it. Both came from the same thing: the panel never stated its own line spacing, so a theme setting a line height of zero anywhere above it — a common icon-font reset — was inherited straight through, leaving each line of text taller than the space allotted to it. The panel now sets its own.
+- **Deleting a student now gives back what they had booked.** WordPress deletes a user without knowing anything about lessons, so their bookings were left behind: the times stayed marked as booked and nobody else could take them, the lessons stayed on the instructor's schedule under a name that no longer resolved, and a group class kept a seat filled by nobody. Deleting an account now cancels each of its upcoming lessons, frees the time for rebooking, cancels its active class enrolments, and voids any payment still pending on them. Past lessons are left exactly as they are — they happened, and the payment report has to keep adding up. A paid lesson is not credited back: a credit could only be spent on the account being deleted, so a refund owed to someone who has left stays the studio's decision to make.
+- **A weak password is now caught before the form is submitted, not after.** The strength meter scores the password as you type, but zxcvbn's dictionary arrives a moment after the page loads — so a password typed straight away was never scored at all, and the first you heard of it was the server rejecting the whole form. The password is now re-scored on submit, so the verdict is always the one your password actually earns.
+
+### Changed
+- **Signup is one page again.** The studio's registration questions used to be a second step behind a **Next** button; they are now asked on the main form, in an **About you** panel above the students you are adding. What the studio needs to know about you is part of registering, not a sequel to it — and there is now one submit rather than three.
+- **Signup asks an adult student for their birth year**, the same four-digit year already asked of every student being registered on someone else's behalf. It is asked only when you are a student yourself — choosing **on behalf of one or more students** leaves the whole **About you** panel out, since those questions describe a student and in that case you are not one.
+
+## [1.4.0]
+
+### Added
+- An **Account** block (`[us_account]`) showing who is signed in — their name and their email — and a **Sign out** link. Signing out returns to the login page chosen in the block, or to the page the visitor was already on when none is set, so putting it in a site header does not also move people somewhere. To a signed-out visitor it shows a **Sign in** link when a login page is chosen, and nothing at all when one is not: a panel about who is signed in has nothing to tell a stranger, and a notice they cannot act on is just clutter in a header.
+
+### Security
+- Signup now checks the password properly. The form scores it as you type with the same zxcvbn meter wp-admin uses and will not submit a weak one, and the server refuses — regardless of what the browser allowed — anything shorter than 8 characters, one of the well-known leaked passwords, one built from barely any distinct characters, or one containing your own name or email address. Composition rules ("must contain a symbol") are deliberately not imposed: they mostly produce predictable substitutions. Email addresses are validated on the server on every signup path, with a clear message when one is already registered.
+
+### Changed
+- Signup now asks **"Who are you registering?"** as a three-way choice — **just myself**, **on behalf of one or more students**, or **both** — in place of the single parent/guardian tick. The tick could only ever say "I have children to add"; it could not say whether the account holder was a student themselves, so every account was offered its own name in the **Who is this for?** picker whether or not anyone meant to book them a lesson. Choosing *on behalf of* now leaves the account holder out of that picker. Existing accounts are unaffected and stay bookable, since the flag records only the new "not a student" case.
+- The studio's **account-signup questions are now asked of anyone registering as a student**, including someone registering themselves alongside their children. Choosing **both** previously collected the questions per child only, so the account holder's own instrument, level and the rest were never asked for or stored, even though they could book lessons. Their answers are recorded against their own account, and a blank required answer now names them rather than blaming "each student".
+- A student's **name and birth year are now required**, marked in the form the same way a required registration question is and enforced on the server whichever way they were submitted. On signup the requirement applies only once the parent/guardian box is ticked, so registering for yourself is unaffected. A student block you have started filling in is now reported back to you rather than silently dropped when the name is missing — only a completely untouched spare block is still ignored.
+- Signup and the profile page now ask for a **birth year** rather than a full date of birth — a four-digit year between 1900 and the current year, with anything else discarded rather than stored. Students added before this change keep showing a birth year, derived from the date already on file; that old full date is then dropped the first time the record is saved, so the studio ends up holding only what it now asks for. No bulk purge runs, so a site wanting the remaining old dates gone should clear the `us_date_of_birth` user meta directly.
+- The interface now says **student** where it said "child" and **profile** where it said "family". The `[us_family]` page is headed **Your profile**, its form is **Add a student**, signup asks for a **Student's name**, and the wp-admin students list and student screen both label the relationship **Profile**. Two strings were reworded rather than swapped: the students list reads **Managed by _name_** (a bare "Student of _name_" would read as a teacher's pupil), and a managed account is described as a **managed student account** so it is not confused with the account holder. Internal names — database columns, request parameters, form field names, the `us_family` shortcode and the `us-scheduler/family` block — are unchanged, since they are contracts with existing installs and saved post content.
+
+### Fixed
+- **Booking a lesson no longer dead-ends on the confirmation.** The confirmation used to replace the calendar entirely, leaving a student who wanted a second lesson with nothing to click and no way back short of reloading the page. It is now a dismissible notice sitting above a freshly loaded calendar — the slot just taken already gone from it, the upcoming-lessons panel already updated — so "it worked" and "book another" are the same screen. Enrolling in a group class did the same thing and is fixed the same way.
+- Upcoming lesson rows no longer render on top of each other. The row's text sits in inline elements that a theme can pull out of normal flow, which dropped the date and time onto the lesson title and the status pill onto the Cancel button; those elements are now pinned into flow alongside the rest of the panel's theme-proofing. The rows held behind **Show all** also stayed visible under the `div { display: block }` reset that many themes still carry, since `[hidden]` is only a browser default — they are now hidden for real.
+
+## [1.3.0]
+
+### Added
+- **Parent and guardian accounts.** A parent registers once and manages lessons for one or more children, who need no login of their own. The signup form gains an **"I'm registering as a parent or guardian"** tick that reveals a block per child — name, date of birth, and the studio's account-signup questions asked **per child**, since those describe the student rather than the account holder. Signup policies are recorded once per child with the guardian named as the person who agreed, which is the record that actually means something: "this guardian accepted version N on behalf of this child, at this time, from this address." A guardian can also be a student themselves and book their own lessons from the same account.
+- A **"Who is this for?"** picker on the booking and group-class forms, listing **children first** and the account holder last — so the default selection is never the parent, and a lesson meant for a child is not quietly booked and billed in the parent's name. An account with only itself on the list sees no picker and behaves exactly as before. A guardian's upcoming-lessons panel covers the whole household, each row naming whose lesson it is, and they can cancel or withdraw for any of their children.
+- A **Family** page for guardians (`[us_family]`, or the **Family** block) to add, edit and remove children after signup. Removing a child is refused once they have lessons or enrolments on record — that history belongs to them, and the studio unpicks it by hand rather than the page orphaning it.
+- **One family, one bill.** Payments record the child the lesson was for *and* the guardian who owes it, so per-child reporting is unchanged while notices, receipts and the payment step all go to the parent. Account credit is held by the payer, so a credit from one child's cancelled lesson can settle a sibling's next charge, and the billing-method override (comp / card / e-transfer) is one setting on the guardian rather than one per child. The daily billing scan sends a guardian **one** notice covering every child, with each line naming whose lesson it is.
+- **Students** in wp-admin gains a **Family** column linking a child to their guardian and a guardian to their children, and the student screen gains a **Family** panel. A child's row shows the guardian's email — a child's own address is a placeholder that can never receive mail — and their credit balance is labelled with whose account actually holds it.
+
+### Changed
+- Child accounts **cannot be signed in to**. They hold the student role so every existing lookup keeps working, but authentication is refused outright and the booking capability is withheld, so the only route to a lesson in a child's name is their guardian's authorised booking.
+
+## [1.2.4]
+
+### Fixed
+- **Adding availability no longer fails in silence.** Entering a window shorter than the chosen lesson length — 5:30–6:00 PM with the lesson length left on its default of 60 minutes, say — saved nothing and said nothing: the page just reloaded, whether the window was one-off or set to repeat for 41 weeks. The **Lesson length** menu now offers only the lengths that actually fit the window you have entered, and the form refuses to submit when none of them do. Every other way the form could quietly do nothing now explains itself too — an unreadable date, an end time before the start, a window running past midnight into the next day — and a successful save says how many bookable slots it created. Deleting says whether the slot went, and tells you when one is refused because it is already booked. Availability added through the API is checked against exactly the same rules, which it previously enforced slightly differently.
+- A student's **upcoming lessons no longer pile on top of each other**. On the booking page, the lesson name, its date and time, the status badge and the **Cancel** button could render over one another instead of sitting in a tidy row — worst with a long lesson-type name, and on narrow screens, where the row had no phone layout at all. The panel now keeps its shape whatever the theme around it does, long names wrap instead of shoving the Cancel button out of the row, and on a phone the lesson details stack above the buttons.
+- The registration page **no longer dead-ends a visitor who is already signed in**. It used to greet them with "You already have an account and are logged in." and nothing else, leaving them to find their own way to the studio. They now get a link onward to the page chosen under the block's **After registration** panel, and the link names it — "Continue to Book a Lesson" rather than the vaguer wording an invited student used to see. With no page chosen, the message appears on its own as before, because sending someone who is already signed in to the sign-in screen helps nobody.
+
+## [1.2.3]
+
+### Changed
+- A **monthly group class is now billed its price once per month**, however many times the class meets in that month. Previously the monthly charge multiplied the price by the number of sessions in the month — a class priced at `40.00 CAD` meeting weekly was billed `160.00 CAD` on the 1st — which no studio could quote honestly on a class card. A monthly **private lesson** is unchanged: its price is a per-lesson fee and the month is still billed one fee per lesson, which is why it is quoted per lesson. Studios running a monthly group class should check the class price now reads as the monthly fee they intend to charge.
+
+### Added
+- Every price a student sees now says **when** it is due. Lesson types in the booking form read `50.00 CAD at booking`, and group-class cards read `120.00 CAD up front`, `40.00 CAD weekly` or `40.00 CAD monthly` — the offering's billing mode, in the student's words. A monthly **private lesson** is quoted per lesson (`50.00 CAD per lesson monthly`), since its monthly charge covers every lesson booked that month; a monthly group class is quoted as the monthly figure it is. A free offering still just reads **Free**.
+- The **Policies** admin page can now **show you what is actually in a version**. Every row in the versions table has a **View** button that opens that version's text below the table, rendered exactly as students see it at booking and signup, whether the version is the published one, an old archived one, or a draft nobody has seen yet. The text is editable straight from the viewer, and what happens when you save depends on the version: a draft is simply updated in place, while editing a **published or archived version saves your text as a new draft version** and leaves the original exactly as students accepted it. The new draft then opens in the viewer ready to publish. Nothing a student has agreed to is ever rewritten.
+- Booking a lesson and enrolling in a class now take a **second confirmation that the student agrees to pay**. Above the Confirm button the form restates the price with its cadence, spells out how it is collected ("Charged on the 1st of each month, for that month's lessons"), adds the studio's HST so the figure matches the total actually billed, and requires a tick on "I agree to pay 56.50 CAD at booking." before it will submit — separate from, and in addition to, the studio policies the student accepts above it. Reserving a time weekly quotes the per-lesson fee and the most it can add up to ("up to 12 lessons, 678.00 CAD in total"), since a week another student takes first is simply not booked. Free offerings have nothing to agree to and show no price block.
+
+### Fixed
+- Policies are **readable where students have to accept them**. A policy typed as plain paragraphs — the normal way to write one, with no HTML — was being dropped into the booking, enrolment, and signup forms unformatted, collapsing the whole document into a single squashed line with a horizontal scrollbar and words piling on top of each other. Policy text is now formatted the same way WordPress formats post content, so blank lines become real paragraphs, and the acceptance box is styled as a proper bounded reading panel: long policies scroll vertically instead of running off the side of the page, long pasted links wrap rather than forcing the page sideways, and the "I have read and agree" tick stays in view. Policies written with HTML are unaffected. The studio registration page was also missing the plugin's stylesheet entirely, which is why the problem was at its worst there.
+
 ## [1.2.2]
 
 ### Added

CLAUDE.md

@@ -1,115 +1,3 @@
 # CLAUDE.md
 
-This file provides guidance to Claude Code (claude.ai/code) when working with code in this repository.
-
-## Commands
-
-```bash
-composer install                  # Install all dependencies
-
-composer test                     # Run the full test suite (required after every change)
-composer lint                     # PHPStan static analysis
-composer cs                       # PHPCS coding standards check
-composer cs:fix                   # Auto-fix coding standards
-
-# Run a single test file
-./vendor/bin/phpunit tests/Unit/Availability/AvailabilityRepositoryTest.php
-
-# Run a single test by name
-./vendor/bin/phpunit --filter testInsertCallsWpdbInsertAndReturnsId
-```
-
-**Run `composer test` after every code change before considering a task complete.**
-
-## Architecture
-
-### Plugin Bootstrap
-`unsupervised-schedular.php` defines constants (`USC_VERSION`, `USC_PLUGIN_DIR`, `USC_PLUGIN_URL`), registers activation/deactivation hooks, then calls `Plugin::boot()` on `plugins_loaded`. No logic lives in the root file.
-
-### Directory Structure
-```
-src/                  — All plugin PHP (PSR-4 namespace: Unsupervised\Schedular\)
-  Availability/       — Availability slots: value object, repository, controller, REST endpoint
-  Booking/            — Lessons/bookings: value object, repository, controller, REST endpoint, shortcode page
-  Auth/               — Roles, capabilities, login page
-  Plugin.php          — Wires all components together on plugins_loaded
-  Installer.php       — Creates DB tables and roles on activation
-  Schema.php          — CREATE TABLE SQL for dbDelta
-  AdminMenu.php       — Registers wp-admin menu pages
-  RestRegistrar.php   — Registers all REST routes under us-scheduler/v1
-  ShortcodeRegistrar.php — Registers [us_booking] and [us_student_login] shortcodes
-  BlockRegistrar.php  — Registers Gutenberg dynamic-block wrappers for the shortcodes
-  BlockPreview.php    — Static editor-preview markup for the blocks
-templates/            — PHP view files included by controllers/shortcodes
-assets/               — CSS and JS (vanilla JS, no build step)
-tests/Unit/           — PHPUnit unit tests (PSR-4: Unsupervised\Schedular\Tests\)
-  Availability/       — Tests for src/Availability/
-  Booking/            — Tests for src/Booking/
-  Auth/               — Tests for src/Auth/
-docs/features/        — One markdown file per feature describing data model, API, and test locations
-```
-
-**Code is organised package-by-domain** (Availability, Booking, Auth). Each domain package contains everything related to that domain: value objects, repositories, controllers, REST endpoints, and shortcode pages. Cross-cutting wiring classes (Plugin, AdminMenu, RestRegistrar, ShortcodeRegistrar, Schema) live directly under `src/`.
-
-### Data Storage
-Two custom database tables (created via `dbDelta` on activation):
-- `{prefix}us_availability` — instructor availability windows
-- `{prefix}us_lessons` — booked lessons
-
-All database access goes through repository classes within their domain package. No direct `$wpdb` calls outside repositories.
-
-### Key Classes
-
-| Class | Responsibility |
-|---|---|
-| `Plugin` | Wires all components together on `plugins_loaded` |
-| `Installer` | Creates DB tables and roles on activation |
-| `Schema` | CREATE TABLE SQL strings for dbDelta |
-| `AdminMenu` | Registers wp-admin menu pages |
-| `RestRegistrar` | Registers all REST routes under `us-scheduler/v1` |
-| `ShortcodeRegistrar` | Registers `[us_booking]` and `[us_student_login]` shortcodes |
-| `BlockRegistrar` | Registers Gutenberg dynamic-block wrappers for the shortcodes |
-| `BlockPreview` | Static editor-preview markup for the blocks |
-| `Val` | Runtime coercion of untyped WP boundary values (wpdb rows, REST params, superglobals) |
-| `Auth\RoleManager` | Registers `us_instructor` and `us_student` roles with custom caps |
-| `Auth\LoginPage` | Renders front-end student login form |
-| `Availability\AvailabilitySlot` | Immutable value object for a slot row |
-| `Availability\AvailabilityRepository` | CRUD for availability slots |
-| `Availability\AvailabilityController` | Instructor availability management page |
-| `Availability\AvailabilityEndpoint` | REST handlers for availability CRUD |
-| `Booking\Lesson` | Immutable value object for a lesson row |
-| `Booking\BookingRepository` | CRUD for lesson bookings |
-| `Booking\BookingEndpoint` | REST handlers for booking and status updates |
-| `Booking\BookingPage` | Renders student booking UI shell (JS takes over) |
-| `Booking\LessonController` | Admin and instructor lesson list pages |
-
-### REST API Namespace
-All endpoints live under `/wp-json/us-scheduler/v1/`. Permissions are enforced via `permission_callback` using capability checks (`manage_availability`, `book_lesson`), never role name checks.
-
-### Testing Approach
-Tests use [Brain\Monkey](https://brain-wp.github.io/BrainMonkey/) to stub WordPress functions without a full WP installation, and Mockery to mock `$wpdb` and other dependencies.
-
-All test classes extend `tests/Unit/TestCase.php`, which handles `Monkey\setUp()` / `Monkey\tearDown()` and stubs all WP translation/escape functions automatically.
-
-**Brain\Monkey API notes:**
-- `Functions\when('fn')->alias(fn() => ...)` — stub with a closure (NOT `returnUsing()`)
-- `Functions\when('fn')->justReturn($val)` — stub returning a fixed value
-- `Functions\expect('fn')->once()->with(...)` — assert call count and arguments
-- Use `Functions\when()` (not `Functions\expect()`) when you need argument-routing (e.g. `get_role` returning different values per argument) to avoid chaining ambiguity
-- Mockery matchers (e.g. `\Mockery::type()`) inside plain PHP arrays do not work with `with()` — use `\Mockery::on(fn($arr) => ...)` or `\Mockery::any()` instead
-- When mocking `$wpdb`, set `$mock->prefix = 'wp_'` explicitly — it is a public property, not a method
-
-### Adding a Feature
-0. **If the feature touches `Schema.php`, bump both the `Version:` header and `USC_VERSION` in `unsupervised-schedular.php`.** `Plugin::boot()` only re-runs `Installer`/`dbDelta` when the stored `us_schedular_version` differs, so a schema change without a version bump never reaches existing sites and inserts into new columns fail silently.
-1. Write the feature doc in `docs/features/<feature-name>.md` (data model, API, classes, test paths).
-2. Create a domain package under `src/<Domain>/` containing all classes for that feature.
-3. Add template(s) under `templates/` if needed.
-4. Write unit tests under `tests/Unit/<Domain>/` mirroring the `src/<Domain>/` structure.
-5. Run `composer test` — all tests must pass before the feature is complete.
-
-### CI
-Gitea Actions (`.gitea/workflows/ci.yml`) runs on every push and pull request:
-- **lint** — PHPCS WordPress coding standards
-- **static-analysis** — PHPStan level 10
-- **test** — PHPUnit on PHP 8.1, 8.2, 8.3
-- **no-debug** — rejects commits with `var_dump`, `error_log`, etc. in `src/`
+See `AGENTS.md` — it is the single source of truth for working in this repo.

assets/css/frontend.css

@@ -34,47 +34,125 @@
     margin-top: 8px;
 }
 
-.us-my-lessons {
+/*
+ * The upcoming-lessons panel. Every rule here is scoped under #us-booking-app —
+ * the same id-level specificity .us-slot above uses — because these rows sit in
+ * whatever layout the theme provides and carry more content than a calendar
+ * cell. Bare class selectors lost to theme rules on div/span/strong, which
+ * collapsed the flex layout and piled the details on top of the actions.
+ */
+#us-booking-app .us-my-lessons {
     margin-bottom: 24px;
 }
 
-.us-my-lesson {
+#us-booking-app .us-my-lesson {
+    box-sizing: border-box;
+    max-width: 100%;
     border: 1px solid #ddd;
     border-radius: 4px;
     padding: 12px 16px;
     margin-bottom: 8px;
     display: flex;
+    flex-wrap: wrap;
     justify-content: space-between;
     align-items: center;
-    gap: 12px;
+    gap: 8px 12px;
 }
 
-.us-my-lesson-info {
+/*
+ * `min-width: 0` lets the title column shrink below its content width — without
+ * it a long offering title cannot compress and shoves the status pill and
+ * Cancel button out of the row. The flex-basis keeps the details and the
+ * actions on one line while there is room, and wraps them once there is not.
+ */
+#us-booking-app .us-my-lesson-info {
     display: flex;
     flex-direction: column;
     gap: 2px;
+    flex: 1 1 14em;
+    min-width: 0;
 }
 
-.us-my-lesson-title {
+#us-booking-app .us-my-lesson-title,
+#us-booking-app .us-my-lesson-when {
+    overflow-wrap: break-word;
+    word-break: break-word;
+}
+
+#us-booking-app .us-my-lesson-title {
     font-size: 1.05em;
 }
 
-.us-my-lesson-duration {
+#us-booking-app .us-my-lesson-duration {
     font-weight: normal;
     color: #666;
 }
 
-.us-my-lesson-when {
+#us-booking-app .us-my-lesson-when {
     color: #555;
 }
 
-.us-my-lesson-actions {
+#us-booking-app .us-my-lesson-actions {
     display: flex;
-    gap: 12px;
+    flex-wrap: wrap;
+    gap: 8px 12px;
     align-items: center;
 }
 
-.us-show-all-lessons {
+/*
+ * Theme-proofing for the leaf text. The row and its two columns are divs with
+ * explicit flex rules above, but the text itself still sits in inline elements
+ * a theme is free to take out of normal flow — an absolutely positioned,
+ * floated or negatively offset span drops the date/time on top of the title and
+ * the status pill on top of the Cancel button. Pinning the properties that
+ * would have to change keeps the leaves in flow, at the same id-level
+ * specificity the rules above rely on.
+ *
+ * `line-height` is pinned for the same reason and is the subtler one, because a
+ * theme does not have to target this panel to break it — it is inherited, so a
+ * `line-height: 0` anywhere above (the usual icon-font or sprite reset) reaches
+ * these elements untouched. Below 1 it produces both halves of the same bug: a
+ * line box shorter than its glyphs, so stacked lines in the details column
+ * overlap, and an inline-block pill whose background is shorter than the text
+ * sitting in it. Nothing here should ever inherit a line-height, so the panel
+ * states its own.
+ */
+#us-booking-app .us-my-lesson,
+#us-booking-app .us-my-lesson-info,
+#us-booking-app .us-my-lesson-actions,
+#us-booking-app .us-my-lesson-title,
+#us-booking-app .us-my-lesson-when,
+#us-booking-app .us-my-lesson-duration,
+#us-booking-app .us-my-lesson-who,
+#us-booking-app .us-my-lesson-kind,
+#us-booking-app .us-lesson-status {
+    line-height: 1.45;
+}
+
+#us-booking-app .us-my-lesson-title,
+#us-booking-app .us-my-lesson-when,
+#us-booking-app .us-my-lesson-duration,
+#us-booking-app .us-my-lesson-who,
+#us-booking-app .us-my-lesson-kind,
+#us-booking-app .us-lesson-status {
+    position: static;
+    float: none;
+    margin: 0;
+    vertical-align: middle;
+}
+
+/*
+ * The rows the "Show all" button reveals. `[hidden]` is only a UA-stylesheet
+ * rule, so any author rule setting a display on div beats it — the html5-reset
+ * `div { display: block }` is still widespread in themes — and the rows the
+ * button is meant to gate render anyway. An author !important is the only way
+ * to win that cascade.
+ */
+#us-booking-app [hidden] {
+    display: none !important;
+}
+
+#us-booking-app .us-show-all-lessons {
     background: transparent;
     border: 1px solid #ccc;
     border-radius: 4px;
@@ -82,11 +160,11 @@
     cursor: pointer;
 }
 
-.us-show-all-lessons:hover {
+#us-booking-app .us-show-all-lessons:hover {
     border-color: #888;
 }
 
-.us-cancel-lesson {
+#us-booking-app .us-cancel-lesson {
     background: transparent;
     border: 1px solid #ccc;
     border-radius: 4px;
@@ -95,24 +173,26 @@
     color: #c00;
 }
 
-.us-cancel-lesson:hover {
+#us-booking-app .us-cancel-lesson:hover {
     border-color: #c00;
 }
 
-.us-lesson-status {
+#us-booking-app .us-lesson-status {
+    display: inline-block;
     font-size: 0.85em;
     font-weight: 600;
     padding: 2px 10px;
     border-radius: 10px;
     background: #eee;
+    white-space: nowrap;
 }
 
-.us-lesson-status-confirmed {
+#us-booking-app .us-lesson-status-confirmed {
     background: #e2f5e5;
     color: #1a7d2e;
 }
 
-.us-lesson-status-pending {
+#us-booking-app .us-lesson-status-pending {
     background: #fdf3d7;
     color: #8a6d1a;
 }
@@ -241,6 +321,102 @@
     opacity: 0.4;
 }
 
+/* The price and pay agreement on a booking / enrolment form. */
+.us-price {
+    border: 1px solid #ddd;
+    border-radius: 4px;
+    padding: 12px 16px;
+    margin: 16px 0;
+}
+
+.us-price h4 {
+    margin: 0 0 8px;
+}
+
+.us-price p {
+    margin: 0 0 4px;
+}
+
+.us-price-amount strong {
+    font-size: 1.15em;
+}
+
+.us-price-cadence {
+    margin-left: 4px;
+}
+
+.us-price-tax,
+.us-price-note {
+    font-size: 0.9em;
+    opacity: 0.8;
+}
+
+.us-price-agree {
+    display: block;
+    margin-top: 12px;
+    font-weight: 600;
+}
+
+/* The cadence-carrying price on a group-class card. */
+.us-class-price {
+    font-weight: 600;
+}
+
+/* Policy acceptance — booking, enrolment, and signup all render this markup. */
+.us-policy {
+    margin: 16px 0;
+}
+
+.us-policy h4 {
+    margin: 0 0 6px;
+}
+
+/*
+ * The body is admin-authored HTML sitting inside whatever layout the theme
+ * provides, so it gets an explicit reading box rather than inheriting one.
+ * `overflow-wrap` breaks pasted URLs instead of letting one long token force
+ * the horizontal scrollbar, and the bounded height keeps a long policy from
+ * pushing the accept checkbox off the screen.
+ */
+.us-policy-body {
+    box-sizing: border-box;
+    max-width: 100%;
+    max-height: 260px;
+    overflow-y: auto;
+    overflow-x: hidden;
+    padding: 12px 14px;
+    margin-bottom: 8px;
+    border: 1px solid #ddd;
+    border-radius: 4px;
+    background: #fafafa;
+    white-space: normal;
+    overflow-wrap: break-word;
+    word-break: break-word;
+    line-height: 1.5;
+    text-align: left;
+}
+
+.us-policy-body p,
+.us-policy-body ul,
+.us-policy-body ol {
+    margin: 0 0 0.75em;
+    max-width: 100%;
+}
+
+.us-policy-body ul,
+.us-policy-body ol {
+    padding-left: 1.5em;
+}
+
+.us-policy-body > :last-child {
+    margin-bottom: 0;
+}
+
+.us-policy-accept,
+.us-policies input[type="checkbox"] {
+    margin-right: 6px;
+}
+
 @media (max-width: 640px) {
     .us-week-grid {
         grid-template-columns: 1fr;
@@ -249,6 +425,268 @@
     .us-week-day {
         min-height: 0;
     }
+
+    /*
+     * A lesson row carries a title, a date/time, a status pill and a button —
+     * more than fits one narrow line, so stack the details above the actions
+     * rather than letting them wrap into each other.
+     */
+    #us-booking-app .us-my-lesson {
+        flex-direction: column;
+        align-items: stretch;
+    }
+
+    #us-booking-app .us-my-lesson-info {
+        flex: 0 0 auto;
+    }
+}
+
+/*
+ * "Who is this for?" picker — booking and enrolment. Present only on an account
+ * that books for more than one person, so it is styled as a normal field rather
+ * than a callout.
+ */
+.us-student-picker select {
+    max-width: 100%;
+}
+
+/*
+ * Whose lesson a row in the upcoming panel is — only shown on an account that
+ * books for more than one person. Scoped under #us-booking-app like the rest of
+ * the panel; as a bare class it was the one rule in the group a theme could
+ * outrank on a plain span.
+ */
+#us-booking-app .us-my-lesson-who {
+    font-weight: normal;
+    opacity: 0.75;
+}
+
+/*
+ * Marks a row in the upcoming panel as a group-class session. The list mixes
+ * one-to-one lessons and classes, and only the class rows have no Cancel button
+ * — without a label that reads as a missing button rather than a different kind
+ * of thing.
+ */
+#us-booking-app .us-my-lesson-kind {
+    display: inline-block;
+    margin-left: 6px;
+    padding: 1px 6px;
+    border-radius: 10px;
+    background: #eef1f5;
+    color: #3c434a;
+    font-size: 0.75em;
+    font-weight: 600;
+    text-transform: uppercase;
+    letter-spacing: 0.03em;
+    vertical-align: middle;
+}
+
+/*
+ * The signup form's grouped sections: who you are registering, your own
+ * details, and the students you are adding. One box style for all three so the
+ * form reads as a short list of decisions rather than an undifferentiated
+ * column of fields.
+ */
+.us-reg-group {
+    margin: 16px 0;
+    padding: 12px 14px;
+    border: 1px solid #ddd;
+    border-radius: 4px;
+}
+
+.us-reg-group legend {
+    padding: 0 6px;
+    font-weight: 600;
+}
+
+.us-children-intro {
+    margin-top: 0;
+    font-size: 0.9em;
+    opacity: 0.8;
+}
+
+/*
+ * Each child is a bordered group so a family of three does not read as one long
+ * undifferentiated column of fields.
+ */
+.us-child {
+    margin-bottom: 12px;
+    padding: 10px 12px;
+    border-left: 3px solid #ddd;
+    background: #fafafa;
+}
+
+.us-child > p:last-child {
+    margin-bottom: 0;
+}
+
+/* The guardian's manage-children screen ([us_family]). */
+
+/*
+ * The account holder's own details, set off from the students below so the two
+ * halves of the page do not read as one long form.
+ */
+.us-family-self {
+    margin-bottom: 24px;
+    padding-bottom: 16px;
+    border-bottom: 1px solid #eee;
+}
+
+.us-family-self-email span {
+    font-weight: 600;
+}
+
+/*
+ * Guidance under a control, not a label: it explains when a field matters
+ * rather than naming it, so it is sized down and reads after the input.
+ */
+.us-field-hint {
+    display: block;
+    margin-top: 4px;
+    font-size: 0.9em;
+    opacity: 0.75;
+}
+
+.us-family-list {
+    margin: 0 0 20px;
+    padding: 0;
+    list-style: none;
+}
+
+.us-family-child {
+    display: flex;
+    flex-wrap: wrap;
+    gap: 8px 12px;
+    align-items: baseline;
+    padding: 10px 0;
+    border-bottom: 1px solid #eee;
+}
+
+.us-family-child-name {
+    font-weight: 600;
+}
+
+.us-family-child-birth-year {
+    font-size: 0.9em;
+    opacity: 0.75;
+}
+
+/*
+ * The actions sit at the far end of the row. Remove is its own form (it posts),
+ * so it is forced inline rather than taking a block of its own.
+ */
+.us-family-child-actions {
+    display: flex;
+    gap: 10px;
+    align-items: baseline;
+    margin-left: auto;
+}
+
+.us-family-remove {
+    display: inline;
+}
+
+/* The editing row replaces the child's line, so it spans the whole width. */
+.us-family-edit {
+    width: 100%;
+}
+
+@media (max-width: 640px) {
+    /* A name, a date and two actions do not fit one narrow line. */
+    .us-family-child-actions {
+        margin-left: 0;
+        width: 100%;
+    }
+}
+
+/*
+ * The live password verdict under the signup field. Colour is a reinforcement,
+ * not the message — the text says what is wrong on its own, so this still reads
+ * correctly to anyone who cannot separate the hues.
+ */
+.us-password-strength {
+    display: block;
+    margin-top: 4px;
+    font-size: 0.85em;
+}
+
+.us-password-strength.is-short,
+.us-password-strength.is-weak {
+    color: #c00;
+}
+
+.us-password-strength.is-medium {
+    color: #7a5c00;
+}
+
+.us-password-strength.is-strong {
+    color: #1a7d2e;
+}
+
+/*
+ * The account panel: who is signed in, and the way out. Sized to sit in a
+ * header or sidebar, so the rules stay minimal and inherit the theme's type —
+ * a block that lands in a site header should look like it belongs there.
+ */
+.us-account p {
+    margin: 0 0 4px;
+}
+
+.us-account-name {
+    font-weight: 600;
+}
+
+.us-account-email {
+    display: block;
+    font-size: 0.9em;
+    opacity: 0.75;
+}
+
+.us-account-actions {
+    margin-top: 8px;
+}
+
+/*
+ * `[hidden]` is a UA-stylesheet rule, so the widespread `div { display: block }`
+ * theme reset outranks it — the same trap the upcoming-lessons panel hit. An
+ * author !important is the only way to win, and it has to sit before the
+ * display rule it guards against.
+ */
+.us-notice[hidden] {
+    display: none !important;
+}
+
+/*
+ * The "you're booked" / "you're enrolled" notice. It sits above the calendar
+ * or class list rather than replacing it, so it needs to read as a banner
+ * about something that just happened — not as the page's content.
+ */
+.us-notice {
+    display: flex;
+    flex-wrap: wrap;
+    justify-content: space-between;
+    align-items: center;
+    gap: 8px 16px;
+    margin-bottom: 16px;
+    padding: 12px 16px;
+    border: 1px solid #b7dfc0;
+    border-left-width: 4px;
+    border-radius: 4px;
+    background: #f2faf4;
+    color: #1a5c2a;
+}
+
+.us-notice p {
+    margin: 0;
+}
+
+.us-notice-dismiss {
+    background: transparent;
+    border: 1px solid currentColor;
+    border-radius: 4px;
+    padding: 4px 12px;
+    color: inherit;
+    cursor: pointer;
 }
 
 /* Shown only in block-editor previews (see BlockPreview). */

assets/js/availability-admin.js

@@ -0,0 +1,98 @@
+/**
+ * Availability form: keep the lesson-length choices honest.
+ *
+ * A window is stored as consecutive lesson-length slots, so one shorter than the
+ * chosen lesson length holds no slots at all and saves nothing. Picking 5:30–6:00
+ * PM while the length select sat on its default of 60 minutes used to do exactly
+ * that, silently. The server now rejects it with a message; this narrows the
+ * choices first so the mistake is hard to make.
+ *
+ * This is a convenience only — AvailabilityController and the REST endpoint both
+ * validate the same window server-side regardless of what happens here.
+ */
+(function () {
+    'use strict';
+
+    const form = document.getElementById('usc-add-availability');
+    if (!form) return;
+
+    const startEl    = document.getElementById('start_dt');
+    const endEl      = document.getElementById('end_dt');
+    const durationEl = document.getElementById('duration_minutes');
+    const warningEl  = document.getElementById('usc-duration-warning');
+    const submitEl   = form.querySelector('input[type="submit"], button[type="submit"]');
+
+    if (!startEl || !endEl || !durationEl) return;
+
+    /**
+     * Minutes between the two datetime-local inputs, or 0 when the pair is not a
+     * usable window yet — empty, unparseable, backwards, or spanning two days
+     * (which the server rejects on its own terms, with its own message).
+     */
+    function windowMinutes() {
+        const start = new Date(startEl.value);
+        const end   = new Date(endEl.value);
+
+        if (!startEl.value || !endEl.value || isNaN(start) || isNaN(end)) return 0;
+        if (end <= start) return 0;
+        if (startEl.value.slice(0, 10) !== endEl.value.slice(0, 10)) return 0;
+
+        return Math.round((end - start) / 60000);
+    }
+
+    function refresh() {
+        const minutes = windowMinutes();
+        const options = Array.from(durationEl.options);
+
+        // No usable window yet: leave every choice alone rather than fighting
+        // someone part-way through typing a date.
+        if (minutes === 0) {
+            options.forEach((option) => {
+                option.hidden   = false;
+                option.disabled = false;
+            });
+            setBlocked(false);
+            return;
+        }
+
+        let fits = [];
+
+        options.forEach((option) => {
+            const tooLong = Number(option.value) > minutes;
+
+            option.hidden   = tooLong;
+            option.disabled = tooLong;
+
+            if (!tooLong) fits.push(option);
+        });
+
+        if (fits.length === 0) {
+            // Nothing bookable fits, so the form cannot produce a single slot.
+            setBlocked(true);
+            return;
+        }
+
+        setBlocked(false);
+
+        // The selection may have just been hidden — fall back to the longest
+        // length that still fits, which is what the instructor most likely wants.
+        if (durationEl.selectedOptions[0] && durationEl.selectedOptions[0].disabled) {
+            durationEl.value = fits.reduce(
+                (longest, option) => (Number(option.value) > Number(longest.value) ? option : longest),
+                fits[0]
+            ).value;
+        }
+    }
+
+    function setBlocked(blocked) {
+        if (warningEl) warningEl.hidden = !blocked;
+        if (submitEl) submitEl.disabled = blocked;
+    }
+
+    startEl.addEventListener('change', refresh);
+    startEl.addEventListener('input', refresh);
+    endEl.addEventListener('change', refresh);
+    endEl.addEventListener('input', refresh);
+
+    refresh();
+}());

assets/js/blocks.js

@@ -282,6 +282,53 @@
                 })
             ),
         },
+        {
+            name: 'us-scheduler/family',
+            title: __('Profile', 'unsupervised-schedular'),
+            description: __('Lets a parent or guardian add, edit and remove the students they book lessons for.', 'unsupervised-schedular'),
+            icon: 'groups',
+            // 'family' and 'children' are kept as search terms only — they are
+            // never displayed, and the block answered to them before it was
+            // renamed, so anyone reaching for the old word still finds it.
+            keywords: ['profile', 'students', 'family', 'children', 'guardian', 'parent'],
+            shortcode: 'us_family',
+            attributes: {
+                loginPageId: { type: 'number', default: 0 },
+            },
+            inspector: (attributes, setAttributes) => el(
+                PanelBody,
+                { title: __('Logged-out visitors', 'unsupervised-schedular') },
+                el(PageSelect, {
+                    label: __('Login page', 'unsupervised-schedular'),
+                    help: __('Where visitors who are not signed in are sent to log in.', 'unsupervised-schedular'),
+                    defaultLabel: __('WordPress login screen', 'unsupervised-schedular'),
+                    value: attributes.loginPageId,
+                    onChange: (loginPageId) => setAttributes({ loginPageId }),
+                })
+            ),
+        },
+        {
+            name: 'us-scheduler/account',
+            title: __('Account', 'unsupervised-schedular'),
+            description: __('Shows the name and email of whoever is signed in, with a sign out link. Renders nothing for signed-out visitors unless a login page is chosen.', 'unsupervised-schedular'),
+            icon: 'admin-users',
+            keywords: ['account', 'sign out', 'log out', 'signed in', 'profile'],
+            shortcode: 'us_account',
+            attributes: {
+                loginPageId: { type: 'number', default: 0 },
+            },
+            inspector: (attributes, setAttributes) => el(
+                PanelBody,
+                { title: __('Signing in and out', 'unsupervised-schedular') },
+                el(PageSelect, {
+                    label: __('Login page', 'unsupervised-schedular'),
+                    help: __('Where signing out returns to, and where signed-out visitors are offered a link to sign in. Without one, signing out returns to the current page and signed-out visitors see nothing.', 'unsupervised-schedular'),
+                    defaultLabel: __('Stay on the current page', 'unsupervised-schedular'),
+                    value: attributes.loginPageId,
+                    onChange: (loginPageId) => setAttributes({ loginPageId }),
+                })
+            ),
+        },
     ];
 
     blocks.forEach((def) => {

assets/js/booking.js

@@ -16,6 +16,11 @@
     const pinnedTypeId  = Number(app.dataset.lessonType) || 0;
     const filterEnabled = app.dataset.typeFilter !== '0';
 
+    // Who this account may book for — children first, the account holder last,
+    // so a guardian's default selection is a child rather than themselves. A
+    // single-student account has one entry and gets no picker.
+    const students = window.usGuardian.parseStudents(app.dataset.students);
+
     function apiFetch(path, options = {}) {
         return fetch(restUrl + path, {
             ...options,
@@ -330,7 +335,12 @@
 
         slotList.querySelectorAll('.us-book-btn[data-slot-id]').forEach((btn) => {
             const slot = allSlots.find((s) => String(s.id) === btn.dataset.slotId);
-            if (slot) btn.addEventListener('click', () => openRegistration(slot));
+            if (slot) {
+                btn.addEventListener('click', () => {
+                    hideConfirmation();
+                    openRegistration(slot);
+                });
+            }
         });
     }
 
@@ -360,13 +370,27 @@
             </div>`;
     }
 
-    // "Piano Lesson (60 min — $50.00 CAD)" / "Trial Lesson (Free)"
+    // "Piano Lesson (60 min — 50.00 CAD at booking)" / "Trial Lesson (Free)"
     function offeringLabel(o) {
         const duration = o.duration_minutes ? `${o.duration_minutes} min — ` : '';
-        const price = Number(o.price) > 0
-            ? `$${Number(o.price).toFixed(2)} ${o.currency}`
-            : 'Free';
-        return `${o.title} (${duration}${price})`;
+        return `${o.title} (${duration}${window.usPricing.priceLabel(o)})`;
+    }
+
+    // How many lessons a weekly reservation can claim, mirroring
+    // BookingEndpoint::MAX_WEEKLY_OCCURRENCES so the quoted total is never
+    // higher than the server will actually charge for.
+    const MAX_WEEKLY_OCCURRENCES = 12;
+
+    // The open times a weekly reservation of this slot would claim: every
+    // still-unbooked slot of its recurring group, capped the way the server
+    // caps it. Some may be taken by another student first, so this is the
+    // upper bound on what will be booked, not a guarantee.
+    function weeklyOccurrences(slot) {
+        if (!slot.recurrence_group) return 1;
+
+        const inGroup = allSlots.filter((s) => s.recurrence_group === slot.recurrence_group).length;
+
+        return Math.min(Math.max(inGroup, 1), MAX_WEEKLY_OCCURRENCES);
     }
 
     function openRegistration(slot) {
@@ -439,10 +463,12 @@
             <div class="us-register">
                 <h3>${escHtml(dayLabel(dayKey(slot.start_dt)))} · ${escHtml(timeOf(slot.start_dt))}–${escHtml(timeOf(slot.end_dt))}</h3>
                 <form id="us-register-form">
+                    ${window.usGuardian.selectorHtml(students, 'us-booking-student')}
                     ${offeringFieldHtml(tied, tiedId, choices)}
                     <div id="us-questions"></div>
                     ${policies.map(policyField).join('')}
                     ${weekly}
+                    <div id="us-price-summary"></div>
                     <p>
                         <button type="submit" class="us-book-btn">Confirm Booking</button>
                         <button type="button" id="us-cancel" class="us-cancel-btn">Back</button>
@@ -458,6 +484,27 @@
         let questions  = [];
 
         const questionsBox = document.getElementById('us-questions');
+        const priceBox     = document.getElementById('us-price-summary');
+        const weeklyEl     = document.getElementById('us-weekly');
+
+        // What the booking will cost and the agreement to pay it, restated
+        // whenever the choices that decide the amount change: the lesson type
+        // carries the price, and a weekly reservation multiplies a per-lesson
+        // one-time price by every week it claims. A slot tied to a type the
+        // catalog no longer carries has no price to quote, so it shows nothing
+        // rather than a figure it cannot stand behind.
+        function renderPrice() {
+            const offering = selectedId ? catalog.find((o) => Number(o.id) === selectedId) : null;
+            priceBox.innerHTML = offering
+                ? window.usPricing.summaryHtml({
+                    price: offering.price,
+                    currency: offering.currency,
+                    billing_mode: offering.billing_mode,
+                    kind: offering.kind,
+                    occurrences: weeklyEl && weeklyEl.checked ? weeklyOccurrences(slot) : 1,
+                })
+                : '';
+        }
 
         function loadQuestions() {
             questions = [];
@@ -475,10 +522,14 @@
             document.getElementById('us-offering').addEventListener('change', (e) => {
                 selectedId = Number(e.target.value) || 0;
                 loadQuestions();
+                renderPrice();
             });
         }
 
+        if (weeklyEl) weeklyEl.addEventListener('change', renderPrice);
+
         loadQuestions();
+        renderPrice();
 
         document.getElementById('us-cancel').addEventListener('click', loadSlots);
         document.getElementById('us-register-form').addEventListener('submit', (e) => {
@@ -487,6 +538,10 @@
                 showError('Please choose a lesson type.');
                 return;
             }
+            if (!window.usPricing.agreed(e.target)) {
+                showError(window.usPricing.AGREE_REQUIRED);
+                return;
+            }
             submitBooking(e.target, slot, selectedId, questions);
         });
     }
@@ -509,6 +564,7 @@
             body: JSON.stringify({
                 slot_id: slot.id,
                 offering_id: offeringId,
+                student_id: window.usGuardian.selectedId('us-booking-student'),
                 recurrence: weeklyEl && weeklyEl.checked ? 'weekly' : 'single',
                 answers,
                 accepted_policy_version_ids: accepted,
@@ -520,8 +576,11 @@
                 ? window.usPayment.collect('lesson', (res.ids || [])[0], slotList)
                 : null))
             .then((result) => {
-                loadMyLessons();
-                showConfirmation(window.usPayment.message(result));
+                const message = window.usPayment.message(result);
+
+                // Order matters: loadSlots() clears any standing notice, and it
+                // is what puts the calendar back with the booked slot gone.
+                return loadSlots().then(() => showConfirmation(message));
             })
             .catch((err) => showError(err.message));
     }
@@ -529,25 +588,65 @@
     function lessonStatusLabel(status) {
         if (status === 'pending') return 'Pending payment';
         if (status === 'confirmed') return 'Confirmed';
+        // A group-class session carries its enrolment's status, and "active"
+        // reads as jargon next to "Confirmed".
+        if (status === 'active') return 'Enrolled';
         return status.charAt(0).toUpperCase() + status.slice(1);
     }
 
     // How many upcoming lessons to show before the "Show all" reveal.
     const INITIAL_LESSON_COUNT = 5;
 
+    // Whose lesson this is. Only shown on an account that books for more than
+    // one person — on a single-student account the name is on every row and says
+    // nothing.
+    function lessonWhoHtml(l) {
+        if (students.length < 2 || !l.student_name) return '';
+
+        return ` <span class="us-my-lesson-who">— ${escHtml(String(l.student_name))}</span>`;
+    }
+
+    // A group-class session is a date in a term, not a booked slot: there is no
+    // lesson to cancel and no time to release, so it carries no Cancel button.
+    // Withdrawing from the class is a separate decision, made on the class page.
+    function isGroupSession(l) {
+        return l.kind === 'group_class';
+    }
+
+    // When a row meets. A class with no class time set has no clock to put it on,
+    // so it carries `schedule` — the studio's own wording, or its term dates — and
+    // that is shown verbatim in place of a date and time. A dated row with no
+    // duration knows when it starts but not when it ends, and says only that
+    // rather than inventing a finish.
+    function lessonWhenHtml(l) {
+        if (l.schedule) {
+            return escHtml(String(l.schedule));
+        }
+
+        const when = `${escHtml(dayLabel(dayKey(l.start_dt)))} · ${escHtml(timeOf(l.start_dt))}`;
+
+        return l.end_dt ? `${when}–${escHtml(timeOf(l.end_dt))}` : when;
+    }
+
     function lessonRowHtml(l) {
-        const title    = l.offering_title ? escHtml(String(l.offering_title)) : 'Lesson';
+        const group    = isGroupSession(l);
+        const title    = l.offering_title ? escHtml(String(l.offering_title)) : (group ? 'Group class' : 'Lesson');
         const duration = l.duration_minutes ? ` <span class="us-my-lesson-duration">(${escHtml(String(l.duration_minutes))} min)</span>` : '';
+        const badge    = group ? ' <span class="us-my-lesson-kind">Group class</span>' : '';
+        const action   = group ? '' : `<button type="button" class="us-cancel-lesson" data-lesson-id="${l.id}">Cancel</button>`;
+        // The two columns are divs, not spans: as spans the layout only held up
+        // while the stylesheet's display:flex won, and a theme rule on span
+        // collapsed the row onto itself.
         return `
             <div class="us-my-lesson">
-                <span class="us-my-lesson-info">
-                    <strong class="us-my-lesson-title">${title}${duration}</strong>
-                    <span class="us-my-lesson-when">${escHtml(dayLabel(dayKey(l.start_dt)))} · ${escHtml(timeOf(l.start_dt))}–${escHtml(timeOf(l.end_dt))}</span>
-                </span>
-                <span class="us-my-lesson-actions">
+                <div class="us-my-lesson-info">
+                    <strong class="us-my-lesson-title">${title}${duration}${badge}${lessonWhoHtml(l)}</strong>
+                    <span class="us-my-lesson-when">${lessonWhenHtml(l)}</span>
+                </div>
+                <div class="us-my-lesson-actions">
                     <span class="us-lesson-status us-lesson-status-${escHtml(String(l.status))}">${escHtml(lessonStatusLabel(String(l.status)))}</span>
-                    <button type="button" class="us-cancel-lesson" data-lesson-id="${l.id}">Cancel</button>
-                </span>
+                    ${action}
+                </div>
             </div>`;
     }
 
@@ -563,13 +662,19 @@
         const visible = upcoming.slice(0, INITIAL_LESSON_COUNT);
         const hidden  = upcoming.slice(INITIAL_LESSON_COUNT);
 
+        // Named for what the list actually holds now that group-class sessions
+        // sit in it alongside booked lessons.
+        const heading = upcoming.some(isGroupSession)
+            ? 'Your upcoming lessons and classes'
+            : 'Your upcoming lessons';
+
         myLessons.innerHTML = `
             <div class="us-my-lessons">
-                <h3>Your upcoming lessons</h3>
+                <h3>${heading}</h3>
                 ${visible.map(lessonRowHtml).join('')}
                 ${hidden.length ? `
                     <div class="us-my-lessons-more" hidden>${hidden.map(lessonRowHtml).join('')}</div>
-                    <button type="button" class="us-show-all-lessons">Show all ${upcoming.length} lessons</button>
+                    <button type="button" class="us-show-all-lessons">Show all ${upcoming.length}</button>
                 ` : ''}
             </div>`;
 
@@ -605,10 +710,43 @@
             .catch(() => { myLessons.innerHTML = ''; });
     }
 
+    /**
+     * Report a completed booking without taking the calendar away.
+     *
+     * This used to hide the slot list and leave the confirmation as the whole
+     * page, which is a dead end: the student had nothing to click and no way
+     * back to booking short of reloading. The notice now sits above a freshly
+     * loaded calendar, so "it worked" and "you can book again" are the same
+     * screen.
+     *
+     * Built from nodes rather than innerHTML because the message can carry a
+     * studio's e-transfer address.
+     */
     function showConfirmation(message) {
-        confirm.textContent = message;
-        slotList.style.display = 'none';
-        confirm.style.display = 'block';
+        confirm.textContent = '';
+
+        const text = document.createElement('p');
+        text.textContent = message;
+
+        const dismiss = document.createElement('button');
+        dismiss.type = 'button';
+        dismiss.className = 'us-notice-dismiss';
+        dismiss.textContent = 'Dismiss';
+        dismiss.addEventListener('click', hideConfirmation);
+
+        confirm.appendChild(text);
+        confirm.appendChild(dismiss);
+
+        // The `hidden` attribute rather than an inline display, which would
+        // outrank the stylesheet's `display: flex` and stack the notice's
+        // parts instead of laying them out in a row.
+        confirm.hidden = false;
+    }
+
+    function hideConfirmation() {
+        if (!confirm) return;
+        confirm.hidden = true;
+        confirm.textContent = '';
     }
 
     // The private-lesson catalog drives both the filter and the registration
@@ -633,16 +771,17 @@
         });
     }
 
+    /** Returns the load, so a caller can act once the calendar is back. */
     function loadSlots() {
         clearError();
         loadMyLessons();
 
         // An upcoming-lessons-only embed has no calendar to fill.
-        if (!slotList) return;
+        if (!slotList) return Promise.resolve();
 
-        slotList.style.display = 'block';
-        confirm.style.display = 'none';
-        Promise.all([apiFetch('availability'), loadCatalog()])
+        hideConfirmation();
+
+        return Promise.all([apiFetch('availability'), loadCatalog()])
             .then(([slots]) => {
                 allSlots = slots;
                 render();

assets/js/group-classes.js

@@ -17,6 +17,10 @@
     // enrolment controls.
     const singleOfferingId = Number(app.dataset.offering || 0);
 
+    // Who this account may enrol — children first, the account holder last, so a
+    // guardian's default selection is a child. One entry means no picker.
+    const students = window.usGuardian.parseStudents(app.dataset.students);
+
     function apiFetch(path, options = {}) {
         return fetch(restUrl + path, {
             ...options,
@@ -133,7 +137,78 @@
         return !o.withdrawal_deadline || todayYmd() <= o.withdrawal_deadline;
     }
 
-    function renderClasses(offerings, enrolledMap) {
+    // Active enrolments grouped by class. A household can hold several in the
+    // same class — one per student — so the value is a list, never a single id.
+    function activeByOffering(enrollments) {
+        const map = new Map();
+        enrollments
+            .filter((e) => e.status === 'active')
+            .forEach((e) => {
+                const key = Number(e.offering_id);
+                const held = map.get(key) || [];
+                held.push({ id: e.id, studentId: Number(e.student_id) });
+                map.set(key, held);
+            });
+        return map;
+    }
+
+    // Who on this account could still be enrolled in a class: everyone the
+    // account may enrol, minus those already holding an active enrolment in it.
+    // The per-student check is the point — the account used to be treated as a
+    // single enrollee, so enrolling one child hid the Enrol button from the rest
+    // of the household even though the server would have taken them happily.
+    function availableStudents(offeringId, enrolled) {
+        const held = enrolled.get(Number(offeringId)) || [];
+
+        // Degraded case: an unparseable student list leaves no id to compare
+        // against, so any existing enrolment is read as covering the account.
+        if (!students.length) return held.length ? [] : [{ id: 0, name: '', is_self: true }];
+
+        const taken = new Set(held.map((e) => e.studentId));
+        return students.filter((s) => !taken.has(Number(s.id)));
+    }
+
+    // The enrolled student's name, or '' when there is nobody to tell them apart
+    // from: an account with a single student reads better in the second person.
+    function studentName(studentId) {
+        if (students.length < 2) return '';
+        const s = students.find((st) => Number(st.id) === Number(studentId));
+        return s && !s.is_self ? s.name : '';
+    }
+
+    function enrolledRow(o, e) {
+        const name = studentName(e.studentId);
+        return `
+                <p class="us-enrolled"><strong>${name ? `${escHtml(name)} is` : 'You are'} enrolled in this class.</strong></p>
+                ${isWithdrawalOpen(o)
+        ? `<button data-enrollment-id="${e.id}" data-student="${escHtml(name)}" class="us-withdraw-btn">Withdraw${name ? ` ${escHtml(name)}` : ''}</button>`
+        : `<p class="us-withdraw-closed">Withdrawal${name ? ` for ${escHtml(name)}` : ''} has closed — contact the studio to withdraw.</p>`}`;
+    }
+
+    function classCard(o, enrolled) {
+        const held      = enrolled.get(Number(o.id)) || [];
+        const available = availableStudents(o.id, enrolled);
+        const canEnrol  = available.length > 0 && isEnrollmentOpen(o);
+
+        return `
+            <div class="us-class">
+                <h3>${escHtml(o.title)}</h3>
+                ${whenLabel(o) ? `<p class="us-class-when">${escHtml(whenLabel(o))}</p>` : ''}
+                ${o.instructor_name ? `<p class="us-class-instructor">With ${escHtml(o.instructor_name)}</p>` : ''}
+                ${o.schedule_note ? `<p>${escHtml(o.schedule_note)}</p>` : ''}
+                ${!singleOfferingId && o.description ? `<p>${escHtml(o.description)}</p>` : ''}
+                <p class="us-class-price">${escHtml(window.usPricing.priceLabel(o))}</p>
+                ${canEnrol && enrolmentDeadline(o)
+        ? `<p class="us-enrol-deadline">Enrol by ${escHtml(formatDate(enrolmentDeadline(o)))}</p>`
+        : ''}
+                ${held.map((e) => enrolledRow(o, e)).join('')}
+                ${canEnrol
+        ? `<button data-offering-id="${o.id}" class="us-enrol-btn">${held.length ? 'Enrol another student' : 'Enrol'}</button>`
+        : (available.length ? '<p class="us-enrol-closed"><strong>Enrolment has closed.</strong></p>' : '')}
+            </div>`;
+    }
+
+    function renderClasses(offerings, enrolled) {
         let groups = offerings.filter((o) => o.kind === 'group_class');
         if (singleOfferingId) {
             groups = groups.filter((o) => Number(o.id) === singleOfferingId);
@@ -145,41 +220,29 @@
             return;
         }
 
-        list.innerHTML = groups.map((o) => `
-            <div class="us-class">
-                <h3>${escHtml(o.title)}</h3>
-                ${whenLabel(o) ? `<p class="us-class-when">${escHtml(whenLabel(o))}</p>` : ''}
-                ${o.instructor_name ? `<p class="us-class-instructor">With ${escHtml(o.instructor_name)}</p>` : ''}
-                ${o.schedule_note ? `<p>${escHtml(o.schedule_note)}</p>` : ''}
-                ${!singleOfferingId && o.description ? `<p>${escHtml(o.description)}</p>` : ''}
-                <p>${escHtml(Number(o.price).toFixed(2))} ${escHtml(o.currency)}</p>
-                ${!enrolledMap.has(Number(o.id)) && isEnrollmentOpen(o) && enrolmentDeadline(o)
-        ? `<p class="us-enrol-deadline">Enrol by ${escHtml(formatDate(enrolmentDeadline(o)))}</p>`
-        : ''}
-                ${enrolledMap.has(Number(o.id))
-        ? `<p class="us-enrolled"><strong>You are enrolled in this class.</strong></p>
-                ${isWithdrawalOpen(o)
-            ? `<button data-enrollment-id="${enrolledMap.get(Number(o.id))}" class="us-withdraw-btn">Withdraw</button>`
-            : '<p class="us-withdraw-closed">Withdrawal has closed — contact the studio to withdraw.</p>'}`
-        : (isEnrollmentOpen(o)
-            ? `<button data-offering-id="${o.id}" class="us-enrol-btn">Enrol</button>`
-            : '<p class="us-enrol-closed"><strong>Enrolment has closed.</strong></p>')}
-            </div>
-        `).join('');
+        list.innerHTML = groups.map((o) => classCard(o, enrolled)).join('');
 
         list.querySelectorAll('.us-enrol-btn').forEach((btn) => {
             const offering = groups.find((o) => String(o.id) === btn.dataset.offeringId);
-            btn.addEventListener('click', () => openEnrolment(offering));
+            btn.addEventListener('click', () => {
+                hideConfirmation();
+                openEnrolment(offering, availableStudents(offering.id, enrolled));
+            });
         });
 
         list.querySelectorAll('.us-withdraw-btn').forEach((btn) => {
-            btn.addEventListener('click', () => withdraw(btn.dataset.enrollmentId));
+            btn.addEventListener('click', () => withdraw(btn.dataset.enrollmentId, btn.dataset.student || ''));
         });
     }
 
-    function withdraw(enrollmentId) {
+    function withdraw(enrollmentId, studentName) {
         clearError();
-        if (!window.confirm('Withdraw from this class? Your seat is released and any pending payment is cancelled.')) {
+        // Named, because a household can hold more than one enrolment in the
+        // same class and "this class" alone would not say whose seat is going.
+        const prompt = studentName
+            ? `Withdraw ${studentName} from this class? Their seat is released and any pending payment is cancelled.`
+            : 'Withdraw from this class? Your seat is released and any pending payment is cancelled.';
+        if (!window.confirm(prompt)) {
             return;
         }
         apiFetch(`enrollments/${enrollmentId}/withdraw`, { method: 'POST' })
@@ -187,23 +250,48 @@
             .catch((err) => showError(err.message));
     }
 
-    function openEnrolment(offering) {
+    function openEnrolment(offering, available) {
         clearError();
         Promise.all([
             apiFetch(`offerings/${offering.id}/questions`),
             apiFetch('policies?scope=booking'),
         ])
-            .then(([questions, policies]) => renderEnrolment(offering, questions, policies))
+            .then(([questions, policies]) => renderEnrolment(offering, questions, policies, available))
             .catch((err) => showError(err.message));
     }
 
-    function renderEnrolment(offering, questions, policies) {
+    /**
+     * The "who is this for?" control for one class, offering only the students
+     * who are not already enrolled in it.
+     *
+     * When exactly one is left there is nothing to choose, but the id still has
+     * to reach the server: an omitted picker posts no student_id, which the
+     * server reads as "enrol the account holder" — and would enrol the parent
+     * instead of the one child still to be signed up.
+     */
+    function studentFieldHtml(available) {
+        if (available.length > 1) {
+            return window.usGuardian.selectorHtml(available, 'us-enrol-student');
+        }
+
+        const only = available[0];
+        if (!only) return '';
+
+        return `<input type="hidden" id="us-enrol-student" value="${Number(only.id)}">
+                    ${students.length > 1
+        ? `<p class="us-student-picker">For ${only.is_self ? 'yourself' : escHtml(only.name)}.</p>`
+        : ''}`;
+    }
+
+    function renderEnrolment(offering, questions, policies, available) {
         list.innerHTML = `
             <div class="us-register">
                 <h3>${escHtml(offering.title)}</h3>
                 <form id="us-enrol-form">
+                    ${studentFieldHtml(available)}
                     ${questions.map(questionField).join('')}
                     ${policies.map(policyField).join('')}
+                    ${window.usPricing.summaryHtml(offering)}
                     <p>
                         <button type="submit" class="us-enrol-btn">Confirm Enrolment</button>
                         <button type="button" id="us-group-cancel" class="us-cancel-btn">Back</button>
@@ -214,6 +302,10 @@
         document.getElementById('us-group-cancel').addEventListener('click', loadClasses);
         document.getElementById('us-enrol-form').addEventListener('submit', (e) => {
             e.preventDefault();
+            if (!window.usPricing.agreed(e.target)) {
+                showError(window.usPricing.AGREE_REQUIRED);
+                return;
+            }
             submitEnrolment(e.target, offering, questions);
         });
     }
@@ -234,6 +326,7 @@
             method: 'POST',
             body: JSON.stringify({
                 offering_id: offering.id,
+                student_id: window.usGuardian.selectedId('us-enrol-student'),
                 answers,
                 accepted_policy_version_ids: accepted,
             }),
@@ -243,34 +336,66 @@
             .then((res) => (res.payment
                 ? window.usPayment.collect('enrollment', res.id, list)
                 : null))
-            .then((result) => showConfirmation(window.usPayment.message(result)))
+            .then((result) => {
+                const message = window.usPayment.message(result);
+
+                // Order matters: loadClasses() clears any standing notice, and
+                // it is what puts the list back showing the new enrolment.
+                return loadClasses().then(() => showConfirmation(message));
+            })
             .catch((err) => showError(err.message));
     }
 
+    /**
+     * Report a completed enrolment without taking the class list away. Hiding
+     * the list left the student on a dead-end screen with no way back to
+     * browsing short of a reload; the notice now sits above a freshly loaded
+     * list instead. Mirrors booking.js.
+     *
+     * Built from nodes rather than innerHTML because the message can carry a
+     * studio's e-transfer address.
+     */
     function showConfirmation(message) {
-        confirm.textContent = message;
-        list.style.display = 'none';
-        confirm.style.display = 'block';
+        confirm.textContent = '';
+
+        const text = document.createElement('p');
+        text.textContent = message;
+
+        const dismiss = document.createElement('button');
+        dismiss.type = 'button';
+        dismiss.className = 'us-notice-dismiss';
+        dismiss.textContent = 'Dismiss';
+        dismiss.addEventListener('click', hideConfirmation);
+
+        confirm.appendChild(text);
+        confirm.appendChild(dismiss);
+
+        // The `hidden` attribute rather than an inline display, which would
+        // outrank the stylesheet's `display: flex` and stack the notice's
+        // parts instead of laying them out in a row.
+        confirm.hidden = false;
     }
 
+    function hideConfirmation() {
+        confirm.hidden = true;
+        confirm.textContent = '';
+    }
+
+    /** Returns the load, so a caller can act once the list is back. */
     function loadClasses() {
         clearError();
-        list.style.display = 'block';
-        confirm.style.display = 'none';
-        // The student's own enrolments are fetched alongside the catalog so a
-        // class they already have an active enrolment in shows its status
+        hideConfirmation();
+        // The household's enrolments are fetched alongside the catalog so a
+        // class a student already has an active enrolment in shows their status
         // instead of offering to enrol them again (the API would reject the
-        // duplicate anyway). A cancelled enrolment does not block re-enrolling.
-        Promise.all([
+        // duplicate anyway). Each student is tracked separately: one child being
+        // enrolled says nothing about their siblings, who can still be signed up
+        // for the same class. A cancelled enrolment does not block re-enrolling.
+        return Promise.all([
             apiFetch('offerings?kind=group_class'),
             apiFetch('enrollments'),
         ])
-            .then(([offerings, enrollments]) => renderClasses(
-                offerings,
-                new Map(enrollments
-                    .filter((e) => e.status === 'active')
-                    .map((e) => [Number(e.offering_id), e.id]))
-            ))
+            .then(([offerings, enrollments]) => renderClasses(offerings, activeByOffering(enrollments)))
             .catch((err) => showError(err.message));
     }
 

assets/js/guardian.js

@@ -0,0 +1,68 @@
+/**
+ * "Who is this for?" picker, shared by the lesson-booking and group-class
+ * registration forms.
+ *
+ * The list arrives from the server already ordered children-first, with the
+ * account holder last, and this module preserves that order: a guardian's
+ * default selection is their first child, never themselves. Booking for the
+ * wrong child is a correctable mistake; quietly enrolling the parent in a class
+ * meant for their kid is not.
+ */
+(function () {
+    'use strict';
+
+    function escHtml(str) {
+        return String(str)
+            .replace(/&/g, '&')
+            .replace(/</g, '&lt;')
+            .replace(/>/g, '&gt;')
+            .replace(/"/g, '&quot;');
+    }
+
+    /**
+     * Read the server-rendered student list off a `data-students` attribute.
+     * Anything unparseable degrades to an empty list, which renders no picker
+     * and books for the signed-in user — the pre-guardian behaviour.
+     */
+    function parseStudents(raw) {
+        if (!raw) return [];
+        try {
+            const list = JSON.parse(raw);
+            return Array.isArray(list) ? list : [];
+        } catch (e) {
+            return [];
+        }
+    }
+
+    /**
+     * The picker's markup, or an empty string when there is nothing to choose:
+     * an account with only itself on the list never sees the question.
+     */
+    function selectorHtml(students, id) {
+        if (!students || students.length < 2) return '';
+
+        const options = students.map((s) => {
+            // The account holder reads as "Myself" — their own name next to their
+            // children's is ambiguous about which row is the parent.
+            const label = s.is_self ? `Myself (${s.name})` : s.name;
+            return `<option value="${Number(s.id)}">${escHtml(label)}</option>`;
+        }).join('');
+
+        return `
+            <p class="us-student-picker">
+                <label for="${id}">Who is this for?<br>
+                <select id="${id}" required>${options}</select></label>
+            </p>`;
+    }
+
+    /**
+     * The chosen student id, or 0 when no picker was rendered — the server
+     * reads 0 as "the caller books for themselves".
+     */
+    function selectedId(id) {
+        const el = document.getElementById(id);
+        return el ? Number(el.value) || 0 : 0;
+    }
+
+    window.usGuardian = { parseStudents, selectorHtml, selectedId };
+}());

assets/js/pricing.js

@@ -0,0 +1,170 @@
+/* global usScheduler */
+(function () {
+    'use strict';
+
+    // Cadence wording for each offering billing mode, in the phrasing a student
+    // sees beside a price. Mirrors Offering::VALID_BILLING_MODES.
+    const CADENCE = {
+        one_time: 'at booking',
+        full_term: 'up front',
+        weekly: 'weekly',
+        monthly: 'monthly',
+    };
+
+    // How each cadence is actually collected, spelled out beneath the price so
+    // the one-word cadence is never the only thing a student has to go on.
+    const CADENCE_NOTE = {
+        one_time: 'Charged once, when you book.',
+        full_term: 'Charged once, up front, for the whole term.',
+        weekly: 'Charged for each lesson, 24 hours before it starts.',
+        monthly: 'Charged on the 1st of each month, for that month’s lessons.',
+    };
+
+    // The billing modes whose price is a per-lesson fee billed again and again,
+    // rather than a single charge. Mirrors Offering::SCHEDULED_BILLING_MODES.
+    const RECURRING = ['weekly', 'monthly'];
+
+    function escHtml(str) {
+        return String(str)
+            .replace(/&/g, '&')
+            .replace(/</g, '&lt;')
+            .replace(/>/g, '&gt;')
+            .replace(/"/g, '&quot;');
+    }
+
+    function mode(billingMode) {
+        return CADENCE[billingMode] ? billingMode : 'one_time';
+    }
+
+    // A monthly charge rolls up every lesson that falls in the month, so a
+    // private lesson's monthly price is quoted *per lesson* — the fee is
+    // multiplied by the lessons booked that month. A group class is enrolled in
+    // once, as one schedule, so its monthly figure is quoted as it stands.
+    function isPerLessonMonthly(billingMode, kind) {
+        return 'monthly' === billingMode && 'group_class' !== kind;
+    }
+
+    // "50.00 CAD" — amount then currency code, the format used throughout the
+    // ledger, receipts and payment notices.
+    function money(amount, currency) {
+        return `${(Number(amount) || 0).toFixed(2)} ${String(currency || '')}`.trim();
+    }
+
+    // The studio's HST rate as a percentage, frozen onto every payment at
+    // booking time (comped students are the one exception — they are not taxed).
+    function taxRate() {
+        return Number(usScheduler.taxRate) || 0;
+    }
+
+    // Tax on a pre-tax amount, rounded the same way PaymentService does.
+    function tax(amount) {
+        return Math.round((Number(amount) || 0) * taxRate()) / 100;
+    }
+
+    function total(amount) {
+        return (Number(amount) || 0) + tax(amount);
+    }
+
+    // "50.00 CAD at booking" / "50.00 CAD per lesson monthly" / "Free" — the
+    // catalogue label, always carrying the cadence so a price is never shown
+    // without saying when it is due.
+    function priceLabel(offering) {
+        const price = Number(offering.price) || 0;
+        if (price <= 0) {
+            return 'Free';
+        }
+
+        const billingMode = mode(offering.billing_mode);
+        const perLesson   = isPerLessonMonthly(billingMode, offering.kind) ? 'per lesson ' : '';
+
+        return `${money(price, offering.currency)} ${perLesson}${CADENCE[billingMode]}`;
+    }
+
+    // The price block shown on a booking/enrolment form, followed by the
+    // agreement the student must tick to confirm they will pay it. A free
+    // offering has nothing to agree to, so it renders nothing at all.
+    //
+    // opts: { price, currency, billing_mode, kind, occurrences }
+    // `occurrences` is how many lessons a one-time price is charged for in this
+    // one registration (a weekly reservation claims several at once); it is
+    // ignored for the other modes, whose price is charged per period regardless.
+    function summaryHtml(opts) {
+        const price = Number(opts.price) || 0;
+        if (price <= 0) {
+            return '';
+        }
+
+        const billingMode = mode(opts.billing_mode);
+        const currency    = opts.currency;
+        const each        = total(price);
+        const count       = 'one_time' === billingMode ? Math.max(1, Number(opts.occurrences) || 1) : 1;
+
+        const taxLine = taxRate() > 0
+            ? `<p class="us-price-tax">${escHtml(`Plus ${taxRate()}% HST — ${money(each, currency)}${count > 1 ? ' per lesson' : ''}.`)}</p>`
+            : '';
+
+        return `
+            <div class="us-price">
+                <h4>Price</h4>
+                <p class="us-price-amount">
+                    <strong>${escHtml(money(price, currency))}</strong>
+                    <span class="us-price-cadence">${escHtml(cadenceLabel(billingMode, opts.kind))}</span>
+                </p>
+                ${taxLine}
+                <p class="us-price-note">${escHtml(count > 1
+                    ? 'Charged once, when you book — for every week reserved.'
+                    : CADENCE_NOTE[billingMode])}</p>
+                <label class="us-price-agree">
+                    <input type="checkbox" class="us-price-accept" required>
+                    ${escHtml(agreeText(each, currency, billingMode, count, opts.kind))}
+                </label>
+            </div>`;
+    }
+
+    // The cadence as it reads beside an amount: a private lesson billed monthly
+    // adds "per lesson", since the month's charge is that fee times the lessons
+    // it covers.
+    function cadenceLabel(billingMode, kind) {
+        return isPerLessonMonthly(billingMode, kind)
+            ? `per lesson ${CADENCE[billingMode]}`
+            : CADENCE[billingMode];
+    }
+
+    // What the student is ticking: the amount actually billed (tax included),
+    // and when. A weekly reservation is charged per lesson for every week it
+    // claims, and the claim can come up short when another student takes one of
+    // the times first — so its total is stated as a ceiling, never a promise.
+    function agreeText(each, currency, billingMode, count, kind) {
+        if (RECURRING.indexOf(billingMode) !== -1) {
+            // A monthly group class is enrolled in once and quoted as it stands;
+            // everything else recurring is a per-lesson fee.
+            return 'monthly' === billingMode && !isPerLessonMonthly(billingMode, kind)
+                ? `I agree to pay ${money(each, currency)} monthly.`
+                : `I agree to pay ${money(each, currency)} per lesson, billed ${CADENCE[billingMode]}.`;
+        }
+
+        if (count > 1) {
+            return `I agree to pay ${money(each, currency)} per lesson at booking — `
+                + `up to ${count} lessons, ${money(each * count, currency)} in total.`;
+        }
+
+        return `I agree to pay ${money(each, currency)} ${CADENCE[billingMode]}.`;
+    }
+
+    // Whether the payment agreement has been ticked. A form without one (a free
+    // offering) has nothing outstanding, so it counts as agreed.
+    function agreed(root) {
+        const box = root.querySelector('.us-price-accept');
+
+        return !box || box.checked;
+    }
+
+    // Shared by the booking and group-class flows so a price reads the same
+    // wherever a student meets it.
+    window.usPricing = {
+        priceLabel,
+        summaryHtml,
+        agreed,
+        AGREE_REQUIRED: 'Please confirm you agree to pay the amount shown.',
+    };
+}());

assets/js/register.js

@@ -1,57 +1,258 @@
 /**
- * Progressive enhancement for the two-step student registration form.
+ * Progressive enhancement for the student registration form.
  *
- * When account-signup questions are configured the form renders two panels
- * (`[data-step="1"]` account details, `[data-step="2"]` the questions) inside a
- * single form marked `data-steps="1"`. This script hides step two behind a
- * "Next" button that only advances once step one passes native validation.
- * Without JS both panels stay visible and the single submit still works.
+ * Two independent behaviours, both optional — without JS every panel stays
+ * visible and the single submit still works:
+ *
+ * 1. **Who are you registering?** The student section is hidden until the
+ *    choice is "on behalf of students" or "both", and "Add another student"
+ *    clones the student block. "On behalf of students" *alone* also takes the
+ *    account holder's own **About you** panel out of play — they are not a
+ *    student in that case, so the server ignores their birth year and answers
+ *    and the browser must not demand them. Under "both" they are a student and
+ *    do fill it in.
+ * 2. **Password strength.** The password is scored with zxcvbn (via WordPress's
+ *    own `wp.passwordStrength`) and a weak one is refused. The server applies
+ *    its own, coarser rule regardless — see `Auth\PasswordPolicy`.
  */
 (function () {
 	'use strict';
 
-	function enhance(form) {
-		var step1 = form.querySelector('[data-step="1"]');
-		var step2 = form.querySelector('[data-step="2"]');
-		var next = form.querySelector('.us-reg-next');
-		var back = form.querySelector('.us-reg-back');
+	var PASSWORD = window.usSchedulerPassword || {};
 
-		if (!step1 || !step2 || !next) {
+	/**
+	 * Gate the form on password strength.
+	 *
+	 * The verdict is attached to the field with `setCustomValidity()` rather than
+	 * by disabling the submit button: an invalid field blocks the submit without
+	 * the button having to know why.
+	 *
+	 * It is also re-scored on submit, which is the case the input handler alone
+	 * misses. zxcvbn's dictionary arrives after page load, and until it does the
+	 * meter has no opinion and the field is left valid — so a password typed in
+	 * the first second and submitted straight away would otherwise never be
+	 * scored at all, and the first the student heard of it would be the server
+	 * rejecting the whole form.
+	 */
+	function enhancePassword(form) {
+		var field = form.querySelector('#us-reg-pass');
+		var output = form.querySelector('#us-reg-pass-strength');
+		var strings = PASSWORD.strings || {};
+
+		if (!field || !PASSWORD.minScore) {
 			return;
 		}
 
-		function show(step) {
-			step1.hidden = step !== 1;
-			step2.hidden = step !== 2;
-		}
+		// What the password must not simply repeat back. Mirrors the identity
+		// check PasswordPolicy makes server-side.
+		function identity() {
+			var out = [];
+			var sources = form.querySelectorAll('#us-reg-email, #us-reg-name');
 
-		show(1);
-
-		next.addEventListener('click', function () {
-			var fields = step1.querySelectorAll('input, select, textarea');
-
-			for (var i = 0; i < fields.length; i++) {
-				if (!fields[i].checkValidity()) {
-					fields[i].reportValidity();
-					return;
+			for (var i = 0; i < sources.length; i++) {
+				var value = (sources[i].value || '').trim();
+				if (value) {
+					out.push(value);
+					if (value.indexOf('@') > 0) {
+						out.push(value.split('@')[0]);
+					}
 				}
 			}
 
-			show(2);
-		});
+			return out;
+		}
 
-		if (back) {
-			back.addEventListener('click', function () {
-				show(1);
+		function assess() {
+			var value = field.value || '';
+
+			if (!value) {
+				report('', '');
+				return;
+			}
+
+			if (value.length < (PASSWORD.minLength || 8)) {
+				report(strings.short, 'short');
+				return;
+			}
+
+			// zxcvbn's dictionary is fetched after load, and wp.passwordStrength
+			// reports -1 until it arrives. Say nothing and allow the submit in that
+			// window — the server still checks, and the next keystroke re-runs this
+			// once the dictionary is in.
+			if (!window.wp || !window.wp.passwordStrength || typeof window.zxcvbn === 'undefined') {
+				report('', '');
+				return;
+			}
+
+			var score = window.wp.passwordStrength.meter(value, identity(), '');
+
+			if (score < 0) {
+				report('', '');
+				return;
+			}
+
+			if (score >= 3) {
+				report(strings.strong, 'strong');
+			} else if (score >= PASSWORD.minScore) {
+				report(strings.medium, 'medium');
+			} else {
+				report(score <= 0 ? strings.veryWeak : strings.weak, 'weak');
+			}
+		}
+
+		/** Show the verdict, and make it the field's validity at the same time. */
+		function report(message, level) {
+			var acceptable = '' === level || 'medium' === level || 'strong' === level;
+
+			if (output) {
+				output.textContent = message || '';
+				output.className = 'us-password-strength' + (level ? ' is-' + level : '');
+			}
+
+			field.setCustomValidity(acceptable ? '' : message || '');
+		}
+
+		field.addEventListener('input', assess);
+		field.addEventListener('blur', assess);
+
+		// The identity check depends on these, so a password typed first and an
+		// email typed second is still caught.
+		var sources = form.querySelectorAll('#us-reg-email, #us-reg-name');
+		for (var i = 0; i < sources.length; i++) {
+			sources[i].addEventListener('change', assess);
+		}
+
+		// Native validation has already run by the time `submit` fires, so a
+		// verdict reached here has to stop the submit by hand.
+		form.addEventListener('submit', function (event) {
+			assess();
+
+			if (!field.checkValidity()) {
+				event.preventDefault();
+				field.reportValidity();
+			}
+		});
+	}
+
+	/**
+	 * Rewrite a cloned child block's `children[0][…]` names and ids to the new
+	 * index, and clear the values carried over from the block it was cloned from.
+	 */
+	function reindex(block, index) {
+		block.setAttribute('data-child-index', String(index));
+
+		var fields = block.querySelectorAll('input, select, textarea');
+		for (var i = 0; i < fields.length; i++) {
+			var field = fields[i];
+
+			if (field.name) {
+				field.name = field.name.replace(/^children\[\d+\]/, 'children[' + index + ']');
+			}
+
+			var oldId = field.id;
+			if (oldId) {
+				field.id = oldId.replace(/^us-child-\d+-/, 'us-child-' + index + '-');
+
+				var label = block.querySelector('label[for="' + oldId + '"]');
+				if (label) {
+					label.setAttribute('for', field.id);
+				}
+			}
+
+			if (field.type === 'checkbox' || field.type === 'radio') {
+				field.checked = false;
+			} else {
+				field.value = '';
+			}
+		}
+	}
+
+	function enhanceGuardian(form) {
+		var choices = form.querySelectorAll('.us-registering-for');
+		var children = form.querySelector('#us-children');
+		var self = form.querySelector('#us-reg-self');
+
+		if (!choices.length || !children) {
+			return;
+		}
+
+		var addButton = children.querySelector('.us-add-child');
+		var nextIndex = 1;
+
+		/** The selected "who are you registering?" value; 'self' if somehow none is. */
+		function mode() {
+			for (var i = 0; i < choices.length; i++) {
+				if (choices[i].checked) return choices[i].value;
+			}
+			return 'self';
+		}
+
+		/**
+		 * Keep the form in step with the choice.
+		 *
+		 * Two independent questions, which is why "both" needs its own answer to
+		 * each:
+		 *
+		 * - Are student blocks in play? For "students" and "both".
+		 * - Is the account holder a student themselves? For "self" and "both" —
+		 *   only then are they asked for their own birth year and answers. A pure
+		 *   guardian gives those per student instead.
+		 *
+		 * Each panel is disabled as well as hidden. Disabling is what actually
+		 * settles it: a `required` field inside a hidden container makes the form
+		 * unsubmittable with no way to reach the offending control, and a disabled
+		 * fieldset is neither validated nor submitted. The server enforces the
+		 * same rules either way.
+		 */
+		function sync() {
+			var current = mode();
+			var wantsStudents = current !== 'self';
+			var asksSelf = current !== 'students';
+
+			children.hidden = !wantsStudents;
+			children.disabled = !wantsStudents;
+
+			// Belt and braces alongside the disabled fieldset, so the required
+			// state is right if a browser ever renders the block on its own.
+			var required = children.querySelectorAll('[data-us-child-required]');
+			for (var r = 0; r < required.length; r++) {
+				required[r].required = wantsStudents;
+			}
+
+			if (self) {
+				self.hidden = !asksSelf;
+				self.disabled = !asksSelf;
+			}
+		}
+
+		for (var c = 0; c < choices.length; c++) {
+			choices[c].addEventListener('change', sync);
+		}
+		sync();
+
+		if (addButton) {
+			addButton.addEventListener('click', function () {
+				var blocks = children.querySelectorAll('.us-child');
+				var clone = blocks[blocks.length - 1].cloneNode(true);
+
+				reindex(clone, nextIndex);
+				nextIndex += 1;
+
+				children.insertBefore(clone, addButton.parentNode);
+
+				// The clone carries the data attribute but not necessarily the
+				// current required state, so settle it the same way as the rest.
+				sync();
 			});
 		}
 	}
 
 	document.addEventListener('DOMContentLoaded', function () {
-		var forms = document.querySelectorAll('.us-register-form form[data-steps="1"]');
+		var forms = document.querySelectorAll('.us-register-form form');
 
 		for (var i = 0; i < forms.length; i++) {
-			enhance(forms[i]);
+			enhanceGuardian(forms[i]);
+			enhancePassword(forms[i]);
 		}
 	});
 })();

bin/build-zip.sh

@@ -23,6 +23,10 @@ INCLUDE=(
 	"$SLUG.php"
 	"uninstall.php"
 	"composer.json"
+	# Staged so the production install below resolves to the locked versions
+	# rather than whatever is newest that day. Both are deleted again before
+	# the zip is written.
+	"composer.lock"
 	"src"
 	"templates"
 	"assets"

composer.json

@@ -5,7 +5,7 @@
     "license": "GPL-2.0-or-later",
     "require": {
         "php": ">=8.1",
-        "stripe/stripe-php": "^17.0"
+        "stripe/stripe-php": "^21.0"
     },
     "require-dev": {
         "phpunit/phpunit": "^10.5",
@@ -36,6 +36,9 @@
         "build": "bash bin/build-zip.sh"
     },
     "config": {
+        "platform": {
+            "php": "8.1"
+        },
         "allow-plugins": {
             "dealerdirect/phpcodesniffer-composer-installer": true
         }

docs/ci.md

@@ -0,0 +1,101 @@
+# CI
+
+CI and release jobs do not install PHP. They run inside the shared images
+maintained in [Unsupervised/ci-php](https://git.unsupervised.ca/Unsupervised/ci-php):
+
+```
+git.unsupervised.ca/unsupervised/ci-php:8.1
+git.unsupervised.ca/unsupervised/ci-php:8.2
+git.unsupervised.ca/unsupervised/ci-php:8.3
+git.unsupervised.ca/unsupervised/ci-php:8.5
+```
+
+The `Unsupervised` org is public, so they pull anonymously — no registry
+credentials in any job here. What the images contain, how they are published,
+and how to add a PHP version are documented in that repository's README.
+
+## Which job runs where
+
+| Job | Runs in |
+|---|---|
+| Coding Standards (PHPCS) | `ci-php:8.3` |
+| Static Analysis (PHPStan) | `ci-php:8.3` |
+| Tests | `ci-php:${{ matrix.php }}` |
+| Build Plugin Zip | `ci-php:8.3` |
+| No Debug Code | runner image — no PHP, and it uses GNU `grep --include` |
+| Open next-version bump PR (release.yml) | runner image — no PHP |
+
+PHPCS and PHPStan are separate jobs so a coding-standards failure still lets
+the static analysis result through. They run in parallel.
+
+## Composer
+
+`composer.lock` is committed, so every job installs the same dependency set
+and two builds of the same tag ship the same vendor tree. `bin/build-zip.sh`
+stages the lock into its build directory for the same reason, then removes it
+before writing the zip.
+
+The Composer download cache lives at `/composer/cache` — `COMPOSER_HOME` is
+`/composer` in the image — and is keyed on `composer.lock`.
+
+## Adding a PHP version to the test matrix
+
+The image has to exist first. Add the version to the `php` matrix in
+`ci-php`'s `.gitea/workflows/publish.yml` and merge, then add it to the `test`
+matrix in `.gitea/workflows/ci.yml` here.
+
+## Signing the version bump commit
+
+`main` is a protected branch that requires signed commits, and Gitea will not
+merge a pull request containing an unsigned one. The `bump-version` job in
+`release.yml` therefore signs the commit it makes, using a dedicated
+`release-bot` SSH key rather than the key Gitea signs merge commits with —
+that one is `[repository.signing] SIGNING_KEY` on the server and no runner can
+reach it. Keeping the CI key separate also means it can be rotated on its own
+if the secret ever leaks.
+
+There is deliberately no `release-bot` Gitea account. A key attached to an
+account is only consulted for signature checking after it has been through the
+web *Verify* flow, and that flow has no API — a bot account would need an
+interactive login to be worth anything. Listing the key under
+`TRUSTED_SSH_KEYS` instead makes Gitea verify commits signed with it without
+any account lookup, which is all the protected branch asks for.
+
+Set up once for the instance, and again only if the key is rotated:
+
+1. Generate a passphrase-less key (it has to be usable unattended):
+
+   ```
+   ssh-keygen -t ed25519 -C '[email protected]' -f release-bot -N ''
+   ```
+
+2. Add the public half to `app.ini` and restart Gitea:
+
+   ```ini
+   [repository.signing]
+   TRUSTED_SSH_KEYS = ssh-ed25519 AAAAC3Nza... [email protected]
+   ```
+
+3. Store the private half as the **organisation** Actions secret
+   `RELEASE_BOT_SIGNING_KEY` (Org → Settings → Actions → Secrets): the whole
+   `release-bot` file verbatim, `-----BEGIN OPENSSH PRIVATE KEY-----` header
+   and footer included — not the `.pub`, and not a GPG export. Organisation
+   secrets are readable as `secrets.RELEASE_BOT_SIGNING_KEY` from every
+   repository in the org, so no repository-level copy is needed. Delete both
+   local files afterwards.
+
+Two consequences of trusting the key instance-wide are worth knowing. Any
+commit signed with it verifies in *every* repository on the instance, not just
+these — the trust is in the key, not in a user with permissions you can scope.
+And the signature is attributed to `SIGNING_NAME` / `SIGNING_EMAIL`, not to the
+`Release Bot <release-bot@unsupervised.ca>` committer the job sets; that
+address backs no account and is only a label.
+
+The job fails fast if the secret is missing or `ssh-keygen` is absent from the
+runner image, and it re-reads the commit it just made to confirm a signature
+is attached before pushing — an unsigned bump commit would otherwise look fine
+until someone tried to merge the PR.
+
+Nothing else in the pipeline signs anything: release tags are made by a human
+through Gitea's release UI, and the merge commit is signed by the server when
+the PR is merged.

docs/features/account-registration.md

@@ -42,6 +42,34 @@ never be used to create a policy-less account (`Auth\EmailConfirmationHandler`):
 - `login_init` action redirects any `action=register` request (GET **and** POST) to the registration page before any processing runs.
 - `registration_errors` filter is a fail-safe that rejects `register_new_user()` outright.
 
+### Holding signups that came from somewhere else
+Blocking core's own form is not the whole story. `users_can_register=1` and
+`default_role=us_student` are *site-wide* settings, so they also arm every other
+route into `wp_insert_user()` a site happens to have — another plugin's signup
+form, a membership add-on. An account minted that way arrives holding
+`book_lesson`, with no email confirmed, no studio approval and no policy
+acceptance on file, and could book and be billed immediately.
+
+So the pending state is not decided by whichever form created the account. It is
+decided once, on `user_register`, by
+`Auth\RegistrationLoginGate::holdUnknownSignup()`:
+
+| New account | Result |
+|---|---|
+| Not a `us_student` | untouched — instructors and everyone else are not this feature's business |
+| Created by someone holding `manage_students` (including an admin adding a user in wp-admin) | left active — a deliberate act by someone who could approve it in the next click |
+| Anything else | **held** via `RegistrationStatus::hold()` and queued under **Pending Students** |
+
+A hold sets `us_awaiting_approval=1` *and* `us_email_confirmed=1`. The account was
+never asked to confirm anything and has no token to answer with, so blocking its
+login would strand it; what the hold withholds is `book_lesson`, until a studio
+admin approves it.
+
+The plugin's own paths all land in the last row and then say what they meant:
+- a self-signup calls `RegistrationStatus::markPending()`, which replaces the hold with a real, unconfirmed pending state (it clears `us_email_confirmed` explicitly for exactly this reason);
+- an invited student is approved outright by `RegistrationPage` before the auto-login — the invitation *is* the approval;
+- a guardian's child is approved outright by `GuardianService::createChild()`; the account is never signed in to, and queueing every child a family adds would be nonsense.
+
 ## Account Lifecycle (self-approval)
 State lives entirely in user meta (`Auth\RegistrationStatus`). Only the raw
 confirmation token's SHA-256 hash is stored; the token expires after 48h
@@ -77,14 +105,62 @@ confirmation token's SHA-256 hash is stored; the token expires after 48h
 | `accepted_at`      | DATETIME         | When accepted; NULL while pending / for group links     |
 | `expires_at`       | DATETIME         | Explicit expiry (end of the chosen day); set on every group link, NULL for personal invites (which expire 14 days after creation) |
 
-## Registration Questions (signup step two)
+## Email and password validation
+
+Both are checked on the server on every signup path, and the browser is given a
+matching but *stricter* job so a bad password is caught before submitting.
+
+**Email** — `type="email"` and `required` in the markup, `is_email()` on the
+server, then `email_exists()` for "an account already exists for this email". A
+personal invite fixes the address and the server always uses the invite's own
+value, so a tampered field is ignored rather than validated.
+
+**Password** — `Auth\PasswordPolicy` is the authority. It deliberately does
+*not* try to reproduce a strength score in PHP; it rejects the categorically
+bad, which is what a server can check without shipping a dictionary:
+
+- shorter than `PasswordPolicy::MIN_LENGTH` (8 — NIST SP 800-63B's floor;
+  composition rules like "must contain a symbol" are deliberately **not** used,
+  as they push people towards predictable substitutions),
+- one of the well-known leaked passwords,
+- built from fewer than four distinct characters (`aaaaaaaa`, `abababab`),
+- containing the user's own display name, email, or the part before the `@`.
+
+The nuance happens in the browser. `register.js` scores the password with
+zxcvbn through WordPress's own `password-strength-meter` script and refuses to
+submit below `PasswordPolicy::MIN_SCORE` (2 of 4 — "medium"; enough to stop a
+guessable password without demanding a passphrase to book a piano lesson). The
+thresholds reach JavaScript via `wp_localize_script()` from the same constants
+the server enforces, so the two cannot drift apart.
+
+The verdict is applied with `setCustomValidity()` on the password field rather
+than by disabling a button: an invalid field stops the submit without the button
+needing to know why. zxcvbn's dictionary loads asynchronously, so the gate stays
+open until it arrives — the server is the check that always runs.
+
+The password is also **re-scored on submit**, not only as it is typed. Native
+validation has already run by the time the `submit` event fires, so a verdict
+reached there stops the submit by hand (`preventDefault()` + `reportValidity()`).
+Without that, a password typed in the second before the dictionary arrived was
+never scored at all, and the first the person heard of it was the server
+rejecting the whole form.
+
+## Registration Questions
 When the studio has configured **account-scope** registration questions
-(**Offerings → Questions → "Account signup"**, see `registration-questions.md`), the
-registration form becomes two steps: name/email/password/policies first, then the required
-questions. This applies to **every** signup path (invite, group link, self-approval).
-Required answers are validated before the account is created, and are stored against the new
-user (`us_question_answers`, `registration_type = 'account'`). A studio admin reviews them
-under **Registration Information** on the student's admin screen.
+(**Offerings → Questions → "Account signup"**, see `registration-questions.md`), they
+are asked on the main form in an **About you** panel — alongside the account
+holder's birth year, above the students they are adding, and only when they are a
+student themselves (`self` or `both`). This applies to **every** signup path
+(invite, group link, self-approval). Required answers are validated before the
+account is created, and are stored against the new user (`us_question_answers`,
+`registration_type = 'account'`). A studio admin reviews them under **Registration
+Information** on the student's admin screen.
+
+The form is one page with one submit. The questions used to be a second step
+behind a "Next" button; that put what the studio needs to know about an adult
+student on a screen reached only after everything else, and the two-step gate is
+what made a weak password reachable — it advanced on a `checkValidity()` that had
+not yet scored anything.
 
 ## Policy Acceptance Scope
 Policies declare **when** they must be accepted via `us_policies.acceptance_scope`:
@@ -132,7 +208,7 @@ recorded in `us_policy_acceptances` with `registration_type = account` and
 The block's **After registration** panel picks the page a student continues to once
 registration finishes, and whether they get there by hand or automatically.
 
-- **Sign-in page** (`loginPageId` / `login_page_id`) — the target of the "Sign in to your account" link shown after email confirmation (`?us_confirmed=1|ready`, falling back to the WordPress login screen) and of the "Continue to your account" link an invited student sees on the spot (`?us_registered=invite`; no link at all with no page chosen, since an already-signed-in student has no use for the login screen).
+- **Sign-in page** (`loginPageId` / `login_page_id`) — the target of the "Sign in to your account" link shown after email confirmation (`?us_confirmed=1|ready`, falling back to the WordPress login screen) and of the **"Continue to _<page title>_"** link every **logged-in** visitor gets (`RegistrationPage::continueLink()`): an invited student who just finished signing up (`?us_registered=invite`), and anyone who simply arrives at the registration page already signed in. The link names the chosen page (via `get_the_title()`) so the visitor knows where it goes; an untitled page falls back to "Continue to your account" rather than reading "Continue to ". Neither gets the WordPress-login-screen fallback — with no page chosen there is no link at all, since sending someone already signed in to the login screen is the same dead end with extra steps.
 - **Redirect automatically** (`autoRedirect`, block only) — sends the student to that page instead of showing the link, via `BlockRegistrar::maybeAutoRedirect()` on `template_redirect`. It fires only on those two finished states (`RegistrationPage::isRegistrationComplete()`), so the "check your email" step, a validation error, and an `expired` confirmation link are always shown rather than redirected past. With no page chosen nothing happens — there is deliberately no login-screen fallback for the redirect. See `editor-blocks.md`.
 
 ## Token Redirect
@@ -150,7 +226,7 @@ No-op when no registration page is set.
 - Repository: `Unsupervised\Schedular\Auth\InviteRepository`
 - Admin controllers: `Unsupervised\Schedular\Auth\RegistrationController` (invites), `Unsupervised\Schedular\Auth\RegistrationApprovalController` (pending students)
 - Frontend: `Unsupervised\Schedular\Auth\RegistrationPage`
-- Self-approval flow: `Auth\RegistrationStatus` (lifecycle meta), `Auth\RegistrationLoginGate` (login + booking-cap gate), `Auth\EmailConfirmationHandler` (confirm link + native-form block), `Auth\RegistrationMailer` (emails)
+- Self-approval flow: `Auth\RegistrationStatus` (lifecycle meta, including `hold()`), `Auth\RegistrationLoginGate` (login gate, booking-cap gate, and the `user_register` hold), `Auth\EmailConfirmationHandler` (confirm link + native-form block), `Auth\RegistrationMailer` (emails)
 - Settings toggle: `Payment\StudioSettings` (`us_registration_mode`, core-option mirror/restore)
 - Reuses `Policy\PolicyRepository`, `Policy\PolicyVersionRepository`, `Policy\AcceptanceRepository`
 - Schema: `us_invites`; `us_policies.acceptance_scope`. Self-approval adds no tables — state is WordPress user meta.
@@ -165,3 +241,12 @@ No-op when no registration page is set.
 - `tests/Unit/Auth/RegistrationApprovalControllerTest.php`
 - `tests/Unit/Auth/RegistrationMailerTest.php`
 - `tests/Unit/Payment/StudioSettingsTest.php`
+
+## Parent/Guardian Signup
+The registration form asks **"Who are you registering?"** — just myself, on behalf
+of one or more students, or both — and the student-bearing choices reveal a
+repeatable child block (name, birth year, and the account-scope questions asked
+**per child**). Each child becomes a login-less `us_student` user linked to the
+guardian, and the signup policies are recorded once per child with the guardian as
+the acceptor. Available on every signup path — personal invite, group link, and
+self-approval. See `parent-guardian-accounts.md`.

docs/features/availability-management.md

@@ -25,8 +25,9 @@ A slot's `duration_minutes` is matched against the offering a student picks: a
 `AvailabilitySlot::splitByDuration()` chunks a submitted window into consecutive
 `duration_minutes` slots; `AvailabilityRepository::createFromWindow()` persists
 one row per chunk. A trailing remainder shorter than the lesson length is
-dropped. Windows must start and end on the same day and fit at least one lesson
-(REST responds `400 invalid_window` otherwise; the admin form is a no-op).
+dropped. Windows must start and end on the same day and fit at least one lesson;
+both the REST endpoint and the admin form reject one that does not, with a
+message saying so (see **REST API** below).
 `AvailabilityRepository::splitOversizedWindows()` is a data migration (run by
 `Installer` on activation or version change) that rewrites pre-split rows.
 
@@ -44,6 +45,27 @@ Instructors access **My Availability** in wp-admin (`?page=us-availability`).
 - Bulk delete: the list view has a checkbox per unbooked slot (with a select-all header checkbox) and a **Delete selected** button (`usc_action=bulk_delete`, `slot_ids[]`); each id is ownership-checked, and booked slots are refused at the repository level
 - Current slots can be shown as a **weekly calendar** (the default, navigated with `usc_week=Y-m-d`) or a **list** (`usc_view=list`); the grid honours the site's `start_of_week` option via `Availability\WeekCalendar`
 
+### Feedback
+Every submitted action reports its outcome as a wp-admin notice — a success
+notice naming the number of slots created or deleted, or an error explaining the
+refusal. `AvailabilityController::handleFormAction()` returns a
+`[$notice, $error]` pair that `templates/admin/availability.php` renders.
+
+This matters because the form used to fail **silently**: a window shorter than
+the chosen lesson length splits into no slots, so nothing was written, nothing
+was said, and the page simply reloaded. Submitting 5:30–6:00 PM with the length
+select on its 60-minute default was the reported case. Invalid datetimes, an end
+before the start, a window spanning two days, and an offering belonging to
+another instructor were all silent in the same way.
+
+### Lesson-length choices
+`assets/js/availability-admin.js` (enqueued by `AdminMenu::enqueueAssets()` on
+this screen only) hides any lesson length longer than the entered window, falls
+back to the longest one that still fits when the current pick is hidden, and
+disables the submit button when nothing fits. It is a convenience, not a
+guarantee — the server validates the same window regardless. The choices come
+from `AvailabilitySlot::DURATION_CHOICES`.
+
 ## Public Calendar
 The front-end booking shortcode renders open slots from `GET /availability`
 either as an agenda-style list grouped by day or as a **weekly calendar** with
@@ -62,12 +84,29 @@ with the **Show Only** lesson-type filter — see `lesson-booking.md`.
 `GET` supports query params: `instructor_id`, `offering_id`, `duration_minutes`, `from` (datetime), `to` (datetime).
 Slots whose start has already passed are never returned.
 
-`POST` validates `start_dt`/`end_dt` (admin form and REST alike) via
-`AvailabilitySlot::normalizeDateTime()`: the canonical `Y-m-d H:i[:s]` and HTML
-`datetime-local` (`Y-m-d\TH:i[:s]`) forms are normalised to `Y-m-d H:i:s`;
-anything else — or an end not after the start — is rejected (REST responds
-`400 invalid_datetime`; the admin form is a no-op). A valid window is stored as
+`POST` runs every submitted window — admin form and REST alike — through
+`Availability\WindowValidator`, which returns either the window ready to persist
+or a `WP_Error`. The REST endpoint returns that error directly (its `status`
+data makes it a 400); the admin screen shows `get_error_message()` in a notice.
+Sharing one validator is deliberate: the two paths previously checked the same
+rules separately, and the admin copy was both laxer (no offering-ownership
+check) and mute (a bare `return` on every rejection).
+
+| Rejection | Code |
+|---|---|
+| Start or end not a real datetime | `invalid_datetime` |
+| End at or before the start | `invalid_datetime` |
+| Window spans two days | `invalid_window` |
+| Window shorter than the lesson length (so it holds no slots) | `invalid_window` |
+| Offering missing, or owned by another instructor | `invalid_offering` |
+
+`start_dt`/`end_dt` are normalised by `AvailabilitySlot::normalizeDateTime()`:
+the canonical `Y-m-d H:i[:s]` and HTML `datetime-local` (`Y-m-d\TH:i[:s]`) forms
+become `Y-m-d H:i:s`; anything else is rejected. A valid window is stored as
 lesson-length slots and `201` returns `{ "ids": [...] }` for every row created.
+`weeks` is clamped to `AvailabilitySlot::MAX_WEEKLY_OCCURRENCES` in the
+repository, so the form's `max` cannot be bypassed by posting directly. A write
+that fails entirely returns `500 not_saved` rather than a `201` listing no ids.
 
 Times are displayed in 12-hour AM/PM form in the booking calendar and wp-admin
 lists.
@@ -78,6 +117,8 @@ lists.
 - Week bucketing: `Unsupervised\Schedular\Availability\WeekCalendar`
 - Admin controller: `Unsupervised\Schedular\Availability\AvailabilityController`
 - REST endpoint: `Unsupervised\Schedular\Availability\AvailabilityEndpoint`
+- Shared window validation: `Unsupervised\Schedular\Availability\WindowValidator`
+- Admin form script: `assets/js/availability-admin.js`, enqueued by `AdminMenu::enqueueAssets()`
 
 ## Tests
 - `tests/Unit/Availability/AvailabilityControllerTest.php`
@@ -85,3 +126,4 @@ lists.
 - `tests/Unit/Availability/AvailabilitySlotTest.php`
 - `tests/Unit/Availability/AvailabilityEndpointTest.php`
 - `tests/Unit/Availability/WeekCalendarTest.php`
+- `tests/Unit/Availability/WindowValidatorTest.php`

docs/features/credits.md

@@ -121,3 +121,12 @@ refund of a shared payment.
 - `tests/Unit/Payment/PaymentTest.php` (`netDue`)
 - `tests/Unit/Booking/BookingEndpointTest.php` (credit issued on cancel)
 - `tests/Unit/Auth/StudentHistoryTest.php` (`creditBalance`, `credits`)
+
+## Family Balances
+A credit records the student it was earned for (`student_id`) and the account
+that **holds** it (`payer_id`). Balance lookups — `availableBalance()`,
+`findAvailableByPayer()`, `consume()` — key on the payer, so a family shares one
+balance and a credit from one child's cancelled lesson can settle a sibling's
+next charge. A child's admin screen still lists the credits their own
+cancellations produced, labelled with whose account holds the balance. See
+`parent-guardian-accounts.md`.

docs/features/data-removal.md

@@ -0,0 +1,79 @@
+# Feature: Data Removal
+
+## Overview
+What deleting the plugin takes with it, and how the site owner says so.
+
+WordPress gives an uninstall no interface of its own: `uninstall.php` runs
+headless, after the plugin is already gone from the screen, with no opportunity
+to ask anything. So the answer is given in advance, on **Access → Plugin
+removal**, and read back at uninstall time.
+
+Two things are true at once, and the split below is how both are honoured:
+
+- **A studio's records are irreplaceable.** Lessons taught, payments taken, what
+  families agreed to and when. A delete during a migration, or a
+  delete-and-reinstall while troubleshooting, must not be the thing that loses
+  them. So the data is **kept unless the owner explicitly says otherwise**.
+- **Credentials are not records.** A Stripe secret and webhook signing key can be
+  re-pasted from the Stripe dashboard in under a minute. Live keys sitting in
+  `wp_options` on a site that no longer has the code to use them are nothing but
+  exposure. So those are **always** removed.
+
+## Option `us_delete_data_on_uninstall`
+`'1'` or `'0'` (default `'0'`). Written only from the Access page.
+
+## Always removed
+Whatever the setting says:
+
+| What | Why |
+|---|---|
+| `us_stripe_secret_key`, `us_stripe_webhook_secret`, `us_stripe_publishable_key`, `us_stripe_mode` | Credentials, not records — cheap to restore, dangerous to leave |
+| `us_schedular_latest_release` transient | Cached release metadata; meaningless without the plugin |
+| The `us_generate_due_payments` cron event | Deactivation clears it too, but a site whose plugin files simply vanished never ran that hook |
+| `users_can_register` / `default_role` | Restored from the snapshot open registration took (`us_registration_prev_*`). These are the *site's* settings, borrowed; leaving them behind would leave the site accepting public signups into a Student role that is about to stop existing. Only acts when a snapshot exists |
+
+## Removed only on an explicit full purge
+- Every table in `Schema::TABLES` — all 14, dropped by name.
+- Every remaining `us_*` option, including the removal setting itself.
+- Every `us_*` user meta key, for all users (`delete_metadata( 'user', 0, $key, '', true )`) — billing overrides, child markers, birth years, pending-signup state.
+- The `us_studio_admin`, `us_instructor` and `us_student` roles.
+
+Roles go **only** on a full purge. A site keeping its data is keeping its
+students, and a student whose role was deleted out from under them holds no
+capabilities at all until the plugin is reinstalled.
+
+`Schema::TABLES` is the single list of tables the plugin owns; the `CREATE TABLE`
+statements in `Schema::tables()` spell their own names out, so a new table has to
+be added in both places or uninstalling will leave it behind.
+
+## Admin Interface
+**Access → Plugin removal** (`manage_options` — the same capability as deleting a
+plugin, so the switch and the act it governs are in the same pair of hands):
+
+- A read-only note stating what is removed regardless.
+- **Erase everything when the plugin is deleted** — off by default.
+
+Turning it **on** takes the tick *and* the word `DELETE` typed into a confirmation
+box. It is the only place in the plugin where a stray click is unrecoverable, so
+the checkbox alone is not enough. A refused confirmation reports why and still
+saves everything else on the page — a mistyped word must not silently swallow a
+capability change made in the same submit.
+
+Turning it **off** needs nothing but unticking the box. Saving the page for some
+other reason while it is already on leaves it on, without asking for the word
+again.
+
+## Implementation
+- `Unsupervised\Schedular\Uninstaller` — the option, and the whole of `run()`
+- `uninstall.php` — guards on `WP_UNINSTALL_PLUGIN`, loads the autoloader, calls `Uninstaller::run()`
+- `Unsupervised\Schedular\Schema::TABLES` — the table list
+- `Unsupervised\Schedular\Auth\AccessSettings` — the setting's UI and the typed confirmation
+- `templates/admin/access.php`
+
+## Tests
+- `tests/Unit/UninstallerTest.php`
+- `tests/Unit/Auth/AccessSettingsTest.php` (the confirmation rules)
+
+## Related
+- `payments.md` — the Stripe credentials this always forgets
+- `account-registration.md` — the core options open registration borrows

docs/features/editor-blocks.md

@@ -1,8 +1,8 @@
 # Editor Blocks
 
-Gutenberg dynamic-block wrappers for the plugin's four front-end shortcodes,
-so the pages can be previewed and styled inside the block editor instead of
-appearing as grey shortcode text.
+Gutenberg dynamic-block wrappers for the plugin's front-end shortcodes, so the
+pages can be previewed and styled inside the block editor instead of appearing
+as grey shortcode text.
 
 ## Blocks
 
@@ -12,6 +12,8 @@ appearing as grey shortcode text.
 | `us-scheduler/student-login` | `[us_student_login]` | `Auth\LoginPage::render()` |
 | `us-scheduler/student-register` | `[us_student_register]` | `Auth\RegistrationPage::render()` |
 | `us-scheduler/group-classes` | `[us_group_classes]` | `GroupClass\GroupClassPage::render()` |
+| `us-scheduler/family` | `[us_family]` | `Guardian\FamilyPage::render()` |
+| `us-scheduler/account` | `[us_account]` | `Auth\AccountPage::render()` |
 
 The shortcodes remain registered for back-compat; blocks and shortcodes share
 the same page objects (constructed once in `Plugin::boot()`), so front-end
@@ -21,7 +23,7 @@ transform.
 
 ## Block options
 
-Four blocks have sidebar (inspector) options:
+Most blocks have sidebar (inspector) options:
 
 | Block | Attribute | Default | Effect |
 |---|---|---|---|
@@ -34,6 +36,8 @@ Four blocks have sidebar (inspector) options:
 | `us-scheduler/student-login` | `autoRedirect` (boolean) | `false` | Send logged-in visitors straight to the booking page instead of showing the link. Does nothing until a booking page is chosen. |
 | `us-scheduler/student-register` | `loginPageId` (number) | `0` | Page students continue to once registration finishes — the "Sign in to your account" link after they confirm their email, and the "Continue to your account" link an invited student gets on the spot. `0` = the WordPress login screen for the confirmation link, and no link at all for the (already signed-in) invited student. Shortcode equivalent: `[us_student_register login_page_id="…"]`. |
 | `us-scheduler/student-register` | `autoRedirect` (boolean) | `false` | Send students straight to that page instead of showing the link. Does nothing until a page is chosen — there is no login-screen fallback here. |
+| `us-scheduler/family` | `loginPageId` (number) | `0` | Where visitors who are not signed in are sent to log in. Shortcode equivalent: `[us_family login_page_id="…"]`. |
+| `us-scheduler/account` | `loginPageId` (number) | `0` | Where signing out returns to, and where a signed-out visitor is offered a **Sign in** link. `0` = signing out returns to the current page, and a signed-out visitor sees **nothing at all** — see below. Shortcode equivalent: `[us_account login_page_id="…"]`. |
 | `us-scheduler/group-classes` | `offeringId` (number) | `0` | Restrict the page to a single group class, for embedding on a page dedicated to that class. The class description is then omitted — only the schedule, instructor, price and enrolment controls are shown, so the surrounding page's own copy is not repeated. `0` = browse all classes, descriptions included. Shortcode equivalent: `[us_group_classes offering="…"]`. |
 
 The page selects list all published pages; if a chosen page is later deleted,
@@ -105,6 +109,10 @@ placeholder content:
 - **Login** — the real `templates/frontend/login-page.php` template (it has
   no request-state dependencies).
 - **Registration** — a disabled sample of the `.us-register-form` fields.
+- **Account** — a populated sample panel. Deliberately populated whatever the
+  editor user's own state: on the published page a signed-out visitor may see
+  nothing at all, and an empty box tells the person placing the block nothing
+  about where it will sit.
 
 Each preview starts with a `.us-editor-note` paragraph explaining what the
 published page shows instead. The note class only appears in editor previews.
@@ -118,5 +126,22 @@ published page shows instead. The note class only appears in editor previews.
   and fallbacks.
 - `tests/Unit/Auth/LoginPageTest.php` — logged-in booking-link targets and
   fallbacks.
+- `tests/Unit/Auth/AccountPageTest.php` — what each visitor sees, the
+  sign-out redirect target, and the signed-out empty render.
 - `tests/Unit/BlockPreviewTest.php` — preview markup mirrors the live CSS
   classes/ids and includes the editor note.
+
+## The account block's signed-out behaviour
+
+`us-scheduler/account` is the one block that can render **nothing**. It is meant
+for a header, sidebar or account page, and its whole subject is the person
+signed in — which a stranger is not. A bare "you are not signed in" in a site
+header is noise that cannot be acted on, so:
+
+- **No login page chosen** → empty string for signed-out visitors.
+- **Login page chosen** → a single **Sign in** link.
+
+Signed in, it shows the display name (`Auth\UserName::format()`, so a username
+is never exposed), the account email, and a **Sign out** link — deliberately
+nothing else. Signing out returns to the chosen login page, or to the current page when there
+is none, so a header sign-out does not also navigate the visitor somewhere.

docs/features/group-classes.md

@@ -15,6 +15,7 @@ A group class can be marked **invite-only** (`us_offerings.access_mode = invite_
 | `instructor_id`| BIGINT UNSIGNED  | WordPress user ID (denormalised from the offering)          |
 | `status`       | VARCHAR(20)      | `active` / `cancelled` / `completed`                        |
 | `payment_id`   | BIGINT UNSIGNED  | Nullable FK → `us_payments.id`                             |
+| `enrolled_by`  | BIGINT UNSIGNED  | Staff member who added the student from wp-admin; 0 when the student (or their guardian) enrolled themselves |
 | `enrolled_at`  | DATETIME         | Insertion time                                             |
 
 ## Class Dates, Time, and Instructor
@@ -31,19 +32,78 @@ Assigning an instructor to a scheduled class removes that instructor's open
 booking slots at the class time and flags any already-booked lesson that clashes;
 see **Instructor assignment** in `offerings.md`.
 
-## Enrolment Flow
-The class list is loaded together with the student's own enrolments
-(`GET /enrollments`); a class the student already has an `active` enrolment in
-shows "You are enrolled in this class." instead of the Enrol button (the
-server would reject the duplicate with `409 already_enrolled` regardless — a
-cancelled enrolment does not block re-enrolling).
+### Sessions in the "upcoming" views
+`GroupClass\SessionSchedule` turns an enrolment into the dated sessions behind it,
+so a class appears alongside one-to-one lessons wherever upcoming lessons are
+listed. A class is a term, not rows in `us_availability`, so an enrolment carries
+no date of its own — the concrete windows come from `Offering::sessionWindows()`,
+the same derivation the billing scan and the class-slot reconciler use, which is
+what keeps a student's list, an instructor's list and the invoice agreeing on when
+the class meets.
 
-1. Student opens a group class from the offering catalog.
+- `upcomingForStudent()` — every not-yet-started session of each enrolment that is
+  not `cancelled`. `completed` is a *billing* state and says nothing about the
+  calendar, so those sessions stay listed.
+- `upcomingForInstructor()` — every session of each active group class they own,
+  one row per session however many students are enrolled; enrolments are not
+  consulted, because a class still has to be taught if nobody has signed up yet.
+
+**A class you are enrolled in must never silently vanish from these lists.** Both
+the class time and the duration are optional on the offering form, and the
+schedule note exists precisely so a studio can write "Tuesdays 4:00pm" rather than
+pin the class to a clock. So the schedule degrades instead of disappearing:
+
+| Class has | What the list gets |
+|---|---|
+| date + time + duration | one dated row per remaining session, with an end time |
+| date + time, no duration | one dated row per remaining session, `end_dt` empty — when it starts is worth showing without guessing when it ends |
+| no class time | **one** row for the class as a whole, sorted by term start (or by "now" once the term is under way), with `schedule` text from `Offering::scheduleLabel()` — the studio's note, else the term dates, else "Schedule to be confirmed" |
+| a term whose last day has passed | nothing |
+
+`schedule` is the tell: non-null means "a class, described in words, not a session
+at a known time", and every renderer shows that text in place of a date and time.
+An undated row's `start_dt` is a **sort key only** — never displayed.
+
+`Offering::sessionStarts()` is the split that makes this work: it needs only the
+date and the time, because knowing *when* a class meets is a separate question
+from knowing how long it runs. `sessionWindows()` is that plus the duration, and
+still returns nothing without one — availability blocking and per-session billing
+need both ends of a window.
+
+Consumers mark these rows `kind = 'group_class'` (`SessionSchedule::KIND`) and
+withhold the per-lesson actions from them: a session is one date in a term, not a
+booked slot, so there is nothing to cancel session by session and no slot to
+release. Withdrawing from the class is the separate, whole-enrolment decision.
+
+Where they show up: the `[us_scheduler]` upcoming panel via `GET /bookings`
+(students and instructors both), and the **Upcoming lessons** table on the admin
+student detail page. Only *upcoming* sessions are added there — the
+**Group-class enrolments** table below already records the whole history, and a
+term's worth of past dates would bury the lessons under "Past lessons".
+
+## Enrolment Flow
+The class list is loaded together with the household's enrolments
+(`GET /enrollments`), and the two are matched up **per student**, not per account.
+Each active enrolment in a class adds its own line to the card — "Ada is enrolled
+in this class." — with its own **Withdraw** button, and the Enrol button stays
+(reading "Enrol another student") for as long as anyone the account may enrol is
+still out of the class. The enrolment form then offers only those students; when
+exactly one is left the picker collapses to a hidden field carrying that student's
+id, because an omitted `student_id` reads as "enrol the account holder" and would
+sign up the parent instead of the last child. Only when the whole household is
+enrolled does the Enrol button disappear.
+
+The per-student matching mirrors the server, which rejects a duplicate with
+`409 already_enrolled` for that `(offering, student)` pair alone — a sibling is
+never a duplicate, and a cancelled enrolment does not block re-enrolling.
+
+1. Student opens a group class from the offering catalog. Each class card shows its price with the **cadence** it is billed on — `120.00 CAD up front`, `40.00 CAD monthly`, and so on.
 2. Student answers the offering's questions (`GET /offerings/{id}/questions`).
 3. Student accepts the current published policy versions (`GET /policies`) — required to continue.
-4. Full-term payment is taken per the student's billing method (card by default; `pending` for e-transfer; skipped for comp). See `payments.md`.
-5. `POST /enrollments` creates the enrolment (`status = active`), records answers and policy acceptances, and links the payment — but only if the offering's `capacity` has not been reached.
-6. On successful payment (or comp) a receipt is emailed.
+4. The enrolment form restates the price (with HST) and requires a second, separate agreement to pay that amount before it will submit. See **Price Display and the Pay Agreement** in `payments.md`.
+5. Full-term payment is taken per the student's billing method (card by default; `pending` for e-transfer; skipped for comp). See `payments.md`.
+6. `POST /enrollments` creates the enrolment (`status = active`), records answers and policy acceptances, and links the payment — but only if the offering's `capacity` has not been reached.
+7. On successful payment (or comp) a receipt is emailed.
 
 Capacity is enforced at enrolment time by counting `active` rows for the offering;
 a class at capacity rejects further enrolments.
@@ -64,7 +124,8 @@ closed. Past the deadline the details page labels these as late enrolments. See
 
 ## Withdrawal Flow
 A student may withdraw themselves from a class they are enrolled in through the same
-group-class page: an active enrolment shows a **Withdraw** button.
+group-class page: an active enrolment shows a **Withdraw** button. A guardian sees one
+per enrolled child, labelled with the child's name, so the right seat is the one released.
 `POST /enrollments/{id}/withdraw` marks the enrolment `cancelled` (freeing its
 capacity seat) and voids any still-pending payment. It **never issues an account
 credit** — a timely withdrawal is a clean exit, not a refund (credits are reserved
@@ -75,10 +136,12 @@ Self-withdrawal is bounded by the class's **withdrawal deadline** (the instructo
 implicit default — a class with no deadline set stays open to withdrawal for its
 whole life. Past the deadline `POST /enrollments/{id}/withdraw` rejects the request
 with `403 withdrawal_closed`, and the class card shows "Withdrawal has closed —
-contact the studio to withdraw." in place of the Withdraw button. The endpoint also
-returns `404 not_found` for an unknown enrolment and `403 forbidden` when the
-enrolment is not the caller's own; a withdrawal of an already-cancelled enrolment is
-idempotent.
+contact the studio to withdraw." in place of the Withdraw button. An enrolment that
+does not exist and one that is not the caller's own both return the same
+`404 not_found`, deliberately: two different answers would let any signed-in student
+walk the id space and count the studio's enrolments, and there is nothing they could
+do with either answer. A withdrawal of an already-cancelled enrolment is idempotent.
+`POST /bookings/{id}/cancel` makes the same trade for the same reason.
 
 The deadline only bounds student **self**-withdrawal. A studio admin can withdraw a
 student at any time from the **student detail page** (`Auth\StudentActions::withdrawEnrollment`),
@@ -120,6 +183,8 @@ controls beneath it:
    settled at once by `PaymentService`). No access grant is needed — this writes straight
    to `us_group_enrollments` + `us_payments`. It bypasses the enrolment deadline and
    capacity, so it doubles as the **late-enrolment** path after a class has closed.
+   The enrolment records who added them (`enrolled_by`), which is what later allows
+   its intake to be recorded — see **Recording Intake Collected Elsewhere**.
 2. **Make available** — the selected registered students get an `invited` grant so the
    class appears in their own group-class list; they then self-enrol through the normal
    paid flow. Each is emailed a "you've been added" notice.
@@ -129,6 +194,17 @@ controls beneath it:
    a **pending** invite, the grant is attached to that invite and **no second link is
    sent**. An address that already has an account is treated as **Make available** instead.
 
+Both student-picking controls vet every posted id with `Auth\RoleManager::isStudent()`
+before acting on it — the same predicate the picker is built from, and the same one
+`Booking\AdminBooking` guards a staff booking with. A posted id naming an instructor,
+an administrator, or an account deleted since the page was drawn is skipped rather
+than enrolled, so nothing can put a non-student on a roster or raise a payment
+against one. Being a student is a matter of the **role**, not the `book_lesson`
+capability, so a guardian's child and a signup still awaiting approval are both
+fully enrollable — neither may enrol *themselves*, which is exactly what the studio
+adding them is for. The reported count is what was actually added, so a skipped id
+shows up as a smaller number.
+
 When an email-invited person completes registration, `RegistrationPage` links their new
 account to the grant (`GroupAccessRepository::linkStudentByEmail`), so the invite-only
 class becomes enrollable for them — they choose whether to enrol.
@@ -170,11 +246,46 @@ class becomes enrollable for them — they choose whether to enrol.
   instructor. The summary (`templates/admin/my-group-classes.php`) and the details page
   (`templates/admin/my-group-class-detail.php`) are separate templates.
 
+## Recording Intake Collected Elsewhere
+A student the studio added with **Add students directly** has no intake answers
+and no policy acceptances: they were never shown the enrolment form. The answers
+are collected another way — a paper form at the first class, a phone call to a
+parent — and recorded afterwards from the **enrolment detail page**, reached from
+the **Intake → View** link on each roster row.
+
+The page shows who and what the enrolment is, the audit trail of everything
+answered and agreed to so far, and — for a studio-made enrolment only — a
+**Record intake collected elsewhere** panel offering whatever is still missing.
+Every recording must say **how** it was collected (signed paper form / in person /
+over the phone / by email / some other way, the last requiring an explanation),
+and that is stamped on every row along with who entered it. Both audit tables
+carry a **How it was given** column, so a policy ticked online and one transcribed
+from paper never look alike.
+
+**Only a studio-made enrolment qualifies** (`Enrollment::isStaffRegistered()`,
+i.e. `enrolled_by > 0`). An enrolment the student made already holds their own
+answers, and letting staff add to it would make the record editable after the
+event. Nothing already recorded can be overwritten: the submission is narrowed to
+what is genuinely still pending before anything is written, so a stale or
+double-posted form is harmless.
+
+This is the same mechanism the Scheduler uses for lessons it booked, and the
+reasoning behind each rule — why no IP is stored, why `accepted_by` stays the
+student while `recorded_by` names the staff member — is set out once in
+**Recording Intake Collected Elsewhere** in `lesson-booking.md`. An enrolment is
+its own registration, so unlike a weekly lesson series there is no anchor to
+follow: one enrolment, one intake record, however many sessions the term holds.
+
+Scoping matches the rest of the detail pages: an instructor may only open
+enrolments in their own classes, a `view_all_lessons` studio admin any.
+
 ## Implementation
 - Repository: `Unsupervised\Schedular\GroupClass\EnrollmentRepository` (`countActiveForOffering`/`hasActiveEnrollment` enforce capacity and prevent duplicates)
 - Access grants: `Unsupervised\Schedular\GroupClass\GroupAccess` + `GroupAccessRepository` (`hasGrant`, `findGrantedOfferingIds`, `markEnrolled`, `linkStudentByEmail`)
 - Model: `Unsupervised\Schedular\GroupClass\Enrollment`
-- Admin controller: `Unsupervised\Schedular\GroupClass\GroupClassController` — `renderPage` (studio admin per-class summary, `view_all_lessons`) and `renderInstructorPage` (instructor summary + `?class_id` roster detail, `view_own_lessons`)
+- Sessions: `Unsupervised\Schedular\GroupClass\SessionSchedule` (`upcomingForStudent`, `upcomingForInstructor`) — consumed by `Booking\BookingEndpoint::myLessons()` and `Auth\StudentController`
+- Admin controller: `Unsupervised\Schedular\GroupClass\GroupClassController` — `renderPage` (studio admin per-class summary, `view_all_lessons`) and `renderInstructorPage` (instructor summary + `?class_id` roster detail, `view_own_lessons`). Both also route `?enrollment_id=` to the enrolment detail view (`maybeRenderEnrollmentDetail`, template `templates/admin/enrollment-detail.php`)
+- Intake audit + late recording: `Unsupervised\Schedular\Registration\IntakeAudit` and `IntakeRecording`, shared with lesson bookings. `Enrollment` implements `Registration\IntakeSubject` to take part
 - REST endpoint: `Unsupervised\Schedular\GroupClass\EnrollmentEndpoint`
 - Frontend: `Unsupervised\Schedular\GroupClass\GroupClassPage` (`[us_group_classes]` shortcode; `offering="…"` restricts it to a single class for embedding on a dedicated page — the block equivalent is the `offeringId` attribute). In single-class mode `assets/js/group-classes.js` leaves the class description out of the card, since the page it is embedded on already describes the class; the schedule, instructor, schedule note, price and enrolment controls are still shown.
 - Reuses `Registration\RegistrationGate` (intake answers + booking-scoped policy acceptance, type `enrollment`)
@@ -192,4 +303,11 @@ class becomes enrollable for them — they choose whether to enrol.
 - `tests/Unit/GroupClass/GroupAccessTest.php`
 - `tests/Unit/GroupClass/GroupAccessRepositoryTest.php`
 - `tests/Unit/GroupClass/GroupClassPageTest.php`
+- `tests/Unit/GroupClass/SessionScheduleTest.php`
 - `tests/Unit/Offering/OfferingEndpointTest.php` (catalog merges granted invite-only classes)
+
+## Enrolling A Child
+`POST /enrollments` accepts the same optional **`student_id`** as booking,
+authorised through `Guardian\GuardianService::canActFor()`; `GET /enrollments`
+covers the guardian's whole household, and a guardian may withdraw any of their
+children. See `parent-guardian-accounts.md`.

docs/features/lesson-booking.md

@@ -17,6 +17,7 @@ Students register for a private lesson by choosing an offering, picking a time (
 | `status`       | VARCHAR(20)      | `pending` / `confirmed` / `cancelled`                       |
 | `payment_id`   | BIGINT UNSIGNED  | Nullable FK → `us_payments.id`                             |
 | `notes`        | TEXT             | Optional student notes                                      |
+| `booked_by`    | BIGINT UNSIGNED  | Staff member who booked it for the student; 0 when the student (or their guardian) booked it themselves |
 | `created_at`   | DATETIME         | Insertion time                                             |
 
 ## Registration Flow
@@ -25,11 +26,13 @@ Students register for a private lesson by choosing an offering, picking a time (
 3. For a `weekly` reservation, the same weekday/time is held for the rest of the offering's term.
 4. Student answers the offering's questions (`GET /offerings/{id}/questions`).
 5. Student accepts the current published policy versions (`GET /policies`) — required to continue.
-6. Payment is taken per the student's billing method (card by default; `pending` for e-transfer; skipped for comp). See `payments.md`.
-7. `POST /bookings` creates the lesson row(s) (`status = pending`), records answers and policy acceptances, marks `us_availability.is_booked = 1`, and links the payment. A booking with nothing owed (a free offering) creates no payment and is `confirmed` immediately.
-8. On successful payment (or comp) the lesson is `confirmed` and a receipt is emailed.
-9. Instructor sees the booking under **My Lessons** and may update status via `PATCH /bookings/{id}/status`.
-10. The booking page also shows the student their upcoming lessons (`GET /bookings`) — each with the booked offering's name and length, when it happens, a per-lesson status badge (pending payment / confirmed), and a **Cancel** button. Only the soonest five are shown; a **Show all** control reveals the rest. `GET /bookings` includes `offering_title` and `duration_minutes` for each lesson so the list needs no extra request.
+6. Student is shown what the booking costs — the offering's price with its **cadence** (at booking / up front / weekly / monthly), plus HST — and must tick a second, separate agreement to pay that amount before the form will submit. A weekly reservation quotes the per-lesson fee and the ceiling on the total it can claim. A free offering shows no price block. See **Price Display and the Pay Agreement** in `payments.md`.
+7. Payment is taken per the student's billing method (card by default; `pending` for e-transfer; skipped for comp). See `payments.md`.
+8. `POST /bookings` creates the lesson row(s) (`status = pending`), records answers and policy acceptances, marks `us_availability.is_booked = 1`, and links the payment. A booking with nothing owed (a free offering) creates no payment and is `confirmed` immediately.
+9. On successful payment (or comp) the lesson is `confirmed` and a receipt is emailed.
+10. Instructor sees the booking under **My Lessons** and may update status via `PATCH /bookings/{id}/status`.
+11. The confirmation is a **dismissible notice above the calendar**, not a screen of its own. The calendar is reloaded first — so the slot just taken is gone and the upcoming-lessons panel is current — and the notice is shown over it. Booking again therefore needs no page reload. The notice clears when it is dismissed, when another slot's booking form is opened, and on any reload of the calendar. `group-classes.js` does the same for enrolments.
+12. The booking page also shows the student their upcoming lessons (`GET /bookings`) — each with the booked offering's name and length, when it happens, a per-lesson status badge (pending payment / confirmed), and a **Cancel** button. Only the soonest five are shown; a **Show all** control reveals the rest. `GET /bookings` includes `offering_title` and `duration_minutes` for each lesson so the list needs no extra request.
 
 ## Lesson-Type Filter
 Not every open slot can be booked as every private-lesson type — a slot tied to
@@ -80,6 +83,103 @@ availability or the offering catalog, and a booking-only embed never requests
 `GET /bookings`. An unrecognised value renders the whole page, so a typo cannot
 silently hide half of it.
 
+## Booking For A Student (Admin)
+A guardian can book for their children, but nobody else can book for anyone —
+which leaves the studio unable to take a booking over the phone, and an
+instructor unable to slot in a make-up lesson. **Book a lesson for a student**,
+a collapsed panel at the top of both **Scheduler** and **My Lessons**, is the
+private-lesson counterpart to the group class's **Add students directly**.
+
+Pick the student, an open time, and (for a general time) the lesson type; tick
+**Reserve this time weekly** for a term, **No charge** for a make-up or goodwill
+lesson. The times offered are the open slots of the next eight weeks — every
+instructor's on the studio **Scheduler**, only the instructor's own on **My
+Lessons**, which `AdminBooking::book()` re-checks rather than trusting the
+posted slot id. The result is reported as a notice above the panel saying what
+was booked and what it left owing; a refusal reopens the panel with the reason
+and every field as it was submitted, so only the mistake needs correcting. A
+booking that succeeds clears the form, so the next one does not inherit it.
+
+It is the same booking a student makes — `LessonBooker` claims the slot(s),
+writes the lesson row(s), and raises the payment exactly as `POST /bookings`
+does — and differs in four deliberate ways:
+
+1. **No intake answers or policy acceptances are recorded at booking time.**
+   Those are the student's to give; staff ticking the boxes for them would be an
+   audit trail that says something untrue. They can instead be collected some
+   other way and recorded afterwards — see **Recording Intake Collected
+   Elsewhere**.
+2. **It is not bounded by what the student could book themselves**, the way a
+   direct group-class enrolment bypasses the enrolment deadline.
+3. **It can be booked at no charge** — no payment at all, and the lesson (or
+   whole series) is `confirmed` at once. Without the tick a pending payment is
+   raised at the lesson type's price, per-occurrence for a weekly reservation,
+   and the lesson confirms when it settles like any other.
+4. **It can book for a student who cannot book at all.** The guard is
+   `Auth\RoleManager::isStudent()` — the student *role*, not the `book_lesson`
+   capability — so it covers a guardian's child and a self-signup still awaiting
+   approval alike, and is shared with the group-class **Add students directly**
+   and **Make available** controls so the two paths cannot drift. Both hold the role;
+   both have `book_lesson` withheld (`Guardian\ChildLoginGate`,
+   `Auth\RegistrationLoginGate`) so that neither can book in their own name.
+   That restriction is on them, not on the studio acting for them — and for a
+   child, whose account is never signed in to, it is the only route to a lesson
+   besides their guardian's. The picker and the guard therefore accept exactly
+   the same set, so nothing offered in the panel can be refused as ineligible.
+
+A weekly reservation needs a time that actually repeats: asked for one on a
+one-off slot, the form refuses (`not_weekly`) rather than quietly booking a
+single lesson, since the person booking asked for a term and would otherwise
+find out from the roster.
+
+## Recording Intake Collected Elsewhere
+A lesson the studio booked has no intake answers and no policy acceptances,
+because nobody was at a keyboard to give them. The studio collects them another
+way — a paper form at the first lesson, a phone call — and records them
+afterwards from the lesson's **detail page**: a **Record intake collected
+elsewhere** panel below the two audit tables.
+
+**Only a staff-booked lesson has the panel** (`Lesson::isStaffRegistered()`, i.e.
+`booked_by > 0`). A lesson the student booked already carries their own answers,
+and letting staff add to them would make the record editable after the fact. The
+same instructor/studio scoping as the rest of the detail page applies: an
+instructor may only open their own lessons, the studio **Scheduler** any.
+
+The panel offers **only what is still missing** — questions with no answer,
+current policy versions with no acceptance — and narrows the submission to that
+set again before writing, so a stale or double-posted form can neither duplicate
+a row nor overwrite one. Nothing is compulsory except the provenance: a studio
+holding half the answers records the half it has and comes back for the rest.
+
+### How they were collected
+Every recording must say **how** the answers reached the studio — on a signed
+paper form, in person, over the phone, by email, or some other way (which must be
+explained in the accompanying note). The method and note are stamped on every row
+the recording writes, alongside **who typed it in**, and both audit tables carry a
+**How it was given** column reading either "Given online when booking" or, say,
+"On a signed paper form — Filed in the studio binder — recorded by Jane Doe".
+
+That column is the point of the feature. "Accepted on 24 Aug" means one thing
+when a student ticked a box and quite another when a staff member transcribed it,
+and an audit trail that cannot tell them apart is worse than none, because it
+looks like one.
+
+Two details keep the record honest:
+
+- **No IP address is stored.** The student was never at a browser; borrowing the
+  staff member's would put a false location in the trail.
+- **The acceptance stays in the student's name** (`accepted_by`) — they did agree,
+  on paper or over the phone. `recorded_by` is who entered it, which is a
+  different question and gets a different column.
+
+A weekly reservation is answered for once, so a recording made against any
+occurrence lands on the series anchor (`Lesson::intakeRegistrationId()`) and
+shows on every occurrence — the same rule the display side already follows.
+
+The whole mechanism is shared with group-class enrolments, which have the same
+gap for the same reason; see **Recording Intake Collected Elsewhere** in
+`group-classes.md`.
+
 ## Cancellation
 Students cancel their own lessons via `POST /bookings/{id}/cancel` (idempotent).
 Cancelling marks the lesson `cancelled`, frees the availability slot for
@@ -124,12 +224,20 @@ active `private_lesson` offerings whose `duration_minutes` matches the slot.
 for students; the instructor's for callers with `manage_availability`), each
 with the slot's `start_dt`/`end_dt`.
 
+It also returns **upcoming group-class sessions**, sorted in among the lessons by
+start time (`GroupClass\SessionSchedule`). A student gets every remaining session
+of every class they are enrolled in; an instructor gets every session of the
+classes they teach. These rows carry `kind: "group_class"` — a session is a date
+in a term rather than a booked slot, so `booking.js` labels it and gives it no
+Cancel button. Lesson rows carry no `kind`, and that absence is what marks them
+cancellable.
+
 Group classes follow the same registration flow but enrol against an offering of
 kind `group_class`; see `group-classes.md`.
 
 ## Admin Interface
-- **Scheduler** (`view_all_lessons` — studio admin / administrators): all upcoming lessons across all instructors
-- **My Lessons** (`view_own_lessons`): upcoming lessons for the logged-in instructor. Hidden for users who also hold `view_all_lessons` — Scheduler is a superset, so the menu item would only duplicate it.
+- **Scheduler** (`view_all_lessons` — studio admin / administrators): all upcoming lessons across all instructors, plus the **Book a lesson for a student** panel (see below), which reaches every instructor's open times
+- **My Lessons** (`view_own_lessons`): upcoming lessons — and upcoming sessions of the instructor's own group classes — for the logged-in instructor, plus the same **Book a lesson for a student** panel scoped to their own open times. Hidden for users who also hold `view_all_lessons` — Scheduler is a superset, so the menu item would only duplicate it.
 
 Both pages open in a **Week** calendar view by default (`usc_view`/`usc_week`
 query params, same pattern as the availability page, bucketed via
@@ -147,12 +255,17 @@ instructor may only open their own lessons; the studio **Scheduler** may open an
 
 ## Implementation
 - Repository: `Unsupervised\Schedular\Booking\BookingRepository` (`insertSeries()` builds a weekly series sharing a `series_id`)
+- Booking core: `Unsupervised\Schedular\Booking\LessonBooker` — `resolveOffering()` (which offering a slot may be booked as), `reserve()` (claim the slot(s), write the lesson row(s)), `settle()` (raise the payment, or confirm when nothing is owed). Shared by `BookingEndpoint` and `AdminBooking` so the two paths cannot drift on price, payment routing, or double-booking.
+- Admin booking: `Unsupervised\Schedular\Booking\AdminBooking` — `book()` (guards, then the booker) and `formData()` (the panel's student / time / lesson-type choices)
+- Late intake: `Unsupervised\Schedular\Registration\IntakeRecording` — `pending()` (what is still unrecorded) and `record()` (the staff-registered guard, the dedup, then `RegistrationGate::record()` with an `IntakeProvenance`). Generic over `Registration\IntakeSubject`, which `Booking\Lesson` and `GroupClass\Enrollment` both implement
+- Provenance: `Unsupervised\Schedular\Registration\IntakeProvenance` — the collection-method vocabulary, its validation, and how a stored row reads on screen. Persisted as `collected_via` / `collected_note` / `recorded_by` on both `us_question_answers` and `us_policy_acceptances`; all null/0 for anything given online.
 - Model: `Unsupervised\Schedular\Booking\Lesson`
 - Registration gate: `Unsupervised\Schedular\Registration\RegistrationGate` — validates and records intake answers + booking-scoped policy acceptances; shared with group enrolment
 - Admin controller: `Unsupervised\Schedular\Booking\LessonController`
-- Admin lesson detail presenter: `Unsupervised\Schedular\Booking\LessonDetail` (per-lesson intake answers + policy acceptances), template `templates/admin/lesson-detail.php`
+- Admin lesson detail presenter: `Unsupervised\Schedular\Registration\IntakeAudit` (a registration's intake answers + policy acceptances), template `templates/admin/lesson-detail.php`. Shared with the group-class enrolment detail view. A weekly series is answered for and agreed to once, against the anchor lesson, so `Lesson::intakeRegistrationId()` reads `series_id ?? id` — every occurrence shows the same intake and audit trail, not just the first.
 - REST endpoint: `Unsupervised\Schedular\Booking\BookingEndpoint`
 - Frontend: `Unsupervised\Schedular\Booking\BookingPage`, `Unsupervised\Schedular\Auth\LoginPage`
+- Upcoming-lessons panel: rendered client-side into `#us-my-lessons` by `assets/js/booking.js` (`lessonRowHtml`/`renderMyLessons`), mirrored for the editor by `BlockPreview::upcomingLessons()` — keep the two markup shapes in step.
 
 > **Payment seam:** a priced booking is created with `status = pending` and its
 > payment linked via `payment_id`; the lesson is confirmed when the payment is
@@ -160,10 +273,28 @@ instructor may only open their own lessons; the studio **Scheduler** may open an
 > Unpriced bookings skip the seam entirely and are confirmed at creation.
 > `GET /policies?scope=booking` returns just the booking-gate policies the form
 > must collect.
+>
+> **Frontend CSS scoping:** every rule for the booking page's own markup is
+> written under `#us-booking-app` (`assets/css/frontend.css`). These panels sit
+> inside whatever layout the active theme provides, and bare class selectors lose
+> to theme rules on `div`/`span`/`strong` — which flattens the flex layout and
+> renders the lesson details on top of the actions. The row's two columns are
+> `div`s for the same reason: the layout must not depend on overriding the
+> inline default. New booking-page rules should follow both conventions.
 
 ## Tests
+- `tests/Unit/Booking/AdminBookingTest.php`
+- `tests/Unit/Registration/IntakeRecordingTest.php`, `tests/Unit/Registration/IntakeAuditTest.php`
 - `tests/Unit/Booking/BookingRepositoryTest.php`
 - `tests/Unit/Booking/LessonTest.php`
 - `tests/Unit/Booking/LessonControllerTest.php`
-- `tests/Unit/Booking/LessonDetailTest.php`
 - `tests/Unit/Booking/BookingEndpointTest.php`
+
+## Booking For Someone Else
+A guardian books for their children from their own account. `POST /bookings`
+accepts an optional **`student_id`**, honoured only when
+`Guardian\GuardianService::canActFor()` confirms the caller is that student's
+guardian — anything else is a `403`. The booking form's "Who is this for?" picker
+lists **children first**, so the default selection is never the parent.
+`GET /bookings` returns the whole household, and a guardian may cancel any of
+their children's lessons. See `parent-guardian-accounts.md`.

docs/features/offerings.md

@@ -33,7 +33,12 @@ An offering is anything a student can register for: a private-lesson type (30 or
 - `one_time` — charged once at booking (a single private lesson).
 - `full_term` — charged in full upfront at registration (a weekly private reservation or a year-long group class). See `payments.md`.
 - `weekly` — **not** charged at registration; a pending payment for one lesson's fee is generated **24 hours before each lesson** by the daily billing scan.
-- `monthly` — **not** charged at registration; on the **1st of each month** a single pending payment is generated for every lesson that falls in that month (4 lessons ⇒ 4 × fee).
+- `monthly` — **not** charged at registration; on the **1st of each month** a single pending payment is generated for that month. A **private lesson**'s price is a per-lesson fee, so the month is billed (#lessons in the month) × fee; a **group class**'s price is the monthly fee itself, billed once for the month however many times the class meets in it.
+
+Students see the mode as a **cadence** beside every price on the front end — *at
+booking*, *up front*, *weekly*, *monthly* — and confirm it explicitly before a
+booking or enrolment goes through. See **Price Display and the Pay Agreement** in
+`payments.md`.
 
 `weekly` and `monthly` are *scheduled* billing (`Offering::isScheduledBilling()`): the
 booking/enrolment succeeds with no payment step, and payments are created later by the

docs/features/parent-guardian-accounts.md

@@ -0,0 +1,452 @@
+# Feature: Parent/Guardian Accounts
+
+## Overview
+A parent or guardian registers **once** and manages lessons for **one or more
+children**, without each child needing their own login. The guardian signs in,
+picks which child a booking is for, and pays for all of them from one account.
+
+A guardian may also be a student in their own right — they appear in their own
+"who is this for?" selector alongside their children, so a parent taking lessons
+next to their kids needs only the one account.
+
+## Vocabulary: "child" in the code, "student" in the UI
+
+The interface says **student** and **profile**; the code says **child** and
+**family**. This is deliberate, not drift. Every identifier below — the
+`us_guardian_links` columns, `GuardianService::createChild()`, the `children[]`
+request parameters, the `child_name` form fields, the `us-scheduler/family`
+block name and the `[us_family]` shortcode — is a stable contract with the
+database, saved post content and existing installs, so renaming them would break
+sites for no user-visible gain. Only the strings a person reads were changed.
+
+When adding to this feature, keep the split: internal names follow the
+data model, translatable strings follow the interface.
+
+## Core Decision: children are accountless WordPress users
+
+Every `student_id` column in `src/Schema.php` (`us_lessons`, `us_payments`,
+`us_credits`, `us_group_enrollments`, `us_question_answers`,
+`us_policy_acceptances`, `us_group_access`) is a `wp_users` id, and booking,
+billing, credits, policies and registration answers all resolve it directly.
+
+Rather than change what `student_id` means, **a child is a real `wp_users` row**
+with the `us_student` role, created without a usable login:
+
+- no password (`wp_generate_password()` is used and discarded — nothing is ever
+  emailed, so it cannot be guessed into a session),
+- no real email address; a child gets a placeholder login on the RFC 2606
+  reserved `.invalid` TLD (`us-child-<random>@child.invalid`, see
+  `GuardianService::childEmail()`) — a well-formed address that can never
+  resolve, so nothing about a child's account can be emailed somewhere real,
+- the `us_child` user meta flag set to `1`, which
+  `Guardian\ChildLoginGate` uses to block authentication outright.
+
+Consequences:
+
+- `us_lessons`, `us_group_enrollments`, `us_question_answers` and
+  `us_group_access` are **unchanged** — a child books like any other student.
+- A child can be promoted to their own login later by setting a password and a
+  real email and clearing `us_child`; no data migrates.
+- A `us_guardians` link table maps guardian → child.
+
+The alternative — a standalone `us_students` table decoupled from `wp_users` —
+was rejected for v1: it changes the meaning of `student_id` on seven tables and
+requires migrating every existing row.
+
+## Data Model — `{prefix}us_guardians`
+
+| Column         | Type            | Notes                                                     |
+|----------------|-----------------|-----------------------------------------------------------|
+| `id`           | BIGINT UNSIGNED | Primary key                                               |
+| `guardian_id`  | BIGINT UNSIGNED | WordPress user ID of the parent/guardian                  |
+| `student_id`   | BIGINT UNSIGNED | WordPress user ID of the child                            |
+| `relationship` | VARCHAR(50)     | Free text shown in admin (e.g. "Parent", "Grandparent"); may be empty |
+| `created_at`   | DATETIME        | Insertion time                                            |
+
+`UNIQUE KEY guardian_student (guardian_id, student_id)` — the same pair can
+never be linked twice.
+
+The table is a link table, not a child record: the child's **name** is their
+`display_name` on `wp_users`, and their birth year is the `us_birth_year`
+user meta. Keeping them on the user row means the admin student screens,
+`get_users()` ordering, and every existing `student_id` lookup keep working with
+no special-casing.
+
+### The legacy `us_date_of_birth` meta
+
+This feature originally collected a full date of birth in `us_date_of_birth`.
+Nothing writes that key any more. It is handled entirely inside
+`GuardianService`:
+
+- **Read** — `birthYear()` falls back to the year of the old date when
+  `us_birth_year` is absent, so a child added before the change still shows one
+  without a migration step.
+- **Write** — `setBirthYear()` deletes `us_date_of_birth` on *every* save,
+  including a save that clears the year. Without that the fallback would
+  resurrect the old date on the next read and the year could never be cleared.
+
+The upshot is a lazy migration: a child's full date survives until their record
+is next edited, then goes for good. There is no bulk purge — a site that wants
+the remaining old dates gone should delete the `us_date_of_birth` meta directly.
+
+v1 is deliberately **one guardian per child**: `GuardianRepository::insert()`
+refuses to link a child that already has a guardian. The unique key and the
+guardian-side lookups already support many-to-many, so adding a second guardian
+(separated parents) later is an insert, not a migration.
+
+## Schema changes to existing tables
+
+| Table | Change | Why |
+|---|---|---|
+| `us_payments` | `payer_id BIGINT UNSIGNED NOT NULL DEFAULT 0` + `KEY payer_id` | Who owes the money, when that is not the student |
+| `us_credits` | `payer_id BIGINT UNSIGNED NOT NULL DEFAULT 0` + `KEY payer_id` | Which account holds the balance |
+| `us_policy_acceptances` | `accepted_by BIGINT UNSIGNED NOT NULL DEFAULT 0` | Who actually clicked, when that is not the student |
+
+All three default to `0`, read back as "same as `student_id`" (see
+`Payment::payerOrStudent()`, `Credit::payerOrStudent()`,
+`PolicyAcceptance::acceptorOrStudent()`), so **an existing row keeps its current
+meaning whatever happens** — a pre-guardian payment is still owed by, and was
+still accepted by, the student it names.
+
+The installer additionally backfills them (`PaymentRepository::backfillPayerIds()`,
+`CreditRepository::backfillPayerIds()`, `AcceptanceRepository::backfillAcceptedBy()`,
+run from `Installer::migrateData()`), because the *balance* lookups key on
+`payer_id` directly and an indexed `WHERE payer_id = 5` would not see a legacy row
+still holding `0`. The backfill is idempotent — it only touches rows still at `0` —
+and the `payerOrStudent()` fallbacks remain as the belt to its braces.
+
+## Billing: the guardian is the payer, the child is the subject
+
+- `us_payments.student_id` keeps naming **the child the lesson was for**, so
+  per-child payment reporting is unchanged.
+- `us_payments.payer_id` names **the guardian who owes it**. Payment notices,
+  receipts and the Stripe intent all resolve the payer.
+- `us_credits.payer_id` is where a **family balance** lives. A credit from one
+  child's cancelled lesson is held by the guardian and can settle a sibling's
+  charge; `CreditRepository::availableBalance()` and `consume()` operate on the
+  payer.
+- The **billing-method override** (`comp` / `card` / `etransfer`, user meta read
+  by `BillingMethodResolver`) resolves against the payer, so comping a family is
+  one setting on the guardian rather than one per child.
+
+`PaymentService::createForRegistration()` takes the payer id alongside the
+student id; `BookingEndpoint` and `ScheduledBillingRunner` both pass
+`GuardianService::payerFor( $studentId )` — the child's guardian when they have
+one, otherwise the student themselves.
+
+Family discounts are **out of scope** for v1 but are not designed out: with the
+payer on both the payment and the credit ledger, a discount rule has a family to
+apply to.
+
+## Registration
+
+A **"Who are you registering?"** choice on the existing `[us_student_register]`
+form (all three signup paths — personal invite, group link, self-approval), as
+three radios:
+
+| Choice | `us_registering_for` | Student blocks | Account holder is a student | Answers the studio's questions |
+|---|---|---|---|---|
+| Just myself | `self` | no | yes | for themselves |
+| On behalf of one or more students | `students` | yes | **no** | per student only |
+| Both — myself and one or more students | `both` | yes | yes | **per student *and* for themselves** |
+
+The last column follows from the third, and is the whole of it: the
+account-scope questions describe a *student* — instrument, level, school — so
+they are asked of everyone being registered as one. Under `both` that is each
+student **and** the account holder, whose answers are stored against their own
+user id, not shared with anyone. Under `students` the account holder is not a
+student, so anything posted for them is ignored outright.
+
+Required answers are checked in two passes rather than one, so the error can say
+whose are missing: `both` would otherwise have to blame "each student" for the
+account holder's own blank field.
+
+Radios rather than checkboxes because the three answers are mutually exclusive:
+"both" only means anything as a third choice alongside the other two. Either
+student-bearing choice requires at least one student name.
+
+Anything unrecognised — a form posted without the field, an old cached page, a
+crafted request — is read as `self`, the choice that collects the least and
+grants the least. A missing radio must never be taken as "register these
+children".
+
+### The account holder as a student
+
+This replaced a single "I'm registering as a parent or guardian" checkbox, which
+could only say *whether there were children to add*. It could not say whether the
+**account holder** was a student, so `bookableStudents()` always offered them
+their own name and every guardian could book themselves a lesson nobody intended
+to sell.
+
+`students` now records `us_guardian_only = 1` and `bookableStudents()` leaves the
+account holder out. The flag is stored as the **negative** deliberately: every
+account predating the choice is a bookable student, and absence has to keep
+meaning exactly that, or the picker would silently stop offering people
+themselves on upgrade. `GuardianService::setGuardianOnly()` clears the key rather
+than writing `0`, so "not set" stays the one spelling of "yes, a student".
+
+One guard: a guardian-only account with **nobody linked to it** is still offered
+itself, because an empty picker is no way to book at all. They can put the
+account right from the profile page — see **Your details** below, where the flag
+is editable as "I take lessons myself".
+
+Per child the form collects:
+- **Name** (required)
+- **Birth year** (required, `us_birth_year` meta) — a four-digit year between
+  1900 and the current year. `GuardianService::normaliseBirthYear()` is the one
+  definition of what counts, shared by the signup form's up-front validation and
+  by `createChild()`/`updateChild()` themselves, so a bad year is refused rather
+  than quietly discarded and a typo cannot leave a nonsense age on the record.
+- **Every account-scope registration question** (`Registration\Question`,
+  `SCOPE_ACCOUNT`) — asked once per child, not once per guardian, because in
+  practice they describe the student (instrument, level, school). The guardian
+  answers them on the child's behalf; the answer row's `student_id` is the child.
+
+### What the account holder gives when they are a student
+
+Under `self` and `both` the account holder is a student too, so the **About you**
+panel asks them for exactly the same two things every other student gives: their
+**birth year** (`us_birth_year`, the same meta key and the same
+`normaliseBirthYear()` rule — `GuardianService::setBirthYear()` writes both cases)
+and the **account-scope questions**. Both are stored against their own user id.
+
+The panel sits on the main form, above the students, rather than behind a "Next".
+The questions used to be a second step, which put what the studio needs to know
+about an adult student on a screen they reached only after everything else; now
+one page holds one decision each — who you are registering, about you, about
+them.
+
+`register.js` takes the whole **About you** fieldset out of play under
+`students`, by `disabled` as well as `hidden`: a disabled fieldset is neither
+validated nor submitted, so a `required` field cannot block a form on a control
+nobody can reach. The students block is toggled the same way, and the server
+enforces both rules regardless — which is what makes them hold with JavaScript
+off. The profile screen has no such problem: its forms are always visible, so the
+attribute is static there.
+
+Name and birth year are marked required in the labels the same way a required
+question is; `[data-us-child-required]` keeps the attribute on the child fields
+in step with the block they live in.
+
+Order of operations in `RegistrationPage::handleSubmit()`:
+
+1. Validate the account holder's own fields (email, password, policies, and —
+   when they are a student — their birth year and answers).
+2. Validate **every** child block — a missing name, a missing or unusable birth
+   year, or a missing required per-child answer fails the whole submission
+   **before** any user is created, so a half-registered family is never left
+   behind. An **entirely empty** block is dropped instead, because the form
+   always renders one spare for "add another"; a block with anything at all
+   typed into it is kept and reported on, rather than silently discarding what
+   the guardian entered.
+3. Create the guardian user, and record `us_guardian_only` and (when they are a
+   student) their birth year against it.
+4. For each child: create the accountless user, link it, record its answers, and
+   record the signup policy acceptances **against the child** with
+   `accepted_by = <guardian>`.
+5. Roll back — every child user created so far is deleted and the guardian user
+   with them — if any child creation fails, so a partial family never persists.
+
+A guardian who does not tick the box registers exactly as before; nothing about
+the single-student flow changes.
+
+### Policy acceptance
+
+`us_policy_acceptances` records **one row per child** for each signup-scoped
+policy, with:
+
+- `student_id` = the child (who the policy binds),
+- `accepted_by` = the guardian (who actually agreed),
+- `registration_type = 'account'`, `registration_id` = the child's user ID.
+
+The guardian also gets their own acceptance row (`student_id = accepted_by =
+guardian`) whether or not they book for themselves — they agreed to the terms as
+an account holder. This is the legally meaningful record: "guardian X accepted
+policy version N on behalf of child Y at time T from IP Z".
+
+Booking-scope policies are accepted at booking time by whoever is signed in;
+`BookingEndpoint` passes the same `accepted_by` when a guardian books for a
+child.
+
+## Managing the account
+
+### Your details
+
+The profile screen opens with the account holder's own record, because the
+alternative was a page called **Your profile** on which the one person who could
+not be edited was you. The form saves through
+`GuardianService::updateSelf()` and holds:
+
+- **Your name** — `display_name` and `nickname`, written together for the reason
+  `updateChild()` does: `UserName` reads the nickname first, and leaving it
+  behind would put the account's email address back on every screen that names a
+  person.
+- **I take lessons myself** — the positive of `us_guardian_only`, so the form
+  asks the question the way a person answers it and `updateSelf()` is the one
+  place the sense is flipped. This is what makes good on "they can put the
+  account right from the profile page": an account that registered as a pure
+  guardian and later took up lessons — or ticked the wrong radio at signup — can
+  now correct itself instead of asking the studio to.
+- **Your birth year** — `us_birth_year`, the same meta and the same
+  `normaliseBirthYear()` rule every student is held to.
+
+Two decisions worth keeping:
+
+- The birth-year field carries **no `required` attribute**. It is asked of a
+  student only, and the family screen loads no JavaScript, so a browser-enforced
+  `required` would leave a guardian who books solely for other people unable to
+  submit the form at all. `FamilyPage::handleSelf()` enforces it against the
+  checkbox instead, which is where the condition actually lives.
+- Unticking **I take lessons myself** does **not** clear a stored birth year.
+  The box says who books, not "forget what you know about me", and someone who
+  ticks it back on the next visit should find their details as they left them.
+
+The **email** is shown but not editable: it is the account's `user_login` as
+well as its address, so changing it is a studio-side job rather than a
+profile-screen one.
+
+The account-scope questions are not re-asked here, in either direction — the
+child rows do not offer them on edit either, and a studio that needs a newly
+self-declared student's answers asks for them the same way it would for any
+other change of circumstance.
+
+### Managing children
+
+The rest of `[us_family]` (block: **Profile**) is the manage-children screen:
+list the children, add one, edit a name/birth year, remove one.
+
+- **Add** creates another accountless child user and links it. Account-scope
+  questions are asked here too, so a child added later carries the same
+  information as one added at signup.
+- **Edit** updates `display_name` and `us_birth_year`.
+- **Remove** unlinks the child and **deletes the child user**, but only when the
+  child has no lessons and no enrolments — a child with history is refused, so
+  removing one can never orphan a lesson, payment or credit
+  (`GuardianService::removeChild()`). The guardian is told to contact the studio
+  instead.
+
+Submissions are processed on `template_redirect` (like registration) and
+post/redirect/get back to the page, so a refresh cannot resubmit.
+
+## Booking
+
+`GET /bookings` returns the lessons of the signed-in user **and of every child
+they are guardian for**, each row carrying `student_id` and `student_name` so
+the list can be grouped by child.
+
+`POST /bookings` takes an optional **`student_id`**:
+
+- absent or `0` → the current user books for themselves (unchanged),
+- a child's id → the endpoint verifies with `GuardianService::canActFor()` that
+  the current user is that child's guardian, and returns `403 forbidden` when
+  they are not. **This is the authorisation boundary of the feature**: without
+  it any student could book, and bill, against any user id they cared to send.
+
+The booking form gains a "Who is this for?" `<select>`, rendered only when the
+account has more than one person on it, so a single-student account's form is
+unchanged.
+
+**Children are listed first and the account holder last**
+(`GuardianService::bookableStudents()`). The order is the whole point: a
+guardian's normal case is booking for a child, so the default selection — the
+one a parent gets by not touching the picker at all — is a child, never
+themselves. Booking for the wrong child is a correctable inconvenience; silently
+billing a parent's account for a lesson meant for their kid is the error worth
+designing out. The guardian is still offered, last, so a parent taking lessons
+alongside their children can book for themselves.
+
+The list is rendered server-side into `data-students` on the page wrapper and
+read by `assets/js/guardian.js`, which both the booking and group-class scripts
+share.
+
+`POST /bookings/<id>/cancel` accepts a cancellation from the lesson's student
+**or** their guardian, subject to the same cancellation cutoff.
+
+## Group classes
+
+`POST /enrollments` carries the same optional `student_id` and the same
+`canActFor()` check, `GET /enrollments` covers the household, and
+`POST /enrollments/<id>/withdraw` accepts the guardian — group enrolment is the
+other place a family books and pays, so it gets the identical treatment rather
+than being left as a single-student-only path.
+
+## Admin
+
+- **Students list** gains a **Profile** column: a child links to its
+  guardian's detail screen, a guardian lists its children as links. Children are
+  listed alongside every other student rather than nested, so nothing about
+  finding a student changes.
+- **Student detail** gains a **Profile** panel — the guardian (for a child) or
+  the children (for a guardian), each a link to the other's screen — and the
+  credit balance shown is the **payer's** balance, labelled with whose it is, so
+  an admin looking at a child sees the family balance that will actually settle
+  their charges rather than an empty per-child one.
+- Registration answers and policy acceptances on a child's screen show
+  "accepted by <guardian>" where the acceptor differs from the student.
+
+Creating or attaching a child from wp-admin is **out of scope** for v1; a studio
+admin adds children through the guardian's own family screen or asks the
+guardian to.
+
+## Capabilities
+
+No new capability. A child user holds the `us_student` role (so every existing
+`student_id` capability check keeps working) but can never sign in
+(`Guardian\ChildLoginGate` blocks `wp_authenticate_user` and forces
+`user_has_cap` to withhold `book_lesson` from a child), so the role grants them
+nothing in practice. Guardians act for children through
+`GuardianService::canActFor()`, checked at every REST and form boundary, rather
+than through a capability.
+
+## Instructor view
+
+Lesson lists show the student's name. Where that student is a child, the
+instructor also sees the guardian's name and email — the contact they actually
+need — via `GuardianService::contactFor()`.
+
+## Implementation
+
+- Models: `Unsupervised\Schedular\Guardian\GuardianLink`
+- Repository: `Unsupervised\Schedular\Guardian\GuardianRepository`
+- Service: `Unsupervised\Schedular\Guardian\GuardianService` (child creation,
+  `canActFor()`, `payerFor()`, `contactFor()`, removal rules, and the account
+  holder's own record via `accountHolder()`/`updateSelf()`)
+- Login block: `Unsupervised\Schedular\Guardian\ChildLoginGate`
+- Frontend: `Unsupervised\Schedular\Guardian\FamilyPage` (`[us_family]`)
+- Shared question field: `Unsupervised\Schedular\Registration\QuestionField`
+  (one question rendered under a caller-supplied input name, so the same
+  question can appear once per child without colliding)
+- Front-end script: `assets/js/guardian.js` (the shared picker),
+  `assets/js/register.js` (guardian toggle + "add another child")
+- Extended: `Auth\RegistrationPage` (guardian checkbox, child blocks, per-child
+  answers/acceptances, rollback), `Booking\BookingEndpoint` and
+  `GroupClass\EnrollmentEndpoint` (`student_id` param + guardian
+  authorisation, household listings), `Booking\BookingPage`,
+  `GroupClass\GroupClassPage`, `Payment\PaymentService`,
+  `Payment\PaymentRepository`, `Payment\CreditRepository`,
+  `Payment\ScheduledBillingRunner` (one notice per payer),
+  `Policy\AcceptanceRepository`, `Registration\RegistrationGate`,
+  `Auth\StudentController`, `Installer` (backfills)
+- Schema: `us_guardians`; `us_payments.payer_id`; `us_credits.payer_id`;
+  `us_policy_acceptances.accepted_by`
+
+## Tests
+
+- `tests/Unit/Guardian/GuardianLinkTest.php`
+- `tests/Unit/Guardian/GuardianRepositoryTest.php`
+- `tests/Unit/Guardian/GuardianServiceTest.php`
+- `tests/Unit/Guardian/ChildLoginGateTest.php`
+- `tests/Unit/Guardian/FamilyPageTest.php`
+- `tests/Unit/Auth/RegistrationPageTest.php` (guardian signup path)
+- `tests/Unit/Booking/BookingEndpointTest.php` and
+  `tests/Unit/GroupClass/EnrollmentEndpointTest.php` (booking/enrolling for a
+  child, and the 403 when the caller is not the guardian)
+- `tests/Unit/Booking/BookingPageTest.php` (children lead the embedded list)
+- `tests/Unit/Payment/PaymentServiceTest.php`, `CreditRepositoryTest.php`,
+  `ScheduledBillingRunnerTest.php` (payer, family balance, one notice)
+
+## Related
+
+`account-registration.md`, `lesson-booking.md`, `payments.md`, `credits.md`,
+`group-classes.md`, `student-administration.md`, `policies.md`,
+`registration-questions.md`.

docs/features/payments.md

@@ -34,6 +34,15 @@ page (`manage_billing`, studio admin only):
 | `us_currency`                | Default ISO 4217 currency, e.g. `CAD`  |
 | `us_etransfer_email`         | Studio-default e-transfer destination  |
 | `us_hst_rate`                | Default HST/tax percentage, e.g. `13`  |
+| `us_default_payment_method`  | Studio-default billing method (`card` \| `etransfer`) |
+
+Secrets are write-only in the form: a stored secret is never echoed back, and a
+blank field keeps it. To disconnect Stripe entirely, **Clear Stripe
+configuration** (shown once any Stripe value is stored) deletes the publishable
+key, secret key and webhook secret and drops the mode back to `test`
+(`StudioSettings::clearStripeConfig()`). Currency, HST, e-transfer and
+registration settings are untouched, as are payments already recorded; billing
+falls back to e-transfer until keys are entered again.
 
 ## HST / Tax
 
@@ -52,8 +61,9 @@ total when tax applies.
 ## Per-Student Billing Method
 Each student's billing method is stored in user meta `us_payment_method`, set by the
 studio admin (`Students → student detail → Billing method`). When unset, the studio
-default applies — `card` if Stripe is configured, otherwise `etransfer`
-(`BillingMethodResolver`):
+default applies (`BillingMethodResolver::defaultMethod()`): the
+`us_default_payment_method` option, degraded to `etransfer` whenever Stripe is not
+configured, since a card cannot be charged without keys.
 
 | Method     | Behaviour                                                              |
 |------------|-----------------------------------------------------------------------|
@@ -61,6 +71,22 @@ default applies — `card` if Stripe is configured, otherwise `etransfer`
 | `etransfer`| Payment row created `pending`; admin marks it `paid` when funds arrive |
 | `comp`     | No charge; registration is confirmed immediately, no payment row required |
 
+## Studio Default Billing Method
+**Studio Settings → Billing → Default payment method** (`manage_billing`) chooses
+between `card` and `etransfer` for every student without an override. Card is the
+default, so a studio that adds Stripe keys and changes nothing else behaves as it
+always has.
+
+Setting it to `etransfer` is the **staged rollout** path: Stripe stays live, but
+the studio keeps billing by e-transfer while individual students are switched to
+`card` on their student detail page. Their bookings exercise real Stripe charges
+end to end; once that is proven, flipping the studio default to `card` moves
+everyone at once and the per-student overrides can be cleared.
+
+`comp` is deliberately not offered as a studio default — it is a per-student
+decision, and a studio-wide `comp` would silently stop billing everybody. A stored
+value that is neither `card` nor `etransfer` reads back as `card`.
+
 ## E-transfer Destination Email
 Where students send e-transfers is resolved and **frozen onto the payment** at
 booking time (`us_payments.etransfer_email`), so each record keeps the destination
@@ -98,6 +124,59 @@ After booking, the destination on a payment can be corrected per booking:
 | `created_at`               | DATETIME         | Insertion time                                        |
 | `paid_at`                  | DATETIME         | When marked `paid`; NULL otherwise                    |
 
+## Price Display and the Pay Agreement
+Every price a student is shown on the front end carries its **cadence** — the
+offering's `billing_mode` in the words the student needs:
+
+| `billing_mode` | Shown as                          | Explained beneath as                                       |
+|----------------|-----------------------------------|------------------------------------------------------------|
+| `one_time`     | `at booking`                      | Charged once, when you book.                               |
+| `full_term`    | `up front`                        | Charged once, up front, for the whole term.                |
+| `weekly`       | `weekly`                          | Charged for each lesson, 24 hours before it starts.        |
+| `monthly`      | `per lesson monthly` / `monthly`  | Charged on the 1st of each month, for that month's lessons.|
+
+So a lesson type reads `50.00 CAD at booking` in the booking form's type picker,
+and a group class card reads `120.00 CAD up front`. A free offering shows `Free`.
+
+**`monthly` reads differently per offering kind, because it *bills* differently.**
+A private lesson's price is a per-lesson fee and its monthly charge is that
+month's lessons × the fee, so the fee is quoted **per lesson**
+(`50.00 CAD per lesson monthly`). A monthly group class is priced **per month** —
+`ScheduledBillingRunner::billGroupMonthly()` charges the fee once for the month
+however many times the class meets in it — so its figure is quoted as it stands
+(`120.00 CAD monthly`). The display split is `isPerLessonMonthly()` in
+`assets/js/pricing.js`; the billing split is the one place the monthly rule
+differs between the two kinds.
+
+Before a booking or enrolment can be submitted, the form shows the price again as
+a summary block with a **required agreement checkbox** — the second confirmation,
+distinct from the policy acceptances above it:
+
+> ☐ I agree to pay 56.50 CAD at booking.
+
+The agreed figure is the amount actually billed, so the studio **HST rate** is
+added to it (`usScheduler.taxRate`, localized from `us_hst_rate`) and broken out
+above the checkbox — matching the total `Payment::total()` charges. A comped
+student is not taxed and is not charged at all, so for them the quoted figure is
+an upper bound. A free offering has nothing to agree to and shows no block.
+
+Cadence-specific wording:
+
+- **Weekly reservation of a `one_time` lesson type** — the fee is charged once per
+  week claimed, so the agreement states the per-lesson amount and the total as a
+  ceiling ("up to 12 lessons, 678.00 CAD in total"). The occurrence count mirrors
+  `BookingEndpoint::MAX_WEEKLY_OCCURRENCES`; a slot another student takes first is
+  simply not claimed, so the real charge can come in under it.
+- **`weekly` / `monthly`** — nothing is taken at registration, so the agreement is
+  to the recurring charge: "I agree to pay 56.50 CAD per lesson, billed monthly."
+  A monthly **group class** agrees to its monthly figure instead ("I agree to pay
+  138.00 CAD monthly."), matching how its price is quoted on the card.
+
+All of this lives in `assets/js/pricing.js` (`window.usPricing`), shared by the
+booking and group-class flows so a price reads the same wherever it is met. The
+script is registered as `us-scheduler-pricing` and is a dependency of both
+`us-scheduler` and `us-scheduler-group`.
+
 ## Payment Flow
 1. During registration the front-end calls `POST /payments/intent` — but only when the registration response carried a `payment` summary (unpriced registrations return `payment: null` and skip the payment step). The intent call creates a Stripe PaymentIntent for a `card` student and returns the client secret. (`etransfer` returns a `pending` payment; `comp` returns none.)
 2. The browser confirms the card payment with Stripe.
@@ -139,9 +218,19 @@ See `payment-reporting.md` for the monthly report and CSV export endpoints.
 - Receipts: `Unsupervised\Schedular\Payment\ReceiptMailer`
 - Settings page: `Unsupervised\Schedular\Payment\StudioSettings`
 - REST endpoint: `Unsupervised\Schedular\Payment\PaymentEndpoint`
+- Front-end price display + pay agreement: `assets/js/pricing.js` (`window.usPricing`), registered and localized with `taxRate` by `Unsupervised\Schedular\ShortcodeRegistrar`
 
 ## Tests
+- `tests/Unit/ShortcodeRegistrarTest.php` (pricing helper registration + localized `taxRate`)
 - `tests/Unit/Payment/PaymentRepositoryTest.php`
 - `tests/Unit/Payment/PaymentTest.php`
 - `tests/Unit/Payment/StripeGatewayTest.php`
 - `tests/Unit/Payment/ReceiptMailerTest.php`
+
+## Who Pays
+`us_payments.student_id` names the student the charge is *for*;
+`us_payments.payer_id` names who **owes** it — a child's guardian, or 0 meaning
+the student pays for themselves (`Payment::payerOrStudent()`). The billing
+method, receipts, payment notices and the Stripe payment step all resolve the
+payer, so a family is billed and comped as one account while per-child reporting
+is unchanged. See `parent-guardian-accounts.md`.

docs/features/plugin-self-update.md

@@ -47,9 +47,21 @@ update for a same-slug plugin and makes core fire the
    `us_schedular_latest_release` transient for 6 hours.
 3. Strips the leading `v` from the tag and compares against `USC_VERSION`
    with `version_compare`; PHP orders `1.0.0-rc.2 < 1.0.0` correctly.
-4. When newer, returns the release's first `.zip` asset as the update
-   package. Core takes over from there: Plugins-screen notice, one-click
-   update, and WP-Cron auto-updates if enabled.
+4. When newer, returns the release's first `.zip` asset **whose download URL
+   is `https` on `git.unsupervised.ca` itself** as the update package. Core
+   takes over from there: Plugins-screen notice, one-click update, and
+   WP-Cron auto-updates if enabled.
+
+   The host check is not ceremony. Whatever this returns is downloaded and
+   unpacked over the installed plugin, so the URL is executable code by
+   another name — and it arrives in a JSON body. An answer that is not really
+   the release server's (a hijacked hostname, a tampered response, a repo host
+   handing out a package hosted somewhere else) would otherwise install
+   arbitrary code on every site running the plugin, silently for anyone with
+   auto-updates on. The host must match exactly: `evil-git.unsupervised.ca`,
+   `git.unsupervised.ca.evil.test` and `cdn.git.unsupervised.ca` are all
+   refused, and so is plain `http`. An asset that fails the check is skipped
+   and the scan continues, so one bad asset does not hide a good one.
 5. When not newer — the site is current, or the lookup failed — returns a
    `no_update` payload (installed version, empty package). This keeps the
    plugin in core's `update_plugins` transient so core's `update-supported`

docs/features/policies.md

@@ -36,18 +36,30 @@ The studio admin drafts, versions, and publishes policies (e.g. cancellation, pa
 | `registration_type` | VARCHAR(20)      | `lesson` or `enrollment`                              |
 | `registration_id`   | BIGINT UNSIGNED  | FK → `us_lessons.id` or `us_group_enrollments.id`     |
 | `accepted_at`       | DATETIME         | Timestamp of acceptance                              |
-| `ip_address`        | VARCHAR(45)      | IP captured at acceptance (audit trail)              |
+| `ip_address`        | VARCHAR(45)      | IP captured at acceptance (audit trail); NULL when not given online |
+| `collected_via`     | VARCHAR(20)      | How the acceptance reached the studio when it was not given online (`paper` / `in_person` / `phone` / `email` / `other`); NULL means online |
+| `collected_note`    | VARCHAR(191)     | Free-text detail for the above; required for `other` |
+| `recorded_by`       | BIGINT UNSIGNED  | Staff member who typed a collected-elsewhere acceptance in; 0 otherwise |
 
 ## Versioning & Acceptance Rules
 - Editing a published policy creates a new `draft` version; the old version stays `published` until the draft is published.
+- Editing a `draft` version rewrites it in place — nobody has accepted it yet, so there is nothing to preserve and no new version is created. `PATCH /policies/{id}/versions/{vid}` allows only this case; the admin page also accepts an edit to a `published` or `archived` version and branches a new draft from it.
 - Publishing a draft sets it `published`, stamps `published_at`, archives the prior version, and points `us_policies.current_version_id` at it.
 - The registration gate requires acceptance of the `current_version_id` of every policy. Because acceptance is tied to `policy_version_id`, a newly published version is unaccepted and must be re-accepted at the student's next booking.
 
 ## Admin Interface
 **Policies** in wp-admin (`manage_policies`, studio admin only):
-- Create a policy; draft and edit version bodies
+- Create a policy; draft version bodies
+- **Rename** the selected policy (`rename_policy`, `PolicyRepository::updateTitle()`). Only the title changes: the slug is the identifier `findBySlug()` and the gates resolve policies by, so renaming can never detach a policy from versions students have already accepted. A blank title, or one longer than `Policy::MAX_TITLE_LENGTH`, is ignored
+- View the content of any version (`?page=us-policies&policy_id={id}&version_id={vid}`), whatever its status
+- Edit from the viewer: a draft is saved in place; editing a published or archived version instead saves the text as a **new draft version** (the viewer follows to it), so text students have already accepted is never rewritten
 - Publish a draft version; view acceptance history per version
 
+## Rendering a Policy Body
+Bodies are typed into a plain textarea, so most are written as blank-line-separated prose with no markup. `PolicyVersion::bodyHtml()` is the single render path — `wp_kses_post()` then `wpautop()`, the same treatment WordPress gives post content — so unmarked-up text arrives as real paragraphs and bodies that do carry markup are left alone. It feeds the booking/enrolment JSON (`GET /policies`), the signup form, and the admin version viewer, which therefore previews exactly what students see.
+
+The acceptance markup (`.us-policy` / `.us-policy-body`) is styled in `assets/css/frontend.css` as a bounded, vertically scrolling reading box with `overflow-wrap: break-word`, so a long policy or a pasted URL cannot force a horizontal scrollbar or push the accept checkbox out of view. `RegistrationPage` enqueues that stylesheet for the signup gate; `BookingPage` and `GroupClassPage` already did.
+
 ## REST API
 | Method   | Endpoint                                                        | Permission        |
 |----------|-----------------------------------------------------------------|-------------------|
@@ -74,3 +86,18 @@ cover every policy's current version or the registration is rejected.
 - `tests/Unit/Policy/PolicyVersionRepositoryTest.php`
 - `tests/Unit/Policy/AcceptanceRepositoryTest.php`
 - `tests/Unit/Policy/PolicyServiceTest.php`
+- `tests/Unit/Policy/PolicyControllerTest.php`
+- `tests/Unit/Policy/PolicyEndpointTest.php`
+
+## Who Accepted
+`us_policy_acceptances.accepted_by` records the person who actually ticked the
+box, where that differs from `student_id` — a guardian agreeing on a child's
+behalf. It defaults to 0, read back as "the student agreed for themselves"
+(`PolicyAcceptance::acceptorOrStudent()`). See `parent-guardian-accounts.md`.
+
+`recorded_by` answers a different question: who *entered* the acceptance, for one
+collected on paper or over the phone and typed in afterwards. The student still
+agreed, so `accepted_by` stays theirs; `collected_via` says how, and no IP is
+stored because they were never at a browser. Only lessons the studio booked can
+be recorded against — see **Recording Intake Collected Elsewhere** in
+`lesson-booking.md`.

docs/features/registration-questions.md

@@ -7,8 +7,8 @@ Questions come in two **scopes**:
   booking a specific offering; authored per offering by the studio admin or the owning
   instructor, and stored against the resulting lesson or group enrolment.
 - **Account scope** (`scope = 'account'`) — studio-wide questions every new student answers
-  **once at account signup**, as a required second step after choosing their name and
-  password. Authored by the studio admin only, and stored against the new user account.
+  **once at account signup**, on the same page as their name and password. Authored by the
+  studio admin only, and stored against the new user account.
 
 Both scopes share the `us_questions` / `us_question_answers` tables, the same field types,
 and the same authoring page (**Offerings → Questions**).
@@ -23,11 +23,32 @@ and the same authoring page (**Offerings → Questions**).
 | `label`       | VARCHAR(255)     | The question text shown to the registrant                   |
 | `field_type`  | VARCHAR(20)      | `text` / `textarea` / `select` / `checkbox`                 |
 | `options`     | TEXT             | JSON array of choices (for `select`); NULL otherwise        |
-| `is_required` | TINYINT(1)       | 1 = registrant must answer to continue                      |
+| `audience`    | VARCHAR(20)      | `all` (default) or `child` — who the question is asked of (account scope) |
+| `is_required` | TINYINT(1)       | 1 = the **account holder** must answer to continue          |
+| `is_required_child` | TINYINT(1) | 1 = each **student being registered** must answer to continue |
 | `sort_order`  | INT              | Display order within the scope                              |
 | `is_active`   | TINYINT(1)       | 0 = retired, 1 = shown on the form                          |
 | `created_at`  | DATETIME         | Insertion time                                             |
 
+## Audience and Required-ness (account scope)
+An account-scope question is asked in two places, and the two are configured separately:
+
+- **The account holder's own "About you" panel** — shown when they are registering
+  themselves (`self` or `both`). Governed by `audience` (a `child` question is not asked
+  here at all) and by `is_required`.
+- **Each student block** — one per person they are registering on behalf of, on the signup
+  form and on the guardian's family screen. Every question is asked here regardless of
+  `audience`; `is_required_child` decides whether it blocks submission.
+
+That split is what lets a studio ask "School and grade" of children only, or make
+"Previous experience" optional for an adult signing themselves up but required for every
+child they enrol. `audience = 'child'` leaves `is_required` moot — the question never
+reaches the account holder's panel.
+
+`audience` and `is_required_child` are ignored for offering-scope questions: booking and
+enrolment ask their intake questions once, about the student being booked, with no separate
+account-holder form to differ from.
+
 ## Data Model — `{prefix}us_question_answers`
 
 | Column              | Type             | Notes                                                  |
@@ -36,6 +57,9 @@ and the same authoring page (**Offerings → Questions**).
 | `question_id`       | BIGINT UNSIGNED  | FK → `us_questions.id`                                 |
 | `registration_type` | VARCHAR(20)      | `lesson`, `enrollment`, or `account`                  |
 | `registration_id`   | BIGINT UNSIGNED  | FK → `us_lessons.id`, `us_group_enrollments.id`, or the user ID (account scope) |
+| `collected_via`     | VARCHAR(20)      | How the answer reached the studio when it was not given online (`paper` / `in_person` / `phone` / `email` / `other`); NULL means online |
+| `collected_note`    | VARCHAR(191)     | Free-text detail for the above; required for `other` |
+| `recorded_by`       | BIGINT UNSIGNED  | Staff member who typed a collected-elsewhere answer in; 0 otherwise |
 | `student_id`        | BIGINT UNSIGNED  | WordPress user ID (denormalised for fast lookup)       |
 | `answer_value`      | TEXT             | The submitted answer (checkbox stored as `0`/`1`)      |
 | `created_at`        | DATETIME         | Insertion time                                        |
@@ -49,21 +73,26 @@ lesson, a group enrolment, or an account signup (`account` + the user ID).
 2. Required questions block submission until answered.
 3. Answers are sent in the `answers[]` array on `POST /bookings` or `POST /enrollments` and written to `us_question_answers` alongside the new registration row.
 
-## Account-scope Flow (signup step two)
+## Account-scope Flow (signup)
 1. The `[us_student_register]` page (`Auth\RegistrationPage`) loads active account-scope questions via `QuestionRepository::findByScope('account')`.
-2. The form renders as two steps: step one is email/name/password/policies, step two is the questions. `assets/js/register.js` reveals step two behind a "Next" button (progressive enhancement — without JS both steps show and the single submit still works). This applies to **every** signup path (invite, group link, self-approval).
-3. On submit, required answers are validated **before** the user is created (a missing answer returns an error and creates no account); after creation each answered question is written to `us_question_answers` with `registration_type = 'account'`, `registration_id = student_id = <new user ID>`.
+2. The form is a single page. The questions sit in an **About you** panel, alongside the account holder's birth year, between the "Who are you registering?" choice and the students being added — minus any `audience = 'child'` question, which is never asked of the account holder. `assets/js/register.js` disables and hides that whole panel when the choice is "on behalf of students" — the questions describe a student and a pure guardian is not one — and puts the full question set in every child block instead. Progressive enhancement: without JS every panel shows and the single submit still works. This applies to **every** signup path (invite, group link, self-approval).
+3. On submit, required answers are validated **before** the user is created (a missing answer returns an error and creates no account) — `is_required` against the account holder's panel, `is_required_child` against each student block; after creation each answered question is written to `us_question_answers` with `registration_type = 'account'`, `registration_id = student_id = <new user ID>`. An answer posted for a `child`-audience question against the account holder is discarded, not stored.
 4. A studio admin reviews the answers on the student's admin screen under **Registration Information** (`Auth\StudentHistory::registrationInfo()` lists every account question paired with the student's answer, "—" when unanswered). These rows are excluded from the offering-scope "Intake answers" table.
 
 ## Admin Interface
 Both scopes are edited from **Offerings → Questions** (`Registration\QuestionController`):
 - Pick an offering to edit its questions, or **"Account signup (all registrations)"** for the account-scope questions.
+- The account-scope form adds **Asked of** (everyone / students only) and a second **Required** checkbox for students; both are hidden for offering scope, where they have no meaning.
 - Studio admin (`manage_questions` + `manage_instructors`) edits any offering's questions and the account-scope questions.
 - Instructor (`manage_questions`) edits questions only on their own offerings; the account-scope option is hidden.
 
 ## REST API
 Only offering-scope questions are exposed over REST. Account-scope questions are managed
-through the server-rendered admin page and read directly by `RegistrationPage`.
+through the server-rendered admin page and read directly by `RegistrationPage` — a request
+naming one is turned away as not found, since the owner check has no offering to check
+against, so REST can neither read nor overwrite an `audience`. An offering question written
+over REST mirrors its single `is_required` into `is_required_child`, as the admin form and
+the upgrade backfill both do.
 
 | Method   | Endpoint                                          | Permission           |
 |----------|---------------------------------------------------|----------------------|
@@ -74,12 +103,13 @@ through the server-rendered admin page and read directly by `RegistrationPage`.
 
 ## Implementation
 - Repositories: `Unsupervised\Schedular\Registration\QuestionRepository` (`findByOffering`, `findByScope`), `Unsupervised\Schedular\Registration\AnswerRepository`
-- Models: `Unsupervised\Schedular\Registration\Question` (`scope`, nullable `offeringId`), `Unsupervised\Schedular\Registration\Answer` (`REG_ACCOUNT`)
+- Models: `Unsupervised\Schedular\Registration\Question` (`scope`, nullable `offeringId`, `audience`, `isRequiredChild`, and the `askedOfSelf()` / `isRequiredForSelf()` / `isRequiredForChild()` readers every caller uses instead of touching `isRequired` directly), `Unsupervised\Schedular\Registration\Answer` (`REG_ACCOUNT`)
 - Admin controller: `Unsupervised\Schedular\Registration\QuestionController`
 - REST endpoint: `Unsupervised\Schedular\Registration\QuestionEndpoint` (offering scope only)
-- Signup step two: `Unsupervised\Schedular\Auth\RegistrationPage`, `templates/frontend/register-page.php`, `assets/js/register.js`
+- Signup form: `Unsupervised\Schedular\Auth\RegistrationPage`, `templates/frontend/register-page.php`, `assets/js/register.js`
 - Admin review: `Unsupervised\Schedular\Auth\StudentHistory::registrationInfo()`, `templates/admin/student-detail.php`
-- Schema: `us_questions.scope` + nullable `us_questions.offering_id` (requires a plugin version bump so `dbDelta` runs)
+- Schema: `us_questions.scope` + nullable `us_questions.offering_id`, `us_questions.audience`, `us_questions.is_required_child` (each requires a plugin version bump so `dbDelta` runs)
+- Required-for-students backfill: `is_required_child` arrives with `DEFAULT 0`, which would quietly make every existing required question optional for students. `QuestionRepository::backfillChildRequired()` copies `is_required` into it once; `Plugin::boot()` runs it guarded by the `us_questions_child_required_backfilled` option, after the version gate has let `dbDelta` add the column
 - Nullability repair: `dbDelta` does **not** reliably relax a column from `NOT NULL` to `NULL`, so sites created before account-scope questions kept `offering_id NOT NULL` and rejected account inserts. `QuestionRepository::ensureOfferingNullable()` re-applies the nullable definition (idempotent `ALTER … MODIFY`); `Plugin::boot()` runs it once, guarded by the `us_questions_offering_nullable` option rather than the version gate (affected sites may already be on the current version)
 
 ## Tests
@@ -87,5 +117,16 @@ through the server-rendered admin page and read directly by `RegistrationPage`.
 - `tests/Unit/Registration/AnswerRepositoryTest.php`
 - `tests/Unit/Registration/QuestionTest.php`
 - `tests/Unit/Registration/AnswerTest.php`
+- `tests/Unit/Registration/QuestionFieldTest.php`
 - `tests/Unit/Auth/RegistrationPageTest.php`
 - `tests/Unit/Auth/StudentHistoryTest.php`
+- `tests/Unit/Guardian/FamilyPageTest.php`
+
+## Per-Child Answers
+For a parent/guardian signup, **account-scope** questions are asked **once per
+child** rather than once per guardian — in practice they describe the student
+(instrument, level, school), not the account holder. Each answer's `student_id`
+and `registration_id` are the child's user ID, so a studio admin reading a
+child's screen sees the information that describes them. The guardian's family
+screen asks the same questions when a child is added later, under the same
+`is_required_child` rule as the signup form. See `parent-guardian-accounts.md`.

docs/features/scheduled-billing.md

@@ -6,7 +6,9 @@ payments on a recurring schedule:
 
 - **`weekly`** — one payment per lesson, due **24 hours before** that lesson.
 - **`monthly`** — one payment per calendar month, due on the **1st**, covering every
-  lesson that falls in the month (4 lessons ⇒ 4 × fee).
+  lesson that falls in the month. A **private lesson**'s fee is per lesson, so the
+  month costs (#lessons) × fee. A **group class**'s fee is per month: the class is
+  billed that fee once for the month, however many times it meets in it.
 
 Both apply to **private lessons** and **group classes**. At registration the
 booking/enrolment succeeds with `payment: null` (no payment step); the lesson is
@@ -29,7 +31,7 @@ method resolution, e-transfer freezing, comp auto-pay reused) with a `due_date`
 | **Private weekly** | lesson `start_dt` ≤ now + 24h | 1 × fee | `us_lessons.payment_id` set on the lesson |
 | **Private monthly** | the lesson's month's 1st ≤ today | (#lessons in month) × fee | `payment_id` set on every lesson in the month |
 | **Group weekly** | session (from `Offering::sessionWindows()`) − 1 day ≤ now | 1 × fee | `us_payments.period_key` = session date |
-| **Group monthly** | the month's 1st ≤ today | (#sessions in month) × fee | `period_key` = `YYYY-MM` |
+| **Group monthly** | the month's 1st ≤ today | 1 × fee (a monthly class is priced per month, not per session) | `period_key` = `YYYY-MM` |
 
 - Private lessons dedup on `us_lessons.payment_id IS NULL` — a lesson with no payment is
   unbilled. A monthly group links its earliest lesson via `createForRegistration` and the
@@ -92,3 +94,10 @@ applies that credit against their due charges before emailing the notice
 - `tests/Unit/Payment/PaymentRepositoryTest.php` (`existsForPeriod`, `due_date`/`period_key`)
 - `tests/Unit/Payment/PaymentServiceTest.php` (`voidPending` skips scheduled)
 - `tests/Unit/Booking/BookingEndpointTest.php` / `tests/Unit/GroupClass/EnrollmentEndpointTest.php` (deferred payment)
+
+## One Notice Per Family
+Charges are bucketed by **payer**, not student, so a guardian gets a single
+notice covering every child rather than one email per child. Each line names the
+student it is for when that is not the payer ("Ada: Piano Lesson — Mar 3, 2026"),
+and account credit is applied across the whole bucket from the family balance.
+See `parent-guardian-accounts.md`.

docs/features/student-administration.md

@@ -24,9 +24,17 @@ No new tables. The views are composed from existing data:
   quick counts (upcoming lessons, active group enrolments). Each row links to the
   detail view.
 - **Detail** (`?student_id=`):
-  - **Account** — display name, email, registered date.
+  - **Account** — display name, email, registered date, and **Booked by**: the
+    name of the parent/guardian who books and pays for this student, linked to
+    their own detail page. Always rendered — a student who books for themselves
+    says so in words, so an empty row can never be mistaken for a lookup that
+    failed.
   - **Upcoming lessons** and **Past lessons** — split by the linked availability
     slot's `start_dt`; each shows date/time, offering, instructor, and status.
+    **Upcoming lessons** also lists the student's upcoming group-class sessions
+    (`GroupClass\SessionSchedule`, marked "group class"), so one table answers
+    "what are they booked into next week?". Only upcoming ones: past dates would
+    bury the lessons, and the enrolment table below already holds the history.
   - **Group-class enrolments** — active/past, with offering title and status.
   - **Policy acceptances** — every acceptance the student has recorded, newest
     first: policy title, version, context (account signup / lesson / enrolment),
@@ -51,7 +59,38 @@ All actions are nonce-protected POSTs handled on the detail page:
   voided. A paid lesson is credited back to the student's account (see
   `credits.md`) rather than refunded.
 - **Withdraw** — on an active group-class enrolment: marked `cancelled` (freeing
-  its capacity seat), with the same pending-payment voiding.
+  its capacity seat), with the same pending-payment voiding. This is the only way
+  to remove a class; the group-class rows in **Upcoming lessons** carry no Cancel
+  action, because there is no such thing as cancelling one session of a term.
+
+## Deleting a user
+Deleting a WordPress user is a core action that knows nothing about lessons, so
+`Auth\DeletedUserCleanup` hooks `delete_user` (and `wpmu_delete_user`) and gives
+back what the account was holding: every **upcoming** lesson is marked
+`cancelled`, its availability slot released for rebooking, and its still-pending
+payment voided; every **active** group-class enrolment is cancelled and its
+pending payment voided. Without it the slots stayed marked booked and unbookable
+by anyone else, the lessons stayed on the instructor's schedule under a name that
+no longer resolved, and a class kept a seat filled by nobody.
+
+**A guardian takes their children with them.** A child account is login-less and
+exists only so the guardian has somebody to book for; without the guardian nobody
+can reach it, book for it, or be billed for it, so leaving it behind leaves an
+unreachable student on the roster holding slots that will never be used. Each
+child's bookings are released on the same terms, the `us_guardians` link row is
+deleted, and the account goes. Deleting a child fires `delete_user` again and
+re-enters the same handler; a `handled` set of user ids makes that a no-op and
+also stops a self-referential or circular link recursing.
+
+(This is a different rule from the family screen's **Remove**, which still refuses
+a child with any lesson or enrolment history — that is a guardian tidying up, not
+an admin deleting an account, and `GuardianService::removeChild()` is unchanged.)
+
+Past lessons are deliberately untouched: they happened, they may have been paid
+for, and the payment report has to keep adding up. No account credit is issued
+for a paid lesson either, unlike a cancellation the student asks for — a credit
+can only be spent on the account being deleted, so a refund owed to someone who
+has left is the studio's decision to make and record.
 
 ## Capabilities
 - `manage_students` — studio admin (administrators inherit it via the
@@ -73,6 +112,8 @@ All actions are nonce-protected POSTs handled on the detail page:
   refuse records that don't belong to the student, and reuse
   `Payment\PaymentService::voidPending`) and account updates via
   `wp_update_user` (unit-tested with mocked repositories).
+- Group-class sessions in the upcoming table: `GroupClass\SessionSchedule::upcomingForStudent()`
+- Deletion cleanup: `Auth\DeletedUserCleanup` (hooked in `Plugin::boot()`)
 - Upcoming/past split: `Auth\StudentSchedule::partition()` (pure, unit-tested)
 - The upcoming/past split is extracted into a small pure helper so it is
   unit-testable (the controller itself follows the repo convention of not being
@@ -80,9 +121,17 @@ All actions are nonce-protected POSTs handled on the detail page:
 
 ## Tests
 - `tests/Unit/Auth/StudentScheduleTest.php` (the pure upcoming/past split helper)
+- `tests/Unit/Auth/DeletedUserCleanupTest.php` (release on user deletion)
 - `tests/Unit/Auth/StudentHistoryTest.php` (history display rows + fallbacks)
 - `tests/Unit/Auth/StudentActionsTest.php` (cancel/withdraw guards + side
   effects, account validation)
 - `findByStudent` coverage in `tests/Unit/Policy/AcceptanceRepositoryTest.php`,
   `tests/Unit/Registration/AnswerRepositoryTest.php`, and
   `tests/Unit/Payment/PaymentRepositoryTest.php`
+
+## Family Relationships
+The students list gains a **Profile** column — a child links to their guardian,
+a guardian lists their children — and the student screen a **Profile** panel. A
+child's listed email is their guardian's, since a child's own address is an
+undeliverable placeholder, and the credit balance shown is the payer's, labelled
+with whose account holds it. See `parent-guardian-accounts.md`.

phpstan.neon

@@ -3,6 +3,13 @@ includes:
 
 parameters:
     level: 10
+    # Analyse against the whole supported range, not whatever PHP happens to be
+    # running. Without this, syntax newer than the `Requires PHP: 8.1` header
+    # promises passes lint on a modern local PHP and only fails in the 8.1 test
+    # job — which is how a PHP 8.2 `true` return type once reached CI.
+    phpVersion:
+        min: 80100
+        max: 80300
     paths:
         - src
     bootstrapFiles:

src/AdminMenu.php

@@ -5,6 +5,7 @@ namespace Unsupervised\Schedular;
 
 use Unsupervised\Schedular\Availability\AvailabilityController;
 use Unsupervised\Schedular\Availability\AvailabilityRepository;
+use Unsupervised\Schedular\Availability\WindowValidator;
 use Unsupervised\Schedular\Auth\AccessSettings;
 use Unsupervised\Schedular\Auth\InstructorController;
 use Unsupervised\Schedular\Auth\InviteRepository;
@@ -14,13 +15,16 @@ use Unsupervised\Schedular\Auth\RegistrationMailer;
 use Unsupervised\Schedular\Auth\RoleManager;
 use Unsupervised\Schedular\Auth\StudentActions;
 use Unsupervised\Schedular\Auth\StudentController;
+use Unsupervised\Schedular\Guardian\GuardianService;
 use Unsupervised\Schedular\Auth\StudentHistory;
+use Unsupervised\Schedular\Booking\AdminBooking;
 use Unsupervised\Schedular\Booking\BookingRepository;
+use Unsupervised\Schedular\Booking\LessonBooker;
 use Unsupervised\Schedular\Booking\LessonController;
-use Unsupervised\Schedular\Booking\LessonDetail;
 use Unsupervised\Schedular\GroupClass\EnrollmentRepository;
 use Unsupervised\Schedular\GroupClass\GroupAccessRepository;
 use Unsupervised\Schedular\GroupClass\GroupClassController;
+use Unsupervised\Schedular\GroupClass\SessionSchedule;
 use Unsupervised\Schedular\Offering\ClassSlotReconciler;
 use Unsupervised\Schedular\Offering\OfferingController;
 use Unsupervised\Schedular\Offering\OfferingRepository;
@@ -39,9 +43,18 @@ use Unsupervised\Schedular\Policy\PolicyVersionRepository;
 use Unsupervised\Schedular\Registration\AnswerRepository;
 use Unsupervised\Schedular\Registration\QuestionController;
 use Unsupervised\Schedular\Registration\QuestionRepository;
+use Unsupervised\Schedular\Registration\IntakeAudit;
+use Unsupervised\Schedular\Registration\IntakeRecording;
+use Unsupervised\Schedular\Registration\RegistrationGate;
 
 class AdminMenu {
 
+	/**
+	 * Hook suffix of the availability screen, captured when the page is added so
+	 * its script loads on that screen only.
+	 */
+	private string $availabilityHook = '';
+
 	private AvailabilityController $availabilityController;
 	private LessonController $lessonController;
 	private OfferingController $offeringController;
@@ -57,16 +70,21 @@ class AdminMenu {
 	private PaymentController $paymentController;
 	private PaymentReportController $paymentReportController;
 
-	public function __construct( AvailabilityRepository $availability, BookingRepository $bookings, OfferingRepository $offerings, QuestionRepository $questions, AnswerRepository $answers, PolicyRepository $policies, PolicyVersionRepository $policyVersions, PolicyService $policyService, AcceptanceRepository $acceptances, InviteRepository $invites, EnrollmentRepository $enrollments, GroupAccessRepository $groupAccess, StudioSettings $settings, PaymentRepository $payments, PaymentService $paymentService, BillingMethodResolver $resolver, RegistrationMailer $registrationMailer, CreditRepository $credits ) {
-		$this->availabilityController         = new AvailabilityController( $availability, $offerings );
-		$this->lessonController               = new LessonController( $bookings, $payments, $availability, $offerings, new LessonDetail( $answers, $questions, $acceptances, $policies, $policyVersions ) );
+	public function __construct( AvailabilityRepository $availability, BookingRepository $bookings, OfferingRepository $offerings, QuestionRepository $questions, AnswerRepository $answers, PolicyRepository $policies, PolicyVersionRepository $policyVersions, PolicyService $policyService, AcceptanceRepository $acceptances, InviteRepository $invites, EnrollmentRepository $enrollments, GroupAccessRepository $groupAccess, StudioSettings $settings, PaymentRepository $payments, PaymentService $paymentService, BillingMethodResolver $resolver, RegistrationMailer $registrationMailer, CreditRepository $credits, GuardianService $guardians, LessonBooker $booker, RegistrationGate $gate ) {
+		// One audit presenter and one recorder, shared by the lesson and enrolment
+		// detail views: intake is the same thing whichever registration it hangs off.
+		$intakeAudit     = new IntakeAudit( $answers, $questions, $acceptances, $policies, $policyVersions );
+		$intakeRecording = new IntakeRecording( $questions, $answers, $policies, $policyVersions, $acceptances, $gate );
+
+		$this->availabilityController         = new AvailabilityController( $availability, $offerings, new WindowValidator( $offerings ) );
+		$this->lessonController               = new LessonController( $bookings, $payments, $availability, $offerings, $intakeAudit, new AdminBooking( $availability, $offerings, $booker ), $intakeRecording );
 		$this->offeringController             = new OfferingController( $offerings, new ClassSlotReconciler( $availability ) );
 		$this->questionController             = new QuestionController( $questions, $offerings );
 		$this->policyController               = new PolicyController( $policies, $policyVersions, $policyService );
 		$this->registrationController         = new RegistrationController( $invites );
 		$this->registrationApprovalController = new RegistrationApprovalController( $registrationMailer );
-		$this->groupClassController           = new GroupClassController( $enrollments, $offerings, $payments, $groupAccess, $paymentService, $invites, $registrationMailer );
-		$this->studentController              = new StudentController( $bookings, $availability, $offerings, $enrollments, $resolver, new StudentHistory( $acceptances, $policies, $policyVersions, $answers, $questions, $payments, $credits ), new StudentActions( $bookings, $availability, $enrollments, $paymentService ) );
+		$this->groupClassController           = new GroupClassController( $enrollments, $offerings, $payments, $groupAccess, $paymentService, $invites, $registrationMailer, $intakeAudit, $intakeRecording );
+		$this->studentController              = new StudentController( $bookings, $availability, $offerings, $enrollments, $resolver, new StudentHistory( $acceptances, $policies, $policyVersions, $answers, $questions, $payments, $credits ), new StudentActions( $bookings, $availability, $enrollments, $paymentService ), $guardians, new SessionSchedule( $enrollments, $offerings ) );
 		$this->instructorController           = new InstructorController();
 		$this->settings                       = $settings;
 		$this->accessSettings                 = new AccessSettings();
@@ -76,9 +94,29 @@ class AdminMenu {
 
 	public function register(): void {
 		add_action( 'admin_menu', [ $this, 'addPages' ] );
+		add_action( 'admin_enqueue_scripts', [ $this, 'enqueueAssets' ] );
 		add_action( 'admin_post_' . PaymentReportController::EXPORT_ACTION, [ $this->paymentReportController, 'export' ] );
 	}
 
+	/**
+	 * Load a screen's script on that screen only.
+	 *
+	 * @param string $hookSuffix Screen the enqueue is running for.
+	 */
+	public function enqueueAssets( string $hookSuffix ): void {
+		if ( '' === $this->availabilityHook || $hookSuffix !== $this->availabilityHook ) {
+			return;
+		}
+
+		wp_enqueue_script(
+			'us-scheduler-availability-admin',
+			USC_PLUGIN_URL . 'assets/js/availability-admin.js',
+			[],
+			USC_VERSION,
+			true
+		);
+	}
+
 	public function addPages(): void {
 		$this->addStudioSeparators();
 
@@ -94,7 +132,7 @@ class AdminMenu {
 		);
 
 		// Instructor: manage their own availability.
-		add_menu_page(
+		$this->availabilityHook = (string) add_menu_page(
 			__( 'My Availability', 'unsupervised-schedular' ),
 			__( 'My Availability', 'unsupervised-schedular' ),
 			RoleManager::CAP_MANAGE_AVAILABILITY,

src/Auth/AccessSettings.php

@@ -3,17 +3,24 @@ declare(strict_types=1);
 
 namespace Unsupervised\Schedular\Auth;
 
+use Unsupervised\Schedular\Uninstaller;
 use Unsupervised\Schedular\Val;
 
 /**
- * Site-owner toggles for whether WordPress administrators automatically receive
- * the studio-admin and/or instructor capabilities.
+ * The site owner's page: whether WordPress administrators automatically receive
+ * the studio-admin and/or instructor capabilities, and what deleting the plugin
+ * takes with it.
  *
- * Both default on, preserving the out-of-the-box experience where a single
- * administrator runs the studio and teaches from one account. The settings page
- * is gated on `manage_options` (the core WordPress administrator capability,
- * which the plugin never grants or revokes) so an administrator can always reach
- * it to re-enable a grant — disabling one can never lock them out.
+ * Both capability grants default on, preserving the out-of-the-box experience
+ * where a single administrator runs the studio and teaches from one account. The
+ * settings page is gated on `manage_options` (the core WordPress administrator
+ * capability, which the plugin never grants or revokes) so an administrator can
+ * always reach it to re-enable a grant — disabling one can never lock them out.
+ *
+ * The data-removal choice lives here for the same reason: `manage_options` is
+ * held by exactly the people who can delete a plugin, so the switch and the act
+ * it governs are in the same pair of hands. {@see Uninstaller} explains what the
+ * two answers mean.
  */
 class AccessSettings {
 
@@ -49,21 +56,56 @@ class AccessSettings {
 			wp_die( esc_html__( 'You do not have permission to manage access settings.', 'unsupervised-schedular' ) );
 		}
 
+		$error = '';
 		if ( isset( $_POST['usc_action'] ) && check_admin_referer( 'usc_access_action' ) ) {
-			$this->save();
+			$error = $this->save();
 		}
 
 		$adminsAreStudioAdmins = $this->adminsAreStudioAdmins();
 		$adminsAreInstructors  = $this->adminsAreInstructors();
+		$deleteDataOnUninstall = Uninstaller::deletesDataOnUninstall();
 
 		include USC_PLUGIN_DIR . 'templates/admin/access.php';
 	}
 
-	private function save(): void {
+	/**
+	 * Persist the submitted settings, reporting why the data-removal choice was
+	 * refused when it was. Everything else on the page saves either way: a
+	 * mistyped confirmation must not also swallow a capability change.
+	 */
+	private function save(): string {
 		// Nonce is verified by the caller (renderPage) before this method runs.
 		// phpcs:disable WordPress.Security.NonceVerification.Missing
 		update_option( self::OPT_GRANT_STUDIO, isset( $_POST['grant_studio'] ) ? '1' : '0' );
 		update_option( self::OPT_GRANT_INSTRUCTOR, isset( $_POST['grant_instructor'] ) ? '1' : '0' );
+
+		$wanted = isset( $_POST['delete_data'] );
+
+		// Switching it off is not the dangerous direction, and needs no ceremony.
+		if ( ! $wanted ) {
+			Uninstaller::setDeletesDataOnUninstall( false );
+
+			return '';
+		}
+
+		// Already on and left on: this save is about something else on the page,
+		// so do not make them retype the word to keep a setting they already made.
+		if ( Uninstaller::deletesDataOnUninstall() ) {
+			return '';
+		}
+
+		// Turning it on erases records that cannot be got back, so the tick alone
+		// is not enough — it is one stray click, and this is the only place in the
+		// plugin where a stray click is unrecoverable.
+		$confirmed = 'delete' === sanitize_key( Val::string( wp_unslash( $_POST['delete_data_confirm'] ?? '' ) ) );
 		// phpcs:enable WordPress.Security.NonceVerification.Missing
+
+		if ( ! $confirmed ) {
+			return __( 'Data removal was not enabled: type DELETE in the confirmation box to turn it on. Everything else on this page was saved.', 'unsupervised-schedular' );
+		}
+
+		Uninstaller::setDeletesDataOnUninstall( true );
+
+		return '';
 	}
 }

src/Auth/AccountPage.php

@@ -0,0 +1,78 @@
+<?php
+declare(strict_types=1);
+
+namespace Unsupervised\Schedular\Auth;
+
+use Unsupervised\Schedular\Val;
+
+/**
+ * Who is signed in, and the way out.
+ *
+ * Meant for a header, sidebar or account page — somewhere it sits alongside
+ * other content rather than being the whole of it. That shapes the two
+ * decisions below.
+ */
+class AccountPage {
+
+	/**
+	 * Renders the account shortcode/block output.
+	 *
+	 * Signed out, this renders a sign-in link when a login page is configured and
+	 * **nothing at all** when one is not. A block whose whole job is "you are
+	 * signed in as X" has nothing to say to a stranger, and a bare "you are not
+	 * signed in" in a site header is noise with no way to act on it. The editor
+	 * preview shows the populated state regardless, so the block is never
+	 * invisible to the person placing it.
+	 *
+	 * @param array<int|string, mixed> $atts Block attributes (`loginPageId`) or
+	 *                                       shortcode attributes (`login_page_id`).
+	 */
+	public function render( array $atts ): string {
+		$loginPageId = Val::int( $atts['loginPageId'] ?? $atts['login_page_id'] ?? 0 );
+		$loginUrl    = $this->pageUrl( $loginPageId );
+
+		wp_enqueue_style( 'us-scheduler' );
+
+		if ( ! is_user_logged_in() ) {
+			if ( null === $loginUrl ) {
+				return '';
+			}
+
+			return sprintf(
+				'<div class="us-account us-account-out"><a class="us-account-signin" href="%s">%s</a></div>',
+				esc_url( $loginUrl ),
+				esc_html__( 'Sign in', 'unsupervised-schedular' )
+			);
+		}
+
+		// Always a WP_User here — is_user_logged_in() above rules out the
+		// id-0 placeholder wp_get_current_user() returns for a visitor.
+		$user = wp_get_current_user();
+
+		$name  = UserName::format( $user, get_current_user_id() );
+		$email = $user->user_email;
+
+		// Back to where they were, so signing out of a header link does not also
+		// navigate them somewhere. The login page is the better landing spot when
+		// one is configured, since the current page may be members-only.
+		$logoutUrl = wp_logout_url( $loginUrl ?? (string) get_permalink() );
+
+		ob_start();
+		include USC_PLUGIN_DIR . 'templates/frontend/account-page.php';
+		return (string) ob_get_clean();
+	}
+
+	/**
+	 * Permalink of a configured page, or null when none is chosen or the chosen
+	 * page has since been deleted.
+	 */
+	private function pageUrl( int $pageId ): ?string {
+		if ( $pageId <= 0 ) {
+			return null;
+		}
+
+		$url = get_permalink( $pageId );
+
+		return is_string( $url ) ? $url : null;
+	}
+}

src/Auth/DeletedUserCleanup.php

@@ -0,0 +1,130 @@
+<?php
+declare(strict_types=1);
+
+namespace Unsupervised\Schedular\Auth;
+
+use Unsupervised\Schedular\Availability\AvailabilityRepository;
+use Unsupervised\Schedular\Booking\BookingRepository;
+use Unsupervised\Schedular\Booking\Lesson;
+use Unsupervised\Schedular\GroupClass\Enrollment;
+use Unsupervised\Schedular\GroupClass\EnrollmentRepository;
+use Unsupervised\Schedular\Guardian\GuardianRepository;
+use Unsupervised\Schedular\Guardian\GuardianService;
+use Unsupervised\Schedular\Payment\PaymentService;
+
+/**
+ * Gives back what a deleted account was holding, and takes the accounts that
+ * only existed underneath it with it.
+ *
+ * WordPress deletes a user without knowing anything about lessons, so a student
+ * removed from **Users → Delete** used to leave their bookings behind: the
+ * availability slots stayed marked booked and unbookable by anyone else, the
+ * lessons stayed on the instructor's schedule under a name that no longer
+ * resolved, and a group class kept a seat filled by nobody.
+ *
+ * So each upcoming booking is cancelled the same way a real cancellation is —
+ * marked cancelled, its slot released, its still-pending payment voided. Past
+ * lessons are deliberately left alone: they happened, they may have been paid
+ * for, and the payment report has to keep adding up.
+ *
+ * A **guardian** takes their children with them. A child account is login-less
+ * and exists only so the guardian has somebody to book for; without the
+ * guardian nobody can reach it, book for it, or be billed for it, so leaving it
+ * behind leaves an unreachable student on the roster holding slots that will
+ * never be used. Each child's bookings are released on the same terms, the link
+ * row goes, and the account is deleted.
+ *
+ * No account credit is issued for a paid lesson, unlike a cancellation the
+ * student asks for. A credit only has value against future billing on the
+ * account it belongs to, and that account is being deleted; a refund owed to
+ * someone who has left is a decision for the studio to make and record, not one
+ * to silently write into a table nobody will read again.
+ */
+class DeletedUserCleanup {
+
+	/**
+	 * Accounts already dealt with this request, so deleting a guardian's child
+	 * — which fires `delete_user` again and re-enters this very handler — cannot
+	 * loop or redo work. It also makes a self-referential or circular guardian
+	 * link, however it got into the table, terminate rather than recurse.
+	 *
+	 * @var array<int, true>
+	 */
+	private array $handled = [];
+
+	public function __construct(
+		private BookingRepository $bookings,
+		private AvailabilityRepository $availability,
+		private EnrollmentRepository $enrollments,
+		private PaymentService $payments,
+		private GuardianRepository $links,
+		private GuardianService $guardians,
+	) {}
+
+	public function register(): void {
+		// `delete_user` fires before the row goes, which is what lets the lookups
+		// below still find the account's bookings and children. `wpmu_delete_user`
+		// is the multisite equivalent for a user removed from the network entirely.
+		add_action( 'delete_user', [ $this, 'releaseBookings' ] );
+		add_action( 'wpmu_delete_user', [ $this, 'releaseBookings' ] );
+	}
+
+	/**
+	 * Release everything the account had booked ahead of it, then remove any
+	 * children that only existed to be booked for.
+	 */
+	public function releaseBookings( int $userId ): void {
+		if ( $userId <= 0 || isset( $this->handled[ $userId ] ) ) {
+			return;
+		}
+
+		$this->handled[ $userId ] = true;
+
+		$this->release( $userId );
+		$this->removeChildren( $userId );
+	}
+
+	/**
+	 * Cancel one account's upcoming lessons and active enrolments, freeing the
+	 * slot and voiding the pending payment behind each.
+	 */
+	private function release( int $studentId ): void {
+		// Upcoming and not already cancelled — the only bookings that are still
+		// holding anything.
+		foreach ( $this->bookings->findUpcomingForStudent( $studentId ) as $lesson ) {
+			$this->bookings->updateStatus( (int) $lesson->id, Lesson::STATUS_CANCELLED );
+			$this->availability->release( $lesson->slotId );
+			$this->payments->voidPending( $lesson->paymentId );
+		}
+
+		foreach ( $this->enrollments->findByStudent( $studentId ) as $enrollment ) {
+			if ( Enrollment::STATUS_ACTIVE !== $enrollment->status ) {
+				continue;
+			}
+
+			$this->enrollments->updateStatus( (int) $enrollment->id, Enrollment::STATUS_CANCELLED );
+			$this->payments->voidPending( $enrollment->paymentId );
+		}
+	}
+
+	/**
+	 * Delete every child linked to a departing guardian, releasing what each was
+	 * holding first. Each child is marked handled *before* it is deleted, so the
+	 * `delete_user` this fires re-enters and returns without redoing the release.
+	 */
+	private function removeChildren( int $guardianId ): void {
+		foreach ( $this->links->findByGuardian( $guardianId ) as $link ) {
+			$childId = $link->studentId;
+
+			if ( $childId <= 0 || $childId === $guardianId || isset( $this->handled[ $childId ] ) ) {
+				continue;
+			}
+
+			$this->handled[ $childId ] = true;
+
+			$this->release( $childId );
+			$this->links->delete( $guardianId, $childId );
+			$this->guardians->deleteUser( $childId );
+		}
+	}
+}

src/Auth/LoginPage.php

@@ -36,7 +36,12 @@ class LoginPage {
 				'remember'      => isset( $_POST['rememberme'] ),
 			];
 
-			$user = wp_signon( $credentials, false );
+			// The secure-cookie argument is deliberately left at its default. Only
+			// the empty string makes wp_signon() work it out from is_ssl(); passing
+			// an explicit false skips that and issues the plain, non-Secure auth
+			// cookie on an HTTPS site — a session that then leaks over the first
+			// http:// request to the domain.
+			$user = wp_signon( $credentials );
 
 			if ( is_wp_error( $user ) ) {
 				$error = esc_html__( 'Invalid username or password.', 'unsupervised-schedular' );

src/Auth/PasswordPolicy.php

@@ -0,0 +1,165 @@
+<?php
+declare(strict_types=1);
+
+namespace Unsupervised\Schedular\Auth;
+
+/**
+ * What counts as an acceptable signup password.
+ *
+ * The check is deliberately split across the two sides, because the two sides
+ * can do different things:
+ *
+ * - **The browser** runs zxcvbn (WordPress ships it as `password-strength-meter`)
+ *   and gates the submit button on {@see MIN_SCORE}. That is the nuanced test —
+ *   it knows that `Tr0ub4dor&3` is weaker than `correct horse battery staple` —
+ *   but it is only advice, because anything in a browser can be turned off.
+ * - **This class** runs on the server and is the rule that actually holds. It
+ *   cannot score a password the way zxcvbn does without shipping a dictionary,
+ *   so it does not pretend to: it rejects the categorically bad — too short,
+ *   the user's own name or email, a password from the well-known lists, or one
+ *   built from almost no distinct characters.
+ *
+ * Neither half is sufficient alone, which is the point. A password that clears
+ * both is not guaranteed strong; one that fails either is definitely not.
+ */
+class PasswordPolicy {
+
+	/**
+	 * Minimum length. NIST SP 800-63B puts the floor at 8 and explicitly advises
+	 * against composition rules ("must contain a symbol") on the grounds that they
+	 * push people towards predictable substitutions. Length plus the checks below
+	 * does more for less annoyance.
+	 */
+	public const MIN_LENGTH = 8;
+
+	/**
+	 * The zxcvbn score the browser demands before it will let the form submit,
+	 * on WordPress's 0-4 scale: 0-1 weak, 2 medium, 3-4 strong. Two rejects the
+	 * passwords a stranger would guess while still accepting an ordinary
+	 * memorable one — a studio signup form is not a bank.
+	 */
+	public const MIN_SCORE = 2;
+
+	/**
+	 * How much of the user's own identity has to appear in the password before it
+	 * is refused. Short enough to catch a name inside a longer password, long
+	 * enough that a two- or three-letter coincidence does not trip it.
+	 */
+	private const IDENTITY_FRAGMENT_LENGTH = 4;
+
+	/** Fewest distinct characters a password may be built from. */
+	private const MIN_DISTINCT_CHARACTERS = 4;
+
+	/**
+	 * Why this password is unacceptable, or null when it passes.
+	 *
+	 * `$email` and `$displayName` are what the same submission is claiming as an
+	 * identity, so they can be checked against the password before either exists
+	 * as a user.
+	 */
+	public static function validate( string $password, string $email = '', string $displayName = '' ): ?string {
+		// Not trimmed: a leading or trailing space is a legitimate character, and
+		// silently changing what someone typed would lock them out later.
+		if ( strlen( $password ) < self::MIN_LENGTH ) {
+			return sprintf(
+				/* translators: %d: minimum number of characters. */
+				__( 'Please choose a password of at least %d characters.', 'unsupervised-schedular' ),
+				self::MIN_LENGTH
+			);
+		}
+
+		$lower = strtolower( $password );
+
+		if ( in_array( $lower, self::commonPasswords(), true ) ) {
+			return __( 'That password is one of the most commonly used ones. Please choose something less guessable.', 'unsupervised-schedular' );
+		}
+
+		if ( count( array_unique( str_split( $lower ) ) ) < self::MIN_DISTINCT_CHARACTERS ) {
+			return __( 'Please choose a password built from more than a few repeated characters.', 'unsupervised-schedular' );
+		}
+
+		if ( self::echoesIdentity( $lower, $email, $displayName ) ) {
+			return __( 'Please choose a password that does not contain your name or email address.', 'unsupervised-schedular' );
+		}
+
+		return null;
+	}
+
+	/**
+	 * Whether the password contains the user's display name, their email address,
+	 * or the part of it before the `@` — the first things anyone guessing would
+	 * try, and the reason "grace2019" is worse than its length suggests.
+	 */
+	private static function echoesIdentity( string $lowerPassword, string $email, string $displayName ): bool {
+		$email     = strtolower( trim( $email ) );
+		$localPart = '' !== $email ? (string) strstr( $email . '@', '@', true ) : '';
+
+		$fragments = [ $email, $localPart, strtolower( trim( $displayName ) ) ];
+
+		foreach ( $fragments as $fragment ) {
+			if ( strlen( $fragment ) >= self::IDENTITY_FRAGMENT_LENGTH && str_contains( $lowerPassword, $fragment ) ) {
+				return true;
+			}
+		}
+
+		return false;
+	}
+
+	/**
+	 * Passwords common enough that a guess costs nothing. Only entries at least
+	 * {@see MIN_LENGTH} long are worth listing — anything shorter is already
+	 * refused — so this is the long tail of the usual leaked-password lists
+	 * rather than the whole of it. zxcvbn in the browser covers the rest.
+	 *
+	 * @return list<string>
+	 */
+	private static function commonPasswords(): array {
+		return [
+			'password',
+			'password1',
+			'password12',
+			'password123',
+			'passw0rd',
+			'p@ssword',
+			'p@ssw0rd',
+			'12345678',
+			'123456789',
+			'1234567890',
+			'123123123',
+			'qwertyui',
+			'qwertyuiop',
+			'qwerty123',
+			'qwerty12',
+			'1qaz2wsx',
+			'zaq12wsx',
+			'iloveyou',
+			'princess',
+			'sunshine',
+			'football',
+			'baseball',
+			'basketball',
+			'superman',
+			'batman123',
+			'trustno1',
+			'welcome1',
+			'welcome123',
+			'letmein1',
+			'letmein123',
+			'admin123',
+			'administrator',
+			'abc12345',
+			'abcd1234',
+			'monkey123',
+			'dragon123',
+			'michael1',
+			'jennifer',
+			'starwars',
+			'computer',
+			'whatever',
+			'freedom1',
+			'changeme',
+			'secret123',
+			'login123',
+		];
+	}
+}

src/Auth/RegistrationLoginGate.php

@@ -11,12 +11,59 @@ namespace Unsupervised\Schedular\Auth;
  *
  * Both checks key solely off the pending user meta, so invite- and
  * admin-created students (which carry none of it) are unaffected.
+ *
+ * It also decides which new accounts land in that pending state to begin with —
+ * see {@see holdUnknownSignup()}, which closes the gap left by open registration
+ * turning the site's own `users_can_register` on.
  */
 class RegistrationLoginGate {
 
 	public function register(): void {
 		add_filter( 'wp_authenticate_user', [ $this, 'blockUnconfirmed' ], 10, 1 );
 		add_filter( 'user_has_cap', [ $this, 'withholdBookingWhilePending' ], 10, 4 );
+		add_action( 'user_register', [ $this, 'holdUnknownSignup' ], 10, 1 );
+	}
+
+	/**
+	 * Hold any student account created by an unauthenticated request that did not
+	 * come through the studio's own signup form.
+	 *
+	 * Enabling open registration switches the site's `users_can_register` on and
+	 * makes Student the default role for a new user, because that is what the
+	 * studio's registration page needs. But those are *site-wide* settings: they
+	 * also arm every other route into `wp_insert_user()` the site happens to have
+	 * — another plugin's signup form, a membership add-on — and an account minted
+	 * that way arrives holding `book_lesson`, with no email confirmed, no studio
+	 * approval, and no policy acceptance on file. It could book and be billed
+	 * immediately.
+	 *
+	 * So the state is decided here, at the one point every path passes through,
+	 * rather than trusted to whichever form happened to create the account:
+	 *
+	 * - **Not a student** — instructors and everyone else are none of this
+	 *   feature's business.
+	 * - **Created by staff** (anyone holding `manage_students`, which includes an
+	 *   administrator adding a user from wp-admin) — a deliberate act by someone
+	 *   who could have approved them anyway; approving their own creation is
+	 *   ceremony, so the account is left active.
+	 * - **Anything else** — held, and queued for review under **Pending
+	 *   Students**.
+	 *
+	 * The studio's own paths land in the last case and then say what they meant:
+	 * a self-signup calls {@see RegistrationStatus::markPending()} (which replaces
+	 * the hold with a real, unconfirmed pending state), and an invited student and
+	 * a guardian's child are approved outright by the code that creates them.
+	 */
+	public function holdUnknownSignup( int $userId ): void {
+		if ( $userId <= 0 || ! RoleManager::isStudent( $userId ) ) {
+			return;
+		}
+
+		if ( current_user_can( RoleManager::CAP_MANAGE_STUDENTS ) ) {
+			return;
+		}
+
+		RegistrationStatus::hold( $userId );
 	}
 
 	/**

src/Auth/RegistrationPage.php

@@ -4,6 +4,7 @@ declare(strict_types=1);
 namespace Unsupervised\Schedular\Auth;
 
 use Unsupervised\Schedular\GroupClass\GroupAccessRepository;
+use Unsupervised\Schedular\Guardian\GuardianService;
 use Unsupervised\Schedular\Payment\StudioSettings;
 use Unsupervised\Schedular\Policy\AcceptanceRepository;
 use Unsupervised\Schedular\Policy\Policy;
@@ -18,6 +19,15 @@ use Unsupervised\Schedular\Val;
 
 class RegistrationPage {
 
+	/** "Who are you registering?": the account holder, and nobody else. */
+	public const FOR_SELF = 'self';
+
+	/** Only other people — the account holder is not a student. */
+	public const FOR_STUDENTS = 'students';
+
+	/** The account holder *and* other people. */
+	public const FOR_BOTH = 'both';
+
 	/** Success signal: an invited student was created and logged in. */
 	private const RESULT_INVITE = 'invite';
 
@@ -47,6 +57,7 @@ class RegistrationPage {
 		private QuestionRepository $questions,
 		private AnswerRepository $answers,
 		private GroupAccessRepository $access,
+		private GuardianService $guardians,
 	) {}
 
 	/**
@@ -65,24 +76,21 @@ class RegistrationPage {
 		$registered = sanitize_key( Val::string( wp_unslash( $_GET['us_registered'] ?? '' ) ) );
 
 		if ( is_user_logged_in() ) {
-			if ( self::RESULT_INVITE === $registered ) {
-				// An invited student is done the moment they land here logged in,
-				// so this is where their "continue" link belongs. The sign-in-page
-				// fallback is deliberately not used: pointing someone who is
-				// already signed in at the login screen helps nobody.
-				$continue = $this->continueUrl( $this->successPageId( $atts ) );
-				$link     = null === $continue
-					? ''
-					: '<p><a href="' . esc_url( $continue ) . '">'
-						. esc_html__( 'Continue to your account', 'unsupervised-schedular' )
-						. '</a></p>';
+			// Both logged-in outcomes are dead ends without somewhere to go next,
+			// so both offer the same "continue" link to the configured page.
+			wp_enqueue_style( 'us-scheduler' );
+			$link = $this->continueLink( $atts );
 
+			if ( self::RESULT_INVITE === $registered ) {
+				// An invited student is done the moment they land here logged in.
 				return '<div class="us-register-form"><p class="us-success">'
 					. esc_html__( 'Your account has been created and you are now logged in.', 'unsupervised-schedular' )
 					. '</p>' . $link . '</div>';
 			}
 
-			return '<p>' . esc_html__( 'You already have an account and are logged in.', 'unsupervised-schedular' ) . '</p>';
+			return '<div class="us-register-form"><p>'
+				. esc_html__( 'You already have an account and are logged in.', 'unsupervised-schedular' )
+				. '</p>' . $link . '</div>';
 		}
 
 		// phpcs:ignore WordPress.Security.NonceVerification.Recommended -- token identifies the invite; the form submit is nonce-checked in maybeHandleSubmit.
@@ -116,9 +124,38 @@ class RegistrationPage {
 		$canRegister       = $open || $inviteValid;
 		$inviteOnlyMessage = $this->inviteOnlyMessage( $atts );
 
-		// The two-step script only matters when there is a second step to reveal.
-		if ( $canRegister && '' === $successType && [] !== $accountQuestions ) {
+		// The signup form carries the same policy-acceptance markup as the booking
+		// gate, so it needs the plugin stylesheet that formats it.
+		wp_enqueue_style( 'us-scheduler' );
+
+		// The script drives the parent/guardian section (revealing it, taking the
+		// account holder's own panel out of play, and cloning the child block for
+		// "add another") and the password meter, so it is needed whenever the form
+		// itself is on screen.
+		if ( $canRegister && '' === $successType ) {
 			wp_enqueue_script( 'us-scheduler-register' );
+
+			// The browser gate reads the same numbers the server enforces, so the
+			// two cannot drift into disagreeing about what it accepted.
+			wp_localize_script(
+				'us-scheduler-register',
+				'usSchedulerPassword',
+				[
+					'minLength' => PasswordPolicy::MIN_LENGTH,
+					'minScore'  => PasswordPolicy::MIN_SCORE,
+					'strings'   => [
+						'short'    => sprintf(
+							/* translators: %d: minimum number of characters. */
+							__( 'At least %d characters, please.', 'unsupervised-schedular' ),
+							PasswordPolicy::MIN_LENGTH
+						),
+						'veryWeak' => __( 'Too weak — a stranger could guess this.', 'unsupervised-schedular' ),
+						'weak'     => __( 'Still too weak. Try a longer phrase.', 'unsupervised-schedular' ),
+						'medium'   => __( 'Good enough.', 'unsupervised-schedular' ),
+						'strong'   => __( 'Strong password.', 'unsupervised-schedular' ),
+					],
+				]
+			);
 		}
 
 		ob_start();
@@ -243,10 +280,6 @@ class RegistrationPage {
 		$password    = Val::string( wp_unslash( $_POST['password'] ?? '' ) );
 		$displayName = sanitize_text_field( Val::string( wp_unslash( $_POST['display_name'] ?? '' ) ) );
 
-		if ( strlen( $password ) < 8 ) {
-			return esc_html__( 'Please choose a password of at least 8 characters.', 'unsupervised-schedular' );
-		}
-
 		// The email is fixed by a personal invite; group-link signups and
 		// self-signups supply their own.
 		if ( $inviteValid && ! $invite->isGroup() ) {
@@ -258,6 +291,15 @@ class RegistrationPage {
 			}
 		}
 
+		// After the email, so the password can be checked against it. The browser
+		// scores the password with zxcvbn and refuses to submit a weak one, but
+		// that is advice a client can decline to take — this is the check that
+		// holds. See PasswordPolicy for why the two halves differ.
+		$passwordError = PasswordPolicy::validate( $password, $email, $displayName );
+		if ( null !== $passwordError ) {
+			return esc_html( $passwordError );
+		}
+
 		$policyForms = $this->signupPolicies();
 		// phpcs:ignore WordPress.Security.ValidatedSanitizedInput.MissingUnslash, WordPress.Security.ValidatedSanitizedInput.InputNotSanitized -- each element is coerced to a positive int in the array_map callback; slashes cannot survive integer coercion.
 		$accepted = array_map( static fn( mixed $v ): int => absint( Val::int( $v ) ), (array) ( $_POST['accept'] ?? [] ) );
@@ -269,27 +311,94 @@ class RegistrationPage {
 			}
 		}
 
-		// Account-signup questions (step two) — validate before creating the user so
-		// a missing required answer never leaves a half-registered account behind.
 		$accountQuestions = $this->questions->findByScope( Question::SCOPE_ACCOUNT, activeOnly: true );
-		$answers          = $this->submittedAnswers();
 
-		foreach ( $accountQuestions as $question ) {
-			if ( $question->isRequired && '' === trim( (string) ( $answers[ (int) $question->id ] ?? '' ) ) ) {
-				return esc_html__( 'Please answer all required registration questions.', 'unsupervised-schedular' );
+		// The account-signup questions describe a *student* — instrument, level,
+		// school — not whoever holds the account. So they are asked of each
+		// student being added, and of the account holder only when they are a
+		// student themselves. "Both" is both.
+		$registeringFor = $this->submittedRegisteringFor();
+
+		// A "students only" question is never put to the account holder, so it is
+		// dropped before their answers are validated or stored — a crafted post
+		// cannot file one against them.
+		$selfQuestions = array_values(
+			array_filter( $accountQuestions, static fn( Question $question ): bool => $question->askedOfSelf() )
+		);
+
+		// "Students" and "both" collect student blocks; only "self" does not.
+		$isGuardian = self::FOR_SELF !== $registeringFor;
+
+		// "Self" and "both" make the account holder a student, so they answer the
+		// questions in their own right. Only a pure guardian does not.
+		$asksSelf = self::FOR_STUDENTS !== $registeringFor;
+
+		$children = $isGuardian ? $this->submittedChildren() : [];
+		$answers  = $asksSelf ? $this->submittedAnswers() : [];
+
+		// phpcs:ignore WordPress.Security.NonceVerification.Missing -- verified by the caller.
+		$birthYear = $asksSelf ? trim( sanitize_text_field( Val::string( wp_unslash( $_POST['birth_year'] ?? '' ) ) ) ) : '';
+
+		// Everything is validated before a single user is created, so a bad child
+		// block never leaves a half-registered family behind.
+		if ( $isGuardian && [] === $children ) {
+			return esc_html__( 'Please add at least one student, or choose "Just myself" instead.', 'unsupervised-schedular' );
+		}
+
+		// Name and birth year are required per student, and are checked here for
+		// the same reason the questions below are: the child blocks are hidden
+		// until the guardian box is ticked, so the browser cannot be asked to
+		// enforce them without blocking a signup that has no children at all.
+		foreach ( $children as $child ) {
+			if ( '' === $child['name'] ) {
+				return esc_html__( 'Please give each student a name.', 'unsupervised-schedular' );
 			}
+
+			if ( 0 === GuardianService::normaliseBirthYear( $child['birth_year'] ) ) {
+				return esc_html( GuardianService::birthYearError() );
+			}
+		}
+
+		// Checked as two passes rather than one so the message can say *whose*
+		// answers are missing — under "both" a single message could not.
+		foreach ( array_column( $children, 'answers' ) as $set ) {
+			if ( $this->hasUnansweredRequired( $accountQuestions, $set, forChild: true ) ) {
+				return esc_html__( 'Please answer all required registration questions for each student.', 'unsupervised-schedular' );
+			}
+		}
+
+		// The account holder is a student too under "self" and "both", so the same
+		// birth year every other student gives is asked of them — and checked
+		// here rather than left to the browser, for the same reason as the
+		// children's: the panel is hidden for a pure guardian, so `required`
+		// alone cannot be trusted to have applied.
+		if ( $asksSelf && 0 === GuardianService::normaliseBirthYear( $birthYear ) ) {
+			return esc_html( GuardianService::ownBirthYearError() );
+		}
+
+		if ( $asksSelf && $this->hasUnansweredRequired( $selfQuestions, $answers ) ) {
+			return esc_html__( 'Please answer all required registration questions.', 'unsupervised-schedular' );
 		}
 
 		if ( email_exists( $email ) ) {
 			return esc_html__( 'An account already exists for this email.', 'unsupervised-schedular' );
 		}
 
+		// Nickname as well as display name. WordPress defaults nickname to
+		// `user_login`, which here is the email address — so without this the
+		// account's own address became its nickname, and every screen that names
+		// a person through `UserName` showed the address instead of the name they
+		// had just typed. `UserName` copes with the accounts already created that
+		// way; this stops any more of them.
+		$name = '' !== $displayName ? $displayName : $email;
+
 		$userId = wp_insert_user(
 			[
 				'user_login'   => $email,
 				'user_email'   => $email,
 				'user_pass'    => $password,
-				'display_name' => '' !== $displayName ? $displayName : $email,
+				'display_name' => $name,
+				'nickname'     => $name,
 				'role'         => $inviteValid ? $invite->role : RoleManager::STUDENT,
 			]
 		);
@@ -298,10 +407,37 @@ class RegistrationPage {
 			return esc_html__( 'Could not create the account. Please contact the studio.', 'unsupervised-schedular' );
 		}
 
-		$this->recordAcceptances( $policyForms, (int) $userId );
-		$this->recordAnswers( $accountQuestions, $answers, (int) $userId );
+		$this->recordAcceptances( $policyForms, (int) $userId, (int) $userId );
+
+		// Only "students" means the account holder is not a student themselves;
+		// "both" registers them alongside the people they book for.
+		$this->guardians->setGuardianOnly( (int) $userId, self::FOR_STUDENTS === $registeringFor );
+
+		if ( $asksSelf ) {
+			$this->guardians->setBirthYear( (int) $userId, $birthYear );
+		}
+
+		if ( $isGuardian ) {
+			$failure = $this->createChildren( $children, $accountQuestions, $policyForms, (int) $userId );
+			if ( '' !== $failure ) {
+				return $failure;
+			}
+		}
+
+		// After the children, so a rollback that deletes this account cannot
+		// leave its answers behind pointing at a user that no longer exists.
+		if ( $asksSelf ) {
+			$this->recordAnswers( $selfQuestions, $answers, (int) $userId );
+		}
 
 		if ( $inviteValid && ! $invite->isGroup() ) {
+			// An invited student is pre-approved by the invitation itself — the
+			// studio picked the address and sent the link. Clears the hold the
+			// registration gate puts on every student account created by an
+			// unauthenticated request ({@see RegistrationLoginGate::holdUnknownSignup()}),
+			// which would otherwise leave them signed in but unable to book.
+			RegistrationStatus::approve( (int) $userId );
+
 			$this->invites->markAccepted( (int) $invite->id, (int) $userId );
 
 			// A personal invite may carry a group-class grant (invited by email);
@@ -349,6 +485,40 @@ class RegistrationPage {
 		return $this->continueUrl( $loginPageId ) ?? wp_login_url();
 	}
 
+	/**
+	 * The "continue" paragraph shown to a logged-in visitor, or an empty string
+	 * when no destination page is configured. The link names the chosen page, so
+	 * the visitor knows where it goes before clicking; an untitled page falls
+	 * back to generic wording rather than reading "Continue to ".
+	 *
+	 * The sign-in-page fallback {@see loginUrl()} applies is deliberately not
+	 * used here: pointing someone who is already signed in at the login screen is
+	 * the same dead end with extra steps, so no link is better than that one.
+	 *
+	 * @param array<int|string, mixed> $atts
+	 */
+	private function continueLink( array $atts ): string {
+		$pageId   = $this->successPageId( $atts );
+		$continue = $this->continueUrl( $pageId );
+
+		if ( null === $continue ) {
+			return '';
+		}
+
+		$title = trim( Val::string( get_the_title( $pageId ) ) );
+		$label = '' === $title
+			? esc_html__( 'Continue to your account', 'unsupervised-schedular' )
+			: esc_html(
+				sprintf(
+					/* translators: %s: title of the page the student continues to. */
+					__( 'Continue to %s', 'unsupervised-schedular' ),
+					$title
+				)
+			);
+
+		return '<p><a href="' . esc_url( $continue ) . '">' . $label . '</a></p>';
+	}
+
 	/**
 	 * The chosen post-registration page's URL, or null when none is configured
 	 * (or it has since been deleted). Unlike {@see loginUrl()} this has no
@@ -405,6 +575,131 @@ class RegistrationPage {
 		return add_query_arg( 'us_confirm', rawurlencode( $rawToken ), $base );
 	}
 
+	/**
+	 * Whether any required question in `$questions` is left blank in `$answers`.
+	 *
+	 * `$forChild` picks which required-ness applies: a question can be optional
+	 * for the account holder answering about themselves and still required of
+	 * every student they register.
+	 *
+	 * @param list<Question>      $questions
+	 * @param array<int, string>  $answers
+	 */
+	private function hasUnansweredRequired( array $questions, array $answers, bool $forChild = false ): bool {
+		foreach ( $questions as $question ) {
+			$required = $forChild ? $question->isRequiredForChild() : $question->isRequiredForSelf();
+
+			if ( $required && '' === trim( (string) ( $answers[ (int) $question->id ] ?? '' ) ) ) {
+				return true;
+			}
+		}
+
+		return false;
+	}
+
+	/**
+	 * Who this signup is for: {@see FOR_SELF}, {@see FOR_STUDENTS} or
+	 * {@see FOR_BOTH}.
+	 *
+	 * Anything unrecognised — including a form posted without the field at all —
+	 * falls back to "just myself", the choice that collects the least and grants
+	 * the least. A missing radio must not be read as "register these children".
+	 */
+	private function submittedRegisteringFor(): string {
+		// The submit nonce is verified by the caller before this runs.
+		// phpcs:ignore WordPress.Security.NonceVerification.Missing
+		$value = sanitize_key( Val::string( wp_unslash( $_POST['us_registering_for'] ?? '' ) ) );
+
+		return in_array( $value, [ self::FOR_STUDENTS, self::FOR_BOTH ], true ) ? $value : self::FOR_SELF;
+	}
+
+	/**
+	 * The child blocks submitted with a guardian signup, as
+	 * `children[<n>][name|birth_year|answers]`.
+	 *
+	 * An **entirely empty** block is dropped rather than rejected — the form always
+	 * renders one spare for "add another", and an untouched spare is not a mistake
+	 * the guardian needs telling about. A block with anything at all filled in is
+	 * kept, so {@see handleSubmit()} can reject it for the missing name or birth
+	 * year rather than silently discarding what they typed.
+	 *
+	 * @return list<array{name: string, birth_year: string, answers: array<int, string>}>
+	 */
+	private function submittedChildren(): array {
+		// The submit nonce is verified by the caller before this runs.
+		// phpcs:ignore WordPress.Security.NonceVerification.Missing, WordPress.Security.ValidatedSanitizedInput.InputNotSanitized, WordPress.Security.ValidatedSanitizedInput.MissingUnslash -- each field is unslashed and sanitized below.
+		$raw = $_POST['children'] ?? [];
+		if ( ! is_array( $raw ) ) {
+			return [];
+		}
+
+		$out = [];
+		foreach ( $raw as $child ) {
+			if ( ! is_array( $child ) ) {
+				continue;
+			}
+
+			$name      = trim( sanitize_text_field( Val::string( wp_unslash( $child['name'] ?? '' ) ) ) );
+			$birthYear = trim( sanitize_text_field( Val::string( wp_unslash( $child['birth_year'] ?? '' ) ) ) );
+
+			$answers = [];
+			foreach ( (array) ( $child['answers'] ?? [] ) as $questionId => $value ) {
+				$answers[ absint( Val::int( $questionId ) ) ] = sanitize_textarea_field( Val::string( wp_unslash( $value ) ) );
+			}
+
+			if ( '' === $name && '' === $birthYear && '' === trim( implode( '', $answers ) ) ) {
+				continue;
+			}
+
+			$out[] = [
+				'name'       => $name,
+				'birth_year' => $birthYear,
+				'answers'    => $answers,
+			];
+		}
+
+		return $out;
+	}
+
+	/**
+	 * Create each child of a guardian signup: the login-less account, its answers
+	 * to the per-child questions, and a signup-policy acceptance recorded against
+	 * the child but attributed to the guardian who agreed for them.
+	 *
+	 * Returns an empty string on success, or an error message after rolling the
+	 * whole family back — every child created so far *and* the guardian. A signup
+	 * that half-worked would leave the guardian with an account they cannot
+	 * re-register and children they never confirmed, so it is undone entirely and
+	 * they simply try again.
+	 *
+	 * @param list<array{name: string, birth_year: string, answers: array<int, string>}>           $children
+	 * @param list<Question>                                                                       $questions
+	 * @param list<array{policy: Policy, version: \Unsupervised\Schedular\Policy\PolicyVersion}>   $policyForms
+	 */
+	private function createChildren( array $children, array $questions, array $policyForms, int $guardianId ): string {
+		$created = [];
+
+		foreach ( $children as $child ) {
+			$childId = $this->guardians->createChild( $guardianId, $child['name'], $child['birth_year'] );
+
+			if ( $childId instanceof \WP_Error ) {
+				foreach ( $created as $id ) {
+					$this->guardians->deleteUser( $id );
+				}
+				$this->guardians->deleteUser( $guardianId );
+
+				return esc_html__( 'Could not create the account. Please contact the studio.', 'unsupervised-schedular' );
+			}
+
+			$created[] = $childId;
+
+			$this->recordAnswers( $questions, $child['answers'], $childId );
+			$this->recordAcceptances( $policyForms, $childId, $guardianId );
+		}
+
+		return '';
+	}
+
 	/**
 	 * The account-question answers submitted with the form, keyed by question id.
 	 *
@@ -454,9 +749,15 @@ class RegistrationPage {
 	/**
 	 * Record account-time acceptances for each signup policy version.
 	 *
+	 * `$userId` is who the policy binds — the guardian for their own acceptance,
+	 * or the child for one accepted on their behalf — and `$acceptedBy` is who
+	 * actually ticked the box. Recording both is what makes the row legally
+	 * meaningful: "guardian X agreed to version N for child Y, at this time, from
+	 * this IP".
+	 *
 	 * @param list<array{policy: Policy, version: \Unsupervised\Schedular\Policy\PolicyVersion}> $policyForms
 	 */
-	private function recordAcceptances( array $policyForms, int $userId ): void {
+	private function recordAcceptances( array $policyForms, int $userId, int $acceptedBy ): void {
 		// phpcs:ignore WordPress.Security.ValidatedSanitizedInput.InputNotSanitized, WordPress.Security.ValidatedSanitizedInput.MissingUnslash -- IP is stored verbatim for audit.
 		$ip = sanitize_text_field( Val::string( wp_unslash( $_SERVER['REMOTE_ADDR'] ?? '' ) ) );
 
@@ -467,6 +768,7 @@ class RegistrationPage {
 					studentId:        $userId,
 					registrationType: PolicyAcceptance::REG_ACCOUNT,
 					registrationId:   $userId,
+					acceptedBy:       $acceptedBy,
 					ipAddress:        '' !== $ip ? $ip : null,
 				)
 			);

src/Auth/RegistrationStatus.php

@@ -58,6 +58,11 @@ class RegistrationStatus {
 		$rawToken = wp_generate_password( 32, false );
 
 		update_user_meta( $userId, self::META_AWAITING_APPROVAL, '1' );
+		// Explicitly *un*confirmed. The account may already have been held by
+		// {@see hold()} on `user_register` — which counts the email as confirmed,
+		// having never asked for confirmation — and this signup did ask, so the
+		// answer has to be waited for rather than inherited.
+		delete_user_meta( $userId, self::META_EMAIL_CONFIRMED );
 		update_user_meta( $userId, self::META_CONFIRM_TOKEN, self::hashToken( $rawToken ) );
 		update_user_meta(
 			$userId,
@@ -72,6 +77,21 @@ class RegistrationStatus {
 		return $rawToken;
 	}
 
+	/**
+	 * Hold a student account that appeared without going through the studio's own
+	 * signup form — see {@see RegistrationLoginGate::holdUnknownSignup()}.
+	 *
+	 * The email counts as confirmed, because nobody ever asked for confirmation
+	 * and there is no token to answer with: blocking the login outright would
+	 * strand the account with no way forward. What the hold actually withholds is
+	 * the booking capability, until a studio admin approves them from **Pending
+	 * Students** — the same queue, and the same decision, as a self-signup.
+	 */
+	public static function hold( int $userId ): void {
+		update_user_meta( $userId, self::META_AWAITING_APPROVAL, '1' );
+		update_user_meta( $userId, self::META_EMAIL_CONFIRMED, '1' );
+	}
+
 	/**
 	 * Mark the account's email confirmed and discard the (now spent) token. The
 	 * account stays awaiting approval.

src/Auth/RoleManager.php

@@ -60,6 +60,27 @@ class RoleManager {
 		self::CAP_EXPORT_PAYMENTS,
 	];
 
+	/**
+	 * Whether a user account is a student the studio may act for.
+	 *
+	 * Deliberately the role and not the `book_lesson` capability: that capability
+	 * is withheld from a guardian's child ({@see \Unsupervised\Schedular\Guardian\ChildLoginGate})
+	 * and from a self-signup still awaiting approval
+	 * ({@see \Unsupervised\Schedular\Auth\RegistrationLoginGate}), so that neither
+	 * can book or enrol *in their own name*. Staff booking or enrolling on their
+	 * behalf is the case those restrictions exist to leave open — and for a child,
+	 * whose account is never signed in to, it is the only route there is.
+	 *
+	 * Use this for every "may the studio register this person?" check, so the
+	 * pickers staff choose from and the guards that vet their choice cannot drift
+	 * into offering someone who is then refused.
+	 */
+	public static function isStudent( int $userId ): bool {
+		$user = $userId > 0 ? get_userdata( $userId ) : false;
+
+		return $user instanceof \WP_User && in_array( self::STUDENT, (array) $user->roles, true );
+	}
+
 	public function __construct( private AccessSettings $access = new AccessSettings() ) {}
 
 	public function register(): void {

src/Auth/StudentController.php

@@ -8,6 +8,8 @@ use Unsupervised\Schedular\Booking\BookingRepository;
 use Unsupervised\Schedular\Booking\Lesson;
 use Unsupervised\Schedular\GroupClass\Enrollment;
 use Unsupervised\Schedular\GroupClass\EnrollmentRepository;
+use Unsupervised\Schedular\GroupClass\SessionSchedule;
+use Unsupervised\Schedular\Guardian\GuardianService;
 use Unsupervised\Schedular\Offering\OfferingRepository;
 use Unsupervised\Schedular\Payment\BillingMethodResolver;
 use Unsupervised\Schedular\Payment\Payment;
@@ -23,6 +25,8 @@ class StudentController {
 		private BillingMethodResolver $resolver,
 		private StudentHistory $history,
 		private StudentActions $actions,
+		private GuardianService $guardians,
+		private SessionSchedule $sessions,
 	) {}
 
 	public function renderPage(): void {
@@ -43,10 +47,14 @@ class StudentController {
 			fn( \WP_User $user ): array => [
 				'id'         => (int) $user->ID,
 				'name'       => $user->display_name,
-				'email'      => $user->user_email,
+				// A child's own address is an undeliverable placeholder, so the
+				// list shows the guardian's — the address an admin would use.
+				'email'      => $this->guardians->contactFor( (int) $user->ID )['email'],
 				'registered' => $user->user_registered,
 				'upcoming'   => $this->bookings->countUpcomingForStudent( (int) $user->ID ),
 				'enrolments' => $this->enrollments->countActiveForStudent( (int) $user->ID ),
+				'guardian'   => $this->guardians->guardianOf( (int) $user->ID ),
+				'children'   => $this->guardians->children( (int) $user->ID ),
 			],
 			array_filter(
 				get_users(
@@ -128,7 +136,15 @@ class StudentController {
 			$this->bookings->findByStudent( (int) $student->ID )
 		);
 
-		$schedule = StudentSchedule::partition( $rows, $now );
+		// Group classes join the upcoming table so "what is this student booked
+		// into next week?" has one answer instead of two. Only their upcoming
+		// sessions are added: the enrolment table below already records the whole
+		// history, and a term's worth of past dates would bury the lessons under
+		// "Past lessons".
+		$schedule = StudentSchedule::partition(
+			array_merge( $rows, $this->groupSessionRows( (int) $student->ID, $now ) ),
+			$now
+		);
 		$upcoming = $schedule['upcoming'];
 		$past     = $schedule['past'];
 
@@ -150,10 +166,19 @@ class StudentController {
 		$intake           = $this->history->intakeAnswers( (int) $student->ID );
 		$payments         = $canBilling ? $this->history->payments( (int) $student->ID ) : [];
 		$credits          = $canBilling ? $this->history->credits( (int) $student->ID ) : [];
-		$creditBalance    = $canBilling ? $this->history->creditBalance( (int) $student->ID ) : 0.0;
 		$creditCurrency   = $this->creditCurrency( $credits );
 
-		$backUrl = admin_url( 'admin.php?page=us-students' );
+		// The family panel, and the account whose balance actually settles this
+		// student's charges — a child's is their guardian's, so showing the
+		// child's own (always empty) balance would be actively misleading.
+		$guardian = $this->guardians->guardianOf( (int) $student->ID );
+		$children = $this->guardians->children( (int) $student->ID );
+		$payer    = $this->guardians->contactFor( (int) $student->ID );
+
+		$creditBalance = $canBilling ? $this->history->creditBalance( $payer['id'] ) : 0.0;
+
+		$backUrl  = admin_url( 'admin.php?page=us-students' );
+		$pageSlug = 'us-students';
 		include USC_PLUGIN_DIR . 'templates/admin/student-detail.php';
 	}
 
@@ -179,6 +204,8 @@ class StudentController {
 
 		return [
 			'id'         => (int) $lesson->id,
+			'kind'       => 'lesson',
+			'schedule'   => null,
 			'start_dt'   => $slot ? $slot->startDt : '',
 			'end_dt'     => $slot ? $slot->endDt : '',
 			'offering'   => $offering ? $offering->title : '—',
@@ -186,4 +213,34 @@ class StudentController {
 			'status'     => $lesson->status,
 		];
 	}
+
+	/**
+	 * The student's upcoming group-class sessions, shaped like the lesson rows
+	 * they sit beside. `kind` is what keeps the table honest: a session is a date
+	 * in a term, not a booked slot, so the row offers no "Cancel" — withdrawing
+	 * is done from the enrolment table, which removes the whole class at once.
+	 *
+	 * @return list<array<string, mixed>>
+	 */
+	private function groupSessionRows( int $studentId, string $now ): array {
+		return array_map(
+			static function ( array $session ): array {
+				$instructor = get_userdata( $session['instructor_id'] );
+
+				return [
+					'id'         => $session['enrollment_id'],
+					'kind'       => SessionSchedule::KIND,
+					'start_dt'   => $session['start_dt'],
+					'end_dt'     => $session['end_dt'],
+					// Set when the class has no time to put on a clock; shown in the
+					// When column in place of a date. See GroupClass\SessionSchedule.
+					'schedule'   => $session['schedule'],
+					'offering'   => $session['offering_title'],
+					'instructor' => $instructor ? $instructor->display_name : (string) $session['instructor_id'],
+					'status'     => $session['status'],
+				];
+			},
+			$this->sessions->upcomingForStudent( $studentId, $now )
+		);
+	}
 }

src/Auth/UserName.php

@@ -5,15 +5,25 @@ namespace Unsupervised\Schedular\Auth;
 
 /**
  * Resolves a person's public-facing name for display. Prefers their real name
- * (first + last), then their nickname — deliberately avoiding the account's
- * login/username, which `display_name` can otherwise expose.
+ * (first + last), then their nickname, then the display name — skipping any of
+ * them that is really the account's login or email address, which is the thing
+ * this class exists to keep off the screen.
  */
 class UserName {
 
 	/**
-	 * The display name for a user: "First Last" when a real name is set,
-	 * otherwise the WordPress nickname. Falls back to the numeric id (or an empty
-	 * string when none is given) when the user cannot be loaded or has no name.
+	 * The display name for a user: "First Last" when a real name is set, else the
+	 * first of nickname / display name that is an actual name. Falls back to the
+	 * numeric id (or an empty string when none is given) when the user cannot be
+	 * loaded or has nothing but identifiers on file.
+	 *
+	 * Display name is consulted at all because WordPress defaults **nickname** to
+	 * `user_login`, and signup uses the email address as the login — so a
+	 * self-registered account carries its own email as its nickname, and every
+	 * screen naming that person showed the address instead. The name they typed
+	 * was on file the whole time, in `display_name`. (Accounts created by a
+	 * guardian never hit this: `GuardianService::createChild()` sets `nickname`
+	 * outright, which is why children read correctly and their parents did not.)
 	 */
 	public static function format( ?\WP_User $user, int $fallbackId = 0 ): string {
 		if ( ! $user instanceof \WP_User ) {
@@ -25,11 +35,25 @@ class UserName {
 			return $full;
 		}
 
-		$nickname = trim( $user->nickname );
-		if ( '' !== $nickname ) {
-			return $nickname;
+		foreach ( [ $user->nickname, $user->display_name ] as $candidate ) {
+			$candidate = trim( (string) $candidate );
+
+			if ( '' !== $candidate && ! self::isIdentifier( $candidate, $user ) ) {
+				return $candidate;
+			}
 		}
 
 		return $fallbackId > 0 ? (string) $fallbackId : '';
 	}
+
+	/**
+	 * Whether a candidate name is really the account's login or email address
+	 * wearing a name's clothing — the case this class must never pass through.
+	 */
+	private static function isIdentifier( string $candidate, \WP_User $user ): bool {
+		$candidate = strtolower( $candidate );
+
+		return strtolower( (string) $user->user_login ) === $candidate
+			|| strtolower( (string) $user->user_email ) === $candidate;
+	}
 }

src/Availability/AvailabilityController.php

@@ -13,6 +13,7 @@ class AvailabilityController {
 	public function __construct(
 		private AvailabilityRepository $repository,
 		private OfferingRepository $offerings,
+		private WindowValidator $validator,
 	) {}
 
 	public function renderPage(): void {
@@ -21,9 +22,11 @@ class AvailabilityController {
 		}
 
 		$instructorId = get_current_user_id();
+		$notice       = '';
+		$error        = '';
 
 		if ( isset( $_POST['usc_action'] ) && check_admin_referer( 'usc_availability_action' ) ) {
-			$this->handleFormAction( $instructorId );
+			[ $notice, $error ] = $this->handleFormAction( $instructorId );
 		}
 
 		$slots           = $this->repository->findByInstructor( $instructorId );
@@ -44,72 +47,144 @@ class AvailabilityController {
 		include USC_PLUGIN_DIR . 'templates/admin/availability.php';
 	}
 
-	private function handleFormAction( int $instructorId ): void {
+	/**
+	 * Run the submitted action and report what happened. Every branch returns a
+	 * message: a form that silently reloads leaves the instructor unable to tell
+	 * "saved 41 slots" from "saved nothing".
+	 *
+	 * @return array{string, string} Success notice and error message; each is
+	 *                               empty when it does not apply.
+	 */
+	private function handleFormAction( int $instructorId ): array {
 		// Nonce is verified by the caller (renderPage) before this method runs.
 		// phpcs:disable WordPress.Security.NonceVerification.Missing
 		$action = sanitize_key( Val::string( wp_unslash( $_POST['usc_action'] ?? '' ) ) );
 
 		if ( 'add' === $action ) {
-			$this->addSlot( $instructorId );
+			return $this->addSlot( $instructorId );
 		}
 
 		if ( 'delete' === $action ) {
-			$this->deleteOwnSlot( absint( Val::int( $_POST['slot_id'] ?? 0 ) ), $instructorId );
+			return $this->deleteOwnSlot( absint( Val::int( $_POST['slot_id'] ?? 0 ) ), $instructorId )
+				? [ __( 'Availability slot deleted.', 'unsupervised-schedular' ), '' ]
+				: [ '', __( 'That slot could not be deleted. It may already be booked, or belong to someone else.', 'unsupervised-schedular' ) ];
 		}
 
 		if ( 'bulk_delete' === $action ) {
 			// The array itself carries no data; each element is coerced and
 			// absint-sanitized individually below.
 			// phpcs:ignore WordPress.Security.ValidatedSanitizedInput
-			$rawIds = $_POST['slot_ids'] ?? [];
+			$rawIds  = $_POST['slot_ids'] ?? [];
+			$deleted = 0;
+			$failed  = 0;
+
 			foreach ( is_array( $rawIds ) ? $rawIds : [] as $rawId ) {
-				$this->deleteOwnSlot( absint( Val::int( $rawId ) ), $instructorId );
+				if ( $this->deleteOwnSlot( absint( Val::int( $rawId ) ), $instructorId ) ) {
+					++$deleted;
+					continue;
+				}
+
+				++$failed;
 			}
+
+			return $this->bulkDeleteResult( $deleted, $failed );
 		}
 		// phpcs:enable WordPress.Security.NonceVerification.Missing
+
+		return [ '', '' ];
+	}
+
+	/**
+	 * Wording for a bulk delete, which can partly succeed.
+	 *
+	 * @return array{string, string}
+	 */
+	private function bulkDeleteResult( int $deleted, int $failed ): array {
+		$notice = $deleted > 0
+			? sprintf(
+				/* translators: %d: number of availability slots deleted. */
+				_n( '%d slot deleted.', '%d slots deleted.', $deleted, 'unsupervised-schedular' ),
+				$deleted
+			)
+			: '';
+
+		$error = $failed > 0
+			? sprintf(
+				/* translators: %d: number of slots that could not be deleted. */
+				_n(
+					'%d slot could not be deleted — it may already be booked.',
+					'%d slots could not be deleted — they may already be booked.',
+					$failed,
+					'unsupervised-schedular'
+				),
+				$failed
+			)
+			: '';
+
+		if ( 0 === $deleted && 0 === $failed ) {
+			$error = __( 'No slots were selected.', 'unsupervised-schedular' );
+		}
+
+		return [ $notice, $error ];
 	}
 
 	/**
 	 * Delete a slot only when it exists and belongs to the given instructor.
-	 * The repository additionally refuses to delete booked slots.
+	 * The repository additionally refuses to delete booked slots. Returns whether
+	 * the row actually went away.
 	 */
-	private function deleteOwnSlot( int $slotId, int $instructorId ): void {
+	private function deleteOwnSlot( int $slotId, int $instructorId ): bool {
 		if ( $slotId <= 0 ) {
-			return;
+			return false;
 		}
 
 		$slot = $this->repository->findById( $slotId );
-		if ( $slot && $slot->instructorId === $instructorId ) {
-			$this->repository->delete( $slotId );
+
+		if ( null === $slot || $slot->instructorId !== $instructorId ) {
+			return false;
 		}
+
+		return $this->repository->delete( $slotId );
 	}
 
-	private function addSlot( int $instructorId ): void {
+	/**
+	 * Validate and persist a submitted window.
+	 *
+	 * @return array{string, string}
+	 */
+	private function addSlot( int $instructorId ): array {
 		// phpcs:disable WordPress.Security.NonceVerification.Missing
-		$startDt = AvailabilitySlot::normalizeDateTime( sanitize_text_field( Val::string( wp_unslash( $_POST['start_dt'] ?? '' ) ) ) );
-		$endDt   = AvailabilitySlot::normalizeDateTime( sanitize_text_field( Val::string( wp_unslash( $_POST['end_dt'] ?? '' ) ) ) );
-
-		// A window must start and end on the same day (weekly repeat covers longer
-		// ranges) and fit at least one lesson; it is stored as lesson-length slots.
-		if ( null === $startDt || null === $endDt || $endDt <= $startDt || substr( $startDt, 0, 10 ) !== substr( $endDt, 0, 10 ) ) {
-			return;
-		}
-
-		$offeringId = absint( Val::int( $_POST['offering_id'] ?? 0 ) );
-		$duration   = absint( Val::int( $_POST['duration_minutes'] ?? 0 ) );
-
-		$window = new AvailabilitySlot(
-			instructorId:    $instructorId,
-			startDt:         $startDt,
-			endDt:           $endDt,
-			durationMinutes: $duration > 0 ? $duration : 60,
-			offeringId:      $offeringId > 0 ? $offeringId : null,
+		$window = $this->validator->validate(
+			$instructorId,
+			sanitize_text_field( Val::string( wp_unslash( $_POST['start_dt'] ?? '' ) ) ),
+			sanitize_text_field( Val::string( wp_unslash( $_POST['end_dt'] ?? '' ) ) ),
+			absint( Val::int( $_POST['duration_minutes'] ?? 0 ) ),
+			absint( Val::int( $_POST['offering_id'] ?? 0 ) ),
 		);
 
+		if ( $window instanceof \WP_Error ) {
+			return [ '', $window->get_error_message() ];
+		}
+
 		$recurrence = sanitize_key( Val::string( wp_unslash( $_POST['recurrence'] ?? 'single' ) ) );
 		$weeks      = absint( Val::int( $_POST['weeks'] ?? 1 ) );
-
-		$this->repository->createFromWindow( $window, 'weekly' === $recurrence, $weeks );
 		// phpcs:enable WordPress.Security.NonceVerification.Missing
+
+		$ids = $this->repository->createFromWindow( $window, 'weekly' === $recurrence, $weeks );
+
+		// The window was valid, so it split into at least one slot — an empty
+		// result means every insert failed.
+		if ( [] === $ids ) {
+			return [ '', __( 'The availability could not be saved. Please try again.', 'unsupervised-schedular' ) ];
+		}
+
+		return [
+			sprintf(
+				/* translators: %d: number of bookable slots created. */
+				_n( 'Added %d bookable slot.', 'Added %d bookable slots.', count( $ids ), 'unsupervised-schedular' ),
+				count( $ids )
+			),
+			'',
+		];
 	}
 }

src/Availability/AvailabilityEndpoint.php

@@ -4,14 +4,13 @@ declare(strict_types=1);
 namespace Unsupervised\Schedular\Availability;
 
 use Unsupervised\Schedular\Auth\RoleManager;
-use Unsupervised\Schedular\Offering\OfferingRepository;
 use Unsupervised\Schedular\Val;
 
 class AvailabilityEndpoint {
 
 	public function __construct(
 		private AvailabilityRepository $repository,
-		private OfferingRepository $offerings,
+		private WindowValidator $validator,
 	) {}
 
 	/**
@@ -113,40 +112,18 @@ class AvailabilityEndpoint {
 	}
 
 	public function create( \WP_REST_Request $request ): \WP_REST_Response|\WP_Error {
-		$instructorId = get_current_user_id();
-		$offeringId   = absint( Val::int( $request->get_param( 'offering_id' ) ) );
-		$duration     = absint( Val::int( $request->get_param( 'duration_minutes' ) ) );
-
-		// A slot may only be tied to an offering the instructor owns, so it can
-		// never inherit another instructor's price or payment routing at booking.
-		if ( $offeringId > 0 ) {
-			$offering = $this->offerings->findById( $offeringId );
-			if ( null === $offering || $offering->instructorId !== $instructorId ) {
-				return new \WP_Error( 'invalid_offering', __( 'That offering is not available.', 'unsupervised-schedular' ), [ 'status' => 400 ] );
-			}
-		}
-
-		$startDt = AvailabilitySlot::normalizeDateTime( Val::string( $request->get_param( 'start_dt' ) ) );
-		$endDt   = AvailabilitySlot::normalizeDateTime( Val::string( $request->get_param( 'end_dt' ) ) );
-
-		if ( null === $startDt || null === $endDt || $endDt <= $startDt ) {
-			return new \WP_Error( 'invalid_datetime', __( 'Provide a valid start and end, with the end after the start.', 'unsupervised-schedular' ), [ 'status' => 400 ] );
-		}
-
-		if ( substr( $startDt, 0, 10 ) !== substr( $endDt, 0, 10 ) ) {
-			return new \WP_Error( 'invalid_window', __( 'Availability must start and end on the same day. Use the weekly repeat to cover multiple weeks.', 'unsupervised-schedular' ), [ 'status' => 400 ] );
-		}
-
-		$window = new AvailabilitySlot(
-			instructorId:    $instructorId,
-			startDt:         $startDt,
-			endDt:           $endDt,
-			durationMinutes: $duration > 0 ? $duration : 60,
-			offeringId:      $offeringId > 0 ? $offeringId : null,
+		// Validation lives in WindowValidator so this endpoint and the admin form
+		// enforce exactly the same rules.
+		$window = $this->validator->validate(
+			get_current_user_id(),
+			Val::string( $request->get_param( 'start_dt' ) ),
+			Val::string( $request->get_param( 'end_dt' ) ),
+			absint( Val::int( $request->get_param( 'duration_minutes' ) ) ),
+			absint( Val::int( $request->get_param( 'offering_id' ) ) ),
 		);
 
-		if ( [] === $window->splitByDuration() ) {
-			return new \WP_Error( 'invalid_window', __( 'The availability window is shorter than the lesson length.', 'unsupervised-schedular' ), [ 'status' => 400 ] );
+		if ( $window instanceof \WP_Error ) {
+			return $window;
 		}
 
 		$ids = $this->repository->createFromWindow(
@@ -155,6 +132,12 @@ class AvailabilityEndpoint {
 			absint( Val::int( $request->get_param( 'weeks' ) ) )
 		);
 
+		// A valid window splits into at least one slot, so nothing written means
+		// every insert failed.
+		if ( [] === $ids ) {
+			return new \WP_Error( 'not_saved', __( 'The availability could not be saved.', 'unsupervised-schedular' ), [ 'status' => 500 ] );
+		}
+
 		return new \WP_REST_Response( [ 'ids' => $ids ], 201 );
 	}
 

src/Availability/AvailabilityRepository.php

@@ -11,8 +11,14 @@ class AvailabilityRepository {
 		$this->table = $db->prefix . 'us_availability';
 	}
 
+	/**
+	 * Insert one slot row. Returns its id, or 0 when the write failed —
+	 * `insert_id` still holds the *previous* statement's id after a failed
+	 * insert, so returning it unconditionally made a failed write look like a
+	 * successful one.
+	 */
 	public function insert( AvailabilitySlot $slot ): int {
-		$this->db->insert(
+		$written = $this->db->insert(
 			$this->table,
 			[
 				'instructor_id'    => $slot->instructorId,
@@ -27,7 +33,7 @@ class AvailabilityRepository {
 			[ '%d', '%d', '%s', '%s', '%d', '%d', '%d', '%s' ]
 		);
 
-		return $this->db->insert_id;
+		return false === $written ? 0 : $this->db->insert_id;
 	}
 
 	/**
@@ -42,9 +48,17 @@ class AvailabilityRepository {
 		$ids = [];
 
 		foreach ( $window->splitByDuration() as $slot ) {
-			$ids = $weekly
-				? array_merge( $ids, $this->createWeeklySeries( $slot, $weeks ) )
-				: [ ...$ids, $this->insert( $slot ) ];
+			if ( $weekly ) {
+				$ids = array_merge( $ids, $this->createWeeklySeries( $slot, $weeks ) );
+				continue;
+			}
+
+			$id = $this->insert( $slot );
+
+			// A failed insert returns 0; it must not reach the caller as an id.
+			if ( $id > 0 ) {
+				$ids[] = $id;
+			}
 		}
 
 		return $ids;
@@ -55,10 +69,14 @@ class AvailabilityRepository {
 	 * separate row one week apart, all sharing a `recurrence_group` (the id of the
 	 * first row).
 	 *
+	 * The count is clamped to `AvailabilitySlot::MAX_WEEKLY_OCCURRENCES`. The
+	 * form's `max` attribute says the same, but only this is binding — a
+	 * hand-crafted POST used to be able to ask for an unbounded number of rows.
+	 *
 	 * @return list<int> Inserted slot IDs.
 	 */
 	public function createWeeklySeries( AvailabilitySlot $first, int $occurrences ): array {
-		$occurrences = max( 1, $occurrences );
+		$occurrences = max( 1, min( AvailabilitySlot::MAX_WEEKLY_OCCURRENCES, $occurrences ) );
 		$start       = new \DateTimeImmutable( $first->startDt );
 		$end         = new \DateTimeImmutable( $first->endDt );
 
@@ -79,6 +97,13 @@ class AvailabilityRepository {
 				)
 			);
 
+			// A failed insert returns 0. Skipping it keeps a bogus id out of the
+			// returned list and, more importantly, stops 0 becoming the series'
+			// recurrence group — which would orphan every later occurrence.
+			if ( $id <= 0 ) {
+				continue;
+			}
+
 			if ( 0 === $groupId ) {
 				$groupId = $id;
 				$this->setRecurrenceGroup( $id, $groupId );

src/Availability/AvailabilitySlot.php

@@ -7,6 +7,23 @@ use Unsupervised\Schedular\Val;
 
 class AvailabilitySlot {
 
+	/** Lesson length used when none was submitted. */
+	public const DEFAULT_DURATION_MINUTES = 60;
+
+	/**
+	 * Lesson lengths a window can be split into, offered by the availability
+	 * form. The form hides the ones a given window is too short for.
+	 *
+	 * @var list<int>
+	 */
+	public const DURATION_CHOICES = [ 30, 60 ];
+
+	/**
+	 * Ceiling on a weekly series, matching the form's `max`. Enforced in the
+	 * repository too, so a hand-crafted POST cannot ask for ten thousand rows.
+	 */
+	public const MAX_WEEKLY_OCCURRENCES = 52;
+
 	public function __construct(
 		public readonly int $instructorId,
 		public readonly string $startDt,

src/Availability/WindowValidator.php

@@ -0,0 +1,105 @@
+<?php
+declare(strict_types=1);
+
+namespace Unsupervised\Schedular\Availability;
+
+use Unsupervised\Schedular\Offering\OfferingRepository;
+
+/**
+ * Validates a submitted availability window.
+ *
+ * The admin form and the REST endpoint both accept the same window, and used to
+ * check it independently — the endpoint returning a specific 400 for each
+ * failure while the form simply returned, saving nothing and saying nothing. A
+ * 30-minute window submitted with the default 60-minute lesson length was the
+ * visible symptom: no rows, no error, no clue. Both callers now come through
+ * here, so neither can drift from the other again.
+ *
+ * Every rejection is a `WP_Error` carrying a message written for the person who
+ * submitted the form: the endpoint returns it as-is (the `status` data makes it
+ * a 400), and the admin screen shows `get_error_message()` in a notice.
+ */
+class WindowValidator {
+
+	public function __construct( private OfferingRepository $offerings ) {}
+
+	/**
+	 * Check a submitted window and return it ready to persist.
+	 *
+	 * @param int    $instructorId    Instructor the window belongs to.
+	 * @param string $rawStart        Submitted start, in any form {@see AvailabilitySlot::normalizeDateTime()} accepts.
+	 * @param string $rawEnd          Submitted end, likewise.
+	 * @param int    $durationMinutes Lesson length the window is split into; 0 falls back to the 60-minute default.
+	 * @param int    $offeringId      Offering the slots are tied to, or 0 for any private lesson.
+	 *
+	 * @return AvailabilitySlot|\WP_Error The window, or why it was rejected.
+	 */
+	public function validate( int $instructorId, string $rawStart, string $rawEnd, int $durationMinutes, int $offeringId ): AvailabilitySlot|\WP_Error {
+		$startDt = AvailabilitySlot::normalizeDateTime( $rawStart );
+		$endDt   = AvailabilitySlot::normalizeDateTime( $rawEnd );
+
+		if ( null === $startDt || null === $endDt ) {
+			return new \WP_Error(
+				'invalid_datetime',
+				__( 'Enter a valid start and end date and time.', 'unsupervised-schedular' ),
+				[ 'status' => 400 ]
+			);
+		}
+
+		if ( $endDt <= $startDt ) {
+			return new \WP_Error(
+				'invalid_datetime',
+				__( 'The end time must be after the start time.', 'unsupervised-schedular' ),
+				[ 'status' => 400 ]
+			);
+		}
+
+		if ( substr( $startDt, 0, 10 ) !== substr( $endDt, 0, 10 ) ) {
+			return new \WP_Error(
+				'invalid_window',
+				__( 'Availability must start and end on the same day. Use the weekly repeat to cover multiple weeks.', 'unsupervised-schedular' ),
+				[ 'status' => 400 ]
+			);
+		}
+
+		// A slot may only be tied to an offering the instructor owns, so it can
+		// never inherit another instructor's price or payment routing at booking.
+		if ( $offeringId > 0 ) {
+			$offering = $this->offerings->findById( $offeringId );
+
+			if ( null === $offering || $offering->instructorId !== $instructorId ) {
+				return new \WP_Error(
+					'invalid_offering',
+					__( 'That offering is not available.', 'unsupervised-schedular' ),
+					[ 'status' => 400 ]
+				);
+			}
+		}
+
+		$duration = $durationMinutes > 0 ? $durationMinutes : AvailabilitySlot::DEFAULT_DURATION_MINUTES;
+
+		$window = new AvailabilitySlot(
+			instructorId:    $instructorId,
+			startDt:         $startDt,
+			endDt:           $endDt,
+			durationMinutes: $duration,
+			offeringId:      $offeringId > 0 ? $offeringId : null,
+		);
+
+		// The window is stored as lesson-length slots, so one that cannot fit a
+		// single lesson would persist nothing at all.
+		if ( [] === $window->splitByDuration() ) {
+			return new \WP_Error(
+				'invalid_window',
+				sprintf(
+					/* translators: %d: the selected lesson length, in minutes. */
+					__( 'This window is shorter than the %d-minute lesson length, so it holds no bookable slots. Choose a shorter lesson length or a longer window.', 'unsupervised-schedular' ),
+					$duration
+				),
+				[ 'status' => 400 ]
+			);
+		}
+
+		return $window;
+	}
+}

src/BlockPreview.php

@@ -15,6 +15,12 @@ namespace Unsupervised\Schedular;
  */
 class BlockPreview {
 
+	/**
+	 * The marker a required field's label carries, matching the one
+	 * {@see Registration\QuestionField::render()} puts on a required question.
+	 */
+	private const REQUIRED_MARK = ' <span class="us-required" aria-hidden="true">*</span>';
+
 	/**
 	 * Sample booking page.
 	 *
@@ -86,13 +92,13 @@ class BlockPreview {
 	private static function upcomingLessons(): string {
 		return sprintf(
 			'<div class="us-my-lessons"><h3>%s</h3>'
-			. '<div class="us-my-lesson"><span class="us-my-lesson-info">'
+			. '<div class="us-my-lesson"><div class="us-my-lesson-info">'
 			. '<strong class="us-my-lesson-title">%s <span class="us-my-lesson-duration">(30 min)</span></strong>'
-			. '<span class="us-my-lesson-when">%s</span></span>'
-			. '<span class="us-my-lesson-actions">'
+			. '<span class="us-my-lesson-when">%s</span></div>'
+			. '<div class="us-my-lesson-actions">'
 			. '<span class="us-lesson-status us-lesson-status-confirmed">%s</span>'
 			. '<button type="button" class="us-cancel-lesson" disabled>%s</button>'
-			. '</span></div></div>',
+			. '</div></div></div>',
 			esc_html__( 'Your upcoming lessons', 'unsupervised-schedular' ),
 			esc_html__( 'Piano Lesson', 'unsupervised-schedular' ),
 			esc_html__( 'Monday · 4:00 PM–4:30 PM', 'unsupervised-schedular' ),
@@ -118,11 +124,13 @@ class BlockPreview {
 			: '<p>' . esc_html__( 'A sample class shown so the page can be styled.', 'unsupervised-schedular' ) . '</p>';
 
 		return sprintf(
-			'<div id="us-group-app">%s<div id="us-group-list"><div class="us-class"><h3>%s</h3><p class="us-class-when">%s</p>%s<p>25.00 CAD</p><p class="us-enrol-deadline">%s</p><button type="button" class="us-enrol-btn" disabled>%s</button></div></div></div>',
+			'<div id="us-group-app">%s<div id="us-group-list"><div class="us-class"><h3>%s</h3><p class="us-class-when">%s</p>%s<p class="us-class-price">%s</p><p class="us-enrol-deadline">%s</p><button type="button" class="us-enrol-btn" disabled>%s</button></div></div></div>',
 			self::note( $note ),
 			esc_html__( 'Beginner Group Class', 'unsupervised-schedular' ),
 			esc_html__( 'Saturdays 10:00 AM–11:00 AM', 'unsupervised-schedular' ),
 			$description,
+			// Prices on the live page always carry their cadence, so the sample does too.
+			esc_html__( '25.00 CAD up front', 'unsupervised-schedular' ),
 			esc_html__( 'Enrol by Sep 6, 2026', 'unsupervised-schedular' ),
 			esc_html__( 'Enrol', 'unsupervised-schedular' )
 		);
@@ -167,6 +175,78 @@ class BlockPreview {
 		);
 	}
 
+	/**
+	 * Sample family page: the account holder's own details, two representative
+	 * children and the add form, with the controls inert so the editor preview
+	 * cannot post.
+	 */
+	public static function family(): string {
+		$self = sprintf(
+			'<h4>%s</h4><p class="us-family-self-email">%s <span>[email protected]</span></p>'
+				. '<p><label for="us-own-name">%s' . self::REQUIRED_MARK . '</label><input type="text" id="us-own-name" value="%s"></p>'
+				. '<p><label><input type="checkbox" checked disabled> %s</label></p>'
+				. '<p><label for="us-own-birth-year">%s</label><input type="number" id="us-own-birth-year" placeholder="YYYY"></p>'
+				. '<p><button type="button" disabled>%s</button></p>',
+			esc_html__( 'Your details', 'unsupervised-schedular' ),
+			esc_html__( 'Email', 'unsupervised-schedular' ),
+			esc_html__( 'Your name', 'unsupervised-schedular' ),
+			esc_attr__( 'Grace Hopper', 'unsupervised-schedular' ),
+			esc_html__( 'I take lessons myself', 'unsupervised-schedular' ),
+			esc_html__( 'Your birth year', 'unsupervised-schedular' ),
+			esc_html__( 'Save my details', 'unsupervised-schedular' )
+		);
+
+		$children = '';
+		foreach ( [ 'Ada Lovelace', 'Alan Turing' ] as $name ) {
+			$children .= sprintf(
+				'<li class="us-family-child"><span class="us-family-child-name">%s</span>'
+					. '<span class="us-family-child-actions"><a href="#">%s</a> <button type="button" disabled>%s</button></span></li>',
+				esc_html( $name ),
+				esc_html__( 'Edit', 'unsupervised-schedular' ),
+				esc_html__( 'Remove', 'unsupervised-schedular' )
+			);
+		}
+
+		$add = sprintf(
+			'<h4>%s</h4><p><label for="us-child-name">%s' . self::REQUIRED_MARK . '</label><input type="text" id="us-child-name"></p>'
+				. '<p><label for="us-child-birth-year">%s' . self::REQUIRED_MARK . '</label><input type="number" id="us-child-birth-year" placeholder="YYYY"></p>'
+				. '<p><button type="button" disabled>%s</button></p>',
+			esc_html__( 'Add a student', 'unsupervised-schedular' ),
+			esc_html__( 'Name', 'unsupervised-schedular' ),
+			esc_html__( 'Birth year', 'unsupervised-schedular' ),
+			esc_html__( 'Add student', 'unsupervised-schedular' )
+		);
+
+		return sprintf(
+			'<div class="us-family">%s<h3>%s</h3><form class="us-family-self">%s</form>'
+				. '<h4>%s</h4><ul class="us-family-list">%s</ul><form class="us-family-add">%s</form></div>',
+			self::note( __( 'Editor preview — signed-in visitors see and manage their own details and students here.', 'unsupervised-schedular' ) ),
+			esc_html__( 'Your profile', 'unsupervised-schedular' ),
+			$self,
+			esc_html__( 'Your students', 'unsupervised-schedular' ),
+			$children,
+			$add
+		);
+	}
+
+	/**
+	 * Sample account panel. Shown populated whatever the editor's own login
+	 * state, since on the published page a signed-out visitor may see nothing at
+	 * all and an empty box tells the person placing the block nothing.
+	 */
+	public static function account(): string {
+		return sprintf(
+			'<div class="us-account">%s'
+				. '<p class="us-account-who"><span class="us-account-name">%s</span>'
+				. '<span class="us-account-email">%s</span></p>'
+				. '<p class="us-account-actions"><a class="us-account-signout" href="#">%s</a></p></div>',
+			self::note( __( 'Editor preview — each visitor sees their own account here.', 'unsupervised-schedular' ) ),
+			esc_html__( 'Grace Hopper', 'unsupervised-schedular' ),
+			esc_html__( '[email protected]', 'unsupervised-schedular' ),
+			esc_html__( 'Sign out', 'unsupervised-schedular' )
+		);
+	}
+
 	private static function note( string $text ): string {
 		return '<p class="us-editor-note">' . esc_html( $text ) . '</p>';
 	}

src/BlockRegistrar.php

@@ -3,10 +3,12 @@ declare(strict_types=1);
 
 namespace Unsupervised\Schedular;
 
+use Unsupervised\Schedular\Auth\AccountPage;
 use Unsupervised\Schedular\Auth\LoginPage;
 use Unsupervised\Schedular\Auth\RegistrationPage;
 use Unsupervised\Schedular\Booking\BookingPage;
 use Unsupervised\Schedular\GroupClass\GroupClassPage;
+use Unsupervised\Schedular\Guardian\FamilyPage;
 
 /**
  * Registers Gutenberg dynamic-block wrappers for the front-end shortcodes so
@@ -28,6 +30,8 @@ class BlockRegistrar {
 		private LoginPage $loginPage,
 		private RegistrationPage $registrationPage,
 		private GroupClassPage $groupClassPage,
+		private FamilyPage $familyPage,
+		private AccountPage $accountPage,
 	) {}
 
 	public function register(): void {
@@ -137,6 +141,24 @@ class BlockRegistrar {
 					],
 				],
 			],
+			'us-scheduler/family'           => [
+				'render'     => [ $this, 'renderFamily' ],
+				'attributes' => [
+					'loginPageId' => [
+						'type'    => 'number',
+						'default' => 0,
+					],
+				],
+			],
+			'us-scheduler/account'          => [
+				'render'     => [ $this, 'renderAccount' ],
+				'attributes' => [
+					'loginPageId' => [
+						'type'    => 'number',
+						'default' => 0,
+					],
+				],
+			],
 		];
 	}
 
@@ -184,6 +206,24 @@ class BlockRegistrar {
 		return BlockPreview::groupClasses( Val::int( $attributes['offeringId'] ?? 0 ) > 0 );
 	}
 
+	/**
+	 * Renders the account (who is signed in) block.
+	 *
+	 * @param array<string, mixed> $attributes Block attributes.
+	 */
+	public function renderAccount( array $attributes = [] ): string {
+		return $this->isEditorPreview() ? BlockPreview::account() : $this->accountPage->render( $attributes );
+	}
+
+	/**
+	 * Renders the family (manage-children) block.
+	 *
+	 * @param array<string, mixed> $attributes Block attributes.
+	 */
+	public function renderFamily( array $attributes = [] ): string {
+		return $this->isEditorPreview() ? BlockPreview::family() : $this->familyPage->render( $attributes );
+	}
+
 	/**
 	 * Server-side auto-redirect for blocks that opt in via their autoRedirect
 	 * attribute: logged-out visitors on a page containing the booking block

src/Booking/AdminBooking.php

@@ -0,0 +1,289 @@
+<?php
+declare(strict_types=1);
+
+namespace Unsupervised\Schedular\Booking;
+
+use Unsupervised\Schedular\Auth\RoleManager;
+use Unsupervised\Schedular\Auth\UserName;
+use Unsupervised\Schedular\Availability\AvailabilityRepository;
+use Unsupervised\Schedular\Availability\AvailabilitySlot;
+use Unsupervised\Schedular\Offering\Offering;
+use Unsupervised\Schedular\Offering\OfferingRepository;
+use Unsupervised\Schedular\Val;
+
+/**
+ * Booking a private lesson **for** a student, from wp-admin — the studio's
+ * counterpart to the group class's "Add students directly". The front desk takes
+ * a phone call, an instructor slots in a make-up lesson; neither of them can log
+ * in as the student, and only a guardian may book through the student-facing
+ * flow.
+ *
+ * It reuses `LessonBooker` — the same offering rules, the same atomic slot claim,
+ * the same billing — and differs from a student's own booking in exactly four
+ * ways, each deliberate:
+ *
+ * 1. **No intake questions or policy acceptances are recorded.** They are the
+ *    student's to answer and agree to; a staff member ticking boxes on their
+ *    behalf would be an audit trail that says something untrue. The lesson's
+ *    detail page simply shows none.
+ * 2. **It is not bounded by what the student could book themselves.** Any open
+ *    slot of the instructor's, including one only reachable past a deadline.
+ * 3. **It can be booked at no charge**, for a make-up or goodwill lesson, which
+ *    skips the payment entirely and confirms the lesson at once.
+ * 4. **It can book for a student who cannot book at all** — a guardian's child,
+ *    or someone still awaiting approval. Both hold the student role but have
+ *    `book_lesson` withheld so that neither can book in their own name; that is
+ *    a limit on them, never on the studio acting for them.
+ */
+class AdminBooking {
+
+	/**
+	 * How far ahead the form's list of open times reaches. Long enough to book a
+	 * term ahead, short enough that the select stays a select.
+	 */
+	private const HORIZON_DAYS = 56;
+
+	public function __construct(
+		private AvailabilityRepository $availability,
+		private OfferingRepository $offerings,
+		private LessonBooker $booker,
+	) {}
+
+	/**
+	 * Book a lesson on a student's behalf, returning the notice to show. When
+	 * `$onlyInstructorId` is non-zero the slot must belong to that instructor —
+	 * how an instructor's own **My Lessons** page is kept to their own schedule,
+	 * where the studio **Scheduler** passes 0 and may book any instructor's time.
+	 *
+	 * @return string|\WP_Error Success notice, or why nothing was booked.
+	 */
+	public function book( int $studentId, int $slotId, int $offeringId, string $recurrence, bool $noCharge, string $notes, int $onlyInstructorId = 0 ): string|\WP_Error {
+		// The student role, not the `book_lesson` capability — see
+		// {@see RoleManager::isStudent()} for why a child and an unapproved signup
+		// must both be bookable for.
+		if ( ! RoleManager::isStudent( $studentId ) ) {
+			return new \WP_Error( 'invalid_student', __( 'Choose a student to book for.', 'unsupervised-schedular' ) );
+		}
+
+		$slot = $slotId > 0 ? $this->availability->findById( $slotId ) : null;
+
+		if ( null === $slot || ( $onlyInstructorId > 0 && $slot->instructorId !== $onlyInstructorId ) ) {
+			return new \WP_Error( 'invalid_slot', __( 'Choose a time to book.', 'unsupervised-schedular' ) );
+		}
+
+		if ( $slot->isBooked ) {
+			return new \WP_Error( 'slot_taken', __( 'That time has already been booked.', 'unsupervised-schedular' ) );
+		}
+
+		$offering = $this->booker->resolveOffering( $slot, $offeringId );
+		if ( $offering instanceof \WP_Error ) {
+			return $offering;
+		}
+
+		// A weekly reservation needs a weekly time to reserve. The student-facing
+		// flow quietly books a single lesson when the slot does not repeat; here the
+		// staff member asked for a term and must be told they are not getting one,
+		// rather than discovering it later on the roster.
+		$weekly = Lesson::RECURRENCE_WEEKLY === $recurrence;
+		if ( $weekly && null === $slot->recurrenceGroup ) {
+			return new \WP_Error( 'not_weekly', __( 'That time does not repeat weekly, so it cannot be reserved for the term.', 'unsupervised-schedular' ) );
+		}
+
+		$reservation = $this->booker->reserve(
+			$slot,
+			$offering,
+			$studentId,
+			$weekly ? Lesson::RECURRENCE_WEEKLY : Lesson::RECURRENCE_SINGLE,
+			$notes,
+			// Stamped on the lesson so it can be told apart later: only a lesson the
+			// studio booked may have its intake recorded after the fact.
+			get_current_user_id()
+		);
+
+		if ( $reservation instanceof \WP_Error ) {
+			return $reservation;
+		}
+
+		$settlement = $this->booker->settle(
+			$reservation['ids'],
+			$reservation['anchor_id'],
+			$slot,
+			$offering,
+			$studentId,
+			$noCharge
+		);
+
+		return $this->notice( $studentId, $offering, $slot, count( $reservation['ids'] ), $settlement['status'] );
+	}
+
+	/**
+	 * What was booked and what it left owing, so the notice answers the two things
+	 * the person who booked it needs to know.
+	 */
+	private function notice( int $studentId, Offering $offering, AvailabilitySlot $slot, int $count, string $status ): string {
+		$who = $this->studentName( $studentId );
+
+		$what = $count > 1
+			? sprintf(
+				/* translators: 1: student name, 2: lesson type, 3: number of weekly occurrences, 4: first lesson date and time. */
+				__( 'Booked %1$s into %2$s — %3$d weekly lessons from %4$s.', 'unsupervised-schedular' ),
+				$who,
+				$offering->title,
+				$count,
+				Val::string( mysql2date( 'M j, Y g:i A', $slot->startDt ) )
+			)
+			: sprintf(
+				/* translators: 1: student name, 2: lesson type, 3: lesson date and time. */
+				__( 'Booked %1$s into %2$s on %3$s.', 'unsupervised-schedular' ),
+				$who,
+				$offering->title,
+				Val::string( mysql2date( 'M j, Y g:i A', $slot->startDt ) )
+			);
+
+		$owing = Lesson::STATUS_CONFIRMED === $status
+			? __( 'Nothing is owed, so it is confirmed.', 'unsupervised-schedular' )
+			: __( 'A pending payment has been raised; the lesson is confirmed once it settles.', 'unsupervised-schedular' );
+
+		return $what . ' ' . $owing;
+	}
+
+	/**
+	 * Everything the form's three selects need. `$onlyInstructorId` scopes both the
+	 * open times and the lesson types to one instructor's, the same way `book()`
+	 * scopes what may be booked.
+	 *
+	 * @return array{students: list<array{id: int, name: string}>, offerings: list<array{id: int, label: string}>, slots: list<array{id: int, label: string, weekly: bool}>}
+	 */
+	public function formData( int $onlyInstructorId = 0 ): array {
+		$slots     = $this->openSlots( $onlyInstructorId );
+		$offerings = array_values(
+			array_filter(
+				$this->offerings->findAll( $onlyInstructorId, Offering::KIND_PRIVATE_LESSON, true ),
+				static fn( Offering $o ): bool => null !== $o->id
+			)
+		);
+
+		// Whose lesson type / whose time only needs saying when the page spans more
+		// than one instructor — on an instructor's own page it is noise.
+		$named = 0 === $onlyInstructorId;
+
+		return [
+			'students'  => $this->studentOptions(),
+			'offerings' => array_map(
+				fn( Offering $o ): array => [
+					'id'    => (int) $o->id,
+					'label' => $this->offeringLabel( $o, $named ),
+				],
+				$offerings
+			),
+			'slots'     => array_map(
+				fn( AvailabilitySlot $s ): array => [
+					'id'     => (int) $s->id,
+					'label'  => $this->slotLabel( $s, $named ),
+					'weekly' => null !== $s->recurrenceGroup,
+				],
+				$slots
+			),
+		];
+	}
+
+	/**
+	 * Open slots inside the booking horizon, newest last.
+	 *
+	 * @return list<AvailabilitySlot>
+	 */
+	private function openSlots( int $instructorId ): array {
+		$until = ( new \DateTimeImmutable( Val::string( current_time( 'mysql' ) ) ) )
+			->modify( '+' . self::HORIZON_DAYS . ' days' )
+			->format( 'Y-m-d H:i:s' );
+
+		return array_values(
+			array_filter(
+				$this->availability->findAvailable( $instructorId, 0, 0, '', $until ),
+				static fn( AvailabilitySlot $s ): bool => null !== $s->id
+			)
+		);
+	}
+
+	/**
+	 * A lesson type as "60 min piano (60 min) — Jane Doe", the instructor named
+	 * only when the list spans several.
+	 */
+	private function offeringLabel( Offering $offering, bool $withInstructor ): string {
+		$label = $offering->title;
+
+		if ( null !== $offering->durationMinutes ) {
+			/* translators: %d: lesson length in minutes. */
+			$label .= ' (' . sprintf( __( '%d min', 'unsupervised-schedular' ), $offering->durationMinutes ) . ')';
+		}
+
+		return $withInstructor ? $label . ' — ' . $this->instructorName( $offering->instructorId ) : $label;
+	}
+
+	/**
+	 * An open time as "Mon Sep 2, 4:00 PM (30 min) — Jane Doe — 30 min piano —
+	 * repeats weekly": when it is, how long, whose, and what it is already tied to,
+	 * since all four decide whether a given student can be booked into it.
+	 */
+	private function slotLabel( AvailabilitySlot $slot, bool $withInstructor ): string {
+		/* translators: %d: lesson length in minutes. */
+		$label = Val::string( mysql2date( 'D M j, Y g:i A', $slot->startDt ) ) . ' (' . sprintf( __( '%d min', 'unsupervised-schedular' ), $slot->durationMinutes ) . ')';
+
+		if ( $withInstructor ) {
+			$label .= ' — ' . $this->instructorName( $slot->instructorId );
+		}
+
+		$tied = null !== $slot->offeringId ? $this->offerings->findById( $slot->offeringId ) : null;
+		if ( null !== $tied ) {
+			$label .= ' — ' . $tied->title;
+		}
+
+		if ( null !== $slot->recurrenceGroup ) {
+			$label .= ' — ' . __( 'repeats weekly', 'unsupervised-schedular' );
+		}
+
+		return $label;
+	}
+
+	private function instructorName( int $instructorId ): string {
+		return $this->studentName( $instructorId );
+	}
+
+	/** A person's display name, however little the account has on file. */
+	private function studentName( int $userId ): string {
+		$user = get_userdata( $userId );
+
+		return UserName::format( $user instanceof \WP_User ? $user : null, $userId );
+	}
+
+	/**
+	 * Everyone who can be booked for, by name — every holder of the student role,
+	 * which is exactly the set {@see book()} accepts. That deliberately includes
+	 * the children a guardian books for and students still awaiting approval:
+	 * neither may book in their own name, both may be booked for.
+	 *
+	 * @return list<array{id: int, name: string}>
+	 */
+	private function studentOptions(): array {
+		$users = array_filter(
+			get_users(
+				[
+					'role'    => RoleManager::STUDENT,
+					'orderby' => 'display_name',
+					'order'   => 'ASC',
+				]
+			),
+			static fn( mixed $u ): bool => $u instanceof \WP_User
+		);
+
+		return array_values(
+			array_map(
+				static fn( \WP_User $u ): array => [
+					'id'   => (int) $u->ID,
+					'name' => UserName::format( $u, (int) $u->ID ),
+				],
+				$users
+			)
+		);
+	}
+}

src/Booking/BookingEndpoint.php

@@ -5,9 +5,9 @@ namespace Unsupervised\Schedular\Booking;
 
 use Unsupervised\Schedular\Availability\AvailabilityRepository;
 use Unsupervised\Schedular\Auth\RoleManager;
-use Unsupervised\Schedular\Offering\Offering;
+use Unsupervised\Schedular\GroupClass\SessionSchedule;
+use Unsupervised\Schedular\Guardian\GuardianService;
 use Unsupervised\Schedular\Offering\OfferingRepository;
-use Unsupervised\Schedular\Payment\Payment;
 use Unsupervised\Schedular\Payment\PaymentService;
 use Unsupervised\Schedular\Policy\PolicyAcceptance;
 use Unsupervised\Schedular\Registration\RegistrationGate;
@@ -15,19 +15,16 @@ use Unsupervised\Schedular\Val;
 
 class BookingEndpoint {
 
-	/**
-	 * The most occurrences a single weekly booking may reserve at once, so one
-	 * student cannot lock up an instructor's entire recurring schedule.
-	 */
-	private const MAX_WEEKLY_OCCURRENCES = 12;
-
 	public function __construct(
 		private AvailabilityRepository $availability,
 		private BookingRepository $bookings,
 		private OfferingRepository $offerings,
 		private RegistrationGate $gate,
 		private PaymentService $payments,
+		private LessonBooker $booker,
 		private CancellationPolicy $cancellationPolicy,
+		private GuardianService $guardians,
+		private SessionSchedule $sessions,
 	) {}
 
 	/**
@@ -59,6 +56,13 @@ class BookingEndpoint {
 							'type'    => 'integer',
 							'default' => 0,
 						],
+						// Who the lesson is for. 0/absent means the caller books for
+						// themselves; a child's id is honoured only for their guardian.
+						'student_id'                  => [
+							'type'              => 'integer',
+							'default'           => 0,
+							'sanitize_callback' => 'absint',
+						],
 						'recurrence'                  => [
 							'type'    => 'string',
 							'default' => 'single',
@@ -114,12 +118,58 @@ class BookingEndpoint {
 	}
 
 	public function myLessons( \WP_REST_Request $request ): \WP_REST_Response { // phpcs:ignore Generic.CodeAnalysis.UnusedFunctionParameter.Found
-		$userId  = get_current_user_id();
-		$lessons = current_user_can( RoleManager::CAP_MANAGE_AVAILABILITY )
-			? $this->bookings->findUpcomingForInstructor( $userId )
-			: $this->bookings->findUpcomingForStudent( $userId );
+		$userId = get_current_user_id();
+		$now    = current_time( 'mysql' );
 
-		return new \WP_REST_Response( array_map( fn( Lesson $l ): array => $this->lessonWithTimes( $l ), $lessons ), 200 );
+		// Group classes are listed here too. A term-based class has no row in
+		// us_availability, so nothing that only read lessons could show one, and a
+		// student whose whole week was a group class saw an empty schedule.
+		if ( current_user_can( RoleManager::CAP_MANAGE_AVAILABILITY ) ) {
+			$lessons = $this->bookings->findUpcomingForInstructor( $userId );
+
+			// One row per session the instructor teaches, not per student in it.
+			$sessions = array_map(
+				static fn( array $session ): array => $session + [ 'kind' => SessionSchedule::KIND ],
+				$this->sessions->upcomingForInstructor( $userId, $now )
+			);
+		} else {
+			// A guardian's list covers the whole household — their own lessons and
+			// every child's — merged and re-sorted so the soonest is first
+			// regardless of whose it is.
+			$lessons  = [];
+			$sessions = [];
+			foreach ( $this->guardians->householdIds( $userId ) as $studentId ) {
+				$lessons  = array_merge( $lessons, $this->bookings->findUpcomingForStudent( $studentId ) );
+				$sessions = array_merge( $sessions, $this->sessionRows( $studentId, $now ) );
+			}
+		}
+
+		$rows = array_merge(
+			array_map( fn( Lesson $l ): array => $this->lessonWithTimes( $l ), $lessons ),
+			$sessions
+		);
+
+		// usort reindexes in place, so the response is already a list.
+		usort( $rows, static fn( array $a, array $b ): int => Val::string( $a['start_dt'] ?? '' ) <=> Val::string( $b['start_dt'] ?? '' ) );
+
+		return new \WP_REST_Response( $rows, 200 );
+	}
+
+	/**
+	 * One student's upcoming group-class sessions, shaped like the lesson rows
+	 * beside them so a single list renders both. `kind` is what tells them apart:
+	 * a session is not a booked slot, so it carries no cancel action.
+	 *
+	 * @return list<array<string, mixed>>
+	 */
+	private function sessionRows( int $studentId, string $now ): array {
+		return array_map(
+			fn( array $session ): array => $session + [
+				'kind'         => SessionSchedule::KIND,
+				'student_name' => $this->guardians->studentName( $studentId ),
+			],
+			$this->sessions->upcomingForStudent( $studentId, $now )
+		);
 	}
 
 	/**
@@ -144,10 +194,21 @@ class BookingEndpoint {
 			'end_dt'           => $slot?->endDt,
 			'offering_title'   => $offering?->title,
 			'duration_minutes' => $duration,
+			// Whose lesson it is, so a guardian's merged list can say which child
+			// each row belongs to.
+			'student_name'     => $this->guardians->studentName( $lesson->studentId ),
 		];
 	}
 
 	public function book( \WP_REST_Request $request ): \WP_REST_Response|\WP_Error {
+		// Who the lesson is for is settled before anything else is touched: an
+		// unauthorised student id must never get as far as claiming a slot, and
+		// certainly never as far as raising a payment against someone's account.
+		$studentId = $this->resolveStudent( $request );
+		if ( $studentId instanceof \WP_Error ) {
+			return $studentId;
+		}
+
 		$slotId = Val::int( $request->get_param( 'slot_id' ) );
 		$slot   = $this->availability->findById( $slotId );
 
@@ -159,52 +220,12 @@ class BookingEndpoint {
 			return new \WP_Error( 'slot_taken', __( 'This slot is already booked.', 'unsupervised-schedular' ), [ 'status' => 409 ] );
 		}
 
-		// Resolve the offering for this booking. A client-supplied offering must
-		// never override the slot's price or payment routing: when the slot is tied
-		// to a specific offering that offering is authoritative, and any offering
-		// used must belong to the slot's instructor. This prevents substituting a
-		// cheaper/free offering to dodge payment, or another instructor's offering
-		// to misroute it.
-		$requestedOfferingId = absint( Val::int( $request->get_param( 'offering_id' ) ) );
-		$slotOfferingId      = (int) ( $slot->offeringId ?? 0 );
-
-		if ( $slotOfferingId > 0 ) {
-			if ( $requestedOfferingId > 0 && $requestedOfferingId !== $slotOfferingId ) {
-				return new \WP_Error( 'offering_mismatch', __( 'This slot is tied to a different offering.', 'unsupervised-schedular' ), [ 'status' => 400 ] );
-			}
-			$offeringId = $slotOfferingId;
-		} else {
-			$offeringId = $requestedOfferingId;
+		$offering = $this->booker->resolveOffering( $slot, absint( Val::int( $request->get_param( 'offering_id' ) ) ) );
+		if ( $offering instanceof \WP_Error ) {
+			return $offering;
 		}
 
-		// Every lesson books against an offering: it carries the price, intake
-		// questions, and payment routing. Without one the booking would silently
-		// be free and unquestioned, so generic slots require the student's choice.
-		if ( $offeringId <= 0 ) {
-			return new \WP_Error( 'offering_required', __( 'Choose a lesson type to book this slot.', 'unsupervised-schedular' ), [ 'status' => 400 ] );
-		}
-
-		$offering = $this->offerings->findById( $offeringId );
-		if ( null === $offering ) {
-			return new \WP_Error( 'invalid_offering', __( 'Offering not found.', 'unsupervised-schedular' ), [ 'status' => 400 ] );
-		}
-
-		if ( $offering->instructorId !== $slot->instructorId ) {
-			return new \WP_Error( 'offering_mismatch', __( 'That offering is not available for this slot.', 'unsupervised-schedular' ), [ 'status' => 400 ] );
-		}
-
-		// A slot-tied offering was the instructor's explicit choice and is honoured
-		// as-is; a student-chosen one must be something the catalog actually offers
-		// for this slot: an active private-lesson type whose length fits the slot.
-		if ( 0 === $slotOfferingId ) {
-			if ( ! $offering->isActive || Offering::KIND_PRIVATE_LESSON !== $offering->kind ) {
-				return new \WP_Error( 'invalid_offering', __( 'That offering cannot be booked as a private lesson.', 'unsupervised-schedular' ), [ 'status' => 400 ] );
-			}
-
-			if ( null !== $offering->durationMinutes && $offering->durationMinutes !== $slot->durationMinutes ) {
-				return new \WP_Error( 'offering_mismatch', __( 'That offering does not match this slot\'s lesson length.', 'unsupervised-schedular' ), [ 'status' => 400 ] );
-			}
-		}
+		$offeringId = (int) $offering->id;
 
 		$answers            = $this->answers( $request );
 		$acceptedVersionIds = array_values( array_map( static fn( mixed $v ): int => absint( Val::int( $v ) ), (array) $request->get_param( 'accepted_policy_version_ids' ) ) );
@@ -214,83 +235,28 @@ class BookingEndpoint {
 			return $gateError;
 		}
 
-		$studentId  = get_current_user_id();
-		$notes      = Val::string( $request->get_param( 'notes' ) );
-		$recurrence = Lesson::RECURRENCE_WEEKLY === $request->get_param( 'recurrence' )
-			? Lesson::RECURRENCE_WEEKLY
-			: Lesson::RECURRENCE_SINGLE;
+		$notes = Val::string( $request->get_param( 'notes' ) );
 
-		$template = new Lesson(
-			slotId:       $slotId,
-			studentId:    $studentId,
-			instructorId: $slot->instructorId,
-			offeringId:   $offeringId,
-			recurrence:   $recurrence,
-			notes:        '' !== $notes ? $notes : null,
+		$reservation = $this->booker->reserve(
+			$slot,
+			$offering,
+			$studentId,
+			Lesson::RECURRENCE_WEEKLY === $request->get_param( 'recurrence' ) ? Lesson::RECURRENCE_WEEKLY : Lesson::RECURRENCE_SINGLE,
+			$notes
 		);
 
-		// Weekly reservation across the slot's recurring group; otherwise a single lesson.
-		if ( Lesson::RECURRENCE_WEEKLY === $recurrence && null !== $slot->recurrenceGroup ) {
-			// Claim each occurrence atomically (capped so one booking cannot lock an
-			// instructor's entire schedule), then create a lesson only for the slots
-			// this request actually won — never for one already taken by someone else.
-			$candidates = array_map( static fn( $s ): int => (int) $s->id, $this->availability->findUnbookedInGroup( $slot->recurrenceGroup ) );
-			$candidates = array_slice( $candidates, 0, self::MAX_WEEKLY_OCCURRENCES );
-
-			$claimed = array_values( array_filter( $candidates, fn( int $candidateId ): bool => $this->availability->claim( $candidateId ) ) );
-			if ( [] === $claimed ) {
-				return new \WP_Error( 'slot_taken', __( 'This slot is already booked.', 'unsupervised-schedular' ), [ 'status' => 409 ] );
-			}
-
-			$ids      = $this->bookings->insertSeries( $template, $claimed );
-			$anchorId = $ids[0] ?? 0;
-		} else {
-			// Claim before inserting: if another request already took the slot, the
-			// guarded update reports no rows and we reject rather than double-book.
-			if ( ! $this->availability->claim( $slotId ) ) {
-				return new \WP_Error( 'slot_taken', __( 'This slot is already booked.', 'unsupervised-schedular' ), [ 'status' => 409 ] );
-			}
-			$anchorId = $this->bookings->insert( $template );
-			$ids      = [ $anchorId ];
+		if ( $reservation instanceof \WP_Error ) {
+			return $reservation;
 		}
 
-		$this->gate->record( PolicyAcceptance::REG_LESSON, $anchorId, $studentId, $offeringId, $answers, $acceptedVersionIds, $this->clientIp() );
+		$ids      = $reservation['ids'];
+		$anchorId = $reservation['anchor_id'];
 
-		$payment = null;
-		$status  = Lesson::STATUS_PENDING;
+		// The acceptance binds the student but is attributed to whoever actually
+		// ticked the boxes — the guardian, when they booked for a child.
+		$this->gate->record( PolicyAcceptance::REG_LESSON, $anchorId, $studentId, $offeringId, $answers, $acceptedVersionIds, $this->clientIp(), get_current_user_id() );
 
-		// Scheduled billing (weekly / monthly) normally defers payment to the daily
-		// scan, but a single lesson booked once its scheduled due date has already
-		// passed — e.g. an extra lesson added to a month that was already billed — is
-		// charged at booking instead, so it is never missed or billed late.
-		$chargeAtBooking = $offering->price > 0.0 && (
-			! $offering->isScheduledBilling()
-			|| ( 1 === count( $ids ) && $this->scheduledDueHasPassed( $offering, $slot->startDt ) )
-		);
-
-		if ( $chargeAtBooking ) {
-			// A full-term price already covers the whole reservation; a per-lesson
-			// (one_time) price is owed once per occurrence actually claimed, so a
-			// weekly reservation cannot hold a term while paying for one week.
-			$amount = Offering::BILLING_FULL_TERM === $offering->billingMode
-				? $offering->price
-				: $offering->price * count( $ids );
-
-			$payment = $this->payments->createForRegistration( Payment::REG_LESSON, $anchorId, $studentId, $slot->instructorId, $amount, $offering->currency, $offering->etransferEmail );
-
-			if ( null !== $payment && $payment->isPaid() ) {
-				$status = Lesson::STATUS_CONFIRMED;
-			}
-		} else {
-			// Either a free offering, or scheduled billing (weekly / monthly) whose
-			// payment is deferred to the daily billing scan. Either way there is no
-			// payment step now to confirm the lessons, so the reserved slots are
-			// confirmed at booking time; the billing scan bills them when they come due.
-			foreach ( $ids as $lessonId ) {
-				$this->bookings->updateStatus( $lessonId, Lesson::STATUS_CONFIRMED );
-			}
-			$status = Lesson::STATUS_CONFIRMED;
-		}
+		[ 'status' => $status, 'payment' => $payment ] = $this->booker->settle( $ids, $anchorId, $slot, $offering, $studentId );
 
 		// `payment: null` tells the front end to skip the payment step entirely.
 		return new \WP_REST_Response(
@@ -303,6 +269,35 @@ class BookingEndpoint {
 		);
 	}
 
+	/**
+	 * Who this booking is for: the caller by default, or one of their children
+	 * when a `student_id` is supplied and they are that child's guardian.
+	 *
+	 * This is the authorisation boundary of guardian booking — without it any
+	 * signed-in student could book, and bill, against any user id they chose to
+	 * send. An id the caller may not act for is a 403, never a silent fallback to
+	 * themselves: a guardian who picked the wrong child needs to be told, not to
+	 * have the lesson quietly booked in their own name.
+	 */
+	private function resolveStudent( \WP_REST_Request $request ): int|\WP_Error {
+		$userId    = get_current_user_id();
+		$requested = absint( Val::int( $request->get_param( 'student_id' ) ) );
+
+		if ( $requested <= 0 || $requested === $userId ) {
+			return $userId;
+		}
+
+		if ( ! $this->guardians->canActFor( $userId, $requested ) ) {
+			return new \WP_Error(
+				'forbidden',
+				__( 'You cannot book on behalf of that student.', 'unsupervised-schedular' ),
+				[ 'status' => 403 ]
+			);
+		}
+
+		return $requested;
+	}
+
 	/**
 	 * Extract a question_id => value map from the request.
 	 *
@@ -317,23 +312,6 @@ class BookingEndpoint {
 		return $out;
 	}
 
-	/**
-	 * Whether a scheduled-billing offering's due date for a given session has
-	 * already passed at booking time. Weekly bills 24 hours before the lesson;
-	 * monthly bills on the 1st, so its due moment has passed once "now" is in the
-	 * lesson's month or later. Only meaningful for weekly / monthly offerings.
-	 */
-	private function scheduledDueHasPassed( Offering $offering, string $slotStart ): bool {
-		$now   = new \DateTimeImmutable( Val::string( current_time( 'mysql' ) ) );
-		$start = new \DateTimeImmutable( $slotStart );
-
-		if ( Offering::BILLING_MONTHLY === $offering->billingMode ) {
-			return $now->format( 'Y-m-d' ) >= $start->format( 'Y-m-01' );
-		}
-
-		return $now >= $start->modify( '-1 day' );
-	}
-
 	private function clientIp(): ?string {
 		// phpcs:ignore WordPress.Security.ValidatedSanitizedInput.InputNotSanitized, WordPress.Security.ValidatedSanitizedInput.MissingUnslash -- IP stored verbatim for audit.
 		$ip = sanitize_text_field( Val::string( wp_unslash( $_SERVER['REMOTE_ADDR'] ?? '' ) ) );
@@ -342,7 +320,8 @@ class BookingEndpoint {
 	}
 
 	/**
-	 * Student-initiated cancellation of their own lesson: marks it cancelled,
+	 * Student-initiated cancellation of their own lesson — or a guardian's, of one
+	 * of their children's: marks it cancelled,
 	 * frees the slot for rebooking, and voids any still-pending payment. A lesson
 	 * already paid for is credited back to the student's account (a per-lesson
 	 * share of the covering payment) to offset their future scheduled billing.
@@ -351,14 +330,19 @@ class BookingEndpoint {
 		$id     = absint( Val::int( $request->get_param( 'id' ) ) );
 		$lesson = $this->bookings->findById( $id );
 
-		if ( null === $lesson ) {
+		// A booking that is not the caller's is answered exactly as one that does
+		// not exist. Telling the two apart — 403 here, 404 there — would let any
+		// signed-in student walk the id space and learn which lessons the studio
+		// holds, and roughly how many. There is nothing a student can do with
+		// either answer, so there is no reason to distinguish them.
+		//
+		// The booking form's own 403 (see resolveStudent) is a different case: the
+		// student id there was chosen from a list of people the caller may act for,
+		// so "not yours" is a correction they need, not a fact they lack.
+		if ( null === $lesson || ! $this->guardians->canActFor( get_current_user_id(), $lesson->studentId ) ) {
 			return new \WP_Error( 'not_found', __( 'Booking not found.', 'unsupervised-schedular' ), [ 'status' => 404 ] );
 		}
 
-		if ( get_current_user_id() !== $lesson->studentId ) {
-			return new \WP_Error( 'forbidden', __( 'You cannot cancel this booking.', 'unsupervised-schedular' ), [ 'status' => 403 ] );
-		}
-
 		if ( Lesson::STATUS_CANCELLED !== $lesson->status ) {
 			$slot = $this->availability->findById( $lesson->slotId );
 			if ( null !== $slot ) {

src/Booking/BookingPage.php

@@ -5,6 +5,7 @@ namespace Unsupervised\Schedular\Booking;
 
 use Unsupervised\Schedular\Auth\RegistrationStatus;
 use Unsupervised\Schedular\Auth\RoleManager;
+use Unsupervised\Schedular\Guardian\GuardianService;
 use Unsupervised\Schedular\Val;
 
 class BookingPage {
@@ -18,6 +19,8 @@ class BookingPage {
 	/** The student's upcoming lessons only — nothing bookable. */
 	public const MODE_UPCOMING = 'upcoming';
 
+	public function __construct( private GuardianService $guardians ) {}
+
 	/**
 	 * Renders the booking shortcode/block output.
 	 *
@@ -64,6 +67,11 @@ class BookingPage {
 		$showBooking  = self::MODE_UPCOMING !== $mode;
 		$showUpcoming = self::MODE_BOOKING !== $mode;
 
+		// Who this account may book for. A single-student account gets one entry
+		// (themselves) and no selector at all; a guardian's list leads with their
+		// children, so the default choice is never the parent.
+		$students = $this->guardians->bookableStudents( get_current_user_id() );
+
 		ob_start();
 		include USC_PLUGIN_DIR . 'templates/frontend/booking-page.php';
 		return (string) ob_get_clean();

src/Booking/BookingRepository.php

@@ -24,9 +24,10 @@ class BookingRepository {
 				'status'        => $lesson->status,
 				'payment_id'    => $lesson->paymentId,
 				'notes'         => $lesson->notes,
+				'booked_by'     => $lesson->bookedBy,
 				'created_at'    => current_time( 'mysql' ),
 			],
-			[ '%d', '%d', '%d', '%d', '%s', '%d', '%s', '%d', '%s', '%s' ]
+			[ '%d', '%d', '%d', '%d', '%s', '%d', '%s', '%d', '%s', '%d', '%s' ]
 		);
 
 		return $this->db->insert_id;
@@ -54,6 +55,7 @@ class BookingRepository {
 					seriesId:     $seriesId > 0 ? $seriesId : null,
 					status:       $template->status,
 					notes:        $template->notes,
+					bookedBy:     $template->bookedBy,
 				)
 			);
 

src/Booking/Lesson.php

@@ -3,9 +3,11 @@ declare(strict_types=1);
 
 namespace Unsupervised\Schedular\Booking;
 
+use Unsupervised\Schedular\Registration\Answer;
+use Unsupervised\Schedular\Registration\IntakeSubject;
 use Unsupervised\Schedular\Val;
 
-class Lesson {
+class Lesson implements IntakeSubject {
 
 	public const STATUS_PENDING   = 'pending';
 	public const STATUS_CONFIRMED = 'confirmed';
@@ -38,9 +40,47 @@ class Lesson {
 		public readonly string $status = self::STATUS_PENDING,
 		public readonly ?int $paymentId = null,
 		public readonly ?string $notes = null,
+		/**
+		 * The staff member who booked this lesson on the student's behalf, from
+		 * wp-admin; 0 when it was booked through the student-facing flow, by the
+		 * student or their guardian. It is what marks a lesson whose intake answers
+		 * and policy acceptances may be recorded after the fact — nobody was at a
+		 * keyboard to give them at booking time.
+		 */
+		public readonly int $bookedBy = 0,
 		public readonly ?int $id = null,
 	) {}
 
+	public function intakeRegistrationType(): string {
+		return Answer::REG_LESSON;
+	}
+
+	/**
+	 * The lesson id this booking's intake answers and policy acceptances hang
+	 * off: the series anchor for a weekly reservation, the lesson itself
+	 * otherwise. A series is answered for and agreed to once, so every occurrence
+	 * reads and writes the same registration.
+	 */
+	public function intakeRegistrationId(): int {
+		return $this->seriesId ?? (int) $this->id;
+	}
+
+	public function intakeOfferingId(): int {
+		return (int) $this->offeringId;
+	}
+
+	public function intakeStudentId(): int {
+		return $this->studentId;
+	}
+
+	/**
+	 * Whether the studio booked this lesson on the student's behalf, rather than
+	 * the student (or their guardian) booking it themselves.
+	 */
+	public function isStaffRegistered(): bool {
+		return $this->bookedBy > 0;
+	}
+
 	public static function fromRow( \stdClass $row ): self {
 		return new self(
 			slotId:       Val::int( $row->slot_id ),
@@ -52,6 +92,7 @@ class Lesson {
 			status:       Val::string( $row->status ),
 			paymentId:    Val::intOrNull( $row->payment_id ),
 			notes:        Val::stringOrNull( $row->notes ),
+			bookedBy:     Val::int( $row->booked_by ?? 0 ),
 			id:           Val::int( $row->id ),
 		);
 	}
@@ -73,6 +114,7 @@ class Lesson {
 			'status'        => $this->status,
 			'payment_id'    => $this->paymentId,
 			'notes'         => $this->notes,
+			'booked_by'     => $this->bookedBy,
 		];
 	}
 }

src/Booking/LessonBooker.php

@@ -0,0 +1,234 @@
+<?php
+declare(strict_types=1);
+
+namespace Unsupervised\Schedular\Booking;
+
+use Unsupervised\Schedular\Availability\AvailabilityRepository;
+use Unsupervised\Schedular\Availability\AvailabilitySlot;
+use Unsupervised\Schedular\Guardian\GuardianService;
+use Unsupervised\Schedular\Offering\Offering;
+use Unsupervised\Schedular\Offering\OfferingRepository;
+use Unsupervised\Schedular\Payment\Payment;
+use Unsupervised\Schedular\Payment\PaymentService;
+use Unsupervised\Schedular\Val;
+
+/**
+ * The booking core shared by the student-facing REST endpoint and the admin
+ * "book a lesson for a student" form: which offering a slot may be booked as,
+ * claiming the slot(s) and writing the lesson row(s), and raising the payment
+ * that confirms them.
+ *
+ * It deliberately knows nothing about who is asking. Authorisation — a guardian
+ * booking for their own child, a studio admin booking for anyone — is settled by
+ * the caller before anything here is touched, and so are the intake answers and
+ * policy acceptances that gate a student's own booking (an admin booking on
+ * someone's behalf has none to collect). What must not diverge between the two
+ * paths is everything below: the offering rules that decide a slot's price and
+ * payment routing, the atomic claim that stops a double-booking, and the billing
+ * that follows.
+ */
+class LessonBooker {
+
+	/**
+	 * The most occurrences a single weekly booking may reserve at once, so one
+	 * student cannot lock up an instructor's entire recurring schedule.
+	 */
+	public const MAX_WEEKLY_OCCURRENCES = 12;
+
+	public function __construct(
+		private AvailabilityRepository $availability,
+		private BookingRepository $bookings,
+		private OfferingRepository $offerings,
+		private PaymentService $payments,
+		private GuardianService $guardians,
+	) {}
+
+	/**
+	 * Resolve the offering a slot is to be booked as. A caller-supplied offering
+	 * must never override the slot's price or payment routing: when the slot is
+	 * tied to a specific offering that offering is authoritative, and any offering
+	 * used must belong to the slot's instructor. This prevents substituting a
+	 * cheaper/free offering to dodge payment, or another instructor's offering to
+	 * misroute it.
+	 */
+	public function resolveOffering( AvailabilitySlot $slot, int $requestedOfferingId ): Offering|\WP_Error {
+		$requestedOfferingId = absint( $requestedOfferingId );
+		$slotOfferingId      = (int) ( $slot->offeringId ?? 0 );
+
+		if ( $slotOfferingId > 0 ) {
+			if ( $requestedOfferingId > 0 && $requestedOfferingId !== $slotOfferingId ) {
+				return new \WP_Error( 'offering_mismatch', __( 'This slot is tied to a different offering.', 'unsupervised-schedular' ), [ 'status' => 400 ] );
+			}
+			$offeringId = $slotOfferingId;
+		} else {
+			$offeringId = $requestedOfferingId;
+		}
+
+		// Every lesson books against an offering: it carries the price, intake
+		// questions, and payment routing. Without one the booking would silently
+		// be free and unquestioned, so generic slots require an explicit choice.
+		if ( $offeringId <= 0 ) {
+			return new \WP_Error( 'offering_required', __( 'Choose a lesson type to book this slot.', 'unsupervised-schedular' ), [ 'status' => 400 ] );
+		}
+
+		$offering = $this->offerings->findById( $offeringId );
+		if ( null === $offering ) {
+			return new \WP_Error( 'invalid_offering', __( 'Offering not found.', 'unsupervised-schedular' ), [ 'status' => 400 ] );
+		}
+
+		if ( $offering->instructorId !== $slot->instructorId ) {
+			return new \WP_Error( 'offering_mismatch', __( 'That offering is not available for this slot.', 'unsupervised-schedular' ), [ 'status' => 400 ] );
+		}
+
+		// A slot-tied offering was the instructor's explicit choice and is honoured
+		// as-is; a chosen one must be something the catalog actually offers for this
+		// slot: an active private-lesson type whose length fits the slot.
+		if ( 0 === $slotOfferingId ) {
+			if ( ! $offering->isActive || Offering::KIND_PRIVATE_LESSON !== $offering->kind ) {
+				return new \WP_Error( 'invalid_offering', __( 'That offering cannot be booked as a private lesson.', 'unsupervised-schedular' ), [ 'status' => 400 ] );
+			}
+
+			if ( null !== $offering->durationMinutes && $offering->durationMinutes !== $slot->durationMinutes ) {
+				return new \WP_Error( 'offering_mismatch', __( 'That offering does not match this slot\'s lesson length.', 'unsupervised-schedular' ), [ 'status' => 400 ] );
+			}
+		}
+
+		return $offering;
+	}
+
+	/**
+	 * Claim the slot(s) and write the lesson row(s) — a single lesson, or one per
+	 * remaining occurrence of the slot's weekly group. The rows are created
+	 * `pending`; `settle()` decides what confirms them.
+	 *
+	 * `$bookedBy` is the staff member booking on the student's behalf, and 0 for a
+	 * booking made through the student-facing flow. It is recorded on every lesson
+	 * of a series, since a series is booked once.
+	 *
+	 * @return array{ids: list<int>, anchor_id: int}|\WP_Error
+	 */
+	public function reserve( AvailabilitySlot $slot, Offering $offering, int $studentId, string $recurrence, ?string $notes = null, int $bookedBy = 0 ): array|\WP_Error {
+		$slotId     = (int) $slot->id;
+		$recurrence = Lesson::RECURRENCE_WEEKLY === $recurrence ? Lesson::RECURRENCE_WEEKLY : Lesson::RECURRENCE_SINGLE;
+
+		$template = new Lesson(
+			slotId:       $slotId,
+			studentId:    $studentId,
+			instructorId: $slot->instructorId,
+			offeringId:   (int) $offering->id,
+			recurrence:   $recurrence,
+			notes:        null !== $notes && '' !== $notes ? $notes : null,
+			bookedBy:     $bookedBy,
+		);
+
+		// Weekly reservation across the slot's recurring group; otherwise a single lesson.
+		if ( Lesson::RECURRENCE_WEEKLY === $recurrence && null !== $slot->recurrenceGroup ) {
+			// Claim each occurrence atomically (capped so one booking cannot lock an
+			// instructor's entire schedule), then create a lesson only for the slots
+			// this request actually won — never for one already taken by someone else.
+			$candidates = array_map( static fn( $s ): int => (int) $s->id, $this->availability->findUnbookedInGroup( $slot->recurrenceGroup ) );
+			$candidates = array_slice( $candidates, 0, self::MAX_WEEKLY_OCCURRENCES );
+
+			$claimed = array_values( array_filter( $candidates, fn( int $candidateId ): bool => $this->availability->claim( $candidateId ) ) );
+			if ( [] === $claimed ) {
+				return new \WP_Error( 'slot_taken', __( 'This slot is already booked.', 'unsupervised-schedular' ), [ 'status' => 409 ] );
+			}
+
+			$ids = $this->bookings->insertSeries( $template, $claimed );
+
+			return [
+				'ids'       => $ids,
+				'anchor_id' => $ids[0] ?? 0,
+			];
+		}
+
+		// Claim before inserting: if another request already took the slot, the
+		// guarded update reports no rows and we reject rather than double-book.
+		if ( ! $this->availability->claim( $slotId ) ) {
+			return new \WP_Error( 'slot_taken', __( 'This slot is already booked.', 'unsupervised-schedular' ), [ 'status' => 409 ] );
+		}
+
+		$anchorId = $this->bookings->insert( $template );
+
+		return [
+			'ids'       => [ $anchorId ],
+			'anchor_id' => $anchorId,
+		];
+	}
+
+	/**
+	 * Raise the payment for a reservation and report the status its lessons end up
+	 * in. A priced booking stays `pending` until its payment settles; anything with
+	 * nothing to charge now — a free offering, scheduled billing, or a booking the
+	 * caller marked `$noCharge` — is confirmed here and then.
+	 *
+	 * @param list<int> $ids
+	 *
+	 * @return array{status: string, payment: ?Payment}
+	 */
+	public function settle( array $ids, int $anchorId, AvailabilitySlot $slot, Offering $offering, int $studentId, bool $noCharge = false ): array {
+		// Scheduled billing (weekly / monthly) normally defers payment to the daily
+		// scan, but a single lesson booked once its scheduled due date has already
+		// passed — e.g. an extra lesson added to a month that was already billed — is
+		// charged at booking instead, so it is never missed or billed late.
+		$chargeAtBooking = ! $noCharge && $offering->price > 0.0 && (
+			! $offering->isScheduledBilling()
+			|| ( 1 === count( $ids ) && $this->scheduledDueHasPassed( $offering, $slot->startDt ) )
+		);
+
+		if ( $chargeAtBooking ) {
+			// A full-term price already covers the whole reservation; a per-lesson
+			// (one_time) price is owed once per occurrence actually claimed, so a
+			// weekly reservation cannot hold a term while paying for one week.
+			$amount = Offering::BILLING_FULL_TERM === $offering->billingMode
+				? $offering->price
+				: $offering->price * count( $ids );
+
+			$payment = $this->payments->createForRegistration(
+				Payment::REG_LESSON,
+				$anchorId,
+				$studentId,
+				$slot->instructorId,
+				$amount,
+				$offering->currency,
+				$offering->etransferEmail,
+				payerId: $this->guardians->payerFor( $studentId )
+			);
+
+			return [
+				'status'  => null !== $payment && $payment->isPaid() ? Lesson::STATUS_CONFIRMED : Lesson::STATUS_PENDING,
+				'payment' => $payment,
+			];
+		}
+
+		// Either nothing is owed — a free offering, or a booking the studio comped —
+		// or scheduled billing (weekly / monthly) whose payment is deferred to the
+		// daily billing scan. Either way there is no payment step now to confirm the
+		// lessons, so the reserved slots are confirmed at booking time; the billing
+		// scan bills the scheduled ones when they come due.
+		foreach ( $ids as $lessonId ) {
+			$this->bookings->updateStatus( $lessonId, Lesson::STATUS_CONFIRMED );
+		}
+
+		return [
+			'status'  => Lesson::STATUS_CONFIRMED,
+			'payment' => null,
+		];
+	}
+
+	/**
+	 * Whether a scheduled-billing offering's due date for a lesson has already
+	 * gone by — monthly bills on the first of the lesson's month, weekly the day
+	 * before the lesson.
+	 */
+	private function scheduledDueHasPassed( Offering $offering, string $slotStart ): bool {
+		$now   = new \DateTimeImmutable( Val::string( current_time( 'mysql' ) ) );
+		$start = new \DateTimeImmutable( $slotStart );
+
+		if ( Offering::BILLING_MONTHLY === $offering->billingMode ) {
+			return $now->format( 'Y-m-d' ) >= $start->format( 'Y-m-01' );
+		}
+
+		return $now >= $start->modify( '-1 day' );
+	}
+}

src/Booking/LessonController.php

@@ -10,6 +10,9 @@ use Unsupervised\Schedular\Availability\WeekCalendar;
 use Unsupervised\Schedular\Offering\OfferingRepository;
 use Unsupervised\Schedular\Payment\Payment;
 use Unsupervised\Schedular\Payment\PaymentRepository;
+use Unsupervised\Schedular\Registration\IntakeAudit;
+use Unsupervised\Schedular\Registration\IntakeProvenance;
+use Unsupervised\Schedular\Registration\IntakeRecording;
 use Unsupervised\Schedular\Val;
 
 class LessonController {
@@ -19,7 +22,9 @@ class LessonController {
 		private PaymentRepository $payments,
 		private AvailabilityRepository $availability,
 		private OfferingRepository $offerings,
-		private LessonDetail $detail,
+		private IntakeAudit $detail,
+		private AdminBooking $adminBooking,
+		private IntakeRecording $intake,
 	) {}
 
 	public function renderAdminDashboard(): void {
@@ -31,11 +36,11 @@ class LessonController {
 			return;
 		}
 
-		$this->handleEtransferUpdate( false );
+		[ $notice, $error ] = $this->handleFormAction( false, 0 );
 
 		$rows = array_map( fn( Lesson $lesson ): array => $this->row( $lesson ), $this->repository->findAllUpcoming() );
 
-		$this->renderLessonsPage( $rows, 'us-scheduler' );
+		$this->renderLessonsPage( $rows, 'us-scheduler', 0, $notice, $error );
 	}
 
 	public function renderInstructorLessons(): void {
@@ -47,11 +52,13 @@ class LessonController {
 			return;
 		}
 
-		$this->handleEtransferUpdate( true );
+		$instructorId = get_current_user_id();
 
-		$rows = array_map( fn( Lesson $lesson ): array => $this->row( $lesson ), $this->repository->findUpcomingForInstructor( get_current_user_id() ) );
+		[ $notice, $error ] = $this->handleFormAction( true, $instructorId );
 
-		$this->renderLessonsPage( $rows, 'us-my-lessons' );
+		$rows = array_map( fn( Lesson $lesson ): array => $this->row( $lesson ), $this->repository->findUpcomingForInstructor( $instructorId ) );
+
+		$this->renderLessonsPage( $rows, 'us-my-lessons', $instructorId, $notice, $error );
 	}
 
 	/**
@@ -68,15 +75,23 @@ class LessonController {
 
 		$lesson  = $this->repository->findById( $lessonId );
 		$backUrl = admin_url( 'admin.php?page=' . $pageSlug );
+		$notice  = '';
+		$error   = '';
 
 		if ( null === $lesson || ( $onlyOwn && get_current_user_id() !== $lesson->instructorId ) ) {
 			$row     = null;
 			$answers = [];
 			$accepts = [];
+			$intake  = $this->emptyIntake();
 		} else {
+			// Recorded before the tables are read, so what was just entered appears
+			// on the page that reports it.
+			[ $notice, $error ] = $this->recordIntake( $lesson );
+
 			$row     = $this->row( $lesson );
-			$answers = $this->detail->answers( $lessonId );
-			$accepts = $this->detail->acceptances( $lessonId );
+			$answers = $this->detail->answers( $lesson );
+			$accepts = $this->detail->acceptances( $lesson );
+			$intake  = $this->intakeForm( $lesson );
 		}
 
 		include USC_PLUGIN_DIR . 'templates/admin/lesson-detail.php';
@@ -84,13 +99,86 @@ class LessonController {
 		return true;
 	}
 
+	/**
+	 * Handle a submitted "record intake collected elsewhere" form.
+	 *
+	 * @return array{string, string} Success notice and error message.
+	 */
+	private function recordIntake( Lesson $lesson ): array {
+		if ( ! isset( $_POST['usc_action'] ) || ! check_admin_referer( 'usc_lesson_action' ) ) {
+			return [ '', '' ];
+		}
+
+		// phpcs:disable WordPress.Security.NonceVerification.Missing -- nonce checked above.
+		if ( 'record_intake' !== sanitize_key( Val::string( wp_unslash( $_POST['usc_action'] ) ) ) ) {
+			return [ '', '' ];
+		}
+
+		$answers = [];
+		// phpcs:ignore WordPress.Security.ValidatedSanitizedInput.InputNotSanitized, WordPress.Security.ValidatedSanitizedInput.MissingUnslash -- each value is unslashed and sanitized below.
+		foreach ( (array) ( $_POST['answers'] ?? [] ) as $questionId => $value ) {
+			$answers[ absint( Val::int( $questionId ) ) ] = sanitize_textarea_field( Val::string( wp_unslash( $value ) ) );
+		}
+
+		// phpcs:ignore WordPress.Security.ValidatedSanitizedInput.InputNotSanitized, WordPress.Security.ValidatedSanitizedInput.MissingUnslash -- each element is coerced to a positive int; slashes cannot survive integer coercion.
+		$rawVersionIds = (array) ( $_POST['accepted_policy_version_ids'] ?? [] );
+		$versionIds    = array_values( array_filter( array_map( static fn( mixed $v ): int => absint( Val::int( $v ) ), $rawVersionIds ) ) );
+
+		$result = $this->intake->record(
+			$lesson,
+			$answers,
+			$versionIds,
+			sanitize_key( Val::string( wp_unslash( $_POST['collected_via'] ?? '' ) ) ),
+			sanitize_text_field( Val::string( wp_unslash( $_POST['collected_note'] ?? '' ) ) ),
+			get_current_user_id()
+		);
+		// phpcs:enable WordPress.Security.NonceVerification.Missing
+
+		return $result instanceof \WP_Error
+			? [ '', $result->get_error_message() ]
+			: [ $result, '' ];
+	}
+
+	/**
+	 * What the detail template needs to offer the recording form: whether this
+	 * lesson qualifies at all, what is still missing, and the collection methods
+	 * to choose between.
+	 *
+	 * @return array{recordable: bool, questions: list<array{id: int, label: string, required: bool}>, policies: list<array{version_id: int, policy: string, version: string}>, methods: array<string, string>}
+	 */
+	private function intakeForm( Lesson $lesson ): array {
+		if ( ! $lesson->isStaffRegistered() ) {
+			return $this->emptyIntake();
+		}
+
+		return [ 'recordable' => true ] + $this->intake->pending( $lesson ) + [ 'methods' => IntakeProvenance::choices() ];
+	}
+
+	/**
+	 * The form data for a lesson that cannot be recorded against — one the student
+	 * booked, or one that could not be opened at all.
+	 *
+	 * @return array{recordable: bool, questions: list<array{id: int, label: string, required: bool}>, policies: list<array{version_id: int, policy: string, version: string}>, methods: array<string, string>}
+	 */
+	private function emptyIntake(): array {
+		return [
+			'recordable' => false,
+			'questions'  => [],
+			'policies'   => [],
+			'methods'    => [],
+		];
+	}
+
 	/**
 	 * Render the lessons template with its calendar view state: week (default)
-	 * or list, plus which week the week view shows.
+	 * or list, plus which week the week view shows, and the choices the
+	 * book-for-a-student form offers — scoped to one instructor's own schedule on
+	 * **My Lessons**, studio-wide (0) on the **Scheduler**.
 	 *
 	 * @param list<array<string, mixed>> $rows
 	 */
-	private function renderLessonsPage( array $rows, string $pageSlug ): void {
+	// phpcs:ignore Generic.CodeAnalysis.UnusedFunctionParameter -- $notice is read by the included template.
+	private function renderLessonsPage( array $rows, string $pageSlug, int $onlyInstructorId, string $notice, string $error ): void {
 		// View-state query params only (which view, which week) — nothing is
 		// mutated from them, so no nonce applies.
 		// phpcs:disable WordPress.Security.NonceVerification.Recommended
@@ -103,21 +191,108 @@ class LessonController {
 		$prevWeek  = ( new \DateTimeImmutable( $weekStart ) )->modify( '-7 days' )->format( 'Y-m-d' );
 		$nextWeek  = ( new \DateTimeImmutable( $weekStart ) )->modify( '+7 days' )->format( 'Y-m-d' );
 		$baseUrl   = admin_url( 'admin.php?page=' . $pageSlug );
+		$bookForm  = $this->adminBooking->formData( $onlyInstructorId );
+
+		// A refused booking is shown again as it was typed — losing five fields to a
+		// single mistake is what made the panel infuriating to correct. A successful
+		// one starts empty, so the next booking does not inherit the last one's.
+		$bookValues = '' !== $error ? $this->submittedBooking() : $this->emptyBooking();
 
 		include USC_PLUGIN_DIR . 'templates/admin/lessons.php';
 	}
 
 	/**
-	 * Handle a per-lesson payment override (e-transfer email or HST rate). When
-	 * $onlyOwn, the payment must belong to the current instructor.
+	 * Run the submitted action and report what happened: a per-lesson payment
+	 * override (e-transfer email or HST rate), or a lesson booked for a student.
+	 * When $onlyOwn, the payment or slot must belong to the current instructor.
+	 *
+	 * @return array{string, string} Success notice and error message; each is
+	 *                               empty when it does not apply.
 	 */
-	private function handleEtransferUpdate( bool $onlyOwn ): void {
+	private function handleFormAction( bool $onlyOwn, int $instructorId ): array {
 		if ( ! isset( $_POST['usc_action'] ) || ! check_admin_referer( 'usc_lesson_action' ) ) {
-			return;
+			return [ '', '' ];
 		}
 
-		// phpcs:disable WordPress.Security.NonceVerification.Missing -- nonce checked above.
-		$action    = sanitize_key( Val::string( wp_unslash( $_POST['usc_action'] ) ) );
+		// phpcs:ignore WordPress.Security.NonceVerification.Missing -- nonce checked above.
+		$action = sanitize_key( Val::string( wp_unslash( $_POST['usc_action'] ) ) );
+
+		if ( 'book_for_student' === $action ) {
+			return $this->bookForStudent( $onlyOwn ? $instructorId : 0 );
+		}
+
+		$this->updatePayment( $action, $onlyOwn );
+
+		return [ '', '' ];
+	}
+
+	/**
+	 * Book a lesson on a student's behalf from the submitted form. The slot is
+	 * scoped to the instructor's own schedule on **My Lessons** ($onlyInstructorId
+	 * non-zero) and studio-wide on the **Scheduler**.
+	 *
+	 * @return array{string, string}
+	 */
+	private function bookForStudent( int $onlyInstructorId ): array {
+		$submitted = $this->submittedBooking();
+
+		$result = $this->adminBooking->book(
+			$submitted['student_id'],
+			$submitted['slot_id'],
+			$submitted['offering_id'],
+			$submitted['weekly'] ? Lesson::RECURRENCE_WEEKLY : Lesson::RECURRENCE_SINGLE,
+			$submitted['no_charge'],
+			$submitted['notes'],
+			$onlyInstructorId
+		);
+
+		return $result instanceof \WP_Error
+			? [ '', $result->get_error_message() ]
+			: [ $result, '' ];
+	}
+
+	/**
+	 * The book-for-a-student form exactly as submitted. Read in one place so what
+	 * gets booked and what the form shows again after a refusal cannot drift apart
+	 * on a field name.
+	 *
+	 * @return array{student_id: int, slot_id: int, offering_id: int, weekly: bool, no_charge: bool, notes: string}
+	 */
+	private function submittedBooking(): array {
+		// phpcs:disable WordPress.Security.NonceVerification.Missing -- read only after handleFormAction() has verified the nonce: to book, or to re-render (escaped) a form it refused.
+		return [
+			'student_id'  => absint( Val::int( $_POST['student_id'] ?? 0 ) ),
+			'slot_id'     => absint( Val::int( $_POST['slot_id'] ?? 0 ) ),
+			'offering_id' => absint( Val::int( $_POST['offering_id'] ?? 0 ) ),
+			'weekly'      => isset( $_POST['recurrence_weekly'] ),
+			'no_charge'   => isset( $_POST['no_charge'] ),
+			'notes'       => sanitize_text_field( Val::string( wp_unslash( $_POST['notes'] ?? '' ) ) ),
+		];
+		// phpcs:enable WordPress.Security.NonceVerification.Missing
+	}
+
+	/**
+	 * An untouched book-for-a-student form.
+	 *
+	 * @return array{student_id: int, slot_id: int, offering_id: int, weekly: bool, no_charge: bool, notes: string}
+	 */
+	private function emptyBooking(): array {
+		return [
+			'student_id'  => 0,
+			'slot_id'     => 0,
+			'offering_id' => 0,
+			'weekly'      => false,
+			'no_charge'   => false,
+			'notes'       => '',
+		];
+	}
+
+	/**
+	 * Apply a per-lesson payment override. When $onlyOwn, the payment must belong
+	 * to the current instructor.
+	 */
+	private function updatePayment( string $action, bool $onlyOwn ): void {
+		// phpcs:disable WordPress.Security.NonceVerification.Missing -- nonce checked by the caller.
 		$paymentId = absint( Val::int( $_POST['payment_id'] ?? 0 ) );
 		$email     = sanitize_email( Val::string( wp_unslash( $_POST['etransfer_email'] ?? '' ) ) );
 		// phpcs:ignore WordPress.Security.ValidatedSanitizedInput.MissingUnslash, WordPress.Security.ValidatedSanitizedInput.InputNotSanitized -- Val::float() coerces to float; slashes cannot survive numeric coercion.

src/Booking/LessonDetail.php

@@ -1,73 +0,0 @@
-<?php
-declare(strict_types=1);
-
-namespace Unsupervised\Schedular\Booking;
-
-use Unsupervised\Schedular\Policy\AcceptanceRepository;
-use Unsupervised\Schedular\Policy\PolicyAcceptance;
-use Unsupervised\Schedular\Policy\PolicyRepository;
-use Unsupervised\Schedular\Policy\PolicyVersionRepository;
-use Unsupervised\Schedular\Registration\Answer;
-use Unsupervised\Schedular\Registration\AnswerRepository;
-use Unsupervised\Schedular\Registration\QuestionRepository;
-
-/**
- * Builds the display rows for the admin lesson detail view: the intake answers
- * the student submitted and the policy versions they accepted when booking.
- *
- * Scoped to a single lesson (the `lesson` registration type), mirroring the
- * per-student history in {@see \Unsupervised\Schedular\Auth\StudentHistory}.
- */
-class LessonDetail {
-
-	public function __construct(
-		private AnswerRepository $answers,
-		private QuestionRepository $questions,
-		private AcceptanceRepository $acceptances,
-		private PolicyRepository $policies,
-		private PolicyVersionRepository $versions,
-	) {}
-
-	/**
-	 * The intake-question answers recorded for this lesson, in submission order.
-	 *
-	 * @return list<array{question: string, answer: string}>
-	 */
-	public function answers( int $lessonId ): array {
-		return array_map(
-			function ( Answer $answer ): array {
-				$question = $this->questions->findById( $answer->questionId );
-				$value    = $answer->answerValue ?? '';
-
-				return [
-					'question' => $question ? $question->label : sprintf( '#%d', $answer->questionId ),
-					'answer'   => '' === $value ? '—' : $value,
-				];
-			},
-			$this->answers->findByRegistration( Answer::REG_LESSON, $lessonId )
-		);
-	}
-
-	/**
-	 * The policy versions the student accepted when booking this lesson, with the
-	 * captured acceptance time and IP for the audit trail.
-	 *
-	 * @return list<array{policy: string, version: string, accepted_at: string, ip: string}>
-	 */
-	public function acceptances( int $lessonId ): array {
-		return array_map(
-			function ( PolicyAcceptance $acceptance ): array {
-				$version = $this->versions->findById( $acceptance->policyVersionId );
-				$policy  = $version ? $this->policies->findById( $version->policyId ) : null;
-
-				return [
-					'policy'      => $policy ? $policy->title : sprintf( '#%d', $acceptance->policyVersionId ),
-					'version'     => $version ? sprintf( 'v%d', $version->versionNumber ) : '—',
-					'accepted_at' => $acceptance->acceptedAt ?? '',
-					'ip'          => $acceptance->ipAddress ?? '',
-				];
-			},
-			$this->acceptances->findByRegistration( PolicyAcceptance::REG_LESSON, $lessonId )
-		);
-	}
-}

src/GroupClass/Enrollment.php

@@ -3,9 +3,11 @@ declare(strict_types=1);
 
 namespace Unsupervised\Schedular\GroupClass;
 
+use Unsupervised\Schedular\Registration\Answer;
+use Unsupervised\Schedular\Registration\IntakeSubject;
 use Unsupervised\Schedular\Val;
 
-class Enrollment {
+class Enrollment implements IntakeSubject {
 
 	public const STATUS_ACTIVE    = 'active';
 	public const STATUS_CANCELLED = 'cancelled';
@@ -24,9 +26,45 @@ class Enrollment {
 		public readonly int $instructorId,
 		public readonly string $status = self::STATUS_ACTIVE,
 		public readonly ?int $paymentId = null,
+		/**
+		 * The staff member who enrolled this student from wp-admin — the class
+		 * detail page's **Add students directly**; 0 when the student or their
+		 * guardian enrolled themselves. It is what marks an enrolment whose intake
+		 * answers and policy acceptances may be recorded after the fact, nobody
+		 * having been at a keyboard to give them at the time.
+		 */
+		public readonly int $enrolledBy = 0,
 		public readonly ?int $id = null,
 	) {}
 
+	public function intakeRegistrationType(): string {
+		return Answer::REG_ENROLLMENT;
+	}
+
+	/**
+	 * An enrolment is registered once and is its own registration — there is no
+	 * series anchor to follow, as a term of classes is one enrolment.
+	 */
+	public function intakeRegistrationId(): int {
+		return (int) $this->id;
+	}
+
+	public function intakeOfferingId(): int {
+		return $this->offeringId;
+	}
+
+	public function intakeStudentId(): int {
+		return $this->studentId;
+	}
+
+	/**
+	 * Whether the studio enrolled this student, rather than the student (or their
+	 * guardian) enrolling themselves.
+	 */
+	public function isStaffRegistered(): bool {
+		return $this->enrolledBy > 0;
+	}
+
 	public static function fromRow( \stdClass $row ): self {
 		return new self(
 			offeringId:   Val::int( $row->offering_id ),
@@ -34,6 +72,7 @@ class Enrollment {
 			instructorId: Val::int( $row->instructor_id ),
 			status:       Val::string( $row->status ),
 			paymentId:    Val::intOrNull( $row->payment_id ),
+			enrolledBy:   Val::int( $row->enrolled_by ?? 0 ),
 			id:           Val::int( $row->id ),
 		);
 	}
@@ -51,6 +90,7 @@ class Enrollment {
 			'instructor_id' => $this->instructorId,
 			'status'        => $this->status,
 			'payment_id'    => $this->paymentId,
+			'enrolled_by'   => $this->enrolledBy,
 		];
 	}
 }

src/GroupClass/EnrollmentEndpoint.php

@@ -4,6 +4,7 @@ declare(strict_types=1);
 namespace Unsupervised\Schedular\GroupClass;
 
 use Unsupervised\Schedular\Auth\RoleManager;
+use Unsupervised\Schedular\Guardian\GuardianService;
 use Unsupervised\Schedular\Offering\Offering;
 use Unsupervised\Schedular\Offering\OfferingRepository;
 use Unsupervised\Schedular\Payment\Payment;
@@ -20,6 +21,7 @@ class EnrollmentEndpoint {
 		private RegistrationGate $gate,
 		private PaymentService $payments,
 		private GroupAccessRepository $access,
+		private GuardianService $guardians,
 	) {}
 
 	/**
@@ -47,6 +49,13 @@ class EnrollmentEndpoint {
 							'required'          => true,
 							'sanitize_callback' => 'absint',
 						],
+						// Who is being enrolled. 0/absent means the caller enrols
+						// themselves; a child's id is honoured only for their guardian.
+						'student_id'                  => [
+							'type'              => 'integer',
+							'default'           => 0,
+							'sanitize_callback' => 'absint',
+						],
 						'answers'                     => [
 							'type'    => 'object',
 							'default' => [],
@@ -81,13 +90,25 @@ class EnrollmentEndpoint {
 		} elseif ( current_user_can( RoleManager::CAP_MANAGE_AVAILABILITY ) ) {
 			$enrollments = $this->enrollments->findByInstructor( $userId );
 		} else {
-			$enrollments = $this->enrollments->findByStudent( $userId );
+			// A guardian sees the whole household's enrolments — their own and
+			// every child's — so one account covers the family.
+			$enrollments = [];
+			foreach ( $this->guardians->householdIds( $userId ) as $studentId ) {
+				$enrollments = array_merge( $enrollments, $this->enrollments->findByStudent( $studentId ) );
+			}
 		}
 
 		return new \WP_REST_Response( array_map( fn( Enrollment $e ) => $e->toArray(), $enrollments ), 200 );
 	}
 
 	public function enroll( \WP_REST_Request $request ): \WP_REST_Response|\WP_Error {
+		// Who is being enrolled is settled before anything else, so an
+		// unauthorised student id never reaches a seat claim or a charge.
+		$studentId = $this->resolveStudent( $request );
+		if ( $studentId instanceof \WP_Error ) {
+			return $studentId;
+		}
+
 		$offeringId = absint( Val::int( $request->get_param( 'offering_id' ) ) );
 		$offering   = $this->offerings->findById( $offeringId );
 
@@ -95,8 +116,6 @@ class EnrollmentEndpoint {
 			return new \WP_Error( 'invalid_offering', __( 'Group class not found.', 'unsupervised-schedular' ), [ 'status' => 404 ] );
 		}
 
-		$studentId = get_current_user_id();
-
 		if ( $this->enrollments->hasActiveEnrollment( $offeringId, $studentId ) ) {
 			return new \WP_Error( 'already_enrolled', __( 'You are already enrolled in this class.', 'unsupervised-schedular' ), [ 'status' => 409 ] );
 		}
@@ -133,7 +152,9 @@ class EnrollmentEndpoint {
 			)
 		);
 
-		$this->gate->record( PolicyAcceptance::REG_ENROLLMENT, $id, $studentId, $offeringId, $answers, $acceptedVersionIds, $this->clientIp() );
+		// The acceptance binds the student but is attributed to whoever ticked the
+		// boxes — the guardian, when they enrolled a child.
+		$this->gate->record( PolicyAcceptance::REG_ENROLLMENT, $id, $studentId, $offeringId, $answers, $acceptedVersionIds, $this->clientIp(), get_current_user_id() );
 
 		// Mark the access grant used so instructor rosters distinguish invited
 		// students from enrolled ones (a no-op for public classes).
@@ -146,7 +167,16 @@ class EnrollmentEndpoint {
 		// regardless of payment.
 		$payment = null;
 		if ( $offering->price > 0.0 && ! $offering->isScheduledBilling() ) {
-			$payment = $this->payments->createForRegistration( Payment::REG_ENROLLMENT, $id, $studentId, $offering->instructorId, $offering->price, $offering->currency, $offering->etransferEmail );
+			$payment = $this->payments->createForRegistration(
+				Payment::REG_ENROLLMENT,
+				$id,
+				$studentId,
+				$offering->instructorId,
+				$offering->price,
+				$offering->currency,
+				$offering->etransferEmail,
+				payerId: $this->guardians->payerFor( $studentId )
+			);
 		}
 
 		// `payment: null` tells the front end to skip the payment step entirely.
@@ -172,14 +202,14 @@ class EnrollmentEndpoint {
 		$id         = absint( Val::int( $request->get_param( 'id' ) ) );
 		$enrollment = $this->enrollments->findById( $id );
 
-		if ( null === $enrollment ) {
+		// Someone else's enrolment is answered exactly as a nonexistent one, so the
+		// id space cannot be walked to count the studio's enrolments. See
+		// {@see \Unsupervised\Schedular\Booking\BookingEndpoint::cancel()}, which
+		// makes the same trade for the same reason.
+		if ( null === $enrollment || ! $this->guardians->canActFor( get_current_user_id(), $enrollment->studentId ) ) {
 			return new \WP_Error( 'not_found', __( 'Enrolment not found.', 'unsupervised-schedular' ), [ 'status' => 404 ] );
 		}
 
-		if ( get_current_user_id() !== $enrollment->studentId ) {
-			return new \WP_Error( 'forbidden', __( 'You cannot withdraw from this class.', 'unsupervised-schedular' ), [ 'status' => 403 ] );
-		}
-
 		if ( Enrollment::STATUS_ACTIVE === $enrollment->status ) {
 			$offering = $this->offerings->findById( $enrollment->offeringId );
 
@@ -212,6 +242,30 @@ class EnrollmentEndpoint {
 		return is_user_logged_in() && current_user_can( RoleManager::CAP_BOOK_LESSON );
 	}
 
+	/**
+	 * Who this enrolment is for: the caller by default, or one of their children
+	 * when a `student_id` is supplied and they are that child's guardian. An id
+	 * the caller may not act for is a 403, never a silent fallback to themselves.
+	 */
+	private function resolveStudent( \WP_REST_Request $request ): int|\WP_Error {
+		$userId    = get_current_user_id();
+		$requested = absint( Val::int( $request->get_param( 'student_id' ) ) );
+
+		if ( $requested <= 0 || $requested === $userId ) {
+			return $userId;
+		}
+
+		if ( ! $this->guardians->canActFor( $userId, $requested ) ) {
+			return new \WP_Error(
+				'forbidden',
+				__( 'You cannot enrol that student.', 'unsupervised-schedular' ),
+				[ 'status' => 403 ]
+			);
+		}
+
+		return $requested;
+	}
+
 	/**
 	 * Extract a question_id => value map from the request.
 	 *

src/GroupClass/EnrollmentRepository.php

@@ -20,9 +20,10 @@ class EnrollmentRepository {
 				'instructor_id' => $enrollment->instructorId,
 				'status'        => $enrollment->status,
 				'payment_id'    => $enrollment->paymentId,
+				'enrolled_by'   => $enrollment->enrolledBy,
 				'enrolled_at'   => current_time( 'mysql' ),
 			],
-			[ '%d', '%d', '%d', '%s', '%d', '%s' ]
+			[ '%d', '%d', '%d', '%s', '%d', '%d', '%s' ]
 		);
 
 		return $this->db->insert_id;

src/GroupClass/GroupClassController.php

@@ -14,6 +14,9 @@ use Unsupervised\Schedular\Offering\OfferingRepository;
 use Unsupervised\Schedular\Payment\Payment;
 use Unsupervised\Schedular\Payment\PaymentRepository;
 use Unsupervised\Schedular\Payment\PaymentService;
+use Unsupervised\Schedular\Registration\IntakeAudit;
+use Unsupervised\Schedular\Registration\IntakeProvenance;
+use Unsupervised\Schedular\Registration\IntakeRecording;
 use Unsupervised\Schedular\Val;
 
 class GroupClassController {
@@ -26,6 +29,8 @@ class GroupClassController {
 		private PaymentService $paymentService,
 		private InviteRepository $invites,
 		private RegistrationMailer $mailer,
+		private IntakeAudit $audit,
+		private IntakeRecording $intake,
 	) {}
 
 	/**
@@ -41,13 +46,18 @@ class GroupClassController {
 			wp_die( esc_html__( 'You do not have permission to view group classes.', 'unsupervised-schedular' ) );
 		}
 
+		$baseUrl = admin_url( 'admin.php?page=us-group-classes' );
+
+		if ( $this->maybeRenderEnrollmentDetail( $baseUrl, 0 ) ) {
+			return;
+		}
+
 		$notice = '';
 		if ( isset( $_POST['usc_action'] ) && check_admin_referer( 'usc_group_action' ) ) {
 			$notice = $this->handleFormAction( get_current_user_id() );
 		}
 
 		$offerings = $this->offerings->findAll( 0, Offering::KIND_GROUP_CLASS );
-		$baseUrl   = admin_url( 'admin.php?page=us-group-classes' );
 
 		// View-state query param only (which class to drill into) — nothing is
 		// mutated from it, so no nonce applies.
@@ -104,6 +114,10 @@ class GroupClassController {
 
 		$instructorId = get_current_user_id();
 
+		if ( $this->maybeRenderEnrollmentDetail( admin_url( 'admin.php?page=us-my-group-classes' ), $instructorId ) ) {
+			return;
+		}
+
 		$notice = '';
 		if ( isset( $_POST['usc_action'] ) && check_admin_referer( 'usc_group_action' ) ) {
 			$notice = $this->handleFormAction( $instructorId );
@@ -144,6 +158,138 @@ class GroupClassController {
 		include USC_PLUGIN_DIR . 'templates/admin/my-group-classes.php';
 	}
 
+	/**
+	 * When the request targets a single enrolment (`?enrollment_id=`), render its
+	 * detail view — the audit trail of what the student answered and agreed to,
+	 * and, for an enrolment the studio made, the form to record intake collected
+	 * elsewhere. Reports whether the page has been handled.
+	 *
+	 * `$onlyInstructorId` scopes it the way the pages themselves are scoped: an
+	 * instructor may only open enrolments in their own classes, while the studio
+	 * **Group Classes** page passes 0 and may open any.
+	 */
+	private function maybeRenderEnrollmentDetail( string $baseUrl, int $onlyInstructorId ): bool {
+		// phpcs:ignore WordPress.Security.NonceVerification.Recommended -- read-only enrolment selector.
+		$enrollmentId = absint( Val::int( $_GET['enrollment_id'] ?? 0 ) );
+		if ( $enrollmentId <= 0 ) {
+			return false;
+		}
+
+		$enrollment = $this->enrollments->findById( $enrollmentId );
+		$notice     = '';
+		$error      = '';
+
+		if ( null === $enrollment || ( $onlyInstructorId > 0 && $enrollment->instructorId !== $onlyInstructorId ) ) {
+			$row     = null;
+			$answers = [];
+			$accepts = [];
+			$intake  = $this->emptyIntake();
+		} else {
+			// Recorded before the tables are read, so what was just entered appears
+			// on the page that reports it.
+			[ $notice, $error ] = $this->recordIntake( $enrollment );
+
+			$row     = $this->enrollmentRow( $enrollment );
+			$answers = $this->audit->answers( $enrollment );
+			$accepts = $this->audit->acceptances( $enrollment );
+			$intake  = $this->intakeForm( $enrollment );
+		}
+
+		include USC_PLUGIN_DIR . 'templates/admin/enrollment-detail.php';
+
+		return true;
+	}
+
+	/**
+	 * Who and what one enrolment is, for the head of its detail view.
+	 *
+	 * @return array{enrollment_id: int, student: string, class: string, instructor: string, status: string, payment: string}
+	 */
+	private function enrollmentRow( Enrollment $enrollment ): array {
+		$student  = get_userdata( $enrollment->studentId );
+		$offering = $this->offerings->findById( $enrollment->offeringId );
+		$payment  = null !== $enrollment->paymentId ? $this->payments->findById( $enrollment->paymentId ) : null;
+
+		return [
+			'enrollment_id' => (int) $enrollment->id,
+			'student'       => UserName::format( $student instanceof \WP_User ? $student : null, $enrollment->studentId ),
+			'class'         => null !== $offering ? $offering->title : '—',
+			'instructor'    => null !== $offering ? $this->instructorName( $offering ) : '—',
+			'status'        => $enrollment->status,
+			'payment'       => null !== $payment ? $payment->status : '—',
+		];
+	}
+
+	/**
+	 * Handle a submitted "record intake collected elsewhere" form.
+	 *
+	 * @return array{string, string} Success notice and error message.
+	 */
+	private function recordIntake( Enrollment $enrollment ): array {
+		if ( ! isset( $_POST['usc_action'] ) || ! check_admin_referer( 'usc_group_action' ) ) {
+			return [ '', '' ];
+		}
+
+		// phpcs:disable WordPress.Security.NonceVerification.Missing -- nonce checked above.
+		if ( 'record_intake' !== sanitize_key( Val::string( wp_unslash( $_POST['usc_action'] ) ) ) ) {
+			return [ '', '' ];
+		}
+
+		$answers = [];
+		// phpcs:ignore WordPress.Security.ValidatedSanitizedInput.InputNotSanitized, WordPress.Security.ValidatedSanitizedInput.MissingUnslash -- each value is unslashed and sanitized below.
+		foreach ( (array) ( $_POST['answers'] ?? [] ) as $questionId => $value ) {
+			$answers[ absint( Val::int( $questionId ) ) ] = sanitize_textarea_field( Val::string( wp_unslash( $value ) ) );
+		}
+
+		// phpcs:ignore WordPress.Security.ValidatedSanitizedInput.InputNotSanitized, WordPress.Security.ValidatedSanitizedInput.MissingUnslash -- each element is coerced to a positive int; slashes cannot survive integer coercion.
+		$rawVersionIds = (array) ( $_POST['accepted_policy_version_ids'] ?? [] );
+		$versionIds    = array_values( array_filter( array_map( static fn( mixed $v ): int => absint( Val::int( $v ) ), $rawVersionIds ) ) );
+
+		$result = $this->intake->record(
+			$enrollment,
+			$answers,
+			$versionIds,
+			sanitize_key( Val::string( wp_unslash( $_POST['collected_via'] ?? '' ) ) ),
+			sanitize_text_field( Val::string( wp_unslash( $_POST['collected_note'] ?? '' ) ) ),
+			get_current_user_id()
+		);
+		// phpcs:enable WordPress.Security.NonceVerification.Missing
+
+		return $result instanceof \WP_Error
+			? [ '', $result->get_error_message() ]
+			: [ $result, '' ];
+	}
+
+	/**
+	 * What the detail template needs to offer the recording form: whether this
+	 * enrolment qualifies at all, what is still missing, and the collection
+	 * methods to choose between.
+	 *
+	 * @return array{recordable: bool, questions: list<array{id: int, label: string, required: bool}>, policies: list<array{version_id: int, policy: string, version: string}>, methods: array<string, string>}
+	 */
+	private function intakeForm( Enrollment $enrollment ): array {
+		if ( ! $enrollment->isStaffRegistered() ) {
+			return $this->emptyIntake();
+		}
+
+		return [ 'recordable' => true ] + $this->intake->pending( $enrollment ) + [ 'methods' => IntakeProvenance::choices() ];
+	}
+
+	/**
+	 * The form data for an enrolment that cannot be recorded against — one the
+	 * student made, or one that could not be opened at all.
+	 *
+	 * @return array{recordable: bool, questions: list<array{id: int, label: string, required: bool}>, policies: list<array{version_id: int, policy: string, version: string}>, methods: array<string, string>}
+	 */
+	private function emptyIntake(): array {
+		return [
+			'recordable' => false,
+			'questions'  => [],
+			'policies'   => [],
+			'methods'    => [],
+		];
+	}
+
 	/**
 	 * Summary row for one class in the instructor overview: its identity, when it
 	 * meets, and how many active enrolments it holds against capacity.
@@ -176,7 +322,7 @@ class GroupClassController {
 	 * invite-only classes — the list of people invited but not yet enrolled.
 	 *
 	 * @param list<Enrollment> $enrollments
-	 * @return array{id: int|null, title: string, when: string, capacity: int|null, enrolled: int, invite_only: bool, instructor: string, price: float, currency: string, duration: int|null, description: string|null, schedule_note: string|null, deadline: string, enrollment_open: bool, active: bool, roster: list<array{student: string, status: string, payment: string|null}>, invited: list<array{who: string, kind: string}>}
+	 * @return array{id: int|null, title: string, when: string, capacity: int|null, enrolled: int, invite_only: bool, instructor: string, price: float, currency: string, duration: int|null, description: string|null, schedule_note: string|null, deadline: string, enrollment_open: bool, active: bool, roster: list<array{id: int, student: string, status: string, payment: string|null}>, invited: list<array{who: string, kind: string}>}
 	 */
 	private function classDetail( Offering $offering, array $enrollments ): array {
 		$roster = [];
@@ -189,6 +335,7 @@ class GroupClassController {
 			$payment = null !== $enrollment->paymentId ? $this->payments->findById( $enrollment->paymentId ) : null;
 
 			$roster[] = [
+				'id'      => (int) $enrollment->id,
 				'student' => $student ? $student->display_name : (string) $enrollment->studentId,
 				'status'  => $enrollment->status,
 				'payment' => $payment?->status,
@@ -334,6 +481,10 @@ class GroupClassController {
 					offeringId:   (int) $offering->id,
 					studentId:    $studentId,
 					instructorId: $offering->instructorId,
+					// Stamped so this enrolment can be told apart later: only one the
+					// studio made may have its intake recorded after the fact, the
+					// student never having been asked the questions.
+					enrolledBy:   get_current_user_id(),
 				)
 			);
 
@@ -489,7 +640,15 @@ class GroupClassController {
 	}
 
 	/**
-	 * The de-duplicated positive student ids posted from a multi-select.
+	 * The de-duplicated student ids posted from a multi-select, keeping only ids
+	 * that are actually students.
+	 *
+	 * The select is built from {@see studentOptions()}, but nothing stops a posted
+	 * id naming an instructor, an administrator, or an account deleted since the
+	 * page was drawn — and enrolling one would write a roster row, and bill it,
+	 * against someone who is not in the class. Vetting here covers both actions at
+	 * once, and against the same {@see RoleManager::isStudent()} the picker uses,
+	 * so a child or an unapproved signup is still perfectly enrollable.
 	 *
 	 * @return list<int>
 	 */
@@ -499,7 +658,7 @@ class GroupClassController {
 		$raw = (array) ( $_POST['student_ids'] ?? [] );
 		$ids = array_filter( array_map( static fn( mixed $v ): int => absint( Val::int( $v ) ), $raw ) );
 
-		return array_values( array_unique( $ids ) );
+		return array_values( array_filter( array_unique( $ids ), RoleManager::isStudent( ... ) ) );
 	}
 
 	/**

src/GroupClass/GroupClassPage.php

@@ -4,10 +4,13 @@ declare(strict_types=1);
 namespace Unsupervised\Schedular\GroupClass;
 
 use Unsupervised\Schedular\Auth\RoleManager;
+use Unsupervised\Schedular\Guardian\GuardianService;
 use Unsupervised\Schedular\Val;
 
 class GroupClassPage {
 
+	public function __construct( private GuardianService $guardians ) {}
+
 	/**
 	 * Renders the group-class enrolment shortcode output.
 	 *
@@ -39,6 +42,10 @@ class GroupClassPage {
 
 		$offeringId = absint( Val::int( $atts['offering'] ?? $atts['offeringId'] ?? 0 ) );
 
+		// Who this account may enrol — children first, the account holder last, so
+		// a guardian's default choice is a child rather than themselves.
+		$students = $this->guardians->bookableStudents( get_current_user_id() );
+
 		ob_start();
 		include USC_PLUGIN_DIR . 'templates/frontend/group-classes-page.php';
 		return (string) ob_get_clean();

src/GroupClass/SessionSchedule.php

@@ -0,0 +1,214 @@
+<?php
+declare(strict_types=1);
+
+namespace Unsupervised\Schedular\GroupClass;
+
+use Unsupervised\Schedular\Offering\Offering;
+use Unsupervised\Schedular\Offering\OfferingRepository;
+
+/**
+ * Turns group-class enrolments into dated sessions, so a class can appear
+ * alongside one-to-one lessons in every "upcoming" view.
+ *
+ * A group class is stored as a term (`term_start`, `term_end`, `class_time`)
+ * rather than as rows in `us_availability`, which is why an enrolment on its own
+ * has no date on it and why nothing that listed lessons ever showed one. The
+ * dates come from {@see Offering::sessionStarts()} — the same derivation the
+ * billing scan and the class-slot reconciler build on, so a student's list, an
+ * instructor's list and the invoice all agree on when the class meets.
+ *
+ * **A class you are enrolled in must never silently vanish from the list.** Both
+ * the class time and the duration are optional on the offering form, and the
+ * schedule note exists precisely so a studio can write "Tuesdays 4:00pm" instead
+ * of pinning the class to a clock. So the schedule degrades rather than
+ * disappearing:
+ *
+ * - date **and** time set — one dated row per remaining session, closed off with
+ *   the duration when there is one and left open-ended when there is not;
+ * - no time to derive dates from — a single row for the class as a whole, sorted
+ *   by when the term starts and labelled with `schedule` text
+ *   ({@see Offering::scheduleLabel()}) in place of a time.
+ *
+ * A row's `schedule` is the tell: non-null means "this is a class, described in
+ * words, not a session at a known time", and every renderer shows that text
+ * instead of a date and time.
+ */
+class SessionSchedule {
+
+	/**
+	 * Marks a row as a group-class session rather than a one-to-one lesson.
+	 * Callers use it to withhold the per-lesson actions (cancel, detail links)
+	 * that only mean something for a booked slot.
+	 */
+	public const KIND = 'group_class';
+
+	public function __construct(
+		private EnrollmentRepository $enrollments,
+		private OfferingRepository $offerings,
+	) {}
+
+	/**
+	 * Upcoming sessions of every class a student is enrolled in, soonest first.
+	 *
+	 * A withdrawn (cancelled) enrolment contributes nothing; a completed one is
+	 * kept, since "completed" describes the enrolment's billing state and says
+	 * nothing about whether the class has met yet.
+	 *
+	 * @return list<array{enrollment_id: int, offering_id: int, offering_title: string, instructor_id: int, status: string, start_dt: string, end_dt: string, duration_minutes: int|null, schedule: string|null}>
+	 */
+	public function upcomingForStudent( int $studentId, string $now ): array {
+		$rows = [];
+
+		foreach ( $this->enrollments->findByStudent( $studentId ) as $enrollment ) {
+			if ( Enrollment::STATUS_CANCELLED === $enrollment->status ) {
+				continue;
+			}
+
+			$offering = $this->offerings->findById( $enrollment->offeringId );
+			if ( null === $offering ) {
+				continue;
+			}
+
+			$rows = array_merge(
+				$rows,
+				$this->rowsFor( $offering, $now, (int) $enrollment->id, $enrollment->instructorId, $enrollment->status )
+			);
+		}
+
+		return self::sortedByStart( $rows );
+	}
+
+	/**
+	 * Upcoming sessions of every active group class an instructor teaches,
+	 * soonest first — one row per session, not per enrolled student. Enrolments
+	 * are not consulted at all: a class the instructor has to turn up and teach
+	 * belongs on their schedule whether or not anyone has signed up yet.
+	 *
+	 * @return list<array{enrollment_id: int, offering_id: int, offering_title: string, instructor_id: int, status: string, start_dt: string, end_dt: string, duration_minutes: int|null, schedule: string|null}>
+	 */
+	public function upcomingForInstructor( int $instructorId, string $now ): array {
+		$rows = [];
+
+		$classes = $this->offerings->findAll( $instructorId, Offering::KIND_GROUP_CLASS, activeOnly: true );
+
+		foreach ( $classes as $offering ) {
+			$rows = array_merge( $rows, $this->rowsFor( $offering, $now, 0, $instructorId, Enrollment::STATUS_ACTIVE ) );
+		}
+
+		return self::sortedByStart( $rows );
+	}
+
+	/**
+	 * One class's contribution to an upcoming list: its remaining dated sessions,
+	 * or — when it has no time to derive dates from — a single row describing the
+	 * class in words. Empty only when the class has demonstrably finished.
+	 *
+	 * @return list<array{enrollment_id: int, offering_id: int, offering_title: string, instructor_id: int, status: string, start_dt: string, end_dt: string, duration_minutes: int|null, schedule: string|null}>
+	 */
+	private function rowsFor( Offering $offering, string $now, int $enrollmentId, int $instructorId, string $status ): array {
+		$base = [
+			'enrollment_id'    => $enrollmentId,
+			'offering_id'      => (int) $offering->id,
+			'offering_title'   => $offering->title,
+			'instructor_id'    => $instructorId,
+			'status'           => $status,
+			'duration_minutes' => $offering->durationMinutes,
+		];
+
+		$starts = $offering->sessionStarts();
+
+		// Dated: the class says exactly when it meets, so list what is left of it
+		// — and nothing at all once the term is over.
+		if ( [] !== $starts ) {
+			$rows = [];
+
+			foreach ( $starts as $start ) {
+				if ( $start < $now ) {
+					continue;
+				}
+
+				$rows[] = $base + [
+					'start_dt' => $start,
+					// Left open when no duration is set. Knowing a class starts at
+					// four o'clock is worth showing even without knowing when it
+					// ends; guessing an end time is not.
+					'end_dt'   => $this->endOf( $offering, $start ),
+					'schedule' => null,
+				];
+			}
+
+			return $rows;
+		}
+
+		// Undated: no class time, so there is nothing to put on a clock. The class
+		// still gets a row — it is enrolled in and running — described by the
+		// studio's own schedule note or its term dates.
+		if ( ! $this->isStillRunning( $offering, $now ) ) {
+			return [];
+		}
+
+		return [
+			$base + [
+				// A sort key, not a claim about when the class meets: a class yet to
+				// start sorts to its first day, one already under way to right now.
+				// `schedule` is what any renderer actually shows.
+				'start_dt' => $this->sortKeyFor( $offering, $now ),
+				'end_dt'   => '',
+				'schedule' => $offering->scheduleLabel(),
+			],
+		];
+	}
+
+	/**
+	 * When a session that starts at `$start` finishes, or an empty string when the
+	 * class has no duration to close it off with.
+	 */
+	private function endOf( Offering $offering, string $start ): string {
+		if ( null === $offering->durationMinutes || $offering->durationMinutes <= 0 ) {
+			return '';
+		}
+
+		return ( new \DateTimeImmutable( $start ) )
+			->add( new \DateInterval( 'PT' . $offering->durationMinutes . 'M' ) )
+			->format( 'Y-m-d H:i:s' );
+	}
+
+	/**
+	 * Whether an undated class still has life in it: its last day has not passed,
+	 * or it has no dates at all (in which case nothing says it has ended, and
+	 * dropping it would be the very disappearance this class exists to prevent).
+	 */
+	private function isStillRunning( Offering $offering, string $now ): bool {
+		$lastDay = $offering->lastClassDay();
+
+		return null === $lastDay || $lastDay >= substr( $now, 0, 10 );
+	}
+
+	/**
+	 * Where an undated class sits in a list ordered by time: at its first day when
+	 * that is still ahead, otherwise at `$now`, so a term already under way reads
+	 * as current rather than as ancient history.
+	 */
+	private function sortKeyFor( Offering $offering, string $now ): string {
+		if ( null === $offering->termStart ) {
+			return $now;
+		}
+
+		$firstDay = $offering->termStart . ' 00:00:00';
+
+		return $firstDay > $now ? $firstDay : $now;
+	}
+
+	/**
+	 * Soonest session first, so classes from separate enrolments interleave by
+	 * date rather than arriving grouped by class.
+	 *
+	 * @param  list<array{enrollment_id: int, offering_id: int, offering_title: string, instructor_id: int, status: string, start_dt: string, end_dt: string, duration_minutes: int|null, schedule: string|null}> $rows
+	 * @return list<array{enrollment_id: int, offering_id: int, offering_title: string, instructor_id: int, status: string, start_dt: string, end_dt: string, duration_minutes: int|null, schedule: string|null}>
+	 */
+	private static function sortedByStart( array $rows ): array {
+		usort( $rows, static fn( array $a, array $b ): int => strcmp( $a['start_dt'], $b['start_dt'] ) );
+
+		return $rows;
+	}
+}

src/Guardian/ChildLoginGate.php

@@ -0,0 +1,62 @@
+<?php
+declare(strict_types=1);
+
+namespace Unsupervised\Schedular\Guardian;
+
+use Unsupervised\Schedular\Auth\RoleManager;
+
+/**
+ * Keeps child accounts unusable as logins. A child holds the `us_student` role
+ * so every `student_id` lookup in the schema keeps working, but nobody is ever
+ * given its credentials — this closes the door the role would otherwise leave
+ * open:
+ *
+ * - authentication is refused outright, and
+ * - the booking capability is withheld, so nothing that reaches a capability
+ *   check on a child's own session (there should be none) can book as them.
+ *
+ * Both key off the `us_child` meta, so ordinary students are untouched.
+ */
+class ChildLoginGate {
+
+	public function register(): void {
+		add_filter( 'wp_authenticate_user', [ $this, 'blockChildLogin' ], 10, 1 );
+		add_filter( 'user_has_cap', [ $this, 'withholdBooking' ], 10, 4 );
+	}
+
+	/**
+	 * Refuse authentication for a child account. Runs after password
+	 * verification, so it holds even if a password were somehow set on one.
+	 *
+	 * @param \WP_User|\WP_Error $user Authenticating user, or an earlier error.
+	 * @return \WP_User|\WP_Error
+	 */
+	public function blockChildLogin( $user ) {
+		if ( $user instanceof \WP_User && GuardianService::isChild( (int) $user->ID ) ) {
+			return new \WP_Error(
+				'us_child_account',
+				esc_html__( 'This is a managed student account and cannot be signed in to. Please sign in with the parent or guardian account.', 'unsupervised-schedular' )
+			);
+		}
+
+		return $user;
+	}
+
+	/**
+	 * Strip the booking capability from a child account, so the only route to a
+	 * lesson in their name is their guardian's authorised booking.
+	 *
+	 * @param array<string, bool> $allcaps All capabilities currently held.
+	 * @param array<int, string>  $caps    Required capabilities (unused).
+	 * @param array<int, mixed>   $args    Callback args (unused).
+	 * @param mixed               $user    The user being checked (a WP_User in practice).
+	 * @return array<string, bool>
+	 */
+	public function withholdBooking( array $allcaps, array $caps, array $args, mixed $user ): array {
+		if ( $user instanceof \WP_User && GuardianService::isChild( (int) $user->ID ) ) {
+			unset( $allcaps[ RoleManager::CAP_BOOK_LESSON ] );
+		}
+
+		return $allcaps;
+	}
+}

src/Guardian/FamilyPage.php

@@ -0,0 +1,307 @@
+<?php
+declare(strict_types=1);
+
+namespace Unsupervised\Schedular\Guardian;
+
+use Unsupervised\Schedular\Registration\Answer;
+use Unsupervised\Schedular\Registration\AnswerRepository;
+use Unsupervised\Schedular\Registration\Question;
+use Unsupervised\Schedular\Registration\QuestionRepository;
+use Unsupervised\Schedular\Val;
+
+/**
+ * The guardian's "my family" screen (`[us_family]`): their own details, plus
+ * list, add, edit and remove the children they book for.
+ *
+ * Submissions are processed on `template_redirect` — before any output — and
+ * post/redirect/get back to the page, so a refresh cannot resubmit and add the
+ * same child twice.
+ */
+class FamilyPage {
+
+	/** Query flag carrying a completed action back to {@see render()}. */
+	private const RESULT_ADDED   = 'added';
+	private const RESULT_UPDATED = 'updated';
+	private const RESULT_REMOVED = 'removed';
+	private const RESULT_SELF    = 'self';
+
+	/**
+	 * Error from the most recent submission processed on `template_redirect`,
+	 * carried over to {@see render()} so it can be shown inline with the form.
+	 */
+	private string $submitError = '';
+
+	public function __construct(
+		private GuardianService $guardians,
+		private QuestionRepository $questions,
+		private AnswerRepository $answers,
+	) {}
+
+	/**
+	 * Renders the family shortcode/block output.
+	 *
+	 * @param array<int|string, mixed> $atts Block attributes (`loginPageId`) or
+	 *                                       shortcode attributes (`login_page_id`).
+	 */
+	public function render( array $atts ): string {
+		if ( ! is_user_logged_in() ) {
+			$loginPageId = Val::int( $atts['loginPageId'] ?? $atts['login_page_id'] ?? 0 );
+
+			return sprintf(
+				'<p>%s <a href="%s">%s</a>.</p>',
+				esc_html__( 'Please', 'unsupervised-schedular' ),
+				esc_url( $this->loginUrl( $loginPageId ) ),
+				esc_html__( 'log in to manage your profile', 'unsupervised-schedular' )
+			);
+		}
+
+		wp_enqueue_style( 'us-scheduler' );
+
+		$userId = get_current_user_id();
+
+		$self      = $this->guardians->accountHolder( $userId );
+		$children  = $this->guardians->children( $userId );
+		$questions = $this->questions->findByScope( Question::SCOPE_ACCOUNT, activeOnly: true );
+		$error     = $this->submitError;
+
+		// phpcs:ignore WordPress.Security.NonceVerification.Recommended -- read-only display flag; the submit that set it was nonce-checked.
+		$result = sanitize_key( Val::string( wp_unslash( $_GET['us_family'] ?? '' ) ) );
+		$notice = $this->noticeFor( $result );
+
+		// Which child the "edit" link opened, if any — the row is swapped for an
+		// editable form rather than every row carrying one.
+		// phpcs:ignore WordPress.Security.NonceVerification.Recommended -- read-only routing; the edit submit is nonce-checked.
+		$editingId = absint( Val::int( $_GET['us_edit_child'] ?? 0 ) );
+
+		ob_start();
+		include USC_PLUGIN_DIR . 'templates/frontend/family-page.php';
+		return (string) ob_get_clean();
+	}
+
+	/**
+	 * Process an add/edit/remove submission on `template_redirect`, before any
+	 * page output, then post/redirect/get back to the page. An error is stashed
+	 * for {@see render()} to show inline with the form.
+	 */
+	public function maybeHandleSubmit(): void {
+		// phpcs:ignore WordPress.Security.NonceVerification.Missing -- routing only; the action is nonce-checked immediately below.
+		$action = sanitize_key( Val::string( wp_unslash( $_POST['us_family_action'] ?? '' ) ) );
+
+		if ( '' === $action || ! is_user_logged_in() ) {
+			return;
+		}
+
+		if ( ! check_admin_referer( 'us_family' ) ) {
+			return;
+		}
+
+		$userId = get_current_user_id();
+
+		$result = match ( $action ) {
+			'add'    => $this->handleAdd( $userId ),
+			'edit'   => $this->handleEdit( $userId ),
+			'remove' => $this->handleRemove( $userId ),
+			'self'   => $this->handleSelf( $userId ),
+			default  => new \WP_Error( 'unknown_action', __( 'Unrecognised request.', 'unsupervised-schedular' ) ),
+		};
+
+		if ( $result instanceof \WP_Error ) {
+			$this->submitError = $result->get_error_message();
+			return;
+		}
+
+		$this->redirect( add_query_arg( 'us_family', $result, $this->currentUrl() ) );
+	}
+
+	/**
+	 * Add a child, then record their answers to the account-signup questions —
+	 * asked per child, since they describe the student rather than the account.
+	 *
+	 * Required answers are validated *before* the child is created, so a missing
+	 * one never leaves a nameless half-added child behind.
+	 */
+	private function handleAdd( int $guardianId ): string|\WP_Error {
+		$name         = $this->postString( 'child_name' );
+		$birthYear    = $this->postString( 'child_birth_year' );
+		$relationship = $this->postString( 'child_relationship' );
+
+		$questions = $this->questions->findByScope( Question::SCOPE_ACCOUNT, activeOnly: true );
+		$answers   = $this->submittedAnswers();
+
+		$missing = $this->firstMissingAnswer( $questions, $answers );
+		if ( null !== $missing ) {
+			return $missing;
+		}
+
+		$childId = $this->guardians->createChild( $guardianId, $name, $birthYear, $relationship );
+		if ( $childId instanceof \WP_Error ) {
+			return $childId;
+		}
+
+		$this->recordAnswers( $questions, $answers, $childId );
+
+		return self::RESULT_ADDED;
+	}
+
+	private function handleEdit( int $guardianId ): string|\WP_Error {
+		// phpcs:ignore WordPress.Security.NonceVerification.Missing -- nonce checked by the caller.
+		$childId = absint( Val::int( $_POST['child_id'] ?? 0 ) );
+
+		$error = $this->guardians->updateChild( $guardianId, $childId, $this->postString( 'child_name' ), $this->postString( 'child_birth_year' ) );
+
+		return $error ?? self::RESULT_UPDATED;
+	}
+
+	/**
+	 * Save the account holder's own details. The birth year is only asked of a
+	 * student, so it is the checkbox — not the browser — that decides whether one
+	 * is required; the field carries no `required` attribute, or a guardian who
+	 * books only for other people could never submit the form at all.
+	 */
+	private function handleSelf( int $userId ): string|\WP_Error {
+		// phpcs:ignore WordPress.Security.NonceVerification.Missing -- nonce checked by the caller.
+		$isStudent = isset( $_POST['is_student'] );
+
+		$error = $this->guardians->updateSelf( $userId, $this->postString( 'own_name' ), $this->postString( 'own_birth_year' ), $isStudent );
+
+		return $error ?? self::RESULT_SELF;
+	}
+
+	private function handleRemove( int $guardianId ): string|\WP_Error {
+		// phpcs:ignore WordPress.Security.NonceVerification.Missing -- nonce checked by the caller.
+		$childId = absint( Val::int( $_POST['child_id'] ?? 0 ) );
+
+		$error = $this->guardians->removeChild( $guardianId, $childId );
+
+		return $error ?? self::RESULT_REMOVED;
+	}
+
+	/**
+	 * The first required question left unanswered, as the error to show — or null
+	 * when every required question has a value.
+	 *
+	 * This screen only ever adds a student the guardian registers, so the
+	 * students' required-ness is the one that applies — the same rule the child
+	 * blocks on the signup form are held to.
+	 *
+	 * @param list<Question>     $questions
+	 * @param array<int, string> $answers   question_id => submitted value
+	 */
+	private function firstMissingAnswer( array $questions, array $answers ): ?\WP_Error {
+		foreach ( $questions as $question ) {
+			if ( $question->isRequiredForChild() && '' === trim( (string) ( $answers[ (int) $question->id ] ?? '' ) ) ) {
+				return new \WP_Error( 'missing_answer', __( 'Please answer all required questions for this student.', 'unsupervised-schedular' ) );
+			}
+		}
+
+		return null;
+	}
+
+	/**
+	 * Persist a child's answers to the account-signup questions. The answer is
+	 * recorded against the child, not the guardian, so a studio admin reading a
+	 * child's screen sees the information that describes them.
+	 *
+	 * @param list<Question>     $questions
+	 * @param array<int, string> $answers   question_id => submitted value
+	 */
+	private function recordAnswers( array $questions, array $answers, int $childId ): void {
+		foreach ( $questions as $question ) {
+			$value = trim( (string) ( $answers[ (int) $question->id ] ?? '' ) );
+			if ( '' === $value ) {
+				continue;
+			}
+
+			$this->answers->insert(
+				new Answer(
+					questionId:       (int) $question->id,
+					registrationType: Answer::REG_ACCOUNT,
+					registrationId:   $childId,
+					studentId:        $childId,
+					answerValue:      $value,
+				)
+			);
+		}
+	}
+
+	/**
+	 * The account-question answers submitted with the form, keyed by question id.
+	 *
+	 * @return array<int, string>
+	 */
+	private function submittedAnswers(): array {
+		// phpcs:ignore WordPress.Security.NonceVerification.Missing, WordPress.Security.ValidatedSanitizedInput.InputNotSanitized, WordPress.Security.ValidatedSanitizedInput.MissingUnslash -- nonce checked by the caller; each value is unslashed and sanitized in the loop below.
+		$raw = $_POST['us_answers'] ?? [];
+		if ( ! is_array( $raw ) ) {
+			return [];
+		}
+
+		$out = [];
+		foreach ( $raw as $questionId => $value ) {
+			$out[ absint( Val::int( $questionId ) ) ] = sanitize_textarea_field( Val::string( wp_unslash( $value ) ) );
+		}
+
+		return $out;
+	}
+
+	/**
+	 * A sanitized text field from the submission. The caller has already verified
+	 * the nonce.
+	 */
+	private function postString( string $key ): string {
+		// phpcs:ignore WordPress.Security.NonceVerification.Missing -- nonce checked by the caller.
+		return sanitize_text_field( Val::string( wp_unslash( $_POST[ $key ] ?? '' ) ) );
+	}
+
+	/**
+	 * The confirmation to show for a completed action, or an empty string when
+	 * the flag is absent or unrecognised.
+	 */
+	private function noticeFor( string $result ): string {
+		return match ( $result ) {
+			self::RESULT_ADDED   => __( 'Student added.', 'unsupervised-schedular' ),
+			self::RESULT_UPDATED => __( 'Details updated.', 'unsupervised-schedular' ),
+			self::RESULT_REMOVED => __( 'Student removed.', 'unsupervised-schedular' ),
+			self::RESULT_SELF    => __( 'Your details have been updated.', 'unsupervised-schedular' ),
+			default              => '',
+		};
+	}
+
+	/**
+	 * The current page's clean permalink, used as the post/redirect/get target so
+	 * the edit flag and any stale notice are dropped from the URL.
+	 */
+	private function currentUrl(): string {
+		$url = get_permalink();
+
+		return is_string( $url ) ? $url : home_url( '/' );
+	}
+
+	/**
+	 * Issues the post-submit redirect and stops the request. Split out so tests
+	 * can observe the target without the process exiting.
+	 */
+	protected function redirect( string $url ): void {
+		wp_safe_redirect( $url );
+		exit;
+	}
+
+	/**
+	 * URL the logged-out prompt sends visitors to: the chosen login page when one
+	 * is configured (and still exists), otherwise the WordPress login screen with
+	 * a redirect back to the current page.
+	 */
+	public function loginUrl( int $loginPageId ): string {
+		if ( $loginPageId > 0 ) {
+			$url = get_permalink( $loginPageId );
+
+			if ( is_string( $url ) ) {
+				return $url;
+			}
+		}
+
+		$permalink = get_permalink();
+
+		return wp_login_url( false === $permalink ? '' : $permalink );
+	}
+}

src/Guardian/GuardianLink.php

@@ -0,0 +1,47 @@
+<?php
+declare(strict_types=1);
+
+namespace Unsupervised\Schedular\Guardian;
+
+use Unsupervised\Schedular\Val;
+
+/**
+ * One parent/guardian ↔ child link. The child is a real (login-less) WordPress
+ * user, so `studentId` is a `wp_users` ID exactly like every other student id in
+ * the schema — this row only records who books and pays on their behalf.
+ */
+class GuardianLink {
+
+	public function __construct(
+		public readonly int $guardianId,
+		public readonly int $studentId,
+		public readonly string $relationship = '',
+		public readonly ?string $createdAt = null,
+		public readonly ?int $id = null,
+	) {}
+
+	public static function fromRow( \stdClass $row ): self {
+		return new self(
+			guardianId:   Val::int( $row->guardian_id ),
+			studentId:    Val::int( $row->student_id ),
+			relationship: Val::string( $row->relationship ?? '' ),
+			createdAt:    Val::stringOrNull( $row->created_at ?? null ),
+			id:           Val::int( $row->id ),
+		);
+	}
+
+	/**
+	 * Returns a plain array representation of the link.
+	 *
+	 * @return array<string, mixed>
+	 */
+	public function toArray(): array {
+		return [
+			'id'           => $this->id,
+			'guardian_id'  => $this->guardianId,
+			'student_id'   => $this->studentId,
+			'relationship' => $this->relationship,
+			'created_at'   => $this->createdAt,
+		];
+	}
+}

src/Guardian/GuardianRepository.php

@@ -0,0 +1,122 @@
+<?php
+declare(strict_types=1);
+
+namespace Unsupervised\Schedular\Guardian;
+
+class GuardianRepository {
+
+	private string $table;
+
+	public function __construct( private \wpdb $db ) {
+		$this->table = $db->prefix . 'us_guardians';
+	}
+
+	/**
+	 * Link a child to a guardian. Returns 0 without inserting when the child
+	 * already has a guardian: v1 is one guardian per child, and the check lives
+	 * here so every caller (signup, the family screen, admin) gets it.
+	 */
+	public function insert( GuardianLink $link ): int {
+		if ( null !== $this->findByStudent( $link->studentId ) ) {
+			return 0;
+		}
+
+		$this->db->insert(
+			$this->table,
+			[
+				'guardian_id'  => $link->guardianId,
+				'student_id'   => $link->studentId,
+				'relationship' => $link->relationship,
+				'created_at'   => current_time( 'mysql' ),
+			],
+			[ '%d', '%d', '%s', '%s' ]
+		);
+
+		return $this->db->insert_id;
+	}
+
+	/**
+	 * The link naming this child's guardian, or null when they book for
+	 * themselves.
+	 */
+	public function findByStudent( int $studentId ): ?GuardianLink {
+		$row = $this->db->get_row(
+			$this->db->prepare(
+				'SELECT * FROM %i WHERE student_id = %d LIMIT 1',
+				$this->table,
+				$studentId
+			)
+		);
+
+		return $row ? GuardianLink::fromRow( $row ) : null;
+	}
+
+	/**
+	 * Every child linked to a guardian, oldest link first — the order they are
+	 * offered in the booking selector, so it stays stable as children are added.
+	 *
+	 * @return list<GuardianLink>
+	 */
+	public function findByGuardian( int $guardianId ): array {
+		$rows = $this->db->get_results(
+			$this->db->prepare(
+				'SELECT * FROM %i WHERE guardian_id = %d ORDER BY created_at ASC, id ASC',
+				$this->table,
+				$guardianId
+			)
+		);
+
+		return array_map( GuardianLink::fromRow( ... ), $rows ?? [] );
+	}
+
+	/**
+	 * Whether this exact guardian↔child pair is linked — the authorisation check
+	 * behind every "act for this student" boundary.
+	 */
+	public function isGuardianOf( int $guardianId, int $studentId ): bool {
+		$found = $this->db->get_var(
+			$this->db->prepare(
+				'SELECT id FROM %i WHERE guardian_id = %d AND student_id = %d LIMIT 1',
+				$this->table,
+				$guardianId,
+				$studentId
+			)
+		);
+
+		return null !== $found;
+	}
+
+	/**
+	 * Remove the link between a guardian and one of their children. Deleting the
+	 * child user itself is the caller's decision ({@see GuardianService::removeChild()});
+	 * this only unlinks.
+	 */
+	public function delete( int $guardianId, int $studentId ): bool {
+		$deleted = $this->db->delete(
+			$this->table,
+			[
+				'guardian_id' => $guardianId,
+				'student_id'  => $studentId,
+			],
+			[ '%d', '%d' ]
+		);
+
+		return (int) $deleted > 0;
+	}
+
+	/**
+	 * How many children a guardian has — enough to decide whether the booking
+	 * page needs a "who is this for?" selector at all.
+	 */
+	public function countChildren( int $guardianId ): int {
+		$count = $this->db->get_var(
+			$this->db->prepare(
+				'SELECT COUNT(*) FROM %i WHERE guardian_id = %d',
+				$this->table,
+				$guardianId
+			)
+		);
+
+		return (int) $count;
+	}
+}

src/Guardian/GuardianService.php

@@ -0,0 +1,574 @@
+<?php
+declare(strict_types=1);
+
+namespace Unsupervised\Schedular\Guardian;
+
+use Unsupervised\Schedular\Auth\RegistrationStatus;
+use Unsupervised\Schedular\Auth\RoleManager;
+use Unsupervised\Schedular\Auth\UserName;
+use Unsupervised\Schedular\Booking\BookingRepository;
+use Unsupervised\Schedular\GroupClass\EnrollmentRepository;
+use Unsupervised\Schedular\Val;
+
+/**
+ * Everything a guardian does on a child's behalf: creating the child's
+ * login-less account, deciding who may act for whom, and resolving the payer and
+ * contact behind a student id.
+ */
+class GuardianService {
+
+	/**
+	 * Marks a `wp_users` row as a child account: created by a guardian, holding
+	 * the student role so every `student_id` lookup keeps working, but with no
+	 * usable login. {@see ChildLoginGate} enforces the "no login" half.
+	 */
+	public const META_CHILD = 'us_child';
+
+	/** A child's birth year (`YYYY`), collected at signup and editable after. */
+	public const META_BIRTH_YEAR = 'us_birth_year';
+
+	/**
+	 * The full date of birth this feature used to collect. Nothing writes it any
+	 * more: it is read once, to derive a birth year for a child who predates the
+	 * change, and cleared the moment that child's record is next saved. Kept
+	 * public so a site that wants to purge the old dates outright can find them.
+	 */
+	public const META_DOB = 'us_date_of_birth';
+
+	/**
+	 * Set on an account that registered **only** to book for other people, so it
+	 * is not offered as a student in its own right.
+	 *
+	 * Stored as the negative on purpose. Every account that existed before this
+	 * choice was offered is a bookable student, and absence of the flag has to
+	 * keep meaning exactly that — otherwise the picker would quietly stop
+	 * offering people themselves on upgrade.
+	 */
+	public const META_GUARDIAN_ONLY = 'us_guardian_only';
+
+	/**
+	 * The earliest birth year the form will accept. Old enough for any student a
+	 * studio will ever enrol, and late enough to reject a typo like `19` or `190`
+	 * that would otherwise be stored as a plausible-looking year.
+	 */
+	private const MIN_BIRTH_YEAR = 1900;
+
+	/**
+	 * Domain used for a child's placeholder login address. `.invalid` is reserved
+	 * by RFC 2606 and can never resolve, so a child's address is guaranteed
+	 * undeliverable — nothing about a child's account can ever be emailed to
+	 * somewhere real by mistake.
+	 */
+	private const CHILD_EMAIL_DOMAIN = 'child.invalid';
+
+	public function __construct(
+		private GuardianRepository $guardians,
+		private BookingRepository $bookings,
+		private EnrollmentRepository $enrollments,
+	) {}
+
+	/**
+	 * Create a login-less child account and link it to its guardian. The password
+	 * is random and discarded — it is never stored anywhere readable, emailed, or
+	 * shown — so the account cannot be signed into even if the gate were removed.
+	 *
+	 * Returns the new user ID, or a `WP_Error` when the name is blank, the birth
+	 * year is missing or unusable, or WordPress refuses the insert.
+	 */
+	public function createChild( int $guardianId, string $name, string $birthYear = '', string $relationship = '' ): int|\WP_Error {
+		$name = trim( $name );
+		if ( '' === $name ) {
+			return new \WP_Error( 'missing_name', __( 'Please give each student a name.', 'unsupervised-schedular' ) );
+		}
+
+		if ( 0 === self::normaliseBirthYear( $birthYear ) ) {
+			return new \WP_Error( 'missing_birth_year', self::birthYearError() );
+		}
+
+		$email  = $this->childEmail();
+		$userId = wp_insert_user(
+			[
+				'user_login'   => $email,
+				'user_email'   => $email,
+				'user_pass'    => wp_generate_password( 24, true, true ),
+				'display_name' => $name,
+				'nickname'     => $name,
+				'role'         => RoleManager::STUDENT,
+			]
+		);
+
+		if ( is_wp_error( $userId ) ) {
+			return $userId;
+		}
+
+		$userId = (int) $userId;
+
+		update_user_meta( $userId, self::META_CHILD, '1' );
+
+		// A child is a student created by someone who is not staff, so the
+		// registration gate holds it on `user_register` like any other unattributed
+		// signup. There is nothing here to approve: the account is never signed in
+		// to, and the guardian in front of us is the approval. Leaving the hold on
+		// would put every child a family adds into the studio's review queue.
+		RegistrationStatus::approve( $userId );
+
+		$this->setBirthYear( $userId, $birthYear );
+
+		$linkId = $this->guardians->insert(
+			new GuardianLink(
+				guardianId:   $guardianId,
+				studentId:    $userId,
+				relationship: trim( $relationship ),
+			)
+		);
+
+		// The child was just created, so it cannot already be linked — a failure
+		// here means the insert itself failed, and leaving an unreachable orphan
+		// user behind would be worse than reporting it.
+		if ( $linkId <= 0 ) {
+			$this->deleteUser( $userId );
+
+			return new \WP_Error( 'link_failed', __( 'Could not add this student. Please contact the studio.', 'unsupervised-schedular' ) );
+		}
+
+		return $userId;
+	}
+
+	/**
+	 * Rename a child and update their birth year. Refuses a student the caller
+	 * is not the guardian of, so the family screen cannot be turned into an
+	 * arbitrary user editor by posting someone else's id.
+	 *
+	 * Returns null on success, mirroring {@see \Unsupervised\Schedular\Registration\RegistrationGate::validate()}.
+	 */
+	public function updateChild( int $guardianId, int $studentId, string $name, string $birthYear = '' ): ?\WP_Error {
+		if ( ! $this->guardians->isGuardianOf( $guardianId, $studentId ) ) {
+			return new \WP_Error( 'forbidden', __( 'That is not one of your students.', 'unsupervised-schedular' ) );
+		}
+
+		$name = trim( $name );
+		if ( '' === $name ) {
+			return new \WP_Error( 'missing_name', __( 'Please give each student a name.', 'unsupervised-schedular' ) );
+		}
+
+		if ( 0 === self::normaliseBirthYear( $birthYear ) ) {
+			return new \WP_Error( 'missing_birth_year', self::birthYearError() );
+		}
+
+		$result = wp_update_user(
+			[
+				'ID'           => $studentId,
+				'display_name' => $name,
+				'nickname'     => $name,
+			]
+		);
+
+		if ( is_wp_error( $result ) ) {
+			return $result;
+		}
+
+		$this->setBirthYear( $studentId, $birthYear );
+
+		return null;
+	}
+
+	/**
+	 * Update the account holder's own details from the profile screen: their
+	 * name, whether they are a student in their own right, and — when they are —
+	 * their birth year.
+	 *
+	 * `$isStudent` is the positive of what {@see META_GUARDIAN_ONLY} stores, so
+	 * the form can ask the question the way a person would answer it and this is
+	 * the single place the sense is flipped.
+	 *
+	 * Returns null on success, mirroring {@see updateChild()}.
+	 */
+	public function updateSelf( int $userId, string $name, string $birthYear, bool $isStudent ): ?\WP_Error {
+		$name = trim( $name );
+		if ( '' === $name ) {
+			return new \WP_Error( 'missing_name', __( 'Please give your name.', 'unsupervised-schedular' ) );
+		}
+
+		if ( $isStudent && 0 === self::normaliseBirthYear( $birthYear ) ) {
+			return new \WP_Error( 'missing_birth_year', self::ownBirthYearError() );
+		}
+
+		$result = wp_update_user(
+			[
+				'ID'           => $userId,
+				'display_name' => $name,
+				'nickname'     => $name,
+			]
+		);
+
+		if ( is_wp_error( $result ) ) {
+			return $result;
+		}
+
+		$this->setGuardianOnly( $userId, ! $isStudent );
+
+		// Only written when they are a student. Saying "I only book for other
+		// people" is a statement about who books, not an instruction to forget a
+		// year already on file — and someone who ticks the box back on the next
+		// visit should find their own details as they left them.
+		if ( $isStudent ) {
+			$this->setBirthYear( $userId, $birthYear );
+		}
+
+		return null;
+	}
+
+	/**
+	 * Unlink a child and delete their account. Refused once the child has any
+	 * lesson or enrolment history: their id is referenced by lessons, payments and
+	 * credits, and deleting the user would orphan all of it. A studio admin
+	 * handles those cases by hand.
+	 *
+	 * Returns null on success.
+	 */
+	public function removeChild( int $guardianId, int $studentId ): ?\WP_Error {
+		if ( ! $this->guardians->isGuardianOf( $guardianId, $studentId ) ) {
+			return new \WP_Error( 'forbidden', __( 'That is not one of your students.', 'unsupervised-schedular' ) );
+		}
+
+		if ( [] !== $this->bookings->findByStudent( $studentId ) || [] !== $this->enrollments->findByStudent( $studentId ) ) {
+			return new \WP_Error(
+				'has_history',
+				__( 'This student has lessons or enrolments on record and cannot be removed here. Please contact the studio.', 'unsupervised-schedular' )
+			);
+		}
+
+		$this->guardians->delete( $guardianId, $studentId );
+		$this->deleteUser( $studentId );
+
+		return null;
+	}
+
+	/**
+	 * Whether `$actorId` may book, cancel and pay as `$studentId` — true for
+	 * themselves, and for a guardian acting as one of their own children. This is
+	 * the authorisation boundary the REST endpoints and form handlers check before
+	 * honouring a submitted student id.
+	 */
+	public function canActFor( int $actorId, int $studentId ): bool {
+		if ( $actorId <= 0 || $studentId <= 0 ) {
+			return false;
+		}
+
+		return $actorId === $studentId || $this->guardians->isGuardianOf( $actorId, $studentId );
+	}
+
+	/**
+	 * Who owes a student's charges: their guardian when they have one, otherwise
+	 * themselves. Payments, credits and the billing-method override all resolve
+	 * through this, so a family shares one balance and one billing setting.
+	 */
+	public function payerFor( int $studentId ): int {
+		$link = $this->guardians->findByStudent( $studentId );
+
+		return null !== $link ? $link->guardianId : $studentId;
+	}
+
+	/**
+	 * The student ids whose lessons `$userId` may see: their own plus every child
+	 * they are guardian for.
+	 *
+	 * @return list<int>
+	 */
+	public function householdIds( int $userId ): array {
+		$ids = [ $userId ];
+
+		foreach ( $this->guardians->findByGuardian( $userId ) as $link ) {
+			$ids[] = $link->studentId;
+		}
+
+		return array_values( array_unique( $ids ) );
+	}
+
+	/**
+	 * The people a user may book or enrol for: **children first**, then
+	 * themselves. The order is the point — a guardian's normal case is booking for
+	 * a child, so the first option (and hence the default selection) is a child,
+	 * never the parent. Booking for a child by mistake is a correctable
+	 * inconvenience; silently billing a parent's account for a lesson meant for
+	 * their kid is the error worth designing out.
+	 *
+	 * The guardian is still offered, last, so a parent taking lessons alongside
+	 * their children can book for themselves from the same account — unless they
+	 * said at signup that they are not a student, in which case offering them is
+	 * an invitation to book a lesson nobody meant to buy.
+	 *
+	 * @return list<array{id: int, name: string, is_self: bool}>
+	 */
+	public function bookableStudents( int $userId ): array {
+		$out = [];
+
+		foreach ( $this->children( $userId ) as $child ) {
+			$out[] = [
+				'id'      => $child['id'],
+				'name'    => $child['name'],
+				'is_self' => false,
+			];
+		}
+
+		// A guardian-only account with nobody linked to it would otherwise get an
+		// empty list and no way to book at all. Offering them themselves is the
+		// lesser wrong: they can still correct the account from the profile page.
+		if ( self::isGuardianOnly( $userId ) && [] !== $out ) {
+			return $out;
+		}
+
+		$self = get_userdata( $userId );
+
+		$out[] = [
+			'id'      => $userId,
+			'name'    => UserName::format( $self instanceof \WP_User ? $self : null, $userId ),
+			'is_self' => true,
+		];
+
+		return $out;
+	}
+
+	/**
+	 * Whether this account books only for other people. False for every account
+	 * that predates the choice — see {@see META_GUARDIAN_ONLY}.
+	 */
+	public static function isGuardianOnly( int $userId ): bool {
+		return '1' === Val::string( get_user_meta( $userId, self::META_GUARDIAN_ONLY, true ) );
+	}
+
+	/**
+	 * Record whether this account is a student in its own right. Clears the flag
+	 * rather than storing a `0`, so "not set" stays the single meaning of "yes,
+	 * they are a student".
+	 */
+	public function setGuardianOnly( int $userId, bool $guardianOnly ): void {
+		if ( $guardianOnly ) {
+			update_user_meta( $userId, self::META_GUARDIAN_ONLY, '1' );
+			return;
+		}
+
+		delete_user_meta( $userId, self::META_GUARDIAN_ONLY );
+	}
+
+	/**
+	 * A guardian's children, in link order, with the details the family and admin
+	 * screens display.
+	 *
+	 * @return list<array{id: int, name: string, birth_year: string, relationship: string}>
+	 */
+	public function children( int $guardianId ): array {
+		$out = [];
+
+		foreach ( $this->guardians->findByGuardian( $guardianId ) as $link ) {
+			$user = get_userdata( $link->studentId );
+
+			$out[] = [
+				'id'           => $link->studentId,
+				'name'         => UserName::format( $user instanceof \WP_User ? $user : null, $link->studentId ),
+				'birth_year'   => $this->birthYear( $link->studentId ),
+				'relationship' => $link->relationship,
+			];
+		}
+
+		return $out;
+	}
+
+	/**
+	 * The account holder's own details, as the profile screen's form needs them.
+	 * The counterpart to {@see children()} for the person reading the page.
+	 *
+	 * `is_student` is the positive of {@see META_GUARDIAN_ONLY} — see
+	 * {@see updateSelf()}, which reads it back the same way round.
+	 *
+	 * @return array{name: string, email: string, birth_year: string, is_student: bool}
+	 */
+	public function accountHolder( int $userId ): array {
+		$user = get_userdata( $userId );
+
+		return [
+			'name'       => UserName::format( $user instanceof \WP_User ? $user : null, $userId ),
+			'email'      => $user instanceof \WP_User ? $user->user_email : '',
+			'birth_year' => $this->birthYear( $userId ),
+			'is_student' => ! self::isGuardianOnly( $userId ),
+		];
+	}
+
+	/**
+	 * The guardian behind a child, or null when the student books for themselves.
+	 *
+	 * @return array{id: int, name: string, email: string}|null
+	 */
+	public function guardianOf( int $studentId ): ?array {
+		$link = $this->guardians->findByStudent( $studentId );
+		if ( null === $link ) {
+			return null;
+		}
+
+		$user = get_userdata( $link->guardianId );
+
+		return [
+			'id'    => $link->guardianId,
+			'name'  => UserName::format( $user instanceof \WP_User ? $user : null, $link->guardianId ),
+			'email' => $user instanceof \WP_User ? $user->user_email : '',
+		];
+	}
+
+	/**
+	 * Who to contact about a student: their guardian when they have one, otherwise
+	 * the student. What an instructor looking at a child's lesson actually needs —
+	 * a child's own address is an undeliverable placeholder.
+	 *
+	 * @return array{id: int, name: string, email: string}
+	 */
+	public function contactFor( int $studentId ): array {
+		$guardian = $this->guardianOf( $studentId );
+		if ( null !== $guardian ) {
+			return $guardian;
+		}
+
+		$user = get_userdata( $studentId );
+
+		return [
+			'id'    => $studentId,
+			'name'  => UserName::format( $user instanceof \WP_User ? $user : null, $studentId ),
+			'email' => $user instanceof \WP_User ? $user->user_email : '',
+		];
+	}
+
+	/**
+	 * A student's display name, or an empty string when the user is gone. Used
+	 * wherever a charge or lesson has to say whose it is.
+	 */
+	public function studentName( int $studentId ): string {
+		$user = get_userdata( $studentId );
+
+		return UserName::format( $user instanceof \WP_User ? $user : null );
+	}
+
+	/**
+	 * Whether a user is a child account (created by a guardian, cannot sign in).
+	 */
+	public static function isChild( int $userId ): bool {
+		return '1' === Val::string( get_user_meta( $userId, self::META_CHILD, true ) );
+	}
+
+	/**
+	 * Delete a child's user account. Split out so the front-end paths pull in the
+	 * admin user functions `wp_delete_user()` lives in — it is not loaded on the
+	 * front end, where the family screen runs.
+	 */
+	public function deleteUser( int $userId ): void {
+		if ( ! function_exists( 'wp_delete_user' ) ) {
+			require_once ABSPATH . 'wp-admin/includes/user.php';
+		}
+
+		wp_delete_user( $userId );
+	}
+
+	/**
+	 * Store a student's birth year, or clear it when blank or out of range. Used
+	 * for a child added by their guardian and for an account holder who is a
+	 * student in their own right — the same fact about the same kind of person,
+	 * so the same meta key holds both.
+	 *
+	 * Either way the legacy full date of birth goes with it. That is what makes
+	 * the read fallback in {@see birthYear()} safe: without it, clearing the year
+	 * on a child who predates this change would leave the old date behind for the
+	 * fallback to resurrect on the very next read.
+	 */
+	public function setBirthYear( int $userId, string $birthYear ): void {
+		delete_user_meta( $userId, self::META_DOB );
+
+		$year = self::normaliseBirthYear( $birthYear );
+
+		if ( 0 === $year ) {
+			delete_user_meta( $userId, self::META_BIRTH_YEAR );
+			return;
+		}
+
+		update_user_meta( $userId, self::META_BIRTH_YEAR, (string) $year );
+	}
+
+	/**
+	 * A submitted birth year as an integer, or 0 when it is blank, not a number,
+	 * or outside {@see MIN_BIRTH_YEAR}..this year. A year in the future is a typo
+	 * every time, so it is refused rather than stored.
+	 *
+	 * Public and static so the signup form can reject a bad year up front, before
+	 * it creates any users, without a second copy of the rule to keep in step.
+	 */
+	public static function normaliseBirthYear( string $birthYear ): int {
+		$birthYear = trim( $birthYear );
+
+		if ( '' === $birthYear || 1 !== preg_match( '/^\d{4}$/', $birthYear ) ) {
+			return 0;
+		}
+
+		$year = (int) $birthYear;
+
+		if ( $year < self::MIN_BIRTH_YEAR || $year > (int) current_time( 'Y' ) ) {
+			return 0;
+		}
+
+		return $year;
+	}
+
+	/**
+	 * The message shown when a birth year is missing or unusable. One phrasing,
+	 * shared by the signup form and the profile screen, so a guardian is told the
+	 * same thing whichever way they got there.
+	 */
+	public static function birthYearError(): string {
+		return sprintf(
+			/* translators: %d: the earliest birth year the form accepts. */
+			__( 'Please give each student a birth year, as four digits from %d onwards.', 'unsupervised-schedular' ),
+			self::MIN_BIRTH_YEAR
+		);
+	}
+
+	/**
+	 * The same message for the account holder's own birth year. Separate wording
+	 * because "each student" is nobody when the student in question is the person
+	 * reading it.
+	 */
+	public static function ownBirthYearError(): string {
+		return sprintf(
+			/* translators: %d: the earliest birth year the form accepts. */
+			__( 'Please give your birth year, as four digits from %d onwards.', 'unsupervised-schedular' ),
+			self::MIN_BIRTH_YEAR
+		);
+	}
+
+	/**
+	 * A child's birth year, or an empty string when none is recorded.
+	 *
+	 * Falls back to the year of the full date of birth this feature used to
+	 * collect, so a child added before the change still shows one. The fallback
+	 * is read-only and one-way: {@see setBirthYear()} drops the old date as soon
+	 * as the record is saved again.
+	 */
+	private function birthYear( int $userId ): string {
+		$year = Val::string( get_user_meta( $userId, self::META_BIRTH_YEAR, true ) );
+		if ( '' !== $year ) {
+			return $year;
+		}
+
+		$legacy = Val::string( get_user_meta( $userId, self::META_DOB, true ) );
+
+		return 1 === preg_match( '/^(\d{4})-/', $legacy, $m ) ? $m[1] : '';
+	}
+
+	/**
+	 * An unused placeholder address for a child's account. WordPress requires a
+	 * unique email per user, so the random suffix is retried against
+	 * `email_exists()` rather than assumed unique.
+	 */
+	private function childEmail(): string {
+		do {
+			$email = 'us-child-' . wp_generate_password( 12, false, false ) . '@' . self::CHILD_EMAIL_DOMAIN;
+		} while ( false !== email_exists( $email ) );
+
+		return strtolower( $email );
+	}
+}

src/Installer.php

@@ -5,7 +5,10 @@ namespace Unsupervised\Schedular;
 
 use Unsupervised\Schedular\Auth\RoleManager;
 use Unsupervised\Schedular\Availability\AvailabilityRepository;
+use Unsupervised\Schedular\Payment\CreditRepository;
+use Unsupervised\Schedular\Payment\PaymentRepository;
 use Unsupervised\Schedular\Payment\ScheduledBillingRunner;
+use Unsupervised\Schedular\Policy\AcceptanceRepository;
 
 class Installer {
 
@@ -50,5 +53,13 @@ class Installer {
 		}
 
 		( new AvailabilityRepository( $wpdb ) )->splitOversizedWindows();
+
+		// Guardian accounts introduced "who pays" / "who agreed" alongside "who the
+		// student is". Every row written before then had them one and the same, so
+		// point the new columns at the student rather than leaving them 0 — the
+		// balance and acceptance lookups key on them directly.
+		( new PaymentRepository( $wpdb ) )->backfillPayerIds();
+		( new CreditRepository( $wpdb ) )->backfillPayerIds();
+		( new AcceptanceRepository( $wpdb ) )->backfillAcceptedBy();
 	}
 }

src/Offering/Offering.php

@@ -175,22 +175,19 @@ class Offering {
 	}
 
 	/**
-	 * The concrete start/end datetimes of every session of this group class,
-	 * derived from the class date(s), the class time, and the duration. A weekly
-	 * class yields one window per week from `term_start` through `term_end`; a
-	 * one-off class yields a single window. Returns an empty list unless the
-	 * schedule is fully specified (date, time, and a positive duration), so it can
-	 * never fabricate a session window from partial data.
+	 * The datetime each session of this group class starts, derived from the class
+	 * date(s) and the class time. A weekly class yields one per week from
+	 * `term_start` through `term_end`; a one-off class yields a single one.
 	 *
-	 * @return list<array{start: string, end: string}>
+	 * Deliberately does **not** need a duration: knowing *when* a class meets is a
+	 * separate question from knowing how long it runs, and a studio can quite
+	 * reasonably set the first without the second. Returns an empty list when
+	 * there is no date or no time, since neither can be invented.
+	 *
+	 * @return list<string> `Y-m-d H:i:s` starts, earliest first.
 	 */
-	public function sessionWindows(): array {
-		if (
-			null === $this->termStart
-			|| null === $this->classTime
-			|| null === $this->durationMinutes
-			|| $this->durationMinutes <= 0
-		) {
+	public function sessionStarts(): array {
+		if ( null === $this->termStart || null === $this->classTime ) {
 			return [];
 		}
 
@@ -200,25 +197,85 @@ class Offering {
 		}
 
 		$lastDay = null !== $this->termEnd ? $this->termEnd : $this->termStart;
-		$step    = new \DateInterval( 'PT' . $this->durationMinutes . 'M' );
 
-		$windows   = [];
+		$starts    = [];
 		$cursor    = $first;
 		$cursorDay = $cursor->format( 'Y-m-d' );
 
 		// Cap the walk at ten years of weeks so a term_end before term_start (or a
 		// bad value) can never spin into an unbounded loop.
 		for ( $i = 0; $i < 520 && $cursorDay <= $lastDay; $i++ ) {
-			$windows[] = [
-				'start' => $cursor->format( 'Y-m-d H:i:s' ),
-				'end'   => $cursor->add( $step )->format( 'Y-m-d H:i:s' ),
-			];
+			$starts[] = $cursor->format( 'Y-m-d H:i:s' );
 
 			$cursor    = $cursor->modify( '+7 days' );
 			$cursorDay = $cursor->format( 'Y-m-d' );
 		}
 
-		return $windows;
+		return $starts;
+	}
+
+	/**
+	 * The concrete start/end datetimes of every session of this group class:
+	 * {@see sessionStarts()} closed off with the class duration. Returns an empty
+	 * list unless the schedule is fully specified (date, time, *and* a positive
+	 * duration), so it can never fabricate a session window from partial data —
+	 * callers that block availability or bill per session need both ends.
+	 *
+	 * @return list<array{start: string, end: string}>
+	 */
+	public function sessionWindows(): array {
+		if ( null === $this->durationMinutes || $this->durationMinutes <= 0 ) {
+			return [];
+		}
+
+		$step = new \DateInterval( 'PT' . $this->durationMinutes . 'M' );
+
+		return array_map(
+			static fn( string $start ): array => [
+				'start' => $start,
+				'end'   => ( new \DateTimeImmutable( $start ) )->add( $step )->format( 'Y-m-d H:i:s' ),
+			],
+			$this->sessionStarts()
+		);
+	}
+
+	/**
+	 * The last day this class meets, or null when it has no dates at all.
+	 */
+	public function lastClassDay(): ?string {
+		return $this->termEnd ?? $this->termStart;
+	}
+
+	/**
+	 * Plain-language wording for when this class meets, for the places that have
+	 * to say something about a class whose schedule cannot be resolved to dates.
+	 * Prefers the studio's own note ("Tuesdays 4:00pm") — that field exists
+	 * precisely so a class can describe its schedule without pinning it to a
+	 * time — then the term dates, and finally an honest admission that nothing
+	 * has been set.
+	 */
+	public function scheduleLabel(): string {
+		$note = null !== $this->scheduleNote ? trim( $this->scheduleNote ) : '';
+		if ( '' !== $note ) {
+			return $note;
+		}
+
+		if ( null === $this->termStart ) {
+			return __( 'Schedule to be confirmed', 'unsupervised-schedular' );
+		}
+
+		$start = (string) mysql2date( 'M j, Y', $this->termStart );
+
+		if ( null === $this->termEnd || $this->termEnd === $this->termStart ) {
+			return $start;
+		}
+
+		return sprintf(
+			/* translators: 1: first class date, 2: last class date. */
+			__( '%1$s – %2$s', 'unsupervised-schedular' ),
+			$start,
+			(string) mysql2date( 'M j, Y', $this->termEnd )
+		);
 	}
 
 	public static function fromRow( \stdClass $row ): self {

src/Payment/BillingMethodResolver.php

@@ -7,8 +7,8 @@ use Unsupervised\Schedular\Val;
 
 /**
  * Resolves the billing method for a student: a per-student override if set,
- * otherwise the studio default — card when Stripe is configured, e-transfer when
- * it is not.
+ * otherwise the studio default chosen on Studio Settings — which itself falls
+ * back to e-transfer whenever Stripe is not configured.
  */
 class BillingMethodResolver {
 
@@ -27,10 +27,17 @@ class BillingMethodResolver {
 
 	/**
 	 * The studio default when a student has no explicit override.
+	 *
+	 * Card is only ever the default when the studio asked for it *and* Stripe is
+	 * configured; without keys there is nothing to charge a card with. A studio
+	 * that sets the default to e-transfer keeps every student on e-transfer even
+	 * with Stripe live, so card billing can be proven on a few students — each
+	 * given a per-student override — before the whole studio moves over.
 	 */
 	public function defaultMethod(): string {
-		return $this->settings->isStripeConfigured()
-			? Payment::METHOD_CARD
-			: Payment::METHOD_ETRANSFER;
+		return Payment::METHOD_CARD === $this->settings->defaultPaymentMethod()
+			&& $this->settings->isStripeConfigured()
+				? Payment::METHOD_CARD
+				: Payment::METHOD_ETRANSFER;
 	}
 }

src/Payment/Credit.php

@@ -26,6 +26,12 @@ class Credit {
 		public readonly int $studentId,
 		public readonly float $amount,
 		public readonly float $remaining,
+		/**
+		 * The account holding this balance — a child's guardian, or 0 meaning
+		 * "the student themselves". A family's credits all sit on the guardian,
+		 * so one child's cancellation can settle a sibling's charge.
+		 */
+		public readonly int $payerId = 0,
 		public readonly string $currency = 'CAD',
 		public readonly ?int $sourcePaymentId = null,
 		public readonly ?int $sourceLessonId = null,
@@ -41,6 +47,7 @@ class Credit {
 			studentId:       Val::int( $row->student_id ),
 			amount:          Val::float( $row->amount ),
 			remaining:       Val::float( $row->remaining ),
+			payerId:         Val::int( $row->payer_id ?? 0 ),
 			currency:        Val::string( $row->currency ),
 			sourcePaymentId: Val::intOrNull( $row->source_payment_id ?? null ),
 			sourceLessonId:  Val::intOrNull( $row->source_lesson_id ?? null ),
@@ -56,6 +63,15 @@ class Credit {
 		return self::STATUS_AVAILABLE === $this->status && $this->remaining > 0.0;
 	}
 
+	/**
+	 * Whose balance this credit sits in: the recorded payer, falling back to the
+	 * student. Callers go through here rather than reading `payerId`, so the `0`
+	 * default of a pre-guardian credit never leaks out as a user id.
+	 */
+	public function payerOrStudent(): int {
+		return $this->payerId > 0 ? $this->payerId : $this->studentId;
+	}
+
 	/**
 	 * Returns a plain array representation of the credit.
 	 *
@@ -65,6 +81,7 @@ class Credit {
 		return [
 			'id'                => $this->id,
 			'student_id'        => $this->studentId,
+			'payer_id'          => $this->payerOrStudent(),
 			'amount'            => $this->amount,
 			'remaining'         => $this->remaining,
 			'currency'          => $this->currency,

src/Payment/CreditRepository.php

@@ -16,6 +16,7 @@ class CreditRepository {
 			$this->table,
 			[
 				'student_id'        => $credit->studentId,
+				'payer_id'          => $credit->payerOrStudent(),
 				'amount'            => $credit->amount,
 				'remaining'         => $credit->remaining,
 				'currency'          => $credit->currency,
@@ -25,7 +26,7 @@ class CreditRepository {
 				'status'            => $credit->status,
 				'created_at'        => current_time( 'mysql' ),
 			],
-			[ '%d', '%f', '%f', '%s', '%d', '%d', '%s', '%s', '%s' ]
+			[ '%d', '%d', '%f', '%f', '%s', '%d', '%d', '%s', '%s', '%s' ]
 		);
 
 		return $this->db->insert_id;
@@ -56,15 +57,16 @@ class CreditRepository {
 	}
 
 	/**
-	 * A student's total unused credit balance (sum of the remaining amounts of every
-	 * still-available credit).
+	 * A payer's total unused credit balance (sum of the remaining amounts of every
+	 * still-available credit). Keyed on the payer, so a guardian's balance covers
+	 * credits earned by any of their children — one family, one balance.
 	 */
-	public function availableBalance( int $studentId ): float {
+	public function availableBalance( int $payerId ): float {
 		$total = $this->db->get_var(
 			$this->db->prepare(
-				'SELECT COALESCE( SUM( remaining ), 0 ) FROM %i WHERE student_id = %d AND status = %s',
+				'SELECT COALESCE( SUM( remaining ), 0 ) FROM %i WHERE payer_id = %d AND status = %s',
 				$this->table,
-				$studentId,
+				$payerId,
 				Credit::STATUS_AVAILABLE
 			)
 		);
@@ -73,17 +75,17 @@ class CreditRepository {
 	}
 
 	/**
-	 * A student's still-available credits, oldest first — the FIFO order they are
+	 * A payer's still-available credits, oldest first — the FIFO order they are
 	 * consumed in.
 	 *
 	 * @return list<Credit>
 	 */
-	public function findAvailableByStudent( int $studentId ): array {
+	public function findAvailableByPayer( int $payerId ): array {
 		$rows = $this->db->get_results(
 			$this->db->prepare(
-				'SELECT * FROM %i WHERE student_id = %d AND status = %s AND remaining > 0 ORDER BY created_at ASC, id ASC',
+				'SELECT * FROM %i WHERE payer_id = %d AND status = %s AND remaining > 0 ORDER BY created_at ASC, id ASC',
 				$this->table,
-				$studentId,
+				$payerId,
 				Credit::STATUS_AVAILABLE
 			)
 		);
@@ -92,7 +94,10 @@ class CreditRepository {
 	}
 
 	/**
-	 * Every credit for a student, newest first (admin history).
+	 * Every credit earned by a student, newest first — the admin history on their
+	 * own screen. Unlike the balance this is keyed on the student, so a child's
+	 * screen shows the credits their cancellations produced even though the
+	 * balance itself sits with their guardian.
 	 *
 	 * @return list<Credit>
 	 */
@@ -109,17 +114,30 @@ class CreditRepository {
 	}
 
 	/**
-	 * Draw down a student's credit balance by $amount, consuming their available
+	 * Backfill `payer_id` on credits written before guardian accounts existed,
+	 * where the student was always the payer. Run once from the installer so the
+	 * payer-keyed balance queries see those rows.
+	 */
+	public function backfillPayerIds(): void {
+		$sql = $this->db->prepare( 'UPDATE %i SET payer_id = student_id WHERE payer_id = 0', $this->table );
+
+		if ( null !== $sql ) {
+			$this->db->query( $sql );
+		}
+	}
+
+	/**
+	 * Draw down a payer's credit balance by $amount, consuming their available
 	 * credits oldest first and marking each fully-spent credit `consumed`. Stops once
 	 * the amount is exhausted; a balance shorter than $amount simply drains to zero.
 	 */
-	public function consume( int $studentId, float $amount ): void {
+	public function consume( int $payerId, float $amount ): void {
 		$remaining = round( $amount, 2 );
 		if ( $remaining <= 0.0 ) {
 			return;
 		}
 
-		foreach ( $this->findAvailableByStudent( $studentId ) as $credit ) {
+		foreach ( $this->findAvailableByPayer( $payerId ) as $credit ) {
 			if ( $remaining <= 0.0 ) {
 				break;
 			}

src/Payment/Payment.php

@@ -39,6 +39,13 @@ class Payment {
 		public readonly string $registrationType,
 		public readonly int $registrationId,
 		public readonly float $amount,
+		/**
+		 * The account that owes this charge — a child's guardian, or 0 meaning
+		 * "the student themselves". Zero rather than a copy of `studentId` so
+		 * every payment written before guardian accounts existed reads back with
+		 * its original meaning without a data migration.
+		 */
+		public readonly int $payerId = 0,
 		public readonly string $currency = 'CAD',
 		public readonly string $method = self::METHOD_ETRANSFER,
 		public readonly string $status = self::STATUS_PENDING,
@@ -64,6 +71,7 @@ class Payment {
 			registrationType:      Val::string( $row->registration_type ),
 			registrationId:        Val::int( $row->registration_id ),
 			amount:                Val::float( $row->amount ),
+			payerId:               Val::int( $row->payer_id ?? 0 ),
 			currency:              Val::string( $row->currency ),
 			method:                Val::string( $row->method ),
 			status:                Val::string( $row->status ),
@@ -87,6 +95,25 @@ class Payment {
 		return self::STATUS_PAID === $this->status;
 	}
 
+	/**
+	 * Who actually owes this charge: the recorded payer, falling back to the
+	 * student. Every caller that needs a person to bill, receipt or credit goes
+	 * through here rather than reading `payerId` directly, so the `0` default
+	 * never leaks out as a user id.
+	 */
+	public function payerOrStudent(): int {
+		return $this->payerId > 0 ? $this->payerId : $this->studentId;
+	}
+
+	/**
+	 * Whether someone other than the student is paying — a guardian. Drives the
+	 * "paid by" line on admin screens, which is noise when they are the same
+	 * person.
+	 */
+	public function hasSeparatePayer(): bool {
+		return $this->payerId > 0 && $this->payerId !== $this->studentId;
+	}
+
 	/**
 	 * Whether this payment was generated by the daily billing scan (weekly /
 	 * monthly) rather than taken at registration. Scheduled payments carry a due
@@ -134,6 +161,7 @@ class Payment {
 		return [
 			'id'                => $this->id,
 			'student_id'        => $this->studentId,
+			'payer_id'          => $this->payerOrStudent(),
 			'instructor_id'     => $this->instructorId,
 			'registration_type' => $this->registrationType,
 			'etransfer_email'   => $this->etransferEmail,

src/Payment/PaymentRepository.php

@@ -16,6 +16,7 @@ class PaymentRepository {
 			$this->table,
 			[
 				'student_id'               => $payment->studentId,
+				'payer_id'                 => $payment->payerOrStudent(),
 				'instructor_id'            => $payment->instructorId,
 				'registration_type'        => $payment->registrationType,
 				'registration_id'          => $payment->registrationId,
@@ -36,12 +37,24 @@ class PaymentRepository {
 				'paid_at'                  => $payment->paidAt,
 				'created_at'               => current_time( 'mysql' ),
 			],
-			[ '%d', '%d', '%s', '%d', '%f', '%s', '%s', '%s', '%f', '%f', '%f', '%s', '%s', '%s', '%s', '%s', '%s', '%s', '%s', '%s' ]
+			[ '%d', '%d', '%d', '%s', '%d', '%f', '%s', '%s', '%s', '%f', '%f', '%f', '%s', '%s', '%s', '%s', '%s', '%s', '%s', '%s', '%s' ]
 		);
 
 		return $this->db->insert_id;
 	}
 
+	/**
+	 * Backfill `payer_id` on payments written before guardian accounts existed,
+	 * where the student was always the payer. Run once from the installer.
+	 */
+	public function backfillPayerIds(): void {
+		$sql = $this->db->prepare( 'UPDATE %i SET payer_id = student_id WHERE payer_id = 0', $this->table );
+
+		if ( null !== $sql ) {
+			$this->db->query( $sql );
+		}
+	}
+
 	/**
 	 * Attach the Stripe PaymentIntent id created for a card payment so the webhook
 	 * can later reconcile the charge back to this row.

src/Payment/PaymentService.php

@@ -34,14 +34,19 @@ class PaymentService {
 	 * A `$dueDate`/`$periodKey` mark a payment generated later by the daily billing
 	 * scan (weekly / monthly) rather than taken at registration; both stay null for
 	 * the pay-now flow.
+	 *
+	 * `$payerId` is who owes it — a child's guardian, or 0 (the default) when the
+	 * student pays for themselves. The billing method resolves against the payer,
+	 * so comping or card-billing a family is one setting on the guardian.
 	 */
-	public function createForRegistration( string $type, int $registrationId, int $studentId, int $instructorId, float $amount, string $currency, ?string $offeringEtransferEmail = null, ?string $dueDate = null, ?string $periodKey = null ): ?Payment {
+	public function createForRegistration( string $type, int $registrationId, int $studentId, int $instructorId, float $amount, string $currency, ?string $offeringEtransferEmail = null, ?string $dueDate = null, ?string $periodKey = null, int $payerId = 0 ): ?Payment {
 		if ( $amount <= 0.0 ) {
 			return null;
 		}
 
-		$method = $this->resolver->resolve( $studentId );
-		$status = Payment::METHOD_COMP === $method ? Payment::STATUS_PAID : Payment::STATUS_PENDING;
+		$payerId = $payerId > 0 ? $payerId : $studentId;
+		$method  = $this->resolver->resolve( $payerId );
+		$status  = Payment::METHOD_COMP === $method ? Payment::STATUS_PAID : Payment::STATUS_PENDING;
 
 		$etransferEmail = null !== $offeringEtransferEmail && '' !== $offeringEtransferEmail
 			? $offeringEtransferEmail
@@ -58,6 +63,7 @@ class PaymentService {
 				registrationType: $type,
 				registrationId:   $registrationId,
 				amount:           $amount,
+				payerId:          $payerId,
 				currency:         $currency,
 				method:           $method,
 				status:           $status,
@@ -72,7 +78,9 @@ class PaymentService {
 		$this->linkPayment( $type, $registrationId, $id );
 
 		if ( Payment::STATUS_PAID === $status ) {
-			$this->finalizePaid( $id, $type, $registrationId, $studentId );
+			// The receipt goes to whoever paid, which for a child's lesson is the
+			// guardian — a child's own address is an undeliverable placeholder.
+			$this->finalizePaid( $id, $type, $registrationId, $payerId );
 		}
 
 		return $this->payments->findById( $id );
@@ -111,7 +119,7 @@ class PaymentService {
 			return true;
 		}
 
-		$this->finalizePaid( $paymentId, $payment->registrationType, $payment->registrationId, $payment->studentId );
+		$this->finalizePaid( $paymentId, $payment->registrationType, $payment->registrationId, $payment->payerOrStudent() );
 
 		return true;
 	}
@@ -174,11 +182,15 @@ class PaymentService {
 			return null;
 		}
 
+		// The credit records the child it was earned for, but the balance itself
+		// lands on whoever paid — so a family's credits pool on the guardian and
+		// one child's cancellation can settle a sibling's next charge.
 		$id = $this->credits->insert(
 			new Credit(
 				studentId:       $payment->studentId,
 				amount:          $share,
 				remaining:       $share,
+				payerId:         $payment->payerOrStudent(),
 				currency:        $payment->currency,
 				sourcePaymentId: $payment->id,
 				sourceLessonId:  $lesson->id,
@@ -209,19 +221,22 @@ class PaymentService {
 	}
 
 	/**
-	 * Apply a student's available credit balance against a set of freshly-created
+	 * Apply a payer's available credit balance against a set of freshly-created
 	 * pending payments (the ones a billing scan just generated for them), oldest
 	 * charge first. Each payment's `credit_applied` is raised by the amount covered;
 	 * a payment fully covered is marked paid-by-credit and its registration confirmed
 	 * so it leaves the confirmation queue. The credit ledger is drawn down by the
 	 * total applied. Returns a map of payment id to the credit applied to it, so the
-	 * caller can reflect the reduction on the student's notice.
+	 * caller can reflect the reduction on the payer's notice.
+	 *
+	 * Keyed on the payer, so a guardian's balance settles charges raised against
+	 * any of their children — the payments passed in may name several students.
 	 *
 	 * @param list<Payment> $payments
 	 * @return array<int, float>
 	 */
-	public function applyCredits( int $studentId, array $payments ): array {
-		$balance = $this->credits->availableBalance( $studentId );
+	public function applyCredits( int $payerId, array $payments ): array {
+		$balance = $this->credits->availableBalance( $payerId );
 		if ( $balance <= 0.0 ) {
 			return [];
 		}
@@ -258,7 +273,7 @@ class PaymentService {
 		}
 
 		if ( $consumed > 0.0 ) {
-			$this->credits->consume( $studentId, $consumed );
+			$this->credits->consume( $payerId, $consumed );
 		}
 
 		return $applied;
@@ -272,11 +287,19 @@ class PaymentService {
 	 * needs no further action. Returns null when the registration has no payment,
 	 * the caller does not own it, or Stripe could not create the intent.
 	 *
+	 * `$userId` is the caller: either the student the registration is for, or the
+	 * guardian who owes it — anyone else gets null rather than a payment step for
+	 * a charge that is not theirs.
+	 *
 	 * @return array<string, mixed>|null
 	 */
-	public function createIntent( string $type, int $registrationId, int $studentId ): ?array {
+	public function createIntent( string $type, int $registrationId, int $userId ): ?array {
 		$payment = $this->payments->findByRegistration( $type, $registrationId );
-		if ( null === $payment || null === $payment->id || $payment->studentId !== $studentId ) {
+		if ( null === $payment || null === $payment->id ) {
+			return null;
+		}
+
+		if ( $payment->studentId !== $userId && $payment->payerOrStudent() !== $userId ) {
 			return null;
 		}
 
@@ -334,7 +357,7 @@ class PaymentService {
 		}
 
 		if ( 'payment_intent.succeeded' === $event->type && ! $payment->isPaid() ) {
-			$this->finalizePaid( $payment->id, $payment->registrationType, $payment->registrationId, $payment->studentId );
+			$this->finalizePaid( $payment->id, $payment->registrationType, $payment->registrationId, $payment->payerOrStudent() );
 		} elseif ( 'payment_intent.payment_failed' === $event->type && ! $payment->isPaid() ) {
 			$this->payments->updateStatus( $payment->id, Payment::STATUS_FAILED );
 		}
@@ -342,12 +365,12 @@ class PaymentService {
 		return true;
 	}
 
-	private function finalizePaid( int $paymentId, string $type, int $registrationId, int $studentId ): void {
+	private function finalizePaid( int $paymentId, string $type, int $registrationId, int $payerId ): void {
 		$this->payments->markPaid( $paymentId, 'USC-' . $paymentId );
 		$this->confirmRegistration( $type, $registrationId );
 
 		$paid = $this->payments->findById( $paymentId );
-		$user = get_userdata( $studentId );
+		$user = get_userdata( $payerId );
 		if ( null !== $paid && $this->mailer->send( $paid, $user instanceof \WP_User ? $user : null ) ) {
 			$this->payments->markReceiptSent( $paymentId );
 		}

src/Payment/ScheduledBillingRunner.php

@@ -6,13 +6,14 @@ namespace Unsupervised\Schedular\Payment;
 use Unsupervised\Schedular\Booking\BookingRepository;
 use Unsupervised\Schedular\GroupClass\Enrollment;
 use Unsupervised\Schedular\GroupClass\EnrollmentRepository;
+use Unsupervised\Schedular\Guardian\GuardianService;
 use Unsupervised\Schedular\Offering\Offering;
 use Unsupervised\Schedular\Offering\OfferingRepository;
 use Unsupervised\Schedular\Val;
 
 /**
  * Generates the pending payments that scheduled-billing offerings (weekly /
- * monthly) owe as they come due, then emails each student one itemised notice.
+ * monthly) owe as they come due, then emails each payer one itemised notice.
  *
  * Runs from the daily WP-Cron action `us_generate_due_payments`. It is
  * self-healing: every run re-scans from the current ledger state, so a missed
@@ -30,6 +31,7 @@ class ScheduledBillingRunner {
 		private EnrollmentRepository $enrollments,
 		private OfferingRepository $offerings,
 		private PaymentDueMailer $mailer,
+		private GuardianService $guardians,
 	) {}
 
 	public function register(): void {
@@ -42,12 +44,13 @@ class ScheduledBillingRunner {
 	public function run(): void {
 		$now = $this->now();
 
-		// One notice bucket per student, filled as pending payments are created and
-		// flushed to a single email at the end, so a student billed for several
-		// lessons on one day is emailed once — never once per lesson. Each entry keeps
-		// the created payment and its label; credits are applied across the whole
-		// bucket before the notice is built, so a student's account credit offsets the
-		// run's charges oldest-first.
+		// One notice bucket per *payer*, filled as pending payments are created and
+		// flushed to a single email at the end, so a payer billed for several
+		// lessons on one day is emailed once — never once per lesson, and a guardian
+		// gets one notice covering every child rather than one per child. Each entry
+		// keeps the created payment and its label; credits are applied across the
+		// whole bucket before the notice is built, so the family's account credit
+		// offsets the run's charges oldest-first.
 		$buckets = [];
 
 		$this->billPrivateLessons( $now, $buckets );
@@ -251,11 +254,18 @@ class ScheduledBillingRunner {
 	/**
 	 * Bill one payment per calendar month of a group class, once its 1st arrives.
 	 *
+	 * A monthly group class is priced **per month**, not per session: the fee is
+	 * charged once for the month however many times the class meets in it. This is
+	 * what the student is quoted and agrees to on the way in ("40.00 CAD monthly"),
+	 * and it is the one place the monthly rule differs from private lessons, whose
+	 * per-lesson fee is multiplied by the lessons that fall in the month.
+	 *
 	 * @param list<array{start: string, end: string}> $windows
 	 * @param array<int, list<array{payment: Payment, label: string}>> $buckets
 	 */
 	private function billGroupMonthly( \DateTimeImmutable $now, string $today, Enrollment $enrollment, Offering $offering, array $windows, array &$buckets ): void { // phpcs:ignore Generic.CodeAnalysis.UnusedFunctionParameter.Found
-		// Count this enrolment's sessions per calendar month.
+		// Count this enrolment's sessions per calendar month. The count does not
+		// price the month — it names it on the student's notice ("3 sessions").
 		$months = [];
 		foreach ( $windows as $window ) {
 			$start                             = new \DateTimeImmutable( $window['start'] );
@@ -278,7 +288,7 @@ class ScheduledBillingRunner {
 				(int) $enrollment->id,
 				$enrollment->studentId,
 				$enrollment->instructorId,
-				$offering->price * $count,
+				$offering->price,
 				$offering->currency,
 				$offering->etransferEmail,
 				$monthStart,
@@ -296,19 +306,24 @@ class ScheduledBillingRunner {
 
 	/**
 	 * Create one scheduled payment and, when it is pending (not a comp auto-pay),
-	 * add it to the student's notice bucket with the label to show on the notice.
+	 * add it to the payer's notice bucket with the label to show on the notice.
 	 * Credits are applied later, once the whole bucket is known. Returns the created
 	 * payment, or null when there was nothing to charge.
 	 *
+	 * The charge is bucketed against whoever owes it, so a guardian's notice covers
+	 * all their children; the label names the child when that differs from the
+	 * payer, or a parent cannot tell whose lesson each line is.
+	 *
 	 * @param array<int, list<array{payment: Payment, label: string}>> $buckets
 	 */
 	private function bill( array &$buckets, string $type, int $registrationId, int $studentId, int $instructorId, float $amount, string $currency, ?string $etransferEmail, string $dueDate, string $periodKey, string $label ): ?Payment {
-		$payment = $this->payments->createForRegistration( $type, $registrationId, $studentId, $instructorId, $amount, $currency, $etransferEmail, $dueDate, $periodKey );
+		$payerId = $this->guardians->payerFor( $studentId );
+		$payment = $this->payments->createForRegistration( $type, $registrationId, $studentId, $instructorId, $amount, $currency, $etransferEmail, $dueDate, $periodKey, $payerId );
 
 		if ( null !== $payment && null !== $payment->id && Payment::STATUS_PENDING === $payment->status ) {
-			$buckets[ $studentId ][] = [
+			$buckets[ $payerId ][] = [
 				'payment' => $payment,
-				'label'   => $label,
+				'label'   => $payerId === $studentId ? $label : $this->labelFor( $studentId, $label ),
 			];
 		}
 
@@ -316,7 +331,17 @@ class ScheduledBillingRunner {
 	}
 
 	/**
-	 * For each student, apply any account credit they hold against the run's charges,
+	 * Prefix a notice line with the student it is for — "Ada: Piano Lesson —
+	 * Mar 3, 2026" — used only when the payer is not the student.
+	 */
+	private function labelFor( int $studentId, string $label ): string {
+		$name = $this->guardians->studentName( $studentId );
+
+		return '' === $name ? $label : $name . ': ' . $label;
+	}
+
+	/**
+	 * For each payer, apply any account credit they hold against the run's charges,
 	 * tag the payments they still owe with a shared batch reference, and email them
 	 * one itemised notice. The notice lists each charge at its full amount, then the
 	 * credit applied and the reduced total due; a charge fully covered by credit is
@@ -326,9 +351,9 @@ class ScheduledBillingRunner {
 	 * @param array<int, list<array{payment: Payment, label: string}>> $buckets
 	 */
 	private function sendNotices( array $buckets ): void {
-		foreach ( $buckets as $studentId => $entries ) {
+		foreach ( $buckets as $payerId => $entries ) {
 			$payments = array_map( static fn( array $entry ): Payment => $entry['payment'], $entries );
-			$applied  = $this->payments->applyCredits( $studentId, $payments );
+			$applied  = $this->payments->applyCredits( $payerId, $payments );
 
 			$items       = [];
 			$batchIds    = [];
@@ -359,7 +384,7 @@ class ScheduledBillingRunner {
 			$reference = [] !== $batchIds ? $this->reference() : '';
 			$this->payments->assignNoticeBatch( $batchIds, $reference );
 
-			$user = get_userdata( $studentId );
+			$user = get_userdata( $payerId );
 			if ( $user instanceof \WP_User ) {
 				$this->mailer->send( $user, $items, $reference, round( $creditTotal, 2 ) );
 			}

src/Payment/StudioSettings.php

@@ -16,6 +16,14 @@ class StudioSettings {
 	public const OPT_ETRANSFER_EMAIL = 'us_etransfer_email';
 	public const OPT_HST_RATE        = 'us_hst_rate';
 
+	/**
+	 * The studio-wide default billing method for students with no per-student
+	 * override. Card is the default; setting it to e-transfer holds every student
+	 * on e-transfer even once Stripe is live, so card billing can be trialled on a
+	 * few students before the whole studio moves over.
+	 */
+	public const OPT_DEFAULT_PAYMENT_METHOD = 'us_default_payment_method';
+
 	/**
 	 * Studio-default cancellation cutoff, stored in hours. A student may not
 	 * cancel a lesson once it starts within this many hours. Displayed to the
@@ -56,6 +64,17 @@ class StudioSettings {
 		return 'live' === get_option( self::OPT_MODE, 'test' ) ? 'live' : 'test';
 	}
 
+	/**
+	 * The studio-default billing method: `card` or `etransfer`. A card default
+	 * still degrades to e-transfer while Stripe is unconfigured — see
+	 * BillingMethodResolver, which owns that fallback.
+	 */
+	public function defaultPaymentMethod(): string {
+		return Payment::METHOD_ETRANSFER === get_option( self::OPT_DEFAULT_PAYMENT_METHOD, Payment::METHOD_CARD )
+			? Payment::METHOD_ETRANSFER
+			: Payment::METHOD_CARD;
+	}
+
 	public function currency(): string {
 		$currency = Val::string( get_option( self::OPT_CURRENCY, 'CAD' ) );
 
@@ -112,13 +131,32 @@ class StudioSettings {
 		return self::MODE_SELF_APPROVAL === $this->registrationMode();
 	}
 
+	/**
+	 * Forget every Stripe credential, returning the studio to e-transfer billing.
+	 * The mode drops back to `test` so a later re-configuration cannot go live by
+	 * inheriting the old setting.
+	 */
+	public function clearStripeConfig(): void {
+		delete_option( self::OPT_PUBLISHABLE );
+		delete_option( self::OPT_SECRET );
+		delete_option( self::OPT_WEBHOOK_SECRET );
+		delete_option( self::OPT_MODE );
+	}
+
 	public function renderPage(): void {
 		if ( ! current_user_can( RoleManager::CAP_MANAGE_BILLING ) ) {
 			wp_die( esc_html__( 'You do not have permission to manage billing settings.', 'unsupervised-schedular' ) );
 		}
 
+		$notice = '';
 		if ( isset( $_POST['usc_action'] ) && check_admin_referer( 'usc_settings_action' ) ) {
-			$this->save();
+			// phpcs:ignore WordPress.Security.NonceVerification.Missing -- verified immediately above.
+			if ( 'clear_stripe' === sanitize_key( Val::string( wp_unslash( $_POST['usc_action'] ) ) ) ) {
+				$this->clearStripeConfig();
+				$notice = __( 'Stripe configuration cleared. New registrations default to e-transfer until Stripe is set up again.', 'unsupervised-schedular' );
+			} else {
+				$this->save();
+			}
 		}
 
 		$publishableKey = $this->publishableKey();
@@ -133,6 +171,10 @@ class StudioSettings {
 		$etransferEmail   = $this->etransferEmail();
 		$hstRate          = $this->hstRate();
 		$stripeConfigured = $this->isStripeConfigured();
+		$defaultMethod    = $this->defaultPaymentMethod();
+		// Offer the clear button whenever any Stripe value lingers, not only when
+		// the pair of keys makes Stripe fully usable.
+		$stripeAnySet     = '' !== $publishableKey || $secretKeySet || $webhookSecretSet;
 		$openRegistration = $this->openRegistrationEnabled();
 		// Stored in hours, surfaced to the admin in whole days.
 		$cancellationCutoffDays = (int) round( $this->cancellationCutoffHours() / 24 );
@@ -158,6 +200,13 @@ class StudioSettings {
 		update_option( self::OPT_MODE, 'live' === $mode ? 'live' : 'test' );
 		update_option( self::OPT_CURRENCY, strtoupper( sanitize_text_field( Val::string( wp_unslash( $_POST['currency'] ?? 'CAD' ) ) ) ) );
 		update_option( self::OPT_ETRANSFER_EMAIL, sanitize_email( Val::string( wp_unslash( $_POST['etransfer_email'] ?? '' ) ) ) );
+		// Anything but an explicit e-transfer choice means card, so a mangled or
+		// missing field can never silently disable card billing studio-wide.
+		$defaultMethod = sanitize_key( Val::string( wp_unslash( $_POST['default_payment_method'] ?? Payment::METHOD_CARD ) ) );
+		update_option(
+			self::OPT_DEFAULT_PAYMENT_METHOD,
+			Payment::METHOD_ETRANSFER === $defaultMethod ? Payment::METHOD_ETRANSFER : Payment::METHOD_CARD
+		);
 		// phpcs:ignore WordPress.Security.ValidatedSanitizedInput.MissingUnslash, WordPress.Security.ValidatedSanitizedInput.InputNotSanitized -- Val::float() coerces to float; slashes cannot survive numeric coercion.
 		$hstRate = isset( $_POST['hst_rate'] ) ? Val::float( $_POST['hst_rate'] ) : 0.0;
 		update_option( self::OPT_HST_RATE, max( 0.0, $hstRate ) );

src/Plugin.php

@@ -3,8 +3,10 @@ declare(strict_types=1);
 
 namespace Unsupervised\Schedular;
 
+use Unsupervised\Schedular\Auth\DeletedUserCleanup;
 use Unsupervised\Schedular\Auth\EmailConfirmationHandler;
 use Unsupervised\Schedular\Auth\InviteRepository;
+use Unsupervised\Schedular\Auth\AccountPage;
 use Unsupervised\Schedular\Auth\LoginPage;
 use Unsupervised\Schedular\Auth\RegistrationLoginGate;
 use Unsupervised\Schedular\Auth\RegistrationMailer;
@@ -14,9 +16,14 @@ use Unsupervised\Schedular\Auth\StudentAdminGuard;
 use Unsupervised\Schedular\Booking\BookingPage;
 use Unsupervised\Schedular\Availability\AvailabilityRepository;
 use Unsupervised\Schedular\Booking\BookingRepository;
+use Unsupervised\Schedular\Booking\LessonBooker;
 use Unsupervised\Schedular\GroupClass\EnrollmentRepository;
 use Unsupervised\Schedular\GroupClass\GroupAccessRepository;
 use Unsupervised\Schedular\GroupClass\GroupClassPage;
+use Unsupervised\Schedular\Guardian\ChildLoginGate;
+use Unsupervised\Schedular\Guardian\FamilyPage;
+use Unsupervised\Schedular\Guardian\GuardianRepository;
+use Unsupervised\Schedular\Guardian\GuardianService;
 use Unsupervised\Schedular\Offering\OfferingRepository;
 use Unsupervised\Schedular\Payment\BillingMethodResolver;
 use Unsupervised\Schedular\Payment\CreditRepository;
@@ -66,6 +73,15 @@ class Plugin {
 			update_option( 'us_questions_offering_nullable', '1' );
 		}
 
+		// One-time backfill of us_questions.is_required_child, which dbDelta adds
+		// defaulting to 0 — leaving every question that *was* required no longer
+		// required of the students a guardian registers. Runs after the version
+		// gate above, so the column it writes to exists. Guarded so a question
+		// later made optional for students stays that way.
+		if ( '1' !== get_option( 'us_questions_child_required_backfilled', '' ) && $questions->backfillChildRequired() ) {
+			update_option( 'us_questions_child_required_backfilled', '1' );
+		}
+
 		$answers          = new AnswerRepository( $wpdb );
 		$policies         = new PolicyRepository( $wpdb );
 		$policyVersions   = new PolicyVersionRepository( $wpdb );
@@ -76,6 +92,9 @@ class Plugin {
 		$groupAccess      = new GroupAccessRepository( $wpdb );
 		$registrationGate = new RegistrationGate( $questions, $answers, $policies, $policyVersions, $acceptances );
 
+		$guardianRepo = new GuardianRepository( $wpdb );
+		$guardians    = new GuardianService( $guardianRepo, $bookings, $enrollments );
+
 		$paymentRepo    = new PaymentRepository( $wpdb );
 		$creditRepo     = new CreditRepository( $wpdb );
 		$settings       = new StudioSettings();
@@ -83,25 +102,33 @@ class Plugin {
 		$stripe         = new StripeGateway( $settings );
 		$paymentService = new PaymentService( $paymentRepo, $resolver, new ReceiptMailer(), $bookings, $enrollments, $settings, $stripe, $creditRepo );
 
+		// The booking core is shared by the REST endpoint students book through and
+		// the admin form staff book on their behalf with.
+		$lessonBooker = new LessonBooker( $availability, $bookings, $offerings, $paymentService, $guardians );
+
 		// The shortcode and block wrappers share the same page objects so
 		// front-end output is identical whichever way a page embeds them.
 		$registrationMailer = new RegistrationMailer();
 
-		$bookingPage      = new BookingPage();
+		$bookingPage      = new BookingPage( $guardians );
 		$loginPage        = new LoginPage();
-		$registrationPage = new RegistrationPage( $invites, $policies, $policyVersions, $acceptances, $settings, $registrationMailer, $questions, $answers, $groupAccess );
-		$groupClassPage   = new GroupClassPage();
+		$registrationPage = new RegistrationPage( $invites, $policies, $policyVersions, $acceptances, $settings, $registrationMailer, $questions, $answers, $groupAccess, $guardians );
+		$groupClassPage   = new GroupClassPage( $guardians );
+		$familyPage       = new FamilyPage( $guardians, $questions, $answers );
+		$accountPage      = new AccountPage();
 
-		( new ScheduledBillingRunner( $paymentService, $bookings, $enrollments, $offerings, new PaymentDueMailer() ) )->register();
+		( new ScheduledBillingRunner( $paymentService, $bookings, $enrollments, $offerings, new PaymentDueMailer(), $guardians ) )->register();
 
 		( new UpdateChecker() )->register();
 		( new RoleManager() )->register();
 		( new RegistrationLoginGate() )->register();
+		( new ChildLoginGate() )->register();
 		( new StudentAdminGuard() )->register();
+		( new DeletedUserCleanup( $bookings, $availability, $enrollments, $paymentService, $guardianRepo, $guardians ) )->register();
 		( new EmailConfirmationHandler( $settings, $registrationMailer ) )->register();
-		( new AdminMenu( $availability, $bookings, $offerings, $questions, $answers, $policies, $policyVersions, $policyService, $acceptances, $invites, $enrollments, $groupAccess, $settings, $paymentRepo, $paymentService, $resolver, $registrationMailer, $creditRepo ) )->register();
-		( new RestRegistrar( $availability, $bookings, $offerings, $questions, $policies, $policyVersions, $policyService, $registrationGate, $enrollments, $groupAccess, $paymentService ) )->register();
-		( new ShortcodeRegistrar( $bookingPage, $loginPage, $registrationPage, $groupClassPage ) )->register();
-		( new BlockRegistrar( $bookingPage, $loginPage, $registrationPage, $groupClassPage ) )->register();
+		( new AdminMenu( $availability, $bookings, $offerings, $questions, $answers, $policies, $policyVersions, $policyService, $acceptances, $invites, $enrollments, $groupAccess, $settings, $paymentRepo, $paymentService, $resolver, $registrationMailer, $creditRepo, $guardians, $lessonBooker, $registrationGate ) )->register();
+		( new RestRegistrar( $availability, $bookings, $offerings, $questions, $policies, $policyVersions, $policyService, $registrationGate, $enrollments, $groupAccess, $paymentService, $guardians, $lessonBooker ) )->register();
+		( new ShortcodeRegistrar( $bookingPage, $loginPage, $registrationPage, $groupClassPage, $familyPage, $accountPage ) )->register();
+		( new BlockRegistrar( $bookingPage, $loginPage, $registrationPage, $groupClassPage, $familyPage, $accountPage ) )->register();
 	}
 }

src/Policy/AcceptanceRepository.php

@@ -17,12 +17,16 @@ class AcceptanceRepository {
 			[
 				'policy_version_id' => $acceptance->policyVersionId,
 				'student_id'        => $acceptance->studentId,
+				'accepted_by'       => $acceptance->acceptorOrStudent(),
 				'registration_type' => $acceptance->registrationType,
 				'registration_id'   => $acceptance->registrationId,
 				'ip_address'        => $acceptance->ipAddress,
+				'collected_via'     => $acceptance->collectedVia,
+				'collected_note'    => $acceptance->collectedNote,
+				'recorded_by'       => $acceptance->recordedBy,
 				'accepted_at'       => current_time( 'mysql' ),
 			],
-			[ '%d', '%d', '%s', '%d', '%s', '%s' ]
+			[ '%d', '%d', '%d', '%s', '%d', '%s', '%s', '%s', '%d', '%s' ]
 		);
 
 		return $this->db->insert_id;
@@ -38,6 +42,19 @@ class AcceptanceRepository {
 		return array_map( fn( PolicyAcceptance $a ): int => $this->insert( $a ), $acceptances );
 	}
 
+	/**
+	 * Backfill `accepted_by` on acceptances recorded before guardian accounts
+	 * existed, where the student always agreed for themselves. Run once from the
+	 * installer so the acceptor is a real user id on every row.
+	 */
+	public function backfillAcceptedBy(): void {
+		$sql = $this->db->prepare( 'UPDATE %i SET accepted_by = student_id WHERE accepted_by = 0', $this->table );
+
+		if ( null !== $sql ) {
+			$this->db->query( $sql );
+		}
+	}
+
 	/**
 	 * Find all acceptances attached to a registration (lesson or enrolment).
 	 *

src/Policy/PolicyAcceptance.php

@@ -24,7 +24,27 @@ class PolicyAcceptance {
 		public readonly int $studentId,
 		public readonly string $registrationType,
 		public readonly int $registrationId,
+		/**
+		 * Who actually clicked "I agree" — a child's guardian, or 0 meaning the
+		 * student agreed for themselves. Zero rather than a copy of `studentId`
+		 * so every acceptance recorded before guardian accounts existed keeps its
+		 * original meaning.
+		 */
+		public readonly int $acceptedBy = 0,
 		public readonly ?string $ipAddress = null,
+		/**
+		 * How this acceptance reached the studio when it was not given online — see
+		 * {@see \Unsupervised\Schedular\Registration\IntakeProvenance}. Null is the
+		 * ordinary case: the student ticked the box themselves.
+		 */
+		public readonly ?string $collectedVia = null,
+		public readonly ?string $collectedNote = null,
+		/**
+		 * The staff member who typed it in, when somebody did. Distinct from
+		 * `acceptedBy`: the student still agreed, on paper or over the phone — this
+		 * is only who entered the record of it.
+		 */
+		public readonly int $recordedBy = 0,
 		public readonly ?string $acceptedAt = null,
 		public readonly ?int $id = null,
 	) {}
@@ -35,12 +55,34 @@ class PolicyAcceptance {
 			studentId:        Val::int( $row->student_id ),
 			registrationType: Val::string( $row->registration_type ),
 			registrationId:   Val::int( $row->registration_id ),
+			acceptedBy:       Val::int( $row->accepted_by ?? 0 ),
 			ipAddress:        Val::stringOrNull( $row->ip_address ),
+			collectedVia:     Val::stringOrNull( $row->collected_via ?? null ),
+			collectedNote:    Val::stringOrNull( $row->collected_note ?? null ),
+			recordedBy:       Val::int( $row->recorded_by ?? 0 ),
 			acceptedAt:       Val::stringOrNull( $row->accepted_at ),
 			id:               Val::int( $row->id ),
 		);
 	}
 
+	/**
+	 * Who this acceptance is legally attributable to: the recorded acceptor,
+	 * falling back to the student. Callers go through here so the `0` default of a
+	 * pre-guardian acceptance never leaks out as a user id.
+	 */
+	public function acceptorOrStudent(): int {
+		return $this->acceptedBy > 0 ? $this->acceptedBy : $this->studentId;
+	}
+
+	/**
+	 * Whether someone other than the student agreed — a guardian accepting on a
+	 * child's behalf. Drives the "accepted by" line on the admin screen, which is
+	 * noise when they are the same person.
+	 */
+	public function acceptedOnBehalf(): bool {
+		return $this->acceptedBy > 0 && $this->acceptedBy !== $this->studentId;
+	}
+
 	/**
 	 * Returns a plain array representation of the acceptance.
 	 *
@@ -51,9 +93,13 @@ class PolicyAcceptance {
 			'id'                => $this->id,
 			'policy_version_id' => $this->policyVersionId,
 			'student_id'        => $this->studentId,
+			'accepted_by'       => $this->acceptorOrStudent(),
 			'registration_type' => $this->registrationType,
 			'registration_id'   => $this->registrationId,
 			'ip_address'        => $this->ipAddress,
+			'collected_via'     => $this->collectedVia,
+			'collected_note'    => $this->collectedNote,
+			'recorded_by'       => $this->recordedBy,
 			'accepted_at'       => $this->acceptedAt,
 		];
 	}

src/Policy/PolicyController.php

@@ -19,20 +19,35 @@ class PolicyController {
 			wp_die( esc_html__( 'You do not have permission to manage policies.', 'unsupervised-schedular' ) );
 		}
 
+		$notice        = '';
+		$viewVersionId = 0;
+
 		if ( isset( $_POST['usc_action'] ) && check_admin_referer( 'usc_policy_action' ) ) {
-			$this->handleFormAction();
+			[ $notice, $viewVersionId ] = $this->handleFormAction();
 		}
 
-		// phpcs:ignore WordPress.Security.NonceVerification.Recommended -- read-only policy selector.
-		$policyId       = absint( Val::int( $_GET['policy_id'] ?? 0 ) );
+		// phpcs:disable WordPress.Security.NonceVerification.Recommended -- read-only policy/version selectors.
+		$policyId = absint( Val::int( $_GET['policy_id'] ?? 0 ) );
+		if ( 0 === $viewVersionId ) {
+			$viewVersionId = absint( Val::int( $_GET['version_id'] ?? 0 ) );
+		}
+		// phpcs:enable WordPress.Security.NonceVerification.Recommended
+
 		$policyList     = $this->policies->findAll();
 		$selectedPolicy = $policyId > 0 ? $this->policies->findById( $policyId ) : null;
 		$policyVersions = null !== $selectedPolicy ? $this->versions->findByPolicy( (int) $selectedPolicy->id ) : null;
+		$viewedVersion  = null !== $selectedPolicy ? $this->loadVersionForPolicy( (int) $selectedPolicy->id, $viewVersionId ) : null;
 
 		include USC_PLUGIN_DIR . 'templates/admin/policies.php';
 	}
 
-	private function handleFormAction(): void {
+	/**
+	 * Process the posted action.
+	 *
+	 * @return array{string, int} Status notice, and the version to open in the
+	 *                            viewer (0 to leave the current selection alone).
+	 */
+	private function handleFormAction(): array {
 		// Nonce is verified by the caller (renderPage) before this method runs.
 		// phpcs:disable WordPress.Security.NonceVerification.Missing
 		$action = sanitize_key( Val::string( wp_unslash( $_POST['usc_action'] ?? '' ) ) );
@@ -53,12 +68,31 @@ class PolicyController {
 				$this->service->createPolicy( $title, $slug, $scope );
 			}
 
-			return;
+			return [ '', 0 ];
 		}
 
 		$policyId = absint( Val::int( $_POST['policy_id'] ?? 0 ) );
 		if ( $policyId <= 0 || null === $this->policies->findById( $policyId ) ) {
-			return;
+			return [ '', 0 ];
+		}
+
+		if ( 'rename_policy' === $action ) {
+			$title = trim( sanitize_text_field( Val::string( wp_unslash( $_POST['title'] ?? '' ) ) ) );
+
+			if ( '' === $title || mb_strlen( $title ) > Policy::MAX_TITLE_LENGTH ) {
+				return [ '', 0 ];
+			}
+
+			$this->policies->updateTitle( $policyId, $title );
+
+			return [
+				sprintf(
+					/* translators: %s: the policy's new title. */
+					__( 'Policy renamed to "%s".', 'unsupervised-schedular' ),
+					$title
+				),
+				0,
+			];
 		}
 
 		if ( 'add_version' === $action ) {
@@ -66,6 +100,40 @@ class PolicyController {
 			$this->service->addDraftVersion( $policyId, $body );
 		}
 
+		if ( 'edit_version' === $action ) {
+			$source = $this->loadVersionForPolicy( $policyId, absint( Val::int( $_POST['version_id'] ?? 0 ) ) );
+			if ( null === $source ) {
+				return [ '', 0 ];
+			}
+
+			$body = wp_kses_post( Val::string( wp_unslash( $_POST['body'] ?? '' ) ) );
+
+			// A draft has never been shown to a student, so it is edited in place.
+			// A published (or archived) version is what students accepted, so an
+			// edit branches a new draft and leaves the original untouched.
+			if ( PolicyVersion::STATUS_DRAFT === $source->status ) {
+				$this->versions->updateBody( (int) $source->id, $body );
+
+				return [
+					sprintf(
+						/* translators: %d: the edited version number. */
+						__( 'Draft version %d was updated.', 'unsupervised-schedular' ),
+						$source->versionNumber
+					),
+					(int) $source->id,
+				];
+			}
+
+			return [
+				sprintf(
+					/* translators: %d: the version number the edit was based on. */
+					__( 'Your changes to version %d were saved as a new draft version.', 'unsupervised-schedular' ),
+					$source->versionNumber
+				),
+				$this->service->addDraftVersion( $policyId, $body ),
+			];
+		}
+
 		if ( 'publish_version' === $action ) {
 			$versionId = absint( Val::int( $_POST['version_id'] ?? 0 ) );
 			if ( $versionId > 0 ) {
@@ -73,5 +141,20 @@ class PolicyController {
 			}
 		}
 		// phpcs:enable WordPress.Security.NonceVerification.Missing
+
+		return [ '', 0 ];
+	}
+
+	/**
+	 * Load a version by id, confirming it belongs to the given policy.
+	 */
+	private function loadVersionForPolicy( int $policyId, int $versionId ): ?PolicyVersion {
+		if ( $versionId <= 0 ) {
+			return null;
+		}
+
+		$version = $this->versions->findById( $versionId );
+
+		return null !== $version && $version->policyId === $policyId ? $version : null;
 	}
 }

src/Policy/PolicyEndpoint.php

@@ -104,9 +104,9 @@ class PolicyEndpoint {
 				'policy_version_id' => $version->id,
 				'version_number'    => $version->versionNumber,
 				// Bodies are kses'd on every write path, but the booking JS renders
-				// this HTML raw — sanitise at output too so a missed write path can
-				// never become stored XSS.
-				'body'              => wp_kses_post( (string) $version->body ),
+				// this HTML raw — bodyHtml() sanitises at output too, so a missed
+				// write path can never become stored XSS.
+				'body'              => $version->bodyHtml(),
 			];
 		}
 

src/Policy/PolicyRepository.php

@@ -46,6 +46,22 @@ class PolicyRepository {
 		return array_map( Policy::fromRow( ... ), $rows ?? [] );
 	}
 
+	/**
+	 * Rename a policy. Only the title moves: the slug is the identifier the
+	 * booking and signup gates look policies up by, so renaming "Studio Policy"
+	 * to "Terms of Enrolment" must not quietly detach it from the versions
+	 * students have already accepted.
+	 */
+	public function updateTitle( int $policyId, string $title ): bool {
+		return false !== $this->db->update(
+			$this->table,
+			[ 'title' => $title ],
+			[ 'id' => $policyId ],
+			[ '%s' ],
+			[ '%d' ]
+		);
+	}
+
 	public function updateCurrentVersion( int $policyId, int $versionId ): bool {
 		return false !== $this->db->update(
 			$this->table,

src/Policy/PolicyVersion.php

@@ -42,6 +42,19 @@ class PolicyVersion {
 		return self::STATUS_PUBLISHED === $this->status;
 	}
 
+	/**
+	 * The body as display-ready HTML.
+	 *
+	 * Policy bodies are typed into a plain textarea, so most are written as
+	 * blank-line-separated prose with no markup at all — dropped into a page
+	 * as-is that collapses into one unreadable run of text. Running the same
+	 * `wpautop()` WordPress applies to post content turns those breaks into
+	 * paragraphs, and leaves bodies that do carry markup alone.
+	 */
+	public function bodyHtml(): string {
+		return wpautop( wp_kses_post( (string) $this->body ) );
+	}
+
 	/**
 	 * Returns a plain array representation of the version.
 	 *

src/Registration/Answer.php

@@ -25,6 +25,15 @@ class Answer {
 		public readonly int $registrationId,
 		public readonly int $studentId,
 		public readonly ?string $answerValue = null,
+		/**
+		 * How this answer reached the studio when it did not come from the booking
+		 * form — see {@see IntakeProvenance}. Null is the ordinary case: the student
+		 * typed it in themselves.
+		 */
+		public readonly ?string $collectedVia = null,
+		public readonly ?string $collectedNote = null,
+		/** The staff member who typed it in, when somebody did. */
+		public readonly int $recordedBy = 0,
 		public readonly ?int $id = null,
 	) {}
 
@@ -35,6 +44,9 @@ class Answer {
 			registrationId:   Val::int( $row->registration_id ),
 			studentId:        Val::int( $row->student_id ),
 			answerValue:      Val::stringOrNull( $row->answer_value ),
+			collectedVia:     Val::stringOrNull( $row->collected_via ?? null ),
+			collectedNote:    Val::stringOrNull( $row->collected_note ?? null ),
+			recordedBy:       Val::int( $row->recorded_by ?? 0 ),
 			id:               Val::int( $row->id ),
 		);
 	}
@@ -52,6 +64,9 @@ class Answer {
 			'registration_id'   => $this->registrationId,
 			'student_id'        => $this->studentId,
 			'answer_value'      => $this->answerValue,
+			'collected_via'     => $this->collectedVia,
+			'collected_note'    => $this->collectedNote,
+			'recorded_by'       => $this->recordedBy,
 		];
 	}
 }

src/Registration/AnswerRepository.php

@@ -20,9 +20,12 @@ class AnswerRepository {
 				'registration_id'   => $answer->registrationId,
 				'student_id'        => $answer->studentId,
 				'answer_value'      => $answer->answerValue,
+				'collected_via'     => $answer->collectedVia,
+				'collected_note'    => $answer->collectedNote,
+				'recorded_by'       => $answer->recordedBy,
 				'created_at'        => current_time( 'mysql' ),
 			],
-			[ '%d', '%s', '%d', '%d', '%s', '%s' ]
+			[ '%d', '%s', '%d', '%d', '%s', '%s', '%s', '%d', '%s' ]
 		);
 
 		return $this->db->insert_id;

src/Registration/IntakeAudit.php

@@ -0,0 +1,100 @@
+<?php
+declare(strict_types=1);
+
+namespace Unsupervised\Schedular\Registration;
+
+use Unsupervised\Schedular\Auth\UserName;
+use Unsupervised\Schedular\Policy\AcceptanceRepository;
+use Unsupervised\Schedular\Policy\PolicyAcceptance;
+use Unsupervised\Schedular\Policy\PolicyRepository;
+use Unsupervised\Schedular\Policy\PolicyVersionRepository;
+
+/**
+ * Builds the display rows for one registration's audit trail: the intake answers
+ * the student gave and the policy versions they accepted. Used by the admin
+ * lesson detail view and the group-class enrolment detail view alike, mirroring
+ * the per-student history in {@see \Unsupervised\Schedular\Auth\StudentHistory}.
+ *
+ * Which rows belong to the registration is the subject's own business
+ * ({@see IntakeSubject::intakeRegistrationId()}) — notably, a weekly lesson
+ * series is answered for and agreed to once, against its anchor, so every
+ * occurrence reads the same trail rather than only the first looking answered.
+ */
+class IntakeAudit {
+
+	public function __construct(
+		private AnswerRepository $answers,
+		private QuestionRepository $questions,
+		private AcceptanceRepository $acceptances,
+		private PolicyRepository $policies,
+		private PolicyVersionRepository $versions,
+	) {}
+
+	/**
+	 * The intake-question answers recorded for this registration, in submission
+	 * order.
+	 *
+	 * @return list<array{question: string, answer: string, source: string}>
+	 */
+	public function answers( IntakeSubject $subject ): array {
+		return array_map(
+			function ( Answer $answer ): array {
+				$question = $this->questions->findById( $answer->questionId );
+				$value    = $answer->answerValue ?? '';
+
+				return [
+					'question' => $question ? $question->label : sprintf( '#%d', $answer->questionId ),
+					'answer'   => '' === $value ? '—' : $value,
+					'source'   => $this->source( $answer->collectedVia, $answer->collectedNote, $answer->recordedBy ),
+				];
+			},
+			$this->answers->findByRegistration( $subject->intakeRegistrationType(), $subject->intakeRegistrationId() )
+		);
+	}
+
+	/**
+	 * Where a recorded row came from: given online by the student, or collected
+	 * some other way and typed in — in which case who typed it is named, since an
+	 * unattributed transcription is worth much less than an attributed one.
+	 */
+	private function source( ?string $collectedVia, ?string $collectedNote, int $recordedBy ): string {
+		$described = IntakeProvenance::describe( $collectedVia, $collectedNote );
+
+		if ( null === $collectedVia || '' === $collectedVia || $recordedBy <= 0 ) {
+			return $described;
+		}
+
+		$user = get_userdata( $recordedBy );
+
+		return sprintf(
+			/* translators: 1: how the answer was collected, 2: name of the staff member who recorded it. */
+			__( '%1$s — recorded by %2$s', 'unsupervised-schedular' ),
+			$described,
+			UserName::format( $user instanceof \WP_User ? $user : null, $recordedBy )
+		);
+	}
+
+	/**
+	 * The policy versions the student accepted for this registration, with the
+	 * captured acceptance time and IP for the audit trail.
+	 *
+	 * @return list<array{policy: string, version: string, accepted_at: string, ip: string, source: string}>
+	 */
+	public function acceptances( IntakeSubject $subject ): array {
+		return array_map(
+			function ( PolicyAcceptance $acceptance ): array {
+				$version = $this->versions->findById( $acceptance->policyVersionId );
+				$policy  = $version ? $this->policies->findById( $version->policyId ) : null;
+
+				return [
+					'policy'      => $policy ? $policy->title : sprintf( '#%d', $acceptance->policyVersionId ),
+					'version'     => $version ? sprintf( 'v%d', $version->versionNumber ) : '—',
+					'accepted_at' => $acceptance->acceptedAt ?? '',
+					'ip'          => $acceptance->ipAddress ?? '',
+					'source'      => $this->source( $acceptance->collectedVia, $acceptance->collectedNote, $acceptance->recordedBy ),
+				];
+			},
+			$this->acceptances->findByRegistration( $subject->intakeRegistrationType(), $subject->intakeRegistrationId() )
+		);
+	}
+}

src/Registration/IntakeProvenance.php

@@ -0,0 +1,101 @@
+<?php
+declare(strict_types=1);
+
+namespace Unsupervised\Schedular\Registration;
+
+/**
+ * Where an intake answer or policy acceptance came from, when it did not come
+ * from the student filling in the booking form.
+ *
+ * A lesson the studio booked on someone's behalf has no answers and no
+ * acceptances — nobody was at a keyboard to give them — so they are collected
+ * some other way and typed in afterwards. What makes that record worth keeping
+ * is knowing *how*: "accepted on 24 Aug" means one thing when a student ticked a
+ * box and quite another when a staff member read it off a signed form, and an
+ * audit trail that cannot tell them apart is worse than no audit trail, because
+ * it looks like one.
+ *
+ * Absent (null) provenance is therefore meaningful in its own right: it is the
+ * ordinary case of the student answering online.
+ */
+class IntakeProvenance {
+
+	public const VIA_PAPER     = 'paper';
+	public const VIA_IN_PERSON = 'in_person';
+	public const VIA_PHONE     = 'phone';
+	public const VIA_EMAIL     = 'email';
+	public const VIA_OTHER     = 'other';
+
+	/**
+	 * How the answers can have reached the studio. `other` exists so the list
+	 * never forces a lie, and is the one option that must be explained.
+	 *
+	 * @var list<string>
+	 */
+	public const VALID_METHODS = [ self::VIA_PAPER, self::VIA_IN_PERSON, self::VIA_PHONE, self::VIA_EMAIL, self::VIA_OTHER ];
+
+	/** Longest note the `collected_note` VARCHAR(191) column holds. */
+	public const MAX_NOTE_LENGTH = 191;
+
+	public function __construct(
+		public readonly string $collectedVia,
+		public readonly ?string $collectedNote = null,
+		public readonly int $recordedBy = 0,
+	) {}
+
+	/**
+	 * Build from submitted values, or explain what is wrong with them. A method
+	 * outside the vocabulary is rejected rather than stored: a column that can say
+	 * anything says nothing. `other` requires the note, since "other" on its own
+	 * answers the question with the question.
+	 */
+	public static function fromInput( string $collectedVia, string $collectedNote, int $recordedBy ): self|\WP_Error {
+		if ( ! in_array( $collectedVia, self::VALID_METHODS, true ) ) {
+			return new \WP_Error( 'invalid_collection_method', __( 'Choose how these were collected.', 'unsupervised-schedular' ) );
+		}
+
+		$note = trim( $collectedNote );
+
+		if ( self::VIA_OTHER === $collectedVia && '' === $note ) {
+			return new \WP_Error( 'collection_note_required', __( 'Say how these were collected.', 'unsupervised-schedular' ) );
+		}
+
+		return new self(
+			collectedVia:  $collectedVia,
+			collectedNote: '' !== $note ? mb_substr( $note, 0, self::MAX_NOTE_LENGTH ) : null,
+			recordedBy:    $recordedBy,
+		);
+	}
+
+	/**
+	 * The methods as `value => label`, for the form's picker and for reading a
+	 * stored value back on screen.
+	 *
+	 * @return array<string, string>
+	 */
+	public static function choices(): array {
+		return [
+			self::VIA_PAPER     => __( 'On a signed paper form', 'unsupervised-schedular' ),
+			self::VIA_IN_PERSON => __( 'In person', 'unsupervised-schedular' ),
+			self::VIA_PHONE     => __( 'Over the phone', 'unsupervised-schedular' ),
+			self::VIA_EMAIL     => __( 'By email', 'unsupervised-schedular' ),
+			self::VIA_OTHER     => __( 'Some other way', 'unsupervised-schedular' ),
+		];
+	}
+
+	/**
+	 * How a stored row reads on screen: the method's label, plus its note. An
+	 * empty method is the ordinary case — the student answered online — and says
+	 * so rather than showing a blank cell.
+	 */
+	public static function describe( ?string $collectedVia, ?string $collectedNote = null ): string {
+		if ( null === $collectedVia || '' === $collectedVia ) {
+			return __( 'Given online when booking', 'unsupervised-schedular' );
+		}
+
+		$label = self::choices()[ $collectedVia ] ?? $collectedVia;
+		$note  = null !== $collectedNote ? trim( $collectedNote ) : '';
+
+		return '' !== $note ? $label . ' — ' . $note : $label;
+	}
+}

src/Registration/IntakeRecording.php

@@ -0,0 +1,194 @@
+<?php
+declare(strict_types=1);
+
+namespace Unsupervised\Schedular\Registration;
+
+use Unsupervised\Schedular\Policy\AcceptanceRepository;
+use Unsupervised\Schedular\Policy\PolicyAcceptance;
+use Unsupervised\Schedular\Policy\PolicyRepository;
+use Unsupervised\Schedular\Policy\PolicyVersionRepository;
+
+/**
+ * Recording, after the fact, the intake answers and policy acceptances of a
+ * registration the studio made on a student's behalf — a lesson booked from the
+ * Scheduler, a student added straight into a group class.
+ *
+ * Such a registration has neither: nobody was at a keyboard to answer the
+ * questions or tick the boxes, and staff doing it *for* the student at the time
+ * would be an audit trail that says something untrue. The answers are instead
+ * collected some other way — a paper form, a phone call — and typed in here, each
+ * row stamped with how it was obtained ({@see IntakeProvenance}), so a reader can
+ * always tell a student's own click from a studio's transcription.
+ *
+ * Two rules hold this honest:
+ *
+ * 1. **Only a staff-made registration qualifies**
+ *    ({@see IntakeSubject::isStaffRegistered()}). One the student made already
+ *    has their real answers, and letting staff add more would let the record be
+ *    edited after the fact.
+ * 2. **Only what is still missing can be recorded.** Answers and acceptances are
+ *    written once and never overwritten, so a second submission cannot quietly
+ *    replace what a student actually said.
+ */
+class IntakeRecording {
+
+	public function __construct(
+		private QuestionRepository $questions,
+		private AnswerRepository $answers,
+		private PolicyRepository $policies,
+		private PolicyVersionRepository $versions,
+		private AcceptanceRepository $acceptances,
+		private RegistrationGate $gate,
+	) {}
+
+	/**
+	 * What is still unrecorded for this registration: the intake questions with no
+	 * answer, and the current policy versions with no acceptance. An empty pair
+	 * means there is nothing left to collect and the form has nothing to show.
+	 *
+	 * @return array{questions: list<array{id: int, label: string, required: bool}>, policies: list<array{version_id: int, policy: string, version: string}>}
+	 */
+	public function pending( IntakeSubject $subject ): array {
+		$type           = $subject->intakeRegistrationType();
+		$registrationId = $subject->intakeRegistrationId();
+
+		$answered = array_map(
+			static fn( Answer $a ): int => $a->questionId,
+			$this->answers->findByRegistration( $type, $registrationId )
+		);
+
+		$accepted = array_map(
+			static fn( PolicyAcceptance $a ): int => $a->policyVersionId,
+			$this->acceptances->findByRegistration( $type, $registrationId )
+		);
+
+		$questions = [];
+		foreach ( $this->questions->findByOffering( $subject->intakeOfferingId(), true ) as $question ) {
+			if ( in_array( (int) $question->id, $answered, true ) ) {
+				continue;
+			}
+
+			$questions[] = [
+				'id'       => (int) $question->id,
+				'label'    => $question->label,
+				'required' => $this->isRequiredOf( $question ),
+			];
+		}
+
+		$policies = [];
+		foreach ( $this->gate->requiredPolicyVersionIds() as $versionId ) {
+			if ( in_array( $versionId, $accepted, true ) ) {
+				continue;
+			}
+
+			$version = $this->versions->findById( $versionId );
+			$policy  = null !== $version ? $this->policies->findById( $version->policyId ) : null;
+
+			$policies[] = [
+				'version_id' => $versionId,
+				'policy'     => null !== $policy ? $policy->title : sprintf( '#%d', $versionId ),
+				'version'    => null !== $version ? sprintf( 'v%d', $version->versionNumber ) : '—',
+			];
+		}
+
+		return [
+			'questions' => $questions,
+			'policies'  => $policies,
+		];
+	}
+
+	/**
+	 * Record what the studio collected elsewhere, returning the notice to show.
+	 *
+	 * Submitted answers and acceptances are narrowed to what is actually still
+	 * pending before anything is written, so a stale form — reloaded, or posted
+	 * twice — can neither duplicate a row nor overwrite one.
+	 *
+	 * @param array<int, string> $answers    question_id => answer value
+	 * @param list<int>          $versionIds Policy version ids being accepted
+	 *
+	 * @return string|\WP_Error
+	 */
+	public function record( IntakeSubject $subject, array $answers, array $versionIds, string $collectedVia, string $collectedNote, int $recordedBy ): string|\WP_Error {
+		if ( ! $subject->isStaffRegistered() ) {
+			return new \WP_Error(
+				'not_recordable',
+				__( 'Intake can only be recorded for a registration the studio made on the student\'s behalf.', 'unsupervised-schedular' )
+			);
+		}
+
+		$provenance = IntakeProvenance::fromInput( $collectedVia, $collectedNote, $recordedBy );
+		if ( $provenance instanceof \WP_Error ) {
+			return $provenance;
+		}
+
+		$pending = $this->pending( $subject );
+
+		$pendingQuestionIds = array_map( static fn( array $q ): int => $q['id'], $pending['questions'] );
+		$pendingVersionIds  = array_map( static fn( array $p ): int => $p['version_id'], $pending['policies'] );
+
+		$newAnswers = [];
+		foreach ( $answers as $questionId => $value ) {
+			$value = trim( $value );
+			if ( '' !== $value && in_array( (int) $questionId, $pendingQuestionIds, true ) ) {
+				$newAnswers[ (int) $questionId ] = $value;
+			}
+		}
+
+		$newVersionIds = array_values( array_intersect( $versionIds, $pendingVersionIds ) );
+
+		if ( [] === $newAnswers && [] === $newVersionIds ) {
+			return new \WP_Error( 'nothing_to_record', __( 'Nothing was filled in to record.', 'unsupervised-schedular' ) );
+		}
+
+		// No IP address is passed: the student was not at a browser, and borrowing
+		// the staff member's would put a false location in the audit trail. Nor is
+		// an acceptor — the student agreed, on paper or over the phone; who typed it
+		// in is `recorded_by`, which the provenance carries.
+		$this->gate->record(
+			$subject->intakeRegistrationType(),
+			$subject->intakeRegistrationId(),
+			$subject->intakeStudentId(),
+			$subject->intakeOfferingId(),
+			$newAnswers,
+			$newVersionIds,
+			null,
+			0,
+			$provenance
+		);
+
+		return $this->notice( count( $newAnswers ), count( $newVersionIds ), $provenance );
+	}
+
+	/** What was written, and how it was said to have been collected. */
+	private function notice( int $answers, int $acceptances, IntakeProvenance $provenance ): string {
+		$parts = [];
+
+		if ( $answers > 0 ) {
+			/* translators: %d: number of intake answers recorded. */
+			$parts[] = sprintf( _n( '%d answer', '%d answers', $answers, 'unsupervised-schedular' ), $answers );
+		}
+
+		if ( $acceptances > 0 ) {
+			/* translators: %d: number of policy acceptances recorded. */
+			$parts[] = sprintf( _n( '%d policy acceptance', '%d policy acceptances', $acceptances, 'unsupervised-schedular' ), $acceptances );
+		}
+
+		return sprintf(
+			/* translators: 1: what was recorded, e.g. "2 answers and 1 policy acceptance", 2: how they were collected. */
+			__( 'Recorded %1$s, collected: %2$s', 'unsupervised-schedular' ),
+			implode( __( ' and ', 'unsupervised-schedular' ), $parts ),
+			IntakeProvenance::describe( $provenance->collectedVia, $provenance->collectedNote )
+		);
+	}
+
+	/**
+	 * Whether the question is one the booking form would have insisted on, of
+	 * either audience. It is shown as a hint only — a studio that has half the
+	 * answers should be able to record the half it has, rather than being made to
+	 * invent the rest to get the form to submit.
+	 */
+	private function isRequiredOf( Question $question ): bool {
+		return $question->isRequired || $question->isRequiredChild;
+	}
+}

src/Registration/IntakeSubject.php

@@ -0,0 +1,49 @@
+<?php
+declare(strict_types=1);
+
+namespace Unsupervised\Schedular\Registration;
+
+/**
+ * A registration that intake answers and policy acceptances hang off: a booked
+ * lesson, or a group-class enrolment.
+ *
+ * The two are different enough to keep their own tables and their own booking
+ * flows, but identical in this one respect — somebody registered, questions were
+ * (or were not) answered, policies were (or were not) agreed to — and the rules
+ * for reading and recording that are not worth writing twice. Everything about
+ * intake works against this interface rather than either model.
+ *
+ * The `intake` prefix is not decoration: both implementations already carry
+ * `$studentId` and `$offeringId` properties, and PHP 8.1 has no way to declare a
+ * property on an interface, so the accessors need names of their own.
+ */
+interface IntakeSubject {
+
+	/**
+	 * Which polymorphic registration table this is — `Answer::REG_LESSON` or
+	 * `Answer::REG_ENROLLMENT`, matching the acceptance constants of the same
+	 * names.
+	 */
+	public function intakeRegistrationType(): string;
+
+	/**
+	 * The id answers and acceptances are stored against. Not always the row's own
+	 * id: a weekly lesson series is answered for once, against its anchor, so
+	 * every occurrence reads and writes the same registration.
+	 */
+	public function intakeRegistrationId(): int;
+
+	/** The offering whose questions apply. */
+	public function intakeOfferingId(): int;
+
+	/** Who the answers and acceptances belong to. */
+	public function intakeStudentId(): int;
+
+	/**
+	 * Whether the studio registered this on the student's behalf, rather than the
+	 * student (or their guardian) doing it themselves. Only these can have their
+	 * intake recorded after the fact: one the student made already holds their own
+	 * answers, and adding to those would make the record editable after the event.
+	 */
+	public function isStaffRegistered(): bool;
+}

src/Registration/Question.php

@@ -21,6 +21,16 @@ class Question {
 	/** Question is studio-wide, asked once at account signup (no offering). */
 	public const SCOPE_ACCOUNT = 'account';
 
+	/** Asked of everyone: the account holder as a student, and each student they register. */
+	public const AUDIENCE_ALL = 'all';
+
+	/**
+	 * Asked only of the students someone registers on behalf of — never of the
+	 * account holder's own "About you" panel. For the questions that only make
+	 * sense about a child ("school and grade", "who may collect them").
+	 */
+	public const AUDIENCE_CHILD = 'child';
+
 	/**
 	 * All valid field types.
 	 *
@@ -43,9 +53,29 @@ class Question {
 		self::SCOPE_ACCOUNT,
 	];
 
+	/**
+	 * All valid audiences.
+	 *
+	 * @var list<string>
+	 */
+	public const VALID_AUDIENCES = [
+		self::AUDIENCE_ALL,
+		self::AUDIENCE_CHILD,
+	];
+
 	/**
 	 * Build an intake question value object.
 	 *
+	 * `$isRequired` and `$isRequiredChild` are deliberately separate: a studio may
+	 * want an answer from every student it enrols without demanding the same of an
+	 * adult signing themselves up. Read them through {@see isRequiredForSelf()} and
+	 * {@see isRequiredForChild()} rather than directly, so the audience is applied
+	 * with them.
+	 *
+	 * Both `$audience` and `$isRequiredChild` are meaningless for offering scope,
+	 * where a booking asks its questions once about the student being booked and
+	 * there is no separate account-holder form to differ from.
+	 *
 	 * @param int|null          $offeringId The owning offering, or null for account-scoped questions.
 	 * @param list<string>|null $options    Choices for a `select` field.
 	 */
@@ -58,9 +88,36 @@ class Question {
 		public readonly int $sortOrder = 0,
 		public readonly bool $isActive = true,
 		public readonly string $scope = self::SCOPE_OFFERING,
+		public readonly string $audience = self::AUDIENCE_ALL,
+		public readonly bool $isRequiredChild = false,
 		public readonly ?int $id = null,
 	) {}
 
+	/**
+	 * Whether the account holder is asked this question in their own right — true
+	 * for everything except a child-audience question.
+	 */
+	public function askedOfSelf(): bool {
+		return self::AUDIENCE_CHILD !== $this->audience;
+	}
+
+	/**
+	 * Whether the account holder must answer before the form will submit. A
+	 * child-audience question never reaches them, so it can never block them.
+	 */
+	public function isRequiredForSelf(): bool {
+		return $this->isRequired && $this->askedOfSelf();
+	}
+
+	/**
+	 * Whether each student being registered must answer before the form will
+	 * submit. Every question is asked in the student blocks whatever its audience,
+	 * so this stands on its own.
+	 */
+	public function isRequiredForChild(): bool {
+		return $this->isRequiredChild;
+	}
+
 	public static function fromRow( \stdClass $row ): self {
 		$options = null;
 		if ( null !== $row->options && '' !== $row->options ) {
@@ -70,16 +127,25 @@ class Question {
 				: null;
 		}
 
+		// `audience` and `is_required_child` arrived after the table did, so a row
+		// read on a site whose dbDelta has not run yet simply lacks them: the
+		// pre-existing behaviour (asked of everyone, required of nobody in
+		// particular) is the right reading of a question authored before the
+		// distinction existed.
+		$audience = Val::string( $row->audience ?? '' );
+
 		return new self(
-			offeringId: Val::intOrNull( $row->offering_id ),
-			label:      Val::string( $row->label ),
-			fieldType:  Val::string( $row->field_type ),
-			options:    $options,
-			isRequired: Val::bool( $row->is_required ),
-			sortOrder:  Val::int( $row->sort_order ),
-			isActive:   Val::bool( $row->is_active ),
-			scope:      Val::string( $row->scope ),
-			id:         Val::int( $row->id ),
+			offeringId:      Val::intOrNull( $row->offering_id ),
+			label:           Val::string( $row->label ),
+			fieldType:       Val::string( $row->field_type ),
+			options:         $options,
+			isRequired:      Val::bool( $row->is_required ),
+			sortOrder:       Val::int( $row->sort_order ),
+			isActive:        Val::bool( $row->is_active ),
+			scope:           Val::string( $row->scope ),
+			audience:        in_array( $audience, self::VALID_AUDIENCES, true ) ? $audience : self::AUDIENCE_ALL,
+			isRequiredChild: Val::bool( $row->is_required_child ?? false ),
+			id:              Val::int( $row->id ),
 		);
 	}
 
@@ -90,15 +156,17 @@ class Question {
 	 */
 	public function toArray(): array {
 		return [
-			'id'          => $this->id,
-			'offering_id' => $this->offeringId,
-			'scope'       => $this->scope,
-			'label'       => $this->label,
-			'field_type'  => $this->fieldType,
-			'options'     => $this->options,
-			'is_required' => $this->isRequired,
-			'sort_order'  => $this->sortOrder,
-			'is_active'   => $this->isActive,
+			'id'                => $this->id,
+			'offering_id'       => $this->offeringId,
+			'scope'             => $this->scope,
+			'label'             => $this->label,
+			'field_type'        => $this->fieldType,
+			'options'           => $this->options,
+			'audience'          => $this->audience,
+			'is_required'       => $this->isRequired,
+			'is_required_child' => $this->isRequiredChild,
+			'sort_order'        => $this->sortOrder,
+			'is_active'         => $this->isActive,
 		];
 	}
 }

src/Registration/QuestionController.php

@@ -89,15 +89,25 @@ class QuestionController {
 			return;
 		}
 
+		// Audience and the students' own required-ness are asked for on the
+		// account-scope form only; an offering's questions are answered once about
+		// the student being booked, so there is no second audience to differ from.
+		// An offering question therefore mirrors its single "required" into both
+		// columns rather than storing a distinction it does not have.
+		$accountScope = null === $offering;
+		$audience     = sanitize_key( Val::string( wp_unslash( $_POST['audience'] ?? '' ) ) );
+
 		$this->questions->insert(
 			new Question(
-				offeringId: null === $offering ? null : (int) $offering->id,
-				label:      $label,
-				fieldType:  $fieldType,
-				options:    $this->parseOptions( sanitize_textarea_field( Val::string( wp_unslash( $_POST['options'] ?? '' ) ) ) ),
-				isRequired: isset( $_POST['is_required'] ),
-				sortOrder:  absint( Val::int( $_POST['sort_order'] ?? 0 ) ),
-				scope:      null === $offering ? Question::SCOPE_ACCOUNT : Question::SCOPE_OFFERING,
+				offeringId:      $accountScope ? null : (int) $offering->id,
+				label:           $label,
+				fieldType:       $fieldType,
+				options:         $this->parseOptions( sanitize_textarea_field( Val::string( wp_unslash( $_POST['options'] ?? '' ) ) ) ),
+				isRequired:      isset( $_POST['is_required'] ),
+				sortOrder:       absint( Val::int( $_POST['sort_order'] ?? 0 ) ),
+				scope:           $accountScope ? Question::SCOPE_ACCOUNT : Question::SCOPE_OFFERING,
+				audience:        $accountScope && in_array( $audience, Question::VALID_AUDIENCES, true ) ? $audience : Question::AUDIENCE_ALL,
+				isRequiredChild: $accountScope ? isset( $_POST['is_required_child'] ) : isset( $_POST['is_required'] ),
 			)
 		);
 		// phpcs:enable WordPress.Security.NonceVerification.Missing

src/Registration/QuestionEndpoint.php

@@ -88,14 +88,21 @@ class QuestionEndpoint {
 			return $this->invalid( __( 'Invalid field type.', 'unsupervised-schedular' ) );
 		}
 
+		$isRequired = (bool) $request->get_param( 'is_required' );
+
 		$question = new Question(
-			offeringId: $offeringId,
-			label:      $label,
-			fieldType:  $fieldType,
-			options:    $this->sanitizeOptions( $request->get_param( 'options' ) ),
-			isRequired: (bool) $request->get_param( 'is_required' ),
-			sortOrder:  Val::int( $request->get_param( 'sort_order' ) ),
-			isActive:   null === $request->get_param( 'is_active' ) ? true : (bool) $request->get_param( 'is_active' ),
+			offeringId:      $offeringId,
+			label:           $label,
+			fieldType:       $fieldType,
+			options:         $this->sanitizeOptions( $request->get_param( 'options' ) ),
+			isRequired:      $isRequired,
+			sortOrder:       Val::int( $request->get_param( 'sort_order' ) ),
+			isActive:        null === $request->get_param( 'is_active' ) ? true : (bool) $request->get_param( 'is_active' ),
+			// An offering asks its questions once, about the student being booked,
+			// so there is no second audience to differ from: the single "required"
+			// stands for both, the same way the upgrade backfill left every
+			// question authored before the two could differ.
+			isRequiredChild: $isRequired,
 		);
 
 		$id = $this->questions->insert( $question );
@@ -129,16 +136,23 @@ class QuestionEndpoint {
 			return $this->invalid( $this->tooLongMessage( __( 'question', 'unsupervised-schedular' ), Question::MAX_LABEL_LENGTH ) );
 		}
 
+		// Only offering-scope questions reach here — an account-scope one has no
+		// offering to own it and is turned away as not found above — so the same
+		// single "required" applies to everyone asked. See create().
+		$isRequired = $request->has_param( 'is_required' ) ? (bool) $request->get_param( 'is_required' ) : $existing->isRequired;
+
 		$question = new Question(
-			offeringId: $existing->offeringId,
-			label:      $label,
-			fieldType:  $fieldType,
-			options:    $request->has_param( 'options' ) ? $this->sanitizeOptions( $request->get_param( 'options' ) ) : $existing->options,
-			isRequired: $request->has_param( 'is_required' ) ? (bool) $request->get_param( 'is_required' ) : $existing->isRequired,
-			sortOrder:  $request->has_param( 'sort_order' ) ? Val::int( $request->get_param( 'sort_order' ) ) : $existing->sortOrder,
-			isActive:   $request->has_param( 'is_active' ) ? (bool) $request->get_param( 'is_active' ) : $existing->isActive,
-			scope:      $existing->scope,
-			id:         $id,
+			offeringId:      $existing->offeringId,
+			label:           $label,
+			fieldType:       $fieldType,
+			options:         $request->has_param( 'options' ) ? $this->sanitizeOptions( $request->get_param( 'options' ) ) : $existing->options,
+			isRequired:      $isRequired,
+			sortOrder:       $request->has_param( 'sort_order' ) ? Val::int( $request->get_param( 'sort_order' ) ) : $existing->sortOrder,
+			isActive:        $request->has_param( 'is_active' ) ? (bool) $request->get_param( 'is_active' ) : $existing->isActive,
+			scope:           $existing->scope,
+			audience:        $existing->audience,
+			isRequiredChild: $isRequired,
+			id:              $id,
 		);
 
 		$this->questions->update( $id, $question );

src/Registration/QuestionField.php

@@ -0,0 +1,67 @@
+<?php
+declare(strict_types=1);
+
+namespace Unsupervised\Schedular\Registration;
+
+/**
+ * Renders one registration question as a form field. Shared by the signup form
+ * and the guardian's family screen, which ask the same account-scope questions —
+ * once per guardian at signup, and once per child either way.
+ */
+class QuestionField {
+
+	/**
+	 * The field's markup, escaped and ready to echo.
+	 *
+	 * `$name` is the full input name (e.g. `us_answers[7]`), and `$id` the DOM id
+	 * the label points at — both supplied by the caller so the same question can
+	 * appear more than once on a page (one block per child) without colliding.
+	 *
+	 * `$enforceRequired` false keeps the required marker in the label but drops
+	 * the HTML attribute, for a block the browser must not block submission on
+	 * because it may not apply at all — the child blocks, which only count when
+	 * the parent/guardian box is ticked. The server validates those either way.
+	 *
+	 * `$isRequired` overrides which of the question's two required flags applies
+	 * here — a question can be optional for the account holder and required for
+	 * each student they register, and only the caller knows which block this is.
+	 * Null falls back to the question's own {@see Question::$isRequired}.
+	 */
+	public static function render( Question $question, string $name, string $id, bool $enforceRequired = true, ?bool $isRequired = null ): string {
+		$mustAnswer = $isRequired ?? $question->isRequired;
+		$required   = $mustAnswer && $enforceRequired ? ' required' : '';
+
+		$label = '<label for="' . esc_attr( $id ) . '">' . esc_html( $question->label )
+			. ( $mustAnswer ? ' <span class="us-required" aria-hidden="true">*</span>' : '' )
+			. '</label>';
+
+		return '<p>' . $label . self::input( $question, $name, $id, $required ) . '</p>';
+	}
+
+	/**
+	 * The input element itself, chosen by the question's field type. `$required`
+	 * is a literal attribute string (' required' or ''), not user input.
+	 */
+	private static function input( Question $question, string $name, string $id, string $required ): string {
+		$common = ' name="' . esc_attr( $name ) . '" id="' . esc_attr( $id ) . '"' . $required;
+
+		if ( Question::FIELD_TEXTAREA === $question->fieldType ) {
+			return '<textarea' . $common . ' rows="4"></textarea>';
+		}
+
+		if ( Question::FIELD_SELECT === $question->fieldType ) {
+			$options = '<option value="">' . esc_html__( '— Select —', 'unsupervised-schedular' ) . '</option>';
+			foreach ( (array) $question->options as $option ) {
+				$options .= '<option value="' . esc_attr( (string) $option ) . '">' . esc_html( (string) $option ) . '</option>';
+			}
+
+			return '<select' . $common . '>' . $options . '</select>';
+		}
+
+		if ( Question::FIELD_CHECKBOX === $question->fieldType ) {
+			return '<input type="checkbox"' . $common . ' value="1">';
+		}
+
+		return '<input type="text"' . $common . '>';
+	}
+}