Merge pull request 'Fix two duplicate-charge bugs in scheduled billing' (#201) from fix/duplicate-payment-due-notice into main

Reviewed-on: #201
Reviewed-by: James Griffin-Allwood <[email protected]>

.claude/settings.local.json

@@ -1,12 +0,0 @@
-{
-  "permissions": {
-    "allow": [
-      "Bash(composer test:*)",
-      "Bash(composer lint *)",
-      "Bash(tea actions:*)",
-      "Bash(tea issue *)",
-      "Bash(tea label *)",
-      "Bash(composer cs *)"
-    ]
-  }
-}

.gitea/workflows/release.yml

@@ -149,6 +149,50 @@ jobs:
             { print }
           ' CHANGELOG.md > CHANGELOG.md.tmp && mv CHANGELOG.md.tmp CHANGELOG.md
 
+      # main requires signed commits, and Gitea refuses to merge a pull request
+      # that carries an unsigned one. The key Gitea signs merge commits with
+      # lives on the server and is not reachable from a runner, so the bump
+      # commit is signed here with a dedicated release-bot key that the instance
+      # trusts via TRUSTED_SSH_KEYS. Generating that key, trusting it and storing
+      # the secret is documented in docs/ci.md.
+      - name: Configure signing as Release Bot
+        env:
+          SIGNING_KEY: ${{ secrets.RELEASE_BOT_SIGNING_KEY }}
+        run: |
+          if [ -z "${SIGNING_KEY}" ]; then
+            echo "RELEASE_BOT_SIGNING_KEY is not set - the bump commit would be unsigned and unmergeable." >&2
+            exit 1
+          fi
+          if ! command -v ssh-keygen > /dev/null; then
+            echo "ssh-keygen is missing from the runner image; git cannot make SSH signatures without it." >&2
+            exit 1
+          fi
+
+          # The secret holds an OpenSSH private key ("-----BEGIN OPENSSH PRIVATE
+          # KEY-----"). git signs by shelling out to ssh-keygen, which wants that
+          # key on disk next to the .pub it is pointed at, readable only by us,
+          # and rejects it unless the final newline survived the round trip.
+          keydir="${RUNNER_TEMP:-${TMPDIR:-/tmp}}/release-bot-signing"
+          install -m 700 -d "${keydir}"
+          printf '%s\n' "${SIGNING_KEY}" | tr -d '\r' > "${keydir}/key"
+          chmod 600 "${keydir}/key"
+          # Doubles as a format check: a truncated or re-wrapped key fails here,
+          # with a clearer cause than "gpg failed to sign the data" later on.
+          if ! ssh-keygen -y -f "${keydir}/key" < /dev/null > "${keydir}/key.pub"; then
+            echo "RELEASE_BOT_SIGNING_KEY is not a usable OpenSSH private key (passphrase-protected, truncated, or re-wrapped on paste)." >&2
+            exit 1
+          fi
+
+          # No Gitea account backs this address; TRUSTED_SSH_KEYS verifies the
+          # signature without an account lookup, so it is a label, not an identity.
+          git config user.name 'Release Bot'
+          git config user.email '[email protected]'
+          # Named gpg.format for historical reasons; "ssh" is what switches git
+          # over to signing with the SSH key above rather than a GPG key.
+          git config gpg.format ssh
+          git config user.signingkey "${keydir}/key.pub"
+          git config commit.gpgsign true
+
       - name: Open pull request
         env:
           TOKEN: ${{ secrets.GITHUB_TOKEN }}
@@ -157,10 +201,14 @@ jobs:
           branch="release/bump-${next}"
           api="${GITHUB_SERVER_URL}/api/v1/repos/${GITHUB_REPOSITORY}"
 
-          git config user.name 'Release Bot'
-          git config user.email '[email protected]'
           git checkout -b "${branch}"
           git commit -am "Bump version to ${next} and open changelog section"
+          # A commit that came out unsigned would otherwise go unnoticed until
+          # someone tried to merge the PR, so fail here instead.
+          if ! git cat-file commit HEAD | grep -q '^gpgsig'; then
+            echo "Bump commit is unsigned; refusing to push it." >&2
+            exit 1
+          fi
           git push origin "${branch}"
 
           curl -fsS -X POST "${api}/pulls" \

AGENTS.md

@@ -0,0 +1,47 @@
+# AGENTS.md
+
+## Commands
+
+```bash
+composer install
+composer test                     # PHPUnit — run after every code change
+composer lint                     # PHPStan (level 10, `src/` only)
+composer cs                       # PHPCS (WordPress standard + exclusions in phpcs.xml.dist)
+composer cs:fix                   # auto-fix coding standards
+composer build                    # -> dist/unsupervised-schedular-<version>.zip
+
+./vendor/bin/phpunit tests/Unit/Offering/OfferingRepositoryTest.php
+./vendor/bin/phpunit --filter testInsertReturnsId
+```
+
+CI (`.gitea/workflows/ci.yml`): `phpcs`, `phpstan`, `test` (PHP 8.1/8.2/8.3/8.5), `no-debug`. Write only PHP 8.1-compatible syntax. No `var_dump|var_export|print_r|error_log|dd|dump(` in `src/` — CI greps and fails.
+
+## Architecture
+
+- WordPress plugin, no front-end build (vanilla JS/CSS in `assets/`). PSR-4 `Unsupervised\Schedular\` -> `src/`.
+- **Package-by-domain:** `src/<Domain>/` (Auth, Availability, Booking, GroupClass, Guardian, Offering, Payment, Policy, Registration) owns its repos, services, endpoints, pages. Cross-cutting wiring lives directly in `src/`: `Plugin`, `Installer`, `Schema`, `AdminMenu`, `RestRegistrar`, `ShortcodeRegistrar`, `BlockRegistrar`, `Val`.
+- Entry: `unsupervised-schedular.php` -> `Plugin::boot()` (wires all dependencies). **Slug is `schedular`, not `scheduler`** — filename, text domain (`unsupervised-schedular`), option `us_schedular_version`, table prefix `us_`. Never "fix" the spelling.
+- REST: `/wp-json/us-scheduler/v1/`, `permission_callback` uses capability checks, never role names.
+- DB: custom `us_*` tables via `dbDelta`; `Schema::tables()` is the source of truth. **All `$wpdb` access inside repository classes only.**
+- `src/Val.php` coerces untyped WP input (`Val::int()`, `Val::string()`, `...OrNull`, etc.). For PHPCS, `Val::int/float/bool/...` count as unslashing passthrough only — still wrap with a real sanitizer: `absint( Val::int( $_GET['id'] ?? 0 ) )`.
+
+## Schema changes (gotcha)
+
+- `Plugin::boot()` only re-runs `Installer`/migrations when stored `us_schedular_version !== USC_VERSION`. **Bump both the `Version:` header and `USC_VERSION` in `unsupervised-schedular.php` or the change never reaches existing sites.**
+- `dbDelta` does not reliably relax column NULL-ability. Follow the existing pattern in `Plugin::boot()`: repository repair method + own `us_*` option flag (e.g. `us_questions_offering_nullable`), not the version gate.
+
+## Tests
+
+- Brain Monkey + Mockery, no live WP. All test classes extend `tests/Unit/TestCase.php` (handles `Monkey\setUp/tearDown`, stubs translations/escaping/`checked`/`selected`).
+- Mirror layout: `tests/Unit/<Domain>/` mirrors `src/<Domain>/`.
+  - `Functions\when('fn')->alias(fn() => ...)` (never `returnUsing()`); `->justReturn($v)` for constants.
+  - Use `when()` not `expect()` for argument-dependent routing.
+  - No `\Mockery::type()` inside plain arrays passed to `with()` — use `\Mockery::on()` or `\Mockery::any()`.
+  - `$wpdb` mock needs `$mock->prefix = 'wp_'` as a property.
+
+## Adding a feature
+
+1. Spec first: `docs/features/<feature-name>.md` (data model, API, classes, test paths).
+2. Code in `src/<Domain>/`; templates in `templates/` if needed.
+3. Tests in `tests/Unit/<Domain>/`.
+4. `composer test` must pass (also `composer lint` + `composer cs` before finishing).

CHANGELOG.md

@@ -11,6 +11,25 @@ When a `v*` tag is pushed, `.gitea/workflows/release.yml` publishes the matching
 the plugin to the next patch version and adds a fresh section here for it. Record
 each change under the current top section as you work.
 
+## [1.5.8]
+
+### Fixed
+- **A student is no longer emailed the same "Payment due" notice twice.** The daily billing scan runs whenever the site gets traffic, and on a busy day two copies of it could end up running at the same time. Neither knew about the other, so each would send its own notice for the same charge — one payment on the books, but the family saw two identical requests to pay and reasonably read it as being billed twice. Each payment is now stamped the moment its notice goes out, and a second run that reaches the same payment sees the stamp and stays quiet, so exactly one notice is sent no matter how the scan is triggered. Payments already noticed before this update are marked as such on upgrade, so nobody gets a fresh round of reminders for charges they were already told about.
+- **Switching a group class to monthly billing no longer charges students who already paid up front a second time.** When a class was set up to be paid once at sign-up and later changed to bill monthly, the daily scan did not recognise the payment already taken at enrolment — it carried no billing month — and raised a fresh charge for the current month on top of it. Families who had already paid were billed again, sometimes for a month they had covered. Changing a class to monthly now marks each enrolled student's up-front payment as covering the current month, so the scan bills them from the following month on and never doubles up on the month already paid. (Enrolments made after the switch, and classes that were always monthly, were never affected.)
+
+## [1.5.7]
+
+## [1.5.6]
+
+### Security
+- **Signing in on the front end no longer hands out a session cookie that can travel over plain HTTP.** The studio's own login form told WordPress not to work out for itself whether the site was secure, and WordPress took that as "it is not" — so on an HTTPS site every student's session cookie was issued without the flag that keeps a browser from ever sending it unencrypted. Anyone able to watch the network and provoke a single `http://` request to the site could have lifted a signed-in session with it. The form now leaves that judgement to WordPress, which is what the standard login screen has always done. Nothing changes for you; existing sessions are unaffected.
+- **Plugin updates are now only accepted from the release server itself.** The update check asks the repository where to download the new version and used to take whatever answer came back. An answer that was not really the release server's — a hijacked hostname, a tampered response — could have pointed the site at any file on the internet, which WordPress would then have unpacked over the plugin. The download address must now be `https` on `git.unsupervised.ca` exactly; a lookalike, a subdomain, or an unencrypted address is refused and no update is offered. Ordinary updates are unaffected.
+- **A student can no longer tell a booking that is not theirs from one that does not exist.** Cancelling someone else's lesson was already refused, but the refusal was worded differently from "no such booking" — enough for a signed-in student to work through the numbers and learn how many lessons the studio holds. Both now answer identically. Withdrawing from a group class was the same and has had the same treatment.
+- **Students created by anything other than the studio's own signup form now wait for approval.** Turning on open registration switches on WordPress's site-wide "anyone can register" setting and makes Student the default role for new accounts — which is what the studio's registration page needs, but it also arms any *other* signup form the site happens to have. An account created that way arrived able to book and be billed immediately, with no email confirmed, no approval and no policies agreed to. Any student account that appears without going through the studio's own form is now held and listed under **Students → Pending Students**, exactly like a self-signup; it can sign in, but cannot book until you approve it. Students you add yourself from wp-admin, invited students, and the children a parent adds are all unaffected.
+
+### Added
+- **You can now decide what deleting the plugin takes with it, on Access → Plugin removal.** WordPress gives an uninstall nothing to ask you with, so the answer is given ahead of time. By default your records stay: delete the plugin and your lessons, enrolments, payments, credits, intake answers, policy agreements, invites and family links are still there when you reinstall, so a delete during a migration or a bit of troubleshooting costs you nothing. Ticking **Erase everything when the plugin is deleted** — which also asks you to type DELETE, because there is no undo — drops every table, setting and role the plugin made. Either way your Stripe secret key and webhook signing secret are now forgotten on deletion, where before they stayed in the database indefinitely: they take a minute to paste back in, and live keys on a site that no longer has the code to use them are worth nothing but risk. The two WordPress settings open registration borrows are put back as they were, too, so deleting the plugin can never leave the site quietly accepting signups into a role that no longer exists.
+
 ## [1.5.5]
 
 ### Changed

CLAUDE.md

@@ -1,31 +1,3 @@
 # CLAUDE.md
 
-This file provides guidance to Claude Code (claude.ai/code) when working with code in this repository.
-
-## Commands
-
-**Run `composer test` after every code change before considering a task complete.**
-
-## Architecture
-
-### Code organisation
-**Code is organised package-by-domain.** Each domain package under `src/<Domain>/` contains everything related to that domain: value objects, repositories, controllers, REST endpoints, and shortcode pages. Cross-cutting wiring classes (Plugin, AdminMenu, RestRegistrar, ShortcodeRegistrar, Schema) live directly under `src/`.
-
-### Data Storage
-Custom database tables are created via `dbDelta` on activation; `Schema.php` holds the SQL.
-
-All database access goes through repository classes within their domain package. No direct `$wpdb` calls outside repositories.
-
-### REST API Namespace
-All endpoints live under `/wp-json/us-scheduler/v1/`. Permissions are enforced via `permission_callback` using capability checks (`manage_availability`, `book_lesson`), never role name checks.
-
-### Testing Approach
-Tests stub WordPress with Brain\Monkey rather than booting a real WP install. The setup and the Brain\Monkey/Mockery API gotchas are in `tests/CLAUDE.md`.
-
-### Adding a Feature
-0. **If the feature touches `Schema.php`, bump both the `Version:` header and `USC_VERSION` in `unsupervised-schedular.php`.** `Plugin::boot()` only re-runs `Installer`/`dbDelta` when the stored `us_schedular_version` differs, so a schema change without a version bump never reaches existing sites and inserts into new columns fail silently.
-1. Write the feature doc in `docs/features/<feature-name>.md` (data model, API, classes, test paths).
-2. Create a domain package under `src/<Domain>/` containing all classes for that feature.
-3. Add template(s) under `templates/` if needed.
-4. Write unit tests under `tests/Unit/<Domain>/` mirroring the `src/<Domain>/` structure.
-5. Run `composer test` — all tests must pass before the feature is complete.
+See `AGENTS.md` — it is the single source of truth for working in this repo.

docs/ci.md

@@ -43,3 +43,59 @@ The Composer download cache lives at `/composer/cache` — `COMPOSER_HOME` is
 The image has to exist first. Add the version to the `php` matrix in
 `ci-php`'s `.gitea/workflows/publish.yml` and merge, then add it to the `test`
 matrix in `.gitea/workflows/ci.yml` here.
+
+## Signing the version bump commit
+
+`main` is a protected branch that requires signed commits, and Gitea will not
+merge a pull request containing an unsigned one. The `bump-version` job in
+`release.yml` therefore signs the commit it makes, using a dedicated
+`release-bot` SSH key rather than the key Gitea signs merge commits with —
+that one is `[repository.signing] SIGNING_KEY` on the server and no runner can
+reach it. Keeping the CI key separate also means it can be rotated on its own
+if the secret ever leaks.
+
+There is deliberately no `release-bot` Gitea account. A key attached to an
+account is only consulted for signature checking after it has been through the
+web *Verify* flow, and that flow has no API — a bot account would need an
+interactive login to be worth anything. Listing the key under
+`TRUSTED_SSH_KEYS` instead makes Gitea verify commits signed with it without
+any account lookup, which is all the protected branch asks for.
+
+Set up once for the instance, and again only if the key is rotated:
+
+1. Generate a passphrase-less key (it has to be usable unattended):
+
+   ```
+   ssh-keygen -t ed25519 -C 'release-bot@unsupervised.ca' -f release-bot -N ''
+   ```
+
+2. Add the public half to `app.ini` and restart Gitea:
+
+   ```ini
+   [repository.signing]
+   TRUSTED_SSH_KEYS = ssh-ed25519 AAAAC3Nza... release-bot@unsupervised.ca
+   ```
+
+3. Store the private half as the **organisation** Actions secret
+   `RELEASE_BOT_SIGNING_KEY` (Org → Settings → Actions → Secrets): the whole
+   `release-bot` file verbatim, `-----BEGIN OPENSSH PRIVATE KEY-----` header
+   and footer included — not the `.pub`, and not a GPG export. Organisation
+   secrets are readable as `secrets.RELEASE_BOT_SIGNING_KEY` from every
+   repository in the org, so no repository-level copy is needed. Delete both
+   local files afterwards.
+
+Two consequences of trusting the key instance-wide are worth knowing. Any
+commit signed with it verifies in *every* repository on the instance, not just
+these — the trust is in the key, not in a user with permissions you can scope.
+And the signature is attributed to `SIGNING_NAME` / `SIGNING_EMAIL`, not to the
+`Release Bot <[email protected]>` committer the job sets; that
+address backs no account and is only a label.
+
+The job fails fast if the secret is missing or `ssh-keygen` is absent from the
+runner image, and it re-reads the commit it just made to confirm a signature
+is attached before pushing — an unsigned bump commit would otherwise look fine
+until someone tried to merge the PR.
+
+Nothing else in the pipeline signs anything: release tags are made by a human
+through Gitea's release UI, and the merge commit is signed by the server when
+the PR is merged.

docs/features/account-registration.md

@@ -42,6 +42,34 @@ never be used to create a policy-less account (`Auth\EmailConfirmationHandler`):
 - `login_init` action redirects any `action=register` request (GET **and** POST) to the registration page before any processing runs.
 - `registration_errors` filter is a fail-safe that rejects `register_new_user()` outright.
 
+### Holding signups that came from somewhere else
+Blocking core's own form is not the whole story. `users_can_register=1` and
+`default_role=us_student` are *site-wide* settings, so they also arm every other
+route into `wp_insert_user()` a site happens to have — another plugin's signup
+form, a membership add-on. An account minted that way arrives holding
+`book_lesson`, with no email confirmed, no studio approval and no policy
+acceptance on file, and could book and be billed immediately.
+
+So the pending state is not decided by whichever form created the account. It is
+decided once, on `user_register`, by
+`Auth\RegistrationLoginGate::holdUnknownSignup()`:
+
+| New account | Result |
+|---|---|
+| Not a `us_student` | untouched — instructors and everyone else are not this feature's business |
+| Created by someone holding `manage_students` (including an admin adding a user in wp-admin) | left active — a deliberate act by someone who could approve it in the next click |
+| Anything else | **held** via `RegistrationStatus::hold()` and queued under **Pending Students** |
+
+A hold sets `us_awaiting_approval=1` *and* `us_email_confirmed=1`. The account was
+never asked to confirm anything and has no token to answer with, so blocking its
+login would strand it; what the hold withholds is `book_lesson`, until a studio
+admin approves it.
+
+The plugin's own paths all land in the last row and then say what they meant:
+- a self-signup calls `RegistrationStatus::markPending()`, which replaces the hold with a real, unconfirmed pending state (it clears `us_email_confirmed` explicitly for exactly this reason);
+- an invited student is approved outright by `RegistrationPage` before the auto-login — the invitation *is* the approval;
+- a guardian's child is approved outright by `GuardianService::createChild()`; the account is never signed in to, and queueing every child a family adds would be nonsense.
+
 ## Account Lifecycle (self-approval)
 State lives entirely in user meta (`Auth\RegistrationStatus`). Only the raw
 confirmation token's SHA-256 hash is stored; the token expires after 48h
@@ -198,7 +226,7 @@ No-op when no registration page is set.
 - Repository: `Unsupervised\Schedular\Auth\InviteRepository`
 - Admin controllers: `Unsupervised\Schedular\Auth\RegistrationController` (invites), `Unsupervised\Schedular\Auth\RegistrationApprovalController` (pending students)
 - Frontend: `Unsupervised\Schedular\Auth\RegistrationPage`
-- Self-approval flow: `Auth\RegistrationStatus` (lifecycle meta), `Auth\RegistrationLoginGate` (login + booking-cap gate), `Auth\EmailConfirmationHandler` (confirm link + native-form block), `Auth\RegistrationMailer` (emails)
+- Self-approval flow: `Auth\RegistrationStatus` (lifecycle meta, including `hold()`), `Auth\RegistrationLoginGate` (login gate, booking-cap gate, and the `user_register` hold), `Auth\EmailConfirmationHandler` (confirm link + native-form block), `Auth\RegistrationMailer` (emails)
 - Settings toggle: `Payment\StudioSettings` (`us_registration_mode`, core-option mirror/restore)
 - Reuses `Policy\PolicyRepository`, `Policy\PolicyVersionRepository`, `Policy\AcceptanceRepository`
 - Schema: `us_invites`; `us_policies.acceptance_scope`. Self-approval adds no tables — state is WordPress user meta.

docs/features/data-removal.md

@@ -0,0 +1,79 @@
+# Feature: Data Removal
+
+## Overview
+What deleting the plugin takes with it, and how the site owner says so.
+
+WordPress gives an uninstall no interface of its own: `uninstall.php` runs
+headless, after the plugin is already gone from the screen, with no opportunity
+to ask anything. So the answer is given in advance, on **Access → Plugin
+removal**, and read back at uninstall time.
+
+Two things are true at once, and the split below is how both are honoured:
+
+- **A studio's records are irreplaceable.** Lessons taught, payments taken, what
+  families agreed to and when. A delete during a migration, or a
+  delete-and-reinstall while troubleshooting, must not be the thing that loses
+  them. So the data is **kept unless the owner explicitly says otherwise**.
+- **Credentials are not records.** A Stripe secret and webhook signing key can be
+  re-pasted from the Stripe dashboard in under a minute. Live keys sitting in
+  `wp_options` on a site that no longer has the code to use them are nothing but
+  exposure. So those are **always** removed.
+
+## Option `us_delete_data_on_uninstall`
+`'1'` or `'0'` (default `'0'`). Written only from the Access page.
+
+## Always removed
+Whatever the setting says:
+
+| What | Why |
+|---|---|
+| `us_stripe_secret_key`, `us_stripe_webhook_secret`, `us_stripe_publishable_key`, `us_stripe_mode` | Credentials, not records — cheap to restore, dangerous to leave |
+| `us_schedular_latest_release` transient | Cached release metadata; meaningless without the plugin |
+| The `us_generate_due_payments` cron event | Deactivation clears it too, but a site whose plugin files simply vanished never ran that hook |
+| `users_can_register` / `default_role` | Restored from the snapshot open registration took (`us_registration_prev_*`). These are the *site's* settings, borrowed; leaving them behind would leave the site accepting public signups into a Student role that is about to stop existing. Only acts when a snapshot exists |
+
+## Removed only on an explicit full purge
+- Every table in `Schema::TABLES` — all 14, dropped by name.
+- Every remaining `us_*` option, including the removal setting itself.
+- Every `us_*` user meta key, for all users (`delete_metadata( 'user', 0, $key, '', true )`) — billing overrides, child markers, birth years, pending-signup state.
+- The `us_studio_admin`, `us_instructor` and `us_student` roles.
+
+Roles go **only** on a full purge. A site keeping its data is keeping its
+students, and a student whose role was deleted out from under them holds no
+capabilities at all until the plugin is reinstalled.
+
+`Schema::TABLES` is the single list of tables the plugin owns; the `CREATE TABLE`
+statements in `Schema::tables()` spell their own names out, so a new table has to
+be added in both places or uninstalling will leave it behind.
+
+## Admin Interface
+**Access → Plugin removal** (`manage_options` — the same capability as deleting a
+plugin, so the switch and the act it governs are in the same pair of hands):
+
+- A read-only note stating what is removed regardless.
+- **Erase everything when the plugin is deleted** — off by default.
+
+Turning it **on** takes the tick *and* the word `DELETE` typed into a confirmation
+box. It is the only place in the plugin where a stray click is unrecoverable, so
+the checkbox alone is not enough. A refused confirmation reports why and still
+saves everything else on the page — a mistyped word must not silently swallow a
+capability change made in the same submit.
+
+Turning it **off** needs nothing but unticking the box. Saving the page for some
+other reason while it is already on leaves it on, without asking for the word
+again.
+
+## Implementation
+- `Unsupervised\Schedular\Uninstaller` — the option, and the whole of `run()`
+- `uninstall.php` — guards on `WP_UNINSTALL_PLUGIN`, loads the autoloader, calls `Uninstaller::run()`
+- `Unsupervised\Schedular\Schema::TABLES` — the table list
+- `Unsupervised\Schedular\Auth\AccessSettings` — the setting's UI and the typed confirmation
+- `templates/admin/access.php`
+
+## Tests
+- `tests/Unit/UninstallerTest.php`
+- `tests/Unit/Auth/AccessSettingsTest.php` (the confirmation rules)
+
+## Related
+- `payments.md` — the Stripe credentials this always forgets
+- `account-registration.md` — the core options open registration borrows

docs/features/group-classes.md

@@ -136,10 +136,12 @@ Self-withdrawal is bounded by the class's **withdrawal deadline** (the instructo
 implicit default — a class with no deadline set stays open to withdrawal for its
 whole life. Past the deadline `POST /enrollments/{id}/withdraw` rejects the request
 with `403 withdrawal_closed`, and the class card shows "Withdrawal has closed —
-contact the studio to withdraw." in place of the Withdraw button. The endpoint also
-returns `404 not_found` for an unknown enrolment and `403 forbidden` when the
-enrolment is not the caller's own; a withdrawal of an already-cancelled enrolment is
-idempotent.
+contact the studio to withdraw." in place of the Withdraw button. An enrolment that
+does not exist and one that is not the caller's own both return the same
+`404 not_found`, deliberately: two different answers would let any signed-in student
+walk the id space and count the studio's enrolments, and there is nothing they could
+do with either answer. A withdrawal of an already-cancelled enrolment is idempotent.
+`POST /bookings/{id}/cancel` makes the same trade for the same reason.
 
 The deadline only bounds student **self**-withdrawal. A studio admin can withdraw a
 student at any time from the **student detail page** (`Auth\StudentActions::withdrawEnrollment`),

docs/features/plugin-self-update.md

@@ -47,9 +47,21 @@ update for a same-slug plugin and makes core fire the
    `us_schedular_latest_release` transient for 6 hours.
 3. Strips the leading `v` from the tag and compares against `USC_VERSION`
    with `version_compare`; PHP orders `1.0.0-rc.2 < 1.0.0` correctly.
-4. When newer, returns the release's first `.zip` asset as the update
-   package. Core takes over from there: Plugins-screen notice, one-click
-   update, and WP-Cron auto-updates if enabled.
+4. When newer, returns the release's first `.zip` asset **whose download URL
+   is `https` on `git.unsupervised.ca` itself** as the update package. Core
+   takes over from there: Plugins-screen notice, one-click update, and
+   WP-Cron auto-updates if enabled.
+
+   The host check is not ceremony. Whatever this returns is downloaded and
+   unpacked over the installed plugin, so the URL is executable code by
+   another name — and it arrives in a JSON body. An answer that is not really
+   the release server's (a hijacked hostname, a tampered response, a repo host
+   handing out a package hosted somewhere else) would otherwise install
+   arbitrary code on every site running the plugin, silently for anyone with
+   auto-updates on. The host must match exactly: `evil-git.unsupervised.ca`,
+   `git.unsupervised.ca.evil.test` and `cdn.git.unsupervised.ca` are all
+   refused, and so is plain `http`. An asset that fails the check is skipped
+   and the scan continues, so one bad asset does not hide a good one.
 5. When not newer — the site is current, or the lookup failed — returns a
    `no_update` payload (installed version, empty package). This keeps the
    plugin in core's `update_plugins` transient so core's `update-supported`

src/AdminMenu.php

@@ -25,6 +25,7 @@ use Unsupervised\Schedular\GroupClass\EnrollmentRepository;
 use Unsupervised\Schedular\GroupClass\GroupAccessRepository;
 use Unsupervised\Schedular\GroupClass\GroupClassController;
 use Unsupervised\Schedular\GroupClass\SessionSchedule;
+use Unsupervised\Schedular\Offering\BillingModeReconciler;
 use Unsupervised\Schedular\Offering\ClassSlotReconciler;
 use Unsupervised\Schedular\Offering\OfferingController;
 use Unsupervised\Schedular\Offering\OfferingRepository;
@@ -70,7 +71,7 @@ class AdminMenu {
 	private PaymentController $paymentController;
 	private PaymentReportController $paymentReportController;
 
-	public function __construct( AvailabilityRepository $availability, BookingRepository $bookings, OfferingRepository $offerings, QuestionRepository $questions, AnswerRepository $answers, PolicyRepository $policies, PolicyVersionRepository $policyVersions, PolicyService $policyService, AcceptanceRepository $acceptances, InviteRepository $invites, EnrollmentRepository $enrollments, GroupAccessRepository $groupAccess, StudioSettings $settings, PaymentRepository $payments, PaymentService $paymentService, BillingMethodResolver $resolver, RegistrationMailer $registrationMailer, CreditRepository $credits, GuardianService $guardians, LessonBooker $booker, RegistrationGate $gate ) {
+	public function __construct( AvailabilityRepository $availability, BookingRepository $bookings, OfferingRepository $offerings, QuestionRepository $questions, AnswerRepository $answers, PolicyRepository $policies, PolicyVersionRepository $policyVersions, PolicyService $policyService, AcceptanceRepository $acceptances, InviteRepository $invites, EnrollmentRepository $enrollments, GroupAccessRepository $groupAccess, StudioSettings $settings, PaymentRepository $payments, PaymentService $paymentService, BillingMethodResolver $resolver, RegistrationMailer $registrationMailer, CreditRepository $credits, GuardianService $guardians, LessonBooker $booker, RegistrationGate $gate, BillingModeReconciler $billingModeReconciler ) {
 		// One audit presenter and one recorder, shared by the lesson and enrolment
 		// detail views: intake is the same thing whichever registration it hangs off.
 		$intakeAudit     = new IntakeAudit( $answers, $questions, $acceptances, $policies, $policyVersions );
@@ -78,7 +79,7 @@ class AdminMenu {
 
 		$this->availabilityController         = new AvailabilityController( $availability, $offerings, new WindowValidator( $offerings ) );
 		$this->lessonController               = new LessonController( $bookings, $payments, $availability, $offerings, $intakeAudit, new AdminBooking( $availability, $offerings, $booker ), $intakeRecording );
-		$this->offeringController             = new OfferingController( $offerings, new ClassSlotReconciler( $availability ) );
+		$this->offeringController             = new OfferingController( $offerings, new ClassSlotReconciler( $availability ), $billingModeReconciler );
 		$this->questionController             = new QuestionController( $questions, $offerings );
 		$this->policyController               = new PolicyController( $policies, $policyVersions, $policyService );
 		$this->registrationController         = new RegistrationController( $invites );

src/Auth/AccessSettings.php

@@ -3,17 +3,24 @@ declare(strict_types=1);
 
 namespace Unsupervised\Schedular\Auth;
 
+use Unsupervised\Schedular\Uninstaller;
 use Unsupervised\Schedular\Val;
 
 /**
- * Site-owner toggles for whether WordPress administrators automatically receive
- * the studio-admin and/or instructor capabilities.
+ * The site owner's page: whether WordPress administrators automatically receive
+ * the studio-admin and/or instructor capabilities, and what deleting the plugin
+ * takes with it.
  *
- * Both default on, preserving the out-of-the-box experience where a single
- * administrator runs the studio and teaches from one account. The settings page
- * is gated on `manage_options` (the core WordPress administrator capability,
- * which the plugin never grants or revokes) so an administrator can always reach
- * it to re-enable a grant — disabling one can never lock them out.
+ * Both capability grants default on, preserving the out-of-the-box experience
+ * where a single administrator runs the studio and teaches from one account. The
+ * settings page is gated on `manage_options` (the core WordPress administrator
+ * capability, which the plugin never grants or revokes) so an administrator can
+ * always reach it to re-enable a grant — disabling one can never lock them out.
+ *
+ * The data-removal choice lives here for the same reason: `manage_options` is
+ * held by exactly the people who can delete a plugin, so the switch and the act
+ * it governs are in the same pair of hands. {@see Uninstaller} explains what the
+ * two answers mean.
  */
 class AccessSettings {
 
@@ -49,21 +56,56 @@ class AccessSettings {
 			wp_die( esc_html__( 'You do not have permission to manage access settings.', 'unsupervised-schedular' ) );
 		}
 
+		$error = '';
 		if ( isset( $_POST['usc_action'] ) && check_admin_referer( 'usc_access_action' ) ) {
-			$this->save();
+			$error = $this->save();
 		}
 
 		$adminsAreStudioAdmins = $this->adminsAreStudioAdmins();
 		$adminsAreInstructors  = $this->adminsAreInstructors();
+		$deleteDataOnUninstall = Uninstaller::deletesDataOnUninstall();
 
 		include USC_PLUGIN_DIR . 'templates/admin/access.php';
 	}
 
-	private function save(): void {
+	/**
+	 * Persist the submitted settings, reporting why the data-removal choice was
+	 * refused when it was. Everything else on the page saves either way: a
+	 * mistyped confirmation must not also swallow a capability change.
+	 */
+	private function save(): string {
 		// Nonce is verified by the caller (renderPage) before this method runs.
 		// phpcs:disable WordPress.Security.NonceVerification.Missing
 		update_option( self::OPT_GRANT_STUDIO, isset( $_POST['grant_studio'] ) ? '1' : '0' );
 		update_option( self::OPT_GRANT_INSTRUCTOR, isset( $_POST['grant_instructor'] ) ? '1' : '0' );
+
+		$wanted = isset( $_POST['delete_data'] );
+
+		// Switching it off is not the dangerous direction, and needs no ceremony.
+		if ( ! $wanted ) {
+			Uninstaller::setDeletesDataOnUninstall( false );
+
+			return '';
+		}
+
+		// Already on and left on: this save is about something else on the page,
+		// so do not make them retype the word to keep a setting they already made.
+		if ( Uninstaller::deletesDataOnUninstall() ) {
+			return '';
+		}
+
+		// Turning it on erases records that cannot be got back, so the tick alone
+		// is not enough — it is one stray click, and this is the only place in the
+		// plugin where a stray click is unrecoverable.
+		$confirmed = 'delete' === sanitize_key( Val::string( wp_unslash( $_POST['delete_data_confirm'] ?? '' ) ) );
 		// phpcs:enable WordPress.Security.NonceVerification.Missing
+
+		if ( ! $confirmed ) {
+			return __( 'Data removal was not enabled: type DELETE in the confirmation box to turn it on. Everything else on this page was saved.', 'unsupervised-schedular' );
+		}
+
+		Uninstaller::setDeletesDataOnUninstall( true );
+
+		return '';
 	}
 }

src/Auth/LoginPage.php

@@ -36,7 +36,12 @@ class LoginPage {
 				'remember'      => isset( $_POST['rememberme'] ),
 			];
 
-			$user = wp_signon( $credentials, false );
+			// The secure-cookie argument is deliberately left at its default. Only
+			// the empty string makes wp_signon() work it out from is_ssl(); passing
+			// an explicit false skips that and issues the plain, non-Secure auth
+			// cookie on an HTTPS site — a session that then leaks over the first
+			// http:// request to the domain.
+			$user = wp_signon( $credentials );
 
 			if ( is_wp_error( $user ) ) {
 				$error = esc_html__( 'Invalid username or password.', 'unsupervised-schedular' );

src/Auth/RegistrationLoginGate.php

@@ -11,12 +11,59 @@ namespace Unsupervised\Schedular\Auth;
  *
  * Both checks key solely off the pending user meta, so invite- and
  * admin-created students (which carry none of it) are unaffected.
+ *
+ * It also decides which new accounts land in that pending state to begin with —
+ * see {@see holdUnknownSignup()}, which closes the gap left by open registration
+ * turning the site's own `users_can_register` on.
  */
 class RegistrationLoginGate {
 
 	public function register(): void {
 		add_filter( 'wp_authenticate_user', [ $this, 'blockUnconfirmed' ], 10, 1 );
 		add_filter( 'user_has_cap', [ $this, 'withholdBookingWhilePending' ], 10, 4 );
+		add_action( 'user_register', [ $this, 'holdUnknownSignup' ], 10, 1 );
+	}
+
+	/**
+	 * Hold any student account created by an unauthenticated request that did not
+	 * come through the studio's own signup form.
+	 *
+	 * Enabling open registration switches the site's `users_can_register` on and
+	 * makes Student the default role for a new user, because that is what the
+	 * studio's registration page needs. But those are *site-wide* settings: they
+	 * also arm every other route into `wp_insert_user()` the site happens to have
+	 * — another plugin's signup form, a membership add-on — and an account minted
+	 * that way arrives holding `book_lesson`, with no email confirmed, no studio
+	 * approval, and no policy acceptance on file. It could book and be billed
+	 * immediately.
+	 *
+	 * So the state is decided here, at the one point every path passes through,
+	 * rather than trusted to whichever form happened to create the account:
+	 *
+	 * - **Not a student** — instructors and everyone else are none of this
+	 *   feature's business.
+	 * - **Created by staff** (anyone holding `manage_students`, which includes an
+	 *   administrator adding a user from wp-admin) — a deliberate act by someone
+	 *   who could have approved them anyway; approving their own creation is
+	 *   ceremony, so the account is left active.
+	 * - **Anything else** — held, and queued for review under **Pending
+	 *   Students**.
+	 *
+	 * The studio's own paths land in the last case and then say what they meant:
+	 * a self-signup calls {@see RegistrationStatus::markPending()} (which replaces
+	 * the hold with a real, unconfirmed pending state), and an invited student and
+	 * a guardian's child are approved outright by the code that creates them.
+	 */
+	public function holdUnknownSignup( int $userId ): void {
+		if ( $userId <= 0 || ! RoleManager::isStudent( $userId ) ) {
+			return;
+		}
+
+		if ( current_user_can( RoleManager::CAP_MANAGE_STUDENTS ) ) {
+			return;
+		}
+
+		RegistrationStatus::hold( $userId );
 	}
 
 	/**

src/Auth/RegistrationPage.php

@@ -431,6 +431,13 @@ class RegistrationPage {
 		}
 
 		if ( $inviteValid && ! $invite->isGroup() ) {
+			// An invited student is pre-approved by the invitation itself — the
+			// studio picked the address and sent the link. Clears the hold the
+			// registration gate puts on every student account created by an
+			// unauthenticated request ({@see RegistrationLoginGate::holdUnknownSignup()}),
+			// which would otherwise leave them signed in but unable to book.
+			RegistrationStatus::approve( (int) $userId );
+
 			$this->invites->markAccepted( (int) $invite->id, (int) $userId );
 
 			// A personal invite may carry a group-class grant (invited by email);

src/Auth/RegistrationStatus.php

@@ -58,6 +58,11 @@ class RegistrationStatus {
 		$rawToken = wp_generate_password( 32, false );
 
 		update_user_meta( $userId, self::META_AWAITING_APPROVAL, '1' );
+		// Explicitly *un*confirmed. The account may already have been held by
+		// {@see hold()} on `user_register` — which counts the email as confirmed,
+		// having never asked for confirmation — and this signup did ask, so the
+		// answer has to be waited for rather than inherited.
+		delete_user_meta( $userId, self::META_EMAIL_CONFIRMED );
 		update_user_meta( $userId, self::META_CONFIRM_TOKEN, self::hashToken( $rawToken ) );
 		update_user_meta(
 			$userId,
@@ -72,6 +77,21 @@ class RegistrationStatus {
 		return $rawToken;
 	}
 
+	/**
+	 * Hold a student account that appeared without going through the studio's own
+	 * signup form — see {@see RegistrationLoginGate::holdUnknownSignup()}.
+	 *
+	 * The email counts as confirmed, because nobody ever asked for confirmation
+	 * and there is no token to answer with: blocking the login outright would
+	 * strand the account with no way forward. What the hold actually withholds is
+	 * the booking capability, until a studio admin approves them from **Pending
+	 * Students** — the same queue, and the same decision, as a self-signup.
+	 */
+	public static function hold( int $userId ): void {
+		update_user_meta( $userId, self::META_AWAITING_APPROVAL, '1' );
+		update_user_meta( $userId, self::META_EMAIL_CONFIRMED, '1' );
+	}
+
 	/**
 	 * Mark the account's email confirmed and discard the (now spent) token. The
 	 * account stays awaiting approval.

src/Booking/BookingEndpoint.php

@@ -330,14 +330,19 @@ class BookingEndpoint {
 		$id     = absint( Val::int( $request->get_param( 'id' ) ) );
 		$lesson = $this->bookings->findById( $id );
 
-		if ( null === $lesson ) {
+		// A booking that is not the caller's is answered exactly as one that does
+		// not exist. Telling the two apart — 403 here, 404 there — would let any
+		// signed-in student walk the id space and learn which lessons the studio
+		// holds, and roughly how many. There is nothing a student can do with
+		// either answer, so there is no reason to distinguish them.
+		//
+		// The booking form's own 403 (see resolveStudent) is a different case: the
+		// student id there was chosen from a list of people the caller may act for,
+		// so "not yours" is a correction they need, not a fact they lack.
+		if ( null === $lesson || ! $this->guardians->canActFor( get_current_user_id(), $lesson->studentId ) ) {
 			return new \WP_Error( 'not_found', __( 'Booking not found.', 'unsupervised-schedular' ), [ 'status' => 404 ] );
 		}
 
-		if ( ! $this->guardians->canActFor( get_current_user_id(), $lesson->studentId ) ) {
-			return new \WP_Error( 'forbidden', __( 'You cannot cancel this booking.', 'unsupervised-schedular' ), [ 'status' => 403 ] );
-		}
-
 		if ( Lesson::STATUS_CANCELLED !== $lesson->status ) {
 			$slot = $this->availability->findById( $lesson->slotId );
 			if ( null !== $slot ) {

src/GroupClass/EnrollmentEndpoint.php

@@ -202,14 +202,14 @@ class EnrollmentEndpoint {
 		$id         = absint( Val::int( $request->get_param( 'id' ) ) );
 		$enrollment = $this->enrollments->findById( $id );
 
-		if ( null === $enrollment ) {
+		// Someone else's enrolment is answered exactly as a nonexistent one, so the
+		// id space cannot be walked to count the studio's enrolments. See
+		// {@see \Unsupervised\Schedular\Booking\BookingEndpoint::cancel()}, which
+		// makes the same trade for the same reason.
+		if ( null === $enrollment || ! $this->guardians->canActFor( get_current_user_id(), $enrollment->studentId ) ) {
 			return new \WP_Error( 'not_found', __( 'Enrolment not found.', 'unsupervised-schedular' ), [ 'status' => 404 ] );
 		}
 
-		if ( ! $this->guardians->canActFor( get_current_user_id(), $enrollment->studentId ) ) {
-			return new \WP_Error( 'forbidden', __( 'You cannot withdraw from this class.', 'unsupervised-schedular' ), [ 'status' => 403 ] );
-		}
-
 		if ( Enrollment::STATUS_ACTIVE === $enrollment->status ) {
 			$offering = $this->offerings->findById( $enrollment->offeringId );
 

src/GroupClass/EnrollmentRepository.php

@@ -82,6 +82,24 @@ class EnrollmentRepository {
 		return $count > 0;
 	}
 
+	/**
+	 * Active enrolments in one offering, oldest first.
+	 *
+	 * @return list<Enrollment>
+	 */
+	public function findActiveByOffering( int $offeringId ): array {
+		$rows = $this->db->get_results(
+			$this->db->prepare(
+				'SELECT * FROM %i WHERE offering_id = %d AND status = %s ORDER BY id ASC',
+				$this->table,
+				$offeringId,
+				Enrollment::STATUS_ACTIVE
+			)
+		);
+
+		return array_map( Enrollment::fromRow( ... ), $rows ?? [] );
+	}
+
 	/**
 	 * A student's enrolments, newest first.
 	 *

src/Guardian/GuardianService.php

@@ -3,6 +3,7 @@ declare(strict_types=1);
 
 namespace Unsupervised\Schedular\Guardian;
 
+use Unsupervised\Schedular\Auth\RegistrationStatus;
 use Unsupervised\Schedular\Auth\RoleManager;
 use Unsupervised\Schedular\Auth\UserName;
 use Unsupervised\Schedular\Booking\BookingRepository;
@@ -103,6 +104,14 @@ class GuardianService {
 		$userId = (int) $userId;
 
 		update_user_meta( $userId, self::META_CHILD, '1' );
+
+		// A child is a student created by someone who is not staff, so the
+		// registration gate holds it on `user_register` like any other unattributed
+		// signup. There is nothing here to approve: the account is never signed in
+		// to, and the guardian in front of us is the approval. Leaving the hold on
+		// would put every child a family adds into the studio's review queue.
+		RegistrationStatus::approve( $userId );
+
 		$this->setBirthYear( $userId, $birthYear );
 
 		$linkId = $this->guardians->insert(

src/Offering/BillingModeReconciler.php

@@ -0,0 +1,85 @@
+<?php
+declare(strict_types=1);
+
+namespace Unsupervised\Schedular\Offering;
+
+use Unsupervised\Schedular\GroupClass\EnrollmentRepository;
+use Unsupervised\Schedular\Payment\Payment;
+use Unsupervised\Schedular\Payment\PaymentRepository;
+use Unsupervised\Schedular\Val;
+
+/**
+ * Keeps existing enrolments from being billed twice when a group class is
+ * switched from a pay-now billing mode (one-time / full-term) to a scheduled one
+ * (weekly / monthly).
+ *
+ * A student who enrols while a class is pay-now is charged once at enrolment, and
+ * that charge carries no `period_key`. The daily scan dedups scheduled charges by
+ * `period_key`, so once the class becomes scheduled the scan does not see the
+ * up-front charge and bills the enrolment again for the same period. This adopts
+ * each such up-front charge into the current billing period so the scan treats it
+ * as already billed; later periods bill normally.
+ *
+ * Only the transition *into* scheduled billing is handled — going the other way,
+ * or editing an already-scheduled class, needs no reconciliation. Weekly is left
+ * alone: a weekly class is billed per session as sessions come due, so there is
+ * no single up-front period a prior charge maps onto.
+ */
+class BillingModeReconciler {
+
+	public function __construct(
+		private EnrollmentRepository $enrollments,
+		private PaymentRepository $payments,
+	) {}
+
+	/**
+	 * Reconcile an offering edit. Given the offering as it was and as it now is,
+	 * adopt up-front enrolment charges into the current month when the class has
+	 * just become monthly. Returns the number of charges adopted (0 when the edit
+	 * is not a pay-now -> monthly transition, or nothing needed adopting).
+	 */
+	public function reconcile( Offering $before, Offering $after ): int {
+		if ( null === $after->id || Offering::KIND_GROUP_CLASS !== $after->kind ) {
+			return 0;
+		}
+
+		// Only a fresh switch into monthly scheduling can strand an up-front charge.
+		$becameMonthly = Offering::BILLING_MONTHLY === $after->billingMode
+			&& Offering::BILLING_MONTHLY !== $before->billingMode;
+		if ( ! $becameMonthly ) {
+			return 0;
+		}
+
+		$period  = $this->currentMonth();
+		$dueDate = $period . '-01';
+		$adopted = 0;
+
+		foreach ( $this->enrollments->findActiveByOffering( $after->id ) as $enrollment ) {
+			$enrollmentId = (int) $enrollment->id;
+
+			// Nothing to adopt unless the enrolment holds an up-front (unscheduled)
+			// charge, and never when the scan has already billed this month for it —
+			// adopting then would leave two charges for the month, the opposite of
+			// the fix.
+			if ( ! $this->payments->hasUnscheduledCharge( Payment::REG_ENROLLMENT, $enrollmentId )
+				|| $this->payments->existsForPeriod( Payment::REG_ENROLLMENT, $enrollmentId, $period )
+			) {
+				continue;
+			}
+
+			$adopted += $this->payments->claimPeriodForUnscheduled( Payment::REG_ENROLLMENT, $enrollmentId, $period, $dueDate );
+		}
+
+		return $adopted;
+	}
+
+	/**
+	 * The current calendar month as a `Y-m` period key, from WordPress site time
+	 * so it matches how the billing scan derives its periods.
+	 */
+	private function currentMonth(): string {
+		$mysql = Val::string( current_time( 'mysql' ) );
+
+		return ( false !== strtotime( $mysql ) ? new \DateTimeImmutable( $mysql ) : new \DateTimeImmutable() )->format( 'Y-m' );
+	}
+}

src/Offering/OfferingController.php

@@ -12,6 +12,7 @@ class OfferingController {
 	public function __construct(
 		private OfferingRepository $repository,
 		private ClassSlotReconciler $reconciler,
+		private BillingModeReconciler $billingModeReconciler,
 		private AccessSettings $access = new AccessSettings(),
 	) {}
 
@@ -81,6 +82,11 @@ class OfferingController {
 					if ( null !== $offering ) {
 						$this->repository->update( $offeringId, $offering );
 
+						// Adopt any up-front enrolment charge into the current period when
+						// this edit switched the class to monthly, so the daily scan does
+						// not bill those enrolments a second time for the month.
+						$this->billingModeReconciler->reconcile( $existing, $offering );
+
 						return $this->reconcileNotice( $offering );
 					}
 				}

src/Offering/OfferingEndpoint.php

@@ -13,6 +13,7 @@ class OfferingEndpoint {
 	public function __construct(
 		private OfferingRepository $repository,
 		private GroupAccessRepository $access,
+		private BillingModeReconciler $billingModeReconciler,
 	) {}
 
 	/**
@@ -237,6 +238,11 @@ class OfferingEndpoint {
 
 		$this->repository->update( $id, $offering );
 
+		// Adopt any up-front enrolment charge into the current period when this edit
+		// switched the class to monthly, so the daily scan does not bill those
+		// enrolments a second time for the month.
+		$this->billingModeReconciler->reconcile( $existing, $offering );
+
 		return new \WP_REST_Response( $offering->toArray(), 200 );
 	}
 

src/Payment/Payment.php

@@ -59,6 +59,13 @@ class Payment {
 		public readonly ?string $stripePaymentIntentId = null,
 		public readonly ?string $receiptNumber = null,
 		public readonly ?string $receiptSentAt = null,
+		/**
+		 * When the daily billing scan emailed this payment's due notice, or null
+		 * if it has not been noticed yet. Gates the notice so a payment is emailed
+		 * exactly once even if the scan runs more than once (WP-Cron fires on
+		 * request and can overlap under concurrent traffic).
+		 */
+		public readonly ?string $noticeSentAt = null,
 		public readonly ?string $paidAt = null,
 		public readonly ?string $createdAt = null,
 		public readonly ?int $id = null,
@@ -85,6 +92,7 @@ class Payment {
 			stripePaymentIntentId: Val::stringOrNull( $row->stripe_payment_intent_id ),
 			receiptNumber:         Val::stringOrNull( $row->receipt_number ),
 			receiptSentAt:         Val::stringOrNull( $row->receipt_sent_at ),
+			noticeSentAt:          Val::stringOrNull( $row->notice_sent_at ?? null ),
 			paidAt:                Val::stringOrNull( $row->paid_at ),
 			createdAt:             Val::stringOrNull( $row->created_at ),
 			id:                    Val::int( $row->id ),

src/Payment/PaymentRepository.php

@@ -34,10 +34,11 @@ class PaymentRepository {
 				'stripe_payment_intent_id' => $payment->stripePaymentIntentId,
 				'receipt_number'           => $payment->receiptNumber,
 				'receipt_sent_at'          => $payment->receiptSentAt,
+				'notice_sent_at'           => $payment->noticeSentAt,
 				'paid_at'                  => $payment->paidAt,
 				'created_at'               => current_time( 'mysql' ),
 			],
-			[ '%d', '%d', '%d', '%s', '%d', '%f', '%s', '%s', '%s', '%f', '%f', '%f', '%s', '%s', '%s', '%s', '%s', '%s', '%s', '%s', '%s' ]
+			[ '%d', '%d', '%d', '%s', '%d', '%f', '%s', '%s', '%s', '%f', '%f', '%f', '%s', '%s', '%s', '%s', '%s', '%s', '%s', '%s', '%s', '%s' ]
 		);
 
 		return $this->db->insert_id;
@@ -271,6 +272,121 @@ class PaymentRepository {
 		);
 	}
 
+	/**
+	 * Whether a registration has an unscheduled, un-voided charge — one taken at
+	 * registration (`period_key IS NULL`, `status != failed`). The billing-mode
+	 * reconciler uses this to spot an up-front charge that a newly-scheduled
+	 * offering would otherwise cause the scan to bill a second time.
+	 */
+	public function hasUnscheduledCharge( string $registrationType, int $registrationId ): bool {
+		$found = $this->db->get_var(
+			$this->db->prepare(
+				'SELECT id FROM %i WHERE registration_type = %s AND registration_id = %d AND period_key IS NULL AND status != %s LIMIT 1',
+				$this->table,
+				$registrationType,
+				$registrationId,
+				Payment::STATUS_FAILED
+			)
+		);
+
+		return null !== $found;
+	}
+
+	/**
+	 * Stamp a registration's existing unscheduled charge with a billing period and
+	 * due date so the daily scan treats that period as already billed. Used when
+	 * an offering is switched to scheduled billing: the charge taken at enrolment
+	 * (which carries no `period_key`) would otherwise never match the scan's
+	 * per-period dedup, and the enrolment would be billed a second time for the
+	 * period the up-front charge already covers.
+	 *
+	 * Only ever adopts a charge that is genuinely unscheduled (`period_key IS
+	 * NULL`) and not voided (`status != failed`) — so it cannot overwrite a real
+	 * scheduled charge or revive a cancelled one. The caller guards against a
+	 * period that already has a scheduled charge (see {@see existsForPeriod}).
+	 * Returns the number of rows adopted (0 or 1).
+	 */
+	public function claimPeriodForUnscheduled( string $registrationType, int $registrationId, string $periodKey, string $dueDate ): int {
+		$sql = $this->db->prepare(
+			'UPDATE %i SET period_key = %s, due_date = %s
+			 WHERE registration_type = %s AND registration_id = %d
+			   AND period_key IS NULL AND status != %s
+			 ORDER BY id ASC LIMIT 1',
+			$this->table,
+			$periodKey,
+			$dueDate,
+			$registrationType,
+			$registrationId,
+			Payment::STATUS_FAILED
+		);
+
+		if ( null === $sql ) {
+			return 0;
+		}
+
+		return (int) $this->db->query( $sql );
+	}
+
+	/**
+	 * Atomically claim a payment for its one due-payment notice. Stamps
+	 * `notice_sent_at` only if it is still null, and returns whether *this* call
+	 * won the claim (one row updated). The billing scan calls this before
+	 * emailing so a payment's notice is sent exactly once: WP-Cron fires on
+	 * request and can overlap under concurrent traffic, so two scans may both
+	 * reach the send step for the same payment — the loser here updates zero rows
+	 * and skips the email. The conditional `WHERE ... IS NULL` is the guard, not a
+	 * prior read, so there is no check-then-act race.
+	 */
+	public function markNoticed( int $id ): bool {
+		$sql = $this->db->prepare(
+			'UPDATE %i SET notice_sent_at = %s WHERE id = %d AND notice_sent_at IS NULL',
+			$this->table,
+			current_time( 'mysql' ),
+			$id
+		);
+
+		if ( null === $sql ) {
+			return false;
+		}
+
+		return (int) $this->db->query( $sql ) === 1;
+	}
+
+	/**
+	 * One-time repair for sites upgraded before `notice_sent_at` existed: dbDelta
+	 * adds the column, and this backfills it so the historical payments those
+	 * sites already emailed notices for are not re-noticed on the next scan.
+	 * Every pre-existing pending scheduled row is treated as already noticed.
+	 * Guarded by its own option flag in {@see \Unsupervised\Schedular\Plugin},
+	 * not the version gate, since affected sites may already be on the current
+	 * version. Returns false when the column is absent so the caller does not set
+	 * its flag before dbDelta has run.
+	 */
+	public function backfillNoticeSent(): bool {
+		$column = $this->db->get_var(
+			$this->db->prepare(
+				'SHOW COLUMNS FROM %i LIKE %s',
+				$this->table,
+				'notice_sent_at'
+			)
+		);
+
+		if ( null === $column ) {
+			return false;
+		}
+
+		$sql = $this->db->prepare(
+			'UPDATE %i SET notice_sent_at = created_at WHERE notice_sent_at IS NULL AND period_key IS NOT NULL',
+			$this->table
+		);
+
+		if ( null !== $sql ) {
+			$this->db->query( $sql );
+		}
+
+		return true;
+	}
+
 	public function updateStatus( int $id, string $status ): bool {
 		if ( ! in_array( $status, Payment::VALID_STATUSES, true ) ) {
 			return false;

src/Payment/PaymentService.php

@@ -106,6 +106,16 @@ class PaymentService {
 		$this->payments->assignNoticeBatch( $ids, $batch );
 	}
 
+	/**
+	 * Atomically claim a payment for its single due-payment notice, returning
+	 * whether this call won the claim. The daily scan calls this before emailing
+	 * so a payment is noticed exactly once even when WP-Cron overlaps. Delegates
+	 * to the ledger.
+	 */
+	public function markNoticed( int $paymentId ): bool {
+		return $this->payments->markNoticed( $paymentId );
+	}
+
 	/**
 	 * Studio-admin confirmation that a pending payment (e-transfer) was received.
 	 * Marks it paid, confirms the registration, and emails the receipt.

src/Payment/ScheduledBillingRunner.php

@@ -352,6 +352,24 @@ class ScheduledBillingRunner {
 	 */
 	private function sendNotices( array $buckets ): void {
 		foreach ( $buckets as $payerId => $entries ) {
+			// Claim each payment's one-and-only notice up front. markNoticed stamps
+			// notice_sent_at only if still null and reports whether this run won —
+			// so an overlapping scan that also created/collected these payments
+			// finds them already claimed and drops them here, and no payer is
+			// emailed the same charge twice. Only the claimed entries go on to be
+			// credited, batched and listed.
+			$entries = array_values(
+				array_filter(
+					$entries,
+					fn( array $entry ): bool => null !== $entry['payment']->id
+						&& $this->payments->markNoticed( (int) $entry['payment']->id )
+				)
+			);
+
+			if ( [] === $entries ) {
+				continue;
+			}
+
 			$payments = array_map( static fn( array $entry ): Payment => $entry['payment'], $entries );
 			$applied  = $this->payments->applyCredits( $payerId, $payments );
 

src/Plugin.php

@@ -24,6 +24,7 @@ use Unsupervised\Schedular\Guardian\ChildLoginGate;
 use Unsupervised\Schedular\Guardian\FamilyPage;
 use Unsupervised\Schedular\Guardian\GuardianRepository;
 use Unsupervised\Schedular\Guardian\GuardianService;
+use Unsupervised\Schedular\Offering\BillingModeReconciler;
 use Unsupervised\Schedular\Offering\OfferingRepository;
 use Unsupervised\Schedular\Payment\BillingMethodResolver;
 use Unsupervised\Schedular\Payment\CreditRepository;
@@ -95,7 +96,19 @@ class Plugin {
 		$guardianRepo = new GuardianRepository( $wpdb );
 		$guardians    = new GuardianService( $guardianRepo, $bookings, $enrollments );
 
-		$paymentRepo    = new PaymentRepository( $wpdb );
+		$paymentRepo = new PaymentRepository( $wpdb );
+
+		// One-time backfill of us_payments.notice_sent_at, which dbDelta adds
+		// defaulting to NULL — leaving every already-noticed scheduled payment
+		// looking un-noticed, which the billing scan would email again. Backfills
+		// existing scheduled rows to their created_at so only genuinely new
+		// payments get a notice from here on. Guarded by its own flag rather than
+		// the version gate, since affected sites may already be on the current
+		// version; set only once the column exists and the update runs.
+		if ( '1' !== get_option( 'us_payments_notice_sent_backfilled', '' ) && $paymentRepo->backfillNoticeSent() ) {
+			update_option( 'us_payments_notice_sent_backfilled', '1' );
+		}
+
 		$creditRepo     = new CreditRepository( $wpdb );
 		$settings       = new StudioSettings();
 		$resolver       = new BillingMethodResolver( $settings );
@@ -117,6 +130,11 @@ class Plugin {
 		$familyPage       = new FamilyPage( $guardians, $questions, $answers );
 		$accountPage      = new AccountPage();
 
+		// Adopts an up-front enrolment charge into the current billing period when a
+		// group class is switched to monthly, so the daily scan does not bill it a
+		// second time for a month the up-front charge already covers.
+		$billingModeReconciler = new BillingModeReconciler( $enrollments, $paymentRepo );
+
 		( new ScheduledBillingRunner( $paymentService, $bookings, $enrollments, $offerings, new PaymentDueMailer(), $guardians ) )->register();
 
 		( new UpdateChecker() )->register();
@@ -126,8 +144,8 @@ class Plugin {
 		( new StudentAdminGuard() )->register();
 		( new DeletedUserCleanup( $bookings, $availability, $enrollments, $paymentService, $guardianRepo, $guardians ) )->register();
 		( new EmailConfirmationHandler( $settings, $registrationMailer ) )->register();
-		( new AdminMenu( $availability, $bookings, $offerings, $questions, $answers, $policies, $policyVersions, $policyService, $acceptances, $invites, $enrollments, $groupAccess, $settings, $paymentRepo, $paymentService, $resolver, $registrationMailer, $creditRepo, $guardians, $lessonBooker, $registrationGate ) )->register();
-		( new RestRegistrar( $availability, $bookings, $offerings, $questions, $policies, $policyVersions, $policyService, $registrationGate, $enrollments, $groupAccess, $paymentService, $guardians, $lessonBooker ) )->register();
+		( new AdminMenu( $availability, $bookings, $offerings, $questions, $answers, $policies, $policyVersions, $policyService, $acceptances, $invites, $enrollments, $groupAccess, $settings, $paymentRepo, $paymentService, $resolver, $registrationMailer, $creditRepo, $guardians, $lessonBooker, $registrationGate, $billingModeReconciler ) )->register();
+		( new RestRegistrar( $availability, $bookings, $offerings, $questions, $policies, $policyVersions, $policyService, $registrationGate, $enrollments, $groupAccess, $paymentService, $guardians, $lessonBooker, $billingModeReconciler ) )->register();
 		( new ShortcodeRegistrar( $bookingPage, $loginPage, $registrationPage, $groupClassPage, $familyPage, $accountPage ) )->register();
 		( new BlockRegistrar( $bookingPage, $loginPage, $registrationPage, $groupClassPage, $familyPage, $accountPage ) )->register();
 	}

src/RestRegistrar.php

@@ -15,6 +15,7 @@ use Unsupervised\Schedular\GroupClass\GroupAccessRepository;
 use Unsupervised\Schedular\GroupClass\EnrollmentRepository;
 use Unsupervised\Schedular\GroupClass\SessionSchedule;
 use Unsupervised\Schedular\Guardian\GuardianService;
+use Unsupervised\Schedular\Offering\BillingModeReconciler;
 use Unsupervised\Schedular\Offering\OfferingEndpoint;
 use Unsupervised\Schedular\Offering\OfferingRepository;
 use Unsupervised\Schedular\Payment\PaymentEndpoint;
@@ -40,10 +41,10 @@ class RestRegistrar {
 	private EnrollmentEndpoint $enrollmentEndpoint;
 	private PaymentEndpoint $paymentEndpoint;
 
-	public function __construct( AvailabilityRepository $availability, BookingRepository $bookings, OfferingRepository $offerings, QuestionRepository $questions, PolicyRepository $policies, PolicyVersionRepository $policyVersions, PolicyService $policyService, RegistrationGate $gate, EnrollmentRepository $enrollments, GroupAccessRepository $groupAccess, PaymentService $paymentService, GuardianService $guardians, LessonBooker $booker ) {
+	public function __construct( AvailabilityRepository $availability, BookingRepository $bookings, OfferingRepository $offerings, QuestionRepository $questions, PolicyRepository $policies, PolicyVersionRepository $policyVersions, PolicyService $policyService, RegistrationGate $gate, EnrollmentRepository $enrollments, GroupAccessRepository $groupAccess, PaymentService $paymentService, GuardianService $guardians, LessonBooker $booker, BillingModeReconciler $billingModeReconciler ) {
 		$this->availabilityEndpoint = new AvailabilityEndpoint( $availability, new WindowValidator( $offerings ) );
 		$this->bookingEndpoint      = new BookingEndpoint( $availability, $bookings, $offerings, $gate, $paymentService, $booker, new CancellationPolicy( new StudioSettings() ), $guardians, new SessionSchedule( $enrollments, $offerings ) );
-		$this->offeringEndpoint     = new OfferingEndpoint( $offerings, $groupAccess );
+		$this->offeringEndpoint     = new OfferingEndpoint( $offerings, $groupAccess, $billingModeReconciler );
 		$this->questionEndpoint     = new QuestionEndpoint( $questions, $offerings );
 		$this->policyEndpoint       = new PolicyEndpoint( $policies, $policyVersions, $policyService );
 		$this->enrollmentEndpoint   = new EnrollmentEndpoint( $enrollments, $offerings, $gate, $paymentService, $groupAccess, $guardians );

src/Schema.php

@@ -5,6 +5,33 @@ namespace Unsupervised\Schedular;
 
 class Schema {
 
+	/**
+	 * Every table this plugin owns, unprefixed and in creation order.
+	 *
+	 * The statements in {@see tables()} spell their own names out, so this list is
+	 * what anything that needs to *name* the tables without building them reads —
+	 * {@see Uninstaller}, which drops them. Add a table below and add it here, or
+	 * uninstalling will leave it behind.
+	 *
+	 * @var list<string>
+	 */
+	public const TABLES = [
+		'us_availability',
+		'us_lessons',
+		'us_offerings',
+		'us_questions',
+		'us_question_answers',
+		'us_policies',
+		'us_policy_versions',
+		'us_policy_acceptances',
+		'us_payments',
+		'us_credits',
+		'us_group_enrollments',
+		'us_invites',
+		'us_guardians',
+		'us_group_access',
+	];
+
 	/**
 	 * Returns CREATE TABLE statements for dbDelta.
 	 *
@@ -180,6 +207,7 @@ class Schema {
                 stripe_payment_intent_id VARCHAR(255)    DEFAULT NULL,
                 receipt_number           VARCHAR(50)     DEFAULT NULL,
                 receipt_sent_at          DATETIME        DEFAULT NULL,
+                notice_sent_at           DATETIME        DEFAULT NULL,
                 created_at               DATETIME        NOT NULL,
                 paid_at                  DATETIME        DEFAULT NULL,
                 PRIMARY KEY (id),

src/Uninstaller.php

@@ -0,0 +1,214 @@
+<?php
+declare(strict_types=1);
+
+namespace Unsupervised\Schedular;
+
+use Unsupervised\Schedular\Auth\AccessSettings;
+use Unsupervised\Schedular\Auth\RegistrationController;
+use Unsupervised\Schedular\Auth\RegistrationStatus;
+use Unsupervised\Schedular\Auth\RoleManager;
+use Unsupervised\Schedular\Guardian\GuardianService;
+use Unsupervised\Schedular\Payment\BillingMethodResolver;
+use Unsupervised\Schedular\Payment\ScheduledBillingRunner;
+use Unsupervised\Schedular\Payment\StudioSettings;
+use Unsupervised\Schedular\Update\UpdateChecker;
+
+/**
+ * What deleting the plugin takes with it.
+ *
+ * WordPress gives an uninstall no interface of its own — `uninstall.php` runs
+ * headless, after the plugin is already gone from the screen — so the choice has
+ * to be made in advance, on **Access → Plugin removal**, and read back here. Two
+ * things are true at once and the split below is how both are honoured:
+ *
+ * - A studio's records are irreplaceable. Lessons taught, payments taken, what
+ *   families agreed to and when: a deactivate-and-reinstall, or a delete during
+ *   a migration, must not be the thing that loses them. So the data is kept
+ *   unless the site owner has explicitly said otherwise.
+ * - Credentials are not records. The Stripe secret and webhook signing key can
+ *   be re-pasted from the Stripe dashboard in under a minute, and leaving live
+ *   keys in `wp_options` of a site that no longer has the code to use them is
+ *   nothing but exposure. So those go every time, choice or no choice.
+ *
+ * The two WordPress settings open registration borrows — `users_can_register`
+ * and `default_role` — are also always put back. They are the site's, not the
+ * plugin's, and leaving them behind would leave the site accepting public
+ * signups into a Student role that may no longer exist.
+ */
+class Uninstaller {
+
+	/**
+	 * Whether deleting the plugin also erases everything it recorded. Off unless
+	 * the site owner turns it on, because the mistake is unrecoverable in one
+	 * direction only.
+	 */
+	public const OPT_DELETE_DATA = 'us_delete_data_on_uninstall';
+
+	/**
+	 * Stripe credentials and configuration. Always removed — see the class
+	 * docblock.
+	 *
+	 * @var list<string>
+	 */
+	private const CREDENTIAL_OPTIONS = [
+		StudioSettings::OPT_PUBLISHABLE,
+		StudioSettings::OPT_SECRET,
+		StudioSettings::OPT_WEBHOOK_SECRET,
+		StudioSettings::OPT_MODE,
+	];
+
+	/**
+	 * Every remaining option the plugin writes. Removed only on a full purge.
+	 *
+	 * @var list<string>
+	 */
+	private const SETTING_OPTIONS = [
+		'us_schedular_version',
+		'us_questions_offering_nullable',
+		'us_questions_child_required_backfilled',
+		StudioSettings::OPT_CURRENCY,
+		StudioSettings::OPT_ETRANSFER_EMAIL,
+		StudioSettings::OPT_HST_RATE,
+		StudioSettings::OPT_DEFAULT_PAYMENT_METHOD,
+		StudioSettings::OPT_CANCELLATION_CUTOFF_HOURS,
+		StudioSettings::OPT_REGISTRATION_MODE,
+		RegistrationController::OPTION_PAGE,
+		AccessSettings::OPT_GRANT_STUDIO,
+		AccessSettings::OPT_GRANT_INSTRUCTOR,
+		self::OPT_DELETE_DATA,
+	];
+
+	/**
+	 * Every user meta key the plugin writes. Removed for all users on a full
+	 * purge, so no student is left carrying a billing override or a half-finished
+	 * signup for a plugin that is gone.
+	 *
+	 * @var list<string>
+	 */
+	private const USER_META = [
+		GuardianService::META_CHILD,
+		GuardianService::META_BIRTH_YEAR,
+		GuardianService::META_DOB,
+		GuardianService::META_GUARDIAN_ONLY,
+		BillingMethodResolver::META_METHOD,
+		RegistrationStatus::META_AWAITING_APPROVAL,
+		RegistrationStatus::META_EMAIL_CONFIRMED,
+		RegistrationStatus::META_CONFIRM_TOKEN,
+		RegistrationStatus::META_CONFIRM_EXPIRES,
+		RegistrationStatus::META_AUTO_APPROVE,
+	];
+
+	/**
+	 * Whether a full purge has been asked for.
+	 */
+	public static function deletesDataOnUninstall(): bool {
+		return '1' === Val::string( get_option( self::OPT_DELETE_DATA, '0' ) );
+	}
+
+	/**
+	 * Record the site owner's answer.
+	 */
+	public static function setDeletesDataOnUninstall( bool $delete ): void {
+		update_option( self::OPT_DELETE_DATA, $delete ? '1' : '0' );
+	}
+
+	/**
+	 * Run the uninstall. Called from `uninstall.php`, which WordPress loads in
+	 * isolation once the plugin has been deleted.
+	 */
+	public function run(): void {
+		$this->forgetCredentials();
+		$this->restoreCoreRegistrationSettings();
+
+		// The event is cleared on deactivation too, which always precedes a
+		// delete — repeated here because a site can be left with a stale schedule
+		// if the plugin files went away without deactivating cleanly.
+		wp_clear_scheduled_hook( ScheduledBillingRunner::HOOK );
+
+		if ( ! self::deletesDataOnUninstall() ) {
+			return;
+		}
+
+		$this->dropTables();
+		$this->deleteSettings();
+		$this->deleteUserMeta();
+		$this->removeRoles();
+	}
+
+	/**
+	 * Forget the Stripe credentials, always. {@see StudioSettings::clearStripeConfig()}
+	 * is the same act from the settings page; it is not reused here because that
+	 * object belongs to a plugin that, by this point, is no longer loaded as one.
+	 */
+	private function forgetCredentials(): void {
+		foreach ( self::CREDENTIAL_OPTIONS as $option ) {
+			delete_option( $option );
+		}
+
+		delete_transient( UpdateChecker::TRANSIENT );
+	}
+
+	/**
+	 * Put back the two core options open registration borrowed, from the snapshot
+	 * taken when it was switched on. Without this, deleting the plugin while open
+	 * registration is enabled leaves the site accepting public signups into a role
+	 * that is about to stop existing.
+	 *
+	 * Only acts when a snapshot exists, so a site that never enabled open
+	 * registration keeps its own settings untouched.
+	 */
+	private function restoreCoreRegistrationSettings(): void {
+		$snapshot = get_option( StudioSettings::OPT_PREV_USERS_CAN_REGISTER, null );
+		if ( null === $snapshot ) {
+			return;
+		}
+
+		$prevRole = Val::string( get_option( StudioSettings::OPT_PREV_DEFAULT_ROLE, 'subscriber' ) );
+
+		update_option( 'users_can_register', '1' === Val::string( $snapshot ) ? '1' : '0' );
+		update_option( 'default_role', '' !== $prevRole ? $prevRole : 'subscriber' );
+
+		delete_option( StudioSettings::OPT_PREV_USERS_CAN_REGISTER );
+		delete_option( StudioSettings::OPT_PREV_DEFAULT_ROLE );
+	}
+
+	private function dropTables(): void {
+		global $wpdb;
+		if ( ! $wpdb instanceof \wpdb ) {
+			return;
+		}
+
+		foreach ( Schema::TABLES as $table ) {
+			$sql = $wpdb->prepare( 'DROP TABLE IF EXISTS %i', $wpdb->prefix . $table );
+
+			if ( null !== $sql ) {
+				// phpcs:ignore WordPress.DB.PreparedSQL.NotPrepared, WordPress.DB.DirectDatabaseQuery.DirectQuery, WordPress.DB.DirectDatabaseQuery.NoCaching, WordPress.DB.DirectDatabaseQuery.SchemaChange -- $sql is the prepared statement two lines up; the sniff cannot follow it across the null guard, which PHPStan requires because prepare() is nullable. The only interpolated value is a Schema::TABLES constant.
+				$wpdb->query( $sql );
+			}
+		}
+	}
+
+	private function deleteSettings(): void {
+		foreach ( self::SETTING_OPTIONS as $option ) {
+			delete_option( $option );
+		}
+	}
+
+	private function deleteUserMeta(): void {
+		foreach ( self::USER_META as $key ) {
+			delete_metadata( 'user', 0, $key, '', true );
+		}
+	}
+
+	/**
+	 * Drop the three roles the plugin adds. Only on a full purge: a site keeping
+	 * its data is keeping its students too, and a student whose role has been
+	 * deleted out from under them is a user with no capabilities at all until the
+	 * plugin is reinstalled.
+	 */
+	private function removeRoles(): void {
+		foreach ( [ RoleManager::STUDIO_ADMIN, RoleManager::INSTRUCTOR, RoleManager::STUDENT ] as $role ) {
+			remove_role( $role );
+		}
+	}
+}

src/Update/UpdateChecker.php

@@ -178,8 +178,13 @@ class UpdateChecker {
 				if ( ! is_array( $asset ) ) {
 					continue;
 				}
-				if ( str_ends_with( strtolower( Val::string( $asset['name'] ?? '' ) ), '.zip' ) ) {
-					$package = Val::string( $asset['browser_download_url'] ?? '' );
+				if ( ! str_ends_with( strtolower( Val::string( $asset['name'] ?? '' ) ), '.zip' ) ) {
+					continue;
+				}
+
+				$url = Val::string( $asset['browser_download_url'] ?? '' );
+				if ( self::isTrustedPackage( $url ) ) {
+					$package = $url;
 					break;
 				}
 			}
@@ -194,4 +199,40 @@ class UpdateChecker {
 			'package' => $package,
 		];
 	}
+
+	/**
+	 * Whether a release asset's URL may be handed to core as a plugin package.
+	 *
+	 * Core downloads whatever this returns and unpacks it over the installed
+	 * plugin, so the URL is executable code by another name. It is taken from a
+	 * JSON body, which means an answer that is not really the release server's —
+	 * a hijacked hostname, a tampered response, a compromised repo host handing
+	 * out a package hosted elsewhere — would otherwise install arbitrary code on
+	 * every site running this plugin, silently for anyone with auto-updates on.
+	 *
+	 * So the package has to come from the release host itself, over TLS: the
+	 * scheme is `https` and the parsed host equals {@see HOSTNAME} exactly. The
+	 * comparison is on the parsed host and not on the string, because a name that
+	 * merely *contains* the right one is the whole trick — `evil-git.unsupervised.ca`
+	 * would satisfy an endsWith check, `git.unsupervised.ca.attacker.test` a
+	 * startsWith one, and `https://[email protected]/x.zip` reads
+	 * like the real host to a person while resolving to someone else's.
+	 * Subdomains are refused too: nothing but the release host publishes releases.
+	 *
+	 * This cannot defend against the release host serving a bad zip of its own —
+	 * nothing here can — but it keeps the blast radius to that one host.
+	 */
+	private static function isTrustedPackage( string $url ): bool {
+		if ( '' === $url ) {
+			return false;
+		}
+
+		$parts = wp_parse_url( $url );
+		if ( ! is_array( $parts ) ) {
+			return false;
+		}
+
+		return 'https' === strtolower( Val::string( $parts['scheme'] ?? '' ) )
+			&& self::HOSTNAME === strtolower( Val::string( $parts['host'] ?? '' ) );
+	}
 }

templates/admin/access.php

@@ -6,8 +6,10 @@ if (! defined('ABSPATH')) {
 }
 
 /**
- * @var bool $adminsAreStudioAdmins
- * @var bool $adminsAreInstructors
+ * @var bool   $adminsAreStudioAdmins
+ * @var bool   $adminsAreInstructors
+ * @var bool   $deleteDataOnUninstall
+ * @var string $error Why the data-removal choice was refused, if it was.
  */
 ?>
 <div class="wrap">
@@ -19,6 +21,12 @@ if (! defined('ABSPATH')) {
         </p>
     </div>
 
+    <?php if ($error !== '') : ?>
+        <div class="notice notice-error inline">
+            <p><?php echo esc_html($error); ?></p>
+        </div>
+    <?php endif; ?>
+
     <form method="post">
         <?php wp_nonce_field('usc_access_action'); ?>
         <input type="hidden" name="usc_action" value="save">
@@ -45,6 +53,50 @@ if (! defined('ABSPATH')) {
                 </td>
             </tr>
         </table>
+
+        <h2><?php esc_html_e('Plugin removal', 'unsupervised-schedular'); ?></h2>
+        <p class="description" style="max-width:46em;">
+            <?php esc_html_e('Deleting a plugin happens on the Plugins screen, and WordPress gives it nothing to ask you at the time — so the answer is given here, in advance.', 'unsupervised-schedular'); ?>
+        </p>
+        <table class="form-table">
+            <tr>
+                <th scope="row"><?php esc_html_e('Always removed', 'unsupervised-schedular'); ?></th>
+                <td>
+                    <p class="description">
+                        <?php esc_html_e('Your Stripe secret key and webhook signing secret are forgotten whenever this plugin is deleted, whatever you choose below. They can be pasted back in from the Stripe dashboard in a minute; leaving live keys on a site that no longer has the code to use them cannot be undone as easily. The two WordPress settings open registration borrows — whether anyone can register, and the role new users get — are put back as they were, too.', 'unsupervised-schedular'); ?>
+                    </p>
+                </td>
+            </tr>
+            <tr>
+                <th scope="row"><?php esc_html_e('Studio records', 'unsupervised-schedular'); ?></th>
+                <td>
+                    <fieldset>
+                        <label>
+                            <input type="checkbox" name="delete_data" value="1" <?php checked($deleteDataOnUninstall); ?>>
+                            <?php esc_html_e('Erase everything when the plugin is deleted', 'unsupervised-schedular'); ?>
+                        </label>
+                        <p class="description">
+                            <?php esc_html_e('Off by default: deleting the plugin leaves your lessons, enrolments, payments, credits, intake answers, policy agreements, invites and family links in the database, so reinstalling picks up exactly where you left off — and a deletion during a migration or a bit of troubleshooting costs you nothing.', 'unsupervised-schedular'); ?>
+                        </p>
+                        <p class="description">
+                            <strong><?php esc_html_e('Turn it on and there is no way back.', 'unsupervised-schedular'); ?></strong>
+                            <?php esc_html_e('Every table this plugin made is dropped, every setting and student record it stored is deleted, and the Studio Admin, Instructor and Student roles are removed. WordPress does not ask twice and there is no undo. Take a database backup first if the studio has ever taken a payment.', 'unsupervised-schedular'); ?>
+                        </p>
+                        <?php if (! $deleteDataOnUninstall) : ?>
+                            <p>
+                                <label for="usc-delete-confirm"><?php esc_html_e('To turn it on, type DELETE:', 'unsupervised-schedular'); ?></label>
+                                <input type="text" name="delete_data_confirm" id="usc-delete-confirm" value="" autocomplete="off" class="regular-text" style="max-width:12em;">
+                            </p>
+                        <?php else : ?>
+                            <p class="description">
+                                <?php esc_html_e('Currently on. Untick the box and save to turn it off again.', 'unsupervised-schedular'); ?>
+                            </p>
+                        <?php endif; ?>
+                    </fieldset>
+                </td>
+            </tr>
+        </table>
+
         <?php submit_button(esc_html__('Save Access Settings', 'unsupervised-schedular')); ?>
     </form>
 </div>

tests/CLAUDE.md

@@ -1,14 +1,3 @@
 # Writing tests
 
-Tests use [Brain\Monkey](https://brain-wp.github.io/BrainMonkey/) to stub WordPress functions without a full WP installation, and Mockery to mock `$wpdb` and other dependencies.
-
-All test classes extend `tests/Unit/TestCase.php`, which handles `Monkey\setUp()` / `Monkey\tearDown()` and stubs all WP translation/escape functions automatically.
-
-**Brain\Monkey API notes:**
-
-- `Functions\when('fn')->alias(fn() => ...)` — stub with a closure (NOT `returnUsing()`)
-- `Functions\when('fn')->justReturn($val)` — stub returning a fixed value
-- `Functions\expect('fn')->once()->with(...)` — assert call count and arguments
-- Use `Functions\when()` (not `Functions\expect()`) when you need argument-routing (e.g. `get_role` returning different values per argument) to avoid chaining ambiguity
-- Mockery matchers (e.g. `\Mockery::type()`) inside plain PHP arrays do not work with `with()` — use `\Mockery::on(fn($arr) => ...)` or `\Mockery::any()` instead
-- When mocking `$wpdb`, set `$mock->prefix = 'wp_'` explicitly — it is a public property, not a method
+See `../../AGENTS.md` (Tests section) — it is the single source of truth for working in this repo.

tests/Unit/Auth/AccessSettingsTest.php

@@ -6,6 +6,7 @@ namespace Unsupervised\Schedular\Tests\Unit\Auth;
 use Brain\Monkey\Functions;
 use Unsupervised\Schedular\Auth\AccessSettings;
 use Unsupervised\Schedular\Tests\Unit\TestCase;
+use Unsupervised\Schedular\Uninstaller;
 
 class AccessSettingsTest extends TestCase
 {
@@ -31,4 +32,108 @@ class AccessSettingsTest extends TestCase
         self::assertFalse($settings->adminsAreStudioAdmins());
         self::assertTrue($settings->adminsAreInstructors());
     }
+
+    /**
+     * Render the page with the given options stored and the given form posted,
+     * returning the options as they end up.
+     *
+     * @param  array<string, mixed> $options
+     * @param  array<string, mixed> $post
+     * @return array<string, mixed>
+     */
+    private function submit(array $options, array $post): array
+    {
+        // A regular closure, not an arrow fn: arrow functions capture by value,
+        // so reads after the save would still see the options as they were.
+        Functions\when('get_option')->alias(
+            static function (string $name, mixed $default = false) use (&$options): mixed {
+                return $options[$name] ?? $default;
+            }
+        );
+        Functions\when('update_option')->alias(
+            static function (string $name, mixed $value) use (&$options): bool {
+                $options[$name] = $value;
+
+                return true;
+            }
+        );
+        Functions\when('current_user_can')->justReturn(true);
+        Functions\when('check_admin_referer')->justReturn(true);
+        Functions\when('wp_unslash')->returnArg();
+        // The typed confirmation is read through sanitize_key, so "Delete",
+        // " delete " and "DELETE" all arrive here as the same word.
+        Functions\when('sanitize_key')->alias(
+            static fn($v): string => (string) preg_replace('/[^a-z0-9_\-]/', '', strtolower((string) $v))
+        );
+        Functions\when('wp_nonce_field')->justReturn('');
+        Functions\when('submit_button')->justReturn('');
+
+        $_POST = $post + ['usc_action' => 'save'];
+
+        ob_start();
+        (new AccessSettings())->renderPage();
+        ob_end_clean();
+
+        $_POST = [];
+
+        return $options;
+    }
+
+    /**
+     * Erasing the studio's records cannot be undone, and a checkbox is one stray
+     * click. The tick alone must not be enough.
+     */
+    public function testTickingDataRemovalWithoutTypingTheWordDoesNotEnableIt(): void
+    {
+        $options = $this->submit(
+            [Uninstaller::OPT_DELETE_DATA => '0'],
+            ['delete_data' => '1', 'grant_studio' => '1']
+        );
+
+        self::assertSame('0', $options[Uninstaller::OPT_DELETE_DATA]);
+        // The rest of the page still saved: a mistyped confirmation must not
+        // silently swallow a capability change made in the same submit.
+        self::assertSame('1', $options[AccessSettings::OPT_GRANT_STUDIO]);
+    }
+
+    public function testTickAndTypedConfirmationTogetherEnableIt(): void
+    {
+        $options = $this->submit(
+            [Uninstaller::OPT_DELETE_DATA => '0'],
+            ['delete_data' => '1', 'delete_data_confirm' => ' DELETE ']
+        );
+
+        self::assertSame('1', $options[Uninstaller::OPT_DELETE_DATA]);
+    }
+
+    public function testANearMissDoesNotCount(): void
+    {
+        $options = $this->submit(
+            [Uninstaller::OPT_DELETE_DATA => '0'],
+            ['delete_data' => '1', 'delete_data_confirm' => 'delete everything']
+        );
+
+        self::assertSame('0', $options[Uninstaller::OPT_DELETE_DATA]);
+    }
+
+    /**
+     * Once it is on, saving the page for some other reason must not turn it off
+     * — nor demand the word again for a setting already made.
+     */
+    public function testSavingOtherSettingsLeavesAnEnabledChoiceAlone(): void
+    {
+        $options = $this->submit(
+            [Uninstaller::OPT_DELETE_DATA => '1'],
+            ['delete_data' => '1', 'grant_instructor' => '1']
+        );
+
+        self::assertSame('1', $options[Uninstaller::OPT_DELETE_DATA]);
+    }
+
+    public function testUntickingTurnsItOffWithNoCeremony(): void
+    {
+        $options = $this->submit([Uninstaller::OPT_DELETE_DATA => '1'], ['grant_studio' => '1']);
+
+        self::assertSame('0', $options[Uninstaller::OPT_DELETE_DATA]);
+    }
 }

tests/Unit/Auth/LoginPageTest.php

@@ -19,7 +19,7 @@ class LoginPageTest extends TestCase
 
     protected function tearDown(): void
     {
-        unset($_POST['us_login']);
+        unset($_POST['us_login'], $_POST['log'], $_POST['pwd']);
         parent::tearDown();
     }
 
@@ -91,4 +91,37 @@ class LoginPageTest extends TestCase
 
         self::assertSame('https://example.com/book/', $this->page->bookingUrl(9));
     }
+
+    /**
+     * wp_signon()'s second argument decides whether the auth cookie carries the
+     * Secure flag, and *only* its default (the empty string) makes it work that
+     * out from is_ssl(). Passing an explicit false — which reads like "no
+     * preference" and is not — issues the plain, non-Secure cookie on an HTTPS
+     * site, leaving every student's session to leak over the first http://
+     * request to the domain. So the call must pass the credentials and nothing
+     * else, which is what this asserts: a second argument of any kind fails it.
+     */
+    public function testSignOnDoesNotOverrideWordPressSecureCookieDetection(): void
+    {
+        $_POST['us_login'] = '1';
+        $_POST['log']      = '[email protected]';
+        $_POST['pwd']      = 'hunter2';
+
+        Functions\when('is_user_logged_in')->justReturn(false);
+        Functions\when('get_permalink')->justReturn('https://example.com/login/');
+        Functions\when('sanitize_url')->returnArg();
+        Functions\when('sanitize_user')->returnArg();
+        Functions\when('wp_unslash')->returnArg();
+        Functions\when('wp_nonce_field')->justReturn('');
+        Functions\when('check_admin_referer')->justReturn(true);
+        // The failure branch, so the render returns instead of redirecting and
+        // exiting the test process.
+        Functions\when('is_wp_error')->justReturn(true);
+
+        Functions\expect('wp_signon')->once()->with(\Mockery::type('array'))->andReturn(null);
+
+        $html = $this->page->render([]);
+
+        self::assertStringContainsString('Invalid username or password.', $html);
+    }
 }

tests/Unit/Auth/RegistrationLoginGateTest.php

@@ -115,4 +115,62 @@ class RegistrationLoginGateTest extends TestCase
 
         self::assertSame($allcaps, $result);
     }
+
+    /**
+     * Describe a user to the `user_register` guard: which role they hold, and
+     * whether whoever created them is studio staff.
+     */
+    private function stubSignup(string $role, bool $byStaff): void
+    {
+        $user        = Mockery::mock(\WP_User::class);
+        $user->roles = [$role];
+
+        Functions\when('get_userdata')->justReturn($user);
+        Functions\when('current_user_can')->justReturn($byStaff);
+    }
+
+    public function testStudentCreatedByAnUnknownSignupFormIsHeldForApproval(): void
+    {
+        // Open registration switches the site's own users_can_register on and
+        // makes Student the default role, so any other signup form on the site
+        // now mints students. They must not arrive able to book.
+        $this->stubSignup(RoleManager::STUDENT, byStaff: false);
+
+        Functions\expect('update_user_meta')->once()
+            ->with(7, RegistrationStatus::META_AWAITING_APPROVAL, '1');
+        // Counted as confirmed: nobody asked them to confirm, and there is no
+        // token for them to answer with, so blocking the login would strand them.
+        Functions\expect('update_user_meta')->once()
+            ->with(7, RegistrationStatus::META_EMAIL_CONFIRMED, '1');
+
+        (new RegistrationLoginGate())->holdUnknownSignup(7);
+    }
+
+    public function testStudentCreatedByStaffIsLeftActive(): void
+    {
+        // An administrator adding a student from wp-admin could have approved
+        // them in the next click; making them do so is ceremony.
+        $this->stubSignup(RoleManager::STUDENT, byStaff: true);
+
+        Functions\expect('update_user_meta')->never();
+
+        (new RegistrationLoginGate())->holdUnknownSignup(7);
+    }
+
+    public function testNonStudentSignupIsNotHeld(): void
+    {
+        $this->stubSignup(RoleManager::INSTRUCTOR, byStaff: false);
+
+        Functions\expect('update_user_meta')->never();
+
+        (new RegistrationLoginGate())->holdUnknownSignup(7);
+    }
+
+    public function testUnknownUserIdIsIgnored(): void
+    {
+        Functions\when('get_userdata')->justReturn(false);
+        Functions\expect('update_user_meta')->never();
+
+        (new RegistrationLoginGate())->holdUnknownSignup(0);
+    }
 }

tests/Unit/Auth/RegistrationPageTest.php

@@ -9,6 +9,7 @@ use Unsupervised\Schedular\Auth\Invite;
 use Unsupervised\Schedular\Auth\InviteRepository;
 use Unsupervised\Schedular\Auth\RegistrationMailer;
 use Unsupervised\Schedular\Auth\RegistrationPage;
+use Unsupervised\Schedular\Auth\RegistrationStatus;
 use Unsupervised\Schedular\GroupClass\GroupAccessRepository;
 use Unsupervised\Schedular\Guardian\GuardianService;
 use Unsupervised\Schedular\Payment\StudioSettings;
@@ -29,6 +30,9 @@ class RegistrationPageTest extends TestCase
     /** @var array<string, mixed> */
     private array $ctx;
 
+    /** @var list<string> User meta keys cleared during the submit under test. */
+    private array $clearedMeta = [];
+
     protected function setUp(): void
     {
         parent::setUp();
@@ -52,6 +56,20 @@ class RegistrationPageTest extends TestCase
         Functions\when('wp_enqueue_script')->justReturn(null);
         Functions\when('wp_localize_script')->justReturn(true);
 
+        // Both success branches clear pending meta on the account they just
+        // created — the invited student is approved outright, the self-signup is
+        // marked unconfirmed. Recorded rather than counted so a test can say
+        // which, without every other test having to expect the calls.
+        $this->clearedMeta = [];
+        $cleared           = &$this->clearedMeta;
+        Functions\when('delete_user_meta')->alias(
+            static function (int $userId, string $key) use (&$cleared): bool {
+                $cleared[] = $key;
+
+                return true;
+            }
+        );
+
         $invites   = Mockery::mock(InviteRepository::class);
         $policies  = Mockery::mock(PolicyRepository::class);
         $questions = Mockery::mock(QuestionRepository::class);
@@ -149,6 +167,24 @@ class RegistrationPageTest extends TestCase
         self::assertSame('invite', $this->submit($invite, false));
     }
 
+    /**
+     * The registration gate holds every student account created by an
+     * unauthenticated request, which is what a signup is — so the invite branch
+     * has to say that this one is different. Without it an invited student is
+     * logged straight in and then told they cannot book.
+     */
+    public function testInvitedStudentIsApprovedRatherThanLeftAwaitingApproval(): void
+    {
+        $_POST = [ 'password' => 'thistle-marrow-42', 'display_name' => 'Ada', 'birth_year' => '1990' ];
+
+        $this->stubInviteSuccess();
+
+        $invite = new Invite(email: '[email protected]', token: 'hash');
+
+        self::assertSame('invite', $this->submit($invite, false));
+        self::assertContains(RegistrationStatus::META_AWAITING_APPROVAL, $this->clearedMeta);
+    }
+
     public function testInviteAcceptanceLinksClassGrantForTheEmail(): void
     {
         $_POST = [ 'password' => 'thistle-marrow-42', 'display_name' => 'Ada', 'birth_year' => '1990' ];

tests/Unit/Auth/RegistrationStatusTest.php

@@ -22,6 +22,12 @@ class RegistrationStatusTest extends TestCase
         Functions\expect('update_user_meta')
             ->once()
             ->with(7, RegistrationStatus::META_CONFIRM_EXPIRES, \Mockery::type('string'));
+        // Explicitly unconfirmed: the account may already have been held (and so
+        // counted as confirmed) by the user_register guard, and this signup did
+        // ask for a confirmation, so it has to be waited for.
+        Functions\expect('delete_user_meta')
+            ->once()
+            ->with(7, RegistrationStatus::META_EMAIL_CONFIRMED);
 
         self::assertSame('rawtoken', RegistrationStatus::markPending(7));
     }
@@ -63,10 +69,34 @@ class RegistrationStatusTest extends TestCase
         Functions\expect('update_user_meta')
             ->once()
             ->with(7, RegistrationStatus::META_AUTO_APPROVE, '1');
+        Functions\expect('delete_user_meta')
+            ->once()
+            ->with(7, RegistrationStatus::META_EMAIL_CONFIRMED);
 
         self::assertSame('rawtoken', RegistrationStatus::markPending(7, true));
     }
 
+    /**
+     * The hold put on a student account that turned up without going through the
+     * studio's signup form. Awaiting approval — so the booking capability is
+     * withheld — but counted as email-confirmed, because no confirmation was ever
+     * asked for and there is no token to answer with: blocking the login instead
+     * would strand the account with no way forward.
+     */
+    public function testHoldMarksAwaitingApprovalWithoutDemandingAConfirmationThatWasNeverSent(): void
+    {
+        Functions\expect('update_user_meta')
+            ->once()
+            ->with(7, RegistrationStatus::META_AWAITING_APPROVAL, '1');
+        Functions\expect('update_user_meta')
+            ->once()
+            ->with(7, RegistrationStatus::META_EMAIL_CONFIRMED, '1');
+        // No token is issued, so nothing is generated and nothing can be spent.
+        Functions\expect('wp_generate_password')->never();
+
+        RegistrationStatus::hold(7);
+    }
+
     public function testIsAutoApproveReadsMeta(): void
     {
         Functions\when('get_user_meta')->alias(static function (int $id, string $key) {

tests/Unit/Booking/BookingEndpointTest.php

@@ -568,9 +568,11 @@ class BookingEndpointTest extends TestCase
         self::assertSame(Lesson::STATUS_CANCELLED, $result->get_data()['status']);
     }
 
-    public function testCancelByAnotherStudentIsForbidden(): void
+    public function testCancelByAnotherStudentAnswersExactlyLikeAnUnknownLesson(): void
     {
-        // Lesson belongs to student 9; current user is 5.
+        // Lesson belongs to student 9; current user is 5. The refusal must be
+        // indistinguishable from testCancelUnknownLessonReturns404 below, or the
+        // pair of answers tells a student which lesson ids exist.
         $lesson = new Lesson(slotId: 10, studentId: 9, instructorId: 3, status: Lesson::STATUS_PENDING, id: 77);
         $this->bookings->shouldReceive('findById')->with(77)->andReturn($lesson);
         $this->bookings->shouldNotReceive('updateStatus');
@@ -579,7 +581,8 @@ class BookingEndpointTest extends TestCase
         $result = $this->endpoint->cancel(new \WP_REST_Request(['id' => 77]));
 
         self::assertInstanceOf(\WP_Error::class, $result);
-        self::assertSame('forbidden', $result->get_error_code());
+        self::assertSame('not_found', $result->get_error_code());
+        self::assertSame(404, $result->error_data['not_found']['status']);
     }
 
     public function testCancelUnknownLessonReturns404(): void
@@ -590,6 +593,7 @@ class BookingEndpointTest extends TestCase
 
         self::assertInstanceOf(\WP_Error::class, $result);
         self::assertSame('not_found', $result->get_error_code());
+        self::assertSame(404, $result->error_data['not_found']['status']);
     }
 
     public function testCancelAlreadyCancelledLessonIsIdempotent(): void

tests/Unit/GroupClass/EnrollmentEndpointTest.php

@@ -224,17 +224,19 @@ class EnrollmentEndpointTest extends TestCase
         self::assertSame(403, $result->error_data['withdrawal_closed']['status']);
     }
 
-    public function testWithdrawRejectsAnotherStudentsEnrolment(): void
+    public function testWithdrawAnswersAnotherStudentsEnrolmentExactlyLikeAnUnknownOne(): void
     {
-        // Enrolment belongs to student 9, but the caller is student 5.
+        // Enrolment belongs to student 9, but the caller is student 5. The refusal
+        // must match testWithdrawReturnsNotFoundForUnknownEnrolment below exactly,
+        // or the two answers together enumerate the studio's enrolments.
         $this->enrollments->shouldReceive('findById')->with(3)->andReturn(new Enrollment(8, 9, 3, Enrollment::STATUS_ACTIVE, 41, 3));
         $this->enrollments->shouldReceive('updateStatus')->never();
 
         $result = $this->endpoint->withdraw(new \WP_REST_Request(['id' => 3]));
 
         self::assertInstanceOf(\WP_Error::class, $result);
-        self::assertSame('forbidden', $result->get_error_code());
-        self::assertSame(403, $result->error_data['forbidden']['status']);
+        self::assertSame('not_found', $result->get_error_code());
+        self::assertSame(404, $result->error_data['not_found']['status']);
     }
 
     public function testWithdrawReturnsNotFoundForUnknownEnrolment(): void

tests/Unit/GroupClass/EnrollmentRepositoryTest.php

@@ -110,6 +110,35 @@ class EnrollmentRepositoryTest extends TestCase
         self::assertInstanceOf(Enrollment::class, $all[0]);
     }
 
+    public function testFindActiveByOfferingReturnsActiveEnrolmentsOldestFirst(): void
+    {
+        $this->db->shouldReceive('prepare')
+            ->once()
+            ->with(
+                Mockery::pattern('/offering_id = %d AND status = %s ORDER BY id ASC/'),
+                'wp_us_group_enrollments',
+                9,
+                Enrollment::STATUS_ACTIVE
+            )
+            ->andReturn('SELECT ...');
+
+        $this->db->shouldReceive('get_results')->andReturn([
+            (object) [
+                'id'            => '7',
+                'offering_id'   => '9',
+                'student_id'    => '5',
+                'instructor_id' => '3',
+                'status'        => Enrollment::STATUS_ACTIVE,
+                'payment_id'    => null,
+            ],
+        ]);
+
+        $found = $this->repo->findActiveByOffering(9);
+
+        self::assertCount(1, $found);
+        self::assertSame(7, $found[0]->id);
+    }
+
     public function testFindActiveByBillingModesJoinsOfferingAndFiltersModes(): void
     {
         $this->db->shouldReceive('prepare')

tests/Unit/Guardian/GuardianServiceTest.php

@@ -5,6 +5,7 @@ namespace Unsupervised\Schedular\Tests\Unit\Guardian;
 
 use Brain\Monkey\Functions;
 use Mockery;
+use Unsupervised\Schedular\Auth\RegistrationStatus;
 use Unsupervised\Schedular\Booking\BookingRepository;
 use Unsupervised\Schedular\GroupClass\EnrollmentRepository;
 use Unsupervised\Schedular\Guardian\GuardianLink;
@@ -96,6 +97,33 @@ class GuardianServiceTest extends TestCase
         self::assertSame('2015', $this->meta[42][GuardianService::META_BIRTH_YEAR]);
     }
 
+    /**
+     * A child is a student account created by someone who is not staff, so the
+     * registration gate holds it on `user_register` exactly as it holds an
+     * anonymous signup. There is nothing here to approve — the account is never
+     * signed in to, and the guardian in front of us is the approval — so the
+     * hold has to come off, or every child a family adds lands in the studio's
+     * review queue.
+     */
+    public function testCreateChildClearsTheHoldTheRegistrationGatePutsOnIt(): void
+    {
+        // Standing in for the user_register hook, which has already run by the
+        // time wp_insert_user() returns.
+        $meta = &$this->meta;
+        Functions\when('wp_insert_user')->alias(
+            static function (array $args) use (&$meta): int {
+                $meta[42][RegistrationStatus::META_AWAITING_APPROVAL] = '1';
+
+                return 42;
+            }
+        );
+
+        $this->guardians->shouldReceive('insert')->once()->andReturn(7);
+
+        self::assertSame(42, $this->service->createChild(5, 'Ada', '2015'));
+        self::assertArrayNotHasKey(RegistrationStatus::META_AWAITING_APPROVAL, $this->meta[42]);
+    }
+
     public function testCreateChildRejectsABlankName(): void
     {
         Functions\expect('wp_insert_user')->never();

tests/Unit/Offering/BillingModeReconcilerTest.php

@@ -0,0 +1,136 @@
+<?php
+declare(strict_types=1);
+
+namespace Unsupervised\Schedular\Tests\Unit\Offering;
+
+use Brain\Monkey\Functions;
+use Mockery;
+use Unsupervised\Schedular\GroupClass\Enrollment;
+use Unsupervised\Schedular\GroupClass\EnrollmentRepository;
+use Unsupervised\Schedular\Offering\BillingModeReconciler;
+use Unsupervised\Schedular\Offering\Offering;
+use Unsupervised\Schedular\Payment\Payment;
+use Unsupervised\Schedular\Payment\PaymentRepository;
+use Unsupervised\Schedular\Tests\Unit\TestCase;
+
+class BillingModeReconcilerTest extends TestCase
+{
+    private EnrollmentRepository&Mockery\MockInterface $enrollments;
+    private PaymentRepository&Mockery\MockInterface $payments;
+    private BillingModeReconciler $reconciler;
+
+    protected function setUp(): void
+    {
+        parent::setUp();
+
+        Functions\when('current_time')->justReturn('2026-09-15 09:00:00');
+
+        $this->enrollments = Mockery::mock(EnrollmentRepository::class);
+        $this->payments    = Mockery::mock(PaymentRepository::class);
+        $this->reconciler  = new BillingModeReconciler($this->enrollments, $this->payments);
+    }
+
+    private function offering(string $billingMode, ?int $id = 9): Offering
+    {
+        return new Offering(
+            instructorId: 3,
+            kind:         Offering::KIND_GROUP_CLASS,
+            title:        'Ensemble',
+            price:        150.0,
+            billingMode:  $billingMode,
+            id:           $id,
+        );
+    }
+
+    private function enrollment(int $id, int $studentId = 5): Enrollment
+    {
+        return new Enrollment(offeringId: 9, studentId: $studentId, instructorId: 3, id: $id);
+    }
+
+    public function testAdoptsUpfrontChargeIntoCurrentMonthWhenClassBecomesMonthly(): void
+    {
+        $this->enrollments->shouldReceive('findActiveByOffering')->with(9)->andReturn([$this->enrollment(7)]);
+
+        $this->payments->shouldReceive('hasUnscheduledCharge')->with(Payment::REG_ENROLLMENT, 7)->andReturn(true);
+        $this->payments->shouldReceive('existsForPeriod')->with(Payment::REG_ENROLLMENT, 7, '2026-09')->andReturn(false);
+
+        // The up-front charge is stamped into 2026-09, due on the 1st, so the scan
+        // treats September as already billed for this enrolment.
+        $this->payments->shouldReceive('claimPeriodForUnscheduled')
+            ->once()
+            ->with(Payment::REG_ENROLLMENT, 7, '2026-09', '2026-09-01')
+            ->andReturn(1);
+
+        self::assertSame(1, $this->reconciler->reconcile($this->offering(Offering::BILLING_ONE_TIME), $this->offering(Offering::BILLING_MONTHLY)));
+    }
+
+    public function testDoesNothingWhenBillingModeDidNotChangeIntoMonthly(): void
+    {
+        $this->enrollments->shouldNotReceive('findActiveByOffering');
+        $this->payments->shouldNotReceive('claimPeriodForUnscheduled');
+
+        // Already monthly -> monthly (e.g. an unrelated title edit): no transition.
+        self::assertSame(0, $this->reconciler->reconcile($this->offering(Offering::BILLING_MONTHLY), $this->offering(Offering::BILLING_MONTHLY)));
+    }
+
+    public function testDoesNothingWhenSwitchingToWeekly(): void
+    {
+        $this->enrollments->shouldNotReceive('findActiveByOffering');
+        $this->payments->shouldNotReceive('claimPeriodForUnscheduled');
+
+        // Weekly bills per session as sessions come due; there is no single upfront
+        // period an enrolment charge maps onto, so it is left alone.
+        self::assertSame(0, $this->reconciler->reconcile($this->offering(Offering::BILLING_ONE_TIME), $this->offering(Offering::BILLING_WEEKLY)));
+    }
+
+    public function testSkipsEnrolmentWithoutAnUpfrontCharge(): void
+    {
+        $this->enrollments->shouldReceive('findActiveByOffering')->with(9)->andReturn([$this->enrollment(7)]);
+
+        // Enrolled after the class was already scheduled, or never charged upfront:
+        // nothing to adopt.
+        $this->payments->shouldReceive('hasUnscheduledCharge')->with(Payment::REG_ENROLLMENT, 7)->andReturn(false);
+        $this->payments->shouldNotReceive('claimPeriodForUnscheduled');
+
+        self::assertSame(0, $this->reconciler->reconcile($this->offering(Offering::BILLING_ONE_TIME), $this->offering(Offering::BILLING_MONTHLY)));
+    }
+
+    public function testSkipsEnrolmentAlreadyBilledForThisMonthByTheScan(): void
+    {
+        $this->enrollments->shouldReceive('findActiveByOffering')->with(9)->andReturn([$this->enrollment(7)]);
+
+        $this->payments->shouldReceive('hasUnscheduledCharge')->with(Payment::REG_ENROLLMENT, 7)->andReturn(true);
+        // The scan already made a 2026-09 charge: adopting the upfront one too would
+        // leave two charges for the month — the very thing we are preventing.
+        $this->payments->shouldReceive('existsForPeriod')->with(Payment::REG_ENROLLMENT, 7, '2026-09')->andReturn(true);
+        $this->payments->shouldNotReceive('claimPeriodForUnscheduled');
+
+        self::assertSame(0, $this->reconciler->reconcile($this->offering(Offering::BILLING_ONE_TIME), $this->offering(Offering::BILLING_MONTHLY)));
+    }
+
+    public function testReconcilesEveryActiveEnrolment(): void
+    {
+        $this->enrollments->shouldReceive('findActiveByOffering')->with(9)
+            ->andReturn([$this->enrollment(7, 5), $this->enrollment(8, 6)]);
+
+        $this->payments->shouldReceive('hasUnscheduledCharge')->with(Payment::REG_ENROLLMENT, 7)->andReturn(true);
+        $this->payments->shouldReceive('existsForPeriod')->with(Payment::REG_ENROLLMENT, 7, '2026-09')->andReturn(false);
+        $this->payments->shouldReceive('claimPeriodForUnscheduled')->with(Payment::REG_ENROLLMENT, 7, '2026-09', '2026-09-01')->andReturn(1);
+
+        $this->payments->shouldReceive('hasUnscheduledCharge')->with(Payment::REG_ENROLLMENT, 8)->andReturn(true);
+        $this->payments->shouldReceive('existsForPeriod')->with(Payment::REG_ENROLLMENT, 8, '2026-09')->andReturn(false);
+        $this->payments->shouldReceive('claimPeriodForUnscheduled')->with(Payment::REG_ENROLLMENT, 8, '2026-09', '2026-09-01')->andReturn(1);
+
+        self::assertSame(2, $this->reconciler->reconcile($this->offering(Offering::BILLING_ONE_TIME), $this->offering(Offering::BILLING_MONTHLY)));
+    }
+
+    public function testIgnoresNonGroupClassOfferings(): void
+    {
+        $before = new Offering(instructorId: 3, kind: Offering::KIND_PRIVATE_LESSON, title: 'Piano', billingMode: Offering::BILLING_ONE_TIME, id: 9);
+        $after  = new Offering(instructorId: 3, kind: Offering::KIND_PRIVATE_LESSON, title: 'Piano', billingMode: Offering::BILLING_MONTHLY, id: 9);
+
+        $this->enrollments->shouldNotReceive('findActiveByOffering');
+
+        self::assertSame(0, $this->reconciler->reconcile($before, $after));
+    }
+}

tests/Unit/Offering/OfferingControllerTest.php

@@ -5,6 +5,7 @@ namespace Unsupervised\Schedular\Tests\Unit\Offering;
 
 use Brain\Monkey\Functions;
 use Mockery;
+use Unsupervised\Schedular\Offering\BillingModeReconciler;
 use Unsupervised\Schedular\Offering\ClassSlotReconciler;
 use Unsupervised\Schedular\Offering\Offering;
 use Unsupervised\Schedular\Offering\OfferingController;
@@ -15,6 +16,7 @@ class OfferingControllerTest extends TestCase
 {
     private OfferingRepository&Mockery\MockInterface $repository;
     private ClassSlotReconciler&Mockery\MockInterface $reconciler;
+    private BillingModeReconciler&Mockery\MockInterface $billingModeReconciler;
     private OfferingController $controller;
 
     protected function setUp(): void
@@ -24,7 +26,9 @@ class OfferingControllerTest extends TestCase
         $this->repository = Mockery::mock(OfferingRepository::class);
         $this->reconciler = Mockery::mock(ClassSlotReconciler::class);
         $this->reconciler->shouldReceive('reconcile')->andReturn(['removed' => 0, 'conflicts' => []])->byDefault();
-        $this->controller = new OfferingController($this->repository, $this->reconciler);
+        $this->billingModeReconciler = Mockery::mock(BillingModeReconciler::class);
+        $this->billingModeReconciler->shouldReceive('reconcile')->andReturn(0)->byDefault();
+        $this->controller = new OfferingController($this->repository, $this->reconciler, $this->billingModeReconciler);
 
         $_POST = [];
         $_GET  = [];

tests/Unit/Offering/OfferingEndpointTest.php

@@ -7,6 +7,7 @@ use Brain\Monkey\Functions;
 use Mockery;
 use Unsupervised\Schedular\Auth\RoleManager;
 use Unsupervised\Schedular\GroupClass\GroupAccessRepository;
+use Unsupervised\Schedular\Offering\BillingModeReconciler;
 use Unsupervised\Schedular\Offering\Offering;
 use Unsupervised\Schedular\Offering\OfferingEndpoint;
 use Unsupervised\Schedular\Offering\OfferingRepository;
@@ -16,6 +17,7 @@ class OfferingEndpointTest extends TestCase
 {
     private OfferingRepository&Mockery\MockInterface $repository;
     private GroupAccessRepository&Mockery\MockInterface $access;
+    private BillingModeReconciler&Mockery\MockInterface $billingModeReconciler;
     private OfferingEndpoint $endpoint;
 
     protected function setUp(): void
@@ -27,7 +29,9 @@ class OfferingEndpointTest extends TestCase
 
         $this->repository = Mockery::mock(OfferingRepository::class);
         $this->access     = Mockery::mock(GroupAccessRepository::class);
-        $this->endpoint   = new OfferingEndpoint($this->repository, $this->access);
+        $this->billingModeReconciler = Mockery::mock(BillingModeReconciler::class);
+        $this->billingModeReconciler->shouldReceive('reconcile')->andReturn(0)->byDefault();
+        $this->endpoint   = new OfferingEndpoint($this->repository, $this->access, $this->billingModeReconciler);
     }
 
     private function group(int $id, string $access): Offering

tests/Unit/Payment/PaymentRepositoryTest.php

@@ -124,6 +124,107 @@ class PaymentRepositoryTest extends TestCase
         self::assertTrue($this->repo->markPaid(50, 'USC-50'));
     }
 
+    public function testMarkNoticedStampsOnlyUnnoticedRowAndReportsTheWin(): void
+    {
+        Functions\expect('current_time')->with('mysql')->andReturn('2026-06-08 12:00:00');
+
+        $this->db->shouldReceive('prepare')
+            ->once()
+            ->with(Mockery::pattern('/SET notice_sent_at = %s WHERE id = %d AND notice_sent_at IS NULL/'), 'wp_us_payments', '2026-06-08 12:00:00', 50)
+            ->andReturn('UPDATE ...');
+
+        // One row updated -> this call won the claim.
+        $this->db->shouldReceive('query')->once()->with('UPDATE ...')->andReturn(1);
+
+        self::assertTrue($this->repo->markNoticed(50));
+    }
+
+    public function testMarkNoticedReturnsFalseWhenAlreadyClaimed(): void
+    {
+        Functions\expect('current_time')->with('mysql')->andReturn('2026-06-08 12:00:00');
+
+        $this->db->shouldReceive('prepare')->once()->andReturn('UPDATE ...');
+        // Zero rows updated -> another run already stamped notice_sent_at.
+        $this->db->shouldReceive('query')->once()->with('UPDATE ...')->andReturn(0);
+
+        self::assertFalse($this->repo->markNoticed(50));
+    }
+
+    public function testBackfillNoticeSentStampsExistingScheduledRowsWhenColumnPresent(): void
+    {
+        $this->db->shouldReceive('prepare')
+            ->once()
+            ->with(Mockery::pattern('/SHOW COLUMNS FROM %i LIKE %s/'), 'wp_us_payments', 'notice_sent_at')
+            ->andReturn('SHOW ...');
+        $this->db->shouldReceive('get_var')->once()->with('SHOW ...')->andReturn('notice_sent_at');
+
+        $this->db->shouldReceive('prepare')
+            ->once()
+            ->with(Mockery::pattern('/SET notice_sent_at = created_at WHERE notice_sent_at IS NULL AND period_key IS NOT NULL/'), 'wp_us_payments')
+            ->andReturn('UPDATE ...');
+        $this->db->shouldReceive('query')->once()->with('UPDATE ...')->andReturn(3);
+
+        self::assertTrue($this->repo->backfillNoticeSent());
+    }
+
+    public function testBackfillNoticeSentIsNoopWhenColumnAbsent(): void
+    {
+        $this->db->shouldReceive('prepare')->once()->andReturn('SHOW ...');
+        $this->db->shouldReceive('get_var')->once()->with('SHOW ...')->andReturn(null);
+
+        // Column not there yet: do not attempt the UPDATE, and report not-done so
+        // the caller does not set its one-time flag before dbDelta has run.
+        $this->db->shouldNotReceive('query');
+
+        self::assertFalse($this->repo->backfillNoticeSent());
+    }
+
+    public function testHasUnscheduledChargeTrueWhenUpfrontChargeExists(): void
+    {
+        $this->db->shouldReceive('prepare')
+            ->once()
+            ->with(Mockery::pattern('/period_key IS NULL AND status != %s/'), 'wp_us_payments', Payment::REG_ENROLLMENT, 7, Payment::STATUS_FAILED)
+            ->andReturn('SELECT ...');
+        $this->db->shouldReceive('get_var')->once()->with('SELECT ...')->andReturn('3');
+
+        self::assertTrue($this->repo->hasUnscheduledCharge(Payment::REG_ENROLLMENT, 7));
+    }
+
+    public function testHasUnscheduledChargeFalseWhenNoneOrOnlyVoided(): void
+    {
+        $this->db->shouldReceive('prepare')->once()->andReturn('SELECT ...');
+        $this->db->shouldReceive('get_var')->once()->andReturn(null);
+
+        self::assertFalse($this->repo->hasUnscheduledCharge(Payment::REG_ENROLLMENT, 7));
+    }
+
+    public function testClaimPeriodForUnscheduledStampsPeriodAndDueDate(): void
+    {
+        $this->db->shouldReceive('prepare')
+            ->once()
+            ->with(
+                Mockery::pattern('/SET period_key = %s, due_date = %s.*period_key IS NULL AND status != %s/s'),
+                'wp_us_payments',
+                '2026-09',
+                '2026-09-01',
+                Payment::REG_ENROLLMENT,
+                7,
+                Payment::STATUS_FAILED
+            )
+            ->andReturn('UPDATE ...');
+        $this->db->shouldReceive('query')->once()->with('UPDATE ...')->andReturn(1);
+
+        self::assertSame(1, $this->repo->claimPeriodForUnscheduled(Payment::REG_ENROLLMENT, 7, '2026-09', '2026-09-01'));
+    }
+
+    public function testClaimPeriodForUnscheduledAdoptsNothingWhenNoMatch(): void
+    {
+        $this->db->shouldReceive('prepare')->once()->andReturn('UPDATE ...');
+        $this->db->shouldReceive('query')->once()->with('UPDATE ...')->andReturn(0);
+
+        self::assertSame(0, $this->repo->claimPeriodForUnscheduled(Payment::REG_ENROLLMENT, 7, '2026-09', '2026-09-01'));
+    }
+
     public function testUpdateTaxRecomputesAmountFromRate(): void
     {
         $this->db->shouldReceive('prepare')

tests/Unit/Payment/PaymentTest.php

@@ -45,6 +45,7 @@ class PaymentTest extends TestCase
             'stripe_payment_intent_id' => null,
             'receipt_number'           => 'USC-7',
             'receipt_sent_at'          => null,
+            'notice_sent_at'           => '2026-06-07 08:00:00',
             'paid_at'                  => '2026-06-08 10:00:00',
             'created_at'               => '2026-06-08 09:00:00',
         ]);
@@ -56,6 +57,7 @@ class PaymentTest extends TestCase
         self::assertSame(Payment::METHOD_COMP, $payment->method);
         self::assertTrue($payment->isPaid());
         self::assertSame('USC-7', $payment->receiptNumber);
+        self::assertSame('2026-06-07 08:00:00', $payment->noticeSentAt);
         self::assertSame('2026-06-08 09:00:00', $payment->createdAt);
     }
 

tests/Unit/Payment/ScheduledBillingRunnerTest.php

@@ -44,6 +44,9 @@ class ScheduledBillingRunnerTest extends TestCase
         $this->payments->shouldReceive('assignNoticeBatch')->byDefault();
         // No account credit unless a test says otherwise.
         $this->payments->shouldReceive('applyCredits')->andReturn([])->byDefault();
+        // Every payment wins its notice claim unless a test simulates an
+        // overlapping run that already claimed it.
+        $this->payments->shouldReceive('markNoticed')->andReturn(true)->byDefault();
 
         Functions\when('wp_generate_uuid4')->justReturn('abcdef12-3456-7890-abcd-ef1234567890');
 
@@ -324,6 +327,62 @@ class ScheduledBillingRunnerTest extends TestCase
         $this->runner->run();
     }
 
+    /**
+     * A payment is emailed exactly once. WP-Cron fires on request and can run the
+     * scan twice concurrently; the second run reaching the send step for a
+     * payment already claimed by the first (markNoticed returns false) must not
+     * email it again, nor re-batch it. This is the double-notice regression.
+     */
+    public function testDoesNotEmailAPaymentWhoseNoticeWasAlreadyClaimed(): void
+    {
+        $this->now('2026-07-15 09:00:00');
+        $this->bookings->shouldReceive('findUnbilledScheduledLessons')
+            ->andReturn([ $this->lessonRow(101, Offering::BILLING_WEEKLY, '2026-07-15 18:00:00', 35.0) ]);
+
+        $this->payments->shouldReceive('createForRegistration')->once()->andReturn($this->pending(500, '2026-07-14'));
+
+        // The competing run already stamped notice_sent_at, so the claim loses.
+        $this->payments->shouldReceive('markNoticed')->with(500)->once()->andReturn(false);
+
+        // No credit, no batch, no email for an already-noticed payment.
+        $this->payments->shouldNotReceive('applyCredits');
+        $this->payments->shouldNotReceive('assignNoticeBatch');
+        $this->mailer->shouldNotReceive('send');
+
+        $this->runner->run();
+    }
+
+    /**
+     * When only some of a payer's charges are already claimed, the run notices
+     * the rest — the still-unclaimed payment is emailed and batched on its own.
+     */
+    public function testEmailsOnlyTheStillUnclaimedPaymentsInABucket(): void
+    {
+        $this->now('2026-07-15 09:00:00');
+
+        $one = $this->lessonRow(101, Offering::BILLING_WEEKLY, '2026-07-15 18:00:00', 35.0);
+        $two = $this->lessonRow(102, Offering::BILLING_WEEKLY, '2026-07-15 19:00:00', 35.0);
+        $this->bookings->shouldReceive('findUnbilledScheduledLessons')->andReturn([$one, $two]);
+
+        $this->payments->shouldReceive('createForRegistration')
+            ->andReturn($this->pending(500, '2026-07-14'), $this->pending(501, '2026-07-14'));
+
+        // 500 already claimed by an overlapping run; 501 is this run's to send.
+        $this->payments->shouldReceive('markNoticed')->with(500)->once()->andReturn(false);
+        $this->payments->shouldReceive('markNoticed')->with(501)->once()->andReturn(true);
+
+        $this->payments->shouldReceive('applyCredits')
+            ->once()
+            ->with(5, Mockery::on(static fn (array $p): bool => count($p) === 1 && (int) $p[0]->id === 501))
+            ->andReturn([]);
+        $this->payments->shouldReceive('assignNoticeBatch')->once()->with([501], Mockery::type('string'));
+        $this->mailer->shouldReceive('send')
+            ->once()
+            ->with(Mockery::type(\WP_User::class), Mockery::on(static fn (array $items): bool => count($items) === 1), Mockery::type('string'), 0.0);
+
+        $this->runner->run();
+    }
+
     private function groupOffering(string $mode, string $termStart, string $termEnd): Offering
     {
         return new Offering(

tests/Unit/UninstallerTest.php

@@ -0,0 +1,243 @@
+<?php
+declare(strict_types=1);
+
+namespace Unsupervised\Schedular\Tests\Unit;
+
+use Brain\Monkey\Functions;
+use Mockery;
+use Unsupervised\Schedular\Auth\RoleManager;
+use Unsupervised\Schedular\Payment\ScheduledBillingRunner;
+use Unsupervised\Schedular\Payment\StudioSettings;
+use Unsupervised\Schedular\Schema;
+use Unsupervised\Schedular\Uninstaller;
+
+class UninstallerTest extends TestCase
+{
+    /** @var array<string, mixed> Option store the stubs read and write. */
+    private array $options = [];
+
+    /** @var list<string> Options deleted during the run. */
+    private array $deleted = [];
+
+    /** @var list<string> SQL statements sent to the database. */
+    private array $queries = [];
+
+    /** @var list<string> User meta keys deleted for every user. */
+    private array $metaDeleted = [];
+
+    /** @var list<string> Roles removed. */
+    private array $rolesRemoved = [];
+
+    /** @var list<string> Cron hooks cleared. */
+    private array $hooksCleared = [];
+
+    protected function setUp(): void
+    {
+        parent::setUp();
+
+        $options      = &$this->options;
+        $deleted      = &$this->deleted;
+        $metaDeleted  = &$this->metaDeleted;
+        $rolesRemoved = &$this->rolesRemoved;
+        $hooksCleared = &$this->hooksCleared;
+
+        // A regular closure, not an arrow fn: arrow functions capture by value,
+        // so every read would answer from a snapshot of the options taken at
+        // setUp — before the test set any, and before the run wrote any.
+        Functions\when('get_option')->alias(
+            static function (string $key, mixed $default = false) use (&$options): mixed {
+                return $options[$key] ?? $default;
+            }
+        );
+        Functions\when('update_option')->alias(
+            static function (string $key, mixed $value) use (&$options): bool {
+                $options[$key] = $value;
+
+                return true;
+            }
+        );
+        Functions\when('delete_option')->alias(
+            static function (string $key) use (&$options, &$deleted): bool {
+                unset($options[$key]);
+                $deleted[] = $key;
+
+                return true;
+            }
+        );
+        Functions\when('delete_transient')->justReturn(true);
+        Functions\when('wp_clear_scheduled_hook')->alias(
+            static function (string $hook) use (&$hooksCleared): int {
+                $hooksCleared[] = $hook;
+
+                return 0;
+            }
+        );
+        Functions\when('delete_metadata')->alias(
+            static function (string $type, int $id, string $key) use (&$metaDeleted): bool {
+                $metaDeleted[] = $key;
+
+                return true;
+            }
+        );
+        Functions\when('remove_role')->alias(
+            static function (string $role) use (&$rolesRemoved): void {
+                $rolesRemoved[] = $role;
+            }
+        );
+
+        $db         = Mockery::mock(\wpdb::class);
+        $db->prefix = 'wp_';
+        $queries    = &$this->queries;
+        $db->shouldReceive('prepare')->andReturnUsing(
+            static fn(string $sql, mixed ...$args): string => str_replace('%i', (string) $args[0], $sql)
+        );
+        $db->shouldReceive('query')->andReturnUsing(
+            static function (string $sql) use (&$queries): int {
+                $queries[] = $sql;
+
+                return 1;
+            }
+        );
+
+        $GLOBALS['wpdb'] = $db;
+    }
+
+    protected function tearDown(): void
+    {
+        unset($GLOBALS['wpdb']);
+        parent::tearDown();
+    }
+
+    /**
+     * A Stripe secret is a credential, not a record. It can be pasted back in
+     * from the Stripe dashboard in a minute, and a site that no longer has the
+     * code to use it has no business still holding it — so it goes whether or
+     * not the studio asked to keep its data.
+     */
+    public function testStripeCredentialsAreForgottenEvenWhenTheDataIsKept(): void
+    {
+        $this->options = [
+            StudioSettings::OPT_SECRET         => 'sk_live_secret',
+            StudioSettings::OPT_WEBHOOK_SECRET => 'whsec_secret',
+            StudioSettings::OPT_PUBLISHABLE    => 'pk_live_key',
+            StudioSettings::OPT_MODE           => 'live',
+            StudioSettings::OPT_HST_RATE       => '13',
+        ];
+
+        (new Uninstaller())->run();
+
+        self::assertArrayNotHasKey(StudioSettings::OPT_SECRET, $this->options);
+        self::assertArrayNotHasKey(StudioSettings::OPT_WEBHOOK_SECRET, $this->options);
+        self::assertArrayNotHasKey(StudioSettings::OPT_PUBLISHABLE, $this->options);
+        self::assertArrayNotHasKey(StudioSettings::OPT_MODE, $this->options);
+
+        // The studio's own settings are records, and stay.
+        self::assertSame('13', $this->options[StudioSettings::OPT_HST_RATE]);
+    }
+
+    public function testKeepingDataDropsNoTablesAndRemovesNoRoles(): void
+    {
+        $this->options = [Uninstaller::OPT_DELETE_DATA => '0'];
+
+        (new Uninstaller())->run();
+
+        self::assertSame([], $this->queries);
+        self::assertSame([], $this->metaDeleted);
+        // A site keeping its data keeps the roles its students hold, or every one
+        // of them is left with no capabilities until the plugin is reinstalled.
+        self::assertSame([], $this->rolesRemoved);
+    }
+
+    public function testFullPurgeDropsEveryTableTheSchemaDeclares(): void
+    {
+        $this->options = [Uninstaller::OPT_DELETE_DATA => '1'];
+
+        (new Uninstaller())->run();
+
+        self::assertCount(count(Schema::TABLES), $this->queries);
+        foreach (Schema::TABLES as $table) {
+            self::assertContains('DROP TABLE IF EXISTS wp_' . $table, $this->queries);
+        }
+    }
+
+    public function testFullPurgeClearsSettingsUserMetaAndRoles(): void
+    {
+        $this->options = [
+            Uninstaller::OPT_DELETE_DATA   => '1',
+            'us_schedular_version'         => '1.5.6',
+            StudioSettings::OPT_HST_RATE   => '13',
+            StudioSettings::OPT_CURRENCY   => 'CAD',
+        ];
+
+        (new Uninstaller())->run();
+
+        self::assertContains('us_schedular_version', $this->deleted);
+        self::assertContains(StudioSettings::OPT_HST_RATE, $this->deleted);
+        self::assertContains(Uninstaller::OPT_DELETE_DATA, $this->deleted);
+
+        // Nothing student-shaped is left hanging off a user account.
+        self::assertContains('us_payment_method', $this->metaDeleted);
+        self::assertContains('us_child', $this->metaDeleted);
+        self::assertContains('us_awaiting_approval', $this->metaDeleted);
+
+        self::assertSame(
+            [RoleManager::STUDIO_ADMIN, RoleManager::INSTRUCTOR, RoleManager::STUDENT],
+            $this->rolesRemoved
+        );
+    }
+
+    /**
+     * Open registration switches the site's own `users_can_register` on and makes
+     * Student the default role. Leaving those behind would leave the site taking
+     * public signups into a role that is, one line later, about to stop existing.
+     */
+    public function testCoreRegistrationSettingsAreRestoredFromTheSnapshot(): void
+    {
+        $this->options = [
+            'users_can_register'                        => '1',
+            'default_role'                              => RoleManager::STUDENT,
+            StudioSettings::OPT_PREV_USERS_CAN_REGISTER => '0',
+            StudioSettings::OPT_PREV_DEFAULT_ROLE       => 'subscriber',
+        ];
+
+        (new Uninstaller())->run();
+
+        self::assertSame('0', $this->options['users_can_register']);
+        self::assertSame('subscriber', $this->options['default_role']);
+        // The snapshot is spent.
+        self::assertArrayNotHasKey(StudioSettings::OPT_PREV_USERS_CAN_REGISTER, $this->options);
+        self::assertArrayNotHasKey(StudioSettings::OPT_PREV_DEFAULT_ROLE, $this->options);
+    }
+
+    public function testSiteThatNeverOpenedRegistrationKeepsItsOwnSettings(): void
+    {
+        $this->options = ['users_can_register' => '1', 'default_role' => 'contributor'];
+
+        (new Uninstaller())->run();
+
+        // No snapshot means the plugin never touched these, so nor does this.
+        self::assertSame('1', $this->options['users_can_register']);
+        self::assertSame('contributor', $this->options['default_role']);
+    }
+
+    public function testTheScheduledBillingEventIsAlwaysCleared(): void
+    {
+        // Deactivation clears it too, and always precedes a delete — but a site
+        // whose plugin files simply vanished never ran that hook, and a schedule
+        // pointing at code that is gone is left firing into nothing.
+        (new Uninstaller())->run();
+
+        self::assertSame([ScheduledBillingRunner::HOOK], $this->hooksCleared);
+    }
+
+    public function testSettingIsOffUntilItIsExplicitlyTurnedOn(): void
+    {
+        self::assertFalse(Uninstaller::deletesDataOnUninstall());
+
+        Uninstaller::setDeletesDataOnUninstall(true);
+        self::assertTrue(Uninstaller::deletesDataOnUninstall());
+
+        Uninstaller::setDeletesDataOnUninstall(false);
+        self::assertFalse(Uninstaller::deletesDataOnUninstall());
+    }
+}

tests/Unit/Update/UpdateCheckerTest.php

@@ -13,6 +13,17 @@ class UpdateCheckerTest extends TestCase
     private const PLUGIN_FILE = 'unsupervised-schedular/unsupervised-schedular.php';
     private const PACKAGE_URL = 'https://git.unsupervised.ca/attachments/abc123';
 
+    protected function setUp(): void
+    {
+        parent::setUp();
+
+        // The package URL is checked against the release host before it is
+        // offered to core, so every path through provideUpdate() reaches this.
+        Functions\when('wp_parse_url')->alias(
+            static fn(string $url, int $component = -1): mixed => parse_url($url, $component)
+        );
+    }
+
     /** Stub a successful Gitea API response with the given decoded body. */
     private function stubApiResponse(int $code, mixed $body): void
     {
@@ -217,6 +228,63 @@ class UpdateCheckerTest extends TestCase
         self::assertSame($this->noUpdatePayload(), $result);
     }
 
+    /**
+     * A package URL is code core will download and unpack over the installed
+     * plugin, so an answer naming somewhere other than the release host is not
+     * an update — whoever gave it, and however plausible the version.
+     *
+     * @dataProvider untrustedPackageUrls
+     */
+    public function testPackageHostedAnywhereButTheReleaseHostIsRefused(string $url): void
+    {
+        Functions\when('plugin_basename')->justReturn(self::PLUGIN_FILE);
+        Functions\when('get_transient')->justReturn(false);
+        Functions\when('set_transient')->justReturn(true);
+        $this->stubApiResponse(200, $this->release('v9.9.9', [
+            ['name' => 'unsupervised-schedular-9.9.9.zip', 'browser_download_url' => $url],
+        ]));
+
+        $result = (new UpdateChecker())->provideUpdate(false, [], self::PLUGIN_FILE);
+
+        // Refused exactly as a release with no zip at all: nothing to install,
+        // and the plugin stays in `no_update` so the toggle does not vanish.
+        self::assertSame($this->noUpdatePayload(), $result);
+    }
+
+    /** @return array<string, array{string}> */
+    public static function untrustedPackageUrls(): array
+    {
+        return [
+            'unrelated host'      => ['https://evil.test/unsupervised-schedular-9.9.9.zip'],
+            // Would pass a naive "contains" or "ends with" check.
+            'lookalike prefix'    => ['https://evil-git.unsupervised.ca/plugin.zip'],
+            'lookalike suffix'    => ['https://git.unsupervised.ca.evil.test/plugin.zip'],
+            'subdomain'           => ['https://cdn.git.unsupervised.ca/plugin.zip'],
+            'credentials in host' => ['https://[email protected]/plugin.zip'],
+            'plain http'          => ['http://git.unsupervised.ca/attachments/abc123'],
+            'no scheme'           => ['git.unsupervised.ca/attachments/abc123'],
+            'empty'               => [''],
+        ];
+    }
+
+    public function testAZipFromTheReleaseHostIsStillOfferedAfterAnUntrustedOne(): void
+    {
+        Functions\when('plugin_basename')->justReturn(self::PLUGIN_FILE);
+        Functions\when('get_transient')->justReturn(false);
+        Functions\when('set_transient')->justReturn(true);
+        $this->stubApiResponse(200, $this->release('v9.9.9', [
+            ['name' => 'decoy.zip', 'browser_download_url' => 'https://evil.test/decoy.zip'],
+            $this->zipAsset(),
+        ]));
+
+        $result = (new UpdateChecker())->provideUpdate(false, [], self::PLUGIN_FILE);
+
+        // The scan does not stop at the first zip it sees — it stops at the
+        // first one it would actually install.
+        self::assertIsArray($result);
+        self::assertSame(self::PACKAGE_URL, $result['package']);
+    }
+
     public function testMalformedApiBodyOffersNoUpdatePayload(): void
     {
         Functions\when('plugin_basename')->justReturn(self::PLUGIN_FILE);

uninstall.php

@@ -1,19 +1,14 @@
 <?php
 declare(strict_types=1);
 
+use Unsupervised\Schedular\Uninstaller;
+
 if (! defined('WP_UNINSTALL_PLUGIN')) {
     exit;
 }
 
 require_once plugin_dir_path(__FILE__) . 'vendor/autoload.php';
 
-global $wpdb;
-
-$wpdb->query("DROP TABLE IF EXISTS {$wpdb->prefix}us_lessons");
-$wpdb->query("DROP TABLE IF EXISTS {$wpdb->prefix}us_availability");
-
-remove_role('us_instructor');
-remove_role('us_student');
-
-delete_option('us_schedular_version');
-delete_transient('us_schedular_latest_release');
+// What this does and does not take with it is decided on Access → Plugin
+// removal, and explained in full in Uninstaller.
+(new Uninstaller())->run();

unsupervised-schedular.php

@@ -3,7 +3,7 @@
  * Plugin Name: Unsupervised Scheduler
  * Plugin URI:  https://git.unsupervised.ca/Unsupervised/unsupervised-scheduler
  * Description: Instructor/student lesson scheduling for WordPress.
- * Version:     1.5.5
+ * Version:     1.5.8
  * Requires at least: 6.2
  * Requires PHP: 8.1
  * Author:      Unsupervised
@@ -21,7 +21,7 @@ if (! defined('ABSPATH')) {
     exit;
 }
 
-define('USC_VERSION', '1.5.5');
+define('USC_VERSION', '1.5.8');
 define('USC_PLUGIN_FILE', __FILE__);
 define('USC_PLUGIN_DIR', plugin_dir_path(__FILE__));
 define('USC_PLUGIN_URL', plugin_dir_url(__FILE__));