diff --git a/CHANGELOG.md b/CHANGELOG.md
index 4fd79e2..9e665f5 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -4,9 +4,912 @@ All notable changes to this project will be documented in this file.
 
 The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/).
 
+## [0.18.0] - 2026-09-16
+
+### Added
+
+Customer-portal backend groundwork — no routes/controllers/views yet (a storefront-facing UI is
+3dealer's job once a frontend designer picks it up), but the boboko-owned services it needs to
+call now exist:
+
+- `Modules\Core\Auth\Services\UserOtpService::validate()` now actually logs the shopper in
+  (`Auth::login()`, `web` guard) — previously it only returned the `User` model with no session
+  established and no route/controller anywhere ever called it (the checkout page's "Login" tab
+  was a disabled placeholder). `Auth::login()` alone is enough to merge/associate any active
+  guest cart too — it fires `Illuminate\Auth\Events\Login`, which Lunar's own
+  `Lunar\Listeners\CartSessionAuthListener` (registered unconditionally in core, no opt-in
+  needed) already reacts to, honoring `config('lunar.cart.auth_policy')` (`'merge'` by default).
+  An earlier draft of this also called `Cart::associate()` directly from this service — removed
+  as redundant and actually wrong: it ran a second, separate association with a hardcoded
+  `'merge'` policy that ignored whatever a consumer had actually set `auth_policy` to. Also fixed
+  an unbounded brute-force window: a 6-digit code (1M combinations, was guessable for its full
+  10-minute expiry with no attempt cap) now invalidates itself after 5 wrong guesses
+  (`users.otp_attempts`, new column), forcing a fresh code request rather than leaving a live one
+  guessable indefinitely.
+- `Modules\Core\Auth\Events\CustomerLoggedIn` — dispatched on every successful OTP login (new
+  user or returning), for a storefront to hook into (e.g. post-login redirect, analytics).
+- `Modules\Core\Customer\Services\CustomerAccountService` — the storefront-facing "My Account"
+  API (mirrors `CartService`/`CheckoutService`'s shape): `orders()` (paginated, placed orders
+  only), `order()`, `addresses()`, `createAddress()`/`updateAddress()`/`deleteAddress()`,
+  `updateProfile()`. Every method is scoped to the given user's own `latestCustomer()` — there
+  is no method that accepts a bare order/address id without also requiring the owning user, so a
+  controller built on top of this can't leak one customer's data to another by trusting a
+  client-supplied id alone (verified live: a second customer attempting to read/edit the first's
+  address or order gets `AddressNotFoundException`/`OrderNotFoundException`, not the record).
+
+### Fixed
+- `Modules\Core\Auth\Services\UserOtpService::validate()`'s wrong-guess counter (`otp_attempts`)
+  was read-check-increment-saved with no locking — two guesses fired in parallel for the same
+  user could each read the same pre-increment value and both save past `max_attempts`, letting an
+  attacker exceed the 5-guess lockout by parallelizing requests instead of sending them serially.
+  Now wrapped in a `DB::transaction()` with `lockForUpdate()` on the user row, so concurrent
+  guesses serialize correctly against the shared counter.
+- The OTP code comparison used a plain `!=` rather than a timing-safe comparison. Now
+  `hash_equals()`.
+
+## [0.17.5] - 2026-09-15
+
+### Added
+
+- Greek translations for `Lunar\Models\Country`/`State` reference data (`lang/el/countries.php`,
+  `lang/el/states.php`), keyed by the exact English spellings Lunar's own installer seeds for
+  Greece (fetched from `data.lunarphp.io/countries+states.json`). Loaded via
+  `loadTranslationsFrom()` under the `core::` namespace — a plain lang file, not
+  `Modules\Core\Localization`'s DB-backed `TranslationService`, since this is fixed reference
+  data, not admin-editable UI copy. A consuming app's storefront looks these up itself (e.g.
+  `__('core::countries.'.$country->name)`) — core has no storefront UI of its own to wire this
+  into.
+- `Modules\Core\Order\Filament\Extensions\OrderActionsExtension::fixCaptureAction()` — reroutes
+  the backoffice "Capture" header action through `Modules\Core\Payment\Support\
+TransactionDriverAdapter::capture()`, the same app-level payment pipeline checkout-time captures
+  use, instead of vendor Lunar's `Lunar\Models\Transaction::capture()` (which resolved
+  `Lunar\Facades\Payments`, an entirely separate, unused driver registry, and never dispatched
+  `Modules\Core\Payment\Events\PaymentCaptured`).
+- `Modules\Core\Payment\Drivers\StripePaymentDriver::cardMetaFromIntent()` — extracts card
+  brand/last-four digits from the Stripe PaymentIntent's `latest_charge`, populated into
+  `PaymentResult::$meta` and mapped onto `Transaction.card_type`/`last_four` by
+  `Modules\Core\Order\Services\TransactionRecorder`. Fixes the admin activity log's "Payment of
+  :amount on card ending :last_four" line rendering with no digits, on both checkout-time and
+  manual captures. Only applies to transactions recorded after this change.
+- `PaymentMethod.name` and `Lunar\Shipping\Models\ShippingMethod.name` are now locale-keyed JSON
+  columns, rendered in Filament via Lunar's own `Lunar\Admin\Support\Forms\Components\
+TranslatedText` — one input per configured `Language` row, same shape/resolution as
+  Product/Collection names. Existing plain-string rows are preserved under the store's default
+  language on migration. `ShippingMethod` has no model cast/`ModelManifest` extension point
+  available (vendor table, `Contracts\ShippingMethod` exists but is never bound by the package),
+  so its translation is decoded/encoded at the Filament field boundary and via the new
+  `Modules\Core\Shipping\Support\ShippingMethodName::resolve()` helper, rather than a model cast.
+- `Modules\Core\Shipping\Contracts\DeclaresFulfillmentType` — lets a shipping rate driver declare
+  whether it fulfils via carrier delivery or in-store pickup as a hardcoded fact about the driver
+  (`AcsRateDriver`, `BoxNowRateDriver` both declare `'carrier'`), instead of asking a merchant to
+  also pick "Carrier delivery" on every row regardless of driver. The merchant-facing "Fulfillment
+  type" Select (`ShippingMethod.data['fulfillment_type']`) now only appears for
+  table-rate-shipping's generic drivers (flat-rate, ship-by, free-shipping), which are genuinely
+  ambiguous, and moved next to `charge_by` instead of trailing at the end of the form,
+  disconnected from the decisions it relates to. `Modules\Core\Shipping\Support\
+FulfillmentType::resolve()`/`isStorePickup()` is the new single source of truth, replacing a
+  direct `data['fulfillment_type']` read in `Order::isStorePickupOrder()`.
+
+### Fixed
+
+- `Modules\Core\Order\Listeners\ApplyResolvedPaymentStatus` never advanced `Order::status` past
+  `awaiting_payment` on a capture — only `paid`/`paid_at` were written, so a fully captured order
+  could sit indefinitely at "awaiting payment" until a staff member manually clicked "Update
+  Status". Now, on `PaymentCaptured` (not `PaymentAuthorized`), `status` advances to the next step
+  in the order's flow, but only when it's still exactly `awaiting_payment`, so a duplicate/delayed
+  capture event never regresses an order staff already moved further.
+- `Lunar\DataTypes\ShippingOption::$collect` (the flag `docs/checkout.md` documents as the
+  mechanism for detecting a pickup option at checkout) was never actually set by any shipping rate
+  driver — `Modules\Core\Shipping\Concerns\ResolvesFixedPricing` now populates it from the same
+  `FulfillmentType` resolution `Order::isStorePickupOrder()` uses, closing a real gap between
+  documented and actual behavior.
+
+### Changed
+
+- `Modules\Core\Order\Filament\Extensions\OrderRefundActionsExtension` renamed to
+  `OrderActionsExtension` — the class now fixes both the refund and capture header actions on the
+  order page, not just refund.
+- Removed the `lunarphp/stripe` dependency in favour of depending on `stripe/stripe-php` directly.
+  `Modules\Core\Payment\Drivers\StripePaymentDriver` had already replaced every bit of Lunar's own
+  Stripe payment flow (checkout, webhook processing) with its own — all that remained load-bearing
+  from the package was raw API-client access, amount conversion, and a correlation table, none of
+  which are Lunar-specific. Added first-party replacements: `Modules\Core\Payment\Support\
+StripeManager`, `Modules\Core\Payment\Models\StripePaymentIntent`, `Modules\Core\Payment\Http\
+Middleware\StripeWebhookMiddleware`, and a first-party copy of the vendor's
+  `create_stripe_payment_intents_table` migration (guarded with `Schema::hasTable()`). No behavior
+  change for consuming apps.
+
+## [0.17.4] - 2026-09-15
+
+### Added
+
+- `boboko:catalog:backfill-skus` — one-off Artisan command to generate a SKU
+  (`SKU-P{product_id}-V{variant_id}`) for every `Lunar\Models\ProductVariant` left with a `null`
+  SKU by the earlier Shopify import (the source export's `Variant SKU` column was genuinely blank
+  for these rows, not an importer mapping bug — see `Modules\MigrateImport\Shopify\
+ShopifyExportImporter`). Only touches variants missing a SKU; `--dry-run` lists what would
+  change without writing.
+
+## [0.17.3] - 2026-09-15
+
+### Changed
+
+- Removed the `lunarphp/stripe` dependency in favour of depending on `stripe/stripe-php` directly.
+  `Modules\Core\Payment\Drivers\StripePaymentDriver` had already replaced every bit of Lunar's own
+  Stripe payment flow (checkout, webhook processing) with its own — all that remained load-bearing
+  from the package was raw API-client access, amount conversion, and a correlation table, none of
+  which are Lunar-specific. Added first-party replacements: `Modules\Core\Payment\Support\
+StripeManager` (API client + `toStripeAmount()`/`fromStripeAmount()`), `Modules\Core\Payment\
+Models\StripePaymentIntent` (now with a proper `context` array cast, replacing manual
+  `json_encode`/`json_decode`), and `Modules\Core\Payment\Http\Middleware\
+StripeWebhookMiddleware`. Added `database/migrations/..._create_stripe_payment_intents_table.php`,
+  a first-party copy of the vendor migration (guarded with `Schema::hasTable()` so it's a no-op on
+  any environment that already has the table from the vendor package's own earlier migration run,
+  and only actually creates it on a genuinely fresh install). No behavior change for consuming
+  apps — same table, same driver contract, same webhook endpoint.
+
+## [0.17.2] - 2026-09-15
+
+### Fixed
+
+- `Modules\Core\Order\Listeners\ApplyResolvedPaymentStatus` never advanced `Order::status` past
+  `awaiting_payment` on a capture — only `paid`/`paid_at` were written, so a fully captured order
+  could sit indefinitely at "awaiting payment" until a staff member manually clicked "Update
+  Status". Now, on `PaymentCaptured` (not `PaymentAuthorized` — an authorization isn't yet
+  captured funds), `status` advances to the next step in the order's flow
+  (`Modules\Core\Order\Services\OrderStatusFlow::nextOptions()`) — but only when it's still
+  exactly `awaiting_payment`, so a duplicate/delayed capture event never regresses an order staff
+  already moved further.
+- The backoffice "Capture" action on the order page (Filament) called vendor Lunar's
+  `Lunar\Models\Transaction::capture()` directly, which resolves `Lunar\Facades\Payments` — an
+  entirely separate, unused driver registry — and never dispatched `Modules\Core\Payment\Events\
+PaymentCaptured`. This meant a manual capture from the admin panel never ran this app's own
+  payment pipeline at all (including the status-advance fix above). `Modules\Core\Order\Filament\
+Extensions\OrderActionsExtension` (renamed from `OrderRefundActionsExtension`, since it now
+  fixes both the refund and capture header actions — see below) now routes capture through
+  `Modules\Core\Payment\Support\TransactionDriverAdapter::capture()`, the same app-level path
+  checkout-time captures use.
+- `Modules\Core\Payment\Drivers\StripePaymentDriver` never extracted a card's brand/last four
+  digits from Stripe's response, so `Lunar\Models\Transaction::card_type`/`last_four` were always
+  empty and the admin's "Payment of :amount on card ending :last_four" activity-log line rendered
+  with no digits — reproduced on both checkout-time and manual captures. Added
+  `cardMetaFromIntent()`, reading `payment_method_details` off the PaymentIntent's `latest_charge`
+  (same source `lunarphp/stripe`'s own `StoreCharges` uses), populated into `PaymentResult::$meta`
+  from `resultFromIntent()` and `capture()`. `Modules\Core\Order\Services\TransactionRecorder`
+  now maps `meta['card_type']`/`meta['last_four']` onto the `Transaction` row. Only applies to
+  transactions recorded after this change — existing rows are not backfilled.
+
+### Changed
+
+- `Modules\Core\Order\Filament\Extensions\OrderRefundActionsExtension` renamed to
+  `OrderActionsExtension` — the class now fixes both the refund and capture header actions on the
+  order page, not just refund, so the old name undersold its scope.
+
+## [0.17.1] - 2026-09-15
+
+### Fixed
+
+- `Modules\Core\Payment\Drivers\StripePaymentDriver::createAndConfirm()` only set
+  `automatic_payment_methods` when no `payment_method` was given — the actual checkout flow always
+  sends one, so it was omitted, and Stripe fell back to whatever payment methods are enabled in the
+  Dashboard and demanded a `return_url` on confirm. Fixed by setting `automatic_payment_methods`
+  unconditionally with `allow_redirects: never` — the storefront's Payment Element already restricts
+  itself to `paymentMethodTypes: ['card']`, so this just tells Stripe the same thing server-side,
+  which drops the `return_url` requirement.
+
+## [0.17.0] - 2026-09-14
+
+### Added
+
+- `Modules\Core\Order\Notifications\OrderPlacedNotification` — an order confirmation email,
+  registered against `Modules\Core\Checkout\Events\OrderPlaced` (fires exactly once per order,
+  regardless of `capture_mode`/driver). Previously only a Stripe (auto-captured) order triggered
+  any placement email at all, via `OrderCapturedNotification` — a different concern (payment
+  confirmation) that happened to fire at the same moment for that one driver; an offline or
+  bank-transfer order got no confirmation whatsoever. Verified live via Mailpit.
+- `Modules\Core\Order\Listeners\DecrementStockOnOrderPlaced` — also wired to `OrderPlaced`, the
+  first stock decrement anywhere in this codebase (previously nothing wrote to
+  `ProductVariant::stock` as a result of an order at all — overselling was possible). A single
+  atomic `UPDATE ... SET stock = GREATEST(stock - qty, 0)` per variant, not a read-then-write on
+  the Eloquent model, to avoid a lost-update race between two orders decrementing the same variant
+  concurrently. Only touches `purchasable === 'in_stock'` variants on `physical` order lines —
+  `always`/`backorder` variants are deliberately left alone (their stock has no purchasing
+  consequence, decrementing it would just make the column an inaccurate negative number). Also
+  re-triggers Scout reindexing for every affected product, closing the gap `Modules\Core\Catalog\
+Services\ProductIndexer`'s own docblock flagged ("nothing currently reindexes a product when an
+  order decrements its stock") — the search index's `in_stock` filter now reflects the change
+  immediately rather than only on the next scheduled reindex.
+- `Modules\Core\Cart\Services\CartLifecycleService` — the single source of truth for the four
+  cart lifecycle states (Ongoing, Abandoned Cart, Abandoned Checkout, Completed) documented in
+  `docs/cart.md`. Previously `Modules\Core\Cart\Filament\Resources\CartResource\Pages\ListCarts`
+  and `Modules\Core\Cart\Commands\DetectAbandonedCarts` each reimplemented the same query split
+  independently, which is exactly the kind of drift that lets the admin panel and the
+  recovery-email pipeline quietly disagree about what "abandoned" means. Both now build on the
+  same `ongoing()`/`abandonedCarts()`/`abandonedCheckouts()`/`completed()` methods, each taking a
+  `Builder` so callers compose the scope onto whatever base query they already have — Filament's
+  own tab query (search/sort/pagination intact) for `ListCarts`, a bare `Cart::query()` for the
+  command.
+- `core.cart.unrecoverable_after` config (default `90 days`) — beyond this age, a stale cart
+  stops being treated as an active "Abandoned Cart"/"Abandoned Checkout" at all (excluded from
+  both `CartLifecycleService` methods), rather than staying flagged as an actionable abandonment
+  forever. A 90-day-old (or older) cart's pricing/stock/tax have very likely moved on, so it's not
+  a realistic recovery target — this is about the abandoned-cart pipeline only, not data
+  retention; no rows are deleted or pruned.
+- `Modules\Core\Cart\Filament\Resources\CartResource\Pages\ViewCart`'s Lines section now shows
+  each line's product thumbnail, name (linking to the product's edit page), and variant options —
+  not just SKU/quantity/price — mirroring Lunar's own order line item display
+  (`OrderItemsTable`). Also added a new Shipping section: the resolved shipping method name (not
+  the bare `acs`-style identifier), destination country, shipping total, and each
+  `shippingBreakdown` line item individually (carrier rate, plus any payment-method fee — see
+  0.16.3's `ApplyPaymentMethodFee`) so staff can see what makes up the total, not just the sum.
+  Guards around `Lunar\Models\ProductVariant::getDescription()`/`getOption()`: both are typed to
+  return `string` but internally read `translateAttribute()`/`translate()`, which return `null`
+  for a product/option with no attribute data set for the active locale — a real `TypeError` hit
+  live against an existing test-fixture product. Reads the underlying relations directly instead
+  of calling through those methods, falling back to "—" rather than crashing the page.
+
+- `Modules\Core\Payment\Drivers\CashOnDeliveryPaymentDriver` — cash-on-delivery/cash-on-pickup was
+  previously wired to `OfflinePaymentDriver`, the same immediate-capture driver as cash-in-hand,
+  which meant a COD order was marked paid the instant it was placed even though no money had
+  actually changed hands. The new driver's `pay()` returns `PaymentResultStatus::Pending` and
+  dispatches nothing, so payment stays unresolved until staff explicitly confirm cash was received
+  (see `Order::paid`/`paid_at` below). A data migration repoints the already-seeded
+  `cash-on-delivery` `PaymentMethod` row to the new driver key.
+- `Order::paid`/`paid_at` — an entirely independent boolean/timestamp pair tracking payment,
+  settable at any point in an order's lifecycle regardless of fulfillment progress. Exists because
+  cash-on-delivery payment timing has no relationship to the fulfillment sequence at all — a
+  courier might not reconcile cash for weeks after an order is already marked completed.
+
+### Changed
+
+- **Order status model, redesigned from scratch.** `Order.status` is a single column again
+  (a same-session 3-axis `payment_status`/`fulfillment_status`/`return_status` design was built,
+  then abandoned before shipping — three independent selects let staff set any combination with no
+  cross-field validation, and didn't map onto how staff actually think about an order: one linear
+  journey, not three simultaneous dials). Now driven by `Modules\Core\Order\Services\
+OrderStatusFlow`, a pure transition-table service offering exactly two sequences — carrier and
+  store-pickup (`Order::isStorePickupOrder()`) — never four; payment method (prepaid vs. COD)
+  affects `Order::paid` only, not which sequence an order follows or where it sits in it. The
+  Filament order page's several guided buttons are replaced by three header actions: "Update
+  Status" offers every status in the order's own branch (`OrderStatusFlow::allOptions()`) — not
+  just the guided next step — so staff can also revert to an earlier status (e.g. undoing a
+  mistaken click); it also replaces vendor `ManageOrder`'s own built-in "Update Status" (same
+  action name, previously left in place unintentionally, producing two duplicate buttons), since
+  vendor's writes `status` directly with no audit trail or branch validation. It is a PLAIN status
+  write with no side effects — picking 'dispatched' there does not create a real shipment. "Create
+  Shipment" is its own separate action, visible only for a carrier order at 'ready_for_dispatch'
+  (`OrderFulfillmentService::canCreateShipment()`) — the one action that talks to a real carrier
+  API, so its weight/locker inputs only ever appear for that specific real-world action rather than
+  inside the general-purpose status select for every manual override of 'dispatched'. "Mark Paid"
+  is a third, separate header action — `Order::paid` is independent of `status`, so it doesn't
+  belong bundled into the status select either — visible only when the order's payment method
+  doesn't auto-capture at checkout (currently only cash-on-delivery). New status vocabulary
+  (`awaiting_payment`, `processing`, `ready_for_dispatch`/`ready_for_pickup`, `dispatched`,
+  `delivery_failed`, `picked_up`, `delivered`, `completed`, `return_requested`, `returned`,
+  `partially_refunded`, `refunded`) replaces the old hyphenated 7-value list in
+  `config/lunar/orders.php` — a breaking rename backed by a one-time data migration that maps every
+  existing order onto the new vocabulary (preferring axis-system data where an order was actually
+  moved through it during this session's testing, falling back to the legacy flat status otherwise)
+  and derives `paid` from historical transaction data. (The carrier branch's post-delivery status
+  was initially named `return_window_open`; renamed to `delivered` — same one combined moment,
+  parcel arrived and return window open — via a follow-up migration once the internal name turned
+  out to be a confusing thing for staff to see on an order.) A new "Payment Method" entry on the
+  order summary sidebar (`Order.meta['payment_method']`, falling back to the latest transaction's
+  driver) surfaces which method a shopper actually used, previously shown nowhere on the order
+  page. The order list topbar's tabs (Lunar's own `favourite` config flag) are trimmed to the
+  main-journey statuses only, rather than all twelve — the exception/branch statuses stay reachable
+  via the table's own filter.
+- "Create Shipment"'s form now branches by carrier (`OrderFulfillmentService::carrierFor()`):
+  - A weight-billed carrier (ACS) gets its weight field pre-filled from the order's own line
+    weights via the new `Modules\Core\Shipping\Support\WeightCalculator` (the same unit-conversion
+    table `AcsRateDriver::totalWeightInKg()` already used for live rate quoting, now shared rather
+    than duplicated) — still staff-editable, not forced.
+  - Box Now ships by compartment size, not weight, so it gets a repeatable list of boxes (one row
+    per physical parcel, each with its own S/M/L size — `ShipmentRequest::$boxes`) instead of the
+    weight field. `BoxNowFulfillmentService::createShipment()` sends one `items` entry per box in a
+    single delivery request and now creates one `Shipment` row per parcel returned (was hardcoded to
+    exactly one box/compartmentSize=1, silently ignoring anything beyond the first parcel) — each row
+    independently trackable/printable/cancellable, linked to its siblings via a shared
+    `meta['delivery_request_id']`.
+  - Box Now's locker field is locked read-only once the shopper's own checkout selection
+    (`$order->shippingAddress->meta['box_now_locker']`) is present — staff can no longer silently
+    redirect a parcel to a different locker than the one the customer picked at checkout; it's only
+    editable for the (current, checkout-UI-less) case where nothing set it yet.
+- New "Shipments" section on the order page (`Modules\Core\Shipping\Extensions\
+OrderShipmentsExtension`, between Transactions and Timeline) — "Create Shipment" previously had no
+  counterpart anywhere to actually see what it created. One entry per `Shipment` record (a multi-box
+  Box Now order shows one entry per parcel), rendered as two inline-labelled lines — carrier +
+  tracking reference, then status + a "Created … · Locker …" helper line — rather than a grid of
+  individually stacked label/value blocks, which reads as a wall of repeated labels once the admin's
+  main content area narrows below Filament's own grid breakpoint (1024px, common with the sidebar
+  open). Two actions per shipment: "Print Label" and "Cancel". Also added `Modules\Core\Shipping\
+Http\Controllers\DownloadShipmentLabelController` (short-lived signed URL, same auth model as
+  Lunar's own vendor order-PDF download) — the only other place that called
+  `CarrierFulfillmentInterface::printLabel()` (`ManagePickupManifests`' bulk "Print" action)
+  discarded the returned bytes entirely; this is the first place in the codebase that actually
+  delivers a label to staff. Hit and fixed two bugs while wiring this up: a `TextEntry` with a blank
+  `state('')` skips rendering its `suffixActions()` entirely (Filament's own empty-state branch
+  returns before reaching the actions markup), so the label-download entry needed a real,
+  non-blank value; and the label-download route, registered via `loadRoutesFrom()` with no
+  middleware group, had `SubstituteBindings` never run, so a type-hinted `Shipment $shipment`
+  parameter silently resolved to an empty, non-existent model instead of 404ing — fixed by taking a
+  plain `int $shipment` and looking the record up directly in the controller.
+- `Modules\Core\Shipping\Enums\TrackingStatus::Failed` — previously unused — is now wired to the
+  new `delivery_failed` status via `Modules\Core\Order\Listeners\
+MarkDeliveryFailedOnCarrierCheckpoint`, from which staff can retry dispatch or convert to a
+  return.
+- Fixed a separate, unrelated bug hit while testing the above: `Lunar\Shipping\Models\
+ShippingMethod::macro('isStorePickup', ...)` silently never registered — `Lunar\Base\Traits\
+HasModelExtending::__callStatic()` (used by every `Lunar\Base\BaseModel` subclass that doesn't
+  declare its own `macro()`, `ShippingMethod` included) intercepts _every_ unmatched static call
+  and dispatches it as an instance call instead of forwarding to `Macroable`, so `hasMacro()` always
+  returned `false` and every order was silently treated as carrier-fulfilled — including store-pickup
+  ones. `Order::isStorePickupOrder()` (the only caller) now reads `ShippingMethod.data
+['fulfillment_type']` directly instead of going through the broken macro.
+- `CartResource::getEloquentQuery()` no longer filters to carts with a known `user_id`/
+  `customer_id` — every cart is now listed, guest carts included. Reverses an earlier deliberate
+  exclusion (an anonymous cart has nothing a staff member could click into — no name, no email),
+  which held for that specific concern but not for the resource's other real use: seeing how many
+  carts are ongoing/abandoned right now. Most real storefront traffic never reaches an identified
+  user/customer, so excluding it silently undercounted exactly what `CartLifecycleService` exists
+  to report on. A guest row's Customer/User columns just render "—" (no link) rather than the row
+  being hidden.
+- `CartLifecycleService::abandonedCarts()` now requires `whereHas('lines')` — an empty cart
+  (created but nothing ever added, e.g. a bot, or a session that never shopped) is no longer
+  counted as "abandoned." There's nothing to recover, so it was a false positive: 9 of 16 carts in
+  the "Abandoned Cart" tab during testing were empty. Removed the now-redundant post-hoc
+  `lines->isEmpty()` skip (and its `with('lines')` eager load) from `DetectAbandonedCarts`, since
+  the query itself excludes them now.
+- `Modules\Core\Shipping\Models\Manifest` — a real record of "a manifest was issued", replacing the
+  loose `shipments.manifest_reference` string. ACS's own `ACS_Issue_Pickup_List` call returns
+  nothing beyond a `PickupList_No`, so there was previously no way to see which shipments were on a
+  given manifest, or when it was issued, once the moment passed — only per-shipment breadcrumbs.
+  `shipments.manifest_id` (FK, replacing `manifest_reference`) now links each shipment to the
+  `Manifest` row `AcsFulfillmentService::issueManifest()` creates; `ManifestResult::success()`
+  carries the created `Manifest` instead of a bare reference string. A one-time data migration
+  backfills a `Manifest` row per distinct existing `(carrier, manifest_reference)` pair, using the
+  earliest `label_printed_at` (or `updated_at`) among that group as a best-effort `issued_at`, since
+  the real issue time was never recorded anywhere.
+- Split the standalone `Modules\Core\Shipping\Filament\Pages\ManagePickupManifests` page into two
+  real Filament resources — a bare `Page` has no access to Filament's resource-level pill-tab UI
+  (`HasTabs` is scoped to `ListRecords`), which carrier-by-carrier separation needed:
+  - `Modules\Core\Shipping\Filament\Resources\ShipmentResource` ("Pending Vouchers") — shipments not
+    yet on an issued manifest, one tab per carrier that implements `SupportsManifestBatching` (ACS
+    today; Box Now has no manifest concept at all — courier pickup is booked at shipment-creation
+    time — so it gets no tab). Adding a future carrier with its own manifest endpoints (e.g.
+    Speedex) needs zero UI changes here — tabs are derived from `Shipping::getSupportedDrivers()`,
+    not hardcoded.
+  - `Modules\Core\Shipping\Filament\Resources\ManifestResource` ("Issued Manifests") — lists issued
+    `Manifest` rows (also tabbed by carrier), with a view page and a `ShipmentsRelationManager`
+    showing which shipments a manifest included, each individually reprintable.
+  - Both bulk actions ("Print selected", "Issue Manifest") now catch `Throwable` around the actual
+    carrier API call and surface a Filament notification instead of an unhandled 500 — previously
+    neither had any error handling at all, so an `AcsApiException` (routine against a voucher/pickup
+    date the carrier no longer recognizes) crashed the whole page.
+  - Fixed a bug introduced while building this: `ViewManifest` initially overrode
+    `getRelationManagers()` directly instead of registering `ShipmentsRelationManager` via
+    `ManifestResource::getRelations()` (the actual wiring point —
+    `HasRelationManagers::getAllRelationManagers()` reads from `Resource::getRelations()`, not a
+    page-level override). The override bypassed the trait's own record-check/caching logic and
+    broke the relation manager's Livewire component mount, surfacing as a CSRF-token 419 redirect
+    loop specifically on `/boboko/manifests/{id}`.
+- "Create Shipment"'s ACS branch gained a "Number of packages" field (`ShipmentRequest::
+$packageCount`, already plumbed through to ACS's `Item_Quantity`/`persistMultipartVouchers()` but
+  never exposed in the form) — more than 1 issues a main voucher plus a multi-part sub-voucher per
+  extra package, each its own `Shipment` row sharing the same total weight. The existing weight
+  field was relabeled "Total weight (kg)" to make explicit that ACS bills by one total shipment
+  weight, not per package.
+
+## [0.16.3] - 2026-09-10
+
+### Fixed
+
+- Stripe `createAndConfirm()` built its `PaymentIntent` params with
+  `'automatic_payment_methods' => isset($data['payment_method']) ? null : ['enabled' => true]`. The
+  Stripe PHP SDK does not omit `null`-valued params from `create()` — it serializes them to an empty
+  string (`ApiRequestor::_encodeObjects()` → `Util::utf8(null)`), and Stripe's API rejects an empty
+  `automatic_payment_methods`. Every Stripe charge failed before it started whenever a
+  `payment_method` was supplied (i.e. every real charge in this flow). Fixed by building `$params`
+  conditionally so the key is either omitted entirely or set to `['enabled' => true]`, never `null`.
+- `Modules\Core\Payment\Filament\Resources\PaymentMethodResource`'s "Driver status" column only
+  flagged a payment method whose driver _class_ no longer resolves (`driver_missing_at`) — it gave
+  no indication when a driver resolves fine but fails `Configurable::isConfigured()` (e.g. Stripe
+  enabled in the DB with no `services.stripe.key` set), which `CheckoutService::getPaymentMethods()`
+  filters out identically. An admin had no way to tell "this method is silently absent at checkout
+  because of missing config" from "everything's fine" at a glance. The same icon column now also
+  reflects `isConfigured()`, with a tooltip distinguishing "driver not found" from "missing required
+  configuration" from "fully configured."
+- `Modules\Core\Payment\Pipelines\Cart\ApplyCashOnDeliveryFee` (now `ApplyPaymentMethodFee`) had two
+  stacked bugs that together meant a configured payment-method fee (e.g. €5 on Cash on Delivery)
+  never actually reached the cart total:
+  - `PaymentMethod::where(...)->value('data->fee')` silently returned `null` on Postgres — Laravel's
+    query builder does not translate the `->` JSON-path column-selector syntax in `value()`/`pluck()`
+    the way it does inside `where()` clauses, so this resolved to a discarded
+    `stdClass::$data->fee` property access instead of the actual fee. Fixed by loading the model and
+    reading the cast `->data['fee']` attribute instead.
+  - Even with the fee correctly read, adding it directly to `$cart->shippingTotal` didn't survive:
+    `Lunar\Pipelines\Cart\CalculateTax`, which runs later in the same cart-calculation pipeline,
+    unconditionally recomputes `shippingTotal` (and shipping tax) from `$cart->shippingBreakdown`'s
+    item sum — silently discarding anything set only on the plain property. Fixed by adding the fee
+    as its own `Lunar\Base\ValueObjects\Cart\ShippingBreakdownItem` on `shippingBreakdown` instead,
+    so it survives `CalculateTax`'s recompute and is correctly included in shipping tax too.
+  - Also generalized while fixing: the pipeline was hardcoded to the literal type string
+    `cash-on-delivery`. Renamed to `ApplyPaymentMethodFee` and changed it to look up whichever
+    `PaymentMethod` row matches `Cart::meta['payment_method']` and apply its own `data.fee` if
+    present — works for any payment method configured with a fee, not just one specific slug.
+- `Modules\Core\Checkout\Services\CheckoutService::selectPaymentMethod()` called `$cart->calculate()`
+  after saving the new payment method, but `Lunar\Models\Cart::calculate()` no-ops if the cart
+  instance was already calculated earlier in the same request (`Cart::isCalculated()`) —
+  `Lunar\Managers\CartSessionManager` memoizes one `Cart` instance per request, so this was true on
+  every request where the checkout page's initial render had already calculated the cart. The
+  result: after switching payment methods, the just-saved `meta['payment_method']` change was
+  persisted, but the cart's totals silently kept reflecting whichever method was calculated _first_
+  in the request — a shopper switching from Cash in Hand to Cash on Delivery would keep seeing Cash
+  in Hand's total, with no COD fee applied, until something else forced a fresh calculation. Fixed
+  by calling `$cart->recalculate()` instead, which forces the pipeline to re-run.
+
+## [0.16.2] - 2026-09-09
+
+### Fixed
+
+- `Lunar\Base\ShippingManifest` is a request-lifetime singleton whose `getOptions()` re-runs the
+  shipping modifier pipeline without ever clearing its `$options` collection first, and whose
+  `addOption()` keeps the first entry per `getIdentifier()` and silently drops any later one. In
+  practice, an option resolved for an earlier shipping address (or cart state) shadowed the
+  correct one after the address/region changed within the same request — e.g. a carrier priced
+  differently across two zones that both match an address would keep quoting the stale zone's
+  price, and `ApplyShipping` would price the cart total off that same stale option. Renamed
+  `Modules\Core\Shipping\Listeners\FlushLivePricingCache` to
+  `Modules\Core\Shipping\Listeners\InvalidateShippingOptions` and had it additionally call
+  `ShippingManifest::clearOptions()`, merged in because both invalidations fire on the exact same
+  event set (`CartLineAdded`, `CartLineUpdated`, `CartLineRemoved`, `CartCleared`,
+  `ShippingAddressSet`) — the only inputs the shipping modifier pipeline depends on.
+
+## [0.16.1] - 2026-09-09
+
+### Fixed
+
+- OTP login page (`resources/views/auth/filament/pages/login.blade.php`) had no visible spacing
+  between the email/OTP input, error text, and buttons following the Filament v3 → v4 upgrade.
+  The view relied on a bare `grid gap-y-4` Tailwind utility class, but since this view ships from
+  the `boboko-core` package rather than a consuming app, that class was never present in any
+  host app's compiled Tailwind output. Replaced with an inline `style` (flex column, `row-gap:
+1rem`) so the layout no longer depends on the consuming app's Tailwind content scanning.
+
+## [0.16.0] - 2026-09-08
+
+### Added
+
+- `Modules\Core\Checkout\Services\CheckoutService::setRecoveryConsent(bool $consent): Cart` — the
+  shopper's promotional/abandoned-cart-recovery opt-in, given once during guest checkout and
+  deliberately independent of `setShippingAddress()`/`setBillingAddress()`: consent is a
+  cart-level decision, not tied to any one `CartAddress` — changing which address is on the cart
+  later never resets or re-asks for it. Only an explicit call to this method (the checkbox itself
+  being submitted) ever changes it; calling it again with `false` is how a later opt-out is
+  recorded, per the legal requirement that consent be provable and withdrawable. Stored on
+  `Cart::meta` (interim, per the design this implements — a real column/consent record is the
+  eventual target, tracked as follow-up) as `recovery_consent` (bool), `recovery_consent_at`
+  (ISO 8601, `null` when `false`), and `recovery_consent_policy_version`
+  (`config('legal.privacy_policy_version')` at the moment of consent, so a later dispute is
+  answered from what was actually agreed to). Dispatches new
+  `Modules\Core\Checkout\Events\RecoveryConsentSet`. Newsletter opt-in is explicitly a separate
+  scope — never merged into this flag.
+- `Modules\Core\Checkout\Services\CheckoutService::initiatePayment()` now requires `bool
+$termsAccepted` and `string $policyVersion` as mandatory parameters (not optional data a caller
+  might omit) — throws the new `Modules\Core\Checkout\Exceptions\TermsNotAcceptedException`
+  _before_ `Cart::createOrder()` is ever called if `$termsAccepted` is `false`, so an order can
+  never exist without a recorded acceptance (refused, not created-then-flagged). On success,
+  writes `terms_accepted` (`true`), `terms_accepted_at` (ISO 8601), and
+  `terms_accepted_policy_version` onto the created `Order`'s own `meta` — the durable,
+  order-level audit trail for a consumer-contract acceptance dispute, written directly (not via
+  an event/listener) since the `Order` row doesn't exist until `createOrder()` returns.
+- `Modules\Core\Cart\Commands\DetectAbandonedCarts` — both its `CartAbandoned` and
+  `CheckoutAbandoned` detection queries now require `meta->recovery_consent = true`. A
+  non-consenting cart's abandonment is never dispatched at all (not merely filtered later at
+  whatever future recovery-email send step reads it) — the correct enforcement point per the
+  legal requirement that recovery/marketing sends only ever reach carts that opted in.
+- `config/legal.php` (merged by a new `Modules\Core\Providers\CheckoutServiceProvider`) —
+  `privacy_policy_version`/`terms_version`, plain `env()`-backed strings bumped by whoever edits
+  the corresponding legal page. Recorded alongside every consent/acceptance rather than read live
+  at dispute time, so what a shopper actually agreed to is answered from the cart/order itself.
+  `CheckoutServiceProvider` itself is new — `Checkout` previously had no dedicated service
+  provider at all (its service/events were resolved/dispatched without one).
+
+## [0.15.0] - 2026-09-07
+
+### Changed
+
+- **Breaking:** `Modules\Core\Payment\Models\PaymentMethod` is now the full DB-instance layer for
+  Payment, same three-layer split (registry / DB instance / cross-cutting config) `Shipping`
+  already has via `ShippingMethod` — see `docs/payments.md`. Every value that used to live in
+  `config('lunar.payments.types.{type}.*')` (`payment_driver`, `capture_mode`, `captured_status`)
+  moves onto the `PaymentMethod` row itself as real columns: `driver` (the new
+  `PaymentDriverRegistry` key — NOT the same as `type`; two rows can share one driver), `name`
+  (admin-facing label, nothing played this role before), `capture_mode`, `captured_status`,
+  `authorized_status`, `position` (admin-controlled ordering, new — reorderable in the Filament
+  table), `driver_missing_at`. `config('lunar.payments.types')` is gone entirely; `config/
+payment.php` now holds only `cart_pipeline` (genuinely cross-cutting — every store gets the
+  same pipeline wiring regardless of how many payment methods it configures).
+- **Breaking:** `Modules\Core\Payment\Services\PaymentDriverResolver` is deleted, replaced by
+  `Modules\Core\Payment\Services\PaymentDriverRegistry` — `register(string $key, string
+$driverClass)`/`resolve(string $key): ?object`/`all(): array<string, string>`. Deliberately
+  knows nothing about `PaymentMethod` or the database (mirrors `Lunar\Shipping\Managers\
+ShippingManager`'s built-in-methods + `Manager::extend()` split, purpose-built rather than
+  extending `Illuminate\Support\Manager` — Payment's drivers implement several independent
+  capability interfaces at once, not one uniform contract). Built-ins (`OfflinePaymentDriver`
+  as `'offline'`, `StripePaymentDriver` as `'stripe'`) registered in
+  `PaymentServiceProvider::boot()`, exactly how `Shipping::extend('acs', ...)` already works.
+- **Breaking:** `Modules\Core\Checkout\Services\CheckoutService::getPaymentMethods()` now returns
+  `Illuminate\Support\Collection<int, PaymentMethod>` (ordered by `position`), not
+  `array<string>`. A method is offered only once three independent checks all pass — `enabled`
+  (admin turned it on), `driver_missing_at` is null (the driver class still exists), and the
+  resolved driver's own `Configurable::isConfigured()` (its runtime requirements are met) — each
+  failure meaning something different to an admin diagnosing why a method isn't showing up.
+  `initiatePayment()` resolves the driver via the selected row's own `driver` column, not `type`.
+- `Modules\Core\Payment\Filament\Resources\PaymentMethodResource` — `canCreate()`/`canDelete()`
+  now both `true` (previously hardcoded `false`, since a row could only ever be a config-defined
+  type before this release). New create/edit form (`name`, `type`, `driver` — a `Select`
+  populated live from `PaymentDriverRegistry::all()`, `capture_mode`, `captured_status`,
+  `authorized_status`); reorderable table (`->reorderable('position')`); a distinct "Driver
+  status" icon column (separate from the `enabled` toggle) showing whether `driver_missing_at`
+  is set.
+- `Modules\Core\Order\Listeners\ApplyResolvedPaymentStatus` reads `captured_status`/
+  `authorized_status` off the `PaymentMethod` row (`where('type', $event->type)`) instead of
+  `config(...)`.
+- `Modules\Core\Command\InstallLunarCommand::seedPaymentMethods()` no longer iterates
+  `config('lunar.payments.types')` — it seeds exactly one opinionated `cash-on-delivery` starter
+  row, every value a plain literal in the command itself (not sourced from config or the
+  registry — a driver has no business carrying opinions about what its captured order status
+  should be called; that's a merchant decision). Skip-if-exists, same as before.
+
+### Added
+
+- `php artisan boboko:payment:sync-drivers` — reconciles every `PaymentMethod` row's `driver`
+  against `PaymentDriverRegistry`, setting `driver_missing_at` when a driver no longer resolves
+  (a package removed, a custom `register()` call deleted) and clearing it automatically if that
+  driver is registered again in a later deploy. Deliberately its own standalone command, meant to
+  run unconditionally on every container start/deploy (Dockerfile entrypoint, alongside
+  `migrate`) — "did the set of registered drivers change" is a deploy-time event, cheap enough to
+  check every time regardless of whether anything actually changed. Verified live: flags a row
+  whose `driver` was manually corrupted, and auto-clears the flag once the driver resolves again.
+- `docs/payments.md` — new "Registry, DB instance, and cross-cutting config" section: the
+  three-layer split researched against `Shipping`'s own already-existing pattern and three real
+  e-commerce platforms (Shopify, WooCommerce, Medusa.js), the "would a store ever plausibly want
+  two different answers to this" test for deciding config vs. DB-column placement, and the
+  three-check availability chain.
+
+- `Modules\Core\Payment\Services\PaymentMethodCache` (`Cache::rememberForever`, same pattern as
+  `Localization\Services\LanguageCache`) + `Modules\Core\Payment\Services\PaymentMethodService`
+  (`create`/`update`/`delete`/`list`) — the single read/write gateway for `PaymentMethod` now used
+  by every Filament resource action (create, edit, edit-fee, delete, the inline `enabled` toggle)
+  instead of the Eloquent model directly, so the cache is invalidated and
+  `PaymentMethodCreated`/`PaymentMethodUpdated`/`PaymentMethodDeleted`/`PaymentMethodsReordered`
+  dispatch on every write, with no exceptions other than Filament's own drag-to-reorder (which
+  does a raw bulk SQL `UPDATE` on the position column directly via
+  `CanReorderRecords`/`reorderTable()`, before `afterReordering()` fires — a confirmed, unavoidable
+  Filament limitation; the reorder hook only clears the cache and dispatches
+  `PaymentMethodsReordered` afterward). `CheckoutService::getPaymentMethods()` and
+  `ApplyResolvedPaymentStatus` both now read through the cache instead of querying `PaymentMethod`
+  directly.
+- `Modules\Core\Payment\Models\CoreTransaction` (a `Lunar\Models\Transaction` subclass) +
+  `Modules\Core\Payment\Support\TransactionDriverAdapter`, registered via
+  `Lunar\Facades\ModelManifest::replace(Lunar\Models\Contracts\Transaction::class,
+CoreTransaction::class)` — the same contract-swap mechanism already used elsewhere for
+  `Customer`/`Staff`. Fixes a real crash (`InvalidArgumentException: Driver [cash-on-delivery] not
+supported`) the first time anything called `$transaction->refund()`/`->capture()`:
+  `Lunar\Models\Transaction::driver()` calls Lunar's own, entirely separate
+  `Lunar\Facades\Payments::driver()` manager, which had never heard of any of this codebase's
+  driver keys. `CoreTransaction::driver()` returns `TransactionDriverAdapter` instead, which
+  resolves the transaction's real `PaymentMethod`/`PaymentDriverRegistry` driver and calls it —
+  Lunar's own admin panel "Refund"/"Capture" buttons now transparently reach the real payment
+  system underneath, including correctly reporting failure (not a silently-faked success) when
+  the resolved driver doesn't implement `SupportsRefunds`/`SupportsCaptures`.
+- `TransactionDriverAdapter::refundVia(Transaction $transaction, ?string $driverKey, int $amount,
+?string $notes = null)` — refund through an explicitly chosen driver, independent of the one
+  the original payment went through (e.g. a cash-on-delivery order refunded via Bank Transfer,
+  which has no notion of the original offline payment at all). The order page's refund action
+  gained a "Refund via" `Select` (every `PaymentDriverRegistry` driver implementing
+  `SupportsRefunds`, defaulting to the transaction's own driver) that routes through this method
+  instead of `Lunar\Models\Transaction::refund()`, whose fixed signature has no room for a driver
+  override.
+- `Modules\Core\Payment\Drivers\BankTransferPaymentDriver` (registered as `'bank-transfer'`) —
+  manual/attested, same trust model as `OfflinePaymentDriver`: no gateway call, `pay()`/`refund()`
+  decide success immediately on a staff member's say-so. Implements both `SupportsPay` and
+  `SupportsRefunds`; exists specifically so a payment taken through a different method can still
+  be refunded via bank transfer. The admin UI for receiving a payment this way (bank reference,
+  notes, proof-of-transfer upload) is a follow-up — the driver itself is complete and usable via
+  the registry today.
+- `Modules\Core\Order\Filament\Infolists\TransactionEntry` (swapped in for Lunar's own
+  `Lunar\Admin\Support\Infolists\Components\Transaction` via a new
+  `OrderTransactionsExtension::extendTransactionsRepeatableEntry()` hook) — the order page's
+  transaction cards now also show a note recorded in `Transaction.meta['notes']` when the `notes`
+  column itself is empty. `Order\Services\TransactionRecorder` only ever wrote `notes` from
+  `PaymentResult::$failureReason`, which is never set on a successful result — a manual driver's
+  staff-entered note (e.g. `BankTransferPaymentDriver`'s) was being recorded but had nowhere to
+  render.
+- `Modules\Core\Payment\Listeners\LogPaymentMethodActivity` — `PaymentMethod` now has an admin
+  activity trail, unlike `Order`/`Transaction`/`Staff` it previously had none. Routes
+  `PaymentMethodCreated`/`Updated`/`Deleted` through the existing `Logging\ActivityLogService`
+  (the same one `Localization\Listeners\LogTranslationActivity` already uses) rather than adding
+  `PaymentMethod` to `Lunar\Base\Traits\LogsActivity`'s generic model-observer logging —
+  `PaymentMethodUpdated::$old`/`PaymentMethodDeleted::$method`'s snapshot already carry more
+  deliberate before/after context than Eloquent's own dirty-attribute diffing would reconstruct.
+  `PaymentMethodsReordered` is deliberately NOT logged — a multi-row position change doesn't fit
+  `ActivityLogService`'s one-`Model`-subject shape, and isn't worth a new method for a low-stakes,
+  purely-cosmetic setting.
+- New `payment_methods.refunded_status` column + form field (same `Select` pattern as
+  `captured_status`/`authorized_status`) — `ApplyResolvedPaymentStatus` now also reacts to
+  `PaymentRefunded`, so `Order.status` actually changes on a refund; before this, only the
+  _derived_ `Order::paymentStatus()` reflected a refund (reading `transactions` live), while the
+  stored `status` column — what admin filtering, customer emails, etc. actually key off — never
+  moved. Resolves the ORIGINAL payment method for this lookup, not the refund event's own
+  `$type`: a refund routed through a different driver via `refundVia()` (e.g. cash-on-delivery
+  refunded through Bank Transfer) carries the REFUND driver's registry key as `$event->type`,
+  which usually isn't even a real `PaymentMethod.type` — the listener now finds the order's
+  earliest successful `capture`/`intent` transaction instead and reads `refunded_status` off
+  _that_ transaction's own `PaymentMethod` row, since that's the payment the refund is actually
+  reversing. Deliberately no `void_status` yet — a void never moved money, so it doesn't carry
+  the same "the customer needs to see this changed" weight a refund does.
+
+### Fixed
+
+- Existing `PaymentMethod` rows seeded before this release (`cash-on-delivery`, `cash-in-hand`)
+  had `driver`/`capture_mode`/`captured_status` all `NULL` after the migration ran — a data
+  backfill was required (not automated by the migration itself) to restore them to a resolvable
+  state; flagged here since a consuming app upgrading past this release needs the same backfill
+  for its own pre-existing rows before `getPaymentMethods()` will offer them again.
+- `Lunar\Admin\Filament\Resources\OrderResource\Pages\ManageOrder::getRefundAction()`/
+  `getCaptureAction()` and `OrderItemsTable::getBulkRefundAction()` report a failed refund/capture
+  by calling `$action->failureNotification(...)`, `$action->failure()`, then `$action->halt()` —
+  but `Filament\Actions\Concerns\InteractsWithActions::callMountedAction()` only ever sends that
+  notification from a code path that runs after the action's closure returns normally; `halt()`
+  throws `Filament\Support\Exceptions\Halt`, caught by an earlier `catch` block that rolls back and
+  returns, so the notification was built but never sent — clicking "Refund" on a payment method
+  that genuinely can't be refunded looked like nothing happened at all, no error, no toast. Real,
+  pre-existing Filament/Lunar bug, invisible until this release's `TransactionDriverAdapter` made
+  an honest failure (rather than a hard crash or a silently-faked success) actually reachable.
+  Fixed via new `Modules\Core\Order\Filament\Extensions\OrderRefundActionsExtension`/
+  `OrderItemsTableExtension`, which wrap the affected actions' closures to send the queued failure
+  notification themselves before re-throwing `Halt`.
+- `TransactionDriverAdapter::refund()`/`capture()` never included `order_id` in the `$context`
+  passed to the driver, so `Order\Listeners\RecordPaymentTransaction`/`ApplyResolvedPaymentStatus`
+  (both requiring `$context['order_id']`) silently no-op'd for every admin-initiated refund/capture
+  through any driver — no audit `Transaction` row was ever created, regardless of whether the
+  refund/capture itself succeeded. Fixed by passing `$transaction->order_id` through.
+
+## [0.14.0] - 2026-09-03
+
+### Changed
+
+- **Breaking:** `Modules\Core\Catalog\Services\ProductSearchService::search()` now returns `Modules\Core\Catalog\DTOs\ProductListingResult` — the exact same shape `ProductService::list()` already returns — instead of a bare `Illuminate\Database\Eloquent\Collection<Product>` of hydrated models with no pagination at all. New signature: `search(string $query, ?ProductFilters $filters = null, ?ProductSort $sort = null, int $perPage = 24, int $page = 1): ProductListingResult`. `->products` is a real `LengthAwarePaginator` of plain, localized indexed-document arrays (not Eloquent models, not Scout's raw response) — a search results page and a category listing page are now interchangeable from a controller's perspective: same DTO, same `ProductCard::fromIndexed()` mapping, same pagination/sort/tag/price-slider handling. `->priceBounds`/`->availableTags` are scoped to the search query itself (delegated to `ProductService::priceSliderBounds()`/`availableTags()`, both of which already accepted a `$query` param for this).
+- `Modules\Core\Catalog\Services\ProductService::availableTags()` is now `public` (was `private`) and takes an optional `$query` parameter, so `ProductSearchService::search()` can reuse it directly instead of reimplementing the same facet call.
+
+### Added
+
+- `Modules\Core\Catalog\Support\ProductDocumentLocalizer` — the per-locale field resolution and raw-Meilisearch-response unwrapping (`withLocalizedFields()`, `hitsFrom()`) extracted out of `ProductService` into its own class, since `ProductSearchService` needed the exact same logic against the exact same kind of document. Both services now depend on this one class instead of `ProductService` owning logic a second service also needed.
+
+## [0.13.0] - 2026-09-03
+
+### Changed
+
+- **Breaking:** `Payment` is now a genuinely standalone module — no direct calls into `Checkout`/`Order`, no reaching into their Eloquent models, communication only via events. The entire old `confirm()`-based flow is gone: `Modules\Core\Payment\Contracts\PaymentDriver` (and the already-stale `Modules\Core\Checkout\Contracts\PaymentDriver` duplicate), `Checkout\Events\PaymentConfirmed`, `Payment\Contracts\InitiatesPayment`, `Payment\DataTransferObjects\PaymentInitiation`, `Payment\Enums\PaymentInitiationMode`, `Payment\Events\PaymentSucceeded`/`PaymentFailed`, `Payment\Events\OrderPaymentStatusResolved`, and `Payment\Exceptions\PaymentNotConfirmedException` are all deleted. This flow was non-functional on `master` before this release — `CheckoutService::confirmPayment()` dispatched an event nothing listened for, so no order was ever placed after payment.
+- **Breaking:** Every payment operation is now its own explicit, opt-in contract, modeled on how real gateways (Stripe, Mastercard's own gateway, Nexi) actually split these operations — see `docs/payments.md`: `Modules\Core\Payment\Contracts\SupportsPay` (atomic authorize+capture), `SupportsAuthorization` (hold only), `SupportsCaptures` (settle a prior hold), `SupportsVoids` (release a prior hold without settling), `SupportsRefunds` (reverse settled funds), `HandlesPaymentCallback` (resolve an async pay()/authorize() later, from a webhook), and `Configurable` (`isConfigured()`, split out of the old single `PaymentDriver` interface). A driver implements only the operations its gateway actually supports.
+- **Breaking:** Every amount flowing through these contracts is `Lunar\DataTypes\Price` (Lunar's own bundled minor-unit-value + `Currency` type) — never a bare `int` paired separately with a `Currency`. Each driver converts at its own boundary (e.g. `StripeManager::toStripeAmount()`/`fromStripeAmount()`); `Payment` itself only ever speaks Lunar's `Price`.
+- **Breaking:** `Modules\Core\Checkout\Services\CheckoutService::placeOrder()` and `confirmPayment()` are both replaced by a single `initiatePayment(string $fingerprint, array $data = []): Modules\Core\Payment\DTOs\PaymentResult`. It creates the draft `Order` (`Cart::createOrder()`, idempotent against an existing draft) and hands off directly to the resolved driver's `pay()`/`authorize()`, per that type's new `config('lunar.payments.types.{type}.capture_mode')` key. `Checkout\Events\OrderPlaced` no longer dispatches from `CheckoutService` — it now fires from `Modules\Core\Order\Listeners\ApplyResolvedPaymentStatus` once a `PaymentCaptured`/`PaymentAuthorized` event actually transitions the order's `placed_at`, since a draft order can now exist well before payment resolves (an async gateway).
+- `Modules\Core\Payment\Services\PaymentDriverResolver::resolve()` now returns `?object` instead of the deleted `PaymentDriver` interface — a driver implements several independent capability interfaces at once, so a caller does its own `instanceof SupportsPay`/`instanceof SupportsAuthorization` check, the same pattern the capability interfaces themselves are designed around.
+- `config/payment.php`'s `cash-on-delivery` entry gains `capture_mode` (`'pay'`, since `OfflinePaymentDriver` only implements `SupportsPay`) and `captured_status` (`'payment-offline'`, replacing the previously dead `'authorized' => 'awaiting-payment'` key, which nothing ever read).
+
+### Added
+
+- `Modules\Core\Payment\DTOs\PaymentResult` — the one return shape every operation (`pay`, `authorize`, `capture`, `void`, `refund`, `handleCallback`) produces, regardless of gateway: `status` (`Modules\Core\Payment\Enums\PaymentResultStatus`: `Succeeded`/`Failed`/`Pending`), `reference`, `amount` (a `Price`), `failureReason`, `retriable` (real on Stripe/Mastercard's own soft-decline classification, always `false` on Nexi — it has no such signal), `raw` (the untouched gateway response, for audit), `meta`, and `continuation` (see below).
+- `Modules\Core\Payment\DTOs\PaymentContinuation` / `Modules\Core\Payment\Enums\PaymentContinuationType` — what a caller does next with a `Pending` `PaymentResult`, gateway-agnostically (`Redirect` or `ClientSecret`), so a storefront controller never needs gateway-specific knowledge of e.g. Stripe's own `PaymentIntent` fields to drive a 3-D Secure/redirect continuation.
+- Eight new events, one terminal pair per operation, replacing the old single `PaymentSucceeded`/`PaymentFailed`: `PaymentAuthorized`/`PaymentAuthorizationFailed`, `PaymentCaptured`/`PaymentCaptureFailed`, `PaymentVoided`/`PaymentVoidFailed`, `PaymentRefunded`/`PaymentRefundFailed`. `PaymentCaptured` is deliberately the same event whether money was taken via `pay()` (one gateway call) or `authorize()`→`capture()` (two calls) — "a payment has been captured" is the same business fact either way. Every event carries `{type, result: PaymentResult, context}` — `context` is an opaque bag the caller hands in and gets back untouched, so `Payment` never needs to know what a `Cart` or `Order` is.
+- `Modules\Core\Order\Listeners\ApplyResolvedPaymentStatus` (rewired, not new — previously listened to the now-deleted `OrderPaymentStatusResolved`) is the only place an `Order`'s `status` column is written in reaction to a payment outcome: it listens to `PaymentCaptured`/`PaymentAuthorized` directly, reads `$event->context['order_id']`, and resolves the new status from `config('lunar.payments.types.{type}.captured_status')`/`authorized_status`.
+- `Modules\Core\Payment\Drivers\StripePaymentDriver` rewritten onto the new contracts — implements all six capability interfaces plus `Configurable`. Solves `handleCallback()`'s async-correlation problem (a webhook is a separate HTTP request from the `pay()`/`authorize()` call that started it) the same way `lunarphp/stripe`'s own `StripePaymentType`/`ProcessStripeWebhook` do: real `cart_id`/`order_id` columns on `Lunar\Stripe\Models\StripePaymentIntent`, plus two new columns this driver needs (`context`, `payment_type`) added by a new migration — `database/migrations/2026_09_03_000002_add_context_to_stripe_payment_intents.php`.
+- `Modules\Core\Payment\Http\Controllers\StripeWebhookController` + `src/Payment/routes/webhooks.php` (`POST /payments/stripe/webhook`, loaded by `PaymentServiceProvider`) — a boboko-owned webhook endpoint, deliberately not `lunarphp/stripe`'s own route (which dispatches into Lunar's own `Payments::driver('stripe')` flow, the flow this driver replaces). Reuses `Lunar\Stripe\Http\Middleware\StripeWebhookMiddleware` and `Stripe\Webhook::constructEvent()` directly — both are genuine Stripe SDK signature verification, safe to reuse without touching the rest of that vendor package's flow. Requires `config('services.stripe.webhooks.lunar')` set in a consuming app; no `stripe` config type entry is added to `config/payment.php` in this release — enabling Stripe for real is a follow-up.
+- `docs/payments.md` — full design notes: the operation/contract table cross-referenced against Mastercard/Stripe/Nexi's real APIs, why `PaymentResult` normalizes only what every gateway can always provide, the async-correlation pattern, and what's explicitly out of scope (a `Transaction`-writing listener, the `stripe` config entry, frontend Stripe Elements integration).
+
+### Fixed
+
+- `Modules\Core\Checkout\Services\CheckoutService::selectPaymentMethod()` crashed (`Call to a member function toArray() on null`) the first time it ran against a cart whose `meta` column was still a genuine SQL `NULL` (any freshly-created cart) — `Cart::$meta`'s `AsArrayObject` cast returns `null`, not an empty array-like object, for a `null` column. Fixed with a null-safe fallback.
+- `Modules\Core\Shipping\Carriers\Acs\AcsRateDriver`/`BoxNowRateDriver` referenced `Lunar\Shipping\DTOs\ShippingOptionRequest`, a namespace that doesn't exist in the installed `lunarphp/table-rate-shipping` version (the real class is `Lunar\Shipping\DataTransferObjects\ShippingOptionRequest`) — crashed `Illuminate\Support\Manager`'s interface-compatibility check the moment anything touched `ShippingManager::getSupportedDrivers()`, including simply adding a line to a cart (via `Modules\Core\Shipping\Listeners\FlushLivePricingCache`).
+
+## [0.13.1] - 2026-09-03
+
+### Added
+
+- `Modules\Core\Order\Listeners\RecordPaymentTransaction` — writes the `lunar_transactions` row for a successful `PaymentCaptured`/`PaymentAuthorized`/`PaymentVoided`/`PaymentRefunded` event, via a new `Modules\Core\Order\Services\TransactionRecorder` (moved here from `Payment\Services`, and rewritten to take a `PaymentResult` directly instead of the deleted `CaptureResult`/`RefundResult` DTOs — `Payment` never writes to `Order`'s models, `Transaction.order_id` being required is exactly why this lives in `Order`, same reasoning as `ApplyResolvedPaymentStatus`). Closes a real gap introduced in `0.13.0`: `Order::paymentStatus()` (which derives its answer entirely from `$order->transactions`) always resolved to `PaymentStatus::Offline` — its "no transactions at all" fallback — regardless of what actually happened, since nothing had ever written a row. Verified live: a captured offline payment now produces a `type: capture` transaction and `Order::paymentStatus()` correctly resolves to `captured`.
+
+## [0.12.1] - 2026-09-03
+
+### Fixed
+
+- `Modules\Core\MigrateImport\Shopify\ShopifyExportImporter` now attaches a variant's `Variant Image` CSV column to that `ProductVariant`'s own `images()` media pivot (`media_product_variant`, `primary`/`position`). Previously the variant image was never read at all — every image from the CSV, including ones the export clearly scopes to one specific variant, went only into the product's own top-level gallery, so a variant swatch/option change had no way to show its own photo.
+- `Modules\Core\MigrateImport\Shopify\Resolvers\ProductOptionResolver::resolveOption()` now sets `label` (same value as `name`) when creating a `Lunar\Models\ProductOption`, not just `name`. A `ProductOption` with a null `label` crashes Lunar's own `ProductOptionIndexer::toSearchableArray()` (`foreach()` on `null`) the moment that option gets reindexed — every option created by the importer before this fix has a null `label` and needs a wipe-and-reimport (see `docs/shopify-reimport.md`, new in this release) to pick up the fix, since `firstOrCreate()` never revisits an already-existing row.
+- `product_reviews.product_id`'s foreign key had no `ON DELETE` clause, so deleting a reviewed `Product` threw a constraint violation instead of the review going with it, unlike every other product-dependent table. New migration adds `cascadeOnDelete()`.
+
+### Added
+
+- `Modules\Core\Catalog\Services\ProductIndexer::mapVariant()` now embeds `gtin`, `mpn`, `ean`, `backorder`, `unit_quantity`, `shippable`, `tax_ref`, and `dimensions` (length/width/height/weight/volume, each with `value`+`unit`) on every indexed variant — previously only `id`/`sku`/`stock`/`purchasable`/`options`/`prices`/`media` were embedded, so a search result or filter needing any of these had no way to get at them without a separate Postgres query per variant.
+- `ProductIndexer::toSearchableArray()` adds a top-level, filterable `skus` field (every variant's SKU, deduplicated) — filtering/matching by SKU no longer requires reaching into the nested `variants` array.
+- `docs/shopify-reimport.md` — runbook for wiping every imported product (cascading through Lunar so Meilisearch documents go too) and re-running the importer from scratch, needed whenever a fix like the two above only takes effect on newly-created rows.
+
+## [0.12.0] - 2026-09-03
+
+### Changed
+
+- **Breaking:** `Modules\Core\Catalog\Services\ProductService::list()` now returns `Modules\Core\Catalog\DTOs\ProductListingResult` (`->products`: the same `Illuminate\Pagination\LengthAwarePaginator` as before, `->priceBounds`: a new `Modules\Core\Catalog\DTOs\PriceSliderBounds`) instead of returning the paginator directly. A caller doing `$service->list(...)->items()`/`->through(...)` must update to `$service->list(...)->products->items()`/`->through(...)`. This collapses what used to be two separate calls a controller had to orchestrate itself (`list()` for products, `priceRange()` + manual floor/ceil/"is this actually filtered" math for the slider) into one.
+- **Breaking:** `Modules\Core\Catalog\Services\ProductSearchService::search()`'s signature changed from `search(string $query, ?string $locale = null)` to `search(string $query, ?ProductFilters $filters = null, ?ProductSort $sort = null)` — the `$locale` parameter is gone (see "every configured language, always" below); `$filters`/`$sort` apply the same `Modules\Core\Catalog\Support\ProductFilterBuilder`/`ProductSort::toMeilisearchSort()` semantics `ProductService::list()` already used, so a text search can now be narrowed by price/brand/stock and sorted the same way a category listing can.
+- `ProductSearchService` now targets every configured store language's fields on every search (`Lunar\Models\Language::all()`), not just the current request locale plus the store's default language. The old `{current, default}` pairing silently stopped catching anything outside those two locales whenever they were equal (a single-language store, or a shopper browsing in the default language) — always searching every configured language closes that gap in both directions. See `docs/product-search.md`.
+- Extracted `Modules\Core\Catalog\Services\ProductService`'s private `buildFilter()` into a new standalone `Modules\Core\Catalog\Support\ProductFilterBuilder`, so `ProductSearchService` can apply the exact same Meilisearch filter-clause semantics to a text query, instead of reimplementing filter-building a second time.
+
+### Added
+
+- `Modules\Core\Catalog\Services\ProductService::priceSliderBounds()` — `priceRange()` rounded to whole currency units (floor/ceil) plus whether the given selected min/max actually narrows it, returned as a `PriceSliderBounds` DTO. Used internally by `list()` now; also callable directly for a caller (e.g. a text-search results page) that needs slider bounds without a full `list()` call.
+- `Modules\Core\Catalog\Services\ProductService::priceRange()` gained an optional `string $query = ''` parameter, so a caller can scope the price range to a text search's own matches (pass the shopper's search text) instead of always spanning the whole catalog.
+- `Modules\Core\Catalog\Services\ProductService::random(int $limit)` — random products still scoped to the Meilisearch index's own channel/status visibility, unlike a raw `Product::inRandomOrder()` (which has no notion of that filtering). Meilisearch has no `ORDER BY RANDOM()` equivalent, so this fetches every matching id only (`attributesToRetrieve: ['id']`), shuffles in PHP, then fetches the full localized documents for just the ids picked, restoring the shuffled order afterward (Meilisearch's `id IN [...]` filter doesn't preserve list order on its own).
+- `Modules\Core\Catalog\Services\ProductService::variantSummaries(array $product)` — the id/price/image of every variant on a product document, for a variant picker/swatch list, without a caller reaching into `$product['variants'][n]['prices'][0]`/`['media'][0]` itself.
+- `Modules\Core\Catalog\Services\ProductSearchService::search()` now also targets `variants.options.value` — a variant's own option value (e.g. "Κάπτεν Γαμέρικα" on a "Name" option) is matchable by search even when that text never appears in the product's own name or description.
+- `php artisan lunar:meilisearch:tune-product-search` (`Modules\Core\Command\TuneProductSearchCommand`) — tightens `minWordSizeForTypos` (1 typo only at 8+ characters, 2 typos only at 12+) and disables Meilisearch's `prefixSearch` on the product index. Meilisearch's defaults for both were loose enough to produce bad matches on short Greek words (confirmed the specific case was `prefixSearch`'s default `indexingTime` behavior on a shared word-start, not typo tolerance, via `showMatchesPosition`). Consuming apps should run this after `lunar:meilisearch:setup` whenever the product index needs (re)provisioning — **requires Meilisearch v1.12+** (`prefixSearch` didn't exist as a configurable setting before then).
+
+## [0.11.1] - 2026-09-01
+
+### Fixed
+
+- `Modules\Core\Catalog\Services\RecommendationService::recommend()` built its result with the base `Illuminate\Support\Collection` (`collect()`) instead of `Illuminate\Database\Eloquent\Collection`, even though every element is a `Product` model. `ProductIndexer::toSearchableArray()` calling `->load(['media', 'variants.prices'])` on that result threw `BadMethodCallException: Method Illuminate\Support\Collection::load does not exist` — silently failing every `MakeSearchable` queue job for a saved product (visible only as `FAIL` in the queue log, with the real exception in `storage/logs/laravel.log`). Fixed by having `RecommendationService` accumulate into a real `Eloquent\Collection` from the start.
+
+## [0.11.0] - 2026-09-01
+
+### Added
+
+- `Modules\Core\Catalog\Services\RecommendationService` — computes "related products" for a given product as a configurable, ordered chain of strategies (`config('catalog.recommendation_rules')`), not one hardcoded rule. Tops up from each successive rule until the limit (default 4) is reached or every rule is exhausted — e.g. 3 products from a same-category rule plus 1 from a random fallback — deduplicated across rules so the same product is never returned twice. Ships with `Modules\Core\Catalog\Recommendations\SameCategoryRule` (other products sharing the source product's first collection) and `RandomRule` (the universal fallback, placed last in the default chain). A new rule is just a class implementing `Modules\Core\Catalog\Contracts\RecommendationRule`. Documented in `docs/product-recommendations.md`.
+- `Modules\Core\Catalog\Services\ProductIndexer` embeds the result directly into each product's own Meilisearch document as `recommendations: [{id, name, price, image}, ...]` (`recommendations.id` filterable) — a product detail page renders its "related products" section with zero extra queries, same reasoning as the existing `collections` field. Deliberately embeds an `id` for the view to build a locale-correct URL from, not a resolved `href` — `product.show` is locale-prefixed, so a URL baked in at index time would only be correct for whichever locale happened to be active during that index run.
+- `Modules\Core\Catalog\Events\ProductSaved`/`ProductDeleted`, dispatched from `Product::saved()`/`Product::deleted()` in `CatalogServiceProvider` (the latter fires for both a soft delete and a force delete, matching Scout's own `unsearchable()` trigger point) — feed `Modules\Core\Catalog\Listeners\ReindexProductsRecommendingProduct`, which reverse-searches Meilisearch for every product currently recommending the changed/deleted one (`recommendations.id = "..."` — there's no Postgres relation for this, a recommendation only exists inside the index) and re-indexes them via Scout's own `->searchable()`. Product creation is deliberately not hooked into this: a new product not yet appearing as a recommendation elsewhere is an accepted staleness window, the same tradeoff already documented for `in_stock`/`price` — see `docs/product-recommendations.md`.
+- `CatalogServiceProvider` schedules `lunar:search:index "Lunar\Models\Product" --refresh` daily at 03:00 — a safety net on top of the event-driven reindexing above, covering a newly-created product not yet appearing as a recommendation and any other drift already accepted between reindexes. `--refresh` also re-syncs filterable/sortable index settings, not just documents.
+
+## [0.10.1] - 2026-09-01
+
+### Added
+
+- `Modules\Core\Localization\Services\StorefrontLabels::all()` gains three keys found missing from `3dealer`'s actual `storefront.*` translation usage: `shop.price_min`, `shop.price_max`, `shop.reset` (the price-filter sidebar's min/max labels and its reset link). Picked up by `InstallLunarCommand`'s existing per-key upsert — re-running `lunar:install` on an already-installed store adds only these three rows, leaving everything already seeded or admin-edited untouched.
+
+## [0.10.0] - 2026-08-31
+
+### Changed
+
+- **Breaking:** Upgraded `lunarphp/lunar`, `lunarphp/core`, `lunarphp/stripe`, `lunarphp/table-rate-shipping`, and `lunarphp/search` to `1.5.0`, and `filament/filament` to `v4.12.6` — the first Filament v4 admin panel on this codebase. `lunarphp/filament3-2fa` and `kalnoy/nestedset` are gone, replaced by Filament v4's native two-factor auth and `lunarphp/nestedset`. Ran Filament's automated `filament-v4` migration tool across `src/`, then hand-fixed three bugs it introduced or left behind: a stale `$infolist` variable reference in `CartResource`'s `ViewCart` page (the parameter had been renamed to `$schema` but the body wasn't updated), `ShippingMethodResourceExtension` rewritten to call `getDefaultChildComponents()` (returns `array|Schema`) instead of the type-safe `getChildComponents()` (always `array<Component>`), and — unrelated to the tool, but surfaced by the same PHP version bump — `InvalidCouponException`'s `readonly $code` property illegally shadowing the built-in `Exception::$code`, renamed to `$couponCode`. `LunarStaff::addActivitylogExcept()` updated for the renamed `two_factor_secret`/`two_factor_recovery_codes` staff columns (now `app_authentication_secret`/`app_authentication_recovery_codes`; `two_factor_confirmed_at` removed). Consuming apps must run `composer update boboko/core --with-all-dependencies` and `php artisan migrate`.
+
+### Added
+
+- `Modules\Core\Checkout\Contracts\PaymentDriver` — the abstraction every payment provider implements: `confirm(Cart $cart, string $type, string $fingerprint, array $data): Order` and `isConfigured(): bool`. A driver only ever calls `CheckoutService::placeOrder()` once it has, by whatever mechanism is native to that gateway, independently confirmed payment — never Lunar's raw `Cart::createOrder()`. This is what lets the storefront checkout sequence stay uniform regardless of which provider is active: set addresses, select shipping, hand off to whichever driver is configured, and the driver decides when (or whether) the order gets created.
+- `Modules\Core\Payment\Drivers\OfflinePaymentDriver` — shared by every payment type with no real gateway to confirm against (`cash-in-hand`, `cash-on-delivery`): places the order immediately via `CheckoutService::placeOrder()`, then sets the order status from `config("lunar.payments.types.{$type}.authorized")` using the type actually confirmed, not a hardcoded key, since one driver instance serves multiple types.
+- `Modules\Core\Payment\Drivers\StripePaymentDriver` — a fork, not a decoration, of `lunarphp/stripe`'s `StripePaymentType::authorize()`: that method is `final` and calls `Cart::createOrder()` directly with no seam to redirect into our fingerprint-checked `placeOrder()`, so this class reimplements its logic (intent retrieval, capture-on-policy, status mapping via `UpdateOrderFromIntent`) with that one substitution. Throws the new `Modules\Core\Payment\Exceptions\PaymentNotConfirmedException` on anything short of a genuinely confirmed payment intent — never falls through to placing an order on ambiguity.
+- `CheckoutService::getPaymentMethods(): array` — every payment type currently offered to the storefront: every key in `config('lunar.payments.types')` that is both administratively enabled (`Modules\Core\Payment\Models\PaymentMethod::enabled`) and whose driver reports `isConfigured()` (e.g. Stripe with no API key set is never offered, regardless of the enabled toggle). `selectPaymentMethod(string $type)` and `confirmPayment(string $type, array $data)` both validate against this list, throwing the new `UnknownPaymentTypeException` for a type that isn't currently offered — re-checked in `confirmPayment()` too, since a type could be disabled between selection and confirmation.
+- `CheckoutService::selectPaymentMethod()` snapshots `Cart::fingerprint()` into `cart->meta['checkout_fingerprint']` _after_ saving the chosen type and recalculating — the fingerprint has to reflect the final total including any payment-type-specific adjustment (e.g. a COD surcharge), which only exists once `payment_method` is set. `confirmPayment()` reads this stored fingerprint internally rather than taking one as a parameter: a storefront should never need to know `Cart::fingerprint()` exists or capture it at exactly the right moment itself.
+- `Modules\Core\Payment\Models\PaymentMethod` — one DB row per payment type key (matching `config('lunar.payments.types')`), `enabled` boolean plus a `data` jsonb column (starting with `fee`, the flat cash-on-delivery surcharge) — mirrors Lunar's own `Discount` model (a single jsonb column of keyed settings, not a fixed column per setting or a separate conditions table). Seeded idempotently by `InstallLunarCommand` (skip-if-exists per type, safe to re-run after installing a new payment-provider package), always `enabled: false` — a newly-seeded type shouldn't go live for shoppers before staff have configured and reviewed it. Admin-editable via the new `PaymentMethodResource` (inline enabled toggle, modal fee editor) under Settings.
+- `ApplyCashOnDeliveryFee` now reads its surcharge from `PaymentMethod` instead of static config, so it's admin-editable without a deploy.
+
+### Fixed
+
+- `CashOnDeliveryPaymentDriver` renamed to `OfflinePaymentDriver` and generalized to work for any offline-style type — it previously hardcoded `'cash-on-delivery'` when reading the post-placement order status from config, which would have silently read the wrong type's status the moment a second offline type (`cash-in-hand`) used it.
+
+## [0.9.0] - 2026-08-29
+
+### Added
+
+- `Modules\Core\Cart\Services\CartService` — the boboko-owned API for all cart mutation, wrapping Lunar's `CartSession`/`Cart` primitives: `addLine()`, `updateLine()`, `removeLine()`, `clear()`, `applyCoupon()`/`removeCoupon()` (throws `InvalidCouponException` on an invalid code), and save-for-later (`saveForLater()`/`moveToCart()`/`activeLines()`/`savedLines()`, backed by a `meta.saved_for_later` flag and a new `Modules\Core\Cart\Pipelines\ZeroSavedForLaterPrice` cart-line pipeline step that zeroes a saved line's price so it's excluded from cart totals without being removed). Dispatches 8 real domain events (`CartLineAdded`/`Updated`/`Removed`/`Saved`/`MovedToCart`, `CartCleared`, `CartCouponApplied`/`Removed`) — none have a listener yet, built so a future concern (analytics, recovery) has something to attach to. Documented in `docs/cart.md`.
+- `Modules\Core\Checkout\Services\CheckoutService` — the boboko-owned API for the checkout stage (address → shipping selection → order placement), sitting between `CartService` and `Order`: `setShippingAddress()`/`setBillingAddress()`, `getShippingOptions()`/`selectShippingOption()` (throws the new `InvalidShippingOptionException` on an identifier that doesn't resolve — previously a silent no-op), and `placeOrder(string $fingerprint)` (the fingerprint is mandatory, not optional — forces re-confirmation via Lunar's own `FingerprintMismatchException` if the cart changed since the shopper last saw its total). Dispatches `ShippingAddressSet`/`BillingAddressSet`/`ShippingOptionSelected`/`OrderPlaced`, each carrying richer, already-resolved payload (e.g. the resolved `ShippingOption`, not just its identifier) than `CartService`'s events. No exception wrapping otherwise — Lunar's own `CartException`/`FingerprintMismatchException` are already the right shape for a storefront to render as form errors. Documented in `docs/checkout.md`.
+- `Modules\Core\Cart\Filament\Resources\CartResource`'s list view now classifies every cart into one of four states — **Ongoing**, **Abandoned Cart**, **Abandoned Checkout**, **Completed** — instead of the previous two-tab Abandoned/Completed split, distinguishing a cart that never reached checkout from one that has a started-but-unplaced order (mirrors the real distinction in Lunar's own `Cart::scopeActive()`). Abandonment threshold is a fixed, configurable cutoff (`config('core.cart.abandoned_after')`, default 1 hour). Added a customer hyperlink (list column + a "View Customer" header action on the view page, both pointing straight at `customers/{id}` via the plain `customer_id` column, no extra query via the `customer` relation).
+- `Modules\Core\Cart\Commands\DetectAbandonedCarts` (`boboko:cart:detect-abandoned`, scheduled hourly) dispatches `Modules\Core\Recovery\Events\CartAbandoned`/`CheckoutAbandoned` for carts/checkouts past the abandonment cutoff — detection only, no persistence; a real tracking table is left for when `Recovery` is built as its own concern. Fixed a self-defeating bug from an earlier draft: marking a cart as notified by writing to it bumped `updated_at`, which immediately un-staled it for the next run's own cutoff check.
+- Merged the `Shipping-Carriers` branch: live carrier rate quoting and fulfillment for **ACS Courier** and **Box Now** (`Modules\Core\Shipping\Carriers\{Acs,BoxNow}`) on top of `lunarphp/table-rate-shipping` — `AcsRateDriver`/`BoxNowRateDriver` (live + static price-break resolution), `AcsFulfillmentService`/`BoxNowFulfillmentService` (shipment creation, label printing, cancellation via the new `Modules\Core\Shipping\Contracts\CarrierFulfillmentInterface`, resolved per-carrier via contextual container binding), `Modules\Core\Shipping\Models\Shipment`/`ShipmentInfo`, `PollShipmentTrackingJob` (scheduled every 30 minutes), `ManagePickupManifests` (Filament page for carrier manifest batching), and an `OrderViewExtension` adding a "Create Shipment" header action to Lunar's order view. Carrier credentials are published config (`config/shippingCarriers/{acs,boxnow}.php`), never committed.
+- `Modules\Core\Shipping\Concerns\CachesLivePricing` caches a live-priced carrier quote per `(rate, cart)` for 30 minutes — a real, billed API call that's otherwise re-run on every `getShippingOptions()`/`selectShippingOption()` call within the same checkout attempt. `Modules\Core\Shipping\Listeners\FlushLivePricingCache` invalidates it on the only two things that can change a quote: a cart line changing or the shipping address changing (deliberately **not** on order placement — the price the shopper was quoted must still be readable afterwards). Scoped generically to any `SupportsLivePricing` driver, not hardcoded to ACS.
+- `AcsRateDriver::resolveLivePrice()` now falls back to the rate's own configured static price if the live ACS API call fails (previously: the shipping option silently disappeared from the list on any API error, including a brief outage). `ManageShippingRates` (our Filament subclass of the vendor rates page) now allows a static price to be configured and saved on a "live" rate specifically for this fallback — previously those fields were hidden and discarded on save for any live-priced rate.
+
+### Fixed
+
+- Fixed a crash (`Attempt to read property "price" on null`) opening/editing a live-priced shipping rate with no fallback price configured yet — the vendor `ManageShippingRates` page's `afterStateHydrated` callback for the price field had no null-guard for a rate with zero `basePrices`, which is now the routine case for an unconfigured live rate.
+- Fixed the Filament admin panel's home URL (`/boboko/home`) incorrectly resolving to the Shipping module's `ManagePickupManifests` page instead of the Dashboard — Filament falls back to the first item of the first registered navigation group when no explicit `homeUrl()` is set, and `ManagePickupManifests` had no `navigationGroup`/`navigationSort` of its own. Fixed via explicit `navigationGroup = 'Sales'` / `navigationSort = 100`, placing it after Sales in the nav instead of first overall.
+
+## [0.8.0] - 2026-08-27
+
+### Added
+
+- `Modules\Core\Cart\Filament\Resources\CartResource` gives staff read-only visibility into carts in the Filament admin panel — Lunar ships no cart admin view at all. Scoped to carts with a known `user_id`/`customer_id` (an anonymous guest cart carries no identity staff could act on); list table shows customer/user, line/item counts (via Filament's built-in `->counts()`/`->sum()`, no per-row queries), currency, and last activity. List page has only two tabs, **Abandoned** (default active) and **Completed** — no "All" tab, so the list never runs an unfiltered fetch over the whole table. They key off whether the cart has a **placed** order (`orders.placed_at IS NOT NULL`), not `Cart::completed_at` — that column is declared/cast on the model but never actually written anywhere in Lunar core, so it's not a real signal; "Abandoned" mirrors Lunar's own `Cart::scopeActive()`. `getNavigationBadge()` shows the abandoned-cart count in the sidebar via a single `COUNT(*)` query, no rows loaded. View page runs `$cart->calculate()` once so line/cart totals (plain public properties Lunar never persists) are populated, without paying that cost per row in the list. Documented in `docs/cart.md`.
+
+## [0.7.0] - 2026-08-27
+
+### Added
+
+- `Modules\Core\Catalog\Services\CollectionService` provides category browsing/nav AND single-collection lookup from Meilisearch, mirroring `ProductService` exactly (`list()`, `getById()`, `getBySlug()`, same locale-resolution logic). `Modules\Core\Catalog\Services\CollectionIndexer` extends Lunar's own `Lunar\Search\CollectionIndexer` (which only carried `id`/`name`/`created_at`) to add `parent_id`, `_lft`/`_rgt` (nested-set tree position, filterable/sortable), `collection_group_id`, `slugs`, and `thumbnail`. `Modules\Core\Catalog\DTOs\CollectionFilters` supports `parentId` (children of a specific collection), `groupId`, and `rootOnly` (top-level collections, `parent_id IS NULL` — mutually exclusive with `parentId`). `Modules\Core\Catalog\Enums\CollectionSort` adds `Position` (`_lft:asc`, the recommended default for nav/tree UIs — matches admin arrangement order), `Name`, `Newest`. Must be registered in a consuming app's `config/lunar/search.php` (`Lunar\Models\Collection::class => CollectionIndexer::class`), same as `ProductIndexer`. Documented in `docs/collections.md`.
+- `Modules\Core\Localization\Services\StorefrontLabels::all()` extracts the default storefront UI label list out of `InstallLunarCommand` into its own class, and adds every previously-missing key (`nav.contact`, `product.description`/`no_image`/`read_more`/`reviews`, `customer_reviews`, `pagination.*`, `review.*`, `shop.*`) that had already been seeded manually in some stores but was absent from the command's own list — bringing the code-side default back in sync with what a real store actually has. `InstallLunarCommand::seedStorefrontLabels()` now does a **per-key upsert** instead of an all-or-nothing "only seed if the group is empty" guard: a key already present in the database (including one an admin has since edited via the Filament **Language Lines** resource) is left untouched, and only missing keys are created via `TranslationService::create()`. This makes it safe to add new keys to `StorefrontLabels::all()` later and re-run `lunar:install` on an already-installed store without either silently skipping the new keys (the old guard's behavior) or reverting an admin's edits back to the hardcoded default. Documented in `docs/localization.md` ("Seeding").
+- `Modules\Core\Catalog\Services\CollectionIndexer` adds `ancestors` — `[{id, name}, ...]` ordered root-first (via the newly eager-loaded `ancestors` relation) — so a breadcrumb can render directly from `CollectionService::getById()`/`getBySlug()` with zero extra queries, and `product_count` — how many products are in a collection or any of its descendants, queried from the product Meilisearch index at collection-index time via the same `collection_ids` field `ProductFilters(collectionId:)` filters against. Documented in `docs/collections.md`, including the reindex-ordering gotcha (`product_count` needs the product index reindexed first).
+- `Modules\Core\Catalog\Services\ProductIndexer` adds a filterable `in_stock` boolean — `true` if any variant currently passes `ProductVariant::canBeFulfilledAtQuantity(1)` (Lunar's own purchasability rule, not a naive `stock > 0` check). `Modules\Core\Catalog\DTOs\ProductFilters` gets a matching `inStockOnly` flag. Reflects stock as of the last reindex only — nothing currently reindexes a product when an order decrements its stock, since that's a cart/checkout concern this doesn't attempt to solve; see `docs/product-listing.md` ("Stock goes stale between orders").
+- `Modules\Core\Catalog\Services\ProductService::facets(string $field, ?ProductFilters $filters = null): array` returns Meilisearch facet value counts (e.g. `['Brand A' => 48, 'Brand B' => 135]`) for a discrete-value filterable field, scoped to the given filters. Uses Scout's plain `->options(['facets' => [...]])`, merged directly into the raw Meilisearch query the same way `filter`/`sort` already are — no adoption of Lunar's separate `SearchManager`/`Search` facade needed. `ProductService::priceRange(?ProductFilters $filters = null): array{min, max}` covers the numeric-field case `facets()` explicitly doesn't (`price` would otherwise return one "facet" per exact price) — backed by Meilisearch's `facetStats`, not `facetDistribution`. `priceRange()` always excludes `minPrice`/`maxPrice` from the filter it builds (via a new `$exclude` parameter on the private `buildFilter()`), so a price slider's own bounds don't shrink to whatever range is already selected on it; other filters (`collectionId`, `brand`, `inStockOnly`) still apply normally. Documented in `docs/product-listing.md`.
+
+### Changed
+
+- **Breaking:** Renamed the `Product` module to `Catalog`, flattened. Every class under `Modules\Core\Product\*` (`Contracts`, `DTOs`, `Enums`, `Services`, `Observers`, `Filament\Extensions`, `OptionTypes`) now lives under `Modules\Core\Catalog\*` at the same sub-path — e.g. `Modules\Core\Product\Services\ProductService` is now `Modules\Core\Catalog\Services\ProductService`, `Modules\Core\Product\DTOs\ProductFilters` is now `Modules\Core\Catalog\DTOs\ProductFilters`. Class names themselves are unchanged (still `ProductService`, `ProductIndexer`, `ProductFilters`, etc.) — only the namespace/folder moved, to make room for `Collection` as a sibling concern under the same `Catalog` umbrella rather than a disconnected top-level module. Consuming apps must update every `use Modules\Core\Product\...` import and any FQCN reference (`config/lunar/search.php`'s indexer registration, service provider bindings).
+- **Breaking:** `Modules\Core\Providers\ProductServiceProvider` renamed to `Modules\Core\Providers\CatalogServiceProvider` (composer.json's provider list updated accordingly) — it now only wires `Catalog`-namespace classes (`ProductOptionTypeManager`, `ProductOptionReindexObserver`), so the name follows the same by-concern convention as `LocalizationServiceProvider`/`ReviewServiceProvider`.
+- **Breaking:** `Modules\Core\Review`'s flat `Extensions/`/`Pages/` folders now nest under `Filament/`, matching the strict per-concern subfolder convention already applied to `Product`(now `Catalog`)/`Localization`. `Modules\Core\Review\Extensions\ProductResourceExtension` is now `Modules\Core\Review\Filament\Extensions\ProductResourceExtension`; `Modules\Core\Review\Pages\ManageProductReviews` is now `Modules\Core\Review\Filament\Pages\ManageProductReviews`. `Modules\Core\Review\Models\ProductReview` is unchanged.
+- **Breaking:** `ProductFilters(collectionId: ...)` now matches a product in that collection **or any of its descendant collections**, not just direct assignment. Products in a Shopify-imported tree are typically attached only to leaf collections, so filtering strictly on direct assignment meant a parent/root category page (`CollectionFilters(rootOnly: true)`'s results, or any non-leaf collection) always returned zero products even though real products existed several levels down. `Modules\Core\Catalog\Services\ProductIndexer` adds a new filterable `collection_ids` field — every directly-assigned collection's id unioned with all of its ancestors' ids (via the newly eager-loaded `collections.ancestors`) — and `ProductService::buildFilter()` now filters `collectionId` against `collection_ids` instead of the old `collections.id`. The display-only `collections` field (`{id, name}`, direct assignments) is unchanged and no longer filterable.
+
+## [0.6.1] - 2026-08-27
+
+### Added
+
+- `Modules\Core\Product\Contracts\ProductOptionTypeInterface` describes how a category of `Lunar\Models\ProductOption` (e.g. "Color", "Size") behaves — what structured data its values carry in their free-form `meta` jsonb column, and how an admin edits it via Filament — without introducing a new model. Registered via `Modules\Core\Product\Services\ProductOptionTypeManager::get()->register([...])` (a singleton registry, same shape as `Modules\Core\Notification\NotificationRegistry`) from a service provider's `boot()`. An admin then picks one per `ProductOption` from an "Option Type" dropdown on the option's own edit form (added by `Modules\Core\Product\Filament\Extensions\ProductOptionResourceExtension`), stored in `ProductOption::meta['option_type']` — deliberately not tied to the option's `handle`, since a shop's own handle naming shouldn't have to match a type's key. `Modules\Core\Product\Filament\Extensions\ValuesRelationManagerExtension` hooks Lunar's own `ValuesRelationManager` (both extensions via `LunarPanel::extensions()`, registered in `CorePlugin`) to append the resolved type's meta form fields to the stock "Values" tab — no fork of Lunar's classes needed. Ships a reference implementation, `Modules\Core\Product\OptionTypes\ColorOptionType`, registered automatically by the new `Modules\Core\Providers\ProductServiceProvider`. Documented in `docs/product-options.md`.
+- `Modules\Core\Product\Services\ProductIndexer::mapVariant()` now includes each option's `handle` (alongside its translated name) in a variant's indexed `options[]` — previously only the translated `option`/`value` names and `meta` were indexed, with no stable, locale-independent identifier for which option a value belongs to.
+- `Modules\Core\Product\Observers\ProductOptionReindexObserver`, wired in the new `Modules\Core\Providers\ProductServiceProvider`, keeps Meilisearch in sync when a `ProductOption` or `ProductOptionValue` is saved or deleted — e.g. picking an Option Type or editing a color's hex. `ProductIndexer::mapVariant()` embeds each option value's `meta` directly into a product's indexed document, but saving the option/value never fires the _product's_ own save events, so without this a changed hex would only reach the index on that product's next unrelated reindex. The observer resolves every `Lunar\Models\Product` whose variants use the changed option (or option value) via the `product_option_value_product_variant` pivot, and calls `->searchable()` on each.
+
+### Changed
+
+- **Breaking:** `Modules\Core\Product\Services\ProductIndexer`'s indexed `collections` field is now an array of `{id, name}` objects instead of two parallel arrays (`collections` as bare ID strings, `collection_names` as translated names joined only by array index). `collection_names` is removed. Filtering by collection now targets the nested field `collections.id` (Meilisearch supports filtering on nested object fields), not bare `collections` — `Modules\Core\Product\Services\ProductService::buildFilter()` updated accordingly; `ProductFilters(collectionId: ...)`'s public API is unchanged. Run `php artisan lunar:meilisearch:setup` then `lunar:search:index --refresh` after upgrading (see docs/product-listing.md "Gotchas").
+- **Breaking:** `ProductIndexer`'s indexed `review_count`/`average_rating` top-level keys are folded into the existing `reviews` key: `reviews` is now `{items, count, average_rating}` instead of a bare array with `review_count`/`average_rating` as separate sibling keys. `reviews` (the array of review items) moved to `reviews.items`.
+
+## [0.6.0] - 2026-08-27
+
+### Added
+
+- `Modules\Core\Localization\Models\LanguageLine` extends `spatie/laravel-translation-loader`'s `LanguageLine` to fall back to the store's actual default language (`LanguageCache::defaultLocale()`, backed by Lunar's `languages.default` flag) instead of the package's stock behavior of falling back to the static `config('app.fallback_locale')` — the two were previously disconnected, so changing the default language via the Filament **Languages** resource had no effect on which locale an untranslated storefront label silently fell back to. Swapped in automatically via `config('translation-loader.model')` in `LocalizationServiceProvider::register()`; no consuming app changes needed. Documented in `docs/localization.md` ("Fallback locale follows the store's default language").
+
+### Changed
+
+- **Breaking:** `Modules\Core\Catalog\ProductService::list()` now returns a real `Illuminate\Pagination\LengthAwarePaginator` (built from the localized Meilisearch hits) instead of a plain `array{data, meta}` — gives callers normal Laravel pagination behaviour (`$products->links()`, standard JSON serialization) without ever touching Scout's raw `paginateRaw()` response directly. `getById()`/`getBySlug()` are unaffected (still return `?array`).
+- `ProductService::withLocalizedFields()` (used by `list()`, `getById()`, `getBySlug()`) no longer hardcodes `name`/`description` as the only translated fields — it now reads every `TranslatedText` attribute on `Product` from `Lunar\Base\AttributeManifest` (the same source Lunar's own indexer reads), so a store's own custom translated attributes (e.g. `seo_title`, `seo_description`) are resolved and locale-stripped automatically with no code change here. Raw `{handle}_{locale}` keys (e.g. `name_el`, `seo_title_en`) are now stripped from every returned product, not just `name_*`/`description_*`.
+- Extracted `Modules\Core\Localization\Services\LanguageCache` (cached read layer over Lunar's `languages` table: `all()`, `defaultLocale()`, `availableLocales()`, `forget()`) out of `LocaleMiddleware`, which previously owned this as private/static methods despite not being middleware-specific behavior. `LocaleMiddleware` now takes `LanguageCache` via constructor injection. `LocaleMiddleware::defaultLocale()`/`forgetLanguagesCache()` (static) are removed — use `app(LanguageCache::class)` or inject `LanguageCache` directly.
+
+### Fixed
+
+- `Modules\Core\MigrateImport\JudgeMe\Resolvers\ProductResolver::resolve()` picked whichever `lunar_urls` row matched a slug first, which can be a soft-deleted product left behind by an earlier import batch rather than the current live one — a store can easily end up with more than one `Product` row sharing the same slug across re-imports, since a soft-deleted product's URL row isn't cleaned up. This silently broke every downstream lookup for that handle (e.g. `Modules\Core\MigrateImport\JudgeMe\JudgeMeExportImporter` logging "no product found for handle, skipping review" and dropping the row, even though a live product with that exact handle existed). Rewrote as a join against `lunar_products` — via `Product::query()`, so Eloquent's `SoftDeletes` global scope excludes trashed rows — so only a URL pointing at a live product resolves.
+- `Modules\Core\Review\Models\ProductReview` had no `registerMediaConversions()` at all, unlike `Product`/`ProductVariant` which get one automatically from Lunar's own `Lunar\Base\StandardMediaDefinitions`. `Modules\Core\Search\ProductIndexer::mapMedia()` is shared across product, variant, and review media and always requests the `small` conversion — the first time a review had an attached image, indexing it threw `Spatie\MediaLibrary\MediaCollections\Exceptions\InvalidConversion`, silently failing the product's `MakeSearchable` queue job (and everything queued after it, since Scout batches). Added a matching `small` conversion (300×300, same fit/border/background as Lunar's standard one) directly on `ProductReview`.
+
+### Breaking
+
+- Merged `Modules\Core\Catalog` and `Modules\Core\Search` into a single `Modules\Core\Product` concern, since both existed purely to serve `Product` (browsing/filtering vs. indexing/full-text search — two services, one concern), following a stricter subfolder convention (`Contracts/`, `Enums/`, `Services/`, `DTOs/`, `Models/`, etc. per concern) going forward:
+  - `Modules\Core\Catalog\ProductService` → `Modules\Core\Product\Services\ProductService`
+  - `Modules\Core\Catalog\ProductFilters` → `Modules\Core\Product\DTOs\ProductFilters`
+  - `Modules\Core\Catalog\ProductSort` → `Modules\Core\Product\Enums\ProductSort`
+  - `Modules\Core\Search\ProductIndexer` → `Modules\Core\Product\Services\ProductIndexer`
+  - `Modules\Core\Search\ProductSearchService` → `Modules\Core\Product\Services\ProductSearchService`
+
+  Consuming apps must update any direct references — notably `config/lunar/search.php`'s `'indexers'` map, which points at `ProductIndexer` by FQCN. `Modules\Core\Catalog\ProductOptionTypeInterface` (in-progress, not yet wired to anything) was deliberately left in place rather than moved.
+
+- Reorganized `Modules\Core\Localization` under the same stricter per-concern subfolder convention — `Events/`, `Filament/`, `Listeners/` were already correctly categorized; four loose root files moved into typed buckets by structural role:
+  - `Modules\Core\Localization\LocaleMiddleware` → `Modules\Core\Localization\Middleware\LocaleMiddleware`
+  - `Modules\Core\Localization\LanguageCacheObserver` → `Modules\Core\Localization\Observers\LanguageCacheObserver`
+  - `Modules\Core\Localization\TranslationReader` → `Modules\Core\Localization\Services\TranslationReader`
+  - `Modules\Core\Localization\TranslationService` → `Modules\Core\Localization\Services\TranslationService`
+
+  `Modules\Core\Localization\Services\LanguageCache` (added earlier in this same unreleased version) already lived at its correct final path — unaffected. The `'locale'` route-middleware alias (registered in `LocalizationServiceProvider`) is unaffected for consuming apps using it by string alias rather than FQCN.
+
+## [0.5.4] - 2026-08-26
+
+### Added
+
+- `Modules\Core\Catalog\ProductService::list()` accepts a `sort` parameter (new `ProductSort` enum: `PriceAsc`, `PriceDesc`, `Newest`), translated into a Meilisearch `sort` clause — `list()` previously had no way to order results, since it always searches with an empty query string and so has no relevance score to fall back on. `Modules\Core\Search\ProductIndexer::getSortableFields()` now also marks `price` sortable (Lunar's base indexer only marks `created_at`/`updated_at`/`skus`/`status`). Requires re-syncing index settings (`php artisan lunar:meilisearch:setup`) on existing stores. Documented in `docs/product-listing.md` ("Sorting").
+
+## [0.5.3] - 2026-08-26
+
+### Fixed
+
+- `Modules\Core\Search\ProductIndexer::toSearchableArray()` threw `column reference "id" is ambiguous` on Postgres when computing `channel_ids` — `$model->channels()->wherePivot('enabled', true)->pluck('id')` joins `lunar_channels` and `lunar_channelables`, both of which have an `id` column, and the unqualified `pluck('id')` left Postgres unable to resolve which table's column to select (SQLite/MySQL tolerated the ambiguity). Qualified as `pluck('lunar_channels.id')`.
+
+## [0.5.2] - 2026-08-26
+
+### Fixed
+
+- `Modules\Core\Localization\LocaleMiddleware`'s shared view data only ever surfaced a single alternate locale (`altLocale`/`altLocaleUrl`, found via `firstWhere('code', '!=', $current)`) — correct by coincidence for a 2-language store, but silently dropped every locale past the first "other" one found for a 3+ language store, with no error. Replaced with `altLocales`, a collection of every other configured language (`code`, `name`, `url` for the current route each), so a language switcher or `hreflang` tags scale to any number of locales. Documented in `docs/localization.md` ("Shared view data — language switcher and `hreflang` tags").
+
+## [0.5.1] - 2026-08-25
+
+### Added
+
+- `Modules\Core\Search\ProductIndexer` now indexes `channel_ids` (filterable) — Lunar's base indexer only marks `status` as filterable, not channel assignment, so storefront search couldn't otherwise scope results to products actually assigned and enabled on the current sales channel. Computed from `$product->channels()->wherePivot('enabled', true)`. Ported from an older `Products` branch whose remote had been deleted; the branch's other, now-superseded `ProductIndexer` changes were dropped in favor of the richer indexer already on `master` (collections, price, variants, reviews — see `0.5.0`).
+
 ## [0.5.0] - 2026-08-24
 
 ### Added
+
 - **`Modules\Core\Catalog\ProductService`**: storefront product listing/filtering (`list()`) and single-product lookup (`getById()`, `getBySlug()`), reading directly from the Meilisearch index rather than the database — one data source, no `->get()` model hydration. Returns plain arrays (not Eloquent models), meant to be called directly from a consuming app's controllers.
   - `ProductFilters` DTO: optional `collectionId`, `brand`, `minPrice`, `maxPrice`, translated into a Meilisearch `filter` expression.
   - Listing results are locale-aware: `withLocalizedFields()` resolves `name`/`description` from the indexer's per-locale fields, falling back to the store's default language (via `LocaleMiddleware::defaultLocale()`) when the current locale has no translation yet, instead of rendering blank.
@@ -17,26 +920,29 @@ The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/).
 - `docs/lunar.md` "Gotchas": three new entries hit while building this — `ProductOption`/`ProductOptionValue::name` isn't `attribute_data` (so `translateAttribute()` silently returns `null` for it), a running `queue:work` process not picking up an edited Scout indexer class, and Scout's `paginateRaw()->items()` on the Meilisearch driver returning the whole raw response rather than a hit list.
 
 ### Fixed
+
 - The admin login form (`Modules\Core\Auth\Filament\Pages\Login`) had no way back from the OTP-entry step to the email step short of reloading the page. A `back()` method resets to the email step; a "← Back" link/button is shown on the OTP step only.
 
 ## [0.4.0] - 2026-08-06
 
 ### Added
+
 - **Locale-prefixed routing** (`Modules\Core\Localization\LocaleMiddleware`): a `locale` route-middleware alias, opt-in per shop (not pushed onto the `web` group globally, since admin/Livewire/webhook routes must not be locale-redirected). Reads the first URL segment against Lunar's own `languages` table, sets `App::setLocale()`, and redirects unprefixed/unknown-locale requests to a resolved locale (`Accept-Language` match → default language → first language). Every locale is prefixed, including the default (`/el/...`, `/en/...`), never a bare root — avoids the hreflang/duplicate-content ambiguity of a bare-root default locale.
   - Language list cached with `Cache::rememberForever()`, invalidated via `Modules\Core\Localization\LanguageCacheObserver` dispatching `LanguageCreated`/`LanguageUpdated`/`LanguageDeleted` events (see below) rather than doing the work itself.
   - **Language rename safety**: renaming a `Language::code` (e.g. `el` → `gr`) no longer strands existing translations. `MigrateTranslationsForRenamedLanguage` (listening on `LanguageUpdated`) migrates every affected `LanguageLine.text` key from the old code to the new one and flushes both codes' translation caches — closing a real data-loss gap where a rename would otherwise make existing `LanguageLine` translations permanently unreachable.
-- **Storefront UI label translations**: pulled in `spatie/laravel-translation-loader` (self-registers via Composer package auto-discovery; its loader *extends* Laravel's file-based `FileLoader` and merges DB translations on top — existing Filament/Lunar vendor `lang/` strings are unaffected). Labels are looked up via Laravel's native `__('storefront.nav.cart')`, kept in its own `storefront` group so nothing collides with Lunar/Filament's own translation groups.
+- **Storefront UI label translations**: pulled in `spatie/laravel-translation-loader` (self-registers via Composer package auto-discovery; its loader _extends_ Laravel's file-based `FileLoader` and merges DB translations on top — existing Filament/Lunar vendor `lang/` strings are unaffected). Labels are looked up via Laravel's native `__('storefront.nav.cart')`, kept in its own `storefront` group so nothing collides with Lunar/Filament's own translation groups.
   - `Modules\Core\Command\InstallLunarCommand` (overriding `lunar:install`) seeds a starter set of ~15 common e-shop labels (`nav.*`, `cart.*`, `product.*`, `auth.*`, `search.*`, English + Greek), idempotently guarded so it's safe on every boot.
   - `Modules\Core\Localization\TranslationReader::group('storefront')` returns the whole reduced/cached label array for a locale (backed by `LanguageLine`'s own forever-cache) — for sharing to a view as `$labels` or `@json()`-ing to JS, on top of `__()` for single-key Blade lookups.
   - **Admin UI**: `Modules\Core\Localization\Filament\Resources\LanguageLineResource` (registered in `CorePlugin`) lists/searches/filters `language_lines` and edits each row's `group`, `key`, and one text input per locale currently in `lunar_languages` — locale columns/inputs are generated dynamically from the language list, so a new language needs no resource changes.
   - **Event-driven writes**: `Modules\Core\Localization\TranslationService` (`create`/`update`/`delete`) is the single write path for `LanguageLine` — the Filament resource's Create/Edit/Delete pages route through it rather than Filament's default direct-model writes. Dispatches `TranslationCreated`/`TranslationUpdated` (carries the full pre-update `{group, key, text}` snapshot, so a bare rename is tracked the same as a text edit)/`TranslationDeleted`, each handled by two listeners:
-    - `FlushTranslationCache` — closes a real gap in `LanguageLine`'s own self-invalidation, which only flushes locales/groups present *after* a save. Flushes the union of old and new group+locale combinations, so a locale removed from `text`, or a `group`/`key` rename, can't leave a stale cached array behind.
+    - `FlushTranslationCache` — closes a real gap in `LanguageLine`'s own self-invalidation, which only flushes locales/groups present _after_ a save. Flushes the union of old and new group+locale combinations, so a locale removed from `text`, or a `group`/`key` rename, can't leave a stale cached array behind.
     - `LogTranslationActivity` — audits every write via the existing `Modules\Core\Logging\ActivityLogService` (`lunar` activity log channel), same `created`/`updated`/`deleted` shape as every other domain write in this project. Properties are flattened with `Arr::dot()` before logging (`text.en`, `text.el` instead of a nested `text` object) since Filament's Activity resource renders `properties` with a flat `KeyValue` field that can't display nested arrays.
 - `Modules\Core\Providers\LocalizationServiceProvider` — split out of the growing `CoreServiceProvider` (per this project's own "split when a provider does too much" convention) to own all locale/translation middleware, observer, and event-listener registration.
 
 ## [0.3.0] - 2026-07-12
 
 ### Added
+
 - **Meilisearch product search**: pulled in `lunarphp/search` (Lunar's driver-agnostic search abstraction — `database`/`meilisearch`/`typesense` engines, selectable via Scout's own `SCOUT_DRIVER` config) and `lunarphp/meilisearch`, wiring Meilisearch in as the search engine for products.
   - `Search\ProductIndexer` overrides Lunar's own indexer to strip HTML tags from string fields (e.g. `name_en`, `description_en`) before they reach the search index — Lunar's default indexer sends raw attribute HTML straight through, which pollutes relevance ranking and highlighting with markup.
   - Meilisearch itself is treated as app-level infrastructure, not a `boboko-core` concern: the actual Meilisearch container, host port, and master key live in each consuming app's own `docker-compose.yml`/`.env` (e.g. `3dealer`), the same way Postgres and Valkey do — `boboko-core` only declares the PHP package dependency and the indexing code.
@@ -44,17 +950,20 @@ The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/).
 ## [0.2.0] - 2026-07-10
 
 ### Added
+
 - **Product reviews** (`Modules\Core\Review`): a new `ProductReview` model + `product_reviews` table (plain, unprefixed — same convention as `import_mappings`), linked to Lunar's `Product` via a `Product::reviews()` macro (registered in `CorePlugin`, since `Lunar\Models\Product` is a vendor model and can't be edited directly).
   - **JudgeMe CSV review importer** (`MigrateImport\JudgeMe\JudgeMeExportImporter`), wired into the existing `boboko:migrate:import --source=judgeme --type=export` command: reads a Judge.me review export, resolves each row's `product_handle` to a Lunar product via `Lunar\Models\Url`, and creates/updates `ProductReview` rows idempotently via `import_mappings` (`source=judgeme`, `source_type=review`, keyed on Judge.me's `metaobject_handle`). Rows with no matching product are skipped with a logged warning rather than failing the whole import.
   - Review images (`picture_urls` in the CSV) are downloaded and stored as real media via Spatie MediaLibrary (`ProductReview::IMAGES_COLLECTION`), not just linked by URL — consistent with how product images are handled.
   - **Admin UI**: a new "Reviews" sub-navigation page on the product edit screen (`Review\Pages\ManageProductReviews`, wired via `Review\Extensions\ProductResourceExtension`), listing rating/title/reviewer with View, Reply, and Delete actions. The Reply action lets staff write/edit a reply directly from the table, setting `replied_at`. The View modal shows full review detail (body, reviewer email, location, source, dates, reply, downloaded images).
 
 ### Fixed
+
 - `Shopify\ShopifyExportImporter` never wrote a Lunar `Url` (slug) row for imported products, despite `docs/shopify-import.md` specifying it should — meaning no code outside the importer itself could resolve "which Lunar product has handle X" (only the importer's own private `import_mappings` bookkeeping could). It now creates/updates a default `Url` row (`slug` = Shopify handle) per product on every import, which the new JudgeMe review importer depends on for product resolution.
 
 ## [0.1.0] - 2026-07-09
 
 ### Added
+
 - **Shipping**: registered Lunar's `lunarphp/table-rate-shipping` plugin (`ShippingPlugin`) directly on `CorePlugin`, so table-rate shipping is available to every consumer app without per-app wiring.
 - **Product migration/import framework** (`Modules\Core\MigrateImport`): a source-agnostic pipeline for importing a vendor's product catalog into Lunar.
   - `boboko:migrate:import` Artisan command — interactively prompts for source, type (export/API), and credentials or file path, then dispatches the import as a queued job (`RunMigrateImportJob`) on the default queue. The file-path prompt resolves relative to `storage/app/private/imports/`, so answering e.g. `shopify` picks up the first CSV found in `imports/shopify/` automatically.
@@ -69,6 +978,7 @@ The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/).
   - `CONTRIBUTE.md` — local dev setup (path-repo + `bin/dc-core.sh`), and the manual DB-verification workflow used to build this feature.
 
 ### Fixed
+
 - `ProductOptionResolver` created duplicate `ProductOption`/`ProductOptionValue` rows when the same option or value appeared with different casing across products (e.g. Shopify export rows using both "Size" and "size"), and could create a duplicate value within a single product's own variant rows due to relying on a stale lazy-loaded relation. Both now resolve by normalized (slugified) identity queried fresh from the database.
 - `boboko:migrate:import` could dispatch an import job with a blank file path (silent no-op failure) if the file-path prompt was answered empty; it now re-prompts until a valid, existing file is given.
 
@@ -77,6 +987,7 @@ The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/).
 First release.
 
 ### Added
+
 - OTP-based authentication built around `User` instead of `Customer` (`UserOtpService`, `UserOtpMail`), replacing the earlier customer-scoped OTP flow.
 - `UserCreated` event with a `CreateCustomerForUser` listener to provision a Lunar customer automatically when a user is created.
 - `UserRelationManager` for managing users from the customer resource in the panel.
@@ -87,7 +998,9 @@ First release.
 - `docs/modules.md` documenting module structure.
 
 ### Removed
+
 - `CustomerOtpMail` and `CustomerOtpService`, superseded by the user-based OTP flow.
 
 ### Dependencies
+
 - Added explicit `symfony/yaml` requirement (used directly by `Stoic::loadConfig()`).
diff --git a/composer.json b/composer.json
index 6d6b840..d871508 100644
--- a/composer.json
+++ b/composer.json
@@ -2,7 +2,7 @@
   "name": "boboko/core",
   "description": "Core module — authentication and shared panel behaviour",
   "type": "library",
-  "version": "0.5.0",
+  "version": "0.18.0",
   "autoload": {
     "psr-4": {
       "Modules\\Core\\": "src/"
@@ -10,14 +10,15 @@
   },
   "require": {
     "php": "^8.5",
-    "lunarphp/lunar": "1.3.0",
+    "lunarphp/lunar": "1.5.0",
     "laravel/framework": "^12.0",
     "laravel/tinker": "^3.0",
     "symfony/yaml": "^7.0",
-    "lunarphp/table-rate-shipping": "^1.3",
+    "lunarphp/table-rate-shipping": "1.5.0",
     "lunarphp/search": "*",
     "lunarphp/meilisearch": "*",
-    "spatie/laravel-translation-loader": "^2.8"
+    "spatie/laravel-translation-loader": "^2.8",
+    "stripe/stripe-php": "^16.6"
   },
   "require-dev": {
     "fakerphp/faker": "^1.23",
@@ -27,7 +28,8 @@
     "mockery/mockery": "^1.6",
     "nunomaduro/collision": "^8.6",
     "pestphp/pest": "^4.6",
-    "pestphp/pest-plugin-laravel": "^4.1"
+    "pestphp/pest-plugin-laravel": "^4.1",
+    "filament/upgrade": "^4.0"
   },
   "extra": {
     "laravel": {
@@ -35,8 +37,14 @@
         "Modules\\Core\\Providers\\CoreServiceProvider",
         "Modules\\Core\\Providers\\AuthServiceProvider",
         "Modules\\Core\\Providers\\CustomerServiceProvider",
+        "Modules\\Core\\Providers\\CheckoutServiceProvider",
+        "Modules\\Core\\Providers\\PaymentServiceProvider",
         "Modules\\Core\\Providers\\LocalizationServiceProvider",
+        "Modules\\Core\\Providers\\CatalogServiceProvider",
+        "Modules\\Core\\Providers\\CartServiceProvider",
         "Modules\\Core\\Providers\\ReviewServiceProvider",
+        "Modules\\Core\\Providers\\ShippingServiceProvider",
+        "Modules\\Core\\Providers\\OrderServiceProvider",
         "Modules\\Core\\Providers\\PrivacyServiceProvider"
       ]
     }
diff --git a/config/catalog.php b/config/catalog.php
new file mode 100644
index 0000000..14af9e4
--- /dev/null
+++ b/config/catalog.php
@@ -0,0 +1,25 @@
+<?php
+
+use Modules\Core\Catalog\Recommendations\RandomRule;
+use Modules\Core\Catalog\Recommendations\SameCategoryRule;
+
+return [
+    /*
+    |--------------------------------------------------------------------------
+    | Product recommendation rules
+    |--------------------------------------------------------------------------
+    |
+    | Tried in order by Modules\Core\Catalog\Services\RecommendationService —
+    | the first rule that returns at least one product wins. The order here IS
+    | the fallback chain: SameCategoryRule first, then RandomRule as a
+    | last-resort so a product page is never left with zero recommendations
+    | (as long as the store has more than one product). A consuming app can
+    | reorder, add, or remove rules freely — nothing about the chain shape is
+    | hardcoded in the service itself.
+    |
+    */
+    'recommendation_rules' => [
+        SameCategoryRule::class,
+        RandomRule::class,
+    ],
+];
diff --git a/config/core.php b/config/core.php
index 2c96443..bd901cb 100644
--- a/config/core.php
+++ b/config/core.php
@@ -45,4 +45,78 @@ return [
         'grace_period_days' => 30,
     ],
 
+    /*
+    |--------------------------------------------------------------------------
+    | Cart Abandonment Threshold
+    |--------------------------------------------------------------------------
+    |
+    | How long a cart (that hasn't converted to a placed order) can go without
+    | activity before Modules\Core\Cart\Filament\Resources\CartResource treats
+    | it as "Abandoned" rather than "Ongoing". Anything DateInterval::createFromDateString()
+    | accepts works, e.g. '1 hour', '30 minutes', '2 days'.
+    |
+    */
+
+    'cart' => [
+        'abandoned_after' => '1 hour',
+
+        /*
+        |----------------------------------------------------------------------
+        | Unrecoverable Cap
+        |----------------------------------------------------------------------
+        |
+        | Beyond this age, a stale cart stops being treated as an active
+        | "Abandoned Cart"/"Abandoned Checkout" (Modules\Core\Cart\Services\
+        | CartLifecycleService) — too old to be a realistic recovery target
+        | (pricing/stock/tax likely stale by then). This is about the
+        | abandoned-cart pipeline only, not data retention — no rows are
+        | deleted or pruned based on this value.
+        |
+        */
+
+        'unrecoverable_after' => '90 days',
+    ],
+
+    /*
+    |--------------------------------------------------------------------------
+    | Order Return Window
+    |--------------------------------------------------------------------------
+    |
+    | How many days after a carrier order is delivered (Order::fulfillment_status
+    | becomes 'return_window_open') before Modules\Core\Order\Commands\
+    | CloseExpiredReturnWindows auto-completes it, if no return was requested.
+    | Store-pickup orders have no return-window step and are unaffected by
+    | this value (see Modules\Core\Order\Listeners\CompleteOrderOnPickedUp).
+    |
+    */
+
+    'order' => [
+        'return_window_days' => 14,
+    ],
+
+    /*
+    |--------------------------------------------------------------------------
+    | Storefront OTP Login
+    |--------------------------------------------------------------------------
+    |
+    | Modules\Core\Auth\Services\UserOtpService's passwordless login.
+    | max_attempts caps how many wrong codes a shopper can guess against ONE
+    | generated code before it's invalidated outright. generation_limit/
+    | generation_decay_minutes cap how often a NEW code can be requested for
+    | the same email — independent of max_attempts, since generating a fresh
+    | code also resets the guess count, so an attempt cap alone doesn't stop
+    | an attacker from just requesting a new code every few tries. This same
+    | limit is also what stands between a malicious/careless caller and
+    | mail-bombing one inbox.
+    |
+    */
+
+    'auth' => [
+        'otp' => [
+            'max_attempts' => 5,
+            'generation_limit' => 3,
+            'generation_decay_minutes' => 10,
+        ],
+    ],
+
 ];
diff --git a/config/legal.php b/config/legal.php
new file mode 100644
index 0000000..fd37e39
--- /dev/null
+++ b/config/legal.php
@@ -0,0 +1,21 @@
+<?php
+
+return [
+    /*
+    |--------------------------------------------------------------------------
+    | Policy versions
+    |--------------------------------------------------------------------------
+    |
+    | Plain version strings, bumped by whoever edits the corresponding legal
+    | page — recorded alongside every consent/acceptance so a later dispute
+    | ("what did the shopper actually agree to?") can be answered from the
+    | order/cart itself rather than a live lookup against whatever the pages
+    | say TODAY. Not tied to any CMS/database row on purpose — this stays a
+    | plain config value the same way payment.php's cart_pipeline is a plain
+    | cross-cutting setting, not a per-instance one.
+    |
+    */
+    'privacy_policy_version' => env('LEGAL_PRIVACY_POLICY_VERSION', '2026-01-01'),
+
+    'terms_version' => env('LEGAL_TERMS_VERSION', '2026-01-01'),
+];
diff --git a/config/payment.php b/config/payment.php
new file mode 100644
index 0000000..01e293c
--- /dev/null
+++ b/config/payment.php
@@ -0,0 +1,28 @@
+<?php
+
+use Modules\Core\Payment\Pipelines\Cart\ApplyPaymentMethodFee;
+
+return [
+    /*
+    |--------------------------------------------------------------------------
+    | Lunar cart pipeline additions
+    |--------------------------------------------------------------------------
+    |
+    | Appended to config('lunar.cart.pipelines.cart') after ApplyShipping so
+    | the selected payment method's own fee (if any) is added to the
+    | shipping total before the final Calculate step sums everything up.
+    |
+    | This is the one thing left in this file — everything about WHICH
+    | payment methods exist (driver mapping, capture_mode, statuses) moved
+    | onto Modules\Core\Payment\Models\PaymentMethod's own row (see
+    | docs/payments.md): that's a per-instance, merchant decision, not a
+    | store-wide-singular setting, so it never belonged in config at all.
+    | This pipeline registration IS genuinely cross-cutting — every store
+    | using this driver gets the same cart-pipeline wiring, regardless of
+    | how many payment methods it configures.
+    |
+    */
+    'cart_pipeline' => [
+        ApplyPaymentMethodFee::class,
+    ],
+];
diff --git a/config/shippingCarriers/acs.php b/config/shippingCarriers/acs.php
new file mode 100644
index 0000000..cea2928
--- /dev/null
+++ b/config/shippingCarriers/acs.php
@@ -0,0 +1,50 @@
+<?php
+
+/*
+|--------------------------------------------------------------------------
+| ACS Courier credentials
+|--------------------------------------------------------------------------
+|
+| ACS requires two credential mechanisms simultaneously: an AcsApiKey
+| HTTP header (gates the REST gateway itself) and four account fields
+| (Company_ID/Company_Password/User_ID/User_Password) sent in every
+| request body. Both are supplied by ACS when your account is set up.
+|
+| Set these via environment variables — never commit real values.
+|
+| ACS_BASE_URL           Root REST endpoint (unversioned, single URL for
+|                        every ACSAlias call).
+| ACS_API_KEY            The AcsApiKey header value.
+| ACS_COMPANY_ID         Company_ID body field.
+| ACS_COMPANY_PASSWORD   Company_Password body field.
+| ACS_USER_ID            User_ID body field.
+| ACS_USER_PASSWORD      User_Password body field.
+| ACS_BILLING_CODE       Your ACS credit/billing code, used for price
+|                        calculation and voucher creation.
+| ACS_SENDER_*           Static sender details reused on every voucher.
+|
+*/
+
+return [
+
+    'base_url' => env('ACS_BASE_URL', 'https://webservices.acscourier.net/ACSRestServices/api/ACSAutoRest'),
+
+    'api_key' => env('ACS_API_KEY'),
+
+    'company_id' => env('ACS_COMPANY_ID'),
+    'company_password' => env('ACS_COMPANY_PASSWORD'),
+    'user_id' => env('ACS_USER_ID'),
+    'user_password' => env('ACS_USER_PASSWORD'),
+
+    'billing_code' => env('ACS_BILLING_CODE'),
+
+    'sender' => [
+        'name' => env('ACS_SENDER_NAME'),
+        'address' => env('ACS_SENDER_ADDRESS'),
+        'zip_code' => env('ACS_SENDER_ZIP'),
+        'phone' => env('ACS_SENDER_PHONE'),
+    ],
+
+    'timeout' => env('ACS_HTTP_TIMEOUT', 10),
+
+];
diff --git a/config/shippingCarriers/boxnow.php b/config/shippingCarriers/boxnow.php
new file mode 100644
index 0000000..672b95f
--- /dev/null
+++ b/config/shippingCarriers/boxnow.php
@@ -0,0 +1,47 @@
+<?php
+
+/*
+|--------------------------------------------------------------------------
+| Box Now credentials
+|--------------------------------------------------------------------------
+|
+| Box Now uses OAuth2 client-credentials: exchange BOXNOW_CLIENT_ID /
+| BOXNOW_CLIENT_SECRET for a Bearer access token (POST /auth-sessions,
+| ~1hr expiry), then attach it as an Authorization header on every call.
+| Unlike ACS, there is no separate per-request credential body — the
+| token alone authorizes all calls once obtained.
+|
+| Set these via environment variables — never commit real values.
+|
+| BOXNOW_BASE_URL         Root REST endpoint for delivery-requests/parcels.
+| BOXNOW_LOCATION_API_URL Separate, faster endpoint for origins/destinations
+|                         lookups (Box Now recommends this over the main
+|                         base URL for those two calls specifically).
+| BOXNOW_CLIENT_ID        OAuth2 client id.
+| BOXNOW_CLIENT_SECRET    OAuth2 client secret.
+| BOXNOW_ORIGIN_LOCATION_ID  Your warehouse's Box Now locationId, used as
+|                            the pickup origin on every delivery request.
+| BOXNOW_SENDER_*         Static sender contact details reused on every
+|                         delivery request.
+|
+*/
+
+return [
+
+    'base_url' => env('BOXNOW_BASE_URL', 'https://api-production.boxnow.gr/api/v1'),
+    'location_api_url' => env('BOXNOW_LOCATION_API_URL', 'https://locationapi-production.boxnow.gr/api/v1'),
+
+    'client_id' => env('BOXNOW_CLIENT_ID'),
+    'client_secret' => env('BOXNOW_CLIENT_SECRET'),
+
+    'origin_location_id' => env('BOXNOW_ORIGIN_LOCATION_ID'),
+
+    'sender' => [
+        'name' => env('BOXNOW_SENDER_NAME'),
+        'email' => env('BOXNOW_SENDER_EMAIL'),
+        'phone' => env('BOXNOW_SENDER_PHONE'),
+    ],
+
+    'timeout' => env('BOXNOW_HTTP_TIMEOUT', 10),
+
+];
diff --git a/database/migrations/2026_07_16_000001_create_shipments_table.php b/database/migrations/2026_07_16_000001_create_shipments_table.php
new file mode 100644
index 0000000..ffccb42
--- /dev/null
+++ b/database/migrations/2026_07_16_000001_create_shipments_table.php
@@ -0,0 +1,29 @@
+<?php
+
+use Illuminate\Database\Migrations\Migration;
+use Illuminate\Database\Schema\Blueprint;
+use Illuminate\Support\Facades\Schema;
+
+return new class extends Migration
+{
+    public function up(): void
+    {
+        Schema::create('shipments', function (Blueprint $table) {
+            $table->id();
+            $table->foreignId('order_id')->constrained(config('lunar.database.table_prefix').'orders');
+            $table->string('carrier');
+            $table->string('tracking_reference')->unique();
+            $table->string('parent_reference')->nullable();
+            $table->timestamp('label_printed_at')->nullable();
+            $table->string('manifest_reference')->nullable();
+            $table->timestamp('cancelled_at')->nullable();
+            $table->json('meta')->nullable();
+            $table->timestamps();
+        });
+    }
+
+    public function down(): void
+    {
+        Schema::dropIfExists('shipments');
+    }
+};
diff --git a/database/migrations/2026_07_21_000001_create_shipment_info_table.php b/database/migrations/2026_07_21_000001_create_shipment_info_table.php
new file mode 100644
index 0000000..fbfe887
--- /dev/null
+++ b/database/migrations/2026_07_21_000001_create_shipment_info_table.php
@@ -0,0 +1,28 @@
+<?php
+
+use Illuminate\Database\Migrations\Migration;
+use Illuminate\Database\Schema\Blueprint;
+use Illuminate\Support\Facades\Schema;
+
+return new class extends Migration
+{
+    public function up(): void
+    {
+        Schema::create('shipment_info', function (Blueprint $table) {
+            $table->id();
+            $table->foreignId('shipment_id')->constrained('shipments')->cascadeOnDelete();
+            $table->string('status');
+            $table->string('carrier_status')->nullable();
+            $table->text('message')->nullable();
+            $table->string('location')->nullable();
+            $table->timestamp('occurred_at');
+            $table->json('meta')->nullable();
+            $table->timestamps();
+        });
+    }
+
+    public function down(): void
+    {
+        Schema::dropIfExists('shipment_info');
+    }
+};
diff --git a/database/migrations/2026_08_31_000001_create_payment_methods_table.php b/database/migrations/2026_08_31_000001_create_payment_methods_table.php
new file mode 100644
index 0000000..4ac80b7
--- /dev/null
+++ b/database/migrations/2026_08_31_000001_create_payment_methods_table.php
@@ -0,0 +1,24 @@
+<?php
+
+use Illuminate\Database\Migrations\Migration;
+use Illuminate\Database\Schema\Blueprint;
+use Illuminate\Support\Facades\Schema;
+
+return new class extends Migration
+{
+    public function up(): void
+    {
+        Schema::create('payment_methods', function (Blueprint $table) {
+            $table->id();
+            $table->string('type')->unique();
+            $table->boolean('enabled')->default(true);
+            $table->json('data')->nullable();
+            $table->timestamps();
+        });
+    }
+
+    public function down(): void
+    {
+        Schema::dropIfExists('payment_methods');
+    }
+};
diff --git a/database/migrations/2026_09_03_000001_add_cascade_delete_to_product_reviews_product_id.php b/database/migrations/2026_09_03_000001_add_cascade_delete_to_product_reviews_product_id.php
new file mode 100644
index 0000000..38cc54a
--- /dev/null
+++ b/database/migrations/2026_09_03_000001_add_cascade_delete_to_product_reviews_product_id.php
@@ -0,0 +1,43 @@
+<?php
+
+use Illuminate\Database\Migrations\Migration;
+use Illuminate\Database\Schema\Blueprint;
+use Illuminate\Support\Facades\Schema;
+
+/**
+ * product_reviews.product_id's original foreign key (2026_07_10_000001) had
+ * no ON DELETE clause, so deleting a Product with reviews throws a
+ * constraint violation instead of the review rows going with it — unlike
+ * every other Product-dependent table (variants, media, etc.), which does
+ * cascade. A review is dependent, disposable data, not something worth
+ * blocking a product deletion over.
+ */
+return new class extends Migration
+{
+    public function up(): void
+    {
+        Schema::table('product_reviews', function (Blueprint $table) {
+            $table->dropForeign(['product_id']);
+        });
+
+        Schema::table('product_reviews', function (Blueprint $table) {
+            $table->foreign('product_id')
+                ->references('id')
+                ->on(config('lunar.database.table_prefix').'products')
+                ->cascadeOnDelete();
+        });
+    }
+
+    public function down(): void
+    {
+        Schema::table('product_reviews', function (Blueprint $table) {
+            $table->dropForeign(['product_id']);
+        });
+
+        Schema::table('product_reviews', function (Blueprint $table) {
+            $table->foreign('product_id')
+                ->references('id')
+                ->on(config('lunar.database.table_prefix').'products');
+        });
+    }
+};
diff --git a/database/migrations/2026_09_03_000001_create_stripe_payment_intents_table.php b/database/migrations/2026_09_03_000001_create_stripe_payment_intents_table.php
new file mode 100644
index 0000000..6f54166
--- /dev/null
+++ b/database/migrations/2026_09_03_000001_create_stripe_payment_intents_table.php
@@ -0,0 +1,46 @@
+<?php
+
+use Illuminate\Database\Schema\Blueprint;
+use Illuminate\Support\Facades\Schema;
+use Lunar\Base\Migration;
+
+/**
+ * First-party copy of lunarphp/stripe's own create_stripe_payment_intents_table
+ * migration (package removed in favour of depending on stripe/stripe-php
+ * directly — see Modules\Core\Payment\Support\StripeManager and
+ * Modules\Core\Payment\Models\StripePaymentIntent, which replace the
+ * package's own classes over this same table). Timestamped to run just
+ * before this app's own add_context_to_stripe_payment_intents migration,
+ * which already alters this table.
+ *
+ * Guarded with hasTable(): on any environment that already ran
+ * lunarphp/stripe's own copy of this migration before the package was
+ * removed, the table already exists — this migration is only the one that
+ * actually creates it on a fresh install/database from now on.
+ */
+return new class extends Migration
+{
+    public function up(): void
+    {
+        if (Schema::hasTable($this->prefix.'stripe_payment_intents')) {
+            return;
+        }
+
+        Schema::create($this->prefix.'stripe_payment_intents', function (Blueprint $table) {
+            $table->id();
+            $table->foreignId('cart_id')->constrained($this->prefix.'carts');
+            $table->foreignId('order_id')->nullable()->constrained($this->prefix.'orders');
+            $table->string('intent_id')->index();
+            $table->string('status')->nullable();
+            $table->string('event_id')->index()->nullable();
+            $table->timestamp('processing_at')->nullable();
+            $table->timestamp('processed_at')->nullable();
+            $table->timestamps();
+        });
+    }
+
+    public function down(): void
+    {
+        Schema::dropIfExists($this->prefix.'stripe_payment_intents');
+    }
+};
diff --git a/database/migrations/2026_09_03_000002_add_context_to_stripe_payment_intents.php b/database/migrations/2026_09_03_000002_add_context_to_stripe_payment_intents.php
new file mode 100644
index 0000000..06a5421
--- /dev/null
+++ b/database/migrations/2026_09_03_000002_add_context_to_stripe_payment_intents.php
@@ -0,0 +1,47 @@
+<?php
+
+use Illuminate\Database\Schema\Blueprint;
+use Illuminate\Support\Facades\Schema;
+use Lunar\Base\Migration;
+
+/**
+ * lunarphp/stripe's own stripe_payment_intents table already correlates a
+ * Stripe intent back to a cart/order via cart_id/order_id — exactly what
+ * Modules\Core\Payment\Drivers\StripePaymentDriver needs to recover
+ * $context in handleCallback(), a separate request (a webhook) from the
+ * pay()/authorize() call that originated it. Two columns this driver
+ * needs that the vendor table doesn't have:
+ *   - context: the full opaque $context bag pay()/authorize() received,
+ *     stored so handleCallback() can dispatch the SAME context the
+ *     original call would have, without Payment inventing its own
+ *     correlation table — see docs/payments.md "Async resolution".
+ *   - payment_type: the payment type key (e.g. 'stripe') pay()/authorize()
+ *     were called with — needed to dispatch Payment events with the
+ *     correct $type in handleCallback(), which otherwise has no way to
+ *     know it (a webhook payload doesn't carry it).
+ *
+ * Extends Lunar\Base\Migration (not the plain base Migration) so $this->prefix
+ * resolves the SAME table-prefix config every Lunar-owned table uses
+ * (config('lunar.database.table_prefix')) — the vendor migration that
+ * creates this table (lunarphp/stripe's create_stripe_payment_intents_table)
+ * already does this, so a store running with a non-default prefix (this
+ * one runs with 'lunar_') would otherwise have this migration fail against
+ * a table name that doesn't exist.
+ */
+return new class extends Migration
+{
+    public function up(): void
+    {
+        Schema::table($this->prefix.'stripe_payment_intents', function (Blueprint $table) {
+            $table->json('context')->nullable()->after('status');
+            $table->string('payment_type')->nullable()->after('context');
+        });
+    }
+
+    public function down(): void
+    {
+        Schema::table($this->prefix.'stripe_payment_intents', function (Blueprint $table) {
+            $table->dropColumn(['context', 'payment_type']);
+        });
+    }
+};
diff --git a/database/migrations/2026_09_05_000001_add_driver_columns_to_payment_methods.php b/database/migrations/2026_09_05_000001_add_driver_columns_to_payment_methods.php
new file mode 100644
index 0000000..0ea1f28
--- /dev/null
+++ b/database/migrations/2026_09_05_000001_add_driver_columns_to_payment_methods.php
@@ -0,0 +1,52 @@
+<?php
+
+use Illuminate\Database\Migrations\Migration;
+use Illuminate\Database\Schema\Blueprint;
+use Illuminate\Support\Facades\Schema;
+
+/**
+ * Moves the driver mapping and per-type behavior that used to live in
+ * config('lunar.payments.types.{type}.*') onto the PaymentMethod row
+ * itself — same DB-instance-vs-config split Modules\Core\Shipping's own
+ * shipping_methods table already has (code/driver/name/enabled columns,
+ * no driver mapping in any config file). See docs/payments.md.
+ *
+ *   - driver: the Modules\Core\Payment\Services\PaymentDriverRegistry key
+ *     (NOT the same as `type` — two rows can share one driver).
+ *   - name: admin-facing label. Nothing played this role before; `type`
+ *     was always the machine slug.
+ *   - capture_mode / captured_status / authorized_status: per-instance
+ *     behavior — fails the "would a store ever want two different answers
+ *     to this" cross-cutting-config test, so these move off config.
+ *   - position: admin-controlled display/checkout order.
+ *   - driver_missing_at: set by the payment:sync-drivers command when
+ *     `driver` no longer resolves via the registry — deliberately
+ *     separate from `enabled`, so a driver vanishing (a deploy removed
+ *     it) is never confused with an admin's own manual toggle, and a
+ *     driver that comes back later auto-clears this with no admin action.
+ */
+return new class extends Migration
+{
+    public function up(): void
+    {
+        Schema::table('payment_methods', function (Blueprint $table) {
+            $table->string('name')->nullable()->after('type');
+            $table->string('driver')->nullable()->after('name');
+            $table->string('capture_mode')->nullable()->after('driver');
+            $table->string('captured_status')->nullable()->after('capture_mode');
+            $table->string('authorized_status')->nullable()->after('captured_status');
+            $table->unsignedInteger('position')->default(0)->after('authorized_status');
+            $table->timestamp('driver_missing_at')->nullable()->after('position');
+        });
+    }
+
+    public function down(): void
+    {
+        Schema::table('payment_methods', function (Blueprint $table) {
+            $table->dropColumn([
+                'name', 'driver', 'capture_mode', 'captured_status',
+                'authorized_status', 'position', 'driver_missing_at',
+            ]);
+        });
+    }
+};
diff --git a/database/migrations/2026_09_08_000001_add_refunded_status_to_payment_methods.php b/database/migrations/2026_09_08_000001_add_refunded_status_to_payment_methods.php
new file mode 100644
index 0000000..00b973e
--- /dev/null
+++ b/database/migrations/2026_09_08_000001_add_refunded_status_to_payment_methods.php
@@ -0,0 +1,38 @@
+<?php
+
+use Illuminate\Database\Migrations\Migration;
+use Illuminate\Database\Schema\Blueprint;
+use Illuminate\Support\Facades\Schema;
+
+/**
+ * captured_status/authorized_status (added in 2026_09_05_000001) cover a
+ * payment being taken, but nothing wrote Order.status on a REFUND —
+ * Order::paymentStatus() (Order\Support\OrderStatus::payment(), derived
+ * live from transactions) already reflects a refund correctly, but the
+ * stored status column — the one admin filtering, customer emails, etc.
+ * actually key off — never moved. Same reasoning as captured_status/
+ * authorized_status: a store could plausibly want a different resulting
+ * status per payment method (e.g. a "Refunded" vs. a "Refund Pending"
+ * variant), so this is a PaymentMethod column, not cross-cutting config.
+ *
+ * Deliberately no separate void_status — void never moved money (it
+ * releases an authorization hold before any capture), so it doesn't carry
+ * the same "the customer needs to see this changed" weight a refund does;
+ * add one later if a real need for it shows up.
+ */
+return new class extends Migration
+{
+    public function up(): void
+    {
+        Schema::table('payment_methods', function (Blueprint $table) {
+            $table->string('refunded_status')->nullable()->after('authorized_status');
+        });
+    }
+
+    public function down(): void
+    {
+        Schema::table('payment_methods', function (Blueprint $table) {
+            $table->dropColumn('refunded_status');
+        });
+    }
+};
diff --git a/database/migrations/2026_09_11_000001_add_status_axes_to_orders_table.php b/database/migrations/2026_09_11_000001_add_status_axes_to_orders_table.php
new file mode 100644
index 0000000..001192a
--- /dev/null
+++ b/database/migrations/2026_09_11_000001_add_status_axes_to_orders_table.php
@@ -0,0 +1,43 @@
+<?php
+
+use Illuminate\Database\Migrations\Migration;
+use Illuminate\Database\Schema\Blueprint;
+use Illuminate\Support\Facades\Schema;
+
+/**
+ * Splits Lunar's single flat `status` column into three independently
+ * tracked axes — payment, fulfillment, return — so a payment refund and a
+ * fulfillment dispatch stop racing to write the same field, and each axis
+ * can be filtered/queried directly instead of overloading one string for
+ * three unrelated concerns. See Modules\Core\Order\Enums\OrderPaymentStatus/
+ * OrderFulfillmentStatus/OrderReturnStatus for the value vocabularies, and
+ * Modules\Core\Order\Listeners\ApplyResolvedPaymentStatus and friends for
+ * where these columns actually get written. `status` itself is left in
+ * place, unchanged — Lunar core still reads/writes it in places this
+ * package doesn't own — but nothing in this package's business logic keys
+ * off it anymore after this migration's consumers land.
+ *
+ * lunar_customers already has a direct precedent for a boboko-core
+ * migration altering a Lunar-owned table (see
+ * 2026_07_02_000002_drop_otp_from_lunar_customers_table.php) — this is not
+ * a new pattern for this codebase, just the first time it's applied to
+ * lunar_orders.
+ */
+return new class extends Migration
+{
+    public function up(): void
+    {
+        Schema::table('lunar_orders', function (Blueprint $table) {
+            $table->string('payment_status')->default('awaiting_payment')->after('status')->index();
+            $table->string('fulfillment_status')->default('unfulfilled')->after('payment_status')->index();
+            $table->string('return_status')->default('none')->after('fulfillment_status')->index();
+        });
+    }
+
+    public function down(): void
+    {
+        Schema::table('lunar_orders', function (Blueprint $table) {
+            $table->dropColumn(['payment_status', 'fulfillment_status', 'return_status']);
+        });
+    }
+};
diff --git a/database/migrations/2026_09_11_000002_create_order_status_transitions_table.php b/database/migrations/2026_09_11_000002_create_order_status_transitions_table.php
new file mode 100644
index 0000000..38b9a29
--- /dev/null
+++ b/database/migrations/2026_09_11_000002_create_order_status_transitions_table.php
@@ -0,0 +1,42 @@
+<?php
+
+use Illuminate\Database\Migrations\Migration;
+use Illuminate\Database\Schema\Blueprint;
+use Illuminate\Support\Facades\Schema;
+
+/**
+ * Append-only audit trail for Order's three status axes (see
+ * 2026_09_11_000001_add_status_axes_to_orders_table.php) — the thing
+ * `Lunar\Models\Order::getDefaultLogExcept()` explicitly denies (`status`
+ * is excluded from Lunar's own Spatie activity log), so this is a
+ * from-scratch mechanism, not a gap in an existing one.
+ *
+ * No `updated_at` — a row is never edited after it's written, only ever
+ * inserted. `event_class` is the FQCN of whatever business event/action
+ * caused the write (e.g. Modules\Core\Order\Events\OrderDispatched, or a
+ * plain string like 'Modules\Core\Shipping\Extensions\OrderViewExtension::
+ * markDispatchedAction' for a manual Filament action that has no backing
+ * event class of its own) — see Modules\Core\Order\Services\
+ * OrderStatusTransitionRecorder.
+ */
+return new class extends Migration
+{
+    public function up(): void
+    {
+        Schema::create('order_status_transitions', function (Blueprint $table) {
+            $table->id();
+            $table->foreignId('order_id')->constrained('lunar_orders')->cascadeOnDelete();
+            $table->string('axis');
+            $table->string('from_status')->nullable();
+            $table->string('to_status');
+            $table->string('event_class');
+            $table->timestamp('created_at')->useCurrent();
+            $table->index(['order_id', 'axis']);
+        });
+    }
+
+    public function down(): void
+    {
+        Schema::dropIfExists('order_status_transitions');
+    }
+};
diff --git a/database/migrations/2026_09_11_000003_backfill_order_status_axes.php b/database/migrations/2026_09_11_000003_backfill_order_status_axes.php
new file mode 100644
index 0000000..63a53d9
--- /dev/null
+++ b/database/migrations/2026_09_11_000003_backfill_order_status_axes.php
@@ -0,0 +1,79 @@
+<?php
+
+use Illuminate\Database\Migrations\Migration;
+use Illuminate\Support\Facades\DB;
+use Illuminate\Support\Facades\Log;
+use Lunar\Models\Order;
+use Modules\Core\Order\Enums\PaymentStatus;
+use Modules\Core\Order\Support\OrderStatus;
+
+/**
+ * Maps every existing order's flat `status` (as it stood before
+ * 2026_09_11_000001_add_status_axes_to_orders_table.php) onto the new
+ * payment_status/fulfillment_status/return_status columns. A separate
+ * migration from the schema change so the schema migration stays simply
+ * reversible via down(), and this data pass can be independently re-run.
+ *
+ * The flat status never captured refunds at all (no 'refunded' value was
+ * ever added to config('lunar.orders.statuses')), so the table-driven
+ * mapping below is corrected per-order by re-deriving
+ * Modules\Core\Order\Support\OrderStatus::payment() — the existing,
+ * unchanged derived-enum logic — and overriding payment_status to
+ * refunded/partially_refunded wherever it disagrees with the flat-status
+ * mapping. This is the one place the "keep the old derived enums" design
+ * decision earns its keep: refund-fraction math isn't reimplemented here,
+ * just reused.
+ */
+return new class extends Migration
+{
+    private const MAP = [
+        'awaiting-payment' => ['payment_status' => 'awaiting_payment', 'fulfillment_status' => 'unfulfilled'],
+        'payment-offline' => ['payment_status' => 'awaiting_payment', 'fulfillment_status' => 'unfulfilled'],
+        'payment-received' => ['payment_status' => 'paid', 'fulfillment_status' => 'unfulfilled'],
+        'ready-for-dispatch' => ['payment_status' => 'paid', 'fulfillment_status' => 'ready'],
+        'ready-for-pickup' => ['payment_status' => 'paid', 'fulfillment_status' => 'ready'],
+        'dispatched' => ['payment_status' => 'paid', 'fulfillment_status' => 'in_transit'],
+        'completed' => ['payment_status' => 'paid', 'fulfillment_status' => 'completed'],
+    ];
+
+    public function up(): void
+    {
+        Order::query()->with('transactions')->chunkById(200, function ($orders) {
+            foreach ($orders as $order) {
+                $mapped = self::MAP[$order->status] ?? null;
+
+                if ($mapped === null) {
+                    Log::warning('Order status axis backfill: unmapped status, leaving column defaults', [
+                        'order_id' => $order->id,
+                        'status' => $order->status,
+                    ]);
+
+                    continue;
+                }
+
+                $paymentStatus = $mapped['payment_status'];
+
+                $derived = OrderStatus::payment($order);
+
+                if ($derived === PaymentStatus::Refunded) {
+                    $paymentStatus = 'refunded';
+                } elseif ($derived === PaymentStatus::PartialRefund) {
+                    $paymentStatus = 'partially_refunded';
+                }
+
+                DB::table('lunar_orders')->where('id', $order->id)->update([
+                    'payment_status' => $paymentStatus,
+                    'fulfillment_status' => $mapped['fulfillment_status'],
+                    'return_status' => 'none',
+                ]);
+            }
+        });
+    }
+
+    public function down(): void
+    {
+        // Column defaults (set in the schema migration) are the correct
+        // "undo" — no need to reverse-map back to the flat status, since
+        // `status` itself was never touched by this migration.
+    }
+};
diff --git a/database/migrations/2026_09_11_000004_drop_status_columns_from_payment_methods_table.php b/database/migrations/2026_09_11_000004_drop_status_columns_from_payment_methods_table.php
new file mode 100644
index 0000000..6e24878
--- /dev/null
+++ b/database/migrations/2026_09_11_000004_drop_status_columns_from_payment_methods_table.php
@@ -0,0 +1,36 @@
+<?php
+
+use Illuminate\Database\Migrations\Migration;
+use Illuminate\Database\Schema\Blueprint;
+use Illuminate\Support\Facades\Schema;
+
+/**
+ * captured_status/authorized_status/refunded_status let a merchant pick
+ * which per-method Order::status label a payment outcome resulted in — a
+ * mechanism that only made sense while Order.status was the single field
+ * carrying that meaning. Modules\Core\Order\Listeners\
+ * ApplyResolvedPaymentStatus now writes a fixed 3-value payment_status
+ * column instead (see 2026_09_11_000001_add_status_axes_to_orders_table.php);
+ * there is no longer any per-method flexibility to preserve — "paid" is
+ * "paid" regardless of which method captured it. Dropped rather than left
+ * vestigial: keeping them visible in the admin would let a merchant
+ * configure something that silently does nothing.
+ */
+return new class extends Migration
+{
+    public function up(): void
+    {
+        Schema::table('payment_methods', function (Blueprint $table) {
+            $table->dropColumn(['captured_status', 'authorized_status', 'refunded_status']);
+        });
+    }
+
+    public function down(): void
+    {
+        Schema::table('payment_methods', function (Blueprint $table) {
+            $table->string('captured_status')->nullable();
+            $table->string('authorized_status')->nullable();
+            $table->string('refunded_status')->nullable();
+        });
+    }
+};
diff --git a/database/migrations/2026_09_12_000001_add_paid_to_orders_table.php b/database/migrations/2026_09_12_000001_add_paid_to_orders_table.php
new file mode 100644
index 0000000..e012efb
--- /dev/null
+++ b/database/migrations/2026_09_12_000001_add_paid_to_orders_table.php
@@ -0,0 +1,30 @@
+<?php
+
+use Illuminate\Database\Migrations\Migration;
+use Illuminate\Database\Schema\Blueprint;
+use Illuminate\Support\Facades\Schema;
+
+/**
+ * Order::paid/paid_at — entirely independent of the `status` column (see
+ * Modules\Core\Order\Services\OrderStatusFlow's own docblock for why
+ * payment timing, especially for cash-on-delivery, cannot be modeled as a
+ * status-sequence step). `paid` is the fast-filter boolean; `paid_at` is
+ * when it actually happened.
+ */
+return new class extends Migration
+{
+    public function up(): void
+    {
+        Schema::table('lunar_orders', function (Blueprint $table) {
+            $table->boolean('paid')->default(false)->after('status')->index();
+            $table->timestamp('paid_at')->nullable()->after('paid');
+        });
+    }
+
+    public function down(): void
+    {
+        Schema::table('lunar_orders', function (Blueprint $table) {
+            $table->dropColumn(['paid', 'paid_at']);
+        });
+    }
+};
diff --git a/database/migrations/2026_09_12_000002_backfill_single_order_status_and_paid.php b/database/migrations/2026_09_12_000002_backfill_single_order_status_and_paid.php
new file mode 100644
index 0000000..d9a9279
--- /dev/null
+++ b/database/migrations/2026_09_12_000002_backfill_single_order_status_and_paid.php
@@ -0,0 +1,116 @@
+<?php
+
+use Illuminate\Database\Migrations\Migration;
+use Illuminate\Support\Facades\DB;
+use Illuminate\Support\Facades\Log;
+use Lunar\Models\Order;
+use Modules\Core\Order\Enums\PaymentStatus;
+use Modules\Core\Order\Support\OrderStatus;
+
+/**
+ * Collapses the 3-axis (payment_status/fulfillment_status/return_status)
+ * model this session briefly built — abandoned before shipping — back
+ * onto a single `status` column plus the new independent `paid`/`paid_at`
+ * fields. Must run after 2026_09_12_000001 (adds paid/paid_at) and before
+ * 2026_09_12_000003 (drops the axis columns this migration still reads).
+ *
+ * Priority rule: axis data where it's genuinely non-default (this order
+ * was really moved through the axis system during this session's manual
+ * testing); the legacy `status` column (which may still hold pre-session
+ * hyphenated values) as fallback everywhere else.
+ */
+return new class extends Migration
+{
+    private const LEGACY_MAP = [
+        'awaiting-payment' => 'awaiting_payment',
+        'payment-offline' => 'awaiting_payment',
+        'payment-received' => 'processing',
+        'ready-for-dispatch' => 'ready_for_dispatch',
+        'ready-for-pickup' => 'ready_for_pickup',
+        'dispatched' => 'dispatched',
+        'completed' => 'completed',
+    ];
+
+    /**
+     * Axis fulfillment_status -> new single status, given branch. Axis
+     * 'delivered' folds into 'return_window_open' (same combined-value
+     * decision the going-forward design makes). Axis payment_status is
+     * used only to decide whether a fully-unfulfilled order should read
+     * as 'awaiting_payment' or 'processing'.
+     */
+    private function mapFromAxes(string $payment, string $fulfillment, string $return, bool $isPickup): ?string
+    {
+        if ($return === 'returned') {
+            return 'returned';
+        }
+        if ($return === 'requested') {
+            return 'return_requested';
+        }
+
+        return match ($fulfillment) {
+            'unfulfilled' => $payment === 'paid' ? 'processing' : 'awaiting_payment',
+            'processing' => 'processing',
+            'ready' => $isPickup ? 'ready_for_pickup' : 'ready_for_dispatch',
+            'in_transit' => 'dispatched',
+            'delivered', 'return_window_open' => 'return_window_open',
+            'picked_up' => 'picked_up',
+            'completed' => 'completed',
+            default => null,
+        };
+    }
+
+    public function up(): void
+    {
+        Order::query()->with('transactions')->chunkById(200, function ($orders) {
+            foreach ($orders as $order) {
+                $isPickup = $order->isStorePickupOrder();
+
+                $axisIsDefault = $order->payment_status === 'awaiting_payment'
+                    && $order->fulfillment_status === 'unfulfilled'
+                    && $order->return_status === 'none';
+
+                $status = $axisIsDefault
+                    ? (self::LEGACY_MAP[$order->status] ?? null)
+                    : $this->mapFromAxes($order->payment_status, $order->fulfillment_status, $order->return_status, $isPickup);
+
+                if ($status === null) {
+                    Log::warning('Single-status backfill: unmapped order, defaulting to awaiting_payment', [
+                        'order_id' => $order->id,
+                        'status' => $order->status,
+                        'payment_status' => $order->payment_status,
+                        'fulfillment_status' => $order->fulfillment_status,
+                        'return_status' => $order->return_status,
+                    ]);
+                    $status = 'awaiting_payment';
+                }
+
+                $derived = OrderStatus::payment($order);
+                $paid = $order->payment_status === 'paid'
+                    || in_array($derived, [PaymentStatus::Captured, PaymentStatus::Refunded, PaymentStatus::PartialRefund], true);
+
+                // A refund implies the order concluded via a return —
+                // even one backfilled to an early status (e.g. an order
+                // refunded before fulfillment ever started) is corrected
+                // to refunded/partially_refunded here, not left stuck
+                // pre-fulfillment with no sign a refund ever happened.
+                if ($derived === PaymentStatus::Refunded) {
+                    $status = 'refunded';
+                } elseif ($derived === PaymentStatus::PartialRefund) {
+                    $status = 'partially_refunded';
+                }
+
+                DB::table('lunar_orders')->where('id', $order->id)->update([
+                    'status' => $status,
+                    'paid' => $paid,
+                    'paid_at' => $paid ? ($order->placed_at ?? now()) : null,
+                ]);
+            }
+        });
+    }
+
+    public function down(): void
+    {
+        // No reverse mapping — column defaults (post-rollback of the
+        // schema migrations) are the correct "undo".
+    }
+};
diff --git a/database/migrations/2026_09_12_000003_drop_status_axes_from_orders_table.php b/database/migrations/2026_09_12_000003_drop_status_axes_from_orders_table.php
new file mode 100644
index 0000000..8644e00
--- /dev/null
+++ b/database/migrations/2026_09_12_000003_drop_status_axes_from_orders_table.php
@@ -0,0 +1,34 @@
+<?php
+
+use Illuminate\Database\Migrations\Migration;
+use Illuminate\Database\Schema\Blueprint;
+use Illuminate\Support\Facades\Schema;
+
+/**
+ * Reverses 2026_09_11_000001_add_status_axes_to_orders_table.php — the
+ * 3-axis model was abandoned before shipping in favor of a single
+ * `status` column plus independent `paid`/`paid_at` (see
+ * 2026_09_12_000001/000002). Must run after 2026_09_12_000002, which
+ * still reads these columns for the backfill.
+ */
+return new class extends Migration
+{
+    public function up(): void
+    {
+        Schema::table('lunar_orders', function (Blueprint $table) {
+            $table->dropColumn(['payment_status', 'fulfillment_status', 'return_status']);
+        });
+    }
+
+    public function down(): void
+    {
+        // Mirrors 2026_09_11_000001's own down() — restores columns
+        // empty/defaulted, does not attempt to resurrect real per-order
+        // values.
+        Schema::table('lunar_orders', function (Blueprint $table) {
+            $table->string('payment_status')->default('awaiting_payment')->after('paid_at')->index();
+            $table->string('fulfillment_status')->default('unfulfilled')->after('payment_status')->index();
+            $table->string('return_status')->default('none')->after('fulfillment_status')->index();
+        });
+    }
+};
diff --git a/database/migrations/2026_09_12_000004_drop_axis_from_order_status_transitions_table.php b/database/migrations/2026_09_12_000004_drop_axis_from_order_status_transitions_table.php
new file mode 100644
index 0000000..8ae0e36
--- /dev/null
+++ b/database/migrations/2026_09_12_000004_drop_axis_from_order_status_transitions_table.php
@@ -0,0 +1,33 @@
+<?php
+
+use Illuminate\Database\Migrations\Migration;
+use Illuminate\Database\Schema\Blueprint;
+use Illuminate\Support\Facades\Schema;
+
+/**
+ * There is only one status column left to audit (plus the synthetic
+ * 'paid' entry — see Modules\Core\Order\Listeners\RecordStatusTransition),
+ * so the `axis` column this table was created with
+ * (2026_09_11_000002_create_order_status_transitions_table.php) no longer
+ * means anything.
+ */
+return new class extends Migration
+{
+    public function up(): void
+    {
+        Schema::table('order_status_transitions', function (Blueprint $table) {
+            $table->dropIndex(['order_id', 'axis']);
+            $table->dropColumn('axis');
+            $table->index('order_id');
+        });
+    }
+
+    public function down(): void
+    {
+        Schema::table('order_status_transitions', function (Blueprint $table) {
+            $table->dropIndex(['order_id']);
+            $table->string('axis')->default('status')->after('order_id');
+            $table->index(['order_id', 'axis']);
+        });
+    }
+};
diff --git a/database/migrations/2026_09_12_000005_correct_cash_on_delivery_payment_method_driver.php b/database/migrations/2026_09_12_000005_correct_cash_on_delivery_payment_method_driver.php
new file mode 100644
index 0000000..e72c810
--- /dev/null
+++ b/database/migrations/2026_09_12_000005_correct_cash_on_delivery_payment_method_driver.php
@@ -0,0 +1,27 @@
+<?php
+
+use Illuminate\Database\Migrations\Migration;
+use Illuminate\Support\Facades\DB;
+
+/**
+ * The seeded 'cash-on-delivery' PaymentMethod row
+ * (Modules\Core\Command\InstallLunarCommand::seedPaymentMethods()) was
+ * wired to driver => 'offline' — the same immediate-capture driver as
+ * cash-in-hand. That's the bug that made COD "pay immediately" instead of
+ * waiting for staff to confirm cash was actually received. Repoints
+ * already-seeded environments to the new dedicated
+ * Modules\Core\Payment\Drivers\CashOnDeliveryPaymentDriver; the seeder
+ * itself is fixed separately for fresh installs.
+ */
+return new class extends Migration
+{
+    public function up(): void
+    {
+        DB::table('payment_methods')->where('type', 'cash-on-delivery')->update(['driver' => 'cash-on-delivery']);
+    }
+
+    public function down(): void
+    {
+        DB::table('payment_methods')->where('type', 'cash-on-delivery')->update(['driver' => 'offline']);
+    }
+};
diff --git a/database/migrations/2026_09_13_000001_rename_return_window_open_status_to_delivered.php b/database/migrations/2026_09_13_000001_rename_return_window_open_status_to_delivered.php
new file mode 100644
index 0000000..001b528
--- /dev/null
+++ b/database/migrations/2026_09_13_000001_rename_return_window_open_status_to_delivered.php
@@ -0,0 +1,30 @@
+<?php
+
+use Illuminate\Database\Migrations\Migration;
+use Illuminate\Support\Facades\DB;
+
+/**
+ * 'return_window_open' is renamed to 'delivered' — same status value,
+ * same meaning (the parcel arrived AND the return window is now open,
+ * still one combined moment — see Modules\Core\Order\Listeners\
+ * AdvanceFulfillmentOnDelivered), just a name a merchant expects to read
+ * on the order page rather than an internal mechanic. Also renames it in
+ * order_status_transitions' audit rows so the history stays consistent
+ * with `status` going forward.
+ */
+return new class extends Migration
+{
+    public function up(): void
+    {
+        DB::table('lunar_orders')->where('status', 'return_window_open')->update(['status' => 'delivered']);
+        DB::table('order_status_transitions')->where('from_status', 'return_window_open')->update(['from_status' => 'delivered']);
+        DB::table('order_status_transitions')->where('to_status', 'return_window_open')->update(['to_status' => 'delivered']);
+    }
+
+    public function down(): void
+    {
+        DB::table('lunar_orders')->where('status', 'delivered')->update(['status' => 'return_window_open']);
+        DB::table('order_status_transitions')->where('from_status', 'delivered')->update(['from_status' => 'return_window_open']);
+        DB::table('order_status_transitions')->where('to_status', 'delivered')->update(['to_status' => 'return_window_open']);
+    }
+};
diff --git a/database/migrations/2026_09_13_000002_create_manifests_table.php b/database/migrations/2026_09_13_000002_create_manifests_table.php
new file mode 100644
index 0000000..1e9abd4
--- /dev/null
+++ b/database/migrations/2026_09_13_000002_create_manifests_table.php
@@ -0,0 +1,43 @@
+<?php
+
+use Illuminate\Database\Migrations\Migration;
+use Illuminate\Database\Schema\Blueprint;
+use Illuminate\Support\Facades\Schema;
+
+/**
+ * A real record of "a manifest was issued", not just a loose
+ * manifest_reference string stamped onto each Shipment row — ACS's own
+ * ACS_Issue_Pickup_List call returns nothing beyond a PickupList_No (see
+ * Modules\Core\Shipping\Carriers\Acs\AcsFulfillmentService::issueManifest()),
+ * so this table is entirely our own bookkeeping: when the manifest was
+ * issued and how many shipments it included, not something re-derivable
+ * from the carrier later. `shipment_count` is denormalized (also
+ * countable via shipments()->count()) purely so the manifests list can
+ * render without an extra query per row.
+ *
+ * carrier-agnostic by design — see Modules\Core\Shipping\Contracts\
+ * SupportsManifestBatching, the same contract any future carrier
+ * (Speedex, etc.) implements to get manifest batching at all; this table
+ * has no ACS-specific columns.
+ */
+return new class extends Migration
+{
+    public function up(): void
+    {
+        Schema::create('manifests', function (Blueprint $table) {
+            $table->id();
+            $table->string('carrier');
+            $table->string('reference');
+            $table->unsignedInteger('shipment_count')->default(0);
+            $table->timestamp('issued_at');
+            $table->timestamps();
+
+            $table->unique(['carrier', 'reference']);
+        });
+    }
+
+    public function down(): void
+    {
+        Schema::dropIfExists('manifests');
+    }
+};
diff --git a/database/migrations/2026_09_13_000003_add_manifest_id_to_shipments_table.php b/database/migrations/2026_09_13_000003_add_manifest_id_to_shipments_table.php
new file mode 100644
index 0000000..4b3de28
--- /dev/null
+++ b/database/migrations/2026_09_13_000003_add_manifest_id_to_shipments_table.php
@@ -0,0 +1,82 @@
+<?php
+
+use Illuminate\Database\Migrations\Migration;
+use Illuminate\Database\Schema\Blueprint;
+use Illuminate\Support\Facades\DB;
+use Illuminate\Support\Facades\Schema;
+
+/**
+ * Replaces the loose manifest_reference string with a real manifests
+ * relation — see 2026_09_13_000002_create_manifests_table.php. Backfills
+ * one Manifest row per distinct (carrier, manifest_reference) pair
+ * already present in shipments, using the earliest label_printed_at (or
+ * updated_at as a fallback) among that group as a best-effort issued_at,
+ * since the exact original issue time was never recorded anywhere.
+ */
+return new class extends Migration
+{
+    public function up(): void
+    {
+        Schema::table('shipments', function (Blueprint $table) {
+            $table->foreignId('manifest_id')->nullable()->after('manifest_reference')->constrained()->nullOnDelete();
+        });
+
+        $groups = DB::table('shipments')
+            ->select('carrier', 'manifest_reference')
+            ->whereNotNull('manifest_reference')
+            ->distinct()
+            ->get();
+
+        foreach ($groups as $group) {
+            $shipments = DB::table('shipments')
+                ->where('carrier', $group->carrier)
+                ->where('manifest_reference', $group->manifest_reference)
+                ->get();
+
+            $issuedAt = $shipments->pluck('label_printed_at')->filter()->min()
+                ?? $shipments->pluck('updated_at')->min();
+
+            $manifestId = DB::table('manifests')->insertGetId([
+                'carrier' => $group->carrier,
+                'reference' => $group->manifest_reference,
+                'shipment_count' => $shipments->count(),
+                'issued_at' => $issuedAt,
+                'created_at' => $issuedAt,
+                'updated_at' => $issuedAt,
+            ]);
+
+            DB::table('shipments')
+                ->where('carrier', $group->carrier)
+                ->where('manifest_reference', $group->manifest_reference)
+                ->update(['manifest_id' => $manifestId]);
+        }
+
+        Schema::table('shipments', function (Blueprint $table) {
+            $table->dropColumn('manifest_reference');
+        });
+    }
+
+    public function down(): void
+    {
+        Schema::table('shipments', function (Blueprint $table) {
+            $table->string('manifest_reference')->nullable()->after('parent_reference');
+        });
+
+        DB::table('shipments')
+            ->whereNotNull('manifest_id')
+            ->orderBy('id')
+            ->each(function ($shipment) {
+                $manifest = DB::table('manifests')->find($shipment->manifest_id);
+
+                if ($manifest) {
+                    DB::table('shipments')->where('id', $shipment->id)->update([
+                        'manifest_reference' => $manifest->reference,
+                    ]);
+                }
+            });
+
+        Schema::table('shipments', function (Blueprint $table) {
+            $table->dropConstrainedForeignId('manifest_id');
+        });
+    }
+};
diff --git a/database/migrations/2026_09_14_000001_add_otp_attempts_to_users_table.php b/database/migrations/2026_09_14_000001_add_otp_attempts_to_users_table.php
new file mode 100644
index 0000000..bf43b6c
--- /dev/null
+++ b/database/migrations/2026_09_14_000001_add_otp_attempts_to_users_table.php
@@ -0,0 +1,30 @@
+<?php
+
+use Illuminate\Database\Migrations\Migration;
+use Illuminate\Database\Schema\Blueprint;
+use Illuminate\Support\Facades\Schema;
+
+/**
+ * Caps brute-forcing a 6-digit OTP code (1M combinations, 10-minute
+ * window, previously uncapped) — see Modules\Core\Auth\Services\
+ * UserOtpService::validate(), which now invalidates the code entirely
+ * (forcing a fresh generateAndSend()) once otp_attempts reaches its max,
+ * rather than leaving a live code guessable indefinitely within its
+ * expiry window.
+ */
+return new class extends Migration
+{
+    public function up(): void
+    {
+        Schema::table('users', function (Blueprint $table) {
+            $table->unsignedTinyInteger('otp_attempts')->default(0)->after('otp_expires_at');
+        });
+    }
+
+    public function down(): void
+    {
+        Schema::table('users', function (Blueprint $table) {
+            $table->dropColumn('otp_attempts');
+        });
+    }
+};
diff --git a/database/migrations/2026_09_15_000001_create_user_sessions_table.php b/database/migrations/2026_09_15_000001_create_user_sessions_table.php
new file mode 100644
index 0000000..dbfb6fa
--- /dev/null
+++ b/database/migrations/2026_09_15_000001_create_user_sessions_table.php
@@ -0,0 +1,41 @@
+<?php
+
+use Illuminate\Database\Migrations\Migration;
+use Illuminate\Database\Schema\Blueprint;
+use Illuminate\Support\Facades\Schema;
+
+/**
+ * A per-login session registry, independent of the actual session store
+ * driver (SESSION_DRIVER=redis in this app — no "sessions" table to
+ * purge by user_id the way the database driver would allow). Each
+ * successful OTP login (Modules\Core\Auth\Services\UserOtpService::
+ * validate()) records one row here and stamps the token into the
+ * Laravel session payload; Modules\Core\Auth\Http\Middleware\
+ * EnsureSessionNotRevoked checks it on every request. "Logout
+ * everywhere" (Modules\Core\Auth\Services\UserSessionService::
+ * revokeOtherSessions()) is then just marking every OTHER row
+ * revoked_at, no session-store-specific logic anywhere.
+ */
+return new class extends Migration
+{
+    public function up(): void
+    {
+        Schema::create('user_sessions', function (Blueprint $table) {
+            $table->id();
+            $table->foreignId('user_id')->constrained()->cascadeOnDelete();
+            $table->string('token', 64)->unique();
+            $table->string('user_agent')->nullable();
+            $table->string('ip_address', 45)->nullable();
+            $table->timestamp('last_used_at');
+            $table->timestamp('revoked_at')->nullable();
+            $table->timestamps();
+
+            $table->index(['user_id', 'revoked_at']);
+        });
+    }
+
+    public function down(): void
+    {
+        Schema::dropIfExists('user_sessions');
+    }
+};
diff --git a/database/migrations/2026_09_15_000001_make_payment_methods_name_translatable.php b/database/migrations/2026_09_15_000001_make_payment_methods_name_translatable.php
new file mode 100644
index 0000000..fc97701
--- /dev/null
+++ b/database/migrations/2026_09_15_000001_make_payment_methods_name_translatable.php
@@ -0,0 +1,65 @@
+<?php
+
+use Illuminate\Database\Migrations\Migration;
+use Illuminate\Support\Facades\DB;
+use Lunar\Models\Language;
+
+/**
+ * PaymentMethod.name becomes a locale-keyed JSON array (e.g.
+ * {"en": "Cash On Delivery", "el": "Αντικαταβολή"}), rendered in Filament
+ * via Lunar's own Lunar\Admin\Support\Forms\Components\TranslatedText —
+ * the same reusable component/data-shape Product/Collection names already
+ * use (Lunar\Base\Traits\HasTranslations), just applied directly to a
+ * plain column here rather than through attribute_data, since
+ * PaymentMethod is a merchant-configured settings row, not a translatable
+ * catalog attribute.
+ *
+ * Existing plain-string rows are preserved under the store's default
+ * Language code (falls back to 'en' if no Language row exists yet — this
+ * migration can run before lunar:install seeds one) rather than dropped,
+ * so an already-configured payment method's name isn't blanked out.
+ *
+ * Uses a raw `ALTER COLUMN ... TYPE` rather than Blueprint::change()
+ * (which requires doctrine/dbal — not installed in this project) —
+ * Postgres-specific (this project runs on `pgsql`, per its own docker
+ * setup), with an explicit USING clause since json isn't implicitly
+ * castable from varchar.
+ */
+return new class extends Migration
+{
+    public function up(): void
+    {
+        $defaultLocale = Language::where('default', true)->value('code') ?? 'en';
+
+        $existing = DB::table('payment_methods')->pluck('name', 'id');
+
+        DB::statement('ALTER TABLE payment_methods ALTER COLUMN name DROP DEFAULT');
+        DB::statement("ALTER TABLE payment_methods ALTER COLUMN name TYPE json USING NULL");
+
+        foreach ($existing as $id => $name) {
+            if ($name === null) {
+                continue;
+            }
+
+            DB::table('payment_methods')
+                ->where('id', $id)
+                ->update(['name' => json_encode([$defaultLocale => $name])]);
+        }
+    }
+
+    public function down(): void
+    {
+        $defaultLocale = Language::where('default', true)->value('code') ?? 'en';
+
+        $existing = DB::table('payment_methods')->pluck('name', 'id');
+
+        DB::statement('ALTER TABLE payment_methods ALTER COLUMN name TYPE varchar(255) USING NULL');
+
+        foreach ($existing as $id => $name) {
+            $decoded = json_decode((string) $name, true);
+            $flat = is_array($decoded) ? ($decoded[$defaultLocale] ?? reset($decoded) ?: null) : $name;
+
+            DB::table('payment_methods')->where('id', $id)->update(['name' => $flat]);
+        }
+    }
+};
diff --git a/database/migrations/2026_09_15_000002_make_shipping_methods_name_translatable.php b/database/migrations/2026_09_15_000002_make_shipping_methods_name_translatable.php
new file mode 100644
index 0000000..2a64fdd
--- /dev/null
+++ b/database/migrations/2026_09_15_000002_make_shipping_methods_name_translatable.php
@@ -0,0 +1,74 @@
+<?php
+
+use Illuminate\Support\Facades\DB;
+use Lunar\Base\Migration;
+use Lunar\Models\Language;
+
+/**
+ * ShippingMethod.name becomes a locale-keyed JSON array (e.g.
+ * {"en": "Standard Delivery", "el": "Κανονική Παράδοση"}), rendered in
+ * Filament via Lunar's own Lunar\Admin\Support\Forms\Components\
+ * TranslatedText (Modules\Core\Shipping\Extensions\
+ * ShippingMethodResourceExtension::replaceNameField()) — same shape/
+ * resolution as PaymentMethod.name (see its own migration,
+ * 2026_09_15_000001_make_payment_methods_name_translatable.php) and
+ * Product/Collection names (Lunar\Base\Traits\HasTranslations).
+ *
+ * ShippingMethod is a vendor (lunarphp/table-rate-shipping) table, but
+ * converting a vendor column's type via a migration is no different from
+ * any other schema change this project already makes against a vendor
+ * table (see database/migrations/2026_08_31_000001_create_payment_methods_table.php's
+ * sibling migrations for the same pattern against PaymentMethod) — there
+ * was no good reason to route this through `data.name` instead, unlike
+ * `data.fulfillment_type` which is a genuinely NEW field the vendor table
+ * never had at all.
+ *
+ * Existing plain-string rows are preserved under the store's default
+ * Language code (falls back to 'en' if no Language row exists yet)
+ * rather than dropped.
+ *
+ * Uses a raw `ALTER COLUMN ... TYPE` rather than Blueprint::change()
+ * (requires doctrine/dbal — not installed in this project) — Postgres-
+ * specific (this project runs on `pgsql`), with an explicit USING clause
+ * since json isn't implicitly castable from varchar.
+ */
+return new class extends Migration
+{
+    public function up(): void
+    {
+        $table = $this->prefix.'shipping_methods';
+        $defaultLocale = Language::where('default', true)->value('code') ?? 'en';
+
+        // The column is NOT NULL (vendor migration never marked it
+        // nullable) — converting via `USING NULL` first, then
+        // backfilling with a second UPDATE, violates that constraint
+        // before the backfill ever runs. json_build_object() converts
+        // each existing string in place, in the same statement, so the
+        // column is never transiently NULL. $defaultLocale is inlined
+        // (not bound) — parameter binding inside an ALTER TABLE ... USING
+        // expression isn't reliable across drivers; it's a Language::code
+        // value we control, not user input, so quote_literal-safe
+        // interpolation here is fine.
+        $quotedLocale = DB::getPdo()->quote($defaultLocale);
+
+        DB::statement("ALTER TABLE {$table} ALTER COLUMN name TYPE json USING json_build_object({$quotedLocale}, name)");
+    }
+
+    public function down(): void
+    {
+        $table = $this->prefix.'shipping_methods';
+        $defaultLocale = Language::where('default', true)->value('code') ?? 'en';
+
+        // Same NOT NULL constraint applies going back — ->>'{locale}'
+        // extracts the default locale's text value directly in the
+        // USING clause, falling back to the first key present via
+        // COALESCE for any row missing that locale (e.g. one only ever
+        // filled in via a non-default language).
+        $quotedLocale = DB::getPdo()->quote($defaultLocale);
+
+        DB::statement(
+            "ALTER TABLE {$table} ALTER COLUMN name TYPE varchar(255) ".
+            "USING COALESCE(name->>{$quotedLocale}, (SELECT value FROM json_each_text(name) LIMIT 1))"
+        );
+    }
+};
diff --git a/docs/cart.md b/docs/cart.md
new file mode 100644
index 0000000..0e99efa
--- /dev/null
+++ b/docs/cart.md
@@ -0,0 +1,280 @@
+# Cart Admin Visibility
+
+`Modules\Core\Cart\Filament\Resources\CartResource` gives staff read-only visibility into
+every cart in the Filament admin panel, guest carts included. Lunar itself ships no cart
+admin view at all — no Filament resource for `Cart`/`CartLine` exists anywhere in
+`lunarphp/lunar` or `lunarphp/core` — this is a from-scratch addition, not an extension of
+something Lunar half-built. See `docs/lunar.md`'s "Cart and Checkout" section for the
+underlying Lunar cart mechanics this resource reads from.
+
+---
+
+## Scope: every cart, identified or not
+
+`CartResource` lists every cart the four lifecycle states (below) cover, with no
+`user_id`/`customer_id` filter — an anonymous guest's session cart is included.
+
+This was a reversal of an earlier, deliberate call to exclude guest carts entirely (on the
+reasoning that an anonymous cart carries no identity a staff member could act on — no name, no
+email, nothing to follow up with — so listing every guest session cart would be noise, not a
+real admin capability). That reasoning holds for "can I click through to a Customer record,"
+but not for the resource's other real use — seeing how many carts are ongoing/abandoned right
+now regardless of who's shopping. Most real storefront traffic never reaches an identified
+user/customer, so excluding it silently undercounts exactly the thing `ListCarts`'s tabs (and
+`CartLifecycleService`, which they and `DetectAbandonedCarts` both build on) exist to report
+on. The `Customer`/`User` columns on a guest row just render "—" (Filament's `placeholder()`)
+instead of a link — nothing to click into, but the row and its contents are still visible via
+`ViewCart`.
+
+This does **not** mirror Shopify's admin (Shopify has no "all carts" view at all — only
+"Abandoned checkouts," gated on a shopper reaching checkout and entering contact info, a
+later/narrower stage than Lunar's `Cart`).
+
+---
+
+## Four states, not two — and not `Cart::completed_at`
+
+`Lunar\Models\Cart::completed_at` is declared and cast (`'completed_at' => 'datetime'`) but
+**never actually written anywhere in Lunar core** — grep `vendor/lunarphp/core/src` for it;
+the only hits are the property declaration and the cast. It is not a real signal. `Cart` has
+no `status` column at all — every state below is derived from relations/timestamps, not a
+single field.
+
+`Cart::scopeActive()` (Lunar's own "not yet converted to an order" scope) actually mixes two
+distinct states together: no order ever started, vs. a draft order exists
+(`placed_at IS NULL`) but was never placed — checkout was started, not finished. Those are
+different purchase-intent signals (see "Abandoned Cart vs Abandoned Checkout" below) and
+different reachability (checkout usually captures an email even for a guest), so
+`ListCarts::getTabs()` splits them into four tabs instead of `scopeActive()`'s two-state
+split.
+
+`Modules\Core\Cart\Services\CartLifecycleService` is the single source of truth for these four
+query shapes — both `ListCarts::getTabs()` (staff browsing) and `DetectAbandonedCarts`
+(abandonment-event dispatch) build on it, rather than each reimplementing the same split
+independently (which is what happened before this service existed, and is exactly the kind of
+drift that lets the admin panel and the recovery-email pipeline quietly disagree about what
+"abandoned" means):
+
+- **Ongoing** (`ongoing()`) — `scopeActive()` and recent `updated_at` (within
+  `abandonedCutoff()`). Default active tab on page load.
+- **Abandoned Cart** (`abandonedCarts()`) — `whereDoesntHave('orders')` and stale
+  `updated_at`.
+- **Abandoned Checkout** (`abandonedCheckouts()`) — has an order with `placed_at IS NULL`,
+  and stale `updated_at`.
+- **Completed** (`completed()`) — has an order with `placed_at IS NOT NULL`.
+
+Each method takes a `Builder` and returns it further scoped, so callers compose it onto
+whatever base query they already have (`CartResource::getEloquentQuery()` for the Filament
+tabs, a bare `Cart::query()` for the command). Deliberately query-shape-only: consent
+(`meta->recovery_consent`) and non-empty-lines filtering stay in `DetectAbandonedCarts`, not on
+the service — those gate whether a recovery *event* should fire, not what "abandoned" means to
+a staff member browsing the list.
+
+There is deliberately **no "All" tab.** Every row shown is always scoped to one of the four
+states above — the list never runs an unfiltered `Cart::query()->get()` over the whole
+(potentially large) table.
+
+### Abandoned Cart vs Abandoned Checkout — why they're not one bucket
+
+Different purchase intent, different reachability, and different recovery strategy — see
+`docs/recovery-strategies.md` for the full marketing-strategy discussion. In short:
+
+- **Abandoned Cart** (no order started) is a weak intent signal — often window-shopping, not
+  a near-purchase. Frequently unreachable (no email/identity at all for a true guest).
+  Recovery leans on on-site retargeting and ad remarketing rather than email.
+- **Abandoned Checkout** (draft order, never placed) is a strong intent signal — the shopper
+  committed to buying and something blocked completion. Checkout typically captures contact
+  info even for a guest, so this state is usually reachable. This is the state the
+  researched 1h/24h/72h recovery-email cadence targets specifically.
+
+`Modules\Core\Cart\Events\CartAbandoned` and `Modules\Core\Checkout\Events\CheckoutAbandoned`
+mirror this same split (see "Events" below) rather than one combined event.
+
+---
+
+## Why this scales fine at a large cart count
+
+Two things keep this cheap regardless of how many carts exist (10,000+):
+
+- **The list is always paginated.** Filament applies `LIMIT`/`OFFSET` to whichever tab's
+  query is active — a page only ever fetches one page's worth of rows, never the whole
+  table, "All" tab or not (and there is no "All" tab — see above).
+- **No per-row queries.** `lines_count`/`lines_sum_quantity` use Filament's built-in
+  `->counts('lines')`/`->sum('lines', 'quantity')`, which fold into the same query as the
+  rest of the list (one `LEFT JOIN`-based aggregate, not N separate lookups). There's no
+  per-record `getStateUsing()` closure anywhere in this table doing its own query — that's
+  the pattern to avoid if a future column needs derived data (see `Modules\Core\Catalog\
+  Services\ProductIndexer` for the general "compute once at index time / one aggregate
+  query, never per-row" principle this project follows elsewhere).
+
+The one thing that **does** scan more rows as the cart count grows is
+`CartResource::getNavigationBadge()` (see below) — but it's a `COUNT(*)`, not a fetch, and
+runs once per admin page load, not once per cart row.
+
+---
+
+## Navigation badge — abandoned cart count
+
+```php
+public static function getNavigationBadge(): ?string
+{
+    return (string) static::getEloquentQuery()->active()->where('updated_at', '<=', static::abandonedCutoff())->count();
+}
+```
+
+Shows the number of abandoned carts (not all carts — a converted cart isn't something a
+staff member needs to keep noticing) next to "Carts" in the sidebar. `->count()` compiles to
+a single `SELECT COUNT(*) ...` — confirmed via query log — no rows are ever loaded just to
+render the badge.
+
+---
+
+## The view page runs the cart's full calculate pipeline — once
+
+`ViewCart::resolveRecord()` calls `$cart->calculate()` before rendering, since `CartLine`'s
+computed properties (`unitPrice`, `total`, etc.) and `Cart`'s own totals (`subTotal`, `total`,
+...) are plain public properties populated as a side effect of that pipeline — never
+persisted, so a plain Eloquent-fetched `Cart` has them all `null`/unset (see `docs/lunar.md`
+Gotchas). This only runs on the single-record view page, not per row in the list table —
+running the full 5-step pipeline for every row of a paginated list would be needless cost for
+data the list doesn't display.
+
+---
+
+## Not built: staff editing a cart
+
+The resource is deliberately read-only (`canCreate()` returns `false`, no edit page
+registered). A cart is owned by the storefront's own add/update/remove flow
+(`CartSession`/`Cart::add()`/etc.) — hand-editing cart contents from the admin panel isn't a
+supported use case here.
+
+---
+
+## `CartService` — the storefront-facing API
+
+`Modules\Core\Cart\Services\CartService` mirrors `Modules\Core\Catalog\Services\
+ProductService`/`CollectionService`'s shape — one boboko-owned API a storefront calls, so
+Lunar's own `CartSession`/`Cart` stay an implementation detail rather than something a
+consuming app depends on directly.
+
+- `current()` / `currentOrCreate()` — the latter force-creates a cart (`CartSession::manager()`),
+  the former doesn't (`CartSession::current()`, returns `null` for a fresh visitor — see
+  `docs/lunar.md`'s Cart gotchas).
+- `addLine()` / `updateLine()` / `removeLine()` / `clear()` — thin wrappers over
+  `Cart::add()`/`updateLine()`/`remove()`/`clear()`. No boboko-owned exception types wrap
+  Lunar's own cart exceptions (`InvalidCartLineQuantityException`, `CartLineIdMismatchException`,
+  etc.) — they propagate as-is; a wrapper would add indirection with identical semantics.
+- `applyCoupon()` / `removeCoupon()` — sets/clears `Cart::coupon_code` (there's no dedicated
+  Lunar action for this, unlike add/update/remove). `applyCoupon()` validates via
+  `Discounts::validateCoupon()` first and throws `Modules\Core\Cart\Exceptions\
+  InvalidCouponException` on a bad code — `CouponString`'s cast only normalizes casing, it
+  doesn't validate anything, so setting `coupon_code` directly would silently accept a bogus
+  code and just not discount anything once calculated.
+- `saveForLater()` / `moveToCart()` / `activeLines()` / `savedLines()` — see "Save for later"
+  below.
+
+Every mutating method returns the recalculated `Cart` (matching Lunar's own `Cart::add()`
+etc., which already return `$this` after `refresh()->recalculate()`) and dispatches a
+matching domain event.
+
+### Events — Lunar dispatches none of its own
+
+`Lunar` dispatches zero cart events — no "item added," no "cart created" (see
+`docs/lunar.md`'s Cart gotchas). `CartService` fills that gap with its own, dispatched after
+the underlying Lunar operation completes:
+
+`CartLineAdded`, `CartLineUpdated`, `CartLineRemoved`, `CartCleared`, `CartCouponApplied`,
+`CartCouponRemoved`, `CartLineSaved`, `CartLineMovedToCart` — all under
+`Modules\Core\Cart\Events`. `CartAbandoned`/`CheckoutAbandoned` live under
+`Modules\Core\Recovery\Events` instead, not `Cart`/`Checkout` — see "Abandonment detection"
+below for why.
+
+**None of these currently have a listener.** They're dispatched-but-unconsumed by design —
+built so something downstream (reindexing, notifications, a future read-side reporting
+service) has a hook to attach to, not because a concrete consumer exists today. This was a
+deliberate decision, not an oversight — see the "don't build speculative infrastructure"
+calls made elsewhere in this project (e.g. not wrapping Lunar's cart exceptions).
+
+**Why not wired to Spatie's Activity Log:** `Cart`/`CartLine` already use Lunar's own
+`LogsActivity` trait (Spatie's package, Lunar's defaults) — confirmed from source, this logs
+model saves/deletes automatically, independent of actor. `Modules\Core\Logging\
+ActivityLogService` (this project's own wrapper, used by e.g. `LogTranslationActivity`) is
+hardcoded to the `staff` guard — correctly scoped for staff-driven writes (Filament admin
+actions), but wrong for customer-driven cart activity, which would resolve `causedBy()` to
+`null` every time. Both `ActivityLogService` and `Cart`/`CartLine`'s native `LogsActivity`
+write to the **same** `log_name = 'lunar'` / `activity_log` table, with no built-in
+separation beyond reading `causer_type` per row — a real limitation worth knowing about, but
+not one this project is fixing by giving Cart a distinct `log_name`, since every other Lunar
+model logs to `'lunar'` too and a Cart-only carve-out would just be inconsistent. The
+intended fix, if this becomes a real need, is a read-side service that queries `activity_log`
+and classifies by `causer_type`/`log_name` — not touching every write site.
+
+### Save for later
+
+A `CartLine` can be moved out of the purchasable cart without being deleted — flagged via
+`meta.saved_for_later`, not a new column (matches the free-form-JSON pattern already used
+elsewhere, e.g. `ProductOptionValue::meta`). `Modules\Core\Cart\Pipelines\
+ZeroSavedForLaterPrice` (registered in `config('lunar.cart.pipelines.cart_lines')`, after the
+stock `GetUnitPrice`) zeroes `unitPrice`/`unitPriceInclTax` for flagged lines **before**
+Lunar's own `CalculateLines` pipeline step sums the cart — `CalculateLines` sums every
+`CartLine` unconditionally with no meta-based exclusion of its own, so zeroing the price
+upstream is what makes `Cart::subTotal`/`total` naturally correct without a second pass or
+callers needing a different totals accessor.
+
+`Lunar\Actions\Carts\UpdateCartLine` **replaces** the whole `meta` column on write (plain
+`update(['meta' => $meta])`, not a merge) — `saveForLater()`/`moveToCart()` read the line's
+existing meta and merge in the flag change before calling `Cart::updateLine()`, or an
+unrelated meta key set by something else would be silently wiped.
+
+### Coupons
+
+See `CartService::applyCoupon()`/`removeCoupon()` above. `Lunar\Base\Casts\CouponString`
+just upper-cases the code; `Lunar\Managers\DiscountManager::validateCoupon()` (via the
+`Discounts` facade) is the actual check — does a matching `Discount` (type `AmountOff` or
+`BuyXGetY`) exist, `active()`, with `max_uses` not exhausted.
+
+---
+
+## Abandonment detection
+
+"Abandoned" is a **derived** state (`Cart::updated_at` older than
+`config('core.cart.abandoned_after')`, default `1 hour`) — nothing transitions a cart into it
+via a normal Eloquent write, so there's no model-event hook to dispatch from directly.
+`Modules\Core\Cart\Commands\DetectAbandonedCarts` (registered on an hourly schedule by
+`Modules\Core\Providers\CartServiceProvider`) is the only place that moment gets detected: it
+builds on the same `CartLifecycleService::abandonedCarts()`/`abandonedCheckouts()` queries
+`ListCarts::getTabs()` uses (no order at all vs. draft order never placed) and dispatches
+`Modules\Core\Recovery\Events\CartAbandoned`/`CheckoutAbandoned` for anything currently stale
+that also has `meta->recovery_consent = true`.
+
+### Cart/Checkout have zero abandonment-related writes — by design
+
+`DetectAbandonedCarts` **only dispatches** — it never writes to `Cart`/`Order` at all. An
+earlier version recorded an "already notified" marker on `Cart::meta`/`Order::meta` to avoid
+refiring the same event every run, but that `->save()` call bumped `Cart::updated_at` as an
+Eloquent side effect — since `updated_at` is also the field abandonment staleness is computed
+from, the write **un-staled the very cart it had just marked abandoned**: confirmed live, a
+cart that correctly fired `CartAbandoned` showed back up as "Ongoing," not "Abandoned Cart,"
+on the very next tab-count check.
+
+The fix wasn't to write the marker more carefully — it was to stop `Cart`/`Checkout` from
+having any way to write abandonment state at all. Deduplication ("has this cart already been
+notified") is deliberately **not** this command's job; it belongs to `Recovery` (not yet
+built — see `docs/recovery-strategies.md`), which will own its own tracking table, keeping
+`Cart`/`Order` permanently free of abandonment-related columns or `meta` keys.
+
+**Current tradeoff, accepted deliberately**: until `Recovery` exists, every cart still
+matching the "abandoned" query refires its event on every hourly run — there is no dedup at
+all right now. That's fine today only because nothing consumes these events yet (see
+"Events" above); it would need addressing before anything real listens for them.
+
+---
+
+## Recovery Sequences — design only, not built
+
+See `docs/recovery-strategies.md` — a full marketing-strategy discussion and a first-pass
+feature design for an admin-configurable sequence of "touches" (delay + optional discount +
+label) per abandonment type. Explicitly parked as an open design question, not scoped for
+implementation yet — whether this belongs under `Cart`, a new `Recovery`/`Marketing` concern,
+and how far the touch model needs to flex (channel choice, value-based branching, segment
+targeting) are all still undecided.
diff --git a/docs/checkout.md b/docs/checkout.md
new file mode 100644
index 0000000..9f486b8
--- /dev/null
+++ b/docs/checkout.md
@@ -0,0 +1,155 @@
+# Checkout — Design Notes
+
+**Status: design finalized, not yet built.** This is the design spec for
+`Modules\Core\Checkout\Services\CheckoutService`, plus the three-stage lifecycle model it's
+part of. Nothing in this document is implemented yet.
+
+---
+
+## Three-stage lifecycle: Cart → Checkout → Order
+
+Each stage is its own concern, not a phase inside a shared one — matching the pattern already
+established this session (`Recovery` was split out from `Cart` specifically because
+abandonment detection is a different lifecycle stage than line-item mutation, even though it
+reads `Cart` state).
+
+- **`Cart`** — line items, coupons, save-for-later (`docs/cart.md`). Ends the moment
+  `Cart::createOrder()` is called.
+- **`Checkout`** — the placement moment itself: setting addresses, selecting a shipping
+  option, placing the order. Starts where Cart ends, ends the instant an `Order` exists.
+  This document.
+- **`Order`** — everything after an order exists: status transitions (`Order::status`,
+  changed via the Filament admin `EditOrder` page — always staff-driven, never part of
+  checkout itself), fulfillment/shipment tracking. **Named and scoped here, not yet built** —
+  same status as `Recovery` before it existed as real code.
+
+`Modules\Core\Checkout\Events\OrderPlaced` (see below) is the handoff point: `Checkout`
+dispatches it the moment an order exists; `Order`'s own listeners (not built yet) would be
+what reacts to it — e.g. sending a confirmation email, initializing whatever `Order` needs to
+initialize. `Checkout` itself has no opinion about what happens after `OrderPlaced` fires.
+
+### Where `Order` would likely absorb work that currently lives under `Shipping`
+
+`Modules\Core\Shipping`'s `Shipment`/`ShipmentInfo` models are already order-scoped
+(`Shipment::order(): BelongsTo`), and `PollShipmentTrackingJob`/
+`ShipmentStatusUpdatedByCarrier` are fulfillment/tracking concerns that happen entirely after
+an order exists — conceptually closer to `Order` than to `Shipping`'s actual job (carrier
+rate quoting, `ShippingRateInterface` drivers, `ShippingManifest`). Not decided whether/when
+this gets moved; noted here so the boundary is visible when `Order` is actually scoped.
+
+---
+
+## `CheckoutService`
+
+Mirrors `Modules\Core\Cart\Services\CartService`'s shape (see `docs/cart.md`) — one
+boboko-owned API a storefront calls, keeping Lunar's own `Cart`/`ShippingManifest` primitives
+an implementation detail.
+
+| Method | Wraps | Dispatches |
+|---|---|---|
+| `setShippingAddress(array\|Addressable $address)` | `Cart::setShippingAddress()` | `ShippingAddressSet($cart, $address)` |
+| `setBillingAddress(array\|Addressable $address)` | `Cart::setBillingAddress()` | `BillingAddressSet($cart, $address)` |
+| `getShippingOptions()` | `ShippingManifest::getOptions($cart)` | — (read-only) |
+| `selectShippingOption(string $identifier)` | `Cart::setShippingOption()` | `ShippingOptionSelected($cart, $option)` — throws `InvalidShippingOptionException` if `$identifier` doesn't resolve |
+| `placeOrder(string $fingerprint)` | `Cart::checkFingerprint()` then `Cart::createOrder()` | `OrderPlaced($order)` |
+
+### `getShippingOptions()` — already fully backed by the merged Shipping-Carriers work
+
+`ShippingManifest::getOptions($cart)` runs every registered `ShippingRateInterface` driver
+through a pipeline — this already includes ACS/Box Now live-rate quoting
+(`Modules\Core\Shipping\Carriers\Acs\AcsRateDriver`/`BoxNowRateDriver`, merged from the
+`Shipping-Carriers` branch) alongside `table-rate-shipping`'s own flat-rate/free-shipping/
+collection drivers. `CheckoutService` doesn't need to build any rate-resolution logic — it's
+a thin pass-through to what already exists and works.
+
+### `placeOrder()` — fingerprint check is mandatory, not optional
+
+`placeOrder(string $fingerprint): Order` requires the fingerprint the shopper's last-seen
+cart total was built from (`Cart::fingerprint()`) as a parameter — not an optional
+after-the-fact check a caller might forget. `Cart::checkFingerprint()` throws Lunar's own
+`FingerprintMismatchException` if the cart's contents/total changed since that fingerprint
+was generated (a line's price changed, stock adjusted the total, another tab modified the
+cart), forcing re-confirmation instead of silently placing an order at a different total than
+what the shopper approved.
+
+### No exception wrapping — same reasoning as `CartService`
+
+Confirmed from source: `Lunar\Validation\Cart\ValidateCartForOrderCreation` (the validator
+`Cart::createOrder()` runs via `config('lunar.cart.validators.order_create')`) already throws
+`Lunar\Exceptions\Carts\CartException` with a field-keyed `MessageBag`
+(`$exception->errors()`) — billing/shipping address completeness, missing shipping option,
+duplicate-order guard. This is already the right shape for a storefront to catch and render
+as form errors directly; wrapping it in a boboko-owned exception type would add indirection
+with identical semantics, the same call made for `CartService`'s cart-line exceptions.
+
+`FingerprintMismatchException` (from the mandatory fingerprint check above) propagates
+as-is for the same reason.
+
+**One genuine exception to this rule**: `selectShippingOption()` throws
+`Modules\Core\Checkout\Exceptions\InvalidShippingOptionException` when `$identifier` doesn't
+resolve to a real option (`ShippingManifest::getOption()` just returns `null` — Lunar has no
+matching exception type here to propagate, unlike `CartException`/`FingerprintMismatchException`
+above). Same reasoning as `Modules\Core\Cart\Exceptions\InvalidCouponException` for
+`Discounts::validateCoupon()`, which also just returns a bool with nothing to reuse. Confirmed
+live: an invalid identifier previously returned the cart unchanged with no signal at all —
+fixed to throw instead, verified via a real container test.
+
+### Validated from source: the real precondition chain
+
+`ValidateCartForOrderCreation::validate()`, read directly from `vendor/lunarphp/core`:
+
+1. No completed order already exists on this cart (duplicate-order guard).
+2. A billing address is set and passes `country_id`/`first_name`/`line_one`/`city`/`postcode`
+   required-field validation.
+3. If the cart `isShippable()` (has at least one non-digital line):
+   - A shipping option must already be selected (`Cart::getShippingOption()` — which only
+     resolves anything once `shippingAddress->shipping_option` has been persisted via
+     `selectShippingOption()`, confirmed from `Lunar\Base\ShippingManifest::getShippingOption()`).
+   - Unless that option is collect/pickup (`$shippingOption->collect`), a shipping address is
+     also required and validated the same way as billing.
+
+This is why `CheckoutService`'s methods exist in the order they're listed above — a
+storefront checkout flow has to drive them roughly in that sequence for `placeOrder()` to
+ever succeed.
+
+---
+
+## Events — richer payload than `CartService`'s, deliberately
+
+`Modules\Core\Checkout\Events`: `ShippingAddressSet`, `BillingAddressSet`,
+`ShippingOptionSelected`, `OrderPlaced`.
+
+Unlike `CartService`'s events (which carry a plain `Cart`/`CartLine` model reference — see
+`docs/cart.md`), these carry richer, already-resolved payload — e.g. `ShippingOptionSelected`
+includes the resolved `ShippingOption` (name, price, carrier identifier), not just the
+string identifier a listener would have to re-resolve. Deliberate divergence from
+`CartService`'s convention: a live-priced shipping quote or a submitted address is
+meaningfully more expensive/awkward for a listener to re-derive later than a `CartLine`
+model reference is.
+
+**Why this matters beyond `Checkout` itself:** the Analytics survey (`docs/scratch/
+analytics-feature-survey.html`) found conversion-funnel tracking (product view → add to cart
+→ checkout → purchase) entirely missing, with zero underlying data captured anywhere. The
+Checkout survey separately flagged "abandoned-checkout stage tracking (email captured vs.
+shipping selected vs. payment started)" as missing. One event per real state transition here
+— not just a single `OrderPlaced` at the end — is what gives a future analytics/reporting
+listener (not built) the funnel-stage data neither gap currently has anything to build on.
+
+**None of these have a listener yet.** Same status as `CartService`'s events — dispatched,
+unconsumed, built so something downstream has a hook to attach to.
+
+---
+
+## Explicitly out of scope for `CheckoutService`
+
+- **Order-status-changed events** — post-placement, staff-driven (`Order::status` changes via
+  the Filament admin `EditOrder` page, never through checkout). Belongs to `Order` (see
+  above), not `Checkout`.
+- **Order confirmation email** — needs `OrderPlaced` as a trigger, but actual sending is
+  separate infrastructure, same "detection/signal only, sending is a later concern" deferral
+  already applied to `Recovery` (`docs/recovery-strategies.md`).
+- **Guest order tracking/lookup** — a separate storefront feature, not part of the placement
+  flow itself.
+- **Payment** — authorizing/capturing a transaction against the placed order. Genuinely
+  separate from `Checkout` as scoped here; `CheckoutService::placeOrder()` produces an
+  `Order`, what happens to pay for it is out of this document's scope.
diff --git a/docs/collections.md b/docs/collections.md
new file mode 100644
index 0000000..affba4f
--- /dev/null
+++ b/docs/collections.md
@@ -0,0 +1,116 @@
+# Collections
+
+`Modules\Core\Catalog\Services\CollectionService` provides category browsing/nav AND
+single-collection lookup for a storefront — `list()`, `getById()`, `getBySlug()` —
+all reading directly from the Meilisearch index, mirroring
+`Modules\Core\Catalog\Services\ProductService` (see `product-listing.md`) exactly.
+
+---
+
+## Why it reads from the index, not the database
+
+Lunar's own `Lunar\Search\CollectionIndexer` only carries `id`/`name`/`created_at` —
+nowhere near enough for a storefront category page or a nav tree.
+`Modules\Core\Catalog\Services\CollectionIndexer` extends it to add everything
+`CollectionService` needs:
+
+| Field | Source | Notes |
+|---|---|---|
+| `parent_id` | `$model->parent_id` | Filterable. The nested-set tree's parent pointer — `null` for a top-level collection. |
+| `_lft` | `$model->_lft` | Filterable and sortable. The nested-set tree position — lets `CollectionService` resolve tree order without a database read. |
+| `collection_group_id` | `$model->collection_group_id` | Filterable. Mirrors `Collection::scopeInGroup()`. |
+| `slugs` | `$model->urls->pluck('slug')` | Filterable. Every locale's `Url::slug`, so `getBySlug()` resolves purely from the index. |
+| `thumbnail` | `$model->getThumbnailImage()` | Display only. `null` if the collection has no thumbnail image. |
+| `ancestors` | `$model->ancestors` | Display only. Array of `{id, name}`, ordered root-first — a breadcrumb (`Home > Apparel > Keychains`) can render directly from a single `getById()`/`getBySlug()` call, no extra queries. Empty array for a top-level collection. |
+| `product_count` | Queried from the *product* Meilisearch index at collection-index time | Display only. How many products are in this collection **or any of its descendants** — matches what `ProductService::list(ProductFilters(collectionId: ...))` would return, not just direct assignment. Computed via `Product::search('')->options(['filter' => "collection_ids = \"{id}\""])`, so it depends on the product index already being current — reindex products *before* collections (see "Gotchas" below). |
+
+`name`/`description` (and any other `TranslatedText` attribute) are indexed per-locale
+by Lunar's base indexer and resolved by `CollectionService` exactly like
+`ProductService` does — see `product-listing.md`'s "Locale resolution" section, same
+logic, same `LanguageCache::defaultLocale()` fallback.
+
+---
+
+## Usage
+
+```php
+use Modules\Core\Catalog\DTOs\CollectionFilters;
+use Modules\Core\Catalog\Enums\CollectionSort;
+use Modules\Core\Catalog\Services\CollectionService;
+
+$service = app(CollectionService::class);
+
+// Top-level collections only (parent_id IS NULL) — for building a nav tree
+$roots = $service->list(
+    filters: new CollectionFilters(rootOnly: true),
+    sort: CollectionSort::Position,
+);
+
+// Children of a specific collection
+$children = $service->list(
+    filters: new CollectionFilters(parentId: 222),
+    sort: CollectionSort::Position,
+);
+
+// Filter by collection group
+$collections = $service->list(filters: new CollectionFilters(groupId: 4));
+
+// Single collection, by primary key or slug
+$collection = $service->getById(223);
+$collection = $service->getBySlug('keychains');
+```
+
+`CollectionFilters(parentId: ..., rootOnly: ...)` are mutually exclusive — if both are
+set, `parentId` wins. There's no `parentId: null` shorthand for "root only", since
+that would be ambiguous with "don't filter by parent at all" (the DTO's actual
+default); `rootOnly` names the root-collections case explicitly instead.
+
+`CollectionSort::Position` (`_lft:asc`) is the recommended default for any nav/tree
+UI — it matches the order an admin arranges collections in Lunar's own Filament UI.
+`Name` and `Newest` are also available, mirroring `ProductSort`'s shape.
+
+---
+
+## Registration
+
+Like `ProductIndexer`, `CollectionIndexer` must be registered in the consuming app's
+own `config/lunar/search.php`:
+
+```php
+'indexers' => [
+    Lunar\Models\Collection::class => Modules\Core\Catalog\Services\CollectionIndexer::class,
+    // ...
+],
+```
+
+New/changed fields aren't filterable/sortable in Meilisearch until `php artisan
+lunar:meilisearch:setup` re-syncs index settings, and existing documents need
+`lunar:search:index --refresh` to pick up the new shape. If `SCOUT_QUEUE` is enabled,
+the queue worker also needs restarting after deploying changes to the indexer class —
+see `docs/lunar.md` "Gotchas".
+
+**`product_count` needs the product index reindexed first.** `config/lunar/search.php`'s
+`indexers` array is typically ordered `Collection` before `Product`, so a plain
+`lunar:search:index --refresh` computes `product_count` against whatever the product
+index held *before* this run — stale if products changed too. `lunar:search:index`
+takes an explicit model list as its argument (`--ignore` restricts it to only those),
+so reindex products first, then collections, when both need a fresh `--refresh` in the
+same deploy:
+
+```
+php artisan lunar:search:index "Lunar\Models\Product" --ignore --refresh
+php artisan lunar:search:index "Lunar\Models\Collection" --ignore --refresh
+```
+
+---
+
+## When to still use Eloquent directly
+
+A single collection's full detail page (breadcrumb via `$collection->breadcrumb`,
+tree ancestors/descendants, route-model-bound `Collection $collection` in a
+controller signature) should keep reading Eloquent directly rather than going through
+`CollectionService` — the indexed document doesn't carry ancestor chains or the full
+nested-set relations, and route-model binding already gives a controller the full
+model for free. `CollectionService` is for browsing/listing and lightweight
+by-id/by-slug lookups where a full Eloquent hydration would be wasteful, the same
+tradeoff `ProductService` makes for products.
diff --git a/docs/localization.md b/docs/localization.md
index 18fe74d..abf98c7 100644
--- a/docs/localization.md
+++ b/docs/localization.md
@@ -50,7 +50,7 @@ fine — just keep admin/Livewire/webhook routes registered outside of it (as th
 
 ## Behavior
 
-`Modules\Core\Localization\LocaleMiddleware`:
+`Modules\Core\Localization\Middleware\LocaleMiddleware`:
 
 1. Reads the first path segment (`request()->segment(1)`).
 2. Matches it against `Lunar\Models\Language::code`.
@@ -68,7 +68,7 @@ and invalidated automatically. Adding, editing, or removing a language via the F
 
 ### How invalidation is wired (event-driven, not the observer itself)
 
-`Modules\Core\Localization\LanguageCacheObserver` observes `Lunar\Models\Language`'s
+`Modules\Core\Localization\Observers\LanguageCacheObserver` observes `Lunar\Models\Language`'s
 `created`/`updated`/`deleted` Eloquent events, but it's a thin trigger only — it doesn't do any
 invalidation work itself. It dispatches one of three events from
 `Modules\Core\Localization\Events` (`LanguageCreated`, `LanguageUpdated` — carrying the old
@@ -105,6 +105,33 @@ $language = $request->attributes->get('language');   // Lunar\Models\Language in
 
 Use `$language->id` when querying Lunar's translatable content (e.g. `Url::where('language_id', ...)`).
 
+### Shared view data — language switcher and `hreflang` tags
+
+The middleware also shares two variables with every view, via `View::share()`, so a layout's
+language switcher or `hreflang` tags don't have to recompute the language list themselves:
+
+```blade
+{{-- current locale --}}
+{{ $currentLocale }}   {{-- e.g. "el" --}}
+
+{{-- every OTHER configured language, each with its own URL for the current page --}}
+@foreach ($altLocales as $altLocale)
+    <a href="{{ $altLocale['url'] }}" hreflang="{{ $altLocale['code'] }}">{{ $altLocale['name'] }}</a>
+@endforeach
+```
+
+`$altLocales` is a **collection**, not a single value — deliberately, so it scales to any number
+of configured languages rather than assuming exactly two. Each entry is a plain array:
+
+| Key | Description |
+|---|---|
+| `code` | The language's `Lunar\Models\Language::code` (e.g. `en`) |
+| `name` | The language's display name |
+| `url` | The **current route**, re-generated with that language's code — via `route($routeName, [...])` when the current request matched a named route, or a bare `/{code}` fallback otherwise |
+
+A 3+ language store gets one `$altLocales` entry per additional language automatically — nothing
+about this shape assumes or special-cases a two-language store.
+
 ---
 
 ## Single-language shops
@@ -151,12 +178,41 @@ namespaced groups so nothing collides. `__()` resolves the translation for whate
 `App::getLocale()` currently is, which `LocaleMiddleware` already sets per-request (see
 "Behavior" above) — no extra wiring needed between the two systems.
 
+### Fallback locale follows the store's default language, not `config('app.fallback_locale')`
+
+`spatie/laravel-translation-loader`'s stock `LanguageLine::getTranslation()` falls back to
+`config('app.fallback_locale')` — a static `.env` value — when a key has no text for the current
+locale. That's a second, disconnected "default language" concept: an admin changing the default
+language via the Filament **Languages** resource has no effect on it, so an untranslated label
+could silently fall back to the wrong language.
+
+`Modules\Core\Localization\Models\LanguageLine` overrides `getTranslation()` to fall back to
+`LanguageCache::defaultLocale()` instead — the same `languages.default` flag `LocaleMiddleware`
+already treats as the single source of truth. It's swapped in via
+`config('translation-loader.model')` (the package's own documented extension point for
+"any model that extends `LanguageLine`"), set in `LocalizationServiceProvider::register()` so it
+wins regardless of provider boot order (Laravel's `mergeConfigFrom()` only fills in config keys
+not already set, so an explicit `register()`-time set always beats the package's own default).
+No consuming app configuration needed — this is automatic once `LocalizationServiceProvider` is
+registered.
+
 ### Seeding
 
 A starter set of common e-shop labels (`nav.*`, `cart.*`, `product.*`, `auth.*`, `search.*`,
-English + Greek) is seeded by `Modules\Core\Command\InstallLunarCommand` (overrides Lunar's own
-`lunar:install`), guarded by `LanguageLine::where('group', 'storefront')->exists()` — same
-idempotent pattern as the rest of that command, safe to run unattended on every boot.
+`review.*`, `shop.*`, `pagination.*`, English + Greek) lives in
+`Modules\Core\Localization\Services\StorefrontLabels::all()` — kept as its own class, separate
+from the seeding logic, so the label list can be scanned/diffed without wading through the
+seeding mechanics.
+
+`Modules\Core\Command\InstallLunarCommand` (overrides Lunar's own `lunar:install`) seeds them via
+a **per-key upsert**, not an all-or-nothing "only seed if the group is empty" guard: a key already
+present in the database — including one an admin has since edited via the Filament **Language
+Lines** resource — is left untouched; only keys missing entirely are created. This is what makes
+it safe to add new keys to `StorefrontLabels::all()` later and re-run `lunar:install` on an
+already-installed store, without either silently skipping the new keys (the old guard's behavior)
+or reverting an admin's edits back to the hardcoded default (what a naive `updateOrCreate` would
+do). New writes go through `TranslationService::create()`, so the usual cache-invalidation and
+activity-log events fire for them too.
 
 ### Admin UI
 
@@ -168,13 +224,13 @@ a third language automatically adds a third input, no resource changes needed.
 
 ### `TranslationService` — writes go through here, not the model directly
 
-`Modules\Core\Localization\TranslationService` wraps create/update/delete on `LanguageLine` and
+`Modules\Core\Localization\Services\TranslationService` wraps create/update/delete on `LanguageLine` and
 dispatches a domain event after each write, following this project's standard event-driven
 pattern (see `modules.md`'s "Splitting Service Providers" / event-listener convention —
 the same shape as `Modules\Core\Auth\Events\UserCreated`):
 
 ```php
-use Modules\Core\Localization\TranslationService;
+use Modules\Core\Localization\Services\TranslationService;
 
 app(TranslationService::class)->create('storefront', 'nav.wishlist', [
     'en' => 'Wishlist',
diff --git a/docs/lunar.md b/docs/lunar.md
index 9e97e70..f21eb27 100644
--- a/docs/lunar.md
+++ b/docs/lunar.md
@@ -554,7 +554,11 @@ Customer resolution order: session → `$user->latestCustomer()`.
 ```php
 use Lunar\Facades\CartSession;
 
-$cart = CartSession::current();       // calculates totals; returns null if no cart
+$cart = CartSession::current();       // returns null unless a cart already exists in
+                                       // session — does NOT auto-create one (see Gotchas)
+$cart = CartSession::manager();       // force-creates a cart if none exists yet — use
+                                       // this (or __call forwarding, see Gotchas) for
+                                       // "give me a cart to add to" flows
 $cart->recalculate();                 // force recalculation
 
 CartSession::createOrder();           // creates order, removes cart from session
@@ -563,6 +567,39 @@ CartSession::forget();                // clear session (soft deletes cart by def
 CartSession::forget(delete: false);   // clear session, keep cart in DB
 ```
 
+Session/identity: the active cart's id is stored under session key `lunar.cart_session.session_key`
+(default `lunar_cart`). `CartSession`'s underlying manager (`Lunar\Managers\CartSessionManager`) —
+not `Lunar\Base\CartSessionInterface`, which is stale/incomplete, see Gotchas — resolves the current
+cart from that session key, falling back to the authenticated user's active cart
+(`$user->carts()->active()->first()`) if the session has none.
+
+### `config/lunar/cart_session.php`
+
+| Key | Default | Meaning |
+|---|---|---|
+| `session_key` | `'lunar_cart'` | Laravel session key storing the active cart id. |
+| `auto_create` | `false` | Whether `CartSession::current()` auto-creates a cart when none exists — it does **not**, by default (see Gotchas). |
+| `allow_multiple_orders_per_cart` | `false` | If false, a cart with a completed order is abandoned in favor of a fresh cart on next fetch. |
+| `delete_on_forget` | `true` | Whether `forget()` (called on logout) soft-deletes the cart — see the auth-policy note above. |
+
+### `config/lunar/cart.php` (cart-line-relevant keys)
+
+| Key | Default | Meaning |
+|---|---|---|
+| `auth_policy` | `'merge'` | Guest→user cart reconciliation on login: `merge` or `override`. |
+| `pipelines.cart` | `CalculateLines, ApplyShipping, ApplyDiscounts, CalculateTax, Calculate` | Steps run on `$cart->calculate()`. |
+| `pipelines.cart_lines` | `[GetUnitPrice::class]` | Steps run per-line before cart-level calc. |
+| `actions.add_to_cart` | `AddOrUpdatePurchasable::class` | Swappable action behind `Cart::add()`. |
+| `actions.get_existing_cart_line` | `GetExistingCartLine::class` | Line-matching logic for add-or-merge (see "Adding items" above). |
+| `actions.update_cart_line` | `UpdateCartLine::class` | Behind `Cart::updateLine()`. |
+| `actions.remove_from_cart` | `RemovePurchasable::class` | Behind `Cart::remove()`. |
+| `validators.add_to_cart` | `[CartLineQuantity, CartLineStock]` | Run before add. |
+| `validators.update_cart_line` | `[CartLineQuantity, CartLineStock]` | Run before update. |
+| `validators.remove_from_cart` | `[]` | None by default. |
+| `eager_load` | 7 relation paths (currency, `lines.purchasable.*`, `lines.cart.currency`) | Auto-eager-loaded whenever the session manager fetches a cart by id. Does **not** include `addresses`/`shippingAddress`/`billingAddress`, `discounts`, or `customer` — add these yourself if needed, to avoid N+1s. |
+| `prune_tables.enabled` | `false` | Whether scheduled cart pruning runs. |
+| `prune_tables.prune_interval` | `90` (days) | Age threshold for pruning. |
+
 ### Adding items
 
 ```php
@@ -573,6 +610,11 @@ $cart->addLines([
 ]);
 ```
 
+`add()` matches an existing line by purchasable **and exact `meta` equality** (config
+`lunar.cart.actions.get_existing_cart_line`, default `GetExistingCartLine`) — if it matches, the
+existing line's quantity is incremented instead of a new line being created; any difference in
+`meta` (e.g. a different chosen option) makes it a separate line for the same purchasable.
+
 ### Updating and removing
 
 ```php
@@ -664,6 +706,14 @@ class MyPipeline
 `merge` — guest cart items combine with user's existing cart on login.
 `override` — guest cart replaces user's cart.
 
+This is wired via `Lunar\Listeners\CartSessionAuthListener`, listening on Laravel's own
+`Illuminate\Auth\Events\Login`/`Logout`. On login, if the session already has a cart with no
+`user_id` yet, it associates that cart to the user (running the policy above); if the session has
+no cart at all, it looks up and resumes the user's own active cart instead. **On logout, it calls
+`CartSession::forget()`** — which, per `cart_session.delete_on_forget` (default `true`), **soft-
+deletes the cart**. A logged-in customer's cart is gone on logout unless that config is set to
+`false`.
+
 ### Shipping options
 
 ```php
@@ -1206,6 +1256,13 @@ Real bugs/traps hit while building against Lunar in this package — not obvious
 - **`ProductOption.handle` must be unique and non-null if a product has more than one option.** Lunar's Filament variant-switcher widget does `SelectFilter::make($option->handle)` per option — two options with a `null`/matching handle throws "Filter must have a unique name" as a 500 when opening that product's variant pricing page. Always derive a slug and check uniqueness.
 - **`Attribute.position` is per-group, and the panel sorts by it.** Hardcoding `position => 1` for multiple new attributes in the same group makes their order undefined/collide with existing attributes at position 1. Compute `max('position') + 1` per group instead.
 - **Currency `decimal_places` isn't always 2.** A seeded/demo currency can have the wrong value (seen: EUR seeded with `decimal_places = 1`), which silently corrupts every price display (`€16.50` renders as `165`). If prices look wrong by a factor of 10, check the currency row before assuming the price-writing code is broken.
-- **`Builder::paginateRaw()`'s `items()` is not a hit list on the Meilisearch driver.** It contains the *entire* raw response (`hits`, `query`, `processingTimeMs`, `hitsPerPage`, `page`, `totalPages`, `totalHits`) as one associative array. Treating `$paginator->items()` as a plain list (e.g. `collect($paginator->items())->values()`) silently produces 7 elements — the real hits array happens to land first, the rest are stray scalars from the other response keys — no error, just corrupted data. Pull `$paginator->items()['hits']` explicitly. `total()`/`perPage()`/`currentPage()`/`lastPage()` on the paginator are unaffected. See `Modules\Core\Catalog\ProductService` / `docs/product-listing.md`.
-- **`ProductOption`/`ProductOptionValue::$name` is not `attribute_data` — `translateAttribute('name')` silently returns null for them.** Unlike `Product`/`Collection`/`Brand`, their translated `name` is a plain locale-keyed array cast (`AsArrayObject`) directly on the column, not stored in `attribute_data`. `HasTranslations::translateAttribute()` only reads `attribute_data`, so calling it on these two models compiles fine and returns `null` with no error — read the array directly instead (`$value->name[$locale] ?? ...`). See `Modules\Core\Search\ProductIndexer::translatedName()`.
+- **`Builder::paginateRaw()`'s `items()` is not a hit list on the Meilisearch driver.** It contains the *entire* raw response (`hits`, `query`, `processingTimeMs`, `hitsPerPage`, `page`, `totalPages`, `totalHits`) as one associative array. Treating `$paginator->items()` as a plain list (e.g. `collect($paginator->items())->values()`) silently produces 7 elements — the real hits array happens to land first, the rest are stray scalars from the other response keys — no error, just corrupted data. Pull `$paginator->items()['hits']` explicitly. `total()`/`perPage()`/`currentPage()`/`lastPage()` on the paginator are unaffected. See `Modules\Core\Catalog\Services\ProductService` / `docs/product-listing.md`.
+- **`ProductOption`/`ProductOptionValue::$name` is not `attribute_data` — `translateAttribute('name')` silently returns null for them.** Unlike `Product`/`Collection`/`Brand`, their translated `name` is a plain locale-keyed array cast (`AsArrayObject`) directly on the column, not stored in `attribute_data`. `HasTranslations::translateAttribute()` only reads `attribute_data`, so calling it on these two models compiles fine and returns `null` with no error — read the array directly instead (`$value->name[$locale] ?? ...`). See `Modules\Core\Catalog\Services\ProductIndexer::translatedName()`.
 - **A running `queue:work` process does not pick up an edited/newly-added Scout indexer class.** It loads PHP classes once at boot and keeps them for the process's lifetime. Symptoms: reindexing commands succeed with no errors, calling `toSearchableArray()` directly (e.g. via `artisan tinker`, which always boots fresh) returns the new fields correctly, but documents written via `$model->searchable()` through the live queue are still missing them. Restart the queue worker after deploying an indexer change — no code fix needed.
+- **`CartSession::current()` returns `null` for a fresh visitor by default.** `cart_session.auto_create` defaults to `false`, so nothing auto-creates a cart just from checking `current()`. Use `CartSession::manager()` (force-creates) for an "add to cart" flow, or rely on the fact that `add()`/`remove()`/etc. auto-create via `__call` forwarding (next entry) — don't gate an add-to-cart button on `current() !== null`, it will be null for every guest who hasn't added anything yet.
+- **`CartSession`'s facade/interface don't declare `add()`, `remove()`, `updateLine()`, `clear()`, etc. at all — they work anyway, via `__call` magic.** `CartSessionManager::__call()` forwards any undeclared method call straight to the underlying `Cart` model (auto-creating one first if needed). So `CartSession::add($variant, 2)` genuinely works, but neither the facade's `@method` docblock nor `Lunar\Base\CartSessionInterface` mention it — reading either in isolation makes it look unsupported. Trust the manager's source (`Lunar\Managers\CartSessionManager`), not the interface, which is also missing several real methods (`manager()`, `createOrder()`, the shipping-estimate methods) and has a stale signature for `current()`.
+- **`Cart::calculate()` is a no-op if totals already look populated — even right after you mutated lines with raw Eloquent.** It's memoized via `isCalculated()` (true when `total` and every line's `total` are non-blank). Every built-in mutator (`add`, `remove`, `updateLine`, `clear`, `associate`, …) already calls `$this->refresh()->recalculate()` to force past this memo — but custom code that touches `CartLine` rows directly (raw `update()`, a queued job, a migration) must call `$cart->recalculate()` itself, or `total`/`subTotal`/etc. silently stay stale.
+- **`CartLine`'s computed properties (`unitPrice`, `subTotal`, `total`, `taxAmount`, …) are plain public properties, not DB columns or Eloquent attributes.** A raw `CartLine::find($id)` (no `calculate()` having run on its owning cart) has all of these as `null`/unset — they only populate as a side effect of the owning `Cart`'s pipeline running. Don't read them off a line fetched outside of `CartSession`/`Cart::add()` etc. without calling `$cart->calculate()` first.
+- **Logging out deletes the cart by default.** `CartSessionAuthListener::logout()` calls `CartSession::forget()`, and `cart_session.delete_on_forget` defaults to `true` — so a logged-in customer's cart is soft-deleted the moment they log out, guest or not. Set `delete_on_forget` to `false` in `config/lunar/cart_session.php` if carts should survive a logout.
+- **Lunar dispatches no cart events at all** — no "item added," "cart created," "line removed," nothing under `Lunar\Events\Cart*`/`CartLine*` exists (unlike products/collections, which have their own Scout indexing hooks). The only reactive surface is `CartLineObserver` (`creating`/`updating`, and it only validates the purchasable type — doesn't dispatch anything). If a feature needs to react to cart changes (reindexing, abandoned-cart notifications, analytics), it has to be built from scratch on plain Eloquent model events (`CartLine::created`, etc.) — there's no Lunar-native pattern to hook into.
+- **No Filament admin resource exists for `Cart`/`CartLine`.** Carts aren't visible anywhere in the admin panel except indirectly through an order's `cart` relationship once that cart has become an order. Don't assume there's an admin cart-viewer to check against when debugging — there isn't one.
diff --git a/docs/payments.md b/docs/payments.md
new file mode 100644
index 0000000..31bdde6
--- /dev/null
+++ b/docs/payments.md
@@ -0,0 +1,189 @@
+# Payment — Design Notes
+
+**Status: abstraction layer built, drivers/wiring in progress.** `Payment` is designed as a
+standalone module: it never calls into `Checkout` or `Order`, never touches their Eloquent
+models, and communicates only via events. This document is the design spec for that
+abstraction — contracts, DTOs, events — independent of how `Checkout`/`Order` end up consuming
+it (that wiring is a separate, later pass).
+
+---
+
+## Operations, not gateways
+
+The driver contracts model the actual operations a payment gateway can perform, not vendor
+terminology. Every real gateway checked while designing this converges on the same small set
+under different names:
+
+| Operation | Mastercard | Stripe | Nexi |
+|---|---|---|---|
+| Atomic charge (authorize+capture in one call) | `Pay` | `capture_method: automatic` | `ActionType::PAY()` |
+| Hold only, settle/release later | `Authorize` | `capture_method: manual` | `ActionType::PREAUTH()` |
+| Settle a prior hold | `Capture` | `PaymentIntent::capture()` | `CaptureRequest`/`CaptureResponse` |
+| Release a prior hold without settling | `Void`/`Cancel` | `PaymentIntent::cancel()` | `CancelRequest`/`CancelResponse` |
+| Reverse settled funds | `Refund` | `Refund::create()` | (refund endpoint) |
+
+A driver implements only the interfaces its gateway actually supports:
+
+- An offline/cash type (`cash-on-delivery`, `cash-in-hand`) only ever settles atomically —
+  implements `SupportsPay` alone.
+- A card gateway capable of either mode per-transaction (Stripe, most card processors)
+  implements `SupportsPay`, `SupportsAuthorization`, `SupportsCaptures`, `SupportsVoids`, and
+  `SupportsRefunds` all at once — which one gets *called* for a given attempt is the caller's
+  policy choice (e.g. `config('lunar.stripe.policy')`), not something baked into the driver's
+  shape.
+- A redirect/wallet gateway with no separate hold step (Viva/Klarna in typical flows)
+  implements `SupportsPay` and `SupportsRefunds`, never `SupportsCaptures`/`SupportsVoids`.
+
+### `pay()` and `authorize()` stay separate methods even when a gateway implements both as "the same call with a flag"
+
+Stripe has no separate `authorize`/`pay` API endpoints — one `PaymentIntent`, confirmed with
+either `capture_method: automatic` or `manual`. Mastercard and Nexi *do* have genuinely
+separate operations. The contract abstracts over both shapes uniformly: every driver capable
+of both exposes two distinct methods, `pay()` and `authorize()`. A Mastercard-style driver
+calls two different endpoints under the hood; a Stripe-style driver calls the same endpoint
+twice with a different flag each time. Neither difference is visible to a caller.
+
+### `capture()`/`void()` are only ever valid against a prior `authorize()`
+
+They are not standalone operations — `capture()` settles a specific hold identified by the
+`reference` `authorize()` returned; `void()` releases that same hold instead. A driver that
+never implements `SupportsAuthorization` never produces a reference either of these methods
+could act on.
+
+---
+
+## `PaymentResult` — the one return shape, every operation, every driver
+
+```php
+enum PaymentResultStatus { case Succeeded; case Failed; case Pending; }
+
+final class PaymentResult {
+    public function __construct(
+        public readonly PaymentResultStatus $status,
+        public readonly string $reference,
+        public readonly int $amount,
+        public readonly ?string $failureReason = null,
+        public readonly bool $retriable = false,
+        public readonly array $raw = [],
+        public readonly array $meta = [],
+    ) {}
+}
+```
+
+Real gateway responses vary wildly in richness — confirmed by reading three SDKs directly:
+
+- **Stripe's `PaymentIntent`** is rich: `status`, `amount`, `amount_capturable`,
+  `amount_received`, `last_payment_error`, a full `getLastResponse()`.
+- **Nexi's `CaptureResponse`/`CancelResponse`** are minimal: just `operationId` +
+  `operationTime` — no echoed amount or status at all. Success is inferred from getting a
+  response rather than an SDK exception.
+- **Mastercard's** gateway sits in between, with `gatewayCode`/`acquirerCode`/
+  `merchantAdviceCode`.
+
+`PaymentResult` only requires what every driver can always know: `status`, `reference`,
+`amount` (the amount **we** requested — not necessarily echoed back by a sparse gateway like
+Nexi's capture). Everything else is best-effort: `failureReason`/`retriable` are normalized
+only when the gateway has something to normalize from; `raw` is the unconditional escape
+hatch — the untouched gateway response body, always populated, for genuine audit fidelity
+regardless of how sparse the normalized fields ended up.
+
+### `retriable` — real on some gateways, absent on others
+
+Stripe classifies declines as soft (`do_not_honor`, `insufficient_funds` — worth retrying,
+after a delay) vs. hard (`stolen_card`, `expired_card` — never retry the same method).
+Mastercard has the equivalent via `authorizationResponse.merchantAdviceCode` and card-scheme
+soft-decline codes. **Nexi has no such signal at all** — `OperationResult` is just
+`DECLINED`/`DENIED_BY_RISK`/`FAILED`/etc. with no retriability classification. `retriable`
+therefore defaults to `false` (assume not safely retriable) rather than guessing when a
+driver's gateway has nothing to base it on.
+
+---
+
+## Events — one terminal pair per operation, keyed to the business fact, not the call path
+
+`Modules\Core\Payment\Events`:
+
+| Event pair | Dispatched by |
+|---|---|
+| `PaymentAuthorized` / `PaymentAuthorizationFailed` | `SupportsAuthorization::authorize()`, or a later `HandlesPaymentCallback::handleCallback()` resolving it |
+| `PaymentCaptured` / `PaymentCaptureFailed` | `SupportsPay::pay()` **or** `SupportsCaptures::capture()` |
+| `PaymentVoided` / `PaymentVoidFailed` | `SupportsVoids::void()` |
+| `PaymentRefunded` / `PaymentRefundFailed` | `SupportsRefunds::refund()` |
+
+`PaymentCaptured` is deliberately the *same* event whether money was taken via `pay()` (one
+gateway call) or `authorize()` → `capture()` (two calls) — "a payment has been captured" is
+the same business fact either way, and a listener reacting to it never needs to know which
+path produced it. There is no separate "payment succeeded" wrapper event distinct from
+`PaymentCaptured`.
+
+Every event carries `{type: string, result: PaymentResult, context: array}`. `Payment` has no
+concept of a `Cart`, an `Order`, or a checkout fingerprint — `$context` is an opaque bag the
+caller hands in on the way down (`pay($type, $data, $context)`) and gets back untouched on
+whichever event that call (or a later `handleCallback()`) produces. Each listener interprets
+`$context` on its own terms, or ignores the event if the keys it needs aren't present —
+`Checkout` is only one possible consumer of these events, not the only one.
+
+---
+
+## Async resolution — `HandlesPaymentCallback`
+
+Only implemented by a driver whose `pay()`/`authorize()` can return `PaymentResultStatus::Pending`
+— a redirect the shopper completes elsewhere, a webhook that arrives later. A driver whose
+gateway always resolves synchronously never implements this.
+
+```php
+public function handleCallback(string $reference, array $data, array $context = []): PaymentResult;
+```
+
+Resolves into the *same* event pair the original `pay()`/`authorize()` call would have
+produced had it resolved synchronously.
+
+### The correlation problem: `handleCallback()` runs in a different request
+
+`$context` passed into the original `pay()`/`authorize()` call does not survive to
+`handleCallback()` on its own — that call is typically a separate HTTP request (a webhook)
+with no memory of the request that started the payment. Something has to persist enough to
+answer "which order/cart does gateway reference X belong to?" between the two calls.
+
+**Read directly from `lunarphp/stripe`'s own source** (`StripePaymentType::authorize()`,
+`ProcessStripeWebhook`, `WebhookController`) to see how Lunar itself solves this — confirmed
+it does **not** stash a generic opaque blob. It writes the correlating ids as real, typed
+columns on `Lunar\Stripe\Models\StripePaymentIntent` (`cart_id`, `order_id`) at the moment the
+intent is created/first seen, then reads them back the same way when the webhook arrives:
+
+```php
+// ProcessStripeWebhook::handle() — falls back through two real lookups,
+// neither of them a generic context blob:
+$cart = StripePaymentIntent::where('intent_id', $this->paymentIntentId)->first()?->cart
+    ?: Cart::where('meta->payment_intent', '=', $this->paymentIntentId)->first();
+```
+
+**`StripePaymentDriver` follows this exact precedent**: it reads `cart_id`/`order_id` out of
+`$context` at `pay()`/`authorize()` time and writes them onto its own `StripePaymentIntent`
+row (a table already owned by `lunarphp/stripe`, already shaped for exactly this), then reads
+them back the same way in `handleCallback()`. No generic `context` json column, no new table.
+
+### This pattern is per-driver, not a shared table
+
+`stripe_payment_intents` is Stripe-specific — keyed on `intent_id`, typed around
+`Stripe\PaymentIntent`'s own status values. It cannot be reused as-is for a future non-Stripe
+async driver (Nexi, Viva): that driver's own gateway reference has a different shape entirely,
+and shoehorning it into Stripe-named columns would make the table misleading. The **pattern**
+generalizes — *any* driver needing async callback resolution owns a small table keyed by its
+own gateway's reference, storing whatever correlation data that driver specifically needs —
+but each driver gets its own table, matching what it actually needs to correlate, rather than
+a shared generic one.
+
+---
+
+## Explicitly out of scope for this pass
+
+- **`Checkout`/`Order` wiring** — how `Checkout` calls into `Payment`, how `Order`/`Checkout`
+  react to `Payment`'s events, where a draft `Order` gets created relative to when `Payment` is
+  called. Deliberately designed and built separately, after `Payment` itself was complete —
+  `Payment` must stand on its own regardless of what ends up consuming it.
+- **`Transaction` persistence** — Lunar's own `transactions` table (`type`: `intent`/`capture`/
+  `refund`, `parent_transaction_id` chaining) already models the audit trail these events
+  would feed, once a listener is built to write to it. `Payment` itself does not write
+  `Transaction` rows — see the events table above; that is a listener's job, in whichever
+  module ends up owning the write (likely `Order`, since `Transaction.order_id` is required).
diff --git a/docs/product-listing.md b/docs/product-listing.md
index 7d2397d..02b4934 100644
--- a/docs/product-listing.md
+++ b/docs/product-listing.md
@@ -1,10 +1,11 @@
 # Product Listing
 
-`Modules\Core\Catalog\ProductService` provides catalog browsing/filtering AND single-product
-lookup for a storefront — `list()`, `getById()`, `getBySlug()` — all reading directly from the
-Meilisearch index rather than the database. One data source for everything this service does.
+`Modules\Core\Catalog\Services\ProductService` provides catalog browsing/filtering AND single-product
+lookup for a storefront — `list()`, `getById()`, `getBySlug()`, `random()`, `variantSummaries()` —
+all reading directly from the Meilisearch index rather than the database. One data source for
+everything this service does.
 
-This is separate from `Modules\Core\Search\ProductSearchService` (see `product-search.md`), which
+This is separate from `Modules\Core\Catalog\Services\ProductSearchService` (see `product-search.md`), which
 handles free-text query search. `ProductService` is for browsing/lookup without a search term.
 
 ---
@@ -14,7 +15,7 @@ handles free-text query search. `ProductService` is for browsing/lookup without
 Every method here reads Meilisearch documents directly and returns plain arrays — never Scout's
 `->get()`, which would re-hydrate Eloquent models from the database. This means the index has to
 carry everything a detail page needs (variants, prices, options, media, reviews — see below), not
-just the trimmed fields a listing page needs. `Modules\Core\Search\ProductIndexer` is built to
+just the trimmed fields a listing page needs. `Modules\Core\Catalog\Services\ProductIndexer` is built to
 carry that full shape.
 
 ---
@@ -22,61 +23,129 @@ carry that full shape.
 ## Usage
 
 ```php
-use Modules\Core\Catalog\ProductFilters;
-use Modules\Core\Catalog\ProductService;
+use Modules\Core\Catalog\DTOs\ProductFilters;
+use Modules\Core\Catalog\Services\ProductService;
+use Modules\Core\Catalog\Enums\ProductSort;
 
 $service = app(ProductService::class);
 
-// List everything, paginated
-$result = $service->list(perPage: 24, page: 1);
+// One call for everything a listing page needs — products AND the price slider's
+// bounds together, as a Modules\Core\Catalog\DTOs\ProductListingResult. A caller
+// used to have to call list() and priceSliderBounds() (or the older priceRange())
+// separately and glue the results together itself; that's now list()'s own job.
+$listing = $service->list(perPage: 24, page: 1);
 
-// Filter by collection, brand, and/or price range
-$result = $service->list(
-    filters: new ProductFilters(collectionId: 17, minPrice: 10.0, maxPrice: 50.0),
+// Filter by collection, brand, price range, and/or stock
+$listing = $service->list(
+    filters: new ProductFilters(collectionId: 17, minPrice: 10.0, maxPrice: 50.0, inStockOnly: true),
     perPage: 24,
     page: 1,
 );
 
-$result['data'];               // array of Meilisearch documents (plain arrays, not models)
-$result['meta']['total'];
-$result['meta']['per_page'];
-$result['meta']['current_page'];
-$result['meta']['last_page'];
+// Sort — cheapest/priciest first, or newest first. Omit for Meilisearch's default
+// relevance ordering (irrelevant here since the query is always empty).
+$listing = $service->list(perPage: 24, page: 1, sort: ProductSort::PriceAsc);
+
+$products = $listing->products;  // a real Illuminate\Pagination\LengthAwarePaginator,
+                                  // built from the localized Meilisearch hits (not Scout's
+                                  // own paginateRaw() result — see "Meilisearch driver
+                                  // quirk" below), so it behaves like any other Laravel
+                                  // paginator.
+$products->items();            // array of Meilisearch documents (plain arrays, not models)
+$products->total();
+$products->perPage();
+$products->currentPage();
+$products->lastPage();
+$products->links();            // in a Blade view — renders pagination links as usual
+
+$bounds = $listing->priceBounds;  // Modules\Core\Catalog\DTOs\PriceSliderBounds
+$bounds->floor;    // ?int — floor() of the matching range's minimum, in whole currency units
+$bounds->ceil;     // ?int — ceil() of the matching range's maximum
+$bounds->filtered; // bool — whether the applied filters' minPrice/maxPrice actually
+                   // narrow the slider below/above these bounds (drives whether a
+                   // "clear filter" control should show)
 
 // Single product, by primary key
 $product = $service->getById(367);   // array, or null if not found
 
 // Single product, by URL slug (any locale — slugs are indexed across all languages)
 $product = $service->getBySlug('erotika-mprelok');   // array, or null if not found
+
+// $limit random products — still scoped to the index's own default channel/status
+// visibility, unlike Eloquent's Product::inRandomOrder() (which has no notion of
+// that filtering at all). Meilisearch has no ORDER BY RANDOM() equivalent, so this
+// pulls every matching id only, shuffles in PHP, then fetches the full localized
+// documents for just the ids picked — see random()'s own docblock.
+$randomProducts = $service->random(13);   // array of documents, same shape as list()'s items
+
+// The id/price/image of every variant on a product document — the base price and
+// thumbnail a variant picker/swatch list needs, without reaching into
+// $product['variants'][n]['prices'][0]/['media'][0] yourself.
+$variants = $service->variantSummaries($product);
+// [['id' => 1204, 'price' => 19.99, 'image' => 'https://.../thumb.jpg'], ...]
+
+// Facet counts for a sidebar — value => matching product count, scoped to whatever
+// $filters is passed. Does NOT exclude the faceted field itself from $filters — see
+// facets()'s docblock for why, and how to build a standard "every option's count,
+// unaffected by that option's own currently-selected value" sidebar.
+$brandCounts = $service->facets('brand', filters: new ProductFilters(collectionId: 17));
+// ['3Dealer.gr - 3D printed creations' => 48, 'Kraniou Topos - 3D printed creations' => 135]
+
+// Min/max price across matching products — the raw, unrounded values list() itself
+// uses to build priceBounds above. minPrice/maxPrice are ALWAYS excluded from the
+// filter driving this (unlike facets(), which doesn't auto-exclude) — the slider's
+// own bounds shouldn't shrink to whatever range is currently selected on it. Other
+// filters (collectionId, brand, inStockOnly) still apply normally. Pass $query too
+// to scope the range to a text search's own matches (see product-search.md) rather
+// than the whole catalog.
+$range = $service->priceRange(new ProductFilters(collectionId: 17));
+// ['min' => 0.0, 'max' => 120.0]
 ```
 
 All `ProductFilters` fields are optional; only the ones set are added to the Meilisearch query.
 
+`facets()` only makes sense on discrete-value filterable fields (`brand`, `in_stock`) — a numeric
+field like `price` would return one "facet" per exact price, not a usable range bucket. Use
+`priceRange()` (or `list()`'s own `priceBounds`) for `price` instead, which reads Meilisearch's
+`facetStats` (min/max), a different feature from `facetDistribution`.
+
 ---
 
-## Fields this depends on: `Modules\Core\Search\ProductIndexer`
+## Stock goes stale between orders
+
+`in_stock` reflects `ProductVariant::stock`/`purchasable` as of the **last reindex**, not live
+inventory. Nothing in this codebase currently reindexes a product when an order decrements its
+stock — that's a cart/checkout concern, not something `ProductIndexer` can solve on its own (see
+`Modules\Core\Catalog\Observers\ProductOptionReindexObserver` for the equivalent pattern once an
+order → stock → reindex pipeline exists to hook into). Until then, `in_stock`/`product_count` can
+drift from the database the same way every other indexed field already can between writes.
+
+---
+
+## Fields this depends on: `Modules\Core\Catalog\Services\ProductIndexer`
 
 Lunar's own `Lunar\Search\ProductIndexer` only carries listing-grade fields (name, description,
 status, brand, a single thumbnail, skus) and marks just `__soft_deleted`, `skus`, `status` as
-filterable. `Modules\Core\Search\ProductIndexer` extends it to add everything `ProductService`
+filterable. `Modules\Core\Catalog\Services\ProductIndexer` extends it to add everything `ProductService`
 needs, listing and detail alike:
 
 | Field | Source | Notes |
 |---|---|---|
 | `id` | — | Newly marked **filterable** — needed for `getById()`'s `id = "..."` filter; Meilisearch doesn't filter on the primary key by default. |
-| `collections` | `$product->collections->pluck('id')` | Filterable. Array of collection IDs (as strings) — filtering matches by ID, not slug. |
-| `collection_names` | `$product->collections` | Display only, not filterable — translated collection names. |
+| `collections` | `$product->collections` | Array of `{id, name}` — directly assigned collections only, `name` is the translated collection name. Not filterable — see `collection_ids`. |
+| `collection_ids` | `$product->collections` + `->ancestors` | Filterable. Flat array of every directly-assigned collection's id, unioned with all of its ancestors' ids. `ProductFilters(collectionId: ...)` filters against this field, not `collections`, since products are typically attached only to leaf collections — a plain direct-match filter would never return anything for a parent/root category page. |
 | `slugs` | `$product->urls->pluck('slug')` | Filterable. Every locale's `Url::slug` for the product, so `getBySlug()` resolves purely from the index — no database read. |
+| `skus` | `$product->variants->pluck('sku')` | Filterable. Every variant's `sku`, deduplicated, empty ones dropped. Same "resolve from the index alone" reasoning as `slugs`, for a future SKU-based lookup/filter. |
 | `price` | Cheapest variant's base price | Filterable. Float in major units (e.g. `19.99`, not `1999`). Base price only — no customer group, default currency (`Currency::getDefault()`) only. `null` if the product has no priced variant yet, so it's excluded from range filters rather than treated as free. |
 | `brand` | Already indexed by Lunar's base indexer | Newly marked **filterable** — it existed in the document already, just wasn't usable in a `filter` clause. |
 | `tags` | `$product->tags->pluck('value')` | Display only. |
 | `media` | `$product->media` | Full gallery (id/url/thumb per image), not just the single thumbnail Lunar's base indexer sends. |
-| `variants` | `$product->variants` | Per variant: `id`, `sku`, `stock`, `purchasable`, `options` (option/value names, in the current locale), `prices` (per currency/customer group), `media` (variant-specific images). |
-| `reviews`, `review_count`, `average_rating` | `Modules\Core\Review\Models\ProductReview` | See "Reviews" below. |
+| `variants` | `$product->variants` | Per variant: `id`, `sku`, `gtin`, `mpn`, `ean`, `stock`, `backorder`, `unit_quantity`, `purchasable`, `shippable`, `tax_ref`, `dimensions` (`length`/`width`/`height`/`weight`/`volume`, each `{value, unit}`), `options` (option/value names, in the current locale), `prices` (per currency/customer group), `media` (the variant's own images — `ProductVariant::images()`, a separate pivot from the product's own gallery above, populated by `ShopifyExportImporter` from Shopify's `Variant Image` CSV column). |
+| `reviews` | `Modules\Core\Review\Models\ProductReview` | `{items, count, average_rating}` — see "Reviews" below. |
+| `in_stock` | `$model->variants` | Filterable boolean. `true` if ANY variant currently passes `ProductVariant::canBeFulfilledAtQuantity(1)` — Lunar's own purchasability rule (`purchasable === 'always'` ignores stock entirely; `in_stock` checks `stock` alone; anything else checks `stock + backorder`). Only as fresh as the last reindex — see "Stock goes stale" below. |
 
-`description` and other translated attributes are indexed as-is, including any HTML markup
-(e.g. from a Shopify `Body (HTML)` import) — **not stripped**. Any view rendering a description
-sourced from `ProductService`'s results must treat it as trusted HTML.
+`name`/`description` (and any other `TranslatedText` attribute) are indexed per-locale — see
+"Locale resolution" below for how `ProductService` resolves them down to one value per request.
 
 **`ProductOption`/`ProductOptionValue` names need a different translation accessor.** Unlike
 `Product`/`Collection`/`Brand`, their `name` is a plain locale-keyed array cast, not
@@ -85,13 +154,41 @@ indexer's `translatedName()` reads the array directly instead. See `docs/lunar.m
 
 ---
 
+## Locale resolution: `name`, `description`, and any other translated attribute
+
+Lunar's base `ScoutIndexer` explodes every `TranslatedText` attribute into one `{handle}_{locale}`
+field per store language at index time (`name_el`, `name_en`, `description_el`, ... — and the same
+for any custom translated attribute a store adds, e.g. `seo_title`/`seo_description`). Every raw
+document in Meilisearch carries all of them side by side, since a document is written once but
+read across many different-locale requests.
+
+`ProductService` resolves these back down to a single value per request. For every result it
+returns (`list()`'s items, `getById()`, `getBySlug()`), it:
+
+1. Reads which `Product` attributes are `TranslatedText` from `Lunar\Base\AttributeManifest` — the
+   same source Lunar's own indexer reads — rather than a hardcoded `['name', 'description']` list,
+   so a store's own custom translated attributes are picked up automatically with no change here.
+2. For each one, resolves `{handle}_{currentLocale}`, falling back to `{handle}_{storeDefaultLocale}`
+   (`LanguageCache::defaultLocale()`) if the current locale has no translation — e.g. a product with
+   no English copy yet still shows its Greek name on `/en/` rather than rendering blank.
+3. Assigns the result to a plain `{handle}` key and **strips every raw `{handle}_{locale}` key** —
+   callers only ever see `$product['name']`/`$product['seo_title']`/etc., never the per-locale
+   fields the index actually stores.
+
+`description` and other translated attributes are otherwise indexed as-is, including any HTML
+markup (e.g. from a Shopify `Body (HTML)` import) — **not stripped**. Any view rendering a
+description sourced from `ProductService`'s results must treat it as trusted HTML.
+
+---
+
 ## Reviews
 
-`Modules\Core\Review\Models\ProductReview` (`product_reviews` table) is indexed per-product as
-`reviews` (array), plus `review_count` and `average_rating` (rounded to 1 decimal, `null` if the
-product has no reviews). Only public-safe fields are included — **`reviewer_email` is deliberately
-excluded**, it's PII with no storefront use. `reply`/`replied_at` (the staff response) are
-included, since they're meant to be shown alongside the review.
+`Modules\Core\Review\Models\ProductReview` (`product_reviews` table) is indexed per-product under
+a single `reviews` key: `{items, count, average_rating}` — `items` is the array of reviews,
+`average_rating` is rounded to 1 decimal (`null` if the product has no reviews). Only public-safe
+fields are included on each item — **`reviewer_email` is deliberately excluded**, it's PII with no
+storefront use. `reply`/`replied_at` (the staff response) are included, since they're meant to be
+shown alongside the review.
 
 A review is created/edited independently of its product (a customer submission, a staff reply)
 — its own save doesn't touch the `Product` row, so the product's own model events never fire.
@@ -113,13 +210,28 @@ variants don't.
 
 ---
 
+## Sorting
+
+`ProductSort` (`Modules\Core\Catalog\Enums\ProductSort`) is a fixed enum of supported sort orders —
+`PriceAsc`, `PriceDesc`, `Newest` — each mapping to a Meilisearch `sort` clause against a field
+`Modules\Core\Catalog\Services\ProductIndexer::getSortableFields()` marks sortable (`price`, plus
+`created_at`/`updated_at`/`skus`/`status` inherited from Lunar's base indexer). Adding a new
+`ProductSort` case requires adding the matching field to `getSortableFields()` and re-syncing (see
+below) — sortable attributes are index settings, not computed per-query, same as filterable ones.
+
+Omitting `sort` leaves Meilisearch's default ordering, which is meaningless here since `list()`
+always searches with an empty query string (`Product::search('')`) — there's no relevance score to
+rank by, so results come back in whatever order the index returns them absent an explicit sort.
+
+---
+
 ## Registering the indexer
 
 Not automatic — an app opts in via its own `config/lunar/search.php`:
 
 ```php
 'indexers' => [
-    Lunar\Models\Product::class => Modules\Core\Search\ProductIndexer::class,
+    Lunar\Models\Product::class => Modules\Core\Catalog\Services\ProductIndexer::class,
     // ...other model indexers unchanged
 ],
 ```
diff --git a/docs/product-options.md b/docs/product-options.md
new file mode 100644
index 0000000..7ff203e
--- /dev/null
+++ b/docs/product-options.md
@@ -0,0 +1,113 @@
+# Product Option Types
+
+Lunar's `ProductOption`/`ProductOptionValue` are generic by design — a "Color" option
+and a "Size" option are both just a handle, a translated name, and a list of values.
+Each `ProductOptionValue` carries a free-form `meta` jsonb column, but nothing in
+Lunar's own admin UI exposes it — there's no way for an admin to, say, attach a hex
+code to a "Red" value without editing the database directly.
+
+`Modules\Core\Catalog\Contracts\ProductOptionTypeInterface` describes how a category
+of option behaves — what structured data its values carry in `meta`, and how an
+admin edits that data — without introducing a new model. `ProductOption`/
+`ProductOptionValue` stay exactly as Lunar defines them.
+
+---
+
+## Registering a type
+
+A shop registers a type class from its own service provider's `boot()`, the same
+shape as `Modules\Core\Notification\NotificationRegistry`:
+
+```php
+use Modules\Core\Catalog\Services\ProductOptionTypeManager;
+
+ProductOptionTypeManager::get()->register([
+    \App\ProductOptions\ColorOptionType::class,
+]);
+```
+
+Not a published config array — the mapping isn't per-`ProductOption`, so there's
+nothing for a shop to *key* by. Instead, an admin picks a type per-option from a
+dropdown on the `ProductOption` edit form itself (see below); the choice is stored
+in `ProductOption::meta['option_type']`, deliberately **not** tied to the option's
+`handle` (a shop's own handle naming — transliterated Greek, legacy import slugs —
+shouldn't have to match a type's key).
+
+A `ProductOption` with no type selected behaves exactly as stock Lunar does — plain
+name/position, no extra meta form.
+
+---
+
+## Writing a type
+
+```php
+namespace App\ProductOptions;
+
+use Filament\Forms\Components\ColorPicker;
+use Modules\Core\Catalog\Contracts\ProductOptionTypeInterface;
+
+class ColorOptionType implements ProductOptionTypeInterface
+{
+    public static function getKey(): string
+    {
+        return 'color';
+    }
+
+    public function getMetaForm(): array
+    {
+        return [
+            ColorPicker::make('meta.hex')
+                ->label('Color')
+                ->required(),
+        ];
+    }
+}
+```
+
+`getMetaForm()` returns Filament form components, keyed under `meta.*` dot notation
+— the path they save to on `ProductOptionValue::meta` (cast as `AsArrayObject`, a
+plain jsonb column). `getKey()` is the identifier used in the admin's "Option Type"
+dropdown and in `ProductOption::meta['option_type']` — it has no relationship to the
+`ProductOption::handle`.
+
+A reference implementation ships at `Modules\Core\Catalog\OptionTypes\ColorOptionType`,
+registered automatically by `Modules\Core\Providers\CatalogServiceProvider` — no shop
+setup needed for it to appear in the "Option Type" dropdown, though an admin still
+has to pick it per-`ProductOption` for it to take effect.
+
+---
+
+## How it's wired into the admin UI
+
+`Modules\Core\Catalog\Services\ProductOptionTypeManager` is a singleton registry:
+- `get(): static` — the shared instance.
+- `register(array $types): void` — registers one or more type classes, keyed
+  internally by `getKey()`.
+- `unregister(string $key): void`
+- `resolve(?string $key): ?ProductOptionTypeInterface` — looks up a registered type
+  by key (or `null` if no key / not found).
+- `all(): array<string, class-string>` — every registered type's class, keyed by
+  `getKey()`.
+
+Two extensions hook into Lunar's admin via its extension system
+(`LunarPanel::extensions([...])`, registered in `CorePlugin`) — no forking of Lunar's
+classes needed:
+
+- `Modules\Core\Catalog\Filament\Extensions\ProductOptionResourceExtension` extends
+  `Lunar\Admin\Filament\Resources\ProductOptionResource`'s own form with a `Select`
+  (`meta.option_type`) listing every enabled type's key. Shown only when at least one
+  type is enabled.
+- `Modules\Core\Catalog\Filament\Extensions\ValuesRelationManagerExtension` extends
+  the "Values" tab's form. Its `extendForm()` reads
+  `$option->meta['option_type']` off the owning `ProductOption`, resolves it via
+  `ProductOptionTypeManager`, and appends `getMetaForm()`'s fields to the stock name
+  field. A `ProductOption` with no type selected gets the stock form unchanged.
+
+---
+
+## Reading the value back
+
+Storefront code reads `ProductOptionValue::meta` like any other jsonb column — e.g.
+`$value->meta['hex']` for a color swatch. `ProductOptionTypeManager` is an admin-side
+concern only (describing *how to edit* the meta); nothing requires the storefront to
+go through it to *read* the meta.
diff --git a/docs/product-recommendations.md b/docs/product-recommendations.md
new file mode 100644
index 0000000..2a391ed
--- /dev/null
+++ b/docs/product-recommendations.md
@@ -0,0 +1,155 @@
+# Product Recommendations
+
+`Modules\Core\Catalog\Services\RecommendationService` computes "related products" for a given
+product — a same-category pick today, with a random fallback, but built as a configurable chain of
+strategies rather than one hardcoded rule. `Modules\Core\Catalog\Services\ProductIndexer` embeds
+the result directly into each product's own Meilisearch document, so a product detail page renders
+its recommendations with zero extra queries — same reasoning as `collections` (see
+`docs/product-listing.md`).
+
+---
+
+## The rule chain
+
+```php
+use Modules\Core\Catalog\Services\RecommendationService;
+
+$recommendations = app(RecommendationService::class)->recommend($product, limit: 4);
+// Illuminate\Support\Collection<int, Lunar\Models\Product>
+```
+
+`recommend()` walks `config('catalog.recommendation_rules')` in order, **topping up** from each
+successive rule until `$limit` distinct products are collected or every rule is exhausted — it does
+not stop at the first rule that returns *something*. If a product's category only has 3 other
+products, `SameCategoryRule` contributes those 3 and `RandomRule` fills the last slot. A rule is
+handed the ids already collected (`$exclude`, always including the source product's own id) so it
+never wastes its own `$limit` budget re-suggesting something already picked, and the same product
+is never returned twice even if two rules would both suggest it.
+
+Default chain (`config/catalog.php`):
+
+```php
+'recommendation_rules' => [
+    SameCategoryRule::class,   // other products sharing $product's first collection
+    RandomRule::class,          // universal fallback — always returns something as
+                                 // long as the store has more than one product
+],
+```
+
+A consuming app publishes and edits this config to reorder, add, or remove rules — nothing about
+the chain shape is hardcoded in `RecommendationService` itself. A new rule (same tag, best sellers,
+"frequently bought together", ...) is a class implementing `Modules\Core\Catalog\Contracts\
+RecommendationRule`, added to the array:
+
+```php
+interface RecommendationRule
+{
+    /**
+     * @param  array<int>  $exclude  ids to never return — the source product's own
+     *   id, plus every id an earlier rule in the chain already picked
+     * @return Collection<int, Product>  at most $limit products
+     */
+    public function recommend(Product $product, int $limit, array $exclude): Collection;
+}
+```
+
+Rules query Eloquent directly (`$product->collections->first()->products()`, `Product::query()`),
+not `Modules\Core\Catalog\Services\ProductService` — see "Why not `ProductService`" below.
+
+---
+
+## Why not `ProductService`
+
+Every other read path in `Modules\Core\Catalog` goes through `ProductService`, which reads
+Meilisearch and resolves translated fields to whatever locale the *current request* is in (see
+`docs/product-listing.md`, "Locale resolution"). Recommendation rules deliberately don't use it:
+they run inside `ProductIndexer::toSearchableArray()`, at **index time** — there is no request, no
+meaningful "current locale" to resolve against, and Meilisearch itself may be mid-write for the very
+product being indexed. Rules return raw `Lunar\Models\Product` models instead; `ProductIndexer`
+resolves what it embeds (`name` via `translateAttribute()`, `price` via the indexer's own
+`cheapestPrice()`, `image` via its own `mapMedia()`) the same way it already does for the embedded
+`collections` field — including that field's same accepted index-time-locale tradeoff (a
+recommendation's embedded `name` reflects whatever locale was active when *that* product was last
+indexed, not the viewer's current locale).
+
+---
+
+## What's embedded, and why not just an id
+
+`ProductIndexer` embeds full card data per recommendation, not just an id:
+
+```php
+$data['recommendations'] = [
+    ['id' => 42, 'name' => 'Espresso Cup', 'price' => 12.5, 'image' => 'https://.../thumb.jpg'],
+    // ...
+];
+```
+
+This shape is deliberately exactly what `x-ui.product-card`/`x-product-grid` (3dealer's storefront
+components) need — `name`, `price`, `image`, and an `id` the view resolves to a URL itself via
+`route('product.show', ['id' => $rec['id']])`. A resolved `href` is **not** embedded: `product.show`
+is locale-prefixed (`{locale}/products/{id}`), so a URL baked in at index time would be correct only
+for whichever locale happened to be active during that index run — wrong for every other locale.
+Building the URL is left to the view, which knows the current request's locale.
+
+`recommendations.id` is marked **filterable** — not for the storefront, but for the reverse-lookup
+reindexing below.
+
+---
+
+## Keeping it fresh: `ProductSaved` / `ProductDeleted`
+
+A recommendation is computed once, at index time, and embedded — it does not update itself when the
+recommended product later changes name, price, or image, or is deleted. Unlike `Modules\Core\Catalog\
+Observers\ProductOptionReindexObserver`'s equivalent problem (which product option value is used by),
+there is no Postgres relation for "which products currently recommend product X" — a recommendation
+only exists inside Meilisearch. The fix is a reverse Meilisearch filter query, not a database join,
+wired through a real event → listener pair (`Modules\Core\Providers\CatalogServiceProvider`):
+
+- `Product::saved()` dispatches `Modules\Core\Catalog\Events\ProductSaved`.
+- `Product::deleted()` dispatches `Modules\Core\Catalog\Events\ProductDeleted` — fires for both a
+  soft delete and a force delete (`Lunar\Models\Product` uses `SoftDeletes`), the same model event
+  Laravel Scout's own `ModelObserver` hooks to make a deleted product `unsearchable()`.
+- `Modules\Core\Catalog\Listeners\ReindexProductsRecommendingProduct` handles both: it searches the
+  product index for `recommendations.id = "{id}"`, finds every referencing product, and calls
+  `->searchable()` on each — which recomputes their `recommendations` field fresh, picking up the
+  changed name/price/image, or (for a delete) dropping the now-gone product and topping back up to
+  the configured limit via the rule chain, same as any other reindex.
+
+`->searchable()` dispatches Scout's own reindex job, queued if `SCOUT_QUEUE` is configured — this
+listener does no synchronous Meilisearch writing itself.
+
+**Product creation is deliberately not hooked into this.** A brand-new product has no
+`recommendations` of its own until Scout's existing create-triggered indexing runs (already correct
+— nothing to add). What's *not* immediate is other products picking the new one up as a fresh
+recommendation candidate — that happens on their own next natural reindex (a save, or the nightly
+full reindex below), the same accepted staleness window `docs/product-listing.md` already documents
+for `in_stock`/`price`. A full proactive "who could now recommend this new product" pass was
+considered and rejected as unnecessary cost for a cosmetic delay.
+
+---
+
+## Nightly full reindex
+
+`Modules\Core\Providers\CatalogServiceProvider` schedules `lunar:search:index "Lunar\Models\Product"
+--refresh` daily at 03:00 — a safety net on top of the event-driven reindexing above, not a
+replacement for it. Catches what event-driven reindexing deliberately doesn't cover: a newly-created
+product not yet appearing as a recommendation elsewhere, and any other drift already accepted
+between reindexes (see `docs/product-listing.md`, "Stock goes stale between orders"). `--refresh`
+also re-syncs filterable/sortable index *settings*, not just documents, so a deploy that changed
+`ProductIndexer`'s field list self-heals overnight even if `lunar:meilisearch:setup` wasn't run
+manually right after that deploy.
+
+---
+
+## Re-syncing after this change
+
+Same as any other `ProductIndexer` field change (see `docs/product-listing.md`):
+
+```bash
+php artisan lunar:meilisearch:setup
+php artisan lunar:search:index "Lunar\Models\Product" --refresh
+```
+
+Restart the queue worker if `SCOUT_QUEUE=true` — see `docs/product-listing.md`'s "Re-syncing after
+this change" for why a running worker won't otherwise pick up the new indexer code.
diff --git a/docs/product-search.md b/docs/product-search.md
index 8f3a98b..aceb157 100644
--- a/docs/product-search.md
+++ b/docs/product-search.md
@@ -1,6 +1,6 @@
 # Product Search
 
-`Modules\Core\Search\ProductSearchService` provides locale-aware full-text product search on
+`Modules\Core\Catalog\Services\ProductSearchService` provides locale-aware full-text product search on
 top of Laravel Scout + Meilisearch.
 
 ---
@@ -24,36 +24,62 @@ merges `$builder->options` directly into the search request).
 ## Usage
 
 ```php
-use Modules\Core\Search\ProductSearchService;
+use Modules\Core\Catalog\DTOs\ProductFilters;
+use Modules\Core\Catalog\Enums\ProductSort;
+use Modules\Core\Catalog\Services\ProductSearchService;
 
 $results = app(ProductSearchService::class)->search('running shoes');
-// or an explicit locale, bypassing App::getLocale():
-$results = app(ProductSearchService::class)->search('running shoes', 'el');
+
+// Filters/sort apply the exact same semantics ProductService::list() uses for
+// collection browsing (same ProductFilterBuilder, same ProductSort) — a shopper
+// narrowing a text search by price/brand/stock gets identical filter behavior
+// to narrowing a category listing.
+$results = app(ProductSearchService::class)->search(
+    'running shoes',
+    filters: new ProductFilters(brand: 'Acme', minPrice: 20.0, inStockOnly: true),
+    sort: ProductSort::PriceAsc,
+);
 ```
 
 Returns an `Illuminate\Database\Eloquent\Collection` of `Lunar\Models\Product` — Scout's
 `->get()` hydrates real models from the database after the Meilisearch query, so relations
 (`variants`, `brand`, `media`, etc.) are available on the results as normal.
 
-`$locale` defaults to `App::getLocale()` — already set correctly on every storefront request by
-`Modules\Core\Localization\LocaleMiddleware` (see `localization.md`), so callers in controllers
-don't need to pass it explicitly.
+There is no `$locale` parameter — see "Field list is dynamic, not hardcoded" below for why
+every configured store language is always searched, regardless of the current request locale.
 
 ---
 
-## Missing-translation fallback
+## Missing-translation fallback, in both directions
 
 If a product was only ever given an English name, `name_el` doesn't exist on that document at
 all (Lunar's indexer only writes a `{handle}_{locale}` field for locales actually present in the
 attribute's stored data — see `ScoutIndexer::mapSearchableAttributes()`). Searching strictly
-against `name_el` would make that product invisible to Greek-locale search, even though it's a
-real catalog item.
+against the current request's locale field would make that product invisible whenever a shopper's
+locale doesn't match the language it happens to be translated into.
 
-To avoid silently hiding incompletely-translated products, `ProductSearchService` targets **both**
-the resolved locale's fields **and** the default language's fields
-(`Lunar\Models\Language::getDefault()->code`) — e.g. searching in `el` targets `name_el`,
-`name_en`, `description_el`, `description_en` together (assuming `en` is the default language).
-A product missing an `el` translation still matches via its `en` fields.
+`ProductSearchService` avoids this by targeting **every configured store language's fields**
+(`Lunar\Models\Language::all()`) on every search, not just the current request locale plus the
+store default — e.g. with `el`/`en` configured, every search targets `name_el`, `name_en`,
+`description_el`, `description_en` together, regardless of which locale the shopper is browsing
+in. This is deliberately not scoped to "current locale + default locale": if the current locale
+already equals the default (a single-language store, or a shopper browsing in the default
+language), that pairing collapses to one locale and stops catching anything else — always
+searching every configured language avoids that gap in both directions, at the cost of a larger
+`attributesToSearchOn` list as the store's language count grows.
+
+---
+
+## Variant option values are searched too
+
+Alongside the locale-suffixed attribute fields, every search also targets
+`variants.options.value` directly — e.g. a variant named "Κάπτεν Γαμέρικα" on a "Name" option
+matches a search for that text, even though it never appears in the product's own name or
+description. This isn't one of Lunar's own attributes (`AttributeManifest` has no entry for it),
+so it can't be discovered the way `name`/`description` are — it's a structural field of
+`Modules\Core\Catalog\Services\ProductIndexer`'s own document shape (see `ProductIndexer::mapVariant()`),
+added here directly. Not locale-suffixed — each option value is stored as one already-resolved
+string per variant.
 
 ---
 
diff --git a/docs/recovery-strategies.md b/docs/recovery-strategies.md
new file mode 100644
index 0000000..bd1a78f
--- /dev/null
+++ b/docs/recovery-strategies.md
@@ -0,0 +1,128 @@
+# Cart/Checkout Recovery Strategies — Design Notes
+
+**Status: open design discussion, not scoped or built.** This is a record of the
+reasoning behind an eventual "Recovery Sequences" feature, kept so the discussion doesn't
+have to be re-derived from scratch later. Nothing in this document is implemented.
+
+See `docs/cart.md` for what's actually built today (the four-state cart classification,
+`CartAbandoned`/`CheckoutAbandoned` events, `DetectAbandonedCarts`).
+
+---
+
+## Why Abandoned Cart and Abandoned Checkout need different strategies
+
+Established in `docs/cart.md`: Abandoned Cart (no order ever started) is a weak purchase-intent
+signal and often unreachable (no identity for a true guest). Abandoned Checkout (a draft order
+exists, `placed_at IS NULL`) is a strong intent signal and usually reachable, since checkout
+typically captures an email/address even for a guest.
+
+That difference in intent and reachability drives genuinely different marketing strategy, not
+just a different admin filter:
+
+### Abandoned Cart strategy — re-engagement, not completion
+
+- **On-site retargeting first** (exit-intent popups, "still thinking it over?" banners on
+  return visits) — often the only viable channel, since email may not exist yet.
+- **Ad platform retargeting** (Meta/Google dynamic remarketing) is the dominant channel here
+  specifically because it works off a browser/device signal, not an email address — the one
+  thing reliably available for an anonymous cart.
+- **Soft messaging** ("did you forget something?") rather than urgency-driven — intent is
+  weak, so aggressive discounting is often poor ROI: it trains browsers who were never close
+  to buying to expect a coupon.
+- **Longer, gentler cadence** — a single reminder around 24h, maybe a second a few days out,
+  sometimes trigger-based (a price drop, back-in-stock) rather than a fixed schedule.
+
+### Abandoned Checkout strategy — completion, not re-engagement
+
+- **Speed matters most.** This is where the classic 1h/24h/72h recovery-email cadence lives —
+  conversion drops sharply with delay, since the shopper is often still in a "was about to
+  buy" mental state within the first hour.
+- **Direct, urgency-framed messaging** ("complete your order"), sometimes showing cart
+  contents/total, occasionally a countdown or limited-time incentive on later touches.
+- **Discount escalation pays off here** — a small incentive (free shipping, 10% off) on the
+  2nd/3rd touch is standard, because it's nudging someone who already decided to buy past
+  whatever blocked them (price shock, a broken payment step, indecision on shipping cost) —
+  not manufacturing demand from nothing.
+- **SMS is more viable** — checkout often captures a phone number, and the higher intent
+  justifies a more direct channel than for cart-stage.
+
+---
+
+## The broader strategy space (beyond cadence + discount)
+
+Raised as context for how far a "Recovery Sequence" feature might eventually need to flex,
+without committing to building any of it yet:
+
+**Message-content strategies**
+- Social proof ("X people have this in their cart," reviews shown in the reminder)
+- Scarcity/urgency framing (low-stock count, countdown timer on an offer)
+- Personalized alternatives — a cheaper or complementary item instead of just re-showing the
+  abandoned one, useful when the likely blocker was price
+
+**Channel strategies**
+- Email (the baseline; nothing built yet — see `docs/cart.md`'s "Recovery Sequences" section)
+- SMS — checkout-stage specifically, opt-in required
+- Push notifications — not relevant yet given this project's storefront maturity, noted for
+  completeness
+- On-site remarketing (banner/modal on the shopper's next visit) — doesn't require email at
+  all, arguably the highest-value channel for Abandoned Cart specifically
+- Ad platform sync (pushing abandoned-cart product data to a custom audience for paid retargeting)
+
+**Escalation/segmentation strategies**
+- Value-based branching — a high-value abandoned checkout might skip straight to a bigger
+  incentive rather than waiting through a full ladder
+- Repeat-abandoner suppression — a customer who's abandoned 3+ times without ever completing
+  either stops receiving emails (fatigue/spam risk) or gets a different tactic (e.g. a "what
+  stopped you?" survey) instead of another discount
+- New vs. returning customer branching — a first-time visitor's abandoned cart might warrant
+  "welcome discount" framing instead of a generic recovery email, since the blocker was
+  likely trust/unfamiliarity rather than price
+
+**Timing refinement**
+- Time-of-day/timezone-aware sending (don't fire a touch at 3am local time even if the delay
+  technically elapsed)
+- Cart-content-triggered timing — a fast-moving/low-stock item might warrant an earlier, more
+  urgent first touch than a cart of always-in-stock staples
+
+---
+
+## First-pass feature shape (discussed, not finalized)
+
+An admin defines, independently per abandonment type (Abandoned Cart, Abandoned Checkout), an
+ordered sequence of **touches**. Each touch is three ideas:
+
+1. **How long to wait** since the abandonment began
+2. **What offer to attach**, optional — reusing whatever `Discount` already exists in the
+   system rather than inventing a new pricing concept
+3. **A label**, so staff can see what a touch represents in the admin UI
+
+The system continuously re-evaluates every abandoned cart/checkout against its sequence, and
+when a cart becomes due for the next touch it hasn't had yet, that becomes a signal — this
+feature's responsibility ends there. Actually sending anything (email, SMS, on-site banner) is
+explicitly out of scope for this feature; something else, not yet designed, would consume that
+signal.
+
+### What this requires that isn't built yet
+
+- **A fixed "abandonment began at" timestamp**, captured once and never re-derived — a
+  sequence needs to schedule touches from a stable starting point, not from `Cart::updated_at`,
+  which keeps moving every time the cart (or its own bookkeeping) is written to. This is the
+  same underlying issue as the known bug in `docs/cart.md`'s "Abandonment detection" section —
+  fixing that bug properly (freezing the abandonment moment) is very likely a prerequisite for
+  this feature, not a separate concern.
+- **Re-evaluation, not one-shot detection** — `DetectAbandonedCarts` today marks a cart
+  abandoned once and stops; a sequence needs a cart to be revisited on every scheduler run to
+  check "which touch, if any, is now due," for as long as it stays unrecovered.
+
+### Still undecided
+
+- **Which concern this belongs under.** Not `Cart` (it's not a cart-mechanics concern) —
+  candidates raised: a new `Recovery` concern, or `Marketing`. Not decided.
+- **How far the touch model needs to flex.** The three-idea shape above (delay, discount,
+  label) covers cadence + discount escalation cleanly, but doesn't yet accommodate channel
+  choice, value-based branching, or segment targeting from the broader strategy list above.
+  Whether those get folded into the touch model, layered on top some other way, or deliberately
+  left out of v1 is unresolved.
+- **Whether "recovery" is cart/checkout-specific at all**, or a more general "scheduled
+  customer touch based on a triggering condition" mechanism that cart/checkout abandonment
+  happens to be the first use case for.
diff --git a/docs/scratch/analytics-feature-survey.html b/docs/scratch/analytics-feature-survey.html
new file mode 100644
index 0000000..18ee9a7
--- /dev/null
+++ b/docs/scratch/analytics-feature-survey.html
@@ -0,0 +1,449 @@
+<title>Analytics Feature Survey</title>
+<style>
+  :root {
+    --paper: #FAFAF7;
+    --ink: #1C1C1A;
+    --muted: #6B6B63;
+    --accent: #2F5D50;
+    --accent-soft: #E4EDE9;
+    --good: #3F7A5C;
+    --good-soft: #E6F0EA;
+    --warn: #B8863B;
+    --warn-soft: #F5ECDC;
+    --miss: #A14B3B;
+    --miss-soft: #F5E5E0;
+    --hairline: #E4E2DB;
+    --card: #FFFFFF;
+  }
+
+  :root:not([data-theme="light"]) {
+    @media (prefers-color-scheme: dark) {
+      --paper: #17181A;
+      --ink: #EDEBE4;
+      --muted: #9B9A90;
+      --accent: #7FBFA8;
+      --accent-soft: #1E2C27;
+      --good: #6FBF97;
+      --good-soft: #1B2A22;
+      --warn: #D9A85C;
+      --warn-soft: #2C2418;
+      --miss: #D97C68;
+      --miss-soft: #2E1E1A;
+      --hairline: #2C2D2E;
+      --card: #1E1F21;
+    }
+  }
+
+  :root[data-theme="dark"] {
+    --paper: #17181A;
+    --ink: #EDEBE4;
+    --muted: #9B9A90;
+    --accent: #7FBFA8;
+    --accent-soft: #1E2C27;
+    --good: #6FBF97;
+    --good-soft: #1B2A22;
+    --warn: #D9A85C;
+    --warn-soft: #2C2418;
+    --miss: #D97C68;
+    --miss-soft: #2E1E1A;
+    --hairline: #2C2D2E;
+    --card: #1E1F21;
+  }
+
+  * { box-sizing: border-box; }
+
+  body {
+    background: var(--paper);
+    color: var(--ink);
+    font-family: "IBM Plex Sans", ui-sans-serif, system-ui, sans-serif;
+    font-size: 15.5px;
+    line-height: 1.55;
+    margin: 0;
+    padding: 4.5rem 1.5rem 6rem;
+  }
+
+  .wrap {
+    max-width: 780px;
+    margin: 0 auto;
+  }
+
+  header.page {
+    margin-bottom: 3.25rem;
+  }
+
+  .eyebrow {
+    font-family: "IBM Plex Mono", ui-monospace, monospace;
+    font-size: 0.72rem;
+    letter-spacing: 0.12em;
+    text-transform: uppercase;
+    color: var(--accent);
+    margin-bottom: 0.9rem;
+  }
+
+  h1 {
+    font-family: "Fraunces", Georgia, serif;
+    font-weight: 560;
+    font-size: clamp(2.1rem, 4.5vw, 2.65rem);
+    line-height: 1.08;
+    letter-spacing: -0.01em;
+    margin: 0 0 0.9rem;
+    text-wrap: balance;
+  }
+
+  .dek {
+    color: var(--muted);
+    max-width: 60ch;
+    font-size: 1.02rem;
+  }
+
+  .dek strong {
+    color: var(--ink);
+    font-weight: 600;
+  }
+
+  .legend {
+    display: flex;
+    flex-wrap: wrap;
+    gap: 0.6rem;
+    margin-top: 1.6rem;
+  }
+
+  .chip {
+    display: inline-flex;
+    align-items: center;
+    gap: 0.4rem;
+    font-family: "IBM Plex Mono", ui-monospace, monospace;
+    font-size: 0.72rem;
+    letter-spacing: 0.04em;
+    padding: 0.28rem 0.6rem;
+    border-radius: 3px;
+  }
+
+  .chip.have { background: var(--good-soft); color: var(--good); }
+  .chip.partial { background: var(--warn-soft); color: var(--warn); }
+  .chip.missing { background: var(--miss-soft); color: var(--miss); }
+
+  section.category {
+    margin-top: 3rem;
+  }
+
+  .cat-head {
+    display: flex;
+    align-items: baseline;
+    gap: 0.85rem;
+    border-bottom: 1px solid var(--hairline);
+    padding-bottom: 0.7rem;
+    margin-bottom: 1.1rem;
+  }
+
+  .cat-num {
+    font-family: "Fraunces", Georgia, serif;
+    font-size: 1.05rem;
+    color: var(--accent);
+    font-variant-numeric: tabular-nums;
+    min-width: 1.6rem;
+  }
+
+  .cat-head h2 {
+    font-family: "Fraunces", Georgia, serif;
+    font-weight: 500;
+    font-size: 1.28rem;
+    margin: 0;
+    letter-spacing: -0.005em;
+  }
+
+  .cat-note {
+    color: var(--muted);
+    font-size: 0.86rem;
+    margin: 0 0 1.2rem;
+    max-width: 62ch;
+  }
+
+  .feature {
+    display: grid;
+    grid-template-columns: 1fr auto;
+    gap: 0.3rem 1rem;
+    padding: 1.05rem 0;
+    border-bottom: 1px solid var(--hairline);
+    align-items: start;
+  }
+
+  .feature:last-child { border-bottom: none; }
+
+  .f-name {
+    font-weight: 600;
+    font-size: 0.98rem;
+  }
+
+  .f-status {
+    font-family: "IBM Plex Mono", ui-monospace, monospace;
+    font-size: 0.68rem;
+    letter-spacing: 0.06em;
+    text-transform: uppercase;
+    padding: 0.22rem 0.55rem;
+    border-radius: 3px;
+    white-space: nowrap;
+    height: fit-content;
+  }
+
+  .f-status.have { background: var(--good-soft); color: var(--good); }
+  .f-status.partial { background: var(--warn-soft); color: var(--warn); }
+  .f-status.missing { background: var(--miss-soft); color: var(--miss); }
+
+  .f-note {
+    grid-column: 1 / -1;
+    color: var(--muted);
+    font-size: 0.87rem;
+    margin-top: 0.15rem;
+    max-width: 66ch;
+  }
+
+  .f-note code {
+    font-family: "IBM Plex Mono", ui-monospace, monospace;
+    font-size: 0.82em;
+    background: var(--accent-soft);
+    color: var(--accent);
+    padding: 0.08em 0.35em;
+    border-radius: 3px;
+  }
+
+  footer.page {
+    margin-top: 4rem;
+    padding-top: 1.5rem;
+    border-top: 1px solid var(--hairline);
+    color: var(--muted);
+    font-size: 0.82rem;
+    display: flex;
+    justify-content: space-between;
+    gap: 1rem;
+    flex-wrap: wrap;
+  }
+
+  footer.page a { color: var(--accent); }
+
+  @media (max-width: 560px) {
+    body { padding: 3rem 1.1rem 4rem; }
+    .feature { grid-template-columns: 1fr; }
+    .f-status { justify-self: start; }
+  }
+</style>
+<link rel="stylesheet" href="https://fonts.googleapis.com/css2?family=Fraunces:opsz,wght@9..144,400..600&family=IBM+Plex+Sans:wght@400;500;600&family=IBM+Plex+Mono:wght@400;500&display=swap">
+
+<div class="wrap">
+
+  <header class="page">
+    <div class="eyebrow">boboko / analytics · competitive survey</div>
+    <h1>What analytics elsewhere can do that boboko can't yet</h1>
+    <p class="dek">
+      A feature-by-feature pass across Shopify, WooCommerce Analytics, and PrestaShop's
+      stats modules — sourced, not recalled from memory — checked against what
+      <strong>Lunar's admin <code>Dashboard</code></strong> actually ships today and what
+      raw data already sits in <code>lunar_orders</code>/<code>lunar_carts</code> unused.
+      This is genuinely new territory for boboko — most rows below land on partial or
+      missing, and that's an honest read, not an undersell.
+    </p>
+    <div class="legend">
+      <span class="chip have">● have</span>
+      <span class="chip partial">◐ partial</span>
+      <span class="chip missing">○ missing</span>
+    </div>
+  </header>
+
+  <section class="category">
+    <div class="cat-head">
+      <span class="cat-num">01</span>
+      <h2>Sales &amp; revenue dashboard</h2>
+    </div>
+    <p class="cat-note">What loads the moment staff open the admin panel — this is the one area where Lunar ships more than expected.</p>
+
+    <div class="feature">
+      <div class="f-name">Revenue / order-count stat cards with period-over-period trend</div>
+      <span class="f-status have">have</span>
+      <div class="f-note">Verified from source: <code>OrderStatsOverview</code> widget — today vs. yesterday, last 7 vs. prior 7, last 30 vs. prior 30 days, both order count and sub-total, with up/down trend icons. Registered by default on Lunar's <code>Dashboard</code> page, and boboko's panel (<code>3dealer/app/Providers/PanelServiceProvider.php</code>) registers the stock panel with no <code>pages()</code>/<code>Dashboard</code> override — this ships as-is.</div>
+    </div>
+
+    <div class="feature">
+      <div class="f-name">Sales-over-time chart (revenue + order count, 12-month trend)</div>
+      <span class="f-status have">have</span>
+      <div class="f-note"><code>OrdersSalesChart</code> — ApexCharts area chart, monthly buckets over the trailing year, dual y-axis (order count / sub-total). Same "no override" reasoning as above applies to every widget on this page.</div>
+    </div>
+
+    <div class="feature">
+      <div class="f-name">Average order value (AOV) trend, segmented by customer group</div>
+      <span class="f-status have">have</span>
+      <div class="f-note"><code>AverageOrderValueChart</code> — one series per <code>CustomerGroup</code> plus a synthetic guest series, monthly average of <code>sub_total</code> over the trailing year.</div>
+    </div>
+
+    <div class="feature">
+      <div class="f-name">New vs. returning customer split</div>
+      <span class="f-status have">have</span>
+      <div class="f-note"><code>NewVsReturningCustomersChart</code> reads <code>Order::new_customer</code>, a real boolean column set by <code>Lunar\Jobs\Orders\MarkAsNewCustomer</code> (true when no prior order existed for that customer at placement time) — not a cosmetic flag.</div>
+    </div>
+
+    <div class="feature">
+      <div class="f-name">Live/latest-orders feed on the dashboard</div>
+      <span class="f-status have">have</span>
+      <div class="f-note"><code>LatestOrdersTable</code> — last 10 placed orders, 60s polling, reuses <code>OrderResource</code>'s own table columns.</div>
+    </div>
+
+    <div class="feature">
+      <div class="f-name">Real-time dashboard vs. scheduled email reports</div>
+      <span class="f-status partial">partial</span>
+      <div class="f-note">The dashboard widgets above poll every 60s (near-real-time, pull-based) — there is no scheduled/emailed report anywhere in Lunar or boboko-core. Industry pattern researched: real-time suits operational checks, scheduled digest suits weekly/monthly strategic review — boboko only has the first half.</div>
+    </div>
+  </section>
+
+  <section class="category">
+    <div class="cat-head">
+      <span class="cat-num">02</span>
+      <h2>Product &amp; catalog performance</h2>
+    </div>
+    <p class="cat-note">Which products are actually selling, and what's about to run out.</p>
+
+    <div class="feature">
+      <div class="f-name">Best-sellers / top-products report</div>
+      <span class="f-status have">have</span>
+      <div class="f-note"><code>PopularProductsTable</code> — groups <code>lunar_order_lines</code> by product identifier over the trailing 12 months, ranked by quantity sold, with revenue (<code>sub_total</code>) alongside. Physical products only (<code>whereType('physical')</code>).</div>
+    </div>
+
+    <div class="feature">
+      <div class="f-name">Per-product detail stats (views, conversion, revenue for one SKU)</div>
+      <span class="f-status missing">missing</span>
+      <div class="f-note">PrestaShop's <code>statsproduct</code> module was researched as the comparison point (per-product page-view + sales detail) — boboko has no page-view capture at all (see 04), so even the sales half of this can't be built without the traffic half.</div>
+    </div>
+
+    <div class="feature">
+      <div class="f-name">Catalog-wide statistics (active/inactive counts, category breakdown)</div>
+      <span class="f-status missing">missing</span>
+      <div class="f-note">PrestaShop's <code>statscatalog</code> module researched as the reference. No equivalent surface in Lunar or boboko-core — would be a straightforward aggregate over <code>lunar_products</code>/<code>lunar_collections</code>, just not built.</div>
+    </div>
+
+    <div class="feature">
+      <div class="f-name">Inventory / stock-turnover report</div>
+      <span class="f-status missing">missing</span>
+      <div class="f-note"><code>ProductVariant::$stock</code> is a plain point-in-time integer column — no stock-movement ledger or history table exists in <code>lunarphp/core</code> (grepped the models and migrations directories). Turnover reporting needs a time series of stock levels or receipts/sales deltas; today's schema only has "current stock," so there's nothing to compute turnover from yet, not just a missing report.</div>
+    </div>
+
+    <div class="feature">
+      <div class="f-name">Low-stock / reorder alerting surfaced in a report</div>
+      <span class="f-status missing">missing</span>
+      <div class="f-note">The Cart survey already noted <code>ProductIndexer</code>'s <code>in_stock</code> field exists for search/listing purposes — nothing aggregates it into a "low stock" admin view or report.</div>
+    </div>
+  </section>
+
+  <section class="category">
+    <div class="cat-head">
+      <span class="cat-num">03</span>
+      <h2>Customer analytics</h2>
+    </div>
+    <p class="cat-note">Value and behavior at the level of one shopper, or a group of them.</p>
+
+    <div class="feature">
+      <div class="f-name">Per-customer order count / average spend / lifetime spend</div>
+      <span class="f-status have">have</span>
+      <div class="f-note">Verified from source: <code>CustomerStatsOverviewWidget</code> on the customer view page — total orders, average spend, and total spend, computed live from <code>orders()->sum()/average()</code>. This is per-customer lookup, not an aggregate report across all customers.</div>
+    </div>
+
+    <div class="feature">
+      <div class="f-name">Customer Lifetime Value (CLV) as a store-wide metric/segment</div>
+      <span class="f-status partial">partial</span>
+      <div class="f-note">The per-customer total-spend figure above is the raw ingredient, but there's no store-wide CLV report, no ranking of customers by CLV, and no predictive/forward-looking CLV — WooCommerce Analytics' Customer Analytics extension (researched) computes this plus churn and RFM segments, none of which exist here.</div>
+    </div>
+
+    <div class="feature">
+      <div class="f-name">Cohort retention analysis</div>
+      <span class="f-status missing">missing</span>
+      <div class="f-note">Researched as a WooCommerce/Metorik feature (retention rate by signup-month cohort). No cohort concept, table, or query exists anywhere in Lunar or boboko-core.</div>
+    </div>
+  </section>
+
+  <section class="category">
+    <div class="cat-head">
+      <span class="cat-num">04</span>
+      <h2>Behavioral &amp; funnel tracking</h2>
+    </div>
+    <p class="cat-note">What happens before an order exists — the storefront side neither repo instruments at all.</p>
+
+    <div class="feature">
+      <div class="f-name">Page-view / product-view event capture</div>
+      <span class="f-status missing">missing</span>
+      <div class="f-note">Grepped both repos for <code>gtag</code>/<code>dataLayer</code>/GA4/any client-side event tracker — zero hits. No storefront event of any kind is dispatched, captured, or stored anywhere.</div>
+    </div>
+
+    <div class="feature">
+      <div class="f-name">Conversion funnel (view → add to cart → checkout → purchase)</div>
+      <span class="f-status missing">missing</span>
+      <div class="f-note">Shopify's funnel report (researched) needs a session-scoped event stream across all four stages. boboko has only the last stage as durable data (a placed <code>Order</code>) — no view or add-to-cart events exist to build the earlier steps from, consistent with the Cart survey's finding that Lunar dispatches zero cart events.</div>
+    </div>
+
+    <div class="feature">
+      <div class="f-name">Abandoned-cart aggregate value/rate reporting</div>
+      <span class="f-status partial">partial</span>
+      <div class="f-note">Distinct from the Cart survey's per-cart admin lookup (<code>CartResource</code>, already shipped) — this is a rolled-up metric: total abandoned value this week, abandonment rate as a percentage of carts started. The underlying rows exist in <code>lunar_carts</code>/<code>lunar_cart_lines</code> (same query <code>CartResource</code>'s Abandoned tab already runs), but nothing aggregates them into a rate or a trend — it's list-only today.</div>
+    </div>
+
+    <div class="feature">
+      <div class="f-name">Traffic-source / campaign attribution (UTM-based)</div>
+      <span class="f-status missing">missing</span>
+      <div class="f-note">No UTM capture, no marketing/session table anywhere in either repo. Researched as the backbone of Shopify's/GA4's acquisition reporting — would need a session table capturing <code>utm_source</code>/<code>medium</code>/<code>campaign</code> at first touch, tied forward to the eventual order.</div>
+    </div>
+  </section>
+
+  <section class="category">
+    <div class="cat-head">
+      <span class="cat-num">05</span>
+      <h2>Tax, accounting &amp; export</h2>
+    </div>
+    <p class="cat-note">Getting numbers out of boboko and into someone else's books.</p>
+
+    <div class="feature">
+      <div class="f-name">Tax / VAT breakdown captured per order</div>
+      <span class="f-status have">have</span>
+      <div class="f-note">Verified from source: <code>lunar_orders</code> migration stores both <code>tax_breakdown</code> (JSON, per-rate detail) and <code>tax_total</code> as real columns on every placed order — this is genuine underlying data, not inferred.</div>
+    </div>
+
+    <div class="feature">
+      <div class="f-name">Tax / VAT report for accounting (e.g. by tax zone, by period)</div>
+      <span class="f-status partial">partial</span>
+      <div class="f-note">The per-order data above is complete enough to build this from, but nothing aggregates <code>tax_breakdown</code>/<code>tax_total</code> across orders into a filing-ready report by <code>TaxZone</code> or period — no such widget, page, or query exists in Lunar or boboko-core.</div>
+    </div>
+
+    <div class="feature">
+      <div class="f-name">CSV / accounting-software export of orders or sales data</div>
+      <span class="f-status missing">missing</span>
+      <div class="f-note">Grepped for <code>Exporter</code>/<code>ExportAction</code>/<code>Excel::</code> across <code>lunarphp/lunar</code> and boboko-core's <code>src</code> — no hits. Filament ships export actions as a first-party feature elsewhere in the ecosystem; nothing here wires one up for orders.</div>
+    </div>
+
+    <div class="feature">
+      <div class="f-name">Sales by channel</div>
+      <span class="f-status partial">partial</span>
+      <div class="f-note"><code>Order::channel_id</code> is a real, always-populated foreign key (verified in the <code>lunar_orders</code> migration) — every order already knows its channel. No report groups by it; the dashboard's charts are all channel-blind.</div>
+    </div>
+  </section>
+
+  <section class="category">
+    <div class="cat-head">
+      <span class="cat-num">06</span>
+      <h2>Audit trail vs. analytics</h2>
+    </div>
+    <p class="cat-note">A distinction worth being explicit about, since it's easy to mistake one for the other.</p>
+
+    <div class="feature">
+      <div class="f-name">Activity log (Spatie activitylog) on core models</div>
+      <span class="f-status have">have</span>
+      <div class="f-note">Verified from source and <code>docs/lunar.md</code>'s Activity Logging section: <code>Lunar\Base\Traits\LogsActivity</code> covers Order, Cart, Product, Customer, and 15 other models, recording only dirty attributes per change under the <code>lunar</code> log name.</div>
+    </div>
+
+    <div class="feature">
+      <div class="f-name">This counts as analytics</div>
+      <span class="f-status missing">missing</span>
+      <div class="f-note">It doesn't, and isn't listed as "have" anywhere above for that reason — activity log is a per-record change history for compliance/support ("who edited this order's shipping address"), not aggregate reporting ("how much revenue this month"). No row in this survey is satisfied by activity-log data.</div>
+    </div>
+  </section>
+
+  <footer class="page">
+    <span>Compiled 2026-08-28 — sources cited inline: <code>docs/lunar.md</code> §Filament Panel Integration and §Activity Logging plus direct reads of <code>vendor/lunarphp/lunar/src/Filament/Widgets/Dashboard</code>, <code>vendor/lunarphp/core</code> models/migrations, and <code>3dealer/app/Providers/PanelServiceProvider.php</code> are repo-verified; Shopify/WooCommerce/PrestaShop feature claims are from web research, not repo reads.</span>
+    <span>boboko-core / docs</span>
+  </footer>
+
+</div>
diff --git a/docs/scratch/checkout-feature-survey.html b/docs/scratch/checkout-feature-survey.html
new file mode 100644
index 0000000..f543775
--- /dev/null
+++ b/docs/scratch/checkout-feature-survey.html
@@ -0,0 +1,429 @@
+<title>Checkout Feature Survey</title>
+<style>
+  :root {
+    --paper: #FAFAF7;
+    --ink: #1C1C1A;
+    --muted: #6B6B63;
+    --accent: #2F5D50;
+    --accent-soft: #E4EDE9;
+    --good: #3F7A5C;
+    --good-soft: #E6F0EA;
+    --warn: #B8863B;
+    --warn-soft: #F5ECDC;
+    --miss: #A14B3B;
+    --miss-soft: #F5E5E0;
+    --hairline: #E4E2DB;
+    --card: #FFFFFF;
+  }
+
+  :root:not([data-theme="light"]) {
+    @media (prefers-color-scheme: dark) {
+      --paper: #17181A;
+      --ink: #EDEBE4;
+      --muted: #9B9A90;
+      --accent: #7FBFA8;
+      --accent-soft: #1E2C27;
+      --good: #6FBF97;
+      --good-soft: #1B2A22;
+      --warn: #D9A85C;
+      --warn-soft: #2C2418;
+      --miss: #D97C68;
+      --miss-soft: #2E1E1A;
+      --hairline: #2C2D2E;
+      --card: #1E1F21;
+    }
+  }
+
+  :root[data-theme="dark"] {
+    --paper: #17181A;
+    --ink: #EDEBE4;
+    --muted: #9B9A90;
+    --accent: #7FBFA8;
+    --accent-soft: #1E2C27;
+    --good: #6FBF97;
+    --good-soft: #1B2A22;
+    --warn: #D9A85C;
+    --warn-soft: #2C2418;
+    --miss: #D97C68;
+    --miss-soft: #2E1E1A;
+    --hairline: #2C2D2E;
+    --card: #1E1F21;
+  }
+
+  * { box-sizing: border-box; }
+
+  body {
+    background: var(--paper);
+    color: var(--ink);
+    font-family: "IBM Plex Sans", ui-sans-serif, system-ui, sans-serif;
+    font-size: 15.5px;
+    line-height: 1.55;
+    margin: 0;
+    padding: 4.5rem 1.5rem 6rem;
+  }
+
+  .wrap {
+    max-width: 780px;
+    margin: 0 auto;
+  }
+
+  header.page {
+    margin-bottom: 3.25rem;
+  }
+
+  .eyebrow {
+    font-family: "IBM Plex Mono", ui-monospace, monospace;
+    font-size: 0.72rem;
+    letter-spacing: 0.12em;
+    text-transform: uppercase;
+    color: var(--accent);
+    margin-bottom: 0.9rem;
+  }
+
+  h1 {
+    font-family: "Fraunces", Georgia, serif;
+    font-weight: 560;
+    font-size: clamp(2.1rem, 4.5vw, 2.65rem);
+    line-height: 1.08;
+    letter-spacing: -0.01em;
+    margin: 0 0 0.9rem;
+    text-wrap: balance;
+  }
+
+  .dek {
+    color: var(--muted);
+    max-width: 60ch;
+    font-size: 1.02rem;
+  }
+
+  .dek strong {
+    color: var(--ink);
+    font-weight: 600;
+  }
+
+  .legend {
+    display: flex;
+    flex-wrap: wrap;
+    gap: 0.6rem;
+    margin-top: 1.6rem;
+  }
+
+  .chip {
+    display: inline-flex;
+    align-items: center;
+    gap: 0.4rem;
+    font-family: "IBM Plex Mono", ui-monospace, monospace;
+    font-size: 0.72rem;
+    letter-spacing: 0.04em;
+    padding: 0.28rem 0.6rem;
+    border-radius: 3px;
+  }
+
+  .chip.have { background: var(--good-soft); color: var(--good); }
+  .chip.partial { background: var(--warn-soft); color: var(--warn); }
+  .chip.missing { background: var(--miss-soft); color: var(--miss); }
+
+  section.category {
+    margin-top: 3rem;
+  }
+
+  .cat-head {
+    display: flex;
+    align-items: baseline;
+    gap: 0.85rem;
+    border-bottom: 1px solid var(--hairline);
+    padding-bottom: 0.7rem;
+    margin-bottom: 1.1rem;
+  }
+
+  .cat-num {
+    font-family: "Fraunces", Georgia, serif;
+    font-size: 1.05rem;
+    color: var(--accent);
+    font-variant-numeric: tabular-nums;
+    min-width: 1.6rem;
+  }
+
+  .cat-head h2 {
+    font-family: "Fraunces", Georgia, serif;
+    font-weight: 500;
+    font-size: 1.28rem;
+    margin: 0;
+    letter-spacing: -0.005em;
+  }
+
+  .cat-note {
+    color: var(--muted);
+    font-size: 0.86rem;
+    margin: 0 0 1.2rem;
+    max-width: 62ch;
+  }
+
+  .feature {
+    display: grid;
+    grid-template-columns: 1fr auto;
+    gap: 0.3rem 1rem;
+    padding: 1.05rem 0;
+    border-bottom: 1px solid var(--hairline);
+    align-items: start;
+  }
+
+  .feature:last-child { border-bottom: none; }
+
+  .f-name {
+    font-weight: 600;
+    font-size: 0.98rem;
+  }
+
+  .f-status {
+    font-family: "IBM Plex Mono", ui-monospace, monospace;
+    font-size: 0.68rem;
+    letter-spacing: 0.06em;
+    text-transform: uppercase;
+    padding: 0.22rem 0.55rem;
+    border-radius: 3px;
+    white-space: nowrap;
+    height: fit-content;
+  }
+
+  .f-status.have { background: var(--good-soft); color: var(--good); }
+  .f-status.partial { background: var(--warn-soft); color: var(--warn); }
+  .f-status.missing { background: var(--miss-soft); color: var(--miss); }
+
+  .f-note {
+    grid-column: 1 / -1;
+    color: var(--muted);
+    font-size: 0.87rem;
+    margin-top: 0.15rem;
+    max-width: 66ch;
+  }
+
+  .f-note code {
+    font-family: "IBM Plex Mono", ui-monospace, monospace;
+    font-size: 0.82em;
+    background: var(--accent-soft);
+    color: var(--accent);
+    padding: 0.08em 0.35em;
+    border-radius: 3px;
+  }
+
+  footer.page {
+    margin-top: 4rem;
+    padding-top: 1.5rem;
+    border-top: 1px solid var(--hairline);
+    color: var(--muted);
+    font-size: 0.82rem;
+    display: flex;
+    justify-content: space-between;
+    gap: 1rem;
+    flex-wrap: wrap;
+  }
+
+  footer.page a { color: var(--accent); }
+
+  @media (max-width: 560px) {
+    body { padding: 3rem 1.1rem 4rem; }
+    .feature { grid-template-columns: 1fr; }
+    .f-status { justify-self: start; }
+  }
+</style>
+<link rel="stylesheet" href="https://fonts.googleapis.com/css2?family=Fraunces:opsz,wght@9..144,400..600&family=IBM+Plex+Sans:wght@400;500;600&family=IBM+Plex+Mono:wght@400;500&display=swap">
+
+<div class="wrap">
+
+  <header class="page">
+    <div class="eyebrow">boboko / checkout · competitive survey</div>
+    <h1>What checkout elsewhere can do that boboko can't yet</h1>
+    <p class="dek">
+      A feature-by-feature pass across Shopify, WooCommerce, and PrestaShop's checkout
+      layer — sourced, not recalled from memory — checked against what
+      <strong>Lunar's <code>Cart::createOrder()</code> / order-creation pipeline</strong>
+      actually supports today. Companion to the Cart survey: this starts where that one
+      left off — address and shipping-option capture through to a placed order. For
+      deciding what to design next, not a build order.
+    </p>
+    <div class="legend">
+      <span class="chip have">● have</span>
+      <span class="chip partial">◐ partial</span>
+      <span class="chip missing">○ missing</span>
+    </div>
+  </header>
+
+  <section class="category">
+    <div class="cat-head">
+      <span class="cat-num">01</span>
+      <h2>Getting to checkout</h2>
+    </div>
+    <p class="cat-note">Who's allowed to check out, and in how many steps.</p>
+
+    <div class="feature">
+      <div class="f-name">Guest checkout (no account required)</div>
+      <span class="f-status have">have</span>
+      <div class="f-note">Structural, not bolted-on: <code>Order.user_id</code> and <code>customer_id</code> are both nullable, and <code>ValidateCartForOrderCreation</code> never checks for either — it only requires a billing address and, if shippable, a shipping address + option. A cart with no <code>user_id</code> creates an order fine.</div>
+    </div>
+
+    <div class="feature">
+      <div class="f-name">One-page vs. multi-step checkout</div>
+      <span class="f-status missing">missing</span>
+      <div class="f-note">Pure storefront-UI concern — Lunar has no opinion here, it just exposes <code>setShippingAddress()</code>/<code>setBillingAddress()</code>/<code>setShippingOption()</code> as independent calls that a UI can sequence however it likes. WooCommerce and PrestaShop both ship one-page as a plugin/theme layer, not core, so this isn't a Lunar gap so much as storefront work still to do.</div>
+    </div>
+
+    <div class="feature">
+      <div class="f-name">Address autocomplete (type-ahead, from Google Places / Loqate)</div>
+      <span class="f-status missing">missing</span>
+      <div class="f-note">Research: cuts address-entry keystrokes by 70%+ and is a proven abandonment-reduction tactic (Google Maps Platform, Loqate). No Lunar hook for it either way — it's a storefront form concern layered on top of the same <code>setShippingAddress()</code> call.</div>
+    </div>
+
+    <div class="feature">
+      <div class="f-name">Express/accelerated checkout (Shop Pay, Apple Pay, Google Pay equivalents)</div>
+      <span class="f-status missing">missing</span>
+      <div class="f-note">Research: Shopify reports Shop Pay can lift conversion up to 50% over guest checkout, mobile especially. Lunar's <code>Payments</code> facade is driver-based (<code>Payments::driver('card')</code>) so a wallet driver is architecturally pluggable, but none ships, and there's no one-tap "skip the address form" path since address capture still runs through the standard cart-address flow first.</div>
+    </div>
+
+    <div class="feature">
+      <div class="f-name">Terms &amp; conditions acceptance at checkout</div>
+      <span class="f-status partial">partial</span>
+      <div class="f-note"><code>Order.meta</code> and <code>Cart.meta</code> are both free-form JSON columns carried straight through <code>FillOrderFromCart</code> (<code>'meta' => $cart->meta</code>) — technically able to record a timestamp/version of accepted terms today, but no dedicated field, checkbox validation, or admin display exists.</div>
+    </div>
+  </section>
+
+  <section class="category">
+    <div class="cat-head">
+      <span class="cat-num">02</span>
+      <h2>Order creation mechanics</h2>
+    </div>
+    <p class="cat-note">What actually happens inside <code>createOrder()</code>, verified from source.</p>
+
+    <div class="feature">
+      <div class="f-name">Duplicate-order prevention on repeat submits</div>
+      <span class="f-status have">have</span>
+      <div class="f-note">Two layers, both real: <code>Cart::draftOrder()</code> matches on <code>fingerprint()</code> + <code>total</code>, so re-running <code>createOrder()</code> on an unchanged cart reuses the same draft order instead of duplicating it (<code>CreateOrder::execute()</code>); once an order is placed, <code>hasCompletedOrders()</code> throws <code>DisallowMultipleCartOrdersException</code> unless <code>allowMultipleOrders</code> is explicitly passed.</div>
+    </div>
+
+    <div class="feature">
+      <div class="f-name">Draft order created before payment, finalized after</div>
+      <span class="f-status have">have</span>
+      <div class="f-note"><code>Order::isDraft()</code>/<code>isPlaced()</code> gate on <code>placed_at</code>; <code>orders.draft_status</code> config (default <code>awaiting-payment</code>) sets the initial status. The order exists — and can be re-run through the pipeline idempotently via the fingerprint match above — before a payment driver ever authorizes anything.</div>
+    </div>
+
+    <div class="feature">
+      <div class="f-name">Order address, line, and shipping-line snapshotting from cart</div>
+      <span class="f-status have">have</span>
+      <div class="f-note">The whole <code>orders.pipelines.creation</code> chain does this explicitly — <code>FillOrderFromCart</code>, <code>CreateOrderLines</code>, <code>CreateOrderAddresses</code>, <code>CreateShippingLine</code>, <code>CleanUpOrderLines</code>, <code>MapDiscountBreakdown</code> — each copying cart state into immutable order rows rather than referencing the cart live.</div>
+    </div>
+
+    <div class="feature">
+      <div class="f-name">Address validation before order creation</div>
+      <span class="f-status have">have</span>
+      <div class="f-note"><code>ValidateCartForOrderCreation</code> requires <code>country_id</code>, <code>first_name</code>, <code>line_one</code>, <code>city</code>, <code>postcode</code> on billing always, and on shipping too unless the chosen <code>ShippingOption-&gt;collect</code> is true (in-store pickup skips a shipping address).</div>
+    </div>
+
+    <div class="feature">
+      <div class="f-name">Exchange rate and currency locked at order time</div>
+      <span class="f-status have">have</span>
+      <div class="f-note"><code>FillOrderFromCart</code> copies <code>currency_code</code> and <code>exchange_rate</code> from the cart's currency onto the order at creation — later currency-config changes don't retroactively alter placed orders.</div>
+    </div>
+  </section>
+
+  <section class="category">
+    <div class="cat-head">
+      <span class="cat-num">03</span>
+      <h2>Confirmation &amp; communication</h2>
+    </div>
+    <p class="cat-note">What tells the customer (and staff) an order happened.</p>
+
+    <div class="feature">
+      <div class="f-name">Order confirmation email on placement</div>
+      <span class="f-status missing">missing</span>
+      <div class="f-note">Surprising given how close it looks to shipping: every status in <code>config/lunar/orders.php</code> carries a <code>mailers</code> and <code>notifications</code> array, but grep across core turns up exactly one reader of that config (<code>Order::getStatusLabelAttribute()</code>, and it only reads <code>label</code>). Nothing in core ever dispatches a mailer or notification from a status change — those keys are unwired placeholders, not a working feature.</div>
+    </div>
+
+    <div class="feature">
+      <div class="f-name">Order-status-changed events</div>
+      <span class="f-status missing">missing</span>
+      <div class="f-note">Same gap as Cart's event survey found — <code>src/Events/</code> in core contains only <code>PaymentAttemptEvent</code>. No <code>OrderCreated</code>, no <code>OrderStatusUpdated</code>. Confirmation email, staff Slack ping, or customer SMS on status change all have to be built from scratch on plain Eloquent model events (<code>Order::updated()</code>), same pattern as the cart-event gap.</div>
+    </div>
+
+    <div class="feature">
+      <div class="f-name">Order tracking / status lookup for guests</div>
+      <span class="f-status missing">missing</span>
+      <div class="f-note">Research: PrestaShop's order-tracking extensions explicitly cover "non-logged-in customers track their orders." Lunar has the data (<code>Order.reference</code>, <code>status</code>, <code>OrderAddress.contact_email</code>) but no lookup mechanism — a guest with no account has no route back to their order without the confirmation email that also doesn't exist yet.</div>
+    </div>
+
+    <div class="feature">
+      <div class="f-name">New-customer detection on first order</div>
+      <span class="f-status have">have</span>
+      <div class="f-note"><code>CreateOrder::execute()</code> dispatches <code>MarkAsNewCustomer::dispatch($order->id)</code> as a queued job after every order creation — genuinely wired, unlike the mail/notification config above.</div>
+    </div>
+  </section>
+
+  <section class="category">
+    <div class="cat-head">
+      <span class="cat-num">04</span>
+      <h2>Abandoned checkout recovery</h2>
+    </div>
+    <p class="cat-note">Distinct from abandoned <em>cart</em> recovery (covered in the Cart survey) — this is someone who reached address/email capture and still left.</p>
+
+    <div class="feature">
+      <div class="f-name">Draft orders are queryable and staff-visible</div>
+      <span class="f-status partial">partial</span>
+      <div class="f-note">The data exists — <code>Order::isDraft()</code> plus the address already captured on it — but per the Cart survey's finding, there's no Filament resource for <code>Cart</code> and (unverified here, likely the same gap) no dedicated "abandoned checkout" view distinguishing a draft order with a captured address from one that never got that far.</div>
+    </div>
+
+    <div class="feature">
+      <div class="f-name">Automated recovery email (post-address-capture)</div>
+      <span class="f-status missing">missing</span>
+      <div class="f-note">Research: Shopify's built-in template fires after a shopper enters details and leaves, with editable wait time and an optional discount. boboko has strictly better raw material for this than the cart-abandonment case — a draft order after address capture always has <code>OrderAddress.contact_email</code>, where an abandoned guest cart usually has none — but nothing sends on it.</div>
+    </div>
+
+    <div class="feature">
+      <div class="f-name">Abandoned-checkout stage tracking (email captured vs. shipping selected vs. payment started)</div>
+      <span class="f-status missing">missing</span>
+      <div class="f-note">No event dispatch anywhere in the checkout pipeline (see 03) means no timestamped record of which step a checkout got to — only the current state of the draft order, not its history.</div>
+    </div>
+  </section>
+
+  <section class="category">
+    <div class="cat-head">
+      <span class="cat-num">05</span>
+      <h2>Pricing, tax &amp; locale at checkout</h2>
+    </div>
+    <p class="cat-note">What the customer sees the moment money is on screen.</p>
+
+    <div class="feature">
+      <div class="f-name">Tax-inclusive vs. tax-exclusive price display</div>
+      <span class="f-status have">have</span>
+      <div class="f-note"><code>TaxZone.price_display</code> is a first-class enum (<code>tax_inclusive</code>/<code>tax_exclusive</code>), and <code>Price::priceExTax()</code>/<code>priceIncTax()</code> both exist on the model — more complete than PrestaShop, where dual-price display is a separately-sold addon module, not core.</div>
+    </div>
+
+    <div class="feature">
+      <div class="f-name">Full tax breakdown shown at checkout (per-line, per-rate)</div>
+      <span class="f-status have">have</span>
+      <div class="f-note"><code>Cart.taxBreakdown</code> and <code>OrderLine.tax_breakdown</code> are both populated structured objects (iterate <code>.amounts</code>), not just a lump-sum total — the data supports a itemized tax display, a storefront just has to render it.</div>
+    </div>
+
+    <div class="feature">
+      <div class="f-name">Multi-currency checkout (pay in shopper's own currency)</div>
+      <span class="f-status have">have</span>
+      <div class="f-note"><code>Currency.exchange_rate</code> plus <code>sync_prices</code> per non-default currency, and the rate is snapshotted onto the order at creation (see 02) — the same mechanics PrestaShop needs an addon for.</div>
+    </div>
+
+    <div class="feature">
+      <div class="f-name">Multi-language checkout copy</div>
+      <span class="f-status partial">partial</span>
+      <div class="f-note">Product/collection/attribute copy is fully translatable via <code>attribute_data</code> + <code>Language</code>, but checkout itself — form labels, validation errors, status labels — is storefront-owned Laravel localization, not something Lunar's order pipeline touches either way.</div>
+    </div>
+
+    <div class="feature">
+      <div class="f-name">Click-and-collect / in-store pickup as a checkout option</div>
+      <span class="f-status have">have</span>
+      <div class="f-note"><code>ShippingOption.collect</code> is a real boolean the validator checks directly — when true, <code>ValidateCartForOrderCreation</code> skips the shipping-address requirement entirely. Modeled at the same level as the <code>collection</code> driver in the Table Rate Shipping add-on.</div>
+    </div>
+  </section>
+
+  <footer class="page">
+    <span>Compiled 2026-08-28 — sources cited inline; <code>vendor/lunarphp/core/src</code> reads are marked by file/class name, Shopify/WooCommerce/PrestaShop claims are marked "Research."</span>
+    <span>boboko-core / docs</span>
+  </footer>
+
+</div>
diff --git a/docs/scratch/customer-accounts-feature-survey.html b/docs/scratch/customer-accounts-feature-survey.html
new file mode 100644
index 0000000..32a9097
--- /dev/null
+++ b/docs/scratch/customer-accounts-feature-survey.html
@@ -0,0 +1,476 @@
+<title>Customer Accounts Feature Survey</title>
+<style>
+  :root {
+    --paper: #FAFAF7;
+    --ink: #1C1C1A;
+    --muted: #6B6B63;
+    --accent: #2F5D50;
+    --accent-soft: #E4EDE9;
+    --good: #3F7A5C;
+    --good-soft: #E6F0EA;
+    --warn: #B8863B;
+    --warn-soft: #F5ECDC;
+    --miss: #A14B3B;
+    --miss-soft: #F5E5E0;
+    --hairline: #E4E2DB;
+    --card: #FFFFFF;
+  }
+
+  :root:not([data-theme="light"]) {
+    @media (prefers-color-scheme: dark) {
+      --paper: #17181A;
+      --ink: #EDEBE4;
+      --muted: #9B9A90;
+      --accent: #7FBFA8;
+      --accent-soft: #1E2C27;
+      --good: #6FBF97;
+      --good-soft: #1B2A22;
+      --warn: #D9A85C;
+      --warn-soft: #2C2418;
+      --miss: #D97C68;
+      --miss-soft: #2E1E1A;
+      --hairline: #2C2D2E;
+      --card: #1E1F21;
+    }
+  }
+
+  :root[data-theme="dark"] {
+    --paper: #17181A;
+    --ink: #EDEBE4;
+    --muted: #9B9A90;
+    --accent: #7FBFA8;
+    --accent-soft: #1E2C27;
+    --good: #6FBF97;
+    --good-soft: #1B2A22;
+    --warn: #D9A85C;
+    --warn-soft: #2C2418;
+    --miss: #D97C68;
+    --miss-soft: #2E1E1A;
+    --hairline: #2C2D2E;
+    --card: #1E1F21;
+  }
+
+  * { box-sizing: border-box; }
+
+  body {
+    background: var(--paper);
+    color: var(--ink);
+    font-family: "IBM Plex Sans", ui-sans-serif, system-ui, sans-serif;
+    font-size: 15.5px;
+    line-height: 1.55;
+    margin: 0;
+    padding: 4.5rem 1.5rem 6rem;
+  }
+
+  .wrap {
+    max-width: 780px;
+    margin: 0 auto;
+  }
+
+  header.page {
+    margin-bottom: 3.25rem;
+  }
+
+  .eyebrow {
+    font-family: "IBM Plex Mono", ui-monospace, monospace;
+    font-size: 0.72rem;
+    letter-spacing: 0.12em;
+    text-transform: uppercase;
+    color: var(--accent);
+    margin-bottom: 0.9rem;
+  }
+
+  h1 {
+    font-family: "Fraunces", Georgia, serif;
+    font-weight: 560;
+    font-size: clamp(2.1rem, 4.5vw, 2.65rem);
+    line-height: 1.08;
+    letter-spacing: -0.01em;
+    margin: 0 0 0.9rem;
+    text-wrap: balance;
+  }
+
+  .dek {
+    color: var(--muted);
+    max-width: 60ch;
+    font-size: 1.02rem;
+  }
+
+  .dek strong {
+    color: var(--ink);
+    font-weight: 600;
+  }
+
+  .legend {
+    display: flex;
+    flex-wrap: wrap;
+    gap: 0.6rem;
+    margin-top: 1.6rem;
+  }
+
+  .chip {
+    display: inline-flex;
+    align-items: center;
+    gap: 0.4rem;
+    font-family: "IBM Plex Mono", ui-monospace, monospace;
+    font-size: 0.72rem;
+    letter-spacing: 0.04em;
+    padding: 0.28rem 0.6rem;
+    border-radius: 3px;
+  }
+
+  .chip.have { background: var(--good-soft); color: var(--good); }
+  .chip.partial { background: var(--warn-soft); color: var(--warn); }
+  .chip.missing { background: var(--miss-soft); color: var(--miss); }
+
+  section.category {
+    margin-top: 3rem;
+  }
+
+  .cat-head {
+    display: flex;
+    align-items: baseline;
+    gap: 0.85rem;
+    border-bottom: 1px solid var(--hairline);
+    padding-bottom: 0.7rem;
+    margin-bottom: 1.1rem;
+  }
+
+  .cat-num {
+    font-family: "Fraunces", Georgia, serif;
+    font-size: 1.05rem;
+    color: var(--accent);
+    font-variant-numeric: tabular-nums;
+    min-width: 1.6rem;
+  }
+
+  .cat-head h2 {
+    font-family: "Fraunces", Georgia, serif;
+    font-weight: 500;
+    font-size: 1.28rem;
+    margin: 0;
+    letter-spacing: -0.005em;
+  }
+
+  .cat-note {
+    color: var(--muted);
+    font-size: 0.86rem;
+    margin: 0 0 1.2rem;
+    max-width: 62ch;
+  }
+
+  .feature {
+    display: grid;
+    grid-template-columns: 1fr auto;
+    gap: 0.3rem 1rem;
+    padding: 1.05rem 0;
+    border-bottom: 1px solid var(--hairline);
+    align-items: start;
+  }
+
+  .feature:last-child { border-bottom: none; }
+
+  .f-name {
+    font-weight: 600;
+    font-size: 0.98rem;
+  }
+
+  .f-status {
+    font-family: "IBM Plex Mono", ui-monospace, monospace;
+    font-size: 0.68rem;
+    letter-spacing: 0.06em;
+    text-transform: uppercase;
+    padding: 0.22rem 0.55rem;
+    border-radius: 3px;
+    white-space: nowrap;
+    height: fit-content;
+  }
+
+  .f-status.have { background: var(--good-soft); color: var(--good); }
+  .f-status.partial { background: var(--warn-soft); color: var(--warn); }
+  .f-status.missing { background: var(--miss-soft); color: var(--miss); }
+
+  .f-note {
+    grid-column: 1 / -1;
+    color: var(--muted);
+    font-size: 0.87rem;
+    margin-top: 0.15rem;
+    max-width: 66ch;
+  }
+
+  .f-note code {
+    font-family: "IBM Plex Mono", ui-monospace, monospace;
+    font-size: 0.82em;
+    background: var(--accent-soft);
+    color: var(--accent);
+    padding: 0.08em 0.35em;
+    border-radius: 3px;
+  }
+
+  footer.page {
+    margin-top: 4rem;
+    padding-top: 1.5rem;
+    border-top: 1px solid var(--hairline);
+    color: var(--muted);
+    font-size: 0.82rem;
+    display: flex;
+    justify-content: space-between;
+    gap: 1rem;
+    flex-wrap: wrap;
+  }
+
+  footer.page a { color: var(--accent); }
+
+  @media (max-width: 560px) {
+    body { padding: 3rem 1.1rem 4rem; }
+    .feature { grid-template-columns: 1fr; }
+    .f-status { justify-self: start; }
+  }
+</style>
+<link rel="stylesheet" href="https://fonts.googleapis.com/css2?family=Fraunces:opsz,wght@9..144,400..600&family=IBM+Plex+Sans:wght@400;500;600&family=IBM+Plex+Mono:wght@400;500&display=swap">
+
+<div class="wrap">
+
+  <header class="page">
+    <div class="eyebrow">boboko / customer accounts · competitive survey</div>
+    <h1>What customer accounts elsewhere can do that boboko can't yet</h1>
+    <p class="dek">
+      A feature-by-feature pass across Shopify, WooCommerce, and PrestaShop's
+      account layer — sourced, not recalled from memory — checked against what
+      <strong>Lunar's <code>Customer</code>/<code>Address</code>/<code>CustomerGroup</code></strong>
+      models actually support today and what exists (or doesn't) in boboko-core
+      and 3dealer right now. For deciding what to design next, not a build order.
+    </p>
+    <div class="legend">
+      <span class="chip have">● have</span>
+      <span class="chip partial">◐ partial</span>
+      <span class="chip missing">○ missing</span>
+    </div>
+  </header>
+
+  <section class="category">
+    <div class="cat-head">
+      <span class="cat-num">01</span>
+      <h2>Whether an account exists at all</h2>
+    </div>
+    <p class="cat-note">The storefront-facing account experience, as distinct from staff/admin auth in <code>Modules\Core\Auth</code>.</p>
+
+    <div class="feature">
+      <div class="f-name">Customer↔User linking (data model)</div>
+      <span class="f-status have">have</span>
+      <div class="f-note">Fully modeled by Lunar core — <code>Customer::users()</code> / <code>User::customers()</code> via <code>customer_user</code> pivot (<code>LunarUser</code> trait), plus <code>User::latestCustomer()</code>.</div>
+    </div>
+
+    <div class="feature">
+      <div class="f-name">Customer record auto-created on signup</div>
+      <span class="f-status have">have</span>
+      <div class="f-note"><code>Modules\Core\Customer\Listeners\CreateCustomerForUser</code> attaches a new <code>Customer</code> to every <code>User</code> on <code>UserCreated</code>, gated by <code>config('core.auto_create_customer_for_user')</code>.</div>
+    </div>
+
+    <div class="feature">
+      <div class="f-name">Storefront login / registration UI</div>
+      <span class="f-status missing">missing</span>
+      <div class="f-note">3dealer has no auth scaffolding at all — no Breeze/Fortify/Sanctum in <code>composer.json</code>, no <code>login</code>/<code>register</code> views, nothing in <code>routes/web.php</code>. Only <code>Modules\Core\Auth</code>'s Filament staff panel login exists.</div>
+    </div>
+
+    <div class="feature">
+      <div class="f-name">Account/profile page (name, addresses, orders)</div>
+      <span class="f-status missing">missing</span>
+      <div class="f-note">No <code>AccountController</code>, no <code>account</code>/<code>profile</code> route, no matching Blade views anywhere in 3dealer's <code>app/</code> or <code>resources/views</code> — confirmed by exhaustive grep.</div>
+    </div>
+
+    <div class="feature">
+      <div class="f-name">Account nav link in header</div>
+      <span class="f-status missing">missing</span>
+      <div class="f-note"><code>resources/views/components/header.blade.php</code> has a cart icon and a search button but no account/login link at all — not even a dead one. The cart icon itself links to <code>/cart</code>, which also has no matching route, matching this codebase's known stubbed-UI pattern.</div>
+    </div>
+  </section>
+
+  <section class="category">
+    <div class="cat-head">
+      <span class="cat-num">02</span>
+      <h2>Order history &amp; tracking</h2>
+    </div>
+    <p class="cat-note">Letting a customer see and follow their own orders without contacting support.</p>
+
+    <div class="feature">
+      <div class="f-name">Order history data (per customer)</div>
+      <span class="f-status have">have</span>
+      <div class="f-note">Fully modeled — <code>Customer::orders()</code> and <code>User::orders()</code> both exist (<code>Lunar\Models\Order</code>), with <code>status</code>, line items, addresses, and transactions already relational.</div>
+    </div>
+
+    <div class="feature">
+      <div class="f-name">Self-service order history / status page</div>
+      <span class="f-status missing">missing</span>
+      <div class="f-note">No storefront route or controller reads <code>Order</code> for a logged-in customer — the data exists, nothing surfaces it. Shopify's rebuilt (2026) customer-accounts UI and PrestaShop's order-detail tracking page are both native; WooCommerce ships this in My Account by default.</div>
+    </div>
+
+    <div class="feature">
+      <div class="f-name">Shipment tracking numbers surfaced to customer</div>
+      <span class="f-status missing">missing</span>
+      <div class="f-note">No tracking-number field found on <code>Order</code>/<code>OrderLine</code>/shipping models in <code>vendor/lunarphp/core</code>; PrestaShop's tracking module patches this same gap with a third-party add-on, so it isn't a "native everywhere" bar either.</div>
+    </div>
+
+    <div class="feature">
+      <div class="f-name">Reorder / buy-again from order history</div>
+      <span class="f-status missing">missing</span>
+      <div class="f-note">Needs an order-history UI to exist first (see above) plus a "re-add these lines to cart" action — Lunar's <code>Cart::add()</code> already supports the mechanics, nothing wires an <code>Order</code> line back into a new cart.</div>
+    </div>
+  </section>
+
+  <section class="category">
+    <div class="cat-head">
+      <span class="cat-num">03</span>
+      <h2>Saved addresses</h2>
+    </div>
+    <p class="cat-note">What a returning customer doesn't have to retype.</p>
+
+    <div class="feature">
+      <div class="f-name">Multiple saved addresses per customer</div>
+      <span class="f-status have">have</span>
+      <div class="f-note"><code>Customer::addresses()</code> (<code>HasMany</code>) — <code>Lunar\Models\Address</code> has no cap on count.</div>
+    </div>
+
+    <div class="feature">
+      <div class="f-name">Separate default shipping / billing address</div>
+      <span class="f-status have">have</span>
+      <div class="f-note"><code>Address::shipping_default</code> and <code>billing_default</code> booleans; <code>AddressObserver</code> auto-unsets the previous default when a new one is flagged, so only one of each can be true at a time.</div>
+    </div>
+
+    <div class="feature">
+      <div class="f-name">Self-service address book (add/edit/delete UI)</div>
+      <span class="f-status missing">missing</span>
+      <div class="f-note">Only Filament's staff-facing <code>AddressRelationManager</code> (<code>src/Customer/RelationManagers/AddressRelationManager.php</code>) touches addresses today — that's an admin back-office view, not a storefront one. No customer-facing CRUD exists.</div>
+    </div>
+
+    <div class="feature">
+      <div class="f-name">Address autocomplete / validation at entry</div>
+      <span class="f-status missing">missing</span>
+      <div class="f-note">Nothing in <code>lunarphp/core</code> or boboko-core wires a geocoding/validation service — this is a storefront-only concern layered on top of the plain <code>line_one</code>…<code>postcode</code> fields.</div>
+    </div>
+  </section>
+
+  <section class="category">
+    <div class="cat-head">
+      <span class="cat-num">04</span>
+      <h2>Login &amp; identity</h2>
+    </div>
+    <p class="cat-note">How a customer gets in, and how forgiving that path is.</p>
+
+    <div class="feature">
+      <div class="f-name">Email + password login</div>
+      <span class="f-status missing">missing</span>
+      <div class="f-note">No storefront auth guard/routes configured — see 01. <code>Modules\Core\Auth\Services\OtpService</code>/<code>UserOtpService</code> exist but are wired to staff/Filament login, not a customer-facing flow.</div>
+    </div>
+
+    <div class="feature">
+      <div class="f-name">Passwordless / magic-link / OTP login</div>
+      <span class="f-status partial">partial</span>
+      <div class="f-note"><code>UserOtpService</code> and <code>UserOtpMail</code> already implement an OTP-by-email mechanism for the staff panel — the building block for a customer-facing passwordless flow exists, just not exposed to a storefront route. Shopify ships this as sign-in links (6-digit email code) by default in its 2026 customer accounts.</div>
+    </div>
+
+    <div class="feature">
+      <div class="f-name">Social login (Google / Apple / Facebook)</div>
+      <span class="f-status missing">missing</span>
+      <div class="f-note">No <code>laravel/socialite</code> in either <code>composer.json</code>. Shopify offers Google/Facebook sign-in and "Sign in with Shop" natively; this would be a from-scratch integration here.</div>
+    </div>
+
+    <div class="feature">
+      <div class="f-name">Guest checkout → account conversion</div>
+      <span class="f-status missing">missing</span>
+      <div class="f-note">No storefront checkout flow exists yet in 3dealer to convert from — this depends on checkout being built before it's meaningful. Lunar's <code>Cart::user_id</code>/<code>customer_id</code> nullable-until-claimed design would support it once a checkout and account UI exist.</div>
+    </div>
+  </section>
+
+  <section class="category">
+    <div class="cat-head">
+      <span class="cat-num">05</span>
+      <h2>Payments &amp; saved methods</h2>
+    </div>
+    <p class="cat-note">Whether a returning customer can skip re-entering card details.</p>
+
+    <div class="feature">
+      <div class="f-name">Saved payment methods on account</div>
+      <span class="f-status missing">missing</span>
+      <div class="f-note">No tokenized-card storage model found in <code>lunarphp/core</code> or boboko-core's payment integration. Even Shopify gates this behind Enterprise; WooCommerce's version depends entirely on gateway-level tokenization (e.g. Stripe), not a core feature.</div>
+    </div>
+  </section>
+
+  <section class="category">
+    <div class="cat-head">
+      <span class="cat-num">06</span>
+      <h2>Wishlist &amp; saved items</h2>
+    </div>
+    <p class="cat-note">Keeping track of products outside the cart.</p>
+
+    <div class="feature">
+      <div class="f-name">Wishlist / saved-for-later products</div>
+      <span class="f-status missing">missing</span>
+      <div class="f-note">No <code>wishlist</code> model, table, or reference anywhere in <code>src/</code> or <code>vendor/lunarphp</code> — grep confirms zero hits. Shopify also has no native wishlist (third-party apps like Flits fill the gap); WooCommerce/PrestaShop are the same story via plugins, so this is a genuinely common gap, not a boboko-specific one.</div>
+    </div>
+  </section>
+
+  <section class="category">
+    <div class="cat-head">
+      <span class="cat-num">07</span>
+      <h2>Groups, pricing &amp; B2B</h2>
+    </div>
+    <p class="cat-note">Where boboko is already ahead of a typical single-tenant storefront — Lunar's <code>CustomerGroup</code> does real work here.</p>
+
+    <div class="feature">
+      <div class="f-name">Customer groups for differentiated pricing/visibility</div>
+      <span class="f-status have">have</span>
+      <div class="f-note"><code>CustomerGroup</code> model plus <code>HasCustomerGroups</code> trait — <code>Product::customerGroup()</code> scope and <code>Price</code>'s polymorphic customer-group awareness are both real, shipped behavior, not scaffolding.</div>
+    </div>
+
+    <div class="feature">
+      <div class="f-name">Scheduled group availability (time-boxed access)</div>
+      <span class="f-status have">have</span>
+      <div class="f-note"><code>HasCustomerGroups::scheduleCustomerGroup()</code> / <code>unscheduleCustomerGroup()</code>, backed by <code>CanScheduleAvailability</code> — supports a <code>starts_at</code>/<code>ends_at</code> window per group, e.g. early access for wholesale.</div>
+    </div>
+
+    <div class="feature">
+      <div class="f-name">Multi-user company / B2B accounts</div>
+      <span class="f-status partial">partial</span>
+      <div class="f-note"><code>Customer::users()->sync([...])</code> already supports attaching several <code>User</code>s to one <code>Customer</code> record — the data model allows a shared company account today, but nothing (invite flow, role/permission split between company users, storefront switch-account UI) is built on top of it. PrestaShop's "Multi-User Customer Account" add-on is the closest native comparison, and it's a paid third-party module there too.</div>
+    </div>
+
+    <div class="feature">
+      <div class="f-name">Self-service customer-group selection at registration</div>
+      <span class="f-status missing">missing</span>
+      <div class="f-note">Groups exist and are assignable (<code>HasCustomerGroups::bootHasCustomerGroups()</code> auto-syncs default groups on creation), but nothing lets a customer request/select a group like "wholesale" at signup — that's currently a staff-only Filament action via <code>CustomerResourceExtension</code>.</div>
+    </div>
+  </section>
+
+  <section class="category">
+    <div class="cat-head">
+      <span class="cat-num">08</span>
+      <h2>Loyalty, retention &amp; data rights</h2>
+    </div>
+    <p class="cat-note">Longer-tail account features — noted for completeness, not depth (data rights specifically overlaps a separate Privacy survey).</p>
+
+    <div class="feature">
+      <div class="f-name">Loyalty / rewards points program</div>
+      <span class="f-status missing">missing</span>
+      <div class="f-note">No points/loyalty model anywhere in <code>lunarphp/core</code> or boboko-core — <code>Discount</code>'s <code>BuyXGetY</code> type is the closest primitive, but it's a promo mechanic, not an accruing balance. PrestaShop and WooCommerce both rely on third-party modules for this too (Knowband, Webkul, Yith).</div>
+    </div>
+
+    <div class="feature">
+      <div class="f-name">Self-service data export / account deletion</div>
+      <span class="f-status missing">missing</span>
+      <div class="f-note">The only related tool is <code>boboko:anonymize</code> — a local-environment-only dev command that scrubs <code>users</code>/<code>lunar_customers</code> for testing, not a customer-facing GDPR flow. WooCommerce's closest native equivalent is also a paid add-on (Data Privacy Manager); flagged briefly here, full treatment belongs to the separate Privacy survey.</div>
+    </div>
+
+    <div class="feature">
+      <div class="f-name">Subscription / recurring-order management</div>
+      <span class="f-status missing">missing</span>
+      <div class="f-note">No subscription model, billing-cycle field, or recurring-cart concept found in <code>lunarphp/core</code>. This is WooCommerce Subscriptions/Shopify-app territory on the platforms researched too — not a core-package feature anywhere.</div>
+    </div>
+  </section>
+
+  <footer class="page">
+    <span>Compiled 2026-08-28 — chips backed by web research (Shopify/WooCommerce/PrestaShop feature claims) are noted inline by platform name; all other claims are direct reads of <code>vendor/lunarphp/core/src</code>, boboko-core's <code>src/</code>, and 3dealer's <code>app/</code>/<code>resources/views</code>/<code>routes</code>.</span>
+    <span>boboko-core / docs</span>
+  </footer>
+
+</div>
diff --git a/docs/scratch/discounts-feature-survey.html b/docs/scratch/discounts-feature-survey.html
new file mode 100644
index 0000000..9147f01
--- /dev/null
+++ b/docs/scratch/discounts-feature-survey.html
@@ -0,0 +1,527 @@
+<title>Discounts Feature Survey</title>
+<style>
+  @import url('https://fonts.googleapis.com/css2?family=Fraunces:opsz,wght@9..144,400;9..144,500;9..144,600&family=IBM+Plex+Sans:wght@400;500;600&family=IBM+Plex+Mono:wght@400;500&display=swap');
+
+  :root {
+    --paper: #FAFAF7;
+    --ink: #1C1C1A;
+    --muted: #6B6B63;
+    --accent: #2F5D50;
+    --accent-soft: #E4EDE9;
+    --good: #3F7A5C;
+    --good-soft: #E6F0EA;
+    --warn: #B8863B;
+    --warn-soft: #F5ECDC;
+    --miss: #A14B3B;
+    --miss-soft: #F5E5E0;
+    --hairline: #E4E2DB;
+    --card: #FFFFFF;
+  }
+
+  @media (prefers-color-scheme: dark) {
+    :root:not([data-theme="light"]) {
+      --paper: #17181A;
+      --ink: #EDEBE4;
+      --muted: #9C9A90;
+      --accent: #6FAE97;
+      --accent-soft: #1E2D28;
+      --good: #6FAE97;
+      --good-soft: #1C2B22;
+      --warn: #D9AD6B;
+      --warn-soft: #2E2618;
+      --miss: #DE8A76;
+      --miss-soft: #2E1F1B;
+      --hairline: #302F2B;
+      --card: #1D1E20;
+    }
+  }
+
+  :root[data-theme="dark"] {
+    --paper: #17181A;
+    --ink: #EDEBE4;
+    --muted: #9C9A90;
+    --accent: #6FAE97;
+    --accent-soft: #1E2D28;
+    --good: #6FAE97;
+    --good-soft: #1C2B22;
+    --warn: #D9AD6B;
+    --warn-soft: #2E2618;
+    --miss: #DE8A76;
+    --miss-soft: #2E1F1B;
+    --hairline: #302F2B;
+    --card: #1D1E20;
+  }
+
+  * { box-sizing: border-box; }
+
+  body {
+    background: var(--paper);
+    color: var(--ink);
+    font-family: "IBM Plex Sans", ui-sans-serif, system-ui, sans-serif;
+    font-size: 16px;
+    line-height: 1.6;
+    margin: 0;
+    padding: 0;
+  }
+
+  .sheet {
+    max-width: 780px;
+    margin: 0 auto;
+    padding: 72px 24px 56px;
+  }
+
+  header.title-block {
+    margin-bottom: 56px;
+    padding-bottom: 32px;
+    border-bottom: 1px solid var(--hairline);
+  }
+
+  .eyebrow {
+    font-family: "IBM Plex Mono", ui-monospace, monospace;
+    font-size: 12px;
+    letter-spacing: 0.08em;
+    text-transform: uppercase;
+    color: var(--accent);
+    margin: 0 0 16px;
+  }
+
+  h1 {
+    font-family: "Fraunces", Georgia, serif;
+    font-weight: 500;
+    font-size: 2.15rem;
+    line-height: 1.18;
+    letter-spacing: -0.01em;
+    text-wrap: balance;
+    margin: 0 0 18px;
+    color: var(--ink);
+  }
+
+  .lede {
+    font-size: 1rem;
+    color: var(--muted);
+    max-width: 62ch;
+    margin: 0 0 20px;
+  }
+
+  .legend {
+    display: flex;
+    flex-wrap: wrap;
+    gap: 10px;
+    margin-top: 8px;
+  }
+
+  .chip {
+    display: inline-flex;
+    align-items: center;
+    gap: 6px;
+    font-family: "IBM Plex Mono", ui-monospace, monospace;
+    font-size: 11.5px;
+    letter-spacing: 0.03em;
+    padding: 3px 9px;
+    border-radius: 3px;
+    text-transform: uppercase;
+    white-space: nowrap;
+  }
+
+  .chip.have { background: var(--good-soft); color: var(--good); }
+  .chip.partial { background: var(--warn-soft); color: var(--warn); }
+  .chip.missing { background: var(--miss-soft); color: var(--miss); }
+
+  section.category {
+    margin-bottom: 48px;
+  }
+
+  .cat-head {
+    display: flex;
+    align-items: baseline;
+    gap: 14px;
+    margin-bottom: 6px;
+  }
+
+  .cat-num {
+    font-family: "Fraunces", Georgia, serif;
+    font-weight: 500;
+    font-size: 1rem;
+    color: var(--accent);
+    min-width: 26px;
+  }
+
+  .cat-title {
+    font-family: "Fraunces", Georgia, serif;
+    font-weight: 500;
+    font-size: 1.3rem;
+    letter-spacing: -0.005em;
+    margin: 0;
+  }
+
+  .cat-note {
+    font-size: 0.92rem;
+    color: var(--muted);
+    margin: 0 0 22px 40px;
+    max-width: 58ch;
+  }
+
+  .rows {
+    display: flex;
+    flex-direction: column;
+    border-top: 1px solid var(--hairline);
+    margin-left: 40px;
+  }
+
+  .row {
+    padding: 15px 0;
+    border-bottom: 1px solid var(--hairline);
+  }
+
+  .row-head {
+    display: flex;
+    align-items: baseline;
+    justify-content: space-between;
+    gap: 16px;
+    margin-bottom: 6px;
+  }
+
+  .feat-name {
+    font-weight: 600;
+    font-size: 0.98rem;
+    color: var(--ink);
+  }
+
+  .ground {
+    font-size: 0.87rem;
+    color: var(--muted);
+    max-width: 66ch;
+  }
+
+  .ground code {
+    font-family: "IBM Plex Mono", ui-monospace, monospace;
+    font-size: 0.83em;
+    background: var(--accent-soft);
+    color: var(--accent);
+    padding: 1px 5px;
+    border-radius: 3px;
+  }
+
+  .callout {
+    background: var(--card);
+    border: 1px solid var(--hairline);
+    border-left: 3px solid var(--accent);
+    border-radius: 4px;
+    padding: 16px 18px;
+    margin: 0 0 22px 40px;
+    font-size: 0.9rem;
+    color: var(--ink);
+  }
+
+  .callout strong {
+    color: var(--accent);
+  }
+
+  footer {
+    margin-top: 64px;
+    padding-top: 24px;
+    border-top: 1px solid var(--hairline);
+    font-size: 0.82rem;
+    color: var(--muted);
+    font-family: "IBM Plex Mono", ui-monospace, monospace;
+  }
+
+  footer p {
+    margin: 0 0 8px;
+    line-height: 1.6;
+  }
+
+  footer p:last-child { margin-bottom: 0; }
+
+  @media (max-width: 560px) {
+    .cat-note, .rows, .callout { margin-left: 0; }
+    .row-head { flex-direction: column; gap: 4px; }
+  }
+</style>
+
+<div class="sheet">
+
+  <header class="title-block">
+    <p class="eyebrow">boboko-core &middot; competitive spec sheet</p>
+    <h1>What discounts &amp; promotions elsewhere can do that boboko can&rsquo;t yet</h1>
+    <p class="lede">A feature-by-feature audit of Lunar's <code style="font-family:'IBM Plex Mono',monospace;background:var(--accent-soft);color:var(--accent);padding:1px 5px;border-radius:3px;font-size:0.85em;">Discount</code> engine against promotion tooling in Shopify, WooCommerce, and PrestaShop. Each row is graded against the underlying Lunar source, not the docs.</p>
+    <div class="legend">
+      <span class="chip have">have</span>
+      <span class="chip partial">partial</span>
+      <span class="chip missing">missing</span>
+    </div>
+  </header>
+
+  <section class="category">
+    <div class="cat-head">
+      <span class="cat-num">01</span>
+      <h2 class="cat-title">Core discount mechanics</h2>
+    </div>
+    <p class="cat-note">The two shipped discount types and the machinery that decides whether they fire.</p>
+
+    <div class="rows">
+      <div class="row">
+        <div class="row-head">
+          <span class="feat-name">Percentage / fixed-amount off cart or line items</span>
+          <span class="chip have">have</span>
+        </div>
+        <p class="ground">Built in as <code>Lunar\DiscountTypes\AmountOff</code>. <code>applyPercentage()</code> and <code>applyFixedValue()</code> distribute the discount across eligible lines, tracking per-currency fixed values (<code>data.fixed_values.{code}</code>) so the amount is currency-aware, not a single converted number.</p>
+      </div>
+      <div class="row">
+        <div class="row-head">
+          <span class="feat-name">Buy X get Y (free or discounted)</span>
+          <span class="chip have">have</span>
+        </div>
+        <p class="ground">Built in as <code>Lunar\DiscountTypes\BuyXGetY</code>. Condition lines and reward lines are configured separately via <code>discountableConditions</code>/<code>discountableRewards</code>; <code>getRewardQuantity()</code> computes how many reward units a given condition quantity earns, with an optional <code>max_reward_qty</code> cap.</p>
+      </div>
+      <div class="row">
+        <div class="row-head">
+          <span class="feat-name">Coupon-code discounts</span>
+          <span class="chip have">have</span>
+        </div>
+        <p class="ground"><code>checkDiscountConditions()</code> compares <code>strtoupper($cart-&gt;coupon_code)</code> against <code>$discount-&gt;coupon</code>; <code>Discounts::validateCoupon()</code> exposes a standalone check. Coupon is cast via <code>CouponString</code> on the model.</p>
+      </div>
+      <div class="row">
+        <div class="row-head">
+          <span class="feat-name">Automatic (no-code) discounts</span>
+          <span class="chip have">have</span>
+        </div>
+        <p class="ground">A blank <code>coupon</code> column makes a discount apply to every eligible cart with no code entered &mdash; <code>DiscountManager::getDiscounts()</code> queries <code>whereNull('coupon')-&gt;orWhere('coupon', '')</code> when the cart carries no coupon code.</p>
+      </div>
+      <div class="row">
+        <div class="row-head">
+          <span class="feat-name">Minimum cart spend condition</span>
+          <span class="chip have">have</span>
+        </div>
+        <p class="ground"><code>checkDiscountConditions()</code> reads <code>data.min_prices.{currency}</code> and compares it against <code>$lines-&gt;sum('subTotal.value')</code>. Configurable per-currency in the admin form's "Minimum cart amount" fieldset &mdash; but only enforced by <code>AmountOff</code>, see row below.</p>
+      </div>
+      <div class="row">
+        <div class="row-head">
+          <span class="feat-name">Scoping to products, variants, collections, brands (incl. exclusions)</span>
+          <span class="chip have">have</span>
+        </div>
+        <p class="ground"><code>AmountOff::getEligibleLines()</code> filters/rejects cart lines against <code>discountableLimitations</code>/<code>discountableExclusions</code> plus <code>collections()</code>/<code>brands()</code> pivot rows typed <code>limitation</code> or <code>exclusion</code>. Configured through five separate Filament relation managers on the discount record.</p>
+      </div>
+    </div>
+  </section>
+
+  <section class="category">
+    <div class="cat-head">
+      <span class="cat-num">02</span>
+      <h2 class="cat-title">Timing, status, and usage limits</h2>
+    </div>
+    <p class="cat-note">Whether a discount is currently live, and how hard its usage caps are enforced.</p>
+
+    <div class="rows">
+      <div class="row">
+        <div class="row-head">
+          <span class="feat-name">Scheduled / expiring discount windows</span>
+          <span class="chip have">have</span>
+        </div>
+        <p class="ground"><code>Discount::getStatusAttribute()</code> derives <code>active</code>/<code>pending</code>/<code>expired</code>/<code>scheduled</code> from <code>starts_at</code>/<code>ends_at</code>; the Filament table badges this status column directly (green/gray/red/blue via <code>DiscountResource::getTableColumns()</code>).</p>
+      </div>
+      <div class="row">
+        <div class="row-head">
+          <span class="feat-name">Global max-uses cap</span>
+          <span class="chip have">have</span>
+        </div>
+        <p class="ground"><code>Discount::scopeUsable()</code> filters query-side (<code>uses &lt; max_uses OR max_uses IS NULL</code>) before a discount is even fetched; <code>checkDiscountConditions()</code> re-checks it in <code>AmountOff</code>. <code>markAsUsed()</code> increments <code>uses</code> and attaches the user via <code>discount_user</code>.</p>
+      </div>
+      <div class="row">
+        <div class="row-head">
+          <span class="feat-name">Per-user max-uses cap</span>
+          <span class="chip partial">partial</span>
+        </div>
+        <p class="ground"><code>checkDiscountConditions()</code> calls <code>usesByUser()</code> only when <code>$cart-&gt;user</code> exists &mdash; a guest checkout cannot be capped per-customer since there's no <code>user_id</code> to key against, only <code>customer_id</code>. Wholesale/B2B carts often complete without a Laravel <code>User</code> attached, so the cap silently no-ops for them.</p>
+      </div>
+      <div class="row">
+        <div class="row-head">
+          <span class="feat-name">Usage/eligibility checks on Buy X Get Y</span>
+          <span class="chip missing">missing</span>
+        </div>
+        <p class="ground"><code>BuyXGetY::apply()</code> never calls <code>checkDiscountConditions()</code> &mdash; grep the method body, it's absent. A coupon-gated, min-spend-gated, or max-uses-capped BOGO discount ignores all three conditions; only the min-quantity/reward math runs. <code>AmountOff::apply()</code> calls it correctly by contrast.</p>
+      </div>
+    </div>
+  </section>
+
+  <section class="category">
+    <div class="cat-head">
+      <span class="cat-num">03</span>
+      <h2 class="cat-title">Multiple discounts, priority, and stacking</h2>
+    </div>
+    <p class="cat-note">What happens when more than one discount could legally apply to the same cart.</p>
+
+    <div class="callout">
+      <strong>The <code>stop</code> field is dead code.</strong> It's a real column, cast as boolean on the model, and it's a live toggle in the Filament admin form (<code>DiscountResource::getStopFormComponent()</code>) &mdash; but a repo-wide grep of both <code>lunarphp/core</code> and <code>lunarphp/lunar</code> for reads of <code>$discount-&gt;stop</code> outside the model and the form turns up nothing. <code>DiscountManager::apply()</code> is a plain unconditional <code>foreach</code> over every fetched discount; nothing ever breaks the loop. Staff can toggle a setting that has zero runtime effect.
+    </div>
+
+    <div class="rows">
+      <div class="row">
+        <div class="row-head">
+          <span class="feat-name">Priority ordering between discounts</span>
+          <span class="chip have">have</span>
+        </div>
+        <p class="ground"><code>DiscountManager::getDiscounts()</code> ends with <code>orderBy('priority', 'desc')-&gt;orderBy('id')</code>, and the admin form exposes low/medium/high (1/5/10) presets. This genuinely controls apply order.</p>
+      </div>
+      <div class="row">
+        <div class="row-head">
+          <span class="feat-name">Stopping further discounts once one applies ("exclusive" discount)</span>
+          <span class="chip missing">missing</span>
+        </div>
+        <p class="ground">See callout above &mdash; <code>stop</code> is unread at runtime. Every active, eligible discount is applied every time; there is no way to make one discount exclusive of the rest short of writing a custom <code>AbstractDiscountType</code> that inspects <code>$cart-&gt;discounts</code> itself.</p>
+      </div>
+      <div class="row">
+        <div class="row-head">
+          <span class="feat-name">Per-class combination rules (product vs. order vs. shipping discounts)</span>
+          <span class="chip missing">missing</span>
+        </div>
+        <p class="ground">Shopify models discounts as Product/Order/Shipping classes with an explicit "Combines with" toggle per pair. Lunar has no discount class concept at all &mdash; <code>AmountOff</code> and <code>BuyXGetY</code> are the only two types and neither declares a class or combination policy.</p>
+      </div>
+      <div class="row">
+        <div class="row-head">
+          <span class="feat-name">Customer-facing stacking transparency (which discounts combined, and why)</span>
+          <span class="chip partial">partial</span>
+        </div>
+        <p class="ground"><code>$cart-&gt;discountBreakdown</code> (a collection of <code>DiscountBreakdown</code> value objects, one per applied discount with its affected lines) gives a storefront the raw data to render "2 promotions applied," but no UI ships to render it &mdash; it's a data structure a storefront app must build its own component against.</p>
+      </div>
+      <div class="row">
+        <div class="row-head">
+          <span class="feat-name">"Best deal wins" line-level conflict resolution</span>
+          <span class="chip have">have</span>
+        </div>
+        <p class="ground">Both <code>AmountOff::applyFixedValue()</code> and <code>applyPercentage()</code> explicitly skip a line when <code>$line-&gt;discountTotal-&gt;value &gt; $amount</code> &mdash; "if this line already has a greater discount value, don't add this one as they already have a better deal." This is a real per-line max-discount guard, just not a whole-cart exclusivity rule.</p>
+      </div>
+    </div>
+  </section>
+
+  <section class="category">
+    <div class="cat-head">
+      <span class="cat-num">04</span>
+      <h2 class="cat-title">Volume, tiers, and bundles</h2>
+    </div>
+    <p class="cat-note">"Buy more, save more" mechanics &mdash; and the separate pricing layer that actually implements some of them in Lunar.</p>
+
+    <div class="callout">
+      <strong>Tiered/volume pricing exists &mdash; but it's not a <code>Discount</code>.</strong> <code>PricingManager::get()</code> filters a purchasable's <code>Price</code> rows for <code>min_quantity &gt; 1 AND $this-&gt;qty &gt;= $price-&gt;min_quantity</code> and picks the cheapest matching price break. This is quantity-break pricing baked into the price table itself, resolved at <code>Pricing::for($variant)-&gt;qty($n)-&gt;get()</code> time &mdash; it never touches the <code>Discount</code> model, coupon system, or discount breakdown at all. A storefront gets the discounted unit price with no visible "discount applied" line.
+    </div>
+
+    <div class="rows">
+      <div class="row">
+        <div class="row-head">
+          <span class="feat-name">Per-SKU quantity price breaks</span>
+          <span class="chip have">have</span>
+        </div>
+        <p class="ground">Via the <code>Price</code> model's <code>min_quantity</code>/pricing pipeline described above, not <code>Discount</code>. Configured directly on product variant pricing in the admin, no separate promotion object needed.</p>
+      </div>
+      <div class="row">
+        <div class="row-head">
+          <span class="feat-name">Cart-wide tiered discount ("spend $100, save 10%; spend $200, save 20%")</span>
+          <span class="chip missing">missing</span>
+        </div>
+        <p class="ground"><code>AmountOff</code> takes one flat percentage or fixed value per discount record; there is no multi-tier threshold structure in <code>data</code>. Reaching this today means creating several separate <code>Discount</code> rows, each with its own <code>min_prices</code> floor, and hoping only the intended one wins (compounded by the <code>stop</code> gap in section 03).</p>
+      </div>
+      <div class="row">
+        <div class="row-head">
+          <span class="feat-name">Bundle / kit discount (buy this set, get a fixed bundle price)</span>
+          <span class="chip missing">missing</span>
+        </div>
+        <p class="ground">No bundle or kit concept anywhere in <code>lunarphp/core</code>'s catalog or discount models. Shopify/WooCommerce/PrestaShop all support this via dedicated bundle apps or plugins layered on the same primitive Lunar lacks &mdash; a discount keyed to a co-purchased product set rather than any single line.</p>
+      </div>
+      <div class="row">
+        <div class="row-head">
+          <span class="feat-name">Free-gift-with-purchase (a distinct SKU added free, not a percentage off an existing line)</span>
+          <span class="chip have">have</span>
+        </div>
+        <p class="ground"><code>BuyXGetY</code>'s <code>automatically_add_rewards</code> flag drives <code>processAutomaticRewards()</code>, which inserts a brand-new <code>CartLine</code> for a randomly selected reward product and zeroes its price via <code>discountTotal</code>. <code>$cart-&gt;freeItems</code> tracks which purchasables were added this way.</p>
+      </div>
+    </div>
+  </section>
+
+  <section class="category">
+    <div class="cat-head">
+      <span class="cat-num">05</span>
+      <h2 class="cat-title">Customer targeting</h2>
+    </div>
+    <p class="cat-note">Lunar has two genuinely different mechanisms here that solve overlapping-looking problems &mdash; conflating them is the easiest mistake to make.</p>
+
+    <div class="callout">
+      <strong><code>CustomerGroup</code> pricing and <code>Discount</code> customer-group scoping are not the same feature.</strong> <code>Pricing::for($variant)-&gt;customerGroups($groups)-&gt;get()</code> resolves a <em>different base price</em> per customer group directly from the <code>Price</code> table (wholesale sees $8, retail sees $10 &mdash; two rows, no discount object, no coupon, nothing to "apply"). <code>Discount::customerGroups()</code> is a separate pivot (<code>customer_group_discount</code>, via the <code>HasCustomerGroups</code> trait) that scopes whether a <em>promotion</em> is visible/enabled to a group at all, with its own <code>starts_at</code>/<code>ends_at</code>/<code>enabled</code>/<code>visible</code> per-pivot-row scheduling. One is differential pricing; the other is promotion eligibility. Both exist and both work, but they're wired into completely separate code paths.
+    </div>
+
+    <div class="rows">
+      <div class="row">
+        <div class="row-head">
+          <span class="feat-name">Differential pricing per customer group (wholesale/VIP base price)</span>
+          <span class="chip have">have</span>
+        </div>
+        <p class="ground"><code>PricingManager::get()</code>: <code>$potentialGroupPrice</code> filters <code>Price</code> rows with a matching <code>customer_group_id</code> and picks the cheapest; falls back to <code>$basePrice</code> when no group price exists.</p>
+      </div>
+      <div class="row">
+        <div class="row-head">
+          <span class="feat-name">Restricting a discount/coupon to specific customer groups</span>
+          <span class="chip have">have</span>
+        </div>
+        <p class="ground"><code>DiscountManager::getDiscounts()</code> applies <code>-&gt;customerGroup($this-&gt;customerGroups)</code> via the shared <code>HasCustomerGroups</code> trait's <code>scopeCustomerGroup()</code>, configured on the discount's own "Availability" sub-page (<code>ManageDiscountAvailability</code>) alongside channel restriction.</p>
+      </div>
+      <div class="row">
+        <div class="row-head">
+          <span class="feat-name">Restricting a discount to specific named customers</span>
+          <span class="chip have">have</span>
+        </div>
+        <p class="ground"><code>Discount::customers()</code> pivot (<code>customer_discount</code>), checked in <code>checkDiscountConditions()</code>: if the discount has any tied customers, a cart without a matching <code>customer_id</code> fails eligibility outright. Managed via <code>CustomerLimitationRelationManager</code> in the admin.</p>
+      </div>
+      <div class="row">
+        <div class="row-head">
+          <span class="feat-name">First-purchase / welcome discount</span>
+          <span class="chip missing">missing</span>
+        </div>
+        <p class="ground">Lunar does compute an order-level <code>new_customer</code> boolean (<code>Jobs\Orders\MarkAsNewCustomer</code>, <code>! $previousOrder</code>) &mdash; but it's a post-order reporting flag surfaced only in the Filament order table/dashboard chart. Nothing reads it during <code>ApplyDiscounts</code>; there's no "is this customer's first order" condition available to a <code>Discount</code> at checkout time.</p>
+      </div>
+      <div class="row">
+        <div class="row-head">
+          <span class="feat-name">Referral discounts (reward both referrer and referee)</span>
+          <span class="chip missing">missing</span>
+        </div>
+        <p class="ground">No referral concept anywhere in <code>lunarphp/core</code> or <code>lunarphp/lunar</code> &mdash; not a model, job, or config key. Common as a bolt-on in WooCommerce/Shopify via loyalty apps (e.g. WPLoyalty's referral-points module); would need to be built from scratch on top of <code>Discount::customers()</code> at best.</p>
+      </div>
+      <div class="row">
+        <div class="row-head">
+          <span class="feat-name">Loyalty points redeemable as a discount</span>
+          <span class="chip missing">missing</span>
+        </div>
+        <p class="ground">No points ledger, balance, or redemption model exists in Lunar core. A loyalty program (points-to-discount conversion, VIP-tier multipliers) is a third-party plugin layer in every researched competitor, not core commerce logic &mdash; same gap here, but Lunar offers no <code>AbstractDiscountType</code> hook obviously suited to "redeem N points" either, since discount eligibility has no notion of a spendable balance.</p>
+      </div>
+    </div>
+  </section>
+
+  <section class="category">
+    <div class="cat-head">
+      <span class="cat-num">06</span>
+      <h2 class="cat-title">Extensibility</h2>
+    </div>
+    <p class="cat-note">What it takes to reach a feature Lunar doesn't ship, without forking the package.</p>
+
+    <div class="rows">
+      <div class="row">
+        <div class="row-head">
+          <span class="feat-name">Registering a custom discount type</span>
+          <span class="chip have">have</span>
+        </div>
+        <p class="ground"><code>Discounts::addType(MyType::class)</code> appends to <code>DiscountManager::$types</code> (seeded with just <code>AmountOff::class, BuyXGetY::class</code>). A new type extends <code>AbstractDiscountType</code> and implements <code>apply(CartContract $cart)</code> &mdash; the same contract the two built-ins use, so it participates in the same unconditional-foreach loop from section 03.</p>
+      </div>
+      <div class="row">
+        <div class="row-head">
+          <span class="feat-name">Admin UI for a custom discount type</span>
+          <span class="chip partial">partial</span>
+        </div>
+        <p class="ground">Requires additionally implementing <code>Lunar\Admin\Base\LunarPanelDiscountInterface</code> (<code>lunarPanelSchema()</code>/<code>lunarPanelOnFill()</code>/<code>lunarPanelOnSave()</code>) for <code>DiscountResource::getDefaultForm()</code> to render a config section for it. The interface exists and is wired in, but there is no shipped example implementation to copy from beyond <code>AmountOff</code>/<code>BuyXGetY</code>, which are hard-coded into the form rather than using the interface themselves.</p>
+      </div>
+    </div>
+  </section>
+
+  <footer>
+    <p>Compiled 2026-08-28 &middot; boboko-core / docs</p>
+    <p>Section 01&ndash;03 and 05&ndash;06 rows are grounded directly in <code>vendor/lunarphp/core/src</code> and <code>vendor/lunarphp/lunar/src</code> source reads (file/method citations inline). Section 02's per-user cap and section 04's pricing-vs-discount distinction are likewise direct source reads. Comparative claims about Shopify, WooCommerce, and PrestaShop feature sets and terminology (discount classes, cart-rule compatibility, loyalty/referral plugins) are sourced from current public documentation and app-store listings via web research, not from reading those platforms' source.</p>
+  </footer>
+
+</div>
diff --git a/docs/scratch/orders-feature-survey.html b/docs/scratch/orders-feature-survey.html
new file mode 100644
index 0000000..ac10bd1
--- /dev/null
+++ b/docs/scratch/orders-feature-survey.html
@@ -0,0 +1,450 @@
+<title>Order Feature Survey</title>
+<style>
+  :root {
+    --paper: #FAFAF7;
+    --ink: #1C1C1A;
+    --muted: #6B6B63;
+    --accent: #2F5D50;
+    --accent-soft: #E4EDE9;
+    --good: #3F7A5C;
+    --good-soft: #E6F0EA;
+    --warn: #B8863B;
+    --warn-soft: #F5ECDC;
+    --miss: #A14B3B;
+    --miss-soft: #F5E5E0;
+    --hairline: #E4E2DB;
+    --card: #FFFFFF;
+  }
+
+  :root:not([data-theme="light"]) {
+    @media (prefers-color-scheme: dark) {
+      --paper: #17181A;
+      --ink: #EDEBE4;
+      --muted: #9B9A90;
+      --accent: #7FBFA8;
+      --accent-soft: #1E2C27;
+      --good: #6FBF97;
+      --good-soft: #1B2A22;
+      --warn: #D9A85C;
+      --warn-soft: #2C2418;
+      --miss: #D97C68;
+      --miss-soft: #2E1E1A;
+      --hairline: #2C2D2E;
+      --card: #1E1F21;
+    }
+  }
+
+  :root[data-theme="dark"] {
+    --paper: #17181A;
+    --ink: #EDEBE4;
+    --muted: #9B9A90;
+    --accent: #7FBFA8;
+    --accent-soft: #1E2C27;
+    --good: #6FBF97;
+    --good-soft: #1B2A22;
+    --warn: #D9A85C;
+    --warn-soft: #2C2418;
+    --miss: #D97C68;
+    --miss-soft: #2E1E1A;
+    --hairline: #2C2D2E;
+    --card: #1E1F21;
+  }
+
+  * { box-sizing: border-box; }
+
+  body {
+    background: var(--paper);
+    color: var(--ink);
+    font-family: "IBM Plex Sans", ui-sans-serif, system-ui, sans-serif;
+    font-size: 15.5px;
+    line-height: 1.55;
+    margin: 0;
+    padding: 4.5rem 1.5rem 6rem;
+  }
+
+  .wrap {
+    max-width: 780px;
+    margin: 0 auto;
+  }
+
+  header.page {
+    margin-bottom: 3.25rem;
+  }
+
+  .eyebrow {
+    font-family: "IBM Plex Mono", ui-monospace, monospace;
+    font-size: 0.72rem;
+    letter-spacing: 0.12em;
+    text-transform: uppercase;
+    color: var(--accent);
+    margin-bottom: 0.9rem;
+  }
+
+  h1 {
+    font-family: "Fraunces", Georgia, serif;
+    font-weight: 560;
+    font-size: clamp(2.1rem, 4.5vw, 2.65rem);
+    line-height: 1.08;
+    letter-spacing: -0.01em;
+    margin: 0 0 0.9rem;
+    text-wrap: balance;
+  }
+
+  .dek {
+    color: var(--muted);
+    max-width: 60ch;
+    font-size: 1.02rem;
+  }
+
+  .dek strong {
+    color: var(--ink);
+    font-weight: 600;
+  }
+
+  .legend {
+    display: flex;
+    flex-wrap: wrap;
+    gap: 0.6rem;
+    margin-top: 1.6rem;
+  }
+
+  .chip {
+    display: inline-flex;
+    align-items: center;
+    gap: 0.4rem;
+    font-family: "IBM Plex Mono", ui-monospace, monospace;
+    font-size: 0.72rem;
+    letter-spacing: 0.04em;
+    padding: 0.28rem 0.6rem;
+    border-radius: 3px;
+  }
+
+  .chip.have { background: var(--good-soft); color: var(--good); }
+  .chip.partial { background: var(--warn-soft); color: var(--warn); }
+  .chip.missing { background: var(--miss-soft); color: var(--miss); }
+
+  section.category {
+    margin-top: 3rem;
+  }
+
+  .cat-head {
+    display: flex;
+    align-items: baseline;
+    gap: 0.85rem;
+    border-bottom: 1px solid var(--hairline);
+    padding-bottom: 0.7rem;
+    margin-bottom: 1.1rem;
+  }
+
+  .cat-num {
+    font-family: "Fraunces", Georgia, serif;
+    font-size: 1.05rem;
+    color: var(--accent);
+    font-variant-numeric: tabular-nums;
+    min-width: 1.6rem;
+  }
+
+  .cat-head h2 {
+    font-family: "Fraunces", Georgia, serif;
+    font-weight: 500;
+    font-size: 1.28rem;
+    margin: 0;
+    letter-spacing: -0.005em;
+  }
+
+  .cat-note {
+    color: var(--muted);
+    font-size: 0.86rem;
+    margin: 0 0 1.2rem;
+    max-width: 62ch;
+  }
+
+  .feature {
+    display: grid;
+    grid-template-columns: 1fr auto;
+    gap: 0.3rem 1rem;
+    padding: 1.05rem 0;
+    border-bottom: 1px solid var(--hairline);
+    align-items: start;
+  }
+
+  .feature:last-child { border-bottom: none; }
+
+  .f-name {
+    font-weight: 600;
+    font-size: 0.98rem;
+  }
+
+  .f-status {
+    font-family: "IBM Plex Mono", ui-monospace, monospace;
+    font-size: 0.68rem;
+    letter-spacing: 0.06em;
+    text-transform: uppercase;
+    padding: 0.22rem 0.55rem;
+    border-radius: 3px;
+    white-space: nowrap;
+    height: fit-content;
+  }
+
+  .f-status.have { background: var(--good-soft); color: var(--good); }
+  .f-status.partial { background: var(--warn-soft); color: var(--warn); }
+  .f-status.missing { background: var(--miss-soft); color: var(--miss); }
+
+  .f-note {
+    grid-column: 1 / -1;
+    color: var(--muted);
+    font-size: 0.87rem;
+    margin-top: 0.15rem;
+    max-width: 66ch;
+  }
+
+  .f-note code {
+    font-family: "IBM Plex Mono", ui-monospace, monospace;
+    font-size: 0.82em;
+    background: var(--accent-soft);
+    color: var(--accent);
+    padding: 0.08em 0.35em;
+    border-radius: 3px;
+  }
+
+  footer.page {
+    margin-top: 4rem;
+    padding-top: 1.5rem;
+    border-top: 1px solid var(--hairline);
+    color: var(--muted);
+    font-size: 0.82rem;
+    display: flex;
+    justify-content: space-between;
+    gap: 1rem;
+    flex-wrap: wrap;
+  }
+
+  footer.page a { color: var(--accent); }
+
+  @media (max-width: 560px) {
+    body { padding: 3rem 1.1rem 4rem; }
+    .feature { grid-template-columns: 1fr; }
+    .f-status { justify-self: start; }
+  }
+</style>
+<link rel="stylesheet" href="https://fonts.googleapis.com/css2?family=Fraunces:opsz,wght@9..144,400..600&family=IBM+Plex+Sans:wght@400;500;600&family=IBM+Plex+Mono:wght@400;500&display=swap">
+
+<div class="wrap">
+
+  <header class="page">
+    <div class="eyebrow">boboko / order · competitive survey</div>
+    <h1>What order management elsewhere can do that boboko can't yet</h1>
+    <p class="dek">
+      Where the Checkout survey stopped — the instant <code>Order</code> exists — this
+      one starts. A feature-by-feature pass across Shopify, WooCommerce, PrestaShop, and
+      (briefly) Magento's post-placement order layer — sourced, not recalled from memory —
+      checked against what <strong>Lunar's <code>Order</code> model and the
+      already-shipped Filament <code>ManageOrder</code> page</strong> actually support
+      today. For deciding what the new <code>Order</code> module needs to own, not a
+      build order.
+    </p>
+    <div class="legend">
+      <span class="chip have">● have</span>
+      <span class="chip partial">◐ partial</span>
+      <span class="chip missing">○ missing</span>
+    </div>
+  </header>
+
+  <section class="category">
+    <div class="cat-head">
+      <span class="cat-num">01</span>
+      <h2>Status model</h2>
+    </div>
+    <p class="cat-note">One field, or several axes — and who's allowed to move it.</p>
+
+    <div class="feature">
+      <div class="f-name">Payment status independent of a single overall status</div>
+      <span class="f-status partial">partial</span>
+      <div class="f-note">The data exists — <code>ManageOrder::paymentStatus()</code> derives a real value from <code>transactions()</code>/<code>captureTotal()</code>/<code>refundTotal()</code>/<code>intentTotal()</code> — but it's a computed display value on the admin page, not a stored column or something the rest of the system (mailers, automations) can key off. Shopify and Magento both make payment status a first-class, independently-queryable dimension; here it's derived on the fly, once, in one Filament page.</div>
+    </div>
+
+    <div class="feature">
+      <div class="f-name">Fulfillment status independent of overall status</div>
+      <span class="f-status missing">missing</span>
+      <div class="f-note">No equivalent of <code>paymentStatus()</code> exists for shipment/fulfillment state — <code>Order</code> has no <code>shipments()</code> relation of its own at all; it's added dynamically by <code>Modules\Core\Shipping\Providers\ShippingServiceProvider::resolveRelationUsing()</code>, outside Order's own boundary (see docs/checkout.md, "Where Order would likely absorb work"). Every platform researched (Shopify, Woo, PrestaShop, Magento) treats "has this shipped" as derivable from child records, not a manually-set field — Lunar has the child records (<code>Shipment</code>) but no derived status method reading them.</div>
+    </div>
+
+    <div class="feature">
+      <div class="f-name">Staff-editable order status with a picker/action</div>
+      <span class="f-status have">have</span>
+      <div class="f-note"><code>ManageOrder</code> ships a working <code>UpdateStatusAction</code> out of the box, backed by <code>config('lunar.orders.statuses')</code> — a flat, merchant-configured list, each entry carrying a <code>label</code>/<code>color</code>/<code>favourite</code> flag. Closer to WooCommerce's single linear field than Shopify's multi-axis split.</div>
+    </div>
+
+    <div class="feature">
+      <div class="f-name">Status rows carry behavior (auto-send email, generate invoice, restock)</div>
+      <span class="f-status partial">partial</span>
+      <div class="f-note">Each status entry in <code>config('lunar.orders.statuses')</code> already declares <code>mailers</code> and <code>notifications</code> arrays — the PrestaShop-style shape is there in config — but per the Checkout survey's finding, nothing in core actually reads and dispatches from those keys on a transition. The data model for "status carries behavior" exists; the behavior doesn't.</div>
+    </div>
+
+    <div class="feature">
+      <div class="f-name">Order-status-changed event other code can react to</div>
+      <span class="f-status missing">missing</span>
+      <div class="f-note">Same gap the Checkout survey flagged for order creation: no <code>OrderStatusUpdated</code>/equivalent exists anywhere in core. <code>UpdateStatusAction</code> just writes the column. Anything wanting to react to a status change — a confirmation email, a webhook, re-deriving payment/fulfillment status — has to hook the raw Eloquent <code>Order::updated()</code> event and diff <code>status</code> itself.</div>
+    </div>
+  </section>
+
+  <section class="category">
+    <div class="cat-head">
+      <span class="cat-num">02</span>
+      <h2>Fulfillment &amp; shipment tracking</h2>
+    </div>
+    <p class="cat-note">Turning a placed order into a package that moves.</p>
+
+    <div class="feature">
+      <div class="f-name">Shipment as its own record, separate from the order</div>
+      <span class="f-status have">have</span>
+      <div class="f-note"><code>Modules\Core\Shipping\Models\Shipment</code> (carrier, tracking reference, label-printed timestamp, manifest reference) already exists and belongs to <code>Order</code>. Built this session, ahead of most gaps in this survey — the record shape is closer to Magento's per-shipment entity than Woo's "no shipment entity at all."</div>
+    </div>
+
+    <div class="feature">
+      <div class="f-name">Multiple shipments per order (partial/split fulfillment)</div>
+      <span class="f-status partial">partial</span>
+      <div class="f-note"><code>Shipment</code> has no <code>quantity</code>-per-line or <code>order_line_id</code> concept — it's one shipment record per carrier voucher, with a <code>parent_reference</code> for ACS's own multipart-voucher case (one physical order split into multiple packages by the carrier), not a per-line-item fulfillment split decided by staff. Closer to "multiple packages for one shipment" than Magento's true per-line partial-shipment model.</div>
+    </div>
+
+    <div class="feature">
+      <div class="f-name">Create-shipment action from the order admin screen</div>
+      <span class="f-status have">have</span>
+      <div class="f-note"><code>Modules\Core\Shipping\Extensions\OrderViewExtension</code> adds a working "Create Shipment" header action to <code>ManageOrder</code>, resolving a <code>CarrierFulfillmentInterface</code> by the order's chosen shipping method and calling <code>createShipment()</code> — genuinely wired, not a stub. Currently lives under <code>Shipping</code>, flagged in docs/checkout.md as conceptually an <code>Order</code> concern.</div>
+    </div>
+
+    <div class="feature">
+      <div class="f-name">Tracking number + carrier surfaced on the order itself</div>
+      <span class="f-status have">have</span>
+      <div class="f-note"><code>Shipment.tracking_reference</code>/<code>carrier</code> exist and are populated by <code>createShipment()</code>; <code>PollShipmentTrackingJob</code> (scheduled every 30 minutes) keeps <code>ShipmentInfo</code> checkpoints current via <code>CarrierFulfillmentInterface::trackShipment()</code>. Genuinely ahead of PrestaShop's thin <code>order_carrier.tracking_number</code> field — this has a real checkpoint history, not just one string.</div>
+    </div>
+
+    <div class="feature">
+      <div class="f-name">"Shipped"/"delivered" status auto-derived from tracking</div>
+      <span class="f-status missing">missing</span>
+      <div class="f-note">The tracking checkpoints exist (<code>ShipmentInfo</code>, <code>TrackingStatus</code> enum including <code>Delivered</code>) but nothing writes them back onto <code>Order.status</code> — a delivered shipment doesn't move the order out of whatever status it was already in. Every platform researched treats "delivered" as a status a customer/staff can see on the order, not something buried one relation away.</div>
+    </div>
+
+    <div class="feature">
+      <div class="f-name">Shipping/delivery notification emails (shipped, out-for-delivery, delivered)</div>
+      <span class="f-status missing">missing</span>
+      <div class="f-note">Research: Shopify fires four separate templated notifications across this window alone (shipping confirmation, out-for-delivery, delivered, plus edited-order). None of the pieces exist here — no order-status-changed event (01) to trigger from, and no mailer wired to <code>PollShipmentTrackingJob</code>'s own status updates either.</div>
+    </div>
+  </section>
+
+  <section class="category">
+    <div class="cat-head">
+      <span class="cat-num">03</span>
+      <h2>Payments: capture, refund, cancellation</h2>
+    </div>
+    <p class="cat-note">Money moving back out, and orders that never should have been placed.</p>
+
+    <div class="feature">
+      <div class="f-name">Refund action from the order screen, amount-scoped</div>
+      <span class="f-status have">have</span>
+      <div class="f-note"><code>ManageOrder</code>'s <code>refund</code> action already exists — picks a transaction, an amount (validated against <code>availableToRefund()</code>), and notes, then calls the driver's own <code>Transaction::refund()</code>. This is genuinely native, matching Woo/Magento's line-item-adjacent (if not line-item-exact) refund UX.</div>
+    </div>
+
+    <div class="feature">
+      <div class="f-name">Capture action for auth-then-capture payment flows</div>
+      <span class="f-status have">have</span>
+      <div class="f-note"><code>ManageOrder</code>'s <code>capture</code> action + <code>requiresCapture()</code>/<code>canBeRefunded()</code> guard methods already exist, delegating to <code>Transaction::capture()</code> — this is the Stripe "authorize now, capture later" flow's admin-side half, already built ahead of most gaps here.</div>
+    </div>
+
+    <div class="feature">
+      <div class="f-name">Refund tied to specific line items (not just a dollar amount)</div>
+      <span class="f-status missing">missing</span>
+      <div class="f-note">The refund action takes a transaction + amount, with no line-item selection or restock decision — WooCommerce and Magento both make "which items, how many, restock or not" the primary refund UI; here it's one number against one transaction, closer to a manual adjustment than a structured partial return.</div>
+    </div>
+
+    <div class="feature">
+      <div class="f-name">Order cancellation as a distinct action (vs. just changing status)</div>
+      <span class="f-status missing">missing</span>
+      <div class="f-note">No dedicated "cancel" action exists on <code>ManageOrder</code> — a cancellation today would just be picking a "cancelled"-labeled entry from the generic status dropdown (01), with no automatic refund trigger, no stock-release logic, and no distinction from any other manual status edit.</div>
+    </div>
+
+    <div class="feature">
+      <div class="f-name">Refund/capture reflected back into an order-level payment status</div>
+      <span class="f-status partial">partial</span>
+      <div class="f-note">Same gap as 01's payment-status finding — <code>paymentStatus()</code> recomputes correctly from transactions when the admin page loads, but a refund doesn't push the order into a <code>refunded</code>/<code>partially-refunded</code> overall status the way Shopify's <code>displayFinancialStatus</code> does automatically.</div>
+    </div>
+  </section>
+
+  <section class="category">
+    <div class="cat-head">
+      <span class="cat-num">04</span>
+      <h2>Returns (RMA)</h2>
+    </div>
+    <p class="cat-note">The one area every researched platform treats as optional, not core.</p>
+
+    <div class="feature">
+      <div class="f-name">Return-merchandise-authorization flow (customer requests, staff approves)</div>
+      <span class="f-status missing">missing</span>
+      <div class="f-note">No <code>Return</code>/RMA model, status set, or request flow exists anywhere in this codebase. Consistent with the research: Shopify is the only platform of the four with this genuinely native; PrestaShop ships it off-by-default; Magento gates it behind the paid Adobe Commerce tier; WooCommerce lacks it entirely. Safe to treat as a real gap, not an urgent one.</div>
+    </div>
+
+    <div class="feature">
+      <div class="f-name">Return shipping label generation</div>
+      <span class="f-status missing">missing</span>
+      <div class="f-note">Depends entirely on the RMA flow above existing first — <code>CarrierFulfillmentInterface</code> already has the label-printing primitive (<code>printLabel()</code>) a return label would reuse, so the carrier-side plumbing isn't the blocker, the RMA request/approval model is.</div>
+    </div>
+  </section>
+
+  <section class="category">
+    <div class="cat-head">
+      <span class="cat-num">05</span>
+      <h2>Order editing</h2>
+    </div>
+    <p class="cat-note">Changing a placed order — and where every platform draws the line.</p>
+
+    <div class="feature">
+      <div class="f-name">Editing guardrails keyed to fulfillment state</div>
+      <span class="f-status missing">missing</span>
+      <div class="f-note">No line-item add/remove exists on a placed order at all today (unlike Shopify/Woo/PrestaShop, which all allow it up to some fulfillment-keyed cutoff, then force a return instead) — so there's no guardrail to speak of yet because there's no editing to guard. Whatever gets built here should key the cutoff to <code>Shipment</code> existing, per the pattern all four researched platforms converge on.</div>
+    </div>
+
+    <div class="feature">
+      <div class="f-name">Editable shipping/billing address after placement</div>
+      <span class="f-status missing">missing</span>
+      <div class="f-note"><code>OrderAddress</code> rows are snapshotted at creation (see Checkout survey, 02) and nothing in <code>ManageOrder</code> exposes editing them afterward — every platform researched treats address edits as lower-risk than line-item edits and allows them more freely; this codebase currently allows neither.</div>
+    </div>
+
+    <div class="feature">
+      <div class="f-name">Tag editing on a placed order</div>
+      <span class="f-status have">have</span>
+      <div class="f-note"><code>ManageOrder</code>'s <code>edit_tags</code> action already works — the one piece of native post-placement editing that exists today, via <code>HasTags</code> on the <code>Order</code> model.</div>
+    </div>
+  </section>
+
+  <section class="category">
+    <div class="cat-head">
+      <span class="cat-num">06</span>
+      <h2>Notes &amp; audit trail</h2>
+    </div>
+    <p class="cat-note">The one thing every researched platform treats as non-negotiable.</p>
+
+    <div class="feature">
+      <div class="f-name">Append-only change history (who changed what, when)</div>
+      <span class="f-status have">have</span>
+      <div class="f-note"><code>Order</code> already uses Spatie's <code>LogsActivity</code> trait — every save is recorded with a diff, same underlying mechanism already relied on elsewhere in this codebase (staff activity log, translation history). Structurally equivalent to PrestaShop's <code>order_history</code> table, just via a different package.</div>
+    </div>
+
+    <div class="feature">
+      <div class="f-name">Internal staff notes, separate from system-generated log entries</div>
+      <span class="f-status missing">missing</span>
+      <div class="f-note">The activity log above captures field changes automatically, but there's no free-text "leave a note for the next person" field — every platform researched has this as a distinct feed from the automatic history (Woo's Order Notes, Shopify's Timeline comments, Magento's Comments History), usually with a private-vs-customer-visible toggle. Nothing here yet.</div>
+    </div>
+
+    <div class="feature">
+      <div class="f-name">Customer-visible note-to-customer, sent as a message</div>
+      <span class="f-status missing">missing</span>
+      <div class="f-note">Depends on both the internal-notes feature above and a working mailer (01/02) — genuinely blocked on more foundational gaps, not just unbuilt on its own.</div>
+    </div>
+  </section>
+
+  <footer class="page">
+    <span>Compiled 2026-09-01 — sources cited inline; <code>vendor/lunarphp/lunar</code> and this codebase's own <code>src/</code> reads are marked by file/class name, Shopify/WooCommerce/PrestaShop/Magento claims are marked "Research."</span>
+    <span>boboko-core / docs</span>
+  </footer>
+
+</div>
diff --git a/docs/scratch/payments-feature-survey.html b/docs/scratch/payments-feature-survey.html
new file mode 100644
index 0000000..cb29969
--- /dev/null
+++ b/docs/scratch/payments-feature-survey.html
@@ -0,0 +1,448 @@
+<title>Payments Feature Survey</title>
+<meta name="viewport" content="width=device-width, initial-scale=1" />
+<link rel="preconnect" href="https://fonts.googleapis.com" />
+<link rel="preconnect" href="https://fonts.gstatic.com" crossorigin />
+<link href="https://fonts.googleapis.com/css2?family=Fraunces:opsz,wght@9..144,400;9..144,500;9..144,600;9..144,700&family=IBM+Plex+Sans:wght@400;500;600&family=IBM+Plex+Mono:wght@400;500&display=swap" rel="stylesheet" />
+
+<style>
+  :root {
+    --paper: #FAFAF7;
+    --ink: #1C1C1A;
+    --muted: #6B6B63;
+    --accent: #2F5D50;
+    --accent-soft: #E4EDE9;
+    --good: #3F7A5C;
+    --good-soft: #E6F0EA;
+    --warn: #B8863B;
+    --warn-soft: #F5ECDC;
+    --miss: #A14B3B;
+    --miss-soft: #F5E5E0;
+    --hairline: #E4E2DB;
+    --card: #FFFFFF;
+  }
+
+  @media (prefers-color-scheme: dark) {
+    :root:not([data-theme="light"]) {
+      --paper: #17181A;
+      --ink: #EDEBE4;
+      --muted: #9B9A91;
+      --accent: #6FAE97;
+      --accent-soft: #1E2C27;
+      --good: #6FAE97;
+      --good-soft: #1C2B22;
+      --warn: #D8A85C;
+      --warn-soft: #2E2718;
+      --miss: #D97F68;
+      --miss-soft: #2E1F1A;
+      --hairline: #2C2D2E;
+      --card: #1D1F20;
+    }
+  }
+
+  :root[data-theme="dark"] {
+    --paper: #17181A;
+    --ink: #EDEBE4;
+    --muted: #9B9A91;
+    --accent: #6FAE97;
+    --accent-soft: #1E2C27;
+    --good: #6FAE97;
+    --good-soft: #1C2B22;
+    --warn: #D8A85C;
+    --warn-soft: #2E2718;
+    --miss: #D97F68;
+    --miss-soft: #2E1F1A;
+    --hairline: #2C2D2E;
+    --card: #1D1F20;
+  }
+
+  * { box-sizing: border-box; }
+
+  body {
+    background: var(--paper);
+    color: var(--ink);
+    font-family: "IBM Plex Sans", ui-sans-serif, system-ui, sans-serif;
+    font-size: 16px;
+    line-height: 1.55;
+    -webkit-font-smoothing: antialiased;
+  }
+
+  .page {
+    max-width: 780px;
+    margin: 0 auto;
+    padding: 72px 24px 96px;
+  }
+
+  header.masthead {
+    margin-bottom: 56px;
+  }
+
+  .eyebrow {
+    font-family: "IBM Plex Mono", ui-monospace, monospace;
+    font-size: 12.5px;
+    letter-spacing: 0.08em;
+    text-transform: uppercase;
+    color: var(--accent);
+    margin: 0 0 18px;
+  }
+
+  h1 {
+    font-family: "Fraunces", Georgia, serif;
+    font-weight: 600;
+    font-size: clamp(30px, 5vw, 40px);
+    line-height: 1.18;
+    letter-spacing: -0.01em;
+    margin: 0 0 18px;
+    text-wrap: balance;
+    max-width: 22ch;
+  }
+
+  .dek {
+    color: var(--muted);
+    font-size: 16.5px;
+    max-width: 62ch;
+    margin: 0 0 28px;
+  }
+
+  .summary-strip {
+    display: flex;
+    gap: 10px;
+    flex-wrap: wrap;
+    padding-top: 22px;
+    border-top: 1px solid var(--hairline);
+  }
+
+  .summary-pill {
+    font-family: "IBM Plex Mono", ui-monospace, monospace;
+    font-size: 12.5px;
+    padding: 6px 12px;
+    border-radius: 999px;
+    display: flex;
+    align-items: baseline;
+    gap: 6px;
+  }
+  .summary-pill b { font-size: 13.5px; }
+  .summary-pill.have { background: var(--good-soft); color: var(--good); }
+  .summary-pill.partial { background: var(--warn-soft); color: var(--warn); }
+  .summary-pill.missing { background: var(--miss-soft); color: var(--miss); }
+
+  section.category {
+    margin-bottom: 52px;
+  }
+
+  .category-head {
+    display: flex;
+    gap: 16px;
+    align-items: baseline;
+    margin-bottom: 6px;
+  }
+
+  .numeral {
+    font-family: "Fraunces", Georgia, serif;
+    font-weight: 500;
+    font-size: 15px;
+    color: var(--accent);
+    font-variant-numeric: tabular-nums;
+    flex: none;
+    width: 2ch;
+  }
+
+  h2 {
+    font-family: "Fraunces", Georgia, serif;
+    font-weight: 600;
+    font-size: 22px;
+    margin: 0;
+    letter-spacing: -0.01em;
+  }
+
+  .category-note {
+    color: var(--muted);
+    font-size: 14.5px;
+    margin: 0 0 22px 34px;
+    max-width: 58ch;
+  }
+
+  .rows {
+    margin-left: 34px;
+    border-top: 1px solid var(--hairline);
+  }
+
+  .row {
+    padding: 16px 0;
+    border-bottom: 1px solid var(--hairline);
+  }
+
+  .row-head {
+    display: flex;
+    justify-content: space-between;
+    align-items: center;
+    gap: 16px;
+  }
+
+  .feature-name {
+    font-weight: 500;
+    font-size: 15.5px;
+  }
+
+  .chip {
+    font-family: "IBM Plex Mono", ui-monospace, monospace;
+    font-size: 11.5px;
+    letter-spacing: 0.04em;
+    text-transform: uppercase;
+    padding: 3px 10px;
+    border-radius: 999px;
+    flex: none;
+    white-space: nowrap;
+  }
+  .chip.have { background: var(--good-soft); color: var(--good); }
+  .chip.partial { background: var(--warn-soft); color: var(--warn); }
+  .chip.missing { background: var(--miss-soft); color: var(--miss); }
+
+  .grounding {
+    color: var(--muted);
+    font-size: 13.5px;
+    margin-top: 6px;
+    line-height: 1.5;
+    max-width: 64ch;
+  }
+
+  code {
+    font-family: "IBM Plex Mono", ui-monospace, monospace;
+    font-size: 12.5px;
+    background: var(--accent-soft);
+    color: var(--accent);
+    padding: 1px 5px;
+    border-radius: 4px;
+  }
+
+  footer {
+    margin-top: 64px;
+    padding-top: 24px;
+    border-top: 1px solid var(--hairline);
+    color: var(--muted);
+    font-size: 13px;
+  }
+
+  footer .compiled {
+    font-family: "IBM Plex Mono", ui-monospace, monospace;
+    font-size: 12px;
+    margin-bottom: 10px;
+  }
+
+  footer p {
+    margin: 0 0 8px;
+    max-width: 62ch;
+  }
+
+  footer p:last-child { margin-bottom: 0; }
+
+  @media (max-width: 560px) {
+    .category-note, .rows { margin-left: 0; }
+    .category-head { gap: 10px; }
+  }
+</style>
+
+<div class="page">
+
+  <header class="masthead">
+    <p class="eyebrow">boboko-core &middot; competitive gap survey &middot; 03</p>
+    <h1>What payments elsewhere can do that boboko can't yet</h1>
+    <p class="dek">
+      Lunar's payment layer (<code>Lunar\Facades\Payments</code>, <code>Transaction</code>, the offline
+      driver) is wired for a single "pay on delivery / bank transfer" flow. Everything downstream of
+      that — cards, wallets, saved methods, self-service refunds, retries — is either scaffolded in
+      Lunar core and unused here, or absent from the stack entirely. This is a research survey, not a
+      build plan.
+    </p>
+    <div class="summary-strip">
+      <span class="summary-pill have"><b>4</b> have</span>
+      <span class="summary-pill partial"><b>9</b> partial</span>
+      <span class="summary-pill missing"><b>14</b> missing</span>
+    </div>
+  </header>
+
+  <section class="category">
+    <div class="category-head">
+      <span class="numeral">01</span>
+      <h2>Payment method breadth</h2>
+    </div>
+    <p class="category-note">boboko currently ships one payment type: cash-in-hand via the offline driver. Every card/wallet/BNPL path below is theoretically pluggable but has zero live implementation.</p>
+    <div class="rows">
+
+      <div class="row">
+        <div class="row-head"><span class="feature-name">Offline / pay-on-account</span><span class="chip have">have</span></div>
+        <div class="grounding">The only configured type in <code>config/lunar/payments.php</code> (3dealer's published copy): <code>'cash-in-hand' => ['driver' => 'offline', 'authorized' => 'payment-offline']</code>, backed by <code>Lunar\PaymentTypes\OfflinePayment</code>.</div>
+      </div>
+
+      <div class="row">
+        <div class="row-head"><span class="feature-name">Card payments (Stripe/other gateway)</span><span class="chip missing">missing</span></div>
+        <div class="grounding"><code>lunarphp/stripe</code> is not present in either <code>boboko-core/vendor/lunarphp</code> or <code>3dealer/vendor/lunarphp</code>, and not listed in either <code>composer.json</code>. <code>docs/lunar.md</code>'s Stripe section documents Lunar's general capability, not something wired into this project.</div>
+      </div>
+
+      <div class="row">
+        <div class="row-head"><span class="feature-name">Digital wallets (Apple Pay, Google Pay, Shop Pay)</span><span class="chip missing">missing</span></div>
+        <div class="grounding">Depends entirely on a card gateway (Stripe Payment Request Button or similar) that isn't installed. Shopify bundles Apple Pay, Google Pay, and Shop Pay as one-tap checkout by default.</div>
+      </div>
+
+      <div class="row">
+        <div class="row-head"><span class="feature-name">Buy-now-pay-later (Klarna, Afterpay, Affirm)</span><span class="chip missing">missing</span></div>
+        <div class="grounding">No BNPL driver or config entry anywhere in the repo. Shopify bundles Klarna natively in eligible regions with Pay-in-4, Pay-Later, and financing tiers; WooCommerce and PrestaShop both offer it as installable gateway plugins.</div>
+      </div>
+
+      <div class="row">
+        <div class="row-head"><span class="feature-name">Bank transfer / open banking (SEPA, Pay by Bank)</span><span class="chip missing">missing</span></div>
+        <div class="grounding">Not represented as a distinct payment type; only the generic cash-in-hand offline flow exists, which is manual reconciliation rather than an automated bank-transfer rail.</div>
+      </div>
+
+      <div class="row">
+        <div class="row-head"><span class="feature-name">Crypto / stablecoin checkout</span><span class="chip missing">missing</span></div>
+        <div class="grounding">No driver, no research finding of it being used in this stack. Industry-wide it's still marginal — stablecoin payment volume is roughly 0.02% of global payments in 2026 per Nuvei's trend report — so this is low-priority even elsewhere.</div>
+      </div>
+
+      <div class="row">
+        <div class="row-head"><span class="feature-name">Pluggable driver architecture for adding methods</span><span class="chip have">have</span></div>
+        <div class="grounding"><code>Lunar\Managers\PaymentManager</code> extends Laravel's <code>Manager</code>; <code>Payments::extend('custom', fn ($app) => ...)</code> registers a new driver, and any class extending <code>Lunar\PaymentTypes\AbstractPayment</code> implementing <code>authorize()</code>/<code>capture()</code>/<code>refund()</code> plugs in. The scaffolding is solid — nothing beyond offline is plugged into it yet.</div>
+      </div>
+
+    </div>
+  </section>
+
+  <section class="category">
+    <div class="category-head">
+      <span class="numeral">02</span>
+      <h2>Capture, refund &amp; transaction lifecycle</h2>
+    </div>
+    <p class="category-note">The core primitives (intent/capture/refund, partial amounts, transaction chaining) exist in Lunar and are exposed in the Filament admin — but nothing calls them outside cash-in-hand, and none of it is customer-facing.</p>
+    <div class="rows">
+
+      <div class="row">
+        <div class="row-head"><span class="feature-name">Authorize / capture / refund contract</span><span class="chip have">have</span></div>
+        <div class="grounding"><code>Lunar\Base\PaymentTypeInterface</code> defines <code>authorize()</code>, <code>capture(Transaction $t, $amount)</code>, <code>refund(Transaction $t, int $amount, $notes)</code>; <code>Transaction::capture()</code>/<code>refund()</code> forward to the transaction's own <code>driver()</code> via <code>Payments::driver($this->driver)</code>.</div>
+      </div>
+
+      <div class="row">
+        <div class="row-head"><span class="feature-name">Manual vs. automatic capture policy</span><span class="chip partial">partial</span></div>
+        <div class="grounding">The interface supports separate authorize/capture steps (intent vs. capture transaction types), but <code>OfflinePayment::capture()</code> just returns <code>new PaymentCapture(true)</code> unconditionally — there's no real deferred-capture gateway wired up to exercise the distinction.</div>
+      </div>
+
+      <div class="row">
+        <div class="row-head"><span class="feature-name">Partial capture</span><span class="chip partial">partial</span></div>
+        <div class="grounding">Admin Filament action passes an arbitrary <code>$data['amount']</code> to <code>$transaction->capture(bcmul($data['amount'], $record->currency->factor))</code> in <code>ManageOrder.php</code> — the plumbing supports partial amounts, but only staff can trigger it, and only against a real (non-offline) driver would it mean anything.</div>
+      </div>
+
+      <div class="row">
+        <div class="row-head"><span class="feature-name">Partial / staged refunds</span><span class="chip have">have</span></div>
+        <div class="grounding">Same file: the "refund" Filament action computes <code>$response = $transaction->refund(bcmul($data['amount'], ...), $data['notes'])</code>, and <code>isPartiallyRefunded()</code> / order status logic (<code>partial-refund</code>, <code>refunded</code>) compares <code>refundTotal</code> against <code>captureTotal</code>/<code>intentTotal</code>. This genuinely works today through the offline driver's no-op <code>refund()</code>.</div>
+      </div>
+
+      <div class="row">
+        <div class="row-head"><span class="feature-name">Multiple payment attempts per order</span><span class="chip partial">partial</span></div>
+        <div class="grounding"><code>Transaction.parent_transaction_id</code> chains captures to intents and refunds to captures, and nothing in the model stops multiple transaction rows per order — but no code path in this repo actually retries a failed attempt with a second transaction; it's schema support, not a driven flow.</div>
+      </div>
+
+      <div class="row">
+        <div class="row-head"><span class="feature-name">Transaction audit trail</span><span class="chip have">have</span></div>
+        <div class="grounding"><code>Lunar\Observers\TransactionObserver::created()</code> logs every transaction (amount, type, status, card_type, last_four, reference, notes) via Spatie activity log automatically — this is real and unconditional, independent of driver.</div>
+      </div>
+
+      <div class="row">
+        <div class="row-head"><span class="feature-name">Webhook handling for async payment events</span><span class="chip missing">missing</span></div>
+        <div class="grounding">Lunar's Stripe package registers a <code>stripe/webhook</code> route, but that package isn't installed here, so there is no webhook endpoint of any kind in this project today.</div>
+      </div>
+
+      <div class="row">
+        <div class="row-head"><span class="feature-name">Payment attempt events for downstream hooks</span><span class="chip have">have</span></div>
+        <div class="grounding"><code>Lunar\Events\PaymentAttemptEvent</code> is dispatched from <code>OfflinePayment::authorize()</code> with the resulting <code>PaymentAuthorize</code> DTO — a real, listenable event, though only one driver currently fires it.</div>
+      </div>
+
+    </div>
+  </section>
+
+  <section class="category">
+    <div class="category-head">
+      <span class="numeral">03</span>
+      <h2>Customer-facing payment experience</h2>
+    </div>
+    <p class="category-note">Everything a shopper would touch directly — saved cards, one-click repeat purchase, self-service refunds — is absent. Lunar's payment layer is staff/checkout-oriented, not account-oriented.</p>
+    <div class="rows">
+
+      <div class="row">
+        <div class="row-head"><span class="feature-name">Saved payment methods on customer account</span><span class="chip missing">missing</span></div>
+        <div class="grounding">No vault/tokenization model exists anywhere in <code>Lunar\Models</code> — no <code>PaymentMethod</code>/<code>Card</code> model, no field on <code>Customer</code>. 2026 trend research (Nuvei, Checkout.com) treats network-tokenized saved cards as baseline for one-click checkout.</div>
+      </div>
+
+      <div class="row">
+        <div class="row-head"><span class="feature-name">One-click repeat purchase</span><span class="chip missing">missing</span></div>
+        <div class="grounding">Depends on saved payment methods, which don't exist. No "reorder" or "buy again" affordance found in boboko-core or 3dealer.</div>
+      </div>
+
+      <div class="row">
+        <div class="row-head"><span class="feature-name">Customer self-service refund requests</span><span class="chip missing">missing</span></div>
+        <div class="grounding">The only refund entry point is the Filament staff action in <code>ManageOrder.php</code> (<code>Actions\Action::make('refund')</code>), gated behind admin auth. WooCommerce/PrestaShop ecosystems commonly expose a customer-initiated return/refund request flow; nothing equivalent exists here.</div>
+      </div>
+
+      <div class="row">
+        <div class="row-head"><span class="feature-name">Split / partial payment plans (pay-in-installments at checkout)</span><span class="chip missing">missing</span></div>
+        <div class="grounding">Distinct from BNPL-as-a-gateway: this is a native "split into N charges" checkout option, seen as marketplace split-payment modules in the PrestaShop ecosystem. No equivalent concept in Lunar's cart/order/payment pipeline.</div>
+      </div>
+
+      <div class="row">
+        <div class="row-head"><span class="feature-name">3D Secure / SCA authentication</span><span class="chip missing">missing</span></div>
+        <div class="grounding">3DS is a property of the card gateway integration (e.g. Stripe PaymentIntents), which isn't installed. WooPayments explicitly advertises 3DS/SCA compatibility with visible card-brand + last-four confirmation as a baseline expectation in 2026.</div>
+      </div>
+
+      <div class="row">
+        <div class="row-head"><span class="feature-name">Fraud detection / risk scoring</span><span class="chip missing">missing</span></div>
+        <div class="grounding">No fraud-scoring hook in <code>PaymentTypeInterface</code> or the offline driver. <code>getPaymentChecks()</code> exists as an extension point (<code>Lunar\Base\DataTransferObjects\PaymentChecks</code>, an iterable of pass/fail <code>PaymentCheck</code> DTOs) but <code>AbstractPayment::getPaymentChecks()</code> just returns an empty collection — real fraud tooling (Stripe Radar-style) isn't behind it.</div>
+      </div>
+
+      <div class="row">
+        <div class="row-head"><span class="feature-name">Payment check / validation extension point</span><span class="chip partial">partial</span></div>
+        <div class="grounding"><code>Transaction::paymentChecks()</code> → driver's <code>getPaymentChecks($transaction)</code> is real, typed infrastructure for surfacing checks (e.g. "AVS matched") in the admin UI — but the default implementation is a no-op, so nothing populates it today.</div>
+      </div>
+
+    </div>
+  </section>
+
+  <section class="category">
+    <div class="category-head">
+      <span class="numeral">04</span>
+      <h2>Currency, subscriptions &amp; recurring billing</h2>
+    </div>
+    <p class="category-note">Lunar's multi-currency model covers pricing display, not multi-currency payment settlement; recurring billing/dunning has no representation at all.</p>
+    <div class="rows">
+
+      <div class="row">
+        <div class="row-head"><span class="feature-name">Multi-currency pricing display</span><span class="chip have">have</span></div>
+        <div class="grounding"><code>Lunar\Models\Currency</code> (code, exchange_rate, decimal_places, default) with <code>sync_prices</code>-gated conversion, documented in <code>docs/lunar.md</code> "Channels and Currencies" — this is genuinely wired, cart/pricing layer already uses it.</div>
+      </div>
+
+      <div class="row">
+        <div class="row-head"><span class="feature-name">Multi-currency payment processing (charge in customer's currency)</span><span class="chip partial">partial</span></div>
+        <div class="grounding">Pricing can display and calculate in any configured currency, but no payment driver in this project actually settles a charge — so whether a real gateway would charge in-currency is untested; the pricing half is there, the processing half isn't proven.</div>
+      </div>
+
+      <div class="row">
+        <div class="row-head"><span class="feature-name">Recurring billing / subscriptions</span><span class="chip missing">missing</span></div>
+        <div class="grounding">No subscription model, no recurring-charge scheduler anywhere in <code>Lunar\Models</code> or boboko-core. This is a one-time-purchase order/cart model end to end.</div>
+      </div>
+
+      <div class="row">
+        <div class="row-head"><span class="feature-name">Failed-payment retry / dunning</span><span class="chip missing">missing</span></div>
+        <div class="grounding">No retry scheduling, no dunning email sequence, no soft-decline handling anywhere in the payment layer — there's nothing to retry against since there's no recurring billing and no live gateway. WooPayments' dunning (1-3 day delayed retry on soft declines) is the comparison point.</div>
+      </div>
+
+      <div class="row">
+        <div class="row-head"><span class="feature-name">PCI compliance / tokenized card storage</span><span class="chip missing">missing</span></div>
+        <div class="grounding">No card data is collected or stored anywhere in this codebase (offline driver never touches card fields), so there's no PCI-scope exposure today — but also no tokenized-vault capability to build saved cards or 3DS on top of when a real gateway is added.</div>
+      </div>
+
+    </div>
+  </section>
+
+  <footer>
+    <p class="compiled">Compiled 2026-08-28 &middot; boboko-core / docs</p>
+    <p>Section 01 (driver architecture) and section 02 (transaction lifecycle, refund/capture, observer, events) are grounded in direct reads of <code>vendor/lunarphp/core/src/{Managers,PaymentTypes,Models,Observers,Events,Base}</code> and <code>vendor/lunarphp/lunar/src/Filament/Resources/OrderResource/Pages/ManageOrder.php</code>, plus the published <code>config/lunar/payments.php</code> in 3dealer — not from <code>docs/lunar.md</code> alone, which was cross-checked and found to describe Lunar's general Stripe capability rather than anything installed in this project.</p>
+    <p>Sections 03 and 04, and the competitive framing throughout, draw on 2026 web research covering Shopify, WooCommerce/WooPayments, and PrestaShop payment modules, plus general industry trend reporting (Nuvei, Checkout.com, Mastercard). Those claims are marked by comparison language ("Shopify bundles...", "WooPayments advertises...") rather than citation to this repo.</p>
+  </footer>
+
+</div>
diff --git a/docs/scratch/privacy-feature-survey.html b/docs/scratch/privacy-feature-survey.html
new file mode 100644
index 0000000..a5dfe97
--- /dev/null
+++ b/docs/scratch/privacy-feature-survey.html
@@ -0,0 +1,492 @@
+<title>Privacy Feature Survey</title>
+<style>
+  :root {
+    --paper: #FAFAF7;
+    --ink: #1C1C1A;
+    --muted: #6B6B63;
+    --accent: #2F5D50;
+    --accent-soft: #E4EDE9;
+    --good: #3F7A5C;
+    --good-soft: #E6F0EA;
+    --warn: #B8863B;
+    --warn-soft: #F5ECDC;
+    --miss: #A14B3B;
+    --miss-soft: #F5E5E0;
+    --hairline: #E4E2DB;
+    --card: #FFFFFF;
+  }
+
+  :root:not([data-theme="light"]) {
+    @media (prefers-color-scheme: dark) {
+      --paper: #17181A;
+      --ink: #EDEBE4;
+      --muted: #9B9A90;
+      --accent: #7FBFA8;
+      --accent-soft: #1E2C27;
+      --good: #6FBF97;
+      --good-soft: #1B2A22;
+      --warn: #D9A85C;
+      --warn-soft: #2C2418;
+      --miss: #D97C68;
+      --miss-soft: #2E1E1A;
+      --hairline: #2C2D2E;
+      --card: #1E1F21;
+    }
+  }
+
+  :root[data-theme="dark"] {
+    --paper: #17181A;
+    --ink: #EDEBE4;
+    --muted: #9B9A90;
+    --accent: #7FBFA8;
+    --accent-soft: #1E2C27;
+    --good: #6FBF97;
+    --good-soft: #1B2A22;
+    --warn: #D9A85C;
+    --warn-soft: #2C2418;
+    --miss: #D97C68;
+    --miss-soft: #2E1E1A;
+    --hairline: #2C2D2E;
+    --card: #1E1F21;
+  }
+
+  * { box-sizing: border-box; }
+
+  body {
+    background: var(--paper);
+    color: var(--ink);
+    font-family: "IBM Plex Sans", ui-sans-serif, system-ui, sans-serif;
+    font-size: 15.5px;
+    line-height: 1.55;
+    margin: 0;
+    padding: 4.5rem 1.5rem 6rem;
+  }
+
+  .wrap {
+    max-width: 780px;
+    margin: 0 auto;
+  }
+
+  header.page {
+    margin-bottom: 3.25rem;
+  }
+
+  .eyebrow {
+    font-family: "IBM Plex Mono", ui-monospace, monospace;
+    font-size: 0.72rem;
+    letter-spacing: 0.12em;
+    text-transform: uppercase;
+    color: var(--accent);
+    margin-bottom: 0.9rem;
+  }
+
+  h1 {
+    font-family: "Fraunces", Georgia, serif;
+    font-weight: 560;
+    font-size: clamp(2.1rem, 4.5vw, 2.65rem);
+    line-height: 1.08;
+    letter-spacing: -0.01em;
+    margin: 0 0 0.9rem;
+    text-wrap: balance;
+  }
+
+  .dek {
+    color: var(--muted);
+    max-width: 60ch;
+    font-size: 1.02rem;
+  }
+
+  .dek strong {
+    color: var(--ink);
+    font-weight: 600;
+  }
+
+  .legend {
+    display: flex;
+    flex-wrap: wrap;
+    gap: 0.6rem;
+    margin-top: 1.6rem;
+  }
+
+  .chip {
+    display: inline-flex;
+    align-items: center;
+    gap: 0.4rem;
+    font-family: "IBM Plex Mono", ui-monospace, monospace;
+    font-size: 0.72rem;
+    letter-spacing: 0.04em;
+    padding: 0.28rem 0.6rem;
+    border-radius: 3px;
+  }
+
+  .chip.have { background: var(--good-soft); color: var(--good); }
+  .chip.partial { background: var(--warn-soft); color: var(--warn); }
+  .chip.missing { background: var(--miss-soft); color: var(--miss); }
+
+  .branch-note {
+    margin-top: 1.4rem;
+    padding: 0.85rem 1rem;
+    background: var(--accent-soft);
+    border-radius: 4px;
+    font-size: 0.86rem;
+    color: var(--ink);
+    max-width: 66ch;
+  }
+
+  .branch-note code {
+    font-family: "IBM Plex Mono", ui-monospace, monospace;
+    font-size: 0.85em;
+    color: var(--accent);
+  }
+
+  section.category {
+    margin-top: 3rem;
+  }
+
+  .cat-head {
+    display: flex;
+    align-items: baseline;
+    gap: 0.85rem;
+    border-bottom: 1px solid var(--hairline);
+    padding-bottom: 0.7rem;
+    margin-bottom: 1.1rem;
+  }
+
+  .cat-num {
+    font-family: "Fraunces", Georgia, serif;
+    font-size: 1.05rem;
+    color: var(--accent);
+    font-variant-numeric: tabular-nums;
+    min-width: 1.6rem;
+  }
+
+  .cat-head h2 {
+    font-family: "Fraunces", Georgia, serif;
+    font-weight: 500;
+    font-size: 1.28rem;
+    margin: 0;
+    letter-spacing: -0.005em;
+  }
+
+  .cat-note {
+    color: var(--muted);
+    font-size: 0.86rem;
+    margin: 0 0 1.2rem;
+    max-width: 62ch;
+  }
+
+  .feature {
+    display: grid;
+    grid-template-columns: 1fr auto;
+    gap: 0.3rem 1rem;
+    padding: 1.05rem 0;
+    border-bottom: 1px solid var(--hairline);
+    align-items: start;
+  }
+
+  .feature:last-child { border-bottom: none; }
+
+  .f-name {
+    font-weight: 600;
+    font-size: 0.98rem;
+  }
+
+  .f-status {
+    font-family: "IBM Plex Mono", ui-monospace, monospace;
+    font-size: 0.68rem;
+    letter-spacing: 0.06em;
+    text-transform: uppercase;
+    padding: 0.22rem 0.55rem;
+    border-radius: 3px;
+    white-space: nowrap;
+    height: fit-content;
+  }
+
+  .f-status.have { background: var(--good-soft); color: var(--good); }
+  .f-status.partial { background: var(--warn-soft); color: var(--warn); }
+  .f-status.missing { background: var(--miss-soft); color: var(--miss); }
+
+  .f-note {
+    grid-column: 1 / -1;
+    color: var(--muted);
+    font-size: 0.87rem;
+    margin-top: 0.15rem;
+    max-width: 66ch;
+  }
+
+  .f-note code {
+    font-family: "IBM Plex Mono", ui-monospace, monospace;
+    font-size: 0.82em;
+    background: var(--accent-soft);
+    color: var(--accent);
+    padding: 0.08em 0.35em;
+    border-radius: 3px;
+  }
+
+  footer.page {
+    margin-top: 4rem;
+    padding-top: 1.5rem;
+    border-top: 1px solid var(--hairline);
+    color: var(--muted);
+    font-size: 0.82rem;
+    display: flex;
+    justify-content: space-between;
+    gap: 1rem;
+    flex-wrap: wrap;
+  }
+
+  footer.page a { color: var(--accent); }
+
+  @media (max-width: 560px) {
+    body { padding: 3rem 1.1rem 4rem; }
+    .feature { grid-template-columns: 1fr; }
+    .f-status { justify-self: start; }
+  }
+</style>
+<link rel="stylesheet" href="https://fonts.googleapis.com/css2?family=Fraunces:opsz,wght@9..144,400..600&family=IBM+Plex+Sans:wght@400;500;600&family=IBM+Plex+Mono:wght@400;500&display=swap">
+
+<div class="wrap">
+
+  <header class="page">
+    <div class="eyebrow">boboko / privacy &amp; compliance · competitive survey</div>
+    <h1>What privacy &amp; compliance elsewhere can do that boboko can't yet</h1>
+    <p class="dek">
+      A feature-by-feature pass across GDPR/CCPA compliance tooling used by Shopify,
+      WooCommerce, and dedicated consent-management platforms — sourced, not recalled
+      from memory — checked against <strong>master</strong> and the substantial,
+      unmerged <strong><code>Privacy</code> branch</strong> ("Feature: Creating Privacy
+      Basics") already built in this repo. For deciding what to finish and merge
+      next, not a build order.
+    </p>
+    <div class="legend">
+      <span class="chip have">● have</span>
+      <span class="chip partial">◐ partial</span>
+      <span class="chip missing">○ missing</span>
+    </div>
+    <div class="branch-note">
+      Most "partial" rows below are fully coded on the unmerged <code>Privacy</code>
+      branch (53 files, +3127/&#8209;24 across two commits: <code>9f540cb</code>,
+      <code>59303cf</code>) but not on <code>master</code> — treated as partial, not
+      have, until it merges. <code>boboko:anonymize</code> is the one privacy-adjacent
+      command that already lives on <code>master</code> today.
+    </div>
+  </header>
+
+  <section class="category">
+    <div class="cat-head">
+      <span class="cat-num">01</span>
+      <h2>Right of access &amp; erasure</h2>
+    </div>
+    <p class="cat-note">GDPR Art. 15 (access) and Art. 17 (erasure) — the two rights every DSAR tool is built around.</p>
+
+    <div class="feature">
+      <div class="f-name">Data export request (right of access)</div>
+      <span class="f-status partial">partial</span>
+      <div class="f-note">On <code>Privacy</code> branch only: <code>PrivacyService::requestExportForCustomer()/requestExportForUser()</code> queue <code>ExportDataSubjectJob</code>, which gathers every registered provider's data and writes a CSV-per-provider zip via <code>WriteExportToCsvListener</code>. Not on <code>master</code>.</div>
+    </div>
+
+    <div class="feature">
+      <div class="f-name">Data erasure request (right to be forgotten)</div>
+      <span class="f-status partial">partial</span>
+      <div class="f-note">On <code>Privacy</code> branch only: <code>PrivacyService::requestErasureForCustomer()/requestErasureForUser()</code>, extensible via <code>config('core.privacy.providers')</code> — the same config-array-registration pattern as <code>NotificationRegistry</code>, keyed off <code>Modules\Core\Privacy\Contracts\PersonalDataProvider</code>.</div>
+    </div>
+
+    <div class="feature">
+      <div class="f-name">Cancellable grace period before erasure</div>
+      <span class="f-status partial">partial</span>
+      <div class="f-note">On <code>Privacy</code> branch only: 30-day default (<code>core.privacy.grace_period_days</code>), reverted automatically on login via <code>CancelErasureOnLoginListener</code> — same pattern Shopify's own account-deletion flow uses. No native platform documents this as a first-party primitive; it's usually left to a third-party app.</div>
+    </div>
+
+    <div class="feature">
+      <div class="f-name">Immediate erasure for regulator/legal requests</div>
+      <span class="f-status partial">partial</span>
+      <div class="f-note">On <code>Privacy</code> branch only: <code>requestImmediateErasureForCustomer()/ForUser()</code>, typed to accept only <code>Staff $requestedBy</code> so a self-service path cannot reach it even by accident.</div>
+    </div>
+
+    <div class="feature">
+      <div class="f-name">Multi-tenant erasure scoping (business account vs. individual login)</div>
+      <span class="f-status partial">partial</span>
+      <div class="f-note">On <code>Privacy</code> branch only, and a genuinely uncommon feature: <code>PrivacyService</code> splits every operation into Customer-scope vs. User-scope, plus a sole-owner cascade (<code>CascadeCustomerErasureListener</code>) when erasing the last linked User orphans a Customer. No researched competitor product handles B2B multi-seat erasure this explicitly.</div>
+    </div>
+
+    <div class="feature">
+      <div class="f-name">Right to rectification (self-service data correction)</div>
+      <span class="f-status missing">missing</span>
+      <div class="f-note">No dedicated flow found on either branch — Art. 16 is generally satisfied today only incidentally, by a customer editing their own profile/address through existing account forms, not a tracked rectification request.</div>
+    </div>
+
+    <div class="feature">
+      <div class="f-name">Dummy data anonymization for local dev</div>
+      <span class="f-status have">have</span>
+      <div class="f-note">On <code>master</code>: <code>src/Command/AnonymizeCommand.php</code> (<code>boboko:anonymize</code>) — scrubs <code>users</code>/<code>lunar_customers</code>, environment-guarded to <code>local</code> only. Distinct from GDPR erasure; the <code>Privacy</code> branch README diff explicitly flags this is <strong>not</strong> the compliance tool.</div>
+    </div>
+  </section>
+
+  <section class="category">
+    <div class="cat-head">
+      <span class="cat-num">02</span>
+      <h2>Anonymization, pseudonymization &amp; retention</h2>
+    </div>
+    <p class="cat-note">Deletion isn't the only lawful outcome — these are three different operations, often confused with each other.</p>
+
+    <div class="feature">
+      <div class="f-name">Legal-retention pseudonymization (orders/invoices)</div>
+      <span class="f-status partial">partial</span>
+      <div class="f-note">On <code>Privacy</code> branch only: <code>OrderDataProvider::eraseForCustomer()</code> clears PII fields but keeps order rows/totals/tax data intact, citing GDPR Art. 17(3)(b)'s legal-obligation exception — reports <code>ErasureOutcome::Pseudonymized</code>, not <code>Erased</code>, distinctly.</div>
+    </div>
+
+    <div class="feature">
+      <div class="f-name">Per-provider retention policy, owned by the data's own module</div>
+      <span class="f-status partial">partial</span>
+      <div class="f-note">On <code>Privacy</code> branch only: <code>PersonalDataProvider</code> deliberately has no central taxonomy — each provider (<code>CustomerDataProvider</code>, <code>AddressDataProvider</code>, <code>OrderDataProvider</code>, <code>CartDataProvider</code>, <code>ReviewDataProvider</code>) decides erase vs. pseudonymize vs. skip for its own table. <code>docs/privacy.md</code> flags <code>ReviewDataProvider</code>'s scope choice as needing review before relying on it.</div>
+    </div>
+
+    <div class="feature">
+      <div class="f-name">Automatic data retention / auto-deletion after N days</div>
+      <span class="f-status missing">missing</span>
+      <div class="f-note">Neither branch has a scheduled sweep that erases stale data on its own — every erasure on the <code>Privacy</code> branch is triggered by an explicit request, not a retention-policy timer (e.g. "delete guest carts after 2 years," "purge OTP logs after 90 days").</div>
+    </div>
+
+    <div class="feature">
+      <div class="f-name">Audit trail of what was erased/exported and why</div>
+      <span class="f-status partial">partial</span>
+      <div class="f-note">On <code>Privacy</code> branch only: <code>DataErasureRequest.report</code> stores the full per-provider outcome as a snapshot (not a live lookup), specifically so the audit record stays readable after the underlying data is gone.</div>
+    </div>
+  </section>
+
+  <section class="category">
+    <div class="cat-head">
+      <span class="cat-num">03</span>
+      <h2>Consent &amp; cookies</h2>
+    </div>
+    <p class="cat-note">What a visitor is asked before tracking starts, and whether that choice is recorded anywhere.</p>
+
+    <div class="feature">
+      <div class="f-name">Cookie consent banner (categorized: essential/analytics/marketing)</div>
+      <span class="f-status missing">missing</span>
+      <div class="f-note">No code on either branch. Shopify ships a first-party <code>Customer Privacy API</code> recognizing four consent signals (analytics, marketing, preferences, sale-of-data); WooCommerce relies entirely on third-party plugins for this.</div>
+    </div>
+
+    <div class="feature">
+      <div class="f-name">Granular marketing-consent tracking (email/SMS opt-in, per channel)</div>
+      <span class="f-status missing">missing</span>
+      <div class="f-note">Not modeled anywhere in <code>Modules\Core</code> — no consent flag found on the <code>Customer</code>/<code>User</code> models on either branch.</div>
+    </div>
+
+    <div class="feature">
+      <div class="f-name">Timestamped, versioned consent log (audit trail per visitor)</div>
+      <span class="f-status missing">missing</span>
+      <div class="f-note">Standard feature of dedicated CMPs (OneTrust, Enzuzo, Consentmo) — a logged record of which policy version a visitor consented to and when. Nothing comparable exists in this codebase; the <code>Privacy</code> branch's audit trail covers erasure/export requests only, not consent events.</div>
+    </div>
+
+    <div class="feature">
+      <div class="f-name">Google Consent Mode v2 / IAB TCF v2.3 integration</div>
+      <span class="f-status missing">missing</span>
+      <div class="f-note">Storefront/analytics-layer concern, not present in boboko-core at all — would live in the 3dealer storefront, not this package.</div>
+    </div>
+  </section>
+
+  <section class="category">
+    <div class="cat-head">
+      <span class="cat-num">04</span>
+      <h2>Policy &amp; agreement management</h2>
+    </div>
+    <p class="cat-note">Terms of service and privacy policy as tracked, versioned documents — not just static pages.</p>
+
+    <div class="feature">
+      <div class="f-name">Terms-of-service / privacy-policy versioning</div>
+      <span class="f-status missing">missing</span>
+      <div class="f-note">No version-tracked policy document model on either branch — best practice researched: store version hashes or dated text alongside each acceptance record, review at least annually.</div>
+    </div>
+
+    <div class="feature">
+      <div class="f-name">Per-user acceptance tracking (clickwrap audit trail)</div>
+      <span class="f-status missing">missing</span>
+      <div class="f-note">No record of "which policy version did this customer accept, and when" anywhere in <code>Modules\Core</code>. Researched as a standard requirement for surviving a legal dispute or regulatory inquiry.</div>
+    </div>
+
+    <div class="feature">
+      <div class="f-name">Re-acceptance prompt on material policy change</div>
+      <span class="f-status missing">missing</span>
+      <div class="f-note">Depends on the versioning row above existing first — nothing to gate a re-prompt on today.</div>
+    </div>
+  </section>
+
+  <section class="category">
+    <div class="cat-head">
+      <span class="cat-num">05</span>
+      <h2>Payment data &amp; PCI-DSS scope</h2>
+    </div>
+    <p class="cat-note">Whether cardholder data ever actually reaches boboko's own infrastructure.</p>
+
+    <div class="feature">
+      <div class="f-name">Card data never touches application servers (tokenization)</div>
+      <span class="f-status have">have</span>
+      <div class="f-note">Verified from source: <code>docs/lunar.md</code> "Stripe integration" — payment flows through Lunar's Stripe driver (<code>Lunar\Stripe\Facades\Stripe</code>, <code>fetchOrCreateIntent()</code>/PaymentIntents), so PAN never lands in a boboko/Lunar database. Researched: this pattern alone can cut PCI-DSS scope by roughly 90% per industry sources.</div>
+    </div>
+
+    <div class="feature">
+      <div class="f-name">Self-attested SAQ-A eligibility documentation</div>
+      <span class="f-status missing">missing</span>
+      <div class="f-note">The technical precondition (no card data touching the server) is met, but nothing in <code>docs/</code> documents or asserts SAQ-A eligibility for a consuming app's own compliance paperwork.</div>
+    </div>
+  </section>
+
+  <section class="category">
+    <div class="cat-head">
+      <span class="cat-num">06</span>
+      <h2>Regional &amp; regulatory coverage</h2>
+    </div>
+    <p class="cat-note">Beyond GDPR — the other regimes a storefront selling outside the EU may need.</p>
+
+    <div class="feature">
+      <div class="f-name">CCPA "Do Not Sell/Share My Info" opt-out</div>
+      <span class="f-status missing">missing</span>
+      <div class="f-note">No opt-out flag or page found on either branch. Shopify's Customer Privacy API models this as a distinct fourth consent signal ("sale of data") alongside analytics/marketing/preferences — boboko has no equivalent signal at all yet.</div>
+    </div>
+
+    <div class="feature">
+      <div class="f-name">Geo-targeted regulatory detection (GDPR vs. CCPA vs. LGPD banner)</div>
+      <span class="f-status missing">missing</span>
+      <div class="f-note">Third-party CMPs (Consentmo, UniConsent) auto-detect visitor region to show the applicable banner/rights. No geo-based privacy-regime logic anywhere in this codebase.</div>
+    </div>
+
+    <div class="feature">
+      <div class="f-name">Age verification / minor-data restrictions (COPPA-adjacent)</div>
+      <span class="f-status missing">missing</span>
+      <div class="f-note">No age gate or minor-specific data handling found on either branch.</div>
+    </div>
+  </section>
+
+  <section class="category">
+    <div class="cat-head">
+      <span class="cat-num">07</span>
+      <h2>Incident &amp; vendor accountability</h2>
+    </div>
+    <p class="cat-note">What happens when something goes wrong, or when a third party is handling data on the shop's behalf.</p>
+
+    <div class="feature">
+      <div class="f-name">Data breach notification workflow</div>
+      <span class="f-status missing">missing</span>
+      <div class="f-note">No incident-tracking model or notification path found on either branch — GDPR Art. 33/34's 72-hour authority-notification and affected-subject-notification duties have no tooling here today.</div>
+    </div>
+
+    <div class="feature">
+      <div class="f-name">Subprocessor / third-party vendor disclosure list</div>
+      <span class="f-status missing">missing</span>
+      <div class="f-note">No subprocessor registry in code — Stripe is the one third-party data processor identifiable from <code>docs/lunar.md</code>, but nothing formally tracks or discloses it as a subprocessor.</div>
+    </div>
+
+    <div class="feature">
+      <div class="f-name">Data processing agreement (DPA) tracking per vendor</div>
+      <span class="f-status missing">missing</span>
+      <div class="f-note">Not applicable to application code directly, but no config or doc references a DPA registry either — purely a legal/ops artifact today, not represented in boboko-core at all.</div>
+    </div>
+  </section>
+
+  <footer class="page">
+    <span>Compiled 2026-08-28 — <code>have</code>/<code>partial</code> statuses sourced from direct reads of <code>master</code> and the unmerged <code>Privacy</code> branch (commits <code>9f540cb</code>, <code>59303cf</code>) via <code>git show</code>; competitor/regulatory claims sourced from web research, cited inline.</span>
+    <span>boboko-core / docs</span>
+  </footer>
+
+</div>
diff --git a/docs/scratch/products-collections-feature-survey.html b/docs/scratch/products-collections-feature-survey.html
new file mode 100644
index 0000000..239aa6d
--- /dev/null
+++ b/docs/scratch/products-collections-feature-survey.html
@@ -0,0 +1,508 @@
+<title>Products &amp; Collections Feature Survey</title>
+<style>
+  :root {
+    --paper: #FAFAF7;
+    --ink: #1C1C1A;
+    --muted: #6B6B63;
+    --accent: #2F5D50;
+    --accent-soft: #E4EDE9;
+    --good: #3F7A5C;
+    --good-soft: #E6F0EA;
+    --warn: #B8863B;
+    --warn-soft: #F5ECDC;
+    --miss: #A14B3B;
+    --miss-soft: #F5E5E0;
+    --hairline: #E4E2DB;
+    --card: #FFFFFF;
+  }
+
+  :root:not([data-theme="light"]) {
+    @media (prefers-color-scheme: dark) {
+      --paper: #17181A;
+      --ink: #EDEBE4;
+      --muted: #9B9A90;
+      --accent: #7FBFA8;
+      --accent-soft: #1E2C27;
+      --good: #6FBF97;
+      --good-soft: #1B2A22;
+      --warn: #D9A85C;
+      --warn-soft: #2C2418;
+      --miss: #D97C68;
+      --miss-soft: #2E1E1A;
+      --hairline: #2C2D2E;
+      --card: #1E1F21;
+    }
+  }
+
+  :root[data-theme="dark"] {
+    --paper: #17181A;
+    --ink: #EDEBE4;
+    --muted: #9B9A90;
+    --accent: #7FBFA8;
+    --accent-soft: #1E2C27;
+    --good: #6FBF97;
+    --good-soft: #1B2A22;
+    --warn: #D9A85C;
+    --warn-soft: #2C2418;
+    --miss: #D97C68;
+    --miss-soft: #2E1E1A;
+    --hairline: #2C2D2E;
+    --card: #1E1F21;
+  }
+
+  * { box-sizing: border-box; }
+
+  body {
+    background: var(--paper);
+    color: var(--ink);
+    font-family: "IBM Plex Sans", ui-sans-serif, system-ui, sans-serif;
+    font-size: 15.5px;
+    line-height: 1.55;
+    margin: 0;
+    padding: 4.5rem 1.5rem 6rem;
+  }
+
+  .wrap {
+    max-width: 780px;
+    margin: 0 auto;
+  }
+
+  header.page {
+    margin-bottom: 3.25rem;
+  }
+
+  .eyebrow {
+    font-family: "IBM Plex Mono", ui-monospace, monospace;
+    font-size: 0.72rem;
+    letter-spacing: 0.12em;
+    text-transform: uppercase;
+    color: var(--accent);
+    margin-bottom: 0.9rem;
+  }
+
+  h1 {
+    font-family: "Fraunces", Georgia, serif;
+    font-weight: 560;
+    font-size: clamp(2.1rem, 4.5vw, 2.65rem);
+    line-height: 1.08;
+    letter-spacing: -0.01em;
+    margin: 0 0 0.9rem;
+    text-wrap: balance;
+  }
+
+  .dek {
+    color: var(--muted);
+    max-width: 60ch;
+    font-size: 1.02rem;
+  }
+
+  .dek strong {
+    color: var(--ink);
+    font-weight: 600;
+  }
+
+  .callout {
+    margin-top: 1.4rem;
+    padding: 0.9rem 1.1rem;
+    background: var(--accent-soft);
+    border-radius: 4px;
+    color: var(--ink);
+    font-size: 0.88rem;
+    max-width: 62ch;
+  }
+
+  .callout strong { color: var(--accent); }
+
+  .legend {
+    display: flex;
+    flex-wrap: wrap;
+    gap: 0.6rem;
+    margin-top: 1.6rem;
+  }
+
+  .chip {
+    display: inline-flex;
+    align-items: center;
+    gap: 0.4rem;
+    font-family: "IBM Plex Mono", ui-monospace, monospace;
+    font-size: 0.72rem;
+    letter-spacing: 0.04em;
+    padding: 0.28rem 0.6rem;
+    border-radius: 3px;
+  }
+
+  .chip.have { background: var(--good-soft); color: var(--good); }
+  .chip.partial { background: var(--warn-soft); color: var(--warn); }
+  .chip.missing { background: var(--miss-soft); color: var(--miss); }
+
+  .tally {
+    margin-top: 1rem;
+    font-family: "IBM Plex Mono", ui-monospace, monospace;
+    font-size: 0.78rem;
+    color: var(--muted);
+    letter-spacing: 0.02em;
+  }
+
+  .tally b { color: var(--ink); }
+
+  section.category {
+    margin-top: 3rem;
+  }
+
+  .cat-head {
+    display: flex;
+    align-items: baseline;
+    gap: 0.85rem;
+    border-bottom: 1px solid var(--hairline);
+    padding-bottom: 0.7rem;
+    margin-bottom: 1.1rem;
+  }
+
+  .cat-num {
+    font-family: "Fraunces", Georgia, serif;
+    font-size: 1.05rem;
+    color: var(--accent);
+    font-variant-numeric: tabular-nums;
+    min-width: 1.6rem;
+  }
+
+  .cat-head h2 {
+    font-family: "Fraunces", Georgia, serif;
+    font-weight: 500;
+    font-size: 1.28rem;
+    margin: 0;
+    letter-spacing: -0.005em;
+  }
+
+  .cat-note {
+    color: var(--muted);
+    font-size: 0.86rem;
+    margin: 0 0 1.2rem;
+    max-width: 62ch;
+  }
+
+  .feature {
+    display: grid;
+    grid-template-columns: 1fr auto;
+    gap: 0.3rem 1rem;
+    padding: 1.05rem 0;
+    border-bottom: 1px solid var(--hairline);
+    align-items: start;
+  }
+
+  .feature:last-child { border-bottom: none; }
+
+  .f-name {
+    font-weight: 600;
+    font-size: 0.98rem;
+  }
+
+  .f-status {
+    font-family: "IBM Plex Mono", ui-monospace, monospace;
+    font-size: 0.68rem;
+    letter-spacing: 0.06em;
+    text-transform: uppercase;
+    padding: 0.22rem 0.55rem;
+    border-radius: 3px;
+    white-space: nowrap;
+    height: fit-content;
+  }
+
+  .f-status.have { background: var(--good-soft); color: var(--good); }
+  .f-status.partial { background: var(--warn-soft); color: var(--warn); }
+  .f-status.missing { background: var(--miss-soft); color: var(--miss); }
+
+  .f-note {
+    grid-column: 1 / -1;
+    color: var(--muted);
+    font-size: 0.87rem;
+    margin-top: 0.15rem;
+    max-width: 66ch;
+  }
+
+  .f-note code {
+    font-family: "IBM Plex Mono", ui-monospace, monospace;
+    font-size: 0.82em;
+    background: var(--accent-soft);
+    color: var(--accent);
+    padding: 0.08em 0.35em;
+    border-radius: 3px;
+  }
+
+  footer.page {
+    margin-top: 4rem;
+    padding-top: 1.5rem;
+    border-top: 1px solid var(--hairline);
+    color: var(--muted);
+    font-size: 0.82rem;
+    display: flex;
+    justify-content: space-between;
+    gap: 1rem;
+    flex-wrap: wrap;
+  }
+
+  footer.page a { color: var(--accent); }
+
+  @media (max-width: 560px) {
+    body { padding: 3rem 1.1rem 4rem; }
+    .feature { grid-template-columns: 1fr; }
+    .f-status { justify-self: start; }
+  }
+</style>
+<link rel="stylesheet" href="https://fonts.googleapis.com/css2?family=Fraunces:opsz,wght@9..144,400..600&family=IBM+Plex+Sans:wght@400;500;600&family=IBM+Plex+Mono:wght@400;500&display=swap">
+
+<div class="wrap">
+
+  <header class="page">
+    <div class="eyebrow">boboko / products &amp; collections · competitive survey</div>
+    <h1>What products &amp; collections elsewhere can do that boboko can't yet</h1>
+    <p class="dek">
+      A feature-by-feature pass across Shopify, WooCommerce, PrestaShop, and general
+      2026 storefront UX trends — checked against what
+      <strong><code>Modules\Core\Catalog</code></strong> actually ships in boboko-core
+      and what 3dealer's storefront actually calls. Unlike the rest of this survey
+      series, this concern is not a blank slate: a real Meilisearch-backed catalog
+      layer (listing, filtering, facets, search, collections, a product-option-type
+      system) was built this session. The gaps here are mostly about storefront wiring
+      and discovery/merchandising UX, not backend plumbing.
+    </p>
+    <div class="callout">
+      <strong>Read this first:</strong> the category page's sort dropdown, price
+      slider, in-stock checkbox, and sidebar search box are all visually present but
+      functionally dead — none of them submit a request or call a filter. The backend
+      methods they'd need (<code>ProductService::facets()</code>,
+      <code>priceRange()</code>, <code>list()</code>'s sort param) already exist and
+      work; nothing in <code>CategoryController</code> passes them through yet.
+    </div>
+    <div class="legend">
+      <span class="chip have">● have</span>
+      <span class="chip partial">◐ partial</span>
+      <span class="chip missing">○ missing</span>
+    </div>
+    <div class="tally">31 features surveyed — <b>8 have</b> · <b>10 partial</b> · <b>13 missing</b></div>
+  </header>
+
+  <section class="category">
+    <div class="cat-head">
+      <span class="cat-num">01</span>
+      <h2>Core listing &amp; filtering plumbing</h2>
+    </div>
+    <p class="cat-note">The Meilisearch-backed layer everything else in this survey sits on top of — this is where most of this session's real build lives.</p>
+
+    <div class="feature">
+      <div class="f-name">Paginated product listing, index-backed (not DB reads)</div>
+      <span class="f-status have">have</span>
+      <div class="f-note"><code>ProductService::list()</code> reads <code>Product::search('')</code> via Meilisearch and returns a real <code>LengthAwarePaginator</code> — used end-to-end by <code>CategoryController::show()</code> and rendered by <code>x-product-grid</code>.</div>
+    </div>
+
+    <div class="feature">
+      <div class="f-name">Filter by collection (including descendant collections)</div>
+      <span class="f-status have">have</span>
+      <div class="f-note"><code>ProductFilters::collectionId</code> matches <code>ProductIndexer</code>'s <code>collection_ids</code> field, which unions a product's direct collections with all ancestors — so a parent-category page picks up products attached only to a leaf subcategory. Wired in <code>CategoryController</code>.</div>
+    </div>
+
+    <div class="feature">
+      <div class="f-name">Filter by brand, price range, stock status</div>
+      <span class="f-status partial">partial</span>
+      <div class="f-note"><code>ProductFilters</code> supports <code>brand</code>, <code>minPrice</code>/<code>maxPrice</code>, <code>inStockOnly</code>, fully implemented in <code>ProductService::buildFilter()</code> — but <code>category/show.blade.php</code>'s price slider and in-stock checkbox are hardcoded markup with no form submission; <code>CategoryController</code> never constructs a <code>ProductFilters</code> with any of these three.</div>
+    </div>
+
+    <div class="feature">
+      <div class="f-name">Faceted counts for a filter sidebar (brand, stock, etc.)</div>
+      <span class="f-status partial">partial</span>
+      <div class="f-note"><code>ProductService::facets()</code> returns value→count via Meilisearch <code>facetDistribution</code>, correctly scoped to co-applied filters — but nothing storefront-side calls it. No brand/attribute facet list renders anywhere in <code>category/show.blade.php</code>.</div>
+    </div>
+
+    <div class="feature">
+      <div class="f-name">Price-range slider backed by real min/max</div>
+      <span class="f-status partial">partial</span>
+      <div class="f-note"><code>ProductService::priceRange()</code> reads Meilisearch <code>facetStats</code> for a correct, filter-scoped min/max — the sidebar instead shows a static "€10 - €50" label with a non-functional apply button.</div>
+    </div>
+
+    <div class="feature">
+      <div class="f-name">Sort (price asc/desc, newest)</div>
+      <span class="f-status partial">partial</span>
+      <div class="f-note"><code>ProductSort</code> enum + <code>ProductIndexer::getSortableFields()</code> (price, created_at) work end-to-end in <code>ProductService::list(sort: ...)</code> — the storefront's sort <code>&lt;select&gt;</code> is explicitly commented <code>{{-- Dummy — not wired to real sorting yet --}}</code> and includes a "popularity" option with no backing signal at all.</div>
+    </div>
+
+    <div class="feature">
+      <div class="f-name">Free-text product search</div>
+      <span class="f-status partial">partial</span>
+      <div class="f-note"><code>ProductSearchService::search()</code> is a complete, locale-aware, fallback-safe implementation (<code>attributesToSearchOn</code> targeting current + default locale) — but no search route exists in 3dealer (<code>routes/web.php</code> only has <code>product.show</code>/<code>category.show</code>), and both the header search icon and the sidebar search box are inert buttons/inputs.</div>
+    </div>
+
+    <div class="feature">
+      <div class="f-name">Single-product lookup by slug or id, index-only</div>
+      <span class="f-status have">have</span>
+      <div class="f-note"><code>ProductService::getById()</code>/<code>getBySlug()</code>, both zero-database-read lookups against the <code>slugs</code>/<code>id</code> filterable fields. <code>ProductController::show()</code> uses <code>getById()</code> directly.</div>
+    </div>
+  </section>
+
+  <section class="category">
+    <div class="cat-head">
+      <span class="cat-num">02</span>
+      <h2>Collections &amp; navigation</h2>
+    </div>
+    <p class="cat-note">Category tree browsing, breadcrumbs, and merchandising — what turns a flat product list into a navigable store.</p>
+
+    <div class="feature">
+      <div class="f-name">Category tree browsing (root / children / by group)</div>
+      <span class="f-status have">have</span>
+      <div class="f-note"><code>CollectionService::list()</code> with <code>CollectionFilters(rootOnly</code>/<code>parentId</code>/<code>groupId)</code>, backed by <code>CollectionIndexer</code>'s nested-set <code>parent_id</code>/<code>_lft</code> fields — no database read needed to build a nav tree.</div>
+    </div>
+
+    <div class="feature">
+      <div class="f-name">Top-nav category dropdown</div>
+      <span class="f-status have">have</span>
+      <div class="f-note"><code>components/header.blade.php</code> renders a CSS-only hover dropdown from a <code>$categories</code> list passed into the layout, linking to <code>category.show</code>.</div>
+    </div>
+
+    <div class="feature">
+      <div class="f-name">Breadcrumb navigation</div>
+      <span class="f-status partial">partial</span>
+      <div class="f-note"><code>CollectionIndexer</code> indexes a full root-first <code>ancestors</code> array ({id, name}) specifically so a breadcrumb needs zero extra queries — but <code>category/show.blade.php</code> and <code>product/show.blade.php</code> both build a flat two-level <code>x-breadcrumb</code> (Home → this category/product) by hand, never reading <code>ancestors</code>. A product under a three-deep category shows no intermediate levels.</div>
+    </div>
+
+    <div class="feature">
+      <div class="f-name">Category landing page merchandising (banner, pinned/featured products)</div>
+      <span class="f-status missing">missing</span>
+      <div class="f-note"><code>category/show.blade.php</code> renders only the collection name/description above a plain product grid — no banner image field, no "featured in this category" pinning above organic results. <code>CollectionIndexer</code>'s <code>thumbnail</code> field exists but isn't read on the category page at all (only used, if anywhere, for nav-level imagery).</div>
+    </div>
+
+    <div class="feature">
+      <div class="f-name">Sub-category faceting (filter by attribute within a category)</div>
+      <span class="f-status missing">missing</span>
+      <div class="f-note">No attribute-value facet (size, material, etc.) is indexed as filterable on <code>ProductIndexer</code> beyond <code>brand</code> and <code>in_stock</code> — a category page can't offer "filter dresses by size" the way Shopify/WooCommerce faceted nav does; would need new filterable fields on custom product attributes plus sidebar UI.</div>
+    </div>
+
+    <div class="feature">
+      <div class="f-name">Product count shown per category</div>
+      <span class="f-status partial">partial</span>
+      <div class="f-note"><code>CollectionIndexer</code> computes <code>product_count</code> (including descendant collections) at index time by querying the product index directly — correct and cheap, but nothing in <code>category/show.blade.php</code> or the nav dropdown displays it.</div>
+    </div>
+  </section>
+
+  <section class="category">
+    <div class="cat-head">
+      <span class="cat-num">03</span>
+      <h2>Product detail page</h2>
+    </div>
+    <p class="cat-note">What a shopper sees once they land on a single product — media, variants, reviews, cross-sell.</p>
+
+    <div class="feature">
+      <div class="f-name">Multi-image gallery with lightbox</div>
+      <span class="f-status have">have</span>
+      <div class="f-note"><code>product/show.blade.php</code>'s <code>product-gallery</code> Stimulus controller — thumbnail rail, main image, full popover lightbox with prev/next/counter — fed from <code>ProductIndexer</code>'s full <code>media</code> array (not just a single thumbnail).</div>
+    </div>
+
+    <div class="feature">
+      <div class="f-name">Variant selection via color swatches</div>
+      <span class="f-status have">have</span>
+      <div class="f-note">End-to-end: <code>ColorOptionType</code> lets an admin attach a hex code to an option value → <code>ProductIndexer::mapVariant()</code> embeds <code>meta.hex</code> per variant → <code>x-ui.color-swatch</code> renders real swatch buttons wired to a <code>product-form</code> Stimulus controller that swaps price/image on selection.</div>
+    </div>
+
+    <div class="feature">
+      <div class="f-name">Swatches for non-color attributes (pattern, texture, material)</div>
+      <span class="f-status partial">partial</span>
+      <div class="f-note">The <code>ProductOptionTypeInterface</code> system is explicitly built to be extensible — a <code>PatternOptionType</code> or <code>MaterialOptionType</code> is a new class plus a Filament form, no core change needed — but only <code>ColorOptionType</code> is registered, and <code>x-ui.color-swatch</code> itself hardcodes a background-color swatch, not a generic swatch renderer.</div>
+    </div>
+
+    <div class="feature">
+      <div class="f-name">Customer reviews with ratings, photos, staff replies</div>
+      <span class="f-status have">have</span>
+      <div class="f-note"><code>ProductReview</code> model, fully indexed (<code>items</code>/<code>count</code>/<code>average_rating</code>, PII-safe), live-reindexed on review create/update/delete via <code>ReviewServiceProvider</code>, and rendered in <code>product/show.blade.php</code>'s Reviews tab with <code>x-review-card</code>/<code>x-review-form</code>.</div>
+    </div>
+
+    <div class="feature">
+      <div class="f-name">Structured data / schema.org Product markup</div>
+      <span class="f-status missing">missing</span>
+      <div class="f-note">No <code>application/ld+json</code> or <code>itemscope</code> markup anywhere in 3dealer's views. Rich results (price/rating/availability in Google Shopping) are a significant organic-CTR lever per 2026 SEO guidance — the product page already has every field (price, rating, stock) a Product schema block would need, just not emitted.</div>
+    </div>
+
+    <div class="feature">
+      <div class="f-name">Related products / "customers also bought" / cross-sell</div>
+      <span class="f-status missing">missing</span>
+      <div class="f-note">Raw Lunar already models this (<code>Lunar\Base\Enums\ProductAssociation::CROSS_SELL</code>/<code>UP_SELL</code>/<code>ALTERNATE</code>, <code>$product-&gt;associate()</code>/<code>associations()</code> — see <code>docs/lunar.md</code> "Products and Variants") but nothing in <code>Modules\Core\Catalog</code> surfaces it, and the "Σχετικά προϊόντα" block at the bottom of <code>product/show.blade.php</code> is four fully hardcoded fake products with <code>href =&gt; '#'</code>.</div>
+    </div>
+
+    <div class="feature">
+      <div class="f-name">Recently-viewed products</div>
+      <span class="f-status missing">missing</span>
+      <div class="f-note">No session/cookie tracking of viewed products anywhere in 3dealer or core — a standard discovery module on both Shopify and WooCommerce storefronts per current UX research.</div>
+    </div>
+
+    <div class="feature">
+      <div class="f-name">Product badges (new / sale / bestseller)</div>
+      <span class="f-status missing">missing</span>
+      <div class="f-note">No badge concept on <code>ProductIndexer</code>'s document and no badge markup on <code>x-ui.product-card</code> — would need either a computed signal (e.g. "new" from <code>created_at</code>, "sale" from <code>compare_price</code> already indexed per-variant) or an admin-set tag, neither wired to a visual badge today.</div>
+    </div>
+
+    <div class="feature">
+      <div class="f-name">Size chart / fit guide</div>
+      <span class="f-status missing">missing</span>
+      <div class="f-note">No size-chart content field on <code>Product</code>/<code>ProductType</code> and no UI for it on the product page. Not especially relevant to 3dealer's current catalog (3D-printed goods), but a real gap for any apparel-leaning store built on this core.</div>
+    </div>
+
+    <div class="feature">
+      <div class="f-name">Stock notification ("notify me when back in stock")</div>
+      <span class="f-status missing">missing</span>
+      <div class="f-note"><code>in_stock</code> is indexed and known per-product (<code>ProductIndexer::toSearchableArray()</code>), but there's no subscription model, email trigger, or UI for a shopper to ask to be notified — the signal exists, nothing acts on it.</div>
+    </div>
+
+    <div class="feature">
+      <div class="f-name">Product Q&amp;A section</div>
+      <span class="f-status missing">missing</span>
+      <div class="f-note">No question/answer model anywhere in core — only the separate review system (<code>ProductReview</code>) exists, which is a distinct concept (post-purchase rating, not pre-purchase Q&amp;A).</div>
+    </div>
+  </section>
+
+  <section class="category">
+    <div class="cat-head">
+      <span class="cat-num">04</span>
+      <h2>Emerging discovery &amp; merchandising UX</h2>
+    </div>
+    <p class="cat-note">2026 trend-adjacent features, mostly backed on other platforms by paid apps/plugins rather than core — useful for calibrating how unusual these gaps are.</p>
+
+    <div class="feature">
+      <div class="f-name">Quick-view modal (preview from listing grid, no page load)</div>
+      <span class="f-status missing">missing</span>
+      <div class="f-note"><code>x-ui.product-card</code> links straight to <code>product.show</code> with a hover-revealed "add to cart" button only — no modal/preview interaction. Current UX research flags quick-view modals as a common INP (responsiveness) failure point, so the absence isn't purely a gap to close blindly.</div>
+    </div>
+
+    <div class="feature">
+      <div class="f-name">Infinite scroll as an alternative to pagination</div>
+      <span class="f-status missing">missing</span>
+      <div class="f-note"><code>category/show.blade.php</code> uses classic <code>x-ui.pagination</code> against the real paginator from <code>ProductService::list()</code> — works correctly, just page-based rather than scroll-based. Research is genuinely mixed on whether infinite scroll is even preferable for conversion/SEO, so this is a parity note, not a clear gap.</div>
+    </div>
+
+    <div class="feature">
+      <div class="f-name">Product comparison tool (side-by-side spec table)</div>
+      <span class="f-status missing">missing</span>
+      <div class="f-note">Not in boboko-core, and notably not native on Shopify or WooCommerce either — both rely on third-party apps (Bear Specs &amp; Compare, Equate, WooCommerce's own paid "Advanced Product Comparison" extension). A real gap, but not one competitors solve in-platform for free.</div>
+    </div>
+
+    <div class="feature">
+      <div class="f-name">Product bundles / kits</div>
+      <span class="f-status missing">missing</span>
+      <div class="f-note">No bundle/kit concept (a purchasable grouping of several variants as one line item) anywhere in <code>Lunar\Models\Product</code>/<code>ProductVariant</code> or <code>Modules\Core\Catalog</code>.</div>
+    </div>
+
+    <div class="feature">
+      <div class="f-name">360°/video product media, AR try-on</div>
+      <span class="f-status partial">partial</span>
+      <div class="f-note"><code>ProductIndexer</code>'s <code>media</code> array is just Spatie media-library images (<code>url</code>/<code>thumb</code>) — no video or 360° asset type modeled, and no AR integration. The gallery component (<code>product-gallery</code> Stimulus controller) is generic enough to extend to a video slide without a rewrite, but nothing does today.</div>
+    </div>
+
+    <div class="feature">
+      <div class="f-name">Variant-specific SEO URLs (distinct slug per color/size)</div>
+      <span class="f-status partial">partial</span>
+      <div class="f-note">Lunar's <code>HasUrls</code>/<code>Url</code> model supports per-locale slugs per <em>product</em> (indexed in <code>ProductIndexer</code>'s <code>slugs</code> field), but there's no per-<em>variant</em> URL — selecting a color swatch changes displayed price/image via <code>product-form</code> client-side state, not the URL, so a specific variant can't be linked or indexed separately.</div>
+    </div>
+  </section>
+
+  <footer class="page">
+    <span>Compiled 2026-08-28 — <code>Modules\Core\Catalog</code> source, docs, and 3dealer storefront claims are direct reads; 2026 UX-trend, quick-view/infinite-scroll, and product-comparison-tooling claims are sourced from web research and marked accordingly in context.</span>
+    <span>boboko-core / docs</span>
+  </footer>
+
+</div>
diff --git a/docs/scratch/shipping-feature-survey.html b/docs/scratch/shipping-feature-survey.html
new file mode 100644
index 0000000..ccccbc7
--- /dev/null
+++ b/docs/scratch/shipping-feature-survey.html
@@ -0,0 +1,465 @@
+<title>Shipping Feature Survey</title>
+<style>
+  :root {
+    --paper: #FAFAF7;
+    --ink: #1C1C1A;
+    --muted: #6B6B63;
+    --accent: #2F5D50;
+    --accent-soft: #E4EDE9;
+    --good: #3F7A5C;
+    --good-soft: #E6F0EA;
+    --warn: #B8863B;
+    --warn-soft: #F5ECDC;
+    --miss: #A14B3B;
+    --miss-soft: #F5E5E0;
+    --hairline: #E4E2DB;
+    --card: #FFFFFF;
+  }
+
+  :root:not([data-theme="light"]) {
+    @media (prefers-color-scheme: dark) {
+      --paper: #17181A;
+      --ink: #EDEBE4;
+      --muted: #9B9A90;
+      --accent: #7FBFA8;
+      --accent-soft: #1E2C27;
+      --good: #6FBF97;
+      --good-soft: #1B2A22;
+      --warn: #D9A85C;
+      --warn-soft: #2C2418;
+      --miss: #D97C68;
+      --miss-soft: #2E1E1A;
+      --hairline: #2C2D2E;
+      --card: #1E1F21;
+    }
+  }
+
+  :root[data-theme="dark"] {
+    --paper: #17181A;
+    --ink: #EDEBE4;
+    --muted: #9B9A90;
+    --accent: #7FBFA8;
+    --accent-soft: #1E2C27;
+    --good: #6FBF97;
+    --good-soft: #1B2A22;
+    --warn: #D9A85C;
+    --warn-soft: #2C2418;
+    --miss: #D97C68;
+    --miss-soft: #2E1E1A;
+    --hairline: #2C2D2E;
+    --card: #1E1F21;
+  }
+
+  * { box-sizing: border-box; }
+
+  body {
+    background: var(--paper);
+    color: var(--ink);
+    font-family: "IBM Plex Sans", ui-sans-serif, system-ui, sans-serif;
+    font-size: 15.5px;
+    line-height: 1.55;
+    margin: 0;
+    padding: 4.5rem 1.5rem 6rem;
+  }
+
+  .wrap {
+    max-width: 780px;
+    margin: 0 auto;
+  }
+
+  header.page {
+    margin-bottom: 3.25rem;
+  }
+
+  .eyebrow {
+    font-family: "IBM Plex Mono", ui-monospace, monospace;
+    font-size: 0.72rem;
+    letter-spacing: 0.12em;
+    text-transform: uppercase;
+    color: var(--accent);
+    margin-bottom: 0.9rem;
+  }
+
+  h1 {
+    font-family: "Fraunces", Georgia, serif;
+    font-weight: 560;
+    font-size: clamp(2.1rem, 4.5vw, 2.65rem);
+    line-height: 1.08;
+    letter-spacing: -0.01em;
+    margin: 0 0 0.9rem;
+    text-wrap: balance;
+  }
+
+  .dek {
+    color: var(--muted);
+    max-width: 60ch;
+    font-size: 1.02rem;
+  }
+
+  .dek strong {
+    color: var(--ink);
+    font-weight: 600;
+  }
+
+  .legend {
+    display: flex;
+    flex-wrap: wrap;
+    gap: 0.6rem;
+    margin-top: 1.6rem;
+  }
+
+  .chip {
+    display: inline-flex;
+    align-items: center;
+    gap: 0.4rem;
+    font-family: "IBM Plex Mono", ui-monospace, monospace;
+    font-size: 0.72rem;
+    letter-spacing: 0.04em;
+    padding: 0.28rem 0.6rem;
+    border-radius: 3px;
+  }
+
+  .chip.have { background: var(--good-soft); color: var(--good); }
+  .chip.partial { background: var(--warn-soft); color: var(--warn); }
+  .chip.missing { background: var(--miss-soft); color: var(--miss); }
+
+  section.category {
+    margin-top: 3rem;
+  }
+
+  .cat-head {
+    display: flex;
+    align-items: baseline;
+    gap: 0.85rem;
+    border-bottom: 1px solid var(--hairline);
+    padding-bottom: 0.7rem;
+    margin-bottom: 1.1rem;
+  }
+
+  .cat-num {
+    font-family: "Fraunces", Georgia, serif;
+    font-size: 1.05rem;
+    color: var(--accent);
+    font-variant-numeric: tabular-nums;
+    min-width: 1.6rem;
+  }
+
+  .cat-head h2 {
+    font-family: "Fraunces", Georgia, serif;
+    font-weight: 500;
+    font-size: 1.28rem;
+    margin: 0;
+    letter-spacing: -0.005em;
+  }
+
+  .cat-note {
+    color: var(--muted);
+    font-size: 0.86rem;
+    margin: 0 0 1.2rem;
+    max-width: 62ch;
+  }
+
+  .feature {
+    display: grid;
+    grid-template-columns: 1fr auto;
+    gap: 0.3rem 1rem;
+    padding: 1.05rem 0;
+    border-bottom: 1px solid var(--hairline);
+    align-items: start;
+  }
+
+  .feature:last-child { border-bottom: none; }
+
+  .f-name {
+    font-weight: 600;
+    font-size: 0.98rem;
+  }
+
+  .f-status {
+    font-family: "IBM Plex Mono", ui-monospace, monospace;
+    font-size: 0.68rem;
+    letter-spacing: 0.06em;
+    text-transform: uppercase;
+    padding: 0.22rem 0.55rem;
+    border-radius: 3px;
+    white-space: nowrap;
+    height: fit-content;
+  }
+
+  .f-status.have { background: var(--good-soft); color: var(--good); }
+  .f-status.partial { background: var(--warn-soft); color: var(--warn); }
+  .f-status.missing { background: var(--miss-soft); color: var(--miss); }
+
+  .f-note {
+    grid-column: 1 / -1;
+    color: var(--muted);
+    font-size: 0.87rem;
+    margin-top: 0.15rem;
+    max-width: 66ch;
+  }
+
+  .f-note code {
+    font-family: "IBM Plex Mono", ui-monospace, monospace;
+    font-size: 0.82em;
+    background: var(--accent-soft);
+    color: var(--accent);
+    padding: 0.08em 0.35em;
+    border-radius: 3px;
+  }
+
+  footer.page {
+    margin-top: 4rem;
+    padding-top: 1.5rem;
+    border-top: 1px solid var(--hairline);
+    color: var(--muted);
+    font-size: 0.82rem;
+    display: flex;
+    justify-content: space-between;
+    gap: 1rem;
+    flex-wrap: wrap;
+  }
+
+  footer.page a { color: var(--accent); }
+
+  @media (max-width: 560px) {
+    body { padding: 3rem 1.1rem 4rem; }
+    .feature { grid-template-columns: 1fr; }
+    .f-status { justify-self: start; }
+  }
+</style>
+<link rel="stylesheet" href="https://fonts.googleapis.com/css2?family=Fraunces:opsz,wght@9..144,400..600&family=IBM+Plex+Sans:wght@400;500;600&family=IBM+Plex+Mono:wght@400;500&display=swap">
+
+<div class="wrap">
+
+  <header class="page">
+    <div class="eyebrow">boboko / shipping · competitive survey</div>
+    <h1>What shipping elsewhere can do that boboko can't yet</h1>
+    <p class="dek">
+      A feature-by-feature pass across Shopify, WooCommerce, and PrestaShop's shipping
+      layer — sourced, not recalled from memory — checked against what
+      <strong>Lunar core's <code>ShippingManifest</code></strong> and the
+      <strong><code>lunarphp/table-rate-shipping</code></strong> add-on actually support
+      today, and what's actually wired up in boboko-core and 3dealer right now.
+      For deciding what to design next, not a build order.
+    </p>
+    <div class="legend">
+      <span class="chip have">● have</span>
+      <span class="chip partial">◐ partial</span>
+      <span class="chip missing">○ missing</span>
+    </div>
+  </header>
+
+  <section class="category">
+    <div class="cat-head">
+      <span class="cat-num">01</span>
+      <h2>Core plumbing</h2>
+    </div>
+    <p class="cat-note">The mechanism Lunar core provides for offering and applying a shipping charge — everything else in this survey is built on top of it.</p>
+
+    <div class="feature">
+      <div class="f-name">Pluggable shipping option providers</div>
+      <span class="f-status have">have</span>
+      <div class="f-note"><code>Lunar\Base\ShippingModifier</code> abstract class + <code>ShippingManifest::addOption()</code> — any package can register options onto the manifest via a pipeline of modifiers (<code>ShippingModifiers::getModifiers()</code>).</div>
+    </div>
+
+    <div class="feature">
+      <div class="f-name">Shipping applied to cart totals during calculate()</div>
+      <span class="f-status have">have</span>
+      <div class="f-note"><code>Lunar\Pipelines\Cart\ApplyShipping</code> — reads <code>ShippingManifest::getShippingOption($cart)</code> or a manual <code>shippingOptionOverride</code>, writes a <code>ShippingBreakdown</code> and <code>shippingSubTotal</code> onto the cart before <code>CalculateTax</code> runs.</div>
+    </div>
+
+    <div class="feature">
+      <div class="f-name">Cart-level shippable check</div>
+      <span class="f-status have">have</span>
+      <div class="f-note"><code>Cart::isShippable()</code> — true if any line's <code>purchasable</code> (e.g. <code>ProductVariant::isShippable()</code>) is shippable; a digital-only cart skips the shipping-address requirement entirely.</div>
+    </div>
+
+    <div class="feature">
+      <div class="f-name">Selecting a shipping option on the cart</div>
+      <span class="f-status have">have</span>
+      <div class="f-note"><code>Cart::setShippingOption()</code> → <code>SetShippingOption</code> action, validated by <code>ShippingOptionValidator</code>, triggers a recalculate. Nothing in 3dealer's storefront calls it yet — no shipping step exists in the UI.</div>
+    </div>
+
+    <div class="feature">
+      <div class="f-name">Order-time shipping line snapshot</div>
+      <span class="f-status have">have</span>
+      <div class="f-note"><code>Lunar\Pipelines\Order\Creation\CreateShippingLine</code> writes an immutable <code>shipping</code>-type order line from the cart's shipping breakdown at checkout — survives later rate changes.</div>
+    </div>
+  </section>
+
+  <section class="category">
+    <div class="cat-head">
+      <span class="cat-num">02</span>
+      <h2>Rate configuration (table-rate-shipping add-on)</h2>
+    </div>
+    <p class="cat-note"><code>lunarphp/table-rate-shipping</code> is installed (<code>composer.json</code>, pinned <code>^1.3</code>) and its <code>ShippingPlugin</code> is registered in <code>CorePlugin::boot()</code> — so 3dealer inherits it automatically, it doesn't need its own registration.</p>
+
+    <div class="feature">
+      <div class="f-name">Geographic shipping zones (country / state / postcode)</div>
+      <span class="f-status have">have</span>
+      <div class="f-note"><code>ShippingZone</code> model, type <code>unrestricted|countries|states|postcodes</code>; <code>ShippingZoneResolver::get()</code> matches a cart's address against zone scope, falling back to any <code>unrestricted</code> zone.</div>
+    </div>
+
+    <div class="feature">
+      <div class="f-name">Flat-rate shipping</div>
+      <span class="f-status have">have</span>
+      <div class="f-note"><code>Drivers\ShippingMethods\FlatRate::resolve()</code> — one price per cart subtotal via <code>Pricing::for($shippingRate)</code>.</div>
+    </div>
+
+    <div class="feature">
+      <div class="f-name">Weight- or total-tiered rates ("ship by")</div>
+      <span class="f-status have">have</span>
+      <div class="f-note"><code>Drivers\ShippingMethods\ShipBy::resolve()</code> — <code>data['charge_by']</code> is <code>cart_total</code> or <code>weight</code>, tiered via <code>priceBreaks</code>, with customer-group price overrides taking priority.</div>
+    </div>
+
+    <div class="feature">
+      <div class="f-name">Free-shipping threshold</div>
+      <span class="f-status have">have</span>
+      <div class="f-note"><code>Drivers\ShippingMethods\FreeShipping::resolve()</code> — <code>data['minimum_spend']</code> (per-currency array supported), optional <code>use_discount_amount</code> to check against post-discount subtotal.</div>
+    </div>
+
+    <div class="feature">
+      <div class="f-name">In-store pickup / collection</div>
+      <span class="f-status have">have</span>
+      <div class="f-note"><code>Drivers\ShippingMethods\Collection::resolve()</code> — zero-price option, flagged <code>collect: true</code> on the <code>ShippingOption</code>. Single implicit "store" — no concept of which location, no per-location stock or hours.</div>
+    </div>
+
+    <div class="feature">
+      <div class="f-name">Per-product shipping exclusions by zone</div>
+      <span class="f-status have">have</span>
+      <div class="f-note"><code>ShippingExclusionList</code> + <code>ShippingZone::shippingExclusions()</code> — every driver checks it before resolving and returns <code>null</code> if any cart line's product is excluded from that zone.</div>
+    </div>
+
+    <div class="feature">
+      <div class="f-name">Per-customer-group rate visibility</div>
+      <span class="f-status have">have</span>
+      <div class="f-note"><code>ShippingMethod::customerGroups()</code> pivot carries <code>visible</code>, <code>enabled</code>, <code>starts_at</code>, <code>ends_at</code> — scheduling and audience-gating a rate is already modeled.</div>
+    </div>
+
+    <div class="feature">
+      <div class="f-name">Filament admin UI for zones/methods/rates</div>
+      <span class="f-status have">have</span>
+      <div class="f-note"><code>ShippingZoneResource</code>, <code>ShippingMethodResource</code>, <code>ShippingExclusionListResource</code> ship with the add-on — usable as soon as the Filament plugin is registered, which it is via <code>CorePlugin</code>.</div>
+    </div>
+
+    <div class="feature">
+      <div class="f-name">Storefront checkout step to pick a rate</div>
+      <span class="f-status missing">missing</span>
+      <div class="f-note">No shipping views exist in 3dealer's <code>resources/views</code> beyond a passing mention in <code>components/footer.blade.php</code> — the whole backend above is unwired to any customer-facing UI.</div>
+    </div>
+  </section>
+
+  <section class="category">
+    <div class="cat-head">
+      <span class="cat-num">03</span>
+      <h2>Carrier integration</h2>
+    </div>
+    <p class="cat-note">Real carriers quoting and printing on Lunar's behalf, rather than merchant-defined flat/tiered rates.</p>
+
+    <div class="feature">
+      <div class="f-name">Real-time carrier rate shopping (USPS/UPS/FedEx/DHL)</div>
+      <span class="f-status missing">missing</span>
+      <div class="f-note">No driver in <code>table-rate-shipping</code> calls an external carrier API — all four shipped drivers (<code>FlatRate</code>, <code>ShipBy</code>, <code>FreeShipping</code>, <code>Collection</code>) compute from local data. Shopify's <code>CarrierService</code> API is the model for this: shop sends weight/dims/destination, carrier returns live rates at checkout.</div>
+    </div>
+
+    <div class="feature">
+      <div class="f-name">Product/variant weight &amp; dimensions for rating</div>
+      <span class="f-status partial">partial</span>
+      <div class="f-note"><code>ProductVariant</code> has <code>weight_value</code>/<code>weight_unit</code> (referenced in <code>ShipBy</code>'s weight tier and <code>docs/lunar.md</code>) but no length/width/height fields exist in core migrations — enough for weight-tier rating, not enough for carrier-grade dimensional/volumetric quotes.</div>
+    </div>
+
+    <div class="feature">
+      <div class="f-name">Shipping label generation &amp; printing (staff-facing)</div>
+      <span class="f-status missing">missing</span>
+      <div class="f-note">No label concept anywhere in core or the add-on. Shopify has this built in for US merchants (USPS/UPS labels from admin or mobile); WooCommerce/PrestaShop lean on Shippo/EasyPost-style apps.</div>
+    </div>
+
+    <div class="feature">
+      <div class="f-name">Return / exchange label generation</div>
+      <span class="f-status missing">missing</span>
+      <div class="f-note">No returns concept exists in Lunar core at all — this sits behind both "labels" and "returns," neither of which exists yet.</div>
+    </div>
+
+    <div class="feature">
+      <div class="f-name">Shipment tracking numbers on orders</div>
+      <span class="f-status missing">missing</span>
+      <div class="f-note"><code>OrderShippingZone</code> pivot table records which zone an order matched, but no field anywhere stores a carrier tracking number or shipment status.</div>
+    </div>
+  </section>
+
+  <section class="category">
+    <div class="cat-head">
+      <span class="cat-num">04</span>
+      <h2>Fulfillment logistics</h2>
+    </div>
+    <p class="cat-note">Where an order physically ships from, and whether it can ship from more than one place.</p>
+
+    <div class="feature">
+      <div class="f-name">Multi-warehouse / multi-location inventory</div>
+      <span class="f-status missing">missing</span>
+      <div class="f-note">No warehouse, location, or fulfillment-center model anywhere in <code>vendor/lunarphp/core</code> or <code>lunar</code> — stock is a flat quantity on the variant. WooCommerce needs Calcurates or WooCommerce Warehouses add-ons for this; it's genuinely not a Lunar concept at all.</div>
+    </div>
+
+    <div class="feature">
+      <div class="f-name">Split shipment (one order, multiple packages/warehouses)</div>
+      <span class="f-status missing">missing</span>
+      <div class="f-note">Downstream of multi-warehouse — with a single implicit stock pool, there's nothing to split by. <code>CreateShippingLine</code> writes exactly one shipping line per order.</div>
+    </div>
+
+    <div class="feature">
+      <div class="f-name">Multiple pickup locations (choose a specific store)</div>
+      <span class="f-status missing">missing</span>
+      <div class="f-note">The <code>Collection</code> driver models pickup as a single yes/no rate per zone — no location entity to pick from, no per-location hours/capacity.</div>
+    </div>
+
+    <div class="feature">
+      <div class="f-name">Local delivery (distinct from carrier shipping or pickup)</div>
+      <span class="f-status missing">missing</span>
+      <div class="f-note">No radius/zone-based "we deliver it ourselves" driver — only <code>ShipBy</code>/<code>FlatRate</code> (carrier-agnostic priced shipping) and <code>Collection</code> (pickup) exist as concepts.</div>
+    </div>
+
+    <div class="feature">
+      <div class="f-name">Delivery date / time-slot selection at checkout</div>
+      <span class="f-status missing">missing</span>
+      <div class="f-note">No date/time field on <code>ShippingOption</code>, <code>CartAddress</code>, or the order shipping line. WooCommerce needs a dedicated delivery-date-picker plugin for this too — not a gap unique to Lunar, but still open here.</div>
+    </div>
+  </section>
+
+  <section class="category">
+    <div class="cat-head">
+      <span class="cat-num">05</span>
+      <h2>International &amp; risk</h2>
+    </div>
+    <p class="cat-note">What happens when a shipment crosses a border, or something goes wrong in transit.</p>
+
+    <div class="feature">
+      <div class="f-name">Customs documentation / HS codes per product</div>
+      <span class="f-status missing">missing</span>
+      <div class="f-note">No HS-code or customs-description field found on <code>Product</code>/<code>ProductVariant</code> migrations. Every international shipment needs one per line item to clear customs — researched requirement, not yet modeled anywhere in Lunar.</div>
+    </div>
+
+    <div class="feature">
+      <div class="f-name">Duties/taxes collected at checkout (DDP)</div>
+      <span class="f-status missing">missing</span>
+      <div class="f-note">Lunar's <code>CalculateTax</code> pipeline step handles sales tax/VAT on the cart itself, not import duty estimation for cross-border orders. DDP vs. DDU is the standard framing (seller-collects-upfront vs. customer-pays-on-delivery) — neither is modeled.</div>
+    </div>
+
+    <div class="feature">
+      <div class="f-name">Country/zone-restricted shipping</div>
+      <span class="f-status have">have</span>
+      <div class="f-note"><code>ShippingZone</code> type <code>countries</code>/<code>states</code>/<code>postcodes</code> already scopes which rates apply where — the building block international shipping would sit on top of.</div>
+    </div>
+
+    <div class="feature">
+      <div class="f-name">Shipping insurance / package protection at checkout</div>
+      <span class="f-status missing">missing</span>
+      <div class="f-note">No insurance line-item concept in core. On Shopify this is exclusively third-party (ShipInsure, Route, Simply Shipping Protection) — not a platform-native feature there either, so the gap is normal, not distinctive.</div>
+    </div>
+  </section>
+
+  <footer class="page">
+    <span>Compiled 2026-08-28 — inline citations from <code>vendor/lunarphp/core</code> and <code>vendor/lunarphp/table-rate-shipping</code> source are direct reads; DDP/DDU, carrier-API, label, and warehouse claims are sourced from web research on Shopify/WooCommerce/PrestaShop, marked accordingly by context.</span>
+    <span>boboko-core / docs</span>
+  </footer>
+
+</div>
diff --git a/docs/shopify-import.md b/docs/shopify-import.md
index 8534085..5a477db 100644
--- a/docs/shopify-import.md
+++ b/docs/shopify-import.md
@@ -2,6 +2,9 @@
 
 Findings from comparing a real Shopify product export CSV against Lunar's schema (`vendor/lunarphp/core`), plus the resulting implementation plan for `MigrateImport\Shopify\ShopifyExportImporter`.
 
+Need to discard everything and re-import from scratch (e.g. after a schema/indexer change that
+only applies to newly-created rows)? See `docs/shopify-reimport.md`.
+
 ## Idempotency problem
 
 Nothing in Lunar tracks "this record came from external system X, ID Y." Re-running an import with no external-ID tracking would duplicate every product on each run.
diff --git a/docs/shopify-reimport.md b/docs/shopify-reimport.md
new file mode 100644
index 0000000..a5de9b3
--- /dev/null
+++ b/docs/shopify-reimport.md
@@ -0,0 +1,149 @@
+# Wiping products before a clean Shopify re-import
+
+A runbook for discarding every imported product (and everything that hangs off one —
+variants, prices, media, reviews, options/values, the Meilisearch documents) and re-running
+`ShopifyExportImporter` from scratch. Useful after a schema/indexer change that only applies to
+newly-created rows (see "Why a wipe, not an update" below), or when the export CSV itself changed
+enough that stale products need to go, not just be updated in place.
+
+Every command below is a `tinker --execute=` one-liner run inside the app container — adjust the
+exec prefix (`./bin/dc-core.sh exec app ...`, `docker compose exec app ...`, etc.) for your setup.
+
+---
+
+## Why a wipe, not an update
+
+`ShopifyExportImporter`'s resolvers are mostly `firstOrCreate` — re-running the importer against
+an *existing* database updates matched rows but leaves already-created ones exactly as they were.
+That's the right behavior for routine re-imports (an updated price, a new variant), but it means a
+change to what gets set **at creation time only** — e.g. `ProductOptionResolver` now also setting
+`label`, not just `name`, on a `ProductOption` — never reaches a `ProductOption` row that already
+exists. A wipe forces every row to go through creation again, picking up such fixes.
+
+---
+
+## 1. Delete every product
+
+Cascades to `ProductVariant`, prices, and Spatie media rows — verified live (see
+`shopify-import.md`'s own history/commit log for context). Also removes each product's Meilisearch
+document automatically, via Scout's own delete hook fired on `forceDelete()` — no separate
+`scout:flush` needed.
+
+```php
+\Lunar\Models\Product::withTrashed()->get()->each->forceDelete();
+```
+
+**Let this run to completion.** Interrupting it mid-loop (e.g. Ctrl+C on the tinker session) stops
+after whichever product it was on, leaving the rest undeleted — safe to just re-run the same
+command again afterward, since already-deleted products are simply skipped.
+
+Verify:
+
+```php
+\Lunar\Models\Product::withTrashed()->count(); // 0
+```
+
+### Requires: `product_reviews.product_id` cascades on delete
+
+`product_reviews` (boboko-core's own table, not Lunar's) originally had no `ON DELETE` clause on
+its `product_id` foreign key — deleting a reviewed product threw a constraint violation instead of
+the review going with it. Fixed by
+`database/migrations/2026_09_03_000001_add_cascade_delete_to_product_reviews_product_id.php`. Make
+sure this migration has actually run (`php artisan migrate`) before step 1, or a product with
+reviews will fail to delete.
+
+---
+
+## 2. Delete product options and values
+
+Not touched by step 1 (`ProductOption`/`ProductOptionValue` aren't scoped to one product — they're
+shared across the catalog, per `ProductOptionResolver::resolveOption()`'s `shared: true`). Safe to
+delete in full once every product (and therefore every variant referencing an option value via the
+`product_option_value_product_variant` pivot) is gone — deleting values while variants still
+reference them throws the same kind of FK violation step 1 guards against.
+
+```php
+\Lunar\Models\ProductOptionValue::query()->delete();
+\Lunar\Models\ProductOption::query()->delete();
+```
+
+Verify:
+
+```php
+\Lunar\Models\ProductOption::count();      // 0
+\Lunar\Models\ProductOptionValue::count(); // 0
+```
+
+---
+
+## 3. Clear the import mappings
+
+Without this, the importer's `ImportMapping::resolve(...)` calls still find the (now-deleted)
+mappings' rows absent, so this step is really about not leaving stale mapping rows pointing at
+nothing — `ImportMapping` rows aren't foreign-keyed to the models they map (`morphTo`, no
+constraint), so leaving them wouldn't break the re-import, but a stale mapping for a product that
+no longer exists is dead weight.
+
+```php
+\Modules\Core\MigrateImport\Models\ImportMapping::where('source', 'shopify')->delete();
+```
+
+Verify:
+
+```php
+\Modules\Core\MigrateImport\Models\ImportMapping::where('source', 'shopify')->count(); // 0
+```
+
+---
+
+## 4. Re-run the importer
+
+`boboko:migrate:import` dispatches `RunMigrateImportJob` onto the queue — **not synchronous** —
+so a queue worker must actually be running (`php artisan queue:work`, or your dev queue container)
+or the job just sits queued.
+
+```bash
+php artisan boboko:migrate:import --source=shopify --type=export --file=<absolute path to the CSV>
+```
+
+The `--file` value must be an **absolute path** inside the container (e.g.
+`/var/www/html/storage/app/private/imports/shopify/products_export.csv`) when running
+non-interactively — a path relative to `storage/app/private/imports` only resolves correctly when
+the command can fall back to its interactive prompt, which isn't available in a scripted/non-TTY
+run.
+
+Watch the queue worker's own log output for `FAIL` entries (see `docs/lunar.md` or your compose
+setup for how logs are routed to `docker compose logs`) — a clean run shows every
+`Laravel\Scout\Jobs\MakeSearchable` / `Spatie\MediaLibrary\Conversions\Jobs\PerformConversionsJob`
+line ending `DONE`, never `FAIL`.
+
+---
+
+## 5. Re-sync Meilisearch and reindex
+
+```bash
+php artisan lunar:meilisearch:setup
+php artisan lunar:meilisearch:tune-product-search
+php artisan lunar:search:index "Lunar\Models\Product" --refresh
+```
+
+`--refresh` re-syncs filterable/sortable index settings *and* reindexes every document — it does
+not reset `typoTolerance`/`prefixSearch` (confirmed live: both survived a `--refresh` run
+unchanged), so `tune-product-search` only needs re-running here for completeness/if it hadn't
+already been applied, not because `--refresh` would have clobbered it.
+
+---
+
+## Verifying the result
+
+```php
+// Product count should match the CSV's actual unique `Handle` count, not
+// whatever the database held before the wipe — those aren't the same number
+// if stale/manually-added products existed alongside the CSV-sourced ones.
+\Lunar\Models\Product::count();
+
+// Spot-check that at least one variant picked up its own image (see
+// shopify-import.md's "Images" section) — 0 is only correct if the CSV
+// genuinely has no `Variant Image` values populated.
+\Lunar\Models\ProductVariant::has('images')->count();
+```
diff --git a/lang/el/countries.php b/lang/el/countries.php
new file mode 100644
index 0000000..ead97b9
--- /dev/null
+++ b/lang/el/countries.php
@@ -0,0 +1,21 @@
+<?php
+
+/**
+ * Greek translations for Lunar\Models\Country::name, keyed by the exact
+ * English spelling Lunar's own installer seeds (`lunar:import:address-data`
+ * fetches http://data.lunarphp.io/countries+states.json — see
+ * vendor/lunarphp/core/src/Console/Commands/Import/AddressData.php).
+ * `Country`/`State` have no i18n support of their own (plain string
+ * columns, no translatable trait) — this is a plain Laravel lang file, not
+ * Modules\Core\Localization's DB-backed TranslationService, since these
+ * names are fixed reference data seeded once, not editable UI copy (see
+ * docs/localization.md). A consuming app's storefront looks this up
+ * itself, e.g. __('core::countries.'.$country->name) — core has no
+ * storefront UI of its own to wire this into (see docs/lunar.md).
+ *
+ * Only Greece is covered — this store operates within Greece; add further
+ * countries here as needed.
+ */
+return [
+    'Greece' => 'Ελλάδα',
+];
diff --git a/lang/el/states.php b/lang/el/states.php
new file mode 100644
index 0000000..fea5880
--- /dev/null
+++ b/lang/el/states.php
@@ -0,0 +1,52 @@
+<?php
+
+/**
+ * Greek translations for Lunar\Models\State::name, keyed by the exact
+ * English spelling Lunar's own installer seeds for Greece
+ * (`lunar:import:address-data` — see lang/el/countries.php's own docblock
+ * for the full explanation of why this is a plain lang file, not
+ * Modules\Core\Localization's TranslationService).
+ *
+ * Covers every Greek state/regional-unit row in Lunar's seed dataset —
+ * scoped to Greece only, matching this store's operating country.
+ */
+return [
+    'Achaea Regional Unit' => 'Περιφερειακή Ενότητα Αχαΐας',
+    'Aetolia-Acarnania Regional Unit' => 'Περιφερειακή Ενότητα Αιτωλοακαρνανίας',
+    'Arcadia Prefecture' => 'Νομός Αρκαδίας',
+    'Argolis Regional Unit' => 'Περιφερειακή Ενότητα Αργολίδας',
+    'Attica Region' => 'Περιφέρεια Αττικής',
+    'Boeotia Regional Unit' => 'Περιφερειακή Ενότητα Βοιωτίας',
+    'Central Greece Region' => 'Περιφέρεια Στερεάς Ελλάδας',
+    'Central Macedonia' => 'Κεντρική Μακεδονία',
+    'Chania Regional Unit' => 'Περιφερειακή Ενότητα Χανίων',
+    'Corfu Prefecture' => 'Νομός Κέρκυρας',
+    'Corinthia Regional Unit' => 'Περιφερειακή Ενότητα Κορινθίας',
+    'Crete Region' => 'Περιφέρεια Κρήτης',
+    'Drama Regional Unit' => 'Περιφερειακή Ενότητα Δράμας',
+    'East Attica Regional Unit' => 'Περιφερειακή Ενότητα Ανατολικής Αττικής',
+    'East Macedonia and Thrace' => 'Ανατολική Μακεδονία και Θράκη',
+    'Epirus Region' => 'Περιφέρεια Ηπείρου',
+    'Euboea' => 'Εύβοια',
+    'Grevena Prefecture' => 'Νομός Γρεβενών',
+    'Imathia Regional Unit' => 'Περιφερειακή Ενότητα Ημαθίας',
+    'Ioannina Regional Unit' => 'Περιφερειακή Ενότητα Ιωαννίνων',
+    'Ionian Islands Region' => 'Περιφέρεια Ιονίων Νήσων',
+    'Karditsa Regional Unit' => 'Περιφερειακή Ενότητα Καρδίτσας',
+    'Kastoria Regional Unit' => 'Περιφερειακή Ενότητα Καστοριάς',
+    'Kefalonia Prefecture' => 'Νομός Κεφαλληνίας',
+    'Kilkis Regional Unit' => 'Περιφερειακή Ενότητα Κιλκίς',
+    'Kozani Prefecture' => 'Νομός Κοζάνης',
+    'Laconia' => 'Λακωνία',
+    'Larissa Prefecture' => 'Νομός Λάρισας',
+    'Lefkada Regional Unit' => 'Περιφερειακή Ενότητα Λευκάδας',
+    'Pella Regional Unit' => 'Περιφερειακή Ενότητα Πέλλας',
+    'Peloponnese Region' => 'Περιφέρεια Πελοποννήσου',
+    'Phthiotis Prefecture' => 'Νομός Φθιώτιδας',
+    'Preveza Prefecture' => 'Νομός Πρέβεζας',
+    'Serres Prefecture' => 'Νομός Σερρών',
+    'South Aegean' => 'Νότιο Αιγαίο',
+    'Thessaloniki Regional Unit' => 'Περιφερειακή Ενότητα Θεσσαλονίκης',
+    'West Greece Region' => 'Περιφέρεια Δυτικής Ελλάδας',
+    'West Macedonia Region' => 'Περιφέρεια Δυτικής Μακεδονίας',
+];
diff --git a/resources/views/auth/filament/pages/login.blade.php b/resources/views/auth/filament/pages/login.blade.php
index 352c696..5facf94 100644
--- a/resources/views/auth/filament/pages/login.blade.php
+++ b/resources/views/auth/filament/pages/login.blade.php
@@ -2,7 +2,7 @@
 
     @if (! $otpSent)
         <form wire:submit="requestOtp">
-            <div class="grid gap-y-4">
+            <div style="display: flex; flex-direction: column; row-gap: 1rem;">
                 <x-filament::input.wrapper>
                     <x-filament::input
                         type="email"
@@ -24,7 +24,7 @@
         </form>
     @else
         <form wire:submit="authenticate">
-            <div class="grid gap-y-4">
+            <div style="display: flex; flex-direction: column; row-gap: 1rem;">
                 <p class="text-sm text-gray-500">
                     A login code was sent to <strong>{{ $email }}</strong>.
                 </p>
diff --git a/resources/views/order/infolists/transaction.blade.php b/resources/views/order/infolists/transaction.blade.php
new file mode 100644
index 0000000..0131675
--- /dev/null
+++ b/resources/views/order/infolists/transaction.blade.php
@@ -0,0 +1,127 @@
+@php
+    $transaction = $getRecord();
+    $notes = $transaction->notes ?: ($transaction->meta['notes'] ?? null);
+@endphp
+
+@once
+    @php
+        $renderPaymentIcons();
+    @endphp
+@endonce
+<div
+    @class([
+        'text-sm rounded-lg shadow-md border dark:bg-gray-900',
+        'text-gray-950 dark:text-white',
+        match($transaction->type){
+            'refund' => 'border-orange-300',
+            'intent' => 'border-sky-300',
+            'capture' => 'border-green-300',
+            default => 'border-gray-300',
+        },
+        '!border-red-500 bg-red-50' => !$transaction->success,
+        'bg-gray-50' => $transaction->success,
+    ])
+>
+    <div class="p-2 space-y-2">
+        <div class="px-4 py-2 rounded text-xs bg-white dark:bg-gray-800 shadow text-gray-600 dark:text-gray-400 ring-1 ring-gray-100 dark:ring-gray-700">
+            <span>{{ $transaction->driver }}</span> //
+            <span>{{ $transaction->reference }}</span>
+        </div>
+
+        <div class="flex items-center justify-between p-4 bg-white dark:bg-gray-800 rounded shadow ring-1 ring-gray-100 dark:ring-gray-700">
+            <div class="flex items-center gap-6">
+                <div>
+                    <strong class="text-xs">
+                        {{ $transaction->status }}
+                    </strong>
+                </div>
+
+                <div>
+                    <svg viewBox="0 0 50 50" class="w-10">
+                        <use xlink:href="#{{ strtolower($transaction->card_type) }}"></use>
+                    </svg>
+                </div>
+
+                @if($transaction->last_four)
+                    <p class="text-sm">
+                        <span class="inline-block -translate-y-px">
+                            &lowast;&lowast;&lowast;&lowast; &lowast;&lowast;&lowast;&lowast; &lowast;&lowast;&lowast;&lowast;
+                        </span>
+
+                        <span class="font-medium">
+                            {{ (string) $transaction->last_four }}
+                        </span>
+                    </p>
+                @endif
+            </div>
+
+            <strong
+                @class([
+                    "text-sm",
+                    'text-red-500' => !$transaction->success,
+                    match($transaction->type){
+                        'refund' => "text-orange-500",
+                        default => "text-gray-900 dark:text-gray-100",
+                    },
+                ])
+            >
+                @if($transaction->type == 'refund')-@endif{{ $transaction->amount->formatted }}
+            </strong>
+        </div>
+
+        <div class="px-4 py-2 bg-white dark:bg-gray-800 shadow rounded flex items-center justify-between text-gray-600 dark:text-gray-400 ring-1 ring-gray-100 dark:ring-gray-700">
+            <div class="text-xs flex items-center gap-2">
+                <div>
+                    <x-filament::icon
+                        icon="heroicon-o-clock"
+                        class="w-4"
+                    />
+                </div>
+                <span>{{ $transaction->created_at->format('jS F Y h:ia') }}</span>
+            </div>
+
+            <div class="flex space-x-2">
+            @foreach($transaction->paymentChecks() as $check)
+                    <x-filament::badge
+                        :icon="$check->successful ? 'heroicon-m-check' : 'heroicon-m-x-mark'"
+                        :color="$check->successful ?  \Filament\Support\Colors\Color::Sky : 'gray'"
+                    >
+                        {{ $check->label }}: {{ $check->message }}
+                    </x-filament::badge>
+            @endforeach
+            </div>
+        </div>
+
+        @if($notes)
+            <div class="px-4 py-2 bg-white dark:bg-gray-800 shadow flex items-center rounded gap-2 ring-1 ring-gray-100 dark:ring-gray-700">
+                <div>
+                    <x-filament::icon
+                        icon="heroicon-o-chat-bubble-oval-left-ellipsis"
+                        class="w-4"
+                    />
+                </div>
+
+                <p class="text-sm">{{ $notes }}</p>
+            </div>
+        @endif
+    </div>
+
+    <div
+        @class([
+            "bottom-0 left-0 block w-full text-center rounded-b-lg border-t text-xs py-1",
+            "!bg-red-50 !dark:bg-red-400/10 !border-red-300 !text-red-600 !dark:text-red-400" => !$transaction->success,
+            match($transaction->type){
+                'refund' => "bg-orange-50 dark:bg-orange-400/10 border-orange-300 text-orange-600 dark:text-orange-400",
+                'intent' => "bg-sky-50 dark:bg-sky-400/10 border-sky-300 text-sky-600 dark:text-sky-400",
+                'capture' => "bg-green-50 dark:bg-green-400/10 border-green-300 text-green-600 dark:text-green-400",
+                default => "bg-gray-50 dark:bg-gray-400/10 border-gray-300 text-gray-600 dark:text-gray-400",
+            },
+        ])
+    >
+        @if(!$transaction->success)
+            {{ __('lunarpanel::order.transactions.failed') }}
+        @else
+            {{ __('lunarpanel::order.transactions.'.$transaction->type) }}
+        @endif
+    </div>
+</div>
diff --git a/resources/views/order/notifications/captured.blade.php b/resources/views/order/notifications/captured.blade.php
new file mode 100644
index 0000000..06b97e2
--- /dev/null
+++ b/resources/views/order/notifications/captured.blade.php
@@ -0,0 +1,3 @@
+<p>Hi,</p>
+
+<p>Payment of <strong>{{ $amount }}</strong> for your order <strong>{{ $reference }}</strong> has been captured.</p>
diff --git a/resources/views/order/notifications/completed.blade.php b/resources/views/order/notifications/completed.blade.php
new file mode 100644
index 0000000..d5df044
--- /dev/null
+++ b/resources/views/order/notifications/completed.blade.php
@@ -0,0 +1,3 @@
+<p>Hi,</p>
+
+<p>Your order <strong>{{ $reference }}</strong> is complete. Thanks for shopping with us!</p>
diff --git a/resources/views/order/notifications/delivered.blade.php b/resources/views/order/notifications/delivered.blade.php
new file mode 100644
index 0000000..5e3f1d4
--- /dev/null
+++ b/resources/views/order/notifications/delivered.blade.php
@@ -0,0 +1,3 @@
+<p>Hi,</p>
+
+<p>Good news — your order <strong>{{ $reference }}</strong> has been delivered.</p>
diff --git a/resources/views/order/notifications/dispatched.blade.php b/resources/views/order/notifications/dispatched.blade.php
new file mode 100644
index 0000000..b89cf17
--- /dev/null
+++ b/resources/views/order/notifications/dispatched.blade.php
@@ -0,0 +1,3 @@
+<p>Hi,</p>
+
+<p>Your order <strong>{{ $reference }}</strong> is on its way.</p>
diff --git a/resources/views/order/notifications/pickup-ready.blade.php b/resources/views/order/notifications/pickup-ready.blade.php
new file mode 100644
index 0000000..0fefc06
--- /dev/null
+++ b/resources/views/order/notifications/pickup-ready.blade.php
@@ -0,0 +1,3 @@
+<p>Hi,</p>
+
+<p>Your order <strong>{{ $reference }}</strong> is ready for pickup in store.</p>
diff --git a/resources/views/order/notifications/placed.blade.php b/resources/views/order/notifications/placed.blade.php
new file mode 100644
index 0000000..0e1b7aa
--- /dev/null
+++ b/resources/views/order/notifications/placed.blade.php
@@ -0,0 +1,11 @@
+<p>Hi,</p>
+
+<p>Thanks for your order! Your order <strong>{{ $reference }}</strong> is confirmed.</p>
+
+<ul>
+    @foreach ($lines as $line)
+        <li>{{ $line->quantity }} &times; {{ $line->description }} — {{ $line->total?->formatted }}</li>
+    @endforeach
+</ul>
+
+<p>Total: <strong>{{ $total }}</strong></p>
diff --git a/resources/views/order/notifications/refunded.blade.php b/resources/views/order/notifications/refunded.blade.php
new file mode 100644
index 0000000..59228a2
--- /dev/null
+++ b/resources/views/order/notifications/refunded.blade.php
@@ -0,0 +1,3 @@
+<p>Hi,</p>
+
+<p>A refund of <strong>{{ $amount }}</strong> has been issued for your order <strong>{{ $reference }}</strong>.</p>
diff --git a/resources/views/order/notifications/status-updated.blade.php b/resources/views/order/notifications/status-updated.blade.php
new file mode 100644
index 0000000..fbcd470
--- /dev/null
+++ b/resources/views/order/notifications/status-updated.blade.php
@@ -0,0 +1,3 @@
+<p>Hi,</p>
+
+<p>Your order <strong>{{ $reference }}</strong> is now: <strong>{{ $statusLabel }}</strong></p>
diff --git a/src/Auth/Exceptions/OtpThrottledException.php b/src/Auth/Exceptions/OtpThrottledException.php
new file mode 100644
index 0000000..246b841
--- /dev/null
+++ b/src/Auth/Exceptions/OtpThrottledException.php
@@ -0,0 +1,20 @@
+<?php
+
+namespace Modules\Core\Auth\Exceptions;
+
+use RuntimeException;
+
+/**
+ * Thrown by Modules\Core\Auth\Services\UserOtpService::generateAndSend()
+ * when an email has requested too many codes too quickly — caps both
+ * mail-bombing one inbox and the "just request a fresh code to reset my
+ * guess count" loophole a per-code attempt cap alone doesn't close.
+ */
+class OtpThrottledException extends RuntimeException
+{
+    public function __construct(
+        public readonly int $availableInSeconds,
+    ) {
+        parent::__construct("Too many code requests. Try again in {$availableInSeconds} second(s).");
+    }
+}
diff --git a/src/Auth/Extensions/StaffResourceExtension.php b/src/Auth/Extensions/StaffResourceExtension.php
index 02d04db..a4d604d 100644
--- a/src/Auth/Extensions/StaffResourceExtension.php
+++ b/src/Auth/Extensions/StaffResourceExtension.php
@@ -2,18 +2,18 @@
 
 namespace Modules\Core\Auth\Extensions;
 
-use Filament\Forms\Form;
+use Filament\Schemas\Schema;
 use Lunar\Admin\Support\Extending\ResourceExtension;
 
 class StaffResourceExtension extends ResourceExtension
 {
-    public function extendForm(Form $form): Form
+    public function extendForm(Schema $form): Schema
     {
         $schema = collect($form->getComponents())
             ->reject(fn ($component) => method_exists($component, 'getName') && $component->getName() == 'password')
             ->values()
             ->all();
 
-        return $form->schema($schema);
+        return $form->components($schema);
     }
 }
diff --git a/src/Auth/Filament/Pages/Login.php b/src/Auth/Filament/Pages/Login.php
index 883aa4b..d431ffd 100644
--- a/src/Auth/Filament/Pages/Login.php
+++ b/src/Auth/Filament/Pages/Login.php
@@ -15,7 +15,7 @@ class Login extends SimplePage
 {
     use WithRateLimiting;
 
-    protected static string $view = 'core::auth.filament.pages.login';
+    protected string $view = 'core::auth.filament.pages.login';
 
     public ?string $email = '';
     public ?string $otp = '';
@@ -78,7 +78,7 @@ class Login extends SimplePage
             ]);
         }
 
-        if ($staff instanceof FilamentUser && !$staff->canAccessPanel(Filament::getCurrentPanel())) {
+        if ($staff instanceof FilamentUser && !$staff->canAccessPanel(Filament::getCurrentOrDefaultPanel())) {
             throw ValidationException::withMessages([
                 'email' => 'You do not have access to this panel.',
             ]);
diff --git a/src/Auth/Http/Middleware/EnsureSessionNotRevoked.php b/src/Auth/Http/Middleware/EnsureSessionNotRevoked.php
new file mode 100644
index 0000000..824262b
--- /dev/null
+++ b/src/Auth/Http/Middleware/EnsureSessionNotRevoked.php
@@ -0,0 +1,50 @@
+<?php
+
+namespace Modules\Core\Auth\Http\Middleware;
+
+use Closure;
+use Illuminate\Http\Request;
+use Illuminate\Support\Facades\Auth;
+use Modules\Core\Auth\Services\UserSessionService;
+use Symfony\Component\HttpFoundation\Response;
+
+/**
+ * The enforcement half of the session registry — see
+ * Modules\Core\Auth\Services\UserSessionService's own docblock. Not
+ * auto-registered anywhere (no routes/kernel wiring exist in this
+ * package — see Modules\Core\Customer\Services\CustomerAccountService's
+ * own docblock for why this branch stops at services); a consuming app
+ * adds this to its `web` middleware group (after `auth`) to actually get
+ * "logout everywhere" enforcement.
+ *
+ * A request with no recorded UserSession at all (see
+ * UserSessionService::currentSession()'s own docblock) is let through —
+ * only an EXPLICITLY revoked session is rejected.
+ */
+class EnsureSessionNotRevoked
+{
+    public function __construct(
+        private readonly UserSessionService $sessions,
+    ) {}
+
+    public function handle(Request $request, Closure $next): Response
+    {
+        if (! Auth::check()) {
+            return $next($request);
+        }
+
+        $session = $this->sessions->currentSession();
+
+        if ($session && $session->isRevoked()) {
+            Auth::logout();
+            $request->session()->invalidate();
+            $request->session()->regenerateToken();
+
+            abort(401, 'Your session has been revoked. Please log in again.');
+        }
+
+        $session?->update(['last_used_at' => now()]);
+
+        return $next($request);
+    }
+}
diff --git a/src/Auth/Models/UserSession.php b/src/Auth/Models/UserSession.php
new file mode 100644
index 0000000..219b7da
--- /dev/null
+++ b/src/Auth/Models/UserSession.php
@@ -0,0 +1,33 @@
+<?php
+
+namespace Modules\Core\Auth\Models;
+
+use Illuminate\Database\Eloquent\Model;
+use Illuminate\Database\Eloquent\Relations\BelongsTo;
+
+/**
+ * One row per login (see Modules\Core\Auth\Services\UserOtpService::
+ * validate()) — see that table's own migration docblock for why this
+ * exists independent of the actual session-store driver.
+ */
+class UserSession extends Model
+{
+    protected $guarded = [];
+
+    protected $casts = [
+        'last_used_at' => 'datetime',
+        'revoked_at' => 'datetime',
+    ];
+
+    public function user(): BelongsTo
+    {
+        $model = config('auth.providers.users.model');
+
+        return $this->belongsTo($model);
+    }
+
+    public function isRevoked(): bool
+    {
+        return $this->revoked_at !== null;
+    }
+}
diff --git a/src/Auth/Services/UserOtpService.php b/src/Auth/Services/UserOtpService.php
index aaa8b18..0b535b1 100644
--- a/src/Auth/Services/UserOtpService.php
+++ b/src/Auth/Services/UserOtpService.php
@@ -2,18 +2,76 @@
 
 namespace Modules\Core\Auth\Services;
 
+use Illuminate\Contracts\Auth\Authenticatable;
+use Illuminate\Http\Request;
+use Illuminate\Support\Facades\Auth;
+use Illuminate\Support\Facades\DB;
 use Illuminate\Support\Facades\Event;
 use Illuminate\Support\Facades\Mail;
+use Illuminate\Support\Facades\RateLimiter;
 use Modules\Core\Auth\Events\UserAuthenticated;
+use Modules\Core\Auth\Exceptions\OtpThrottledException;
 use Modules\Core\Auth\Mail\UserOtpMail;
 
+/**
+ * The storefront's passwordless login — a shopper supplies only an email
+ * (Shopify-style), gets a 6-digit code, and validate() authenticates the
+ * `web` guard via Auth::login().
+ *
+ * That alone is enough to merge/associate any active guest cart into the
+ * now-known customer — Auth::login() fires Illuminate\Auth\Events\Login,
+ * which Lunar's own Lunar\Listeners\CartSessionAuthListener (registered
+ * unconditionally in LunarServiceProvider::boot(), no opt-in needed)
+ * already listens to, calling CartSession::associate() with
+ * config('lunar.cart.auth_policy') — 'merge' by default, 'override' if a
+ * consumer changes that config. Deliberately no cart-association call
+ * here: doing our own on top would run a SECOND merge attempt with a
+ * hardcoded policy that ignores whatever the consumer configured.
+ *
+ * generateAndSend()'s find-or-create already triggers the full
+ * Customer/User pairing cascade for a genuinely new email — see
+ * Modules\Core\Auth\Events\UserCreated's own docblock and
+ * Modules\Core\Customer\Listeners\CreateCustomerForUser.
+ *
+ * Two independent throttles, both configured under core.auth.otp — see
+ * config/core.php's own comment for why they're separate: max_attempts
+ * caps wrong guesses against ONE code; generation_limit caps how often a
+ * NEW code can be requested for the same email at all (closes both the
+ * "regenerate to reset my guess count" loophole and mail-bombing one
+ * inbox).
+ *
+ * validate() also records a UserSessionService entry for the new login —
+ * see that class's own docblock for the "logout everywhere" registry
+ * this feeds (Modules\Core\Auth\Http\Middleware\EnsureSessionNotRevoked
+ * is the enforcement half; a consuming app must add it to its own
+ * middleware stack). $request is optional purely so this service stays
+ * callable from a context with no HTTP request at all (a console
+ * command, a test) — user-agent/ip are simply not recorded when omitted.
+ */
 class UserOtpService
 {
     private const EXPIRY_MINUTES = 10;
     private const CODE_LENGTH = 6;
 
+    public function __construct(
+        private readonly UserSessionService $sessions,
+    ) {}
+
+    /**
+     * @throws OtpThrottledException if this email has requested too many
+     *   codes within core.auth.otp.generation_decay_minutes
+     */
     public function generateAndSend(string $email): bool
     {
+        $limiterKey = $this->generationLimiterKey($email);
+        $maxGenerations = (int) config('core.auth.otp.generation_limit', 3);
+
+        if (RateLimiter::tooManyAttempts($limiterKey, $maxGenerations)) {
+            throw new OtpThrottledException(RateLimiter::availableIn($limiterKey));
+        }
+
+        RateLimiter::hit($limiterKey, (int) config('core.auth.otp.generation_decay_minutes', 10) * 60);
+
         $model = config('auth.providers.users.model');
         $user = $model::firstOrCreate(['email' => $email]);
 
@@ -21,6 +79,7 @@ class UserOtpService
 
         $user->otp_code = $code;
         $user->otp_expires_at = now()->addMinutes(self::EXPIRY_MINUTES);
+        $user->otp_attempts = 0;
         $user->save();
 
         Mail::to($user->email)->send(new UserOtpMail($user->name ?? $user->email, $code));
@@ -28,25 +87,70 @@ class UserOtpService
         return true;
     }
 
-    public function validate(string $email, string $code)
+    /**
+     * A wrong code counts against core.auth.otp.max_attempts and, once
+     * reached, invalidates the code entirely — the shopper must request
+     * a fresh one via generateAndSend() (itself throttled independently
+     * — see this class's own docblock) rather than being able to keep
+     * guessing against a still-live code for the rest of its 10-minute
+     * expiry window.
+     */
+    public function validate(string $email, string $code, ?Request $request = null): ?Authenticatable
     {
         $model = config('auth.providers.users.model');
-        $user = $model::where('email', $email)->first();
 
-        if (! $user) {
+        // lockForUpdate() + a transaction make the read-check-increment-save
+        // below atomic across concurrent requests for the same user — without
+        // it, two guesses fired in parallel can each read the same
+        // pre-increment otp_attempts value and both save past
+        // max_attempts, letting an attacker exceed the lockout by
+        // parallelizing requests instead of sending them serially.
+        $result = DB::transaction(function () use ($model, $email, $code) {
+            $user = $model::where('email', $email)->lockForUpdate()->first();
+
+            if (! $user || ! $user->otp_expires_at || now()->isAfter($user->otp_expires_at)) {
+                return null;
+            }
+
+            if (! hash_equals((string) $user->otp_code, $code)) {
+                $user->otp_attempts++;
+
+                if ($user->otp_attempts >= (int) config('core.auth.otp.max_attempts', 5)) {
+                    $user->otp_code = null;
+                    $user->otp_expires_at = null;
+                    $user->otp_attempts = 0;
+                }
+
+                $user->save();
+
+                return null;
+            }
+
+            $user->otp_code = null;
+            $user->otp_expires_at = null;
+            $user->otp_attempts = 0;
+            $user->save();
+
+            return $user;
+        });
+
+        if (! $result) {
             return null;
         }
 
-        if (! $user->otp_expires_at || $user->otp_code != $code || now()->isAfter($user->otp_expires_at)) {
-            return null;
-        }
+        RateLimiter::clear($this->generationLimiterKey($email));
 
-        $user->otp_code = null;
-        $user->otp_expires_at = null;
-        $user->save();
+        Auth::login($result);
 
-        Event::dispatch(new UserAuthenticated($user));
+        $this->sessions->record($result, $request);
 
-        return $user;
+        Event::dispatch(new UserAuthenticated($result));
+
+        return $result;
+    }
+
+    private function generationLimiterKey(string $email): string
+    {
+        return 'otp-generate:'.strtolower($email);
     }
 }
diff --git a/src/Auth/Services/UserSessionService.php b/src/Auth/Services/UserSessionService.php
new file mode 100644
index 0000000..d1f36b1
--- /dev/null
+++ b/src/Auth/Services/UserSessionService.php
@@ -0,0 +1,105 @@
+<?php
+
+namespace Modules\Core\Auth\Services;
+
+use Illuminate\Contracts\Auth\Authenticatable;
+use Illuminate\Http\Request;
+use Illuminate\Support\Str;
+use Modules\Core\Auth\Models\UserSession;
+
+/**
+ * The record/revoke half of the session registry — see
+ * database/migrations/2026_09_15_000001_create_user_sessions_table.php's
+ * own docblock for why this exists (SESSION_DRIVER=redis in this app has
+ * no "sessions" table to purge by user_id). The enforcement half is
+ * Modules\Core\Auth\Http\Middleware\EnsureSessionNotRevoked, which reads
+ * the token this class stamps into the session payload.
+ */
+class UserSessionService
+{
+    private const SESSION_TOKEN_KEY = 'user_session_token';
+
+    /**
+     * Called once, right after Auth::login() succeeds (see
+     * UserOtpService::validate()) — generates a fresh token, records it,
+     * and stamps it into the CURRENT session payload so
+     * EnsureSessionNotRevoked can look it up on later requests.
+     */
+    public function record(Authenticatable $user, ?Request $request = null): UserSession
+    {
+        $token = Str::random(64);
+
+        $session = UserSession::create([
+            'user_id' => $user->getAuthIdentifier(),
+            'token' => $token,
+            'user_agent' => $request?->userAgent(),
+            'ip_address' => $request?->ip(),
+            'last_used_at' => now(),
+        ]);
+
+        session([self::SESSION_TOKEN_KEY => $token]);
+
+        return $session;
+    }
+
+    /**
+     * Revokes every OTHER active session for $user — the current one
+     * (matched by the token in the CURRENT session payload) is left
+     * alone, matching Laravel's own logoutOtherDevices() semantics
+     * (there just isn't a password to re-verify against here — this is a
+     * passwordless account, so revocation is simply "every row that
+     * isn't the one making this request").
+     *
+     * Known, deliberately accepted gap: this requires only a currently
+     * valid session, not a freshly-completed login — so anyone holding
+     * an already-authenticated session (e.g. someone who sits down at an
+     * account left logged in on a shared/public PC) can use this to
+     * evict the real owner's OTHER sessions just as easily as the real
+     * owner could use it to evict an intruder's. A stricter version would
+     * require a fresh OTP re-verification (e.g. within the last few
+     * minutes) before allowing this call. Left as-is for now — revisit if
+     * this turns out to matter in practice, rather than building
+     * abuse-resistance against a threat model nobody's confirmed is real
+     * for this storefront.
+     */
+    public function revokeOtherSessions(Authenticatable $user): int
+    {
+        $currentToken = session(self::SESSION_TOKEN_KEY);
+
+        return UserSession::query()
+            ->where('user_id', $user->getAuthIdentifier())
+            ->whereNull('revoked_at')
+            ->when($currentToken, fn ($query) => $query->where('token', '!=', $currentToken))
+            ->update(['revoked_at' => now()]);
+    }
+
+    /**
+     * Revokes EVERY session for $user, current one included — for a
+     * "this account may be compromised" response, not a routine logout.
+     */
+    public function revokeAllSessions(Authenticatable $user): int
+    {
+        return UserSession::query()
+            ->where('user_id', $user->getAuthIdentifier())
+            ->whereNull('revoked_at')
+            ->update(['revoked_at' => now()]);
+    }
+
+    /**
+     * @return UserSession|null null if the CURRENT session has no
+     *   recorded token at all (e.g. a session predating this feature, or
+     *   one Auth::login() established outside UserOtpService) — treated
+     *   as valid by EnsureSessionNotRevoked rather than rejected, since
+     *   there's nothing to have been revoked.
+     */
+    public function currentSession(): ?UserSession
+    {
+        $token = session(self::SESSION_TOKEN_KEY);
+
+        if (! $token) {
+            return null;
+        }
+
+        return UserSession::where('token', $token)->first();
+    }
+}
diff --git a/src/Cart/Commands/DetectAbandonedCarts.php b/src/Cart/Commands/DetectAbandonedCarts.php
new file mode 100644
index 0000000..3169c86
--- /dev/null
+++ b/src/Cart/Commands/DetectAbandonedCarts.php
@@ -0,0 +1,89 @@
+<?php
+
+namespace Modules\Core\Cart\Commands;
+
+use Illuminate\Console\Command;
+use Illuminate\Support\Facades\Event;
+use Lunar\Models\Cart;
+use Modules\Core\Cart\Services\CartLifecycleService;
+use Modules\Core\Recovery\Events\CartAbandoned;
+use Modules\Core\Recovery\Events\CheckoutAbandoned;
+
+/**
+ * "Abandoned" is a derived state (Cart::updated_at older than
+ * config('core.cart.abandoned_after')) — nothing transitions a cart into it
+ * via a normal Eloquent write, so there's no model-event hook to dispatch
+ * CartAbandoned/CheckoutAbandoned from directly. This command is the only
+ * place that moment gets detected; run it on a schedule (see docs/cart.md).
+ *
+ * Splits Cart::scopeActive()'s two branches into their own events —
+ * see CartAbandoned/CheckoutAbandoned's docblocks for why they're distinct,
+ * not one combined "abandoned" state: a cart with no order at all is a much
+ * weaker purchase-intent signal than one with a draft order that was never
+ * placed.
+ *
+ * Deliberately does NOT write anything to Cart/Order — dispatch only. An
+ * earlier version recorded an "already notified" marker on Cart::meta/
+ * Order::meta, but that write bumped updated_at as an Eloquent side effect,
+ * which un-staled the very cart being marked abandoned (the same field
+ * abandonment staleness is computed from) — see docs/cart.md's former
+ * "Known bug" note. Cart/Checkout must have no way of writing abandonment
+ * state at all; every cart still matching the query below refires its event
+ * on every run until Recovery (not yet built — see
+ * docs/recovery-strategies.md) owns its own dedup/tracking table.
+ *
+ * Both queries require meta->recovery_consent = true — CartAbandoned/
+ * CheckoutAbandoned exist specifically to drive future recovery-email
+ * sends (Checkout\Services\CheckoutService::setRecoveryConsent() is where
+ * that consent is actually recorded), and a non-consenting cart's
+ * abandonment must never be dispatched at all, not merely filtered later
+ * at send time — see docs referenced above for the legal reasoning. This
+ * consent filter stays here rather than on Modules\Core\Cart\Services\
+ * CartLifecycleService, whose two "abandoned" queries this command builds
+ * on — dispatch eligibility is this command's own concern, not part of
+ * what "abandoned" means to a staff member browsing the admin panel. (The
+ * non-empty-lines requirement, by contrast, IS part of what "abandoned"
+ * means either way, so it lives on CartLifecycleService::abandonedCarts()
+ * itself, not here.)
+ */
+class DetectAbandonedCarts extends Command
+{
+    protected $signature = 'boboko:cart:detect-abandoned';
+
+    protected $description = 'Dispatch CartAbandoned/CheckoutAbandoned for carts that just crossed the abandonment threshold.';
+
+    public function handle(CartLifecycleService $lifecycle): void
+    {
+        $cartsAbandoned = 0;
+        $checkoutsAbandoned = 0;
+
+        $lifecycle->abandonedCarts(Cart::query())
+            ->where('meta->recovery_consent', true)
+            ->chunkById(200, function ($carts) use (&$cartsAbandoned) {
+                foreach ($carts as $cart) {
+                    Event::dispatch(new CartAbandoned($cart));
+
+                    $cartsAbandoned++;
+                }
+            });
+
+        $lifecycle->abandonedCheckouts(Cart::query())
+            ->where('meta->recovery_consent', true)
+            ->with(['orders' => fn ($query) => $query->whereNull('placed_at')])
+            ->chunkById(200, function ($carts) use (&$checkoutsAbandoned) {
+                foreach ($carts as $cart) {
+                    $order = $cart->orders->first();
+
+                    if ($order === null) {
+                        continue;
+                    }
+
+                    Event::dispatch(new CheckoutAbandoned($cart, $order));
+
+                    $checkoutsAbandoned++;
+                }
+            });
+
+        $this->components->info("Dispatched CartAbandoned for {$cartsAbandoned} cart(s), CheckoutAbandoned for {$checkoutsAbandoned} checkout(s).");
+    }
+}
diff --git a/src/Cart/Events/CartCleared.php b/src/Cart/Events/CartCleared.php
new file mode 100644
index 0000000..388bba7
--- /dev/null
+++ b/src/Cart/Events/CartCleared.php
@@ -0,0 +1,18 @@
+<?php
+
+namespace Modules\Core\Cart\Events;
+
+use Lunar\Models\Cart;
+
+class CartCleared
+{
+    /**
+     * @param  array<int, array{id: int, purchasable_type: string, purchasable_id: int, quantity: int, meta: array}>  $lines
+     *   Snapshot of every line that was in the cart before clearing — Cart::clear()
+     *   deletes all rows directly, so nothing here can be fresh CartLine instances.
+     */
+    public function __construct(
+        public readonly Cart $cart,
+        public readonly array $lines,
+    ) {}
+}
diff --git a/src/Cart/Events/CartCouponApplied.php b/src/Cart/Events/CartCouponApplied.php
new file mode 100644
index 0000000..3a77cd0
--- /dev/null
+++ b/src/Cart/Events/CartCouponApplied.php
@@ -0,0 +1,13 @@
+<?php
+
+namespace Modules\Core\Cart\Events;
+
+use Lunar\Models\Cart;
+
+class CartCouponApplied
+{
+    public function __construct(
+        public readonly Cart $cart,
+        public readonly string $code,
+    ) {}
+}
diff --git a/src/Cart/Events/CartCouponRemoved.php b/src/Cart/Events/CartCouponRemoved.php
new file mode 100644
index 0000000..896cea1
--- /dev/null
+++ b/src/Cart/Events/CartCouponRemoved.php
@@ -0,0 +1,13 @@
+<?php
+
+namespace Modules\Core\Cart\Events;
+
+use Lunar\Models\Cart;
+
+class CartCouponRemoved
+{
+    public function __construct(
+        public readonly Cart $cart,
+        public readonly string $code,
+    ) {}
+}
diff --git a/src/Cart/Events/CartLineAdded.php b/src/Cart/Events/CartLineAdded.php
new file mode 100644
index 0000000..88b3bed
--- /dev/null
+++ b/src/Cart/Events/CartLineAdded.php
@@ -0,0 +1,14 @@
+<?php
+
+namespace Modules\Core\Cart\Events;
+
+use Lunar\Models\Cart;
+use Lunar\Models\CartLine;
+
+class CartLineAdded
+{
+    public function __construct(
+        public readonly Cart $cart,
+        public readonly CartLine $line,
+    ) {}
+}
diff --git a/src/Cart/Events/CartLineMovedToCart.php b/src/Cart/Events/CartLineMovedToCart.php
new file mode 100644
index 0000000..14241ba
--- /dev/null
+++ b/src/Cart/Events/CartLineMovedToCart.php
@@ -0,0 +1,18 @@
+<?php
+
+namespace Modules\Core\Cart\Events;
+
+use Lunar\Models\Cart;
+use Lunar\Models\CartLine;
+
+/**
+ * The reverse of CartLineSaved — a previously saved-for-later line moved back
+ * into the purchasable cart (now counted in totals again).
+ */
+class CartLineMovedToCart
+{
+    public function __construct(
+        public readonly Cart $cart,
+        public readonly CartLine $line,
+    ) {}
+}
diff --git a/src/Cart/Events/CartLineRemoved.php b/src/Cart/Events/CartLineRemoved.php
new file mode 100644
index 0000000..fc72572
--- /dev/null
+++ b/src/Cart/Events/CartLineRemoved.php
@@ -0,0 +1,18 @@
+<?php
+
+namespace Modules\Core\Cart\Events;
+
+use Lunar\Models\Cart;
+
+class CartLineRemoved
+{
+    /**
+     * @param  array{id: int, purchasable_type: string, purchasable_id: int, quantity: int, meta: array}  $line
+     *   Snapshot of the removed line — the row is already deleted by the time this
+     *   event dispatches, so nothing here can be a fresh CartLine model instance.
+     */
+    public function __construct(
+        public readonly Cart $cart,
+        public readonly array $line,
+    ) {}
+}
diff --git a/src/Cart/Events/CartLineSaved.php b/src/Cart/Events/CartLineSaved.php
new file mode 100644
index 0000000..e736629
--- /dev/null
+++ b/src/Cart/Events/CartLineSaved.php
@@ -0,0 +1,20 @@
+<?php
+
+namespace Modules\Core\Cart\Events;
+
+use Lunar\Models\Cart;
+use Lunar\Models\CartLine;
+
+/**
+ * A line was moved OUT of the purchasable cart and into "saved for later" —
+ * not a removal (the row still exists), but distinct from CartLineUpdated
+ * since it's a state transition worth its own hook (e.g. abandoned-cart
+ * recovery treating a saved line very differently from a deleted one).
+ */
+class CartLineSaved
+{
+    public function __construct(
+        public readonly Cart $cart,
+        public readonly CartLine $line,
+    ) {}
+}
diff --git a/src/Cart/Events/CartLineUpdated.php b/src/Cart/Events/CartLineUpdated.php
new file mode 100644
index 0000000..ebf1df2
--- /dev/null
+++ b/src/Cart/Events/CartLineUpdated.php
@@ -0,0 +1,18 @@
+<?php
+
+namespace Modules\Core\Cart\Events;
+
+use Lunar\Models\Cart;
+use Lunar\Models\CartLine;
+
+class CartLineUpdated
+{
+    /**
+     * @param  array{quantity: int, meta: array}  $old  Snapshot before the update.
+     */
+    public function __construct(
+        public readonly Cart $cart,
+        public readonly CartLine $line,
+        public readonly array $old,
+    ) {}
+}
diff --git a/src/Cart/Exceptions/InvalidCouponException.php b/src/Cart/Exceptions/InvalidCouponException.php
new file mode 100644
index 0000000..c009444
--- /dev/null
+++ b/src/Cart/Exceptions/InvalidCouponException.php
@@ -0,0 +1,19 @@
+<?php
+
+namespace Modules\Core\Cart\Exceptions;
+
+use RuntimeException;
+
+/**
+ * Thrown by CartService::applyCoupon() when the given code doesn't match any
+ * currently-active, non-exhausted Discount — Lunar's own
+ * Discounts::validateCoupon() only returns a bool, it has no matching
+ * exception type of its own to reuse here.
+ */
+class InvalidCouponException extends RuntimeException
+{
+    public function __construct(public readonly string $couponCode)
+    {
+        parent::__construct("The coupon code \"{$couponCode}\" is not valid.");
+    }
+}
diff --git a/src/Cart/Filament/Resources/CartResource.php b/src/Cart/Filament/Resources/CartResource.php
new file mode 100644
index 0000000..7b22255
--- /dev/null
+++ b/src/Cart/Filament/Resources/CartResource.php
@@ -0,0 +1,125 @@
+<?php
+
+namespace Modules\Core\Cart\Filament\Resources;
+
+use Filament\Tables\Columns\TextColumn;
+use Filament\Actions\ViewAction;
+use Modules\Core\Cart\Filament\Resources\CartResource\Pages\ListCarts;
+use Modules\Core\Cart\Filament\Resources\CartResource\Pages\ViewCart;
+use Filament\Resources\Resource;
+use Filament\Tables;
+use Filament\Tables\Table;
+use Illuminate\Support\Carbon;
+use Lunar\Admin\Filament\Resources\CustomerResource;
+use Lunar\Models\Cart;
+use Modules\Core\Cart\Filament\Resources\CartResource\Pages;
+use Modules\Core\Cart\Services\CartLifecycleService;
+
+/**
+ * Read-only — a cart is managed entirely through the storefront (add/update/remove
+ * line, checkout), never hand-edited by staff. Lists every cart, guest carts
+ * included — see docs/cart.md ("Scope: every cart, identified or not"). An
+ * anonymous cart's Customer/User columns just render "—" (see table() below)
+ * rather than the row being hidden outright: most real traffic never reaches
+ * an identified user/customer, and "how many carts are ongoing/abandoned
+ * right now" is a real reporting need regardless of identity — excluding
+ * anonymous carts would silently undercount it. Lunar itself ships no cart
+ * admin view at all to follow a precedent from.
+ */
+class CartResource extends Resource
+{
+    protected static ?string $model = Cart::class;
+
+    protected static string | \BackedEnum | null $navigationIcon = 'heroicon-o-shopping-cart';
+
+    protected static string | \UnitEnum | null $navigationGroup = 'Sales';
+
+    protected static ?string $modelLabel = 'Cart';
+
+    protected static ?string $pluralModelLabel = 'Carts';
+
+    /**
+     * Count only, not a fetch — no rows are loaded. Combines BOTH abandoned
+     * states (`active()` already covers "no order at all" and "draft order,
+     * never placed" together — see ListCarts::getTabs()'s "Abandoned Cart" /
+     * "Abandoned Checkout" tabs for where they're split apart), not "Ongoing"
+     * — the badge is meant to answer "how many carts might need following up
+     * on," not the total including ones someone is actively shopping in right
+     * now.
+     */
+    public static function getNavigationBadge(): ?string
+    {
+        return (string) static::getEloquentQuery()->active()->where('updated_at', '<=', static::abandonedCutoff())->count();
+    }
+
+    public static function lifecycle(): CartLifecycleService
+    {
+        return app(CartLifecycleService::class);
+    }
+
+    /**
+     * `Cart::scopeActive()` (not-yet-converted-to-an-order carts) mixes two very
+     * different things together: a cart someone is actively shopping in right now,
+     * and one that's genuinely been left behind. Lunar tracks no time-based
+     * staleness signal of its own — `Cart::updated_at` plus a configurable
+     * threshold (`config('core.cart.abandoned_after')`, default 1 hour) is what
+     * this resource uses to tell them apart. A cart with no recent activity is
+     * "Abandoned"; anything more recent is "Ongoing".
+     */
+    public static function abandonedCutoff(): Carbon
+    {
+        return static::lifecycle()->abandonedCutoff();
+    }
+
+    public static function table(Table $table): Table
+    {
+        return $table
+            ->columns([
+                TextColumn::make('id')
+                    ->label('Cart')
+                    ->sortable(),
+                TextColumn::make('customer.full_name')
+                    ->label('Customer')
+                    ->placeholder('—')
+                    ->searchable()
+                    ->url(fn (Cart $record) => $record->customer_id !== null
+                        ? CustomerResource::getUrl('view', ['record' => $record->customer_id])
+                        : null),
+                TextColumn::make('user.email')
+                    ->label('User')
+                    ->placeholder('—')
+                    ->searchable(),
+                TextColumn::make('lines_count')
+                    ->label('Lines')
+                    ->counts('lines')
+                    ->sortable(),
+                TextColumn::make('lines_sum_quantity')
+                    ->label('Items')
+                    ->sum('lines', 'quantity')
+                    ->sortable(),
+                TextColumn::make('currency.code')
+                    ->label('Currency'),
+                TextColumn::make('updated_at')
+                    ->label('Last activity')
+                    ->dateTime()
+                    ->sortable(),
+            ])
+            ->recordActions([
+                ViewAction::make(),
+            ])
+            ->defaultSort('updated_at', 'desc');
+    }
+
+    public static function getPages(): array
+    {
+        return [
+            'index' => ListCarts::route('/'),
+            'view' => ViewCart::route('/{record}'),
+        ];
+    }
+
+    public static function canCreate(): bool
+    {
+        return false;
+    }
+}
diff --git a/src/Cart/Filament/Resources/CartResource/Pages/ListCarts.php b/src/Cart/Filament/Resources/CartResource/Pages/ListCarts.php
new file mode 100644
index 0000000..1d15f05
--- /dev/null
+++ b/src/Cart/Filament/Resources/CartResource/Pages/ListCarts.php
@@ -0,0 +1,51 @@
+<?php
+
+namespace Modules\Core\Cart\Filament\Resources\CartResource\Pages;
+
+use Filament\Schemas\Components\Tabs\Tab;
+use Filament\Resources\Pages\ListRecords;
+use Illuminate\Database\Eloquent\Builder;
+use Modules\Core\Cart\Filament\Resources\CartResource;
+use Modules\Core\Cart\Services\CartLifecycleService;
+
+class ListCarts extends ListRecords
+{
+    protected static string $resource = CartResource::class;
+
+    /**
+     * `Cart::completed_at` is declared/cast on the model but never actually written
+     * anywhere in Lunar core — it's dead, not a real "did this convert" signal.
+     * "Completed" instead means the cart has an order with `placed_at` set (a
+     * placed, not just drafted, order).
+     *
+     * `Cart::scopeActive()` (not yet converted to an order) actually mixes two
+     * distinct states: no order started at all, vs. a draft order exists
+     * (`placed_at IS NULL`) but was never placed — checkout was started, not
+     * finished. That's a real difference in purchase intent (a cart with a
+     * draft order is a much stronger signal than one with no order at all) and
+     * in reachability (checkout usually captures an email even for a guest),
+     * so they get separate tabs rather than one combined "no order yet"
+     * bucket — same distinction Modules\Core\Recovery\Events\CartAbandoned /
+     * Modules\Core\Recovery\Events\CheckoutAbandoned draw.
+     *
+     * The four query shapes below live on Modules\Core\Cart\Services\
+     * CartLifecycleService, shared with Modules\Core\Cart\Commands\
+     * DetectAbandonedCarts — see that service's docblock for why duplicating
+     * them independently in both places was worth centralizing.
+     */
+    public function getTabs(): array
+    {
+        $lifecycle = app(CartLifecycleService::class);
+
+        return [
+            'abandoned_cart' => Tab::make('Abandoned Cart')
+                ->modifyQueryUsing(fn (Builder $query) => $lifecycle->abandonedCarts($query)),
+            'abandoned_checkout' => Tab::make('Abandoned Checkout')
+                ->modifyQueryUsing(fn (Builder $query) => $lifecycle->abandonedCheckouts($query)),
+            'ongoing' => Tab::make('Ongoing')
+                ->modifyQueryUsing(fn (Builder $query) => $lifecycle->ongoing($query)),
+            'completed' => Tab::make('Completed')
+                ->modifyQueryUsing(fn (Builder $query) => $lifecycle->completed($query)),
+        ];
+    }
+}
diff --git a/src/Cart/Filament/Resources/CartResource/Pages/ViewCart.php b/src/Cart/Filament/Resources/CartResource/Pages/ViewCart.php
new file mode 100644
index 0000000..f4a4bbb
--- /dev/null
+++ b/src/Cart/Filament/Resources/CartResource/Pages/ViewCart.php
@@ -0,0 +1,207 @@
+<?php
+
+namespace Modules\Core\Cart\Filament\Resources\CartResource\Pages;
+
+use Filament\Schemas\Schema;
+use Filament\Schemas\Components\Section;
+use Filament\Actions\Action;
+use Filament\Infolists\Components\ImageEntry;
+use Filament\Infolists\Components\RepeatableEntry;
+use Filament\Infolists\Components\TextEntry;
+use Filament\Resources\Pages\ViewRecord;
+use Filament\Support\Colors\Color;
+use Illuminate\Database\Eloquent\Collection as EloquentCollection;
+use Illuminate\Support\Facades\Blade;
+use Lunar\Admin\Filament\Resources\CustomerResource;
+use Lunar\Admin\Filament\Resources\ProductResource\Pages\EditProduct;
+use Lunar\Models\Cart;
+use Lunar\Models\CartLine;
+use Lunar\Models\ProductVariant;
+use Modules\Core\Cart\Filament\Resources\CartResource;
+
+class ViewCart extends ViewRecord
+{
+    protected static string $resource = CartResource::class;
+
+    protected function getHeaderActions(): array
+    {
+        return [
+            Action::make('viewCustomer')
+                ->label('View Customer')
+                ->icon('heroicon-o-user')
+                ->url(fn (Cart $record) => CustomerResource::getUrl('view', ['record' => $record->customer_id]))
+                ->visible(fn (Cart $record) => $record->customer_id !== null),
+        ];
+    }
+
+    /**
+     * Cart's computed properties (subTotal/total/etc.) are plain public properties
+     * populated as a side effect of the pipeline calculate() runs — never persisted,
+     * so they don't exist on a plain Eloquent-fetched record. Calculated once here
+     * (a single view page load), not per-row in the list table, since running the
+     * full pipeline for every row of a paginated table would be expensive for no
+     * real benefit — see docs/lunar.md's Cart gotchas.
+     *
+     * Eager-loads what the Lines section (below) reads off each line's
+     * purchasable — name, thumbnail, options — the same relations Lunar's
+     * own OrderItemsTable loads for an order's line items (`with(['purchasable'])`,
+     * see vendor/lunarphp/lunar/.../OrderItemsTable::getDefaultTable()) — so
+     * rendering the product grid doesn't N+1 per line.
+     */
+    protected function resolveRecord(int|string $key): Cart
+    {
+        /** @var Cart $cart */
+        $cart = parent::resolveRecord($key);
+
+        $cart->load('lines.purchasable', 'shippingAddress.country');
+
+        EloquentCollection::make($cart->lines->pluck('purchasable')->filter(fn ($p) => $p instanceof ProductVariant))
+            ->loadMissing(['product.thumbnail', 'images', 'values']);
+
+        return $cart->calculate();
+    }
+
+    public function infolist(Schema $schema): Schema
+    {
+        return $schema
+            ->components([
+                Section::make('Cart')
+                    ->columns(3)
+                    ->schema([
+                        TextEntry::make('id'),
+                        TextEntry::make('customer.full_name')
+                            ->label('Customer')
+                            ->placeholder('—')
+                            ->url(fn (Cart $record) => $record->customer_id !== null
+                                ? CustomerResource::getUrl('view', ['record' => $record->customer_id])
+                                : null),
+                        TextEntry::make('user.email')
+                            ->label('User')
+                            ->placeholder('—'),
+                        TextEntry::make('currency.code')
+                            ->label('Currency'),
+                        TextEntry::make('completedOrderPlacedAt')
+                            ->label('Ordered at')
+                            ->state(fn (Cart $record) => $record->orders()->whereNotNull('placed_at')->value('placed_at'))
+                            ->dateTime()
+                            ->placeholder('Not ordered'),
+                        TextEntry::make('updated_at')
+                            ->label('Last activity')
+                            ->dateTime(),
+                    ]),
+                Section::make('Lines')
+                    ->schema([
+                        RepeatableEntry::make('lines')
+                            ->hiddenLabel()
+                            ->schema([
+                                ImageEntry::make('image')
+                                    ->hiddenLabel()
+                                    ->state(fn (CartLine $record) => $record->purchasable instanceof ProductVariant
+                                        ? $record->purchasable->getThumbnail()?->getUrl('small')
+                                        : null)
+                                    ->defaultImageUrl(fn () => 'data:image/svg+xml;base64,'.base64_encode(
+                                        Blade::render('<x-filament::icon icon="heroicon-o-photo" style="color:rgb('.Color::Gray[400].');"/>')
+                                    ))
+                                    ->imageSize(48),
+                                TextEntry::make('description')
+                                    ->label('Product')
+                                    // ProductVariant::getDescription()/getOption() are typed
+                                    // string but internally read translateAttribute()/
+                                    // translate(), which return null for a product/option
+                                    // with no attribute data set for the active locale —
+                                    // reading the underlying relations directly here avoids
+                                    // that TypeError rather than calling through them.
+                                    ->state(fn (CartLine $record) => $record->purchasable instanceof ProductVariant
+                                        ? ($record->purchasable->product?->translateAttribute('name') ?? '—')
+                                        : '—')
+                                    ->url(fn (CartLine $record) => $record->purchasable instanceof ProductVariant
+                                        ? EditProduct::getUrl(['record' => $record->purchasable->product_id])
+                                        : null)
+                                    ->weight('bold'),
+                                TextEntry::make('options')
+                                    ->label('Options')
+                                    ->state(fn (CartLine $record) => $record->purchasable instanceof ProductVariant
+                                        ? ($record->purchasable->values->map(fn ($value) => $value->translate('name'))->filter()->join(', ') ?: null)
+                                        : null)
+                                    ->placeholder('—')
+                                    ->badge(),
+                                TextEntry::make('purchasable.sku')
+                                    ->label('SKU')
+                                    ->placeholder('—'),
+                                TextEntry::make('quantity'),
+                                TextEntry::make('unitPrice')
+                                    ->label('Unit price')
+                                    ->formatStateUsing(fn (CartLine $record) => $record->unitPrice?->formatted() ?? '—'),
+                                TextEntry::make('total')
+                                    ->label('Line total')
+                                    ->formatStateUsing(fn (CartLine $record) => $record->total?->formatted() ?? '—'),
+                            ])
+                            ->columns(4),
+                    ]),
+                Section::make('Shipping')
+                    ->columns(3)
+                    ->schema([
+                        TextEntry::make('shippingAddress.shipping_option')
+                            ->label('Shipping method')
+                            // The raw identifier (e.g. "acs") is all a
+                            // CartAddress row stores — the human-readable
+                            // name only exists on the resolved
+                            // Lunar\DataTypes\ShippingOption, which is what
+                            // shippingBreakdown's items are keyed/named
+                            // from below, so fall back to that name rather
+                            // than showing the bare identifier.
+                            ->formatStateUsing(fn (Cart $record, ?string $state) => $state
+                                ? ($record->shippingBreakdown?->items->get($state)?->name ?? $state)
+                                : null)
+                            ->placeholder('Not selected'),
+                        TextEntry::make('shippingAddress.country.name')
+                            ->label('Shipping to')
+                            ->placeholder('—'),
+                        TextEntry::make('shippingTotal')
+                            ->label('Shipping total')
+                            ->formatStateUsing(fn (Cart $record) => $record->shippingTotal?->formatted() ?? '—')
+                            ->weight('bold'),
+                        RepeatableEntry::make('shippingBreakdownItems')
+                            ->label('Breakdown')
+                            ->columnSpanFull()
+                            // shippingBreakdown->items is a plain (non-Eloquent)
+                            // Collection of Lunar\Base\ValueObjects\Cart\
+                            // ShippingBreakdownItem — e.g. the carrier rate and,
+                            // separately, Modules\Core\Payment\Pipelines\Cart\
+                            // ApplyPaymentMethodFee's own line item when the
+                            // selected payment method carries a fee (see
+                            // CHANGELOG 0.16.3) — both show up here individually
+                            // rather than only as the summed shippingTotal above.
+                            ->state(fn (Cart $record) => $record->shippingBreakdown?->items->values() ?? [])
+                            ->schema([
+                                TextEntry::make('name')
+                                    ->hiddenLabel(),
+                                TextEntry::make('price')
+                                    ->hiddenLabel()
+                                    ->formatStateUsing(fn ($state) => $state?->formatted() ?? '—')
+                                    ->alignEnd(),
+                            ])
+                            ->columns(2)
+                            ->visible(fn (Cart $record) => (bool) $record->shippingBreakdown?->items->isNotEmpty()),
+                    ])
+                    ->visible(fn (Cart $record) => $record->shippingAddress !== null),
+                Section::make('Totals')
+                    ->columns(3)
+                    ->schema([
+                        TextEntry::make('subTotal')
+                            ->label('Subtotal')
+                            ->formatStateUsing(fn (Cart $record) => $record->subTotal?->formatted() ?? '—'),
+                        TextEntry::make('discountTotal')
+                            ->label('Discount')
+                            ->formatStateUsing(fn (Cart $record) => $record->discountTotal?->formatted() ?? '—'),
+                        TextEntry::make('taxTotal')
+                            ->label('Tax')
+                            ->formatStateUsing(fn (Cart $record) => $record->taxTotal?->formatted() ?? '—'),
+                        TextEntry::make('total')
+                            ->label('Total')
+                            ->formatStateUsing(fn (Cart $record) => $record->total?->formatted() ?? '—')
+                            ->weight('bold'),
+                    ]),
+            ]);
+    }
+}
diff --git a/src/Cart/Pipelines/ZeroSavedForLaterPrice.php b/src/Cart/Pipelines/ZeroSavedForLaterPrice.php
new file mode 100644
index 0000000..af5fcb3
--- /dev/null
+++ b/src/Cart/Pipelines/ZeroSavedForLaterPrice.php
@@ -0,0 +1,33 @@
+<?php
+
+namespace Modules\Core\Cart\Pipelines;
+
+use Closure;
+use Lunar\DataTypes\Price;
+use Lunar\Models\Contracts\CartLine as CartLineContract;
+
+/**
+ * Runs in config('lunar.cart.pipelines.cart_lines'), after GetUnitPrice —
+ * zeroes out unitPrice/unitPriceInclTax for any line flagged
+ * meta.saved_for_later, BEFORE Lunar's own CalculateLines pipeline step reads
+ * unitPrice to compute subTotal/total. A saved-for-later item is deliberately
+ * parked, not pending purchase, so it shouldn't inflate Cart::total — and
+ * since CalculateLines sums every CartLine unconditionally with no meta-based
+ * exclusion of its own, zeroing the price here (rather than patching subTotal
+ * after the fact) is what makes every downstream total naturally correct
+ * without a second pass.
+ */
+class ZeroSavedForLaterPrice
+{
+    public function handle(CartLineContract $cartLine, Closure $next): mixed
+    {
+        if ($cartLine->meta['saved_for_later'] ?? false) {
+            $currency = $cartLine->cart->currency;
+
+            $cartLine->unitPrice = new Price(0, $currency, 1);
+            $cartLine->unitPriceInclTax = new Price(0, $currency, 1);
+        }
+
+        return $next($cartLine);
+    }
+}
diff --git a/src/Cart/Services/CartLifecycleService.php b/src/Cart/Services/CartLifecycleService.php
new file mode 100644
index 0000000..71f312b
--- /dev/null
+++ b/src/Cart/Services/CartLifecycleService.php
@@ -0,0 +1,99 @@
+<?php
+
+namespace Modules\Core\Cart\Services;
+
+use Illuminate\Database\Eloquent\Builder;
+use Illuminate\Support\Carbon;
+use Lunar\Models\Cart;
+
+/**
+ * The single source of truth for the four cart lifecycle states documented in
+ * docs/cart.md ("Four states, not two — and not Cart::completed_at"). Both
+ * Modules\Core\Cart\Filament\Resources\CartResource/ListCarts (staff-facing
+ * browsing/tabs) and Modules\Core\Cart\Commands\DetectAbandonedCarts
+ * (abandonment-event dispatch) build on these same four query shapes — before
+ * this existed, each reimplemented them independently, which is exactly the
+ * kind of drift that lets the admin panel and the recovery-email pipeline
+ * quietly disagree about what "abandoned" means.
+ *
+ * `Cart::completed_at` is declared/cast on the model but never actually
+ * written anywhere in Lunar core — not a real signal, not used here.
+ * `Cart::scopeActive()` (Lunar's own "not yet converted to an order" scope)
+ * mixes two distinct states together (no order at all vs. a draft order that
+ * was never placed) — see docs/cart.md for why they're kept apart as
+ * different purchase-intent/reachability signals rather than folded into one
+ * "not converted" bucket.
+ *
+ * Query shape only: consent (`meta->recovery_consent`) and non-empty-lines
+ * filtering stay in DetectAbandonedCarts, not here — those are specific to
+ * whether a recovery event should fire, not to what "abandoned" means. Staff
+ * browsing the admin panel should see every abandoned cart, consenting or
+ * not.
+ *
+ * `unrecoverableCutoff()` is a second, older threshold
+ * (`core.cart.unrecoverable_after`, default 90 days) applied as a lower
+ * bound on both abandoned*() methods below: a cart past it is too old to be
+ * a realistic recovery target (pricing/stock/tax have likely moved on), so
+ * it drops out of "Abandoned Cart"/"Abandoned Checkout" entirely rather than
+ * staying flagged as an actionable abandonment forever. It does not appear
+ * in `ongoing()`/`completed()` either — this is about the abandoned-cart
+ * pipeline specifically, not a retention/deletion policy (no rows are
+ * touched here).
+ */
+class CartLifecycleService
+{
+    public function abandonedCutoff(): Carbon
+    {
+        return now()->sub(config('core.cart.abandoned_after', '1 hour'));
+    }
+
+    public function unrecoverableCutoff(): Carbon
+    {
+        return now()->sub(config('core.cart.unrecoverable_after', '90 days'));
+    }
+
+    /**
+     * Not yet converted to an order (scopeActive()), with recent activity —
+     * someone plausibly shopping right now, not (yet) left behind.
+     */
+    public function ongoing(Builder $query): Builder
+    {
+        return $query->active()->where('updated_at', '>', $this->abandonedCutoff());
+    }
+
+    /**
+     * No order started at all, stale, not yet past the unrecoverable cap, and
+     * actually has something in it — the weaker of the two abandoned states
+     * (see docs/cart.md's "Abandoned Cart vs Abandoned Checkout"). An empty
+     * cart (created but nothing ever added — e.g. a bot, or a session that
+     * never shopped) was never really "abandoned"; there's nothing to
+     * recover, so it's excluded rather than counted as a false positive.
+     */
+    public function abandonedCarts(Builder $query): Builder
+    {
+        return $query->whereDoesntHave('orders')
+            ->whereHas('lines')
+            ->where('updated_at', '<=', $this->abandonedCutoff())
+            ->where('updated_at', '>', $this->unrecoverableCutoff());
+    }
+
+    /**
+     * A draft order exists (checkout was started) but was never placed,
+     * stale, and not yet past the unrecoverable cap — the stronger of the
+     * two abandoned states.
+     */
+    public function abandonedCheckouts(Builder $query): Builder
+    {
+        return $query->whereHas('orders', fn (Builder $query) => $query->whereNull('placed_at'))
+            ->where('updated_at', '<=', $this->abandonedCutoff())
+            ->where('updated_at', '>', $this->unrecoverableCutoff());
+    }
+
+    /**
+     * Has an order that was actually placed, not just drafted.
+     */
+    public function completed(Builder $query): Builder
+    {
+        return $query->whereHas('orders', fn (Builder $query) => $query->whereNotNull('placed_at'));
+    }
+}
diff --git a/src/Cart/Services/CartService.php b/src/Cart/Services/CartService.php
new file mode 100644
index 0000000..7d8ddc6
--- /dev/null
+++ b/src/Cart/Services/CartService.php
@@ -0,0 +1,250 @@
+<?php
+
+namespace Modules\Core\Cart\Services;
+
+use Illuminate\Support\Collection;
+use Illuminate\Support\Facades\Event;
+use Lunar\Actions\Carts\GetExistingCartLine;
+use Lunar\Base\Purchasable;
+use Lunar\Facades\CartSession;
+use Lunar\Facades\Discounts;
+use Lunar\Models\Cart;
+use Lunar\Models\CartLine;
+use Modules\Core\Cart\Events\CartCleared;
+use Modules\Core\Cart\Events\CartCouponApplied;
+use Modules\Core\Cart\Events\CartCouponRemoved;
+use Modules\Core\Cart\Events\CartLineAdded;
+use Modules\Core\Cart\Events\CartLineMovedToCart;
+use Modules\Core\Cart\Events\CartLineRemoved;
+use Modules\Core\Cart\Events\CartLineSaved;
+use Modules\Core\Cart\Events\CartLineUpdated;
+use Modules\Core\Cart\Exceptions\InvalidCouponException;
+
+/**
+ * Storefront-facing cart operations, mirroring Modules\Core\Catalog\Services\
+ * ProductService/CollectionService's shape — one boboko-owned API a storefront
+ * calls, so Lunar's own CartSession/Cart stay an implementation detail rather
+ * than something a consuming app depends on directly.
+ *
+ * Every mutating method dispatches a matching domain event
+ * (Modules\Core\Cart\Events\*) after the underlying Lunar operation completes —
+ * Lunar itself dispatches zero cart events (see docs/lunar.md's Cart gotchas),
+ * so without this, nothing in a consuming app has anything to react to when a
+ * cart actually changes (reindexing, notifications, analytics, etc.).
+ *
+ * All mutating methods return the recalculated Cart — matching Lunar's own
+ * Cart::add()/updateLine()/etc., which already return $this after
+ * refresh()->recalculate() — so a caller gets fresh totals in the same call,
+ * no second fetch needed.
+ */
+class CartService
+{
+    /**
+     * The current session's cart, or null if none exists yet. Does NOT
+     * auto-create one — see currentOrCreate() for that.
+     */
+    public function current(): ?Cart
+    {
+        return CartSession::current();
+    }
+
+    /**
+     * The current session's cart, creating one if none exists yet — the right
+     * call for "add to cart" style flows where a cart must exist by the time
+     * the method returns.
+     */
+    public function currentOrCreate(): Cart
+    {
+        return CartSession::manager();
+    }
+
+    public function addLine(Purchasable $purchasable, int $quantity = 1, array $meta = []): Cart
+    {
+        $cart = $this->currentOrCreate()->add($purchasable, $quantity, $meta);
+
+        $line = app(config('lunar.cart.actions.get_existing_cart_line', GetExistingCartLine::class))
+            ->execute($cart, $purchasable, $meta);
+
+        if ($line !== null) {
+            Event::dispatch(new CartLineAdded($cart, $line));
+        }
+
+        return $cart;
+    }
+
+    public function updateLine(int $cartLineId, int $quantity, ?array $meta = null): Cart
+    {
+        $before = CartLine::findOrFail($cartLineId);
+        $old = ['quantity' => $before->quantity, 'meta' => $before->meta->toArray()];
+
+        $cart = $this->currentOrCreate()->updateLine($cartLineId, $quantity, $meta);
+
+        $line = $cart->lines->firstWhere('id', $cartLineId);
+
+        if ($line !== null) {
+            Event::dispatch(new CartLineUpdated($cart, $line, $old));
+        }
+
+        return $cart;
+    }
+
+    public function removeLine(int $cartLineId): Cart
+    {
+        $line = CartLine::findOrFail($cartLineId);
+        $snapshot = $this->snapshotLine($line);
+
+        $cart = $this->currentOrCreate()->remove($cartLineId);
+
+        Event::dispatch(new CartLineRemoved($cart, $snapshot));
+
+        return $cart;
+    }
+
+    public function clear(): Cart
+    {
+        $cart = $this->currentOrCreate();
+        $snapshots = $cart->lines->map($this->snapshotLine(...))->all();
+
+        $cart = $cart->clear();
+
+        Event::dispatch(new CartCleared($cart, $snapshots));
+
+        return $cart;
+    }
+
+    /**
+     * Sets the cart's coupon code, which the ApplyDiscounts pipeline step picks
+     * up on the next calculate() — there's no dedicated Lunar action for this
+     * (unlike add/update/remove, coupon_code is a plain cast attribute), so
+     * this is the closest thing to one for a consuming app to call.
+     *
+     * Validated via Discounts::validateCoupon() (does a matching, currently
+     * active, non-exhausted Discount exist?) before it's set — CouponString's
+     * cast only normalizes casing, it doesn't validate anything, so setting
+     * coupon_code directly would silently accept a bogus code and just not
+     * discount anything once calculated.
+     *
+     * @throws InvalidCouponException if the code doesn't match a valid, active,
+     *   non-exhausted Discount
+     */
+    public function applyCoupon(string $code): Cart
+    {
+        if (! Discounts::validateCoupon($code)) {
+            throw new InvalidCouponException($code);
+        }
+
+        $cart = $this->currentOrCreate();
+        $cart->coupon_code = $code;
+        $cart->save();
+        $cart = $cart->recalculate();
+
+        Event::dispatch(new CartCouponApplied($cart, $cart->coupon_code));
+
+        return $cart;
+    }
+
+    public function removeCoupon(): Cart
+    {
+        $cart = $this->currentOrCreate();
+        $code = $cart->coupon_code;
+
+        if ($code === null) {
+            return $cart;
+        }
+
+        $cart->coupon_code = null;
+        $cart->save();
+        $cart = $cart->recalculate();
+
+        Event::dispatch(new CartCouponRemoved($cart, $code));
+
+        return $cart;
+    }
+
+    /**
+     * Lines currently counted toward the cart's totals — everything except
+     * ones flagged meta.saved_for_later (see savedLines()). This is the set a
+     * cart page's main list / checkout would iterate, since a saved line
+     * isn't pending purchase.
+     *
+     * @return Collection<int, CartLine>
+     */
+    public function activeLines(?Cart $cart = null): Collection
+    {
+        $cart ??= $this->currentOrCreate();
+
+        return $cart->lines->reject(fn (CartLine $line) => $line->meta['saved_for_later'] ?? false)->values();
+    }
+
+    /**
+     * Lines a shopper has deliberately parked rather than deleted — excluded
+     * from Cart totals (see Modules\Core\Cart\Pipelines\ZeroSavedForLaterPrice)
+     * and from activeLines(). A cart page's "Saved for later" section iterates
+     * this set.
+     *
+     * @return Collection<int, CartLine>
+     */
+    public function savedLines(?Cart $cart = null): Collection
+    {
+        $cart ??= $this->currentOrCreate();
+
+        return $cart->lines->filter(fn (CartLine $line) => $line->meta['saved_for_later'] ?? false)->values();
+    }
+
+    /**
+     * Moves a line OUT of the purchasable cart without deleting it — it stays
+     * on the cart (still visible, still re-addable) but is excluded from
+     * totals via meta.saved_for_later, zeroed by ZeroSavedForLaterPrice before
+     * Lunar's own CalculateLines sums the cart (which has no meta-based
+     * exclusion of its own).
+     */
+    public function saveForLater(int $cartLineId): Cart
+    {
+        $line = CartLine::findOrFail($cartLineId);
+        $meta = [...$line->meta->toArray(), 'saved_for_later' => true];
+
+        $cart = $this->currentOrCreate()->updateLine($cartLineId, $line->quantity, $meta);
+
+        $line = $cart->lines->firstWhere('id', $cartLineId);
+
+        if ($line !== null) {
+            Event::dispatch(new CartLineSaved($cart, $line));
+        }
+
+        return $cart;
+    }
+
+    /**
+     * The reverse of saveForLater() — moves a line back into the purchasable
+     * cart, counted in totals again.
+     */
+    public function moveToCart(int $cartLineId): Cart
+    {
+        $line = CartLine::findOrFail($cartLineId);
+        $meta = [...$line->meta->toArray(), 'saved_for_later' => false];
+
+        $cart = $this->currentOrCreate()->updateLine($cartLineId, $line->quantity, $meta);
+
+        $line = $cart->lines->firstWhere('id', $cartLineId);
+
+        if ($line !== null) {
+            Event::dispatch(new CartLineMovedToCart($cart, $line));
+        }
+
+        return $cart;
+    }
+
+    /**
+     * @return array{id: int, purchasable_type: string, purchasable_id: int, quantity: int, meta: array}
+     */
+    private function snapshotLine(CartLine $line): array
+    {
+        return [
+            'id' => $line->id,
+            'purchasable_type' => $line->purchasable_type,
+            'purchasable_id' => $line->purchasable_id,
+            'quantity' => $line->quantity,
+            'meta' => $line->meta->toArray(),
+        ];
+    }
+}
diff --git a/src/Catalog/Contracts/ProductOptionTypeInterface.php b/src/Catalog/Contracts/ProductOptionTypeInterface.php
new file mode 100644
index 0000000..09f6688
--- /dev/null
+++ b/src/Catalog/Contracts/ProductOptionTypeInterface.php
@@ -0,0 +1,34 @@
+<?php
+
+namespace Modules\Core\Catalog\Contracts;
+
+use Filament\Schemas\Components\Component;
+
+/**
+ * A Product Option Type describes how a category of Lunar `ProductOption` (e.g.
+ * "Color", "Size", "Material") behaves — namely, what structured data its values
+ * carry in their free-form `meta` jsonb column, and how an admin edits that data.
+ *
+ * `ProductOption`/`ProductOptionValue` themselves stay exactly as Lunar defines
+ * them — this is not a new model. `ProductOptionTypeManager` maps a
+ * `ProductOption::handle` to the type describing it (via `config('core.product_option_types')`,
+ * typed explicitly by the admin), so adding a new kind of option is a single new
+ * class, not scattered per-option special-casing across the admin UI or storefront.
+ */
+interface ProductOptionTypeInterface
+{
+    /**
+     * Matches the ProductOption::handle this type describes (e.g. 'color', 'size').
+     */
+    public static function getKey(): string;
+
+    /**
+     * Filament form components for editing a ProductOptionValue's `meta` under this
+     * option type — e.g. Color returns a color picker for `meta.hex`, Size returns a
+     * numeric input for `meta.sort_value`. Field names should be dot-notation under
+     * `meta` (e.g. `meta.hex`), matching where ValuesRelationManagerExtension saves them.
+     *
+     * @return array<Component>
+     */
+    public function getMetaForm(): array;
+}
diff --git a/src/Catalog/Contracts/RecommendationRule.php b/src/Catalog/Contracts/RecommendationRule.php
new file mode 100644
index 0000000..c512531
--- /dev/null
+++ b/src/Catalog/Contracts/RecommendationRule.php
@@ -0,0 +1,39 @@
+<?php
+
+namespace Modules\Core\Catalog\Contracts;
+
+use Illuminate\Support\Collection;
+use Lunar\Models\Product;
+
+/**
+ * One strategy for producing recommended products for a given product —
+ * e.g. same category, same tag, best sellers, random. Modules\Core\Catalog\
+ * Services\RecommendationService runs rules registered in
+ * config('catalog.recommendation_rules') in order, topping up from each
+ * successive rule until $limit distinct products are collected or every
+ * rule is exhausted (e.g. 3 from SameCategoryRule + 1 from RandomRule) —
+ * nothing here decides that accumulation itself; a store composes its own
+ * chain by ordering rules in config (e.g. [SameCategoryRule::class,
+ * RandomRule::class]).
+ *
+ * Returns raw Product models, not ProductService::list()'s locale-resolved
+ * array output — this runs at index time (ProductIndexer::toSearchableArray()),
+ * where "the current locale" isn't a meaningful concept the way it is for a
+ * storefront request. ProductIndexer resolves translated fields itself via
+ * translateAttribute(), same as it already does for the embedded `collections`
+ * field — same known index-time-locale tradeoff, not a new one.
+ */
+interface RecommendationRule
+{
+    /**
+     * $exclude carries $product's own id plus every id already picked by an
+     * earlier rule this call — RecommendationService never shows the same
+     * product twice even when two rules would both suggest it, and a rule
+     * shouldn't spend its $limit budget re-returning something already
+     * collected.
+     *
+     * @param  array<int>  $exclude
+     * @return Collection<int, Product> at most $limit products
+     */
+    public function recommend(Product $product, int $limit, array $exclude): Collection;
+}
diff --git a/src/Catalog/DTOs/CollectionFilters.php b/src/Catalog/DTOs/CollectionFilters.php
new file mode 100644
index 0000000..3d1044e
--- /dev/null
+++ b/src/Catalog/DTOs/CollectionFilters.php
@@ -0,0 +1,24 @@
+<?php
+
+namespace Modules\Core\Catalog\DTOs;
+
+/**
+ * Filter input for CollectionService::list(). All fields are optional — omitted
+ * filters are simply not added to the Meilisearch query. Values are matched
+ * against Modules\Core\Catalog\Services\CollectionIndexer's document fields, so
+ * filtering only works on stores where that indexer is registered and the index
+ * has been re-synced (see docs/product-listing.md).
+ */
+class CollectionFilters
+{
+    /**
+     * @param $parentId children of this specific parent collection.
+     * @param $rootOnly top-level collections only (`parent_id IS NULL`) — mutually
+     *   exclusive with $parentId; if both are set, $parentId wins.
+     */
+    public function __construct(
+        public readonly ?int $parentId = null,
+        public readonly ?int $groupId = null,
+        public readonly bool $rootOnly = false,
+    ) {}
+}
diff --git a/src/Catalog/DTOs/PriceSliderBounds.php b/src/Catalog/DTOs/PriceSliderBounds.php
new file mode 100644
index 0000000..e6ab419
--- /dev/null
+++ b/src/Catalog/DTOs/PriceSliderBounds.php
@@ -0,0 +1,19 @@
+<?php
+
+namespace Modules\Core\Catalog\DTOs;
+
+/**
+ * A price range slider's bounds and whether it's currently narrowed —
+ * built by ProductService::priceSliderBounds(), which owns the floor/ceil
+ * rounding and "is this actually a meaningful filter" comparison, so a
+ * controller (CategoryController, SearchController, ...) doesn't have to
+ * reimplement that rule itself.
+ */
+class PriceSliderBounds
+{
+    public function __construct(
+        public readonly ?int $floor,
+        public readonly ?int $ceil,
+        public readonly bool $filtered,
+    ) {}
+}
diff --git a/src/Catalog/DTOs/ProductFilters.php b/src/Catalog/DTOs/ProductFilters.php
new file mode 100644
index 0000000..bfae470
--- /dev/null
+++ b/src/Catalog/DTOs/ProductFilters.php
@@ -0,0 +1,30 @@
+<?php
+
+namespace Modules\Core\Catalog\DTOs;
+
+/**
+ * Filter input for ProductService::list(). All fields are optional — omitted
+ * filters are simply not added to the Meilisearch query. Values are matched
+ * against Modules\Core\Catalog\Services\ProductIndexer's document fields, so
+ * filtering only works on stores where that indexer is registered and the index
+ * has been re-synced (see docs/product-listing.md).
+ */
+class ProductFilters
+{
+    /**
+     * @param $collectionId matches a product in this collection OR any of its
+     *   descendant collections (filtered against ProductIndexer's `collection_ids`,
+     *   not a direct-assignment-only match) — the right semantics for "products on
+     *   this category page", since products are typically attached only to leaf
+     *   collections.
+     * @param $tag exactly one tag — no multi-select yet.
+     */
+    public function __construct(
+        public readonly ?int $collectionId = null,
+        public readonly ?string $brand = null,
+        public readonly ?string $tag = null,
+        public readonly ?float $minPrice = null,
+        public readonly ?float $maxPrice = null,
+        public readonly bool $inStockOnly = false,
+    ) {}
+}
diff --git a/src/Catalog/DTOs/ProductListingResult.php b/src/Catalog/DTOs/ProductListingResult.php
new file mode 100644
index 0000000..5e562bc
--- /dev/null
+++ b/src/Catalog/DTOs/ProductListingResult.php
@@ -0,0 +1,33 @@
+<?php
+
+namespace Modules\Core\Catalog\DTOs;
+
+use Illuminate\Pagination\LengthAwarePaginator;
+
+/**
+ * Everything a listing page needs from one ProductService::list() call —
+ * the product page itself, the price slider's bounds, and the set of tags
+ * actually present on matching products (for a tag filter sidebar) — so a
+ * controller makes one service call instead of orchestrating list(),
+ * priceSliderBounds(), and facets('tags', ...) separately. list() still
+ * issues multiple Meilisearch requests internally (the product search, the
+ * price facet stats, the tag facet distribution — see priceSliderBounds()'s
+ * own docblock for why the price ones can't be merged into one without
+ * changing the slider's UX), but that's this DTO's job to hide, not the
+ * controller's to know about.
+ */
+class ProductListingResult
+{
+    /**
+     * @param  array<int, string>  $availableTags  every distinct tag value
+     *   present on at least one product matching the listing's OTHER
+     *   filters (collection/price/stock — never the tag filter itself, so
+     *   selecting a tag doesn't collapse the list down to just that tag).
+     *   Sorted alphabetically. Empty if no product in scope has any tag.
+     */
+    public function __construct(
+        public readonly LengthAwarePaginator $products,
+        public readonly PriceSliderBounds $priceBounds,
+        public readonly array $availableTags = [],
+    ) {}
+}
diff --git a/src/Catalog/Enums/CollectionSort.php b/src/Catalog/Enums/CollectionSort.php
new file mode 100644
index 0000000..a4887d0
--- /dev/null
+++ b/src/Catalog/Enums/CollectionSort.php
@@ -0,0 +1,24 @@
+<?php
+
+namespace Modules\Core\Catalog\Enums;
+
+/**
+ * Sort options for CollectionService::list(), each mapped to a Meilisearch `sort`
+ * clause against a field indexed as sortable by Modules\Core\Catalog\Services\
+ * CollectionIndexer (see its getSortableFields()).
+ */
+enum CollectionSort: string
+{
+    case Position = 'position';
+    case Name = 'name';
+    case Newest = 'newest';
+
+    public function toMeilisearchSort(): string
+    {
+        return match ($this) {
+            self::Position => '_lft:asc',
+            self::Name => 'name:asc',
+            self::Newest => 'created_at:desc',
+        };
+    }
+}
diff --git a/src/Catalog/Enums/ProductSort.php b/src/Catalog/Enums/ProductSort.php
new file mode 100644
index 0000000..71cc99c
--- /dev/null
+++ b/src/Catalog/Enums/ProductSort.php
@@ -0,0 +1,26 @@
+<?php
+
+namespace Modules\Core\Catalog\Enums;
+
+/**
+ * Sort options for ProductService::list(), each mapped to a Meilisearch `sort`
+ * clause against a field indexed as sortable by Modules\Core\Catalog\Services\
+ * ProductIndexer (see its getSortableFields()). Adding a case here requires the
+ * matching field to also be sortable in the index, re-synced via
+ * `php artisan lunar:meilisearch:setup`.
+ */
+enum ProductSort: string
+{
+    case PriceAsc = 'price_asc';
+    case PriceDesc = 'price_desc';
+    case Newest = 'newest';
+
+    public function toMeilisearchSort(): string
+    {
+        return match ($this) {
+            self::PriceAsc => 'price:asc',
+            self::PriceDesc => 'price:desc',
+            self::Newest => 'created_at:desc',
+        };
+    }
+}
diff --git a/src/Catalog/Events/ProductDeleted.php b/src/Catalog/Events/ProductDeleted.php
new file mode 100644
index 0000000..136fcb4
--- /dev/null
+++ b/src/Catalog/Events/ProductDeleted.php
@@ -0,0 +1,23 @@
+<?php
+
+namespace Modules\Core\Catalog\Events;
+
+/**
+ * Dispatched whenever a Product is deleted (see CatalogServiceProvider,
+ * which wires this to the model's own deleted() hook — fires for both a
+ * soft delete and a force delete, same as Laravel Scout's own
+ * ModelObserver::deleted() that triggers unsearchable() for the product
+ * itself). Same purpose as Modules\Core\Catalog\Events\ProductSaved: lets
+ * Modules\Core\Catalog\Listeners\ReindexProductsRecommendingProduct find
+ * and re-index every OTHER product that currently embeds this one in its
+ * `recommendations` field, so a deleted product doesn't linger as a dead
+ * reference elsewhere. Carries only the id, not the Product model — by the
+ * time this fires the model may already be gone (force delete), and the
+ * reverse lookup only ever needs the id to filter on.
+ */
+class ProductDeleted
+{
+    public function __construct(
+        public readonly int $productId,
+    ) {}
+}
diff --git a/src/Catalog/Events/ProductSaved.php b/src/Catalog/Events/ProductSaved.php
new file mode 100644
index 0000000..ba6281d
--- /dev/null
+++ b/src/Catalog/Events/ProductSaved.php
@@ -0,0 +1,24 @@
+<?php
+
+namespace Modules\Core\Catalog\Events;
+
+use Lunar\Models\Product;
+
+/**
+ * Dispatched whenever a Product is saved (see CatalogServiceProvider,
+ * which wires this to the model's own saved() hook) — exists specifically
+ * so Modules\Core\Catalog\Listeners\ReindexProductsRecommendingProduct can
+ * find and re-index every OTHER product that currently embeds this one in
+ * its own `recommendations` field (see ProductIndexer). Those products
+ * have no direct database relationship to this one — a recommendation is
+ * computed and stored only inside Meilisearch (Modules\Core\Catalog\
+ * Services\RecommendationService) — so nothing about their own save
+ * lifecycle would otherwise pick up this product's changed name/price/
+ * image.
+ */
+class ProductSaved
+{
+    public function __construct(
+        public readonly Product $product,
+    ) {}
+}
diff --git a/src/Catalog/Filament/Extensions/ProductOptionResourceExtension.php b/src/Catalog/Filament/Extensions/ProductOptionResourceExtension.php
new file mode 100644
index 0000000..46e0913
--- /dev/null
+++ b/src/Catalog/Filament/Extensions/ProductOptionResourceExtension.php
@@ -0,0 +1,39 @@
+<?php
+
+namespace Modules\Core\Catalog\Filament\Extensions;
+
+use Filament\Schemas\Schema;
+use Filament\Forms\Components\Select;
+use Illuminate\Support\Str;
+use Lunar\Admin\Support\Extending\ResourceExtension;
+use Modules\Core\Catalog\Services\ProductOptionTypeManager;
+
+/**
+ * Adds an "Option Type" dropdown to Lunar's own ProductOptionResource form, letting
+ * an admin pick which registered `ProductOptionTypeInterface` (if any) describes this
+ * option's values — e.g. "Color" — independent of the option's own `handle`. The
+ * selection is saved to `ProductOption::meta['option_type']`.
+ */
+class ProductOptionResourceExtension extends ResourceExtension
+{
+    public function extendForm(Schema $schema): Schema
+    {
+        $options = collect(ProductOptionTypeManager::get()->all())
+            ->keys()
+            ->mapWithKeys(fn (string $key) => [$key => Str::headline($key)])
+            ->all();
+
+        if ($options === []) {
+            return $schema;
+        }
+
+        return $schema->components([
+            ...$schema->getComponents(),
+            Select::make('meta.option_type')
+                ->label('Option Type')
+                ->options($options)
+                ->helperText('Controls which meta fields appear when editing this option\'s values.')
+                ->native(false),
+        ]);
+    }
+}
diff --git a/src/Catalog/Filament/Extensions/ValuesRelationManagerExtension.php b/src/Catalog/Filament/Extensions/ValuesRelationManagerExtension.php
new file mode 100644
index 0000000..827fa9c
--- /dev/null
+++ b/src/Catalog/Filament/Extensions/ValuesRelationManagerExtension.php
@@ -0,0 +1,34 @@
+<?php
+
+namespace Modules\Core\Catalog\Filament\Extensions;
+
+use Filament\Schemas\Schema;
+use Lunar\Admin\Support\Extending\RelationManagerExtension;
+use Lunar\Models\ProductOption;
+use Modules\Core\Catalog\Services\ProductOptionTypeManager;
+
+/**
+ * Appends the owning `ProductOption`'s registered `ProductOptionTypeInterface` meta
+ * form (if any) to Lunar's own ValuesRelationManager form, so e.g. a "color" option
+ * gets a hex-color picker for each value alongside the stock name field — without
+ * forking Lunar's relation manager.
+ */
+class ValuesRelationManagerExtension extends RelationManagerExtension
+{
+    public function extendForm(Schema $schema): Schema
+    {
+        /** @var ProductOption $option */
+        $option = $this->caller->getOwnerRecord();
+
+        $type = ProductOptionTypeManager::get()->resolve($option->meta['option_type'] ?? null);
+
+        if ($type === null) {
+            return $schema;
+        }
+
+        return $schema->components([
+            ...$schema->getComponents(),
+            ...$type->getMetaForm(),
+        ]);
+    }
+}
diff --git a/src/Catalog/Listeners/ReindexProductsRecommendingProduct.php b/src/Catalog/Listeners/ReindexProductsRecommendingProduct.php
new file mode 100644
index 0000000..957cf2d
--- /dev/null
+++ b/src/Catalog/Listeners/ReindexProductsRecommendingProduct.php
@@ -0,0 +1,64 @@
+<?php
+
+namespace Modules\Core\Catalog\Listeners;
+
+use Lunar\Models\Product;
+use Modules\Core\Catalog\Events\ProductDeleted;
+use Modules\Core\Catalog\Events\ProductSaved;
+
+/**
+ * Keeps every product's embedded `recommendations` field (see
+ * ProductIndexer) in sync when a product they recommend changes or is
+ * removed. Unlike Modules\Core\Catalog\Observers\ProductOptionReindexObserver's
+ * equivalent ("who references this option value"), there is no Postgres
+ * table to query here — a recommendation only exists inside Meilisearch,
+ * computed by RecommendationService at index time — so the reverse lookup
+ * is a Meilisearch filter query against `recommendations.id`, not a
+ * database join.
+ *
+ * Handles both ProductSaved (name/price/image changed — referencing
+ * products' embedded copy is stale) and ProductDeleted (the recommended
+ * product no longer exists at all — referencing products need to drop it
+ * and, since RecommendationService tops up to its limit, naturally pick up
+ * a replacement on reindex). Same reverse lookup either way, just a
+ * different source for the id being searched for.
+ *
+ * Re-indexing via ->searchable() dispatches Scout's own (queued, if
+ * SCOUT_QUEUE is configured) reindex job per matched product — this
+ * listener itself does no synchronous Meilisearch writing.
+ */
+class ReindexProductsRecommendingProduct
+{
+    public function handleSaved(ProductSaved $event): void
+    {
+        $this->reindexReferencingProducts($event->product->id);
+    }
+
+    public function handleDeleted(ProductDeleted $event): void
+    {
+        $this->reindexReferencingProducts($event->productId);
+    }
+
+    private function reindexReferencingProducts(int $productId): void
+    {
+        $hits = Product::search('')
+            ->options([
+                'filter' => "recommendations.id = \"{$productId}\"",
+                'attributesToRetrieve' => ['id'],
+                // Meilisearch's own hitsPerPage default (20) would silently
+                // drop referencing products past that count — this is a
+                // reverse lookup, not a paginated storefront result, so it
+                // needs every match, up to Meilisearch's hard limit.
+                'hitsPerPage' => 1000,
+            ])
+            ->raw()['hits'] ?? [];
+
+        $ids = collect($hits)->pluck('id')->unique()->values();
+
+        if ($ids->isEmpty()) {
+            return;
+        }
+
+        Product::whereIn('id', $ids)->get()->each->searchable();
+    }
+}
diff --git a/src/Catalog/Observers/ProductOptionReindexObserver.php b/src/Catalog/Observers/ProductOptionReindexObserver.php
new file mode 100644
index 0000000..5b47c45
--- /dev/null
+++ b/src/Catalog/Observers/ProductOptionReindexObserver.php
@@ -0,0 +1,68 @@
+<?php
+
+namespace Modules\Core\Catalog\Observers;
+
+use Illuminate\Support\Facades\DB;
+use Lunar\Models\Product;
+use Lunar\Models\ProductOption;
+use Lunar\Models\ProductOptionValue;
+use Lunar\Models\ProductVariant;
+
+/**
+ * Keeps every product using a ProductOption/ProductOptionValue in sync with
+ * Meilisearch. ProductIndexer::mapVariant() embeds each option value's `meta`
+ * (e.g. a color's hex) directly into the product's indexed document — but saving
+ * the option or one of its values never fires the *product's* own save/update
+ * events, so without this, a changed option_type or a changed hex would only
+ * reach the index on that product's next unrelated reindex.
+ */
+class ProductOptionReindexObserver
+{
+    public function optionSaved(ProductOption $option): void
+    {
+        $this->reindexProductsForOption($option->id);
+    }
+
+    public function optionDeleted(ProductOption $option): void
+    {
+        $this->reindexProductsForOption($option->id);
+    }
+
+    public function valueSaved(ProductOptionValue $value): void
+    {
+        $this->reindexProductsForValues([$value->id]);
+    }
+
+    public function valueDeleted(ProductOptionValue $value): void
+    {
+        $this->reindexProductsForValues([$value->id]);
+    }
+
+    private function reindexProductsForOption(int $optionId): void
+    {
+        $valueIds = ProductOptionValue::where('product_option_id', $optionId)->pluck('id');
+
+        $this->reindexProductsForValues($valueIds->all());
+    }
+
+    private function reindexProductsForValues(array $valueIds): void
+    {
+        if ($valueIds === []) {
+            return;
+        }
+
+        $prefix = config('lunar.database.table_prefix');
+
+        $variantIds = DB::table("{$prefix}product_option_value_product_variant")
+            ->whereIn('value_id', $valueIds)
+            ->pluck('variant_id');
+
+        if ($variantIds->isEmpty()) {
+            return;
+        }
+
+        $productIds = ProductVariant::whereIn('id', $variantIds)->pluck('product_id')->unique();
+
+        Product::whereIn('id', $productIds)->get()->each->searchable();
+    }
+}
diff --git a/src/Catalog/OptionTypes/ColorOptionType.php b/src/Catalog/OptionTypes/ColorOptionType.php
new file mode 100644
index 0000000..10600b2
--- /dev/null
+++ b/src/Catalog/OptionTypes/ColorOptionType.php
@@ -0,0 +1,29 @@
+<?php
+
+namespace Modules\Core\Catalog\OptionTypes;
+
+use Filament\Forms\Components\ColorPicker;
+use Modules\Core\Catalog\Contracts\ProductOptionTypeInterface;
+
+/**
+ * Describes a 'color' ProductOption's values as carrying a hex code in
+ * `meta.hex`, editable via a Filament color picker. Registered automatically by
+ * `Modules\Core\Providers\CatalogServiceProvider` — a shop's admin still has to
+ * pick "Color" from the Option Type dropdown per-ProductOption for it to apply.
+ */
+class ColorOptionType implements ProductOptionTypeInterface
+{
+    public static function getKey(): string
+    {
+        return 'color';
+    }
+
+    public function getMetaForm(): array
+    {
+        return [
+            ColorPicker::make('meta.hex')
+                ->label('Color')
+                ->required(),
+        ];
+    }
+}
diff --git a/src/Catalog/ProductFilters.php b/src/Catalog/ProductFilters.php
deleted file mode 100644
index 5701d01..0000000
--- a/src/Catalog/ProductFilters.php
+++ /dev/null
@@ -1,20 +0,0 @@
-<?php
-
-namespace Modules\Core\Catalog;
-
-/**
- * Filter input for ProductService::list(). All fields are optional — omitted
- * filters are simply not added to the Meilisearch query. Values are matched
- * against Modules\Core\Search\ProductIndexer's document fields, so filtering
- * only works on stores where that indexer is registered and the index has
- * been re-synced (see docs/product-listing.md).
- */
-class ProductFilters
-{
-    public function __construct(
-        public readonly ?int $collectionId = null,
-        public readonly ?string $brand = null,
-        public readonly ?float $minPrice = null,
-        public readonly ?float $maxPrice = null,
-    ) {}
-}
diff --git a/src/Catalog/ProductService.php b/src/Catalog/ProductService.php
deleted file mode 100644
index 5b1489e..0000000
--- a/src/Catalog/ProductService.php
+++ /dev/null
@@ -1,126 +0,0 @@
-<?php
-
-namespace Modules\Core\Catalog;
-
-use Illuminate\Contracts\Pagination\LengthAwarePaginator;
-use Illuminate\Support\Collection;
-use Illuminate\Support\Facades\App;
-use Lunar\Models\Product;
-use Modules\Core\Localization\LocaleMiddleware;
-
-/**
- * Storefront product listing/filtering AND single-product lookup, all reading directly
- * from the Meilisearch index (Modules\Core\Search\ProductIndexer) - one data source, no
- * ->get() model hydration anywhere in this service. Callers get plain arrays of the
- * indexed document, not Eloquent models.
- *
- * Full-text query search lives separately in Modules\Core\Search\ProductSearchService;
- * this service is for browsing/filtering without a search term.
- */
-class ProductService
-{
-    /**
-     * @return array{data: array<int, array>, meta: array}
-     */
-    public function list(?ProductFilters $filters = null, int $perPage = 24, int $page = 1): array
-    {
-        $paginator = Product::search('')
-            ->options([
-                'filter' => $this->buildFilter($filters),
-            ])
-            ->paginateRaw(perPage: $perPage, page: $page);
-
-        return [
-            'data' => collect($this->hitsFrom($paginator))
-                ->map(fn (array $product) => $this->withLocalizedFields($product))
-                ->all(),
-            'meta' => [
-                'total' => $paginator->total(),
-                'per_page' => $paginator->perPage(),
-                'current_page' => $paginator->currentPage(),
-                'last_page' => $paginator->lastPage(),
-            ],
-        ];
-    }
-
-    /**
-     * Look up a single product by its URL slug (any locale - slugs are indexed across
-     * all languages, see Modules\Core\Search\ProductIndexer). Returns the full indexed
-     * product document, or null if no product has that slug.
-     */
-    public function getBySlug(string $slug): ?array
-    {
-        return $this->findOneWhere('slugs = "'.addcslashes($slug, '"\\').'"');
-    }
-
-    /**
-     * Look up a single product by its primary key. Returns the full indexed product
-     * document, or null if no product has that id.
-     */
-    public function getById(int $id): ?array
-    {
-        return $this->findOneWhere("id = \"{$id}\"");
-    }
-
-    private function findOneWhere(string $filter): ?array
-    {
-        $paginator = Product::search('')
-            ->options(['filter' => $filter])
-            ->paginateRaw(perPage: 1, page: 1);
-
-        $product = $this->hitsFrom($paginator)[0] ?? null;
-
-        return $product !== null ? $this->withLocalizedFields($product) : null;
-    }
-
-    /**
-     * Resolves the current-locale `name`/`description` from the indexer's
-     * per-locale `name_{locale}`/`description_{locale}` fields, falling back to
-     * the store's default language (Language::default, see
-     * LocaleMiddleware::defaultLocale()) when the current locale has no
-     * translation - e.g. a product with no English copy yet still shows its
-     * Greek name/description on /en/ rather than rendering blank.
-     *
-     * Deliberately not config('app.locale') - App::setLocale() overwrites that
-     * config value on every request, so by request time it's just whatever the
-     * current locale already is, not a stable fallback.
-     */
-    private function withLocalizedFields(array $product): array
-    {
-        $locale = App::getLocale();
-        $fallbackLocale = LocaleMiddleware::defaultLocale();
-
-        $product['name'] = $product['name_'.$locale] ?? $product['name_'.$fallbackLocale] ?? null;
-        $product['description'] = $product['description_'.$locale] ?? $product['description_'.$fallbackLocale] ?? null;
-
-        return $product;
-    }
-
-    /**
-     * For the Meilisearch driver, Scout's paginateRaw() puts the whole raw response
-     * (hits, query, processingTimeMs, ...) in items(), not a plain list of hits - the
-     * actual documents are under the 'hits' key.
-     */
-    private function hitsFrom(LengthAwarePaginator $paginator): array
-    {
-        $rawResponse = $paginator->items();
-
-        return collect($rawResponse['hits'] ?? [])->values()->all();
-    }
-
-    private function buildFilter(?ProductFilters $filters): ?string
-    {
-        if ($filters === null) {
-            return null;
-        }
-
-        $clauses = Collection::make([
-            $filters->collectionId !== null ? "collections = \"{$filters->collectionId}\"" : null,
-            $filters->brand !== null ? 'brand = "'.addcslashes($filters->brand, '"\\').'"' : null,
-            $filters->minPrice !== null ? "price >= {$filters->minPrice}" : null,
-            $filters->maxPrice !== null ? "price <= {$filters->maxPrice}" : null,
-        ])->filter();
-
-        return $clauses->isEmpty() ? null : $clauses->join(' AND ');
-    }
-}
diff --git a/src/Catalog/Recommendations/RandomRule.php b/src/Catalog/Recommendations/RandomRule.php
new file mode 100644
index 0000000..c55621f
--- /dev/null
+++ b/src/Catalog/Recommendations/RandomRule.php
@@ -0,0 +1,27 @@
+<?php
+
+namespace Modules\Core\Catalog\Recommendations;
+
+use Illuminate\Support\Collection;
+use Lunar\Models\Product;
+use Modules\Core\Catalog\Contracts\RecommendationRule;
+
+/**
+ * The universal fallback — always returns something as long as the store
+ * has more than one product, since it has no eligibility condition of its
+ * own to come up empty on. Meant to be placed last in
+ * config('catalog.recommendation_rules'), not first: every store using
+ * the default chain gets a real fallback, but one that only kicks in once
+ * more specific rules (same category, same tag, ...) have had a chance.
+ */
+class RandomRule implements RecommendationRule
+{
+    public function recommend(Product $product, int $limit, array $exclude): Collection
+    {
+        return Product::query()
+            ->whereKeyNot($exclude)
+            ->inRandomOrder()
+            ->limit($limit)
+            ->get();
+    }
+}
diff --git a/src/Catalog/Recommendations/SameCategoryRule.php b/src/Catalog/Recommendations/SameCategoryRule.php
new file mode 100644
index 0000000..b07c09e
--- /dev/null
+++ b/src/Catalog/Recommendations/SameCategoryRule.php
@@ -0,0 +1,39 @@
+<?php
+
+namespace Modules\Core\Catalog\Recommendations;
+
+use Illuminate\Support\Collection;
+use Lunar\Models\Product;
+use Modules\Core\Catalog\Contracts\RecommendationRule;
+
+/**
+ * Recommends other products sharing at least one of $product's directly-
+ * assigned collections — takes $product's first collection (a product
+ * usually has one primary category; if it has several, the first is as
+ * good a choice as any without a "primary collection" concept to prefer).
+ * Returns nothing if $product has no collection at all, letting the next
+ * rule in the chain (see RecommendationRule's docblock) take over.
+ *
+ * Queries Eloquent directly rather than going through Modules\Core\Catalog\
+ * Services\ProductService — this runs at index time (see
+ * RecommendationRule's docblock), where Meilisearch may be mid-reindex for
+ * this very product and ProductService::list()'s locale-resolution has no
+ * meaningful "current locale" to resolve against anyway.
+ */
+class SameCategoryRule implements RecommendationRule
+{
+    public function recommend(Product $product, int $limit, array $exclude): Collection
+    {
+        $collection = $product->collections->first();
+
+        if ($collection === null) {
+            return collect();
+        }
+
+        return $collection->products()
+            ->whereKeyNot($exclude)
+            ->inRandomOrder()
+            ->limit($limit)
+            ->get();
+    }
+}
diff --git a/src/Catalog/Services/CollectionIndexer.php b/src/Catalog/Services/CollectionIndexer.php
new file mode 100644
index 0000000..29eb4ef
--- /dev/null
+++ b/src/Catalog/Services/CollectionIndexer.php
@@ -0,0 +1,91 @@
+<?php
+
+namespace Modules\Core\Catalog\Services;
+
+use Illuminate\Database\Eloquent\Builder;
+use Illuminate\Database\Eloquent\Model;
+use Lunar\Models\Collection;
+use Lunar\Models\Product;
+use Lunar\Search\CollectionIndexer as BaseCollectionIndexer;
+
+/**
+ * Extends Lunar's own indexer so Modules\Core\Catalog\Services\CollectionService can
+ * serve category browsing/nav AND single-collection lookups from Meilisearch alone,
+ * the same reasoning as Modules\Core\Catalog\Services\ProductIndexer. Lunar's base
+ * indexer only carries `id`/`name`/`created_at` — nowhere near enough for a storefront
+ * category page or a nav tree. Adds:
+ *   - parent_id, _lft, _rgt (filterable/sortable) — the nested-set tree position, so
+ *     CollectionService can resolve "children of X" or build a full tree without a
+ *     database read
+ *   - collection_group_id (filterable) — mirrors Collection::scopeInGroup()
+ *   - slugs (filterable) — every locale's Url::slug, so getBySlug() resolves from the
+ *     index directly, no database read
+ *   - thumbnail (display) — the collection's thumbnail image URL
+ *   - ancestors (display) — [{id, name}, ...] ordered root-first, so a breadcrumb can
+ *     render directly from a single indexed document with zero extra queries
+ *   - product_count (display) — how many products are in this collection or any of
+ *     its descendants, read from the *product* Meilisearch index at collection-index
+ *     time (via `collection_ids`, see Modules\Core\Catalog\Services\ProductIndexer) —
+ *     matches what ProductService::list(ProductFilters(collectionId: ...)) would
+ *     return, not just direct assignment. Reflects the product index's state as of
+ *     the last collection reindex, so re-run `lunar:search:index --refresh` after a
+ *     product reindex if this needs to be current.
+ *
+ * New fields aren't filterable/sortable in Meilisearch until `php artisan
+ * lunar:meilisearch:setup` re-syncs index settings, and existing documents need
+ * `lunar:search:index --refresh` to pick up the new shape.
+ */
+class CollectionIndexer extends BaseCollectionIndexer
+{
+    public function getFilterableFields(): array
+    {
+        return [
+            ...parent::getFilterableFields(),
+            'id',
+            'parent_id',
+            '_lft',
+            'collection_group_id',
+            'slugs',
+        ];
+    }
+
+    public function getSortableFields(): array
+    {
+        return [
+            ...parent::getSortableFields(),
+            '_lft',
+        ];
+    }
+
+    public function makeAllSearchableUsing(Builder $query): Builder
+    {
+        return parent::makeAllSearchableUsing($query)->with(['urls', 'media', 'ancestors']);
+    }
+
+    public function toSearchableArray(Model $model): array
+    {
+        /** @var Collection $model */
+        $data = parent::toSearchableArray($model);
+
+        $data['parent_id'] = $model->parent_id;
+        $data['_lft'] = $model->_lft;
+        $data['_rgt'] = $model->_rgt;
+        $data['collection_group_id'] = $model->collection_group_id;
+        $data['slugs'] = $model->urls->pluck('slug')->unique()->values()->all();
+        $data['thumbnail'] = $model->getThumbnailImage() ?: null;
+        $data['ancestors'] = $model->ancestors
+            ->sortBy('_lft')
+            ->map(fn ($ancestor) => [
+                'id' => $ancestor->id,
+                'name' => $ancestor->translateAttribute('name'),
+            ])
+            ->values()
+            ->all();
+        $data['product_count'] = Product::search('')
+            ->options(['filter' => "collection_ids = \"{$model->id}\""])
+            ->paginateRaw(perPage: 1, page: 1)
+            ->total();
+
+        return $data;
+    }
+}
diff --git a/src/Catalog/Services/CollectionService.php b/src/Catalog/Services/CollectionService.php
new file mode 100644
index 0000000..001c239
--- /dev/null
+++ b/src/Catalog/Services/CollectionService.php
@@ -0,0 +1,147 @@
+<?php
+
+namespace Modules\Core\Catalog\Services;
+
+use Illuminate\Contracts\Pagination\LengthAwarePaginator as LengthAwarePaginatorContract;
+use Illuminate\Pagination\LengthAwarePaginator;
+use Illuminate\Support\Collection;
+use Illuminate\Support\Facades\App;
+use Lunar\Base\AttributeManifest;
+use Lunar\FieldTypes\TranslatedText;
+use Lunar\Models\Collection as CollectionModel;
+use Modules\Core\Catalog\DTOs\CollectionFilters;
+use Modules\Core\Catalog\Enums\CollectionSort;
+use Modules\Core\Localization\Services\LanguageCache;
+
+/**
+ * Category browsing (tree/nav) AND single-collection lookup, all reading directly
+ * from the Meilisearch index (Modules\Core\Catalog\Services\CollectionIndexer) — same
+ * shape and reasoning as Modules\Core\Catalog\Services\ProductService. Callers get
+ * plain arrays of the indexed document, not Eloquent models.
+ */
+class CollectionService
+{
+    public function __construct(
+        private readonly LanguageCache $languages,
+        private readonly AttributeManifest $attributes,
+    ) {}
+
+    /**
+     * Returns a real LengthAwarePaginator (not Scout's own paginateRaw() result — see
+     * ProductService's "Meilisearch driver quirk" note) so a controller/view gets
+     * normal pagination behaviour without ever touching the raw Meilisearch response.
+     */
+    public function list(?CollectionFilters $filters = null, int $perPage = 24, int $page = 1, ?CollectionSort $sort = null): LengthAwarePaginator
+    {
+        $options = ['filter' => $this->buildFilter($filters)];
+
+        if ($sort !== null) {
+            $options['sort'] = [$sort->toMeilisearchSort()];
+        }
+
+        $paginator = CollectionModel::search('')
+            ->options($options)
+            ->paginateRaw(perPage: $perPage, page: $page);
+
+        $data = collect($this->hitsFrom($paginator))
+            ->map(fn (array $collection) => $this->withLocalizedFields($collection))
+            ->all();
+
+        return new LengthAwarePaginator(
+            items: $data,
+            total: $paginator->total(),
+            perPage: $paginator->perPage(),
+            currentPage: $paginator->currentPage(),
+            options: ['path' => LengthAwarePaginator::resolveCurrentPath()],
+        );
+    }
+
+    /**
+     * Look up a single collection by its URL slug (any locale). Returns the full
+     * indexed collection document, or null if no collection has that slug.
+     */
+    public function getBySlug(string $slug): ?array
+    {
+        return $this->findOneWhere('slugs = "'.addcslashes($slug, '"\\').'"');
+    }
+
+    /**
+     * Look up a single collection by its primary key. Returns the full indexed
+     * collection document, or null if no collection has that id.
+     */
+    public function getById(int $id): ?array
+    {
+        return $this->findOneWhere("id = \"{$id}\"");
+    }
+
+    private function findOneWhere(string $filter): ?array
+    {
+        $paginator = CollectionModel::search('')
+            ->options(['filter' => $filter])
+            ->paginateRaw(perPage: 1, page: 1);
+
+        $collection = $this->hitsFrom($paginator)[0] ?? null;
+
+        return $collection !== null ? $this->withLocalizedFields($collection) : null;
+    }
+
+    /**
+     * Resolves every translated Collection attribute's current-locale value — same
+     * logic as ProductService::withLocalizedFields(), see there for the full
+     * reasoning (AttributeManifest-driven, store-default-locale fallback, raw
+     * per-locale keys stripped after resolving).
+     */
+    private function withLocalizedFields(array $collection): array
+    {
+        $locale = App::getLocale();
+        $fallbackLocale = $this->languages->defaultLocale();
+        $availableLocales = $this->languages->availableLocales();
+
+        foreach ($this->translatedAttributeHandles() as $handle) {
+            $collection[$handle] = $collection[$handle.'_'.$locale] ?? $collection[$handle.'_'.$fallbackLocale] ?? null;
+
+            foreach ($availableLocales as $availableLocale) {
+                unset($collection[$handle.'_'.$availableLocale]);
+            }
+        }
+
+        return $collection;
+    }
+
+    /**
+     * @return array<int, string>
+     */
+    private function translatedAttributeHandles(): array
+    {
+        return $this->attributes->getSearchableAttributes((new CollectionModel)->getMorphClass())
+            ->filter(fn ($attribute) => $attribute->type === TranslatedText::class)
+            ->pluck('handle')
+            ->all();
+    }
+
+    /**
+     * For the Meilisearch driver, Scout's paginateRaw() puts the whole raw response
+     * in items(), not a plain list of hits — see ProductService's identical note.
+     */
+    private function hitsFrom(LengthAwarePaginatorContract $paginator): array
+    {
+        $rawResponse = $paginator->items();
+
+        return collect($rawResponse['hits'] ?? [])->values()->all();
+    }
+
+    private function buildFilter(?CollectionFilters $filters): ?string
+    {
+        if ($filters === null) {
+            return null;
+        }
+
+        $clauses = Collection::make([
+            $filters->parentId !== null ? "parent_id = \"{$filters->parentId}\""
+                : ($filters->rootOnly ? 'parent_id IS NULL' : null),
+            $filters->groupId !== null ? "collection_group_id = \"{$filters->groupId}\"" : null,
+        ])->filter();
+
+        return $clauses->isEmpty() ? null : $clauses->join(' AND ');
+    }
+}
diff --git a/src/Catalog/Services/ProductIndexer.php b/src/Catalog/Services/ProductIndexer.php
new file mode 100644
index 0000000..0ed4516
--- /dev/null
+++ b/src/Catalog/Services/ProductIndexer.php
@@ -0,0 +1,274 @@
+<?php
+
+namespace Modules\Core\Catalog\Services;
+
+use Illuminate\Database\Eloquent\Builder;
+use Illuminate\Database\Eloquent\Model;
+use Lunar\Models\Currency;
+use Lunar\Models\Price;
+use Lunar\Models\Product;
+use Lunar\Models\ProductVariant;
+use Lunar\Search\ProductIndexer as BaseProductIndexer;
+use Modules\Core\Review\Models\ProductReview;
+use Spatie\MediaLibrary\MediaCollections\Models\Media;
+
+/**
+ * Extends Lunar's own indexer so Modules\Core\Catalog\Services\ProductService can
+ * serve both listing/filtering AND single-product lookups from Meilisearch alone —
+ * one data source, no separate database read path for a product detail page. Adds:
+ *   - collections: [{id, name}, ...] — directly assigned collections only, for
+ *     display (breadcrumbs, "also in"). Not filterable — see collection_ids below.
+ *   - collection_ids (filterable): flat array of every directly-assigned collection's
+ *     id UNIONED with all of its ancestors' ids. Products are typically attached only
+ *     to leaf collections in a Shopify-imported tree, so a plain `collections.id`
+ *     filter would never match a parent/root category page — ProductService::list()
+ *     filters `collectionId` against this field instead, so "products in category X"
+ *     also picks up every product attached only to one of X's subcategories.
+ *   - slugs (every locale's Url::slug for the product, filterable) — lets
+ *     ProductService::getBySlug() resolve a product from the index directly, with
+ *     no database read at all
+ *   - skus (every variant's sku, deduplicated, filterable) — same "resolve from the
+ *     index alone" reasoning as slugs, for a future SKU-based lookup/filter
+ *   - price (cheapest variant, filterable) and full per-variant pricing
+ *   - variants: sku, gtin, mpn, ean, stock, backorder, unit_quantity, purchasable,
+ *     shippable, tax_ref, dimensions (length/width/height/weight/volume, each
+ *     {value, unit}), option values, prices, media — the variant's own images
+ *     (ProductVariant::images(), separate from the product's gallery below), not
+ *     the product's own media repeated per variant
+ *   - the full media gallery (not just the single thumbnail Lunar's base indexer sends)
+ *   - tags
+ *   - reviews: {items: [...], count, average_rating} — items are public-safe fields
+ *     only (see mapReview() — reviewer_email is deliberately excluded, it's PII with
+ *     no storefront use), including staff replies
+ *   - channel_ids (filterable) — Lunar's base indexer only indexes "status" as
+ *     filterable, not channel assignment, so search results can't otherwise be
+ *     scoped to products actually assigned+enabled on the current sales channel
+ *   - in_stock (filterable) — true if ANY variant can currently be purchased at
+ *     quantity 1, via ProductVariant::canBeFulfilledAtQuantity() (Lunar's own
+ *     purchasability rule: `purchasable === 'always'` is always true regardless of
+ *     stock, `in_stock` checks stock alone, anything else checks stock+backorder).
+ *     Modules\Core\Order\Listeners\DecrementStockOnOrderPlaced reindexes a product
+ *     the moment an order placed against it decrements its stock — see that
+ *     class's own docblock for why only `purchasable === 'in_stock'`
+ *     variants are ever touched. Any other stock edit (a manual admin
+ *     change, a future inventory-sync integration) still only reflects here
+ *     as of the next reindex (see docs/product-listing.md).
+ *
+ *   - recommendations (recommendations.id filterable): [{id, name, price, image}, ...]
+ *     up to 4 other products to show alongside this one (a "related products"
+ *     section), sourced from Modules\Core\Catalog\Services\RecommendationService's
+ *     configured rule chain (config('catalog.recommendation_rules')). Embedded
+ *     card data, not just ids, same reasoning as `collections`: renders
+ *     directly with zero extra Meilisearch calls. `name` is resolved via
+ *     translateAttribute() at index time (not through ProductService's
+ *     per-request locale resolution, since indexing has no "current locale"
+ *     the way a storefront request does) — same known index-time-locale
+ *     tradeoff `collections` already has. `recommendations.id` is filterable
+ *     specifically so Modules\Core\Catalog\Listeners\
+ *     ReindexProductsRecommendingProduct can find every product currently
+ *     recommending a given one, when that one changes — there's no Postgres
+ *     relation for this, a recommendation only exists inside the index.
+ *
+ * A review is created/edited independently of its product (Modules\Core\Providers\
+ * ReviewServiceProvider re-indexes the product on review create/update/delete), so
+ * this data doesn't go stale between full reindexes.
+ *
+ * New fields aren't filterable in Meilisearch until `php artisan lunar:meilisearch:setup`
+ * re-syncs index settings, and existing documents need `lunar:search:index --refresh` to
+ * pick up the new shape — see docs/product-listing.md. If SCOUT_QUEUE is enabled, the
+ * queue worker also needs restarting after deploying changes to this class (see
+ * docs/lunar.md "Gotchas" — a running worker keeps stale indexer code in memory).
+ */
+class ProductIndexer extends BaseProductIndexer
+{
+    public function getFilterableFields(): array
+    {
+        return [
+            ...parent::getFilterableFields(),
+            'id',
+            'brand',
+            'collection_ids',
+            'price',
+            'slugs',
+            'channel_ids',
+            'in_stock',
+            'recommendations.id',
+            'skus',
+            'tags',
+        ];
+    }
+
+    public function getSortableFields(): array
+    {
+        return [
+            ...parent::getSortableFields(),
+            'price',
+        ];
+    }
+
+    public function makeAllSearchableUsing(Builder $query): Builder
+    {
+        return parent::makeAllSearchableUsing($query)->with([
+            'collections',
+            'collections.ancestors',
+            'media',
+            'tags',
+            'urls',
+            'variants.images',
+            'variants.prices',
+            'variants.values.option',
+        ]);
+    }
+
+    public function toSearchableArray(Model $model): array
+    {
+        /** @var Product $model */
+        $data = parent::toSearchableArray($model);
+
+        $currency = Currency::getDefault();
+        $reviews = ProductReview::where('product_id', $model->id)->with('media')->get();
+
+        $data['collections'] = $model->collections->map(fn ($collection) => [
+            'id' => $collection->id,
+            'name' => $collection->translateAttribute('name'),
+        ])->all();
+        $data['collection_ids'] = $model->collections
+            ->flatMap(fn ($collection) => [$collection->id, ...$collection->ancestors->pluck('id')])
+            ->unique()
+            ->values()
+            ->all();
+        $data['slugs'] = $model->urls->pluck('slug')->unique()->values()->all();
+        $data['skus'] = $model->variants->pluck('sku')->filter()->unique()->values()->all();
+        $data['tags'] = $model->tags->pluck('value')->all();
+        $data['media'] = $model->media->map(fn (Media $media) => $this->mapMedia($media))->all();
+        $data['variants'] = $model->variants->map(fn (ProductVariant $variant) => $this->mapVariant($variant, $currency))->all();
+        $data['price'] = $this->cheapestPrice($model, $currency);
+        $data['reviews'] = [
+            'items' => $reviews->map(fn (ProductReview $review) => $this->mapReview($review))->all(),
+            'count' => $reviews->count(),
+            'average_rating' => $reviews->isEmpty() ? null : round($reviews->avg('rating'), 1),
+        ];
+        $data['channel_ids'] = $model->channels()
+            ->wherePivot('enabled', true)
+            ->pluck('lunar_channels.id')
+            ->toArray();
+        $data['in_stock'] = $model->variants->contains(
+            fn (ProductVariant $variant) => $variant->canBeFulfilledAtQuantity(1)
+        );
+        $data['recommendations'] = app(RecommendationService::class)
+            ->recommend($model)
+            ->load(['media', 'variants.prices'])
+            ->map(fn (Product $recommendation) => [
+                'id' => $recommendation->id,
+                'name' => $recommendation->translateAttribute('name'),
+                'price' => $this->cheapestPrice($recommendation, $currency),
+                'image' => $recommendation->media->first() ? $this->mapMedia($recommendation->media->first())['thumb'] : null,
+            ])
+            ->all();
+
+        return $data;
+    }
+
+    private function mapVariant(ProductVariant $variant, Currency $currency): array
+    {
+        return [
+            'id' => $variant->id,
+            'sku' => $variant->sku,
+            'gtin' => $variant->gtin,
+            'mpn' => $variant->mpn,
+            'ean' => $variant->ean,
+            'stock' => $variant->stock,
+            'backorder' => $variant->backorder,
+            'unit_quantity' => $variant->unit_quantity,
+            'purchasable' => $variant->purchasable,
+            'shippable' => $variant->shippable,
+            'tax_ref' => $variant->tax_ref,
+            'dimensions' => [
+                'length' => ['value' => $variant->length_value, 'unit' => $variant->length_unit],
+                'width' => ['value' => $variant->width_value, 'unit' => $variant->width_unit],
+                'height' => ['value' => $variant->height_value, 'unit' => $variant->height_unit],
+                'weight' => ['value' => $variant->weight_value, 'unit' => $variant->weight_unit],
+                'volume' => ['value' => $variant->volume_value, 'unit' => $variant->volume_unit],
+            ],
+            'options' => $variant->values->map(fn ($value) => [
+                'option' => $this->translatedName($value->option->name),
+                'handle' => $value->option->handle,
+                'value' => $this->translatedName($value->name),
+                'meta' => $value->meta,
+            ])->all(),
+            'prices' => $variant->prices->map(fn (Price $price) => [
+                'currency_id' => $price->currency_id,
+                'customer_group_id' => $price->customer_group_id,
+                'price' => $price->price->decimal(),
+                'compare_price' => $price->compare_price?->decimal(),
+                'min_quantity' => $price->min_quantity,
+            ])->all(),
+            'media' => $variant->images->map(fn (Media $media) => $this->mapMedia($media))->all(),
+        ];
+    }
+
+    /**
+     * Public-safe fields only — reviewer_email is PII with no storefront use and is
+     * deliberately excluded, unlike every other column on the review. reply/replied_at
+     * (the staff response) are included since they're meant to be shown alongside the
+     * review on the storefront.
+     */
+    private function mapReview(ProductReview $review): array
+    {
+        return [
+            'id' => $review->id,
+            'title' => $review->title,
+            'body' => $review->body,
+            'rating' => $review->rating,
+            'reviewed_at' => $review->reviewed_at?->timestamp,
+            'reviewer_name' => $review->reviewer_name,
+            'reply' => $review->reply,
+            'replied_at' => $review->replied_at?->timestamp,
+            'location' => $review->location,
+            'media' => $review->media->map(fn (Media $media) => $this->mapMedia($media))->all(),
+        ];
+    }
+
+    /**
+     * ProductOption/ProductOptionValue's `name` is a plain locale-keyed array cast
+     * (AsArrayObject) directly on the column — unlike Product/Collection/Brand, it is
+     * not stored in attribute_data. Lunar's translateAttribute() only reads
+     * attribute_data, so it silently returns null for these two models; this reads
+     * the array directly instead. Falls back to the first available locale if the
+     * current one is missing. Not a general replacement for translateAttribute() —
+     * every other translated field in this indexer (product/collection name and
+     * description) genuinely is attribute_data-backed and translateAttribute() is
+     * correct for those.
+     */
+    private function translatedName(mixed $name): ?string
+    {
+        $names = is_array($name) ? $name : (array) $name;
+
+        return $names[app()->getLocale()] ?? reset($names) ?: null;
+    }
+
+    private function mapMedia(Media $media): array
+    {
+        return [
+            'id' => $media->id,
+            'url' => $media->getUrl(),
+            'thumb' => $media->getUrl('small'),
+        ];
+    }
+
+    /**
+     * The cheapest variant's base price (no customer group) in the default currency,
+     * as a float in major units — e.g. 19.99, not 1999. Null if the product has no
+     * variant with a price in that currency yet, so it's excluded from price filters
+     * rather than sorting to the bottom as if it were free.
+     */
+    private function cheapestPrice(Product $model, Currency $currency): ?float
+    {
+        $price = $model->variants
+            ->flatMap(fn ($variant) => $variant->prices)
+            ->filter(fn ($price) => $price->currency_id === $currency->id && $price->customer_group_id === null)
+            ->min(fn ($price) => $price->price->value);
+
+        return $price !== null ? $price / (10 ** $currency->decimal_places) : null;
+    }
+}
diff --git a/src/Catalog/Services/ProductOptionTypeManager.php b/src/Catalog/Services/ProductOptionTypeManager.php
new file mode 100644
index 0000000..2b45683
--- /dev/null
+++ b/src/Catalog/Services/ProductOptionTypeManager.php
@@ -0,0 +1,68 @@
+<?php
+
+namespace Modules\Core\Catalog\Services;
+
+use Modules\Core\Catalog\Contracts\ProductOptionTypeInterface;
+
+/**
+ * Resolves an admin-selected option type key to the `ProductOptionTypeInterface`
+ * describing it. The selection (which key a given `Lunar\Models\ProductOption` uses)
+ * is stored per-option in `ProductOption::meta['option_type']` — deliberately not
+ * tied to the option's `handle`, since a shop's own handle naming (e.g. transliterated
+ * Greek, legacy imports) shouldn't have to match a type's key.
+ *
+ * A singleton registry, same shape as `Modules\Core\Notification\NotificationRegistry`
+ * — a consuming app calls `ProductOptionTypeManager::get()->register([...])` from its
+ * own service provider `boot()`, rather than listing classes in a published config
+ * file.
+ */
+class ProductOptionTypeManager
+{
+    private static ?self $instance = null;
+
+    /** @var array<string, class-string<ProductOptionTypeInterface>> */
+    private array $types = [];
+
+    private function __construct() {}
+
+    public static function get(): static
+    {
+        if (static::$instance === null) {
+            static::$instance = new static();
+        }
+
+        return static::$instance;
+    }
+
+    /**
+     * @param array<class-string<ProductOptionTypeInterface>> $types
+     */
+    public function register(array $types): void
+    {
+        foreach ($types as $class) {
+            $this->types[$class::getKey()] = $class;
+        }
+    }
+
+    public function unregister(string $key): void
+    {
+        unset($this->types[$key]);
+    }
+
+    public function resolve(?string $key): ?ProductOptionTypeInterface
+    {
+        if ($key === null || ! isset($this->types[$key])) {
+            return null;
+        }
+
+        return app($this->types[$key]);
+    }
+
+    /**
+     * @return array<string, class-string<ProductOptionTypeInterface>>
+     */
+    public function all(): array
+    {
+        return $this->types;
+    }
+}
diff --git a/src/Catalog/Services/ProductSearchService.php b/src/Catalog/Services/ProductSearchService.php
new file mode 100644
index 0000000..b4790b6
--- /dev/null
+++ b/src/Catalog/Services/ProductSearchService.php
@@ -0,0 +1,124 @@
+<?php
+
+namespace Modules\Core\Catalog\Services;
+
+use Illuminate\Pagination\LengthAwarePaginator;
+use Lunar\Facades\AttributeManifest;
+use Lunar\Models\Language;
+use Lunar\Models\Product;
+use Modules\Core\Catalog\DTOs\ProductFilters;
+use Modules\Core\Catalog\DTOs\ProductListingResult;
+use Modules\Core\Catalog\Enums\ProductSort;
+use Modules\Core\Catalog\Support\ProductDocumentLocalizer;
+use Modules\Core\Catalog\Support\ProductFilterBuilder;
+
+/**
+ * Lunar's Meilisearch indexer flattens translated attributes into locale-suffixed
+ * fields on a single document (name_en, name_el, description_en, description_el —
+ * see Lunar\Search\ScoutIndexer::mapSearchableAttributes()), not separate indexes
+ * or a filterable locale field. Locale-aware search means choosing which fields
+ * to search on, not filtering results by locale.
+ */
+class ProductSearchService
+{
+    public function __construct(
+        private readonly ProductFilterBuilder $filterBuilder,
+        private readonly ProductDocumentLocalizer $localizer,
+        private readonly ProductService $products,
+    ) {}
+
+    /**
+     * Returns the exact same Modules\Core\Catalog\DTOs\ProductListingResult
+     * ProductService::list() does — a search results page and a category
+     * listing page consume identically shaped data, one call each. The
+     * paginator itself carries plain, localized indexed-document arrays
+     * (not hydrated Product models), same as list().
+     *
+     * priceBounds/availableTags are delegated to ProductService's own
+     * priceSliderBounds()/availableTags() rather than reimplemented here —
+     * both already accept a $query param for exactly this reason (a search
+     * page's slider/tag sidebar should reflect only the products search
+     * actually matched, not the whole catalog).
+     *
+     * $filters/$sort apply the exact same semantics ProductService::list()
+     * uses for collection browsing (same ProductFilterBuilder, same
+     * ProductSort::toMeilisearchSort()) — a shopper narrowing a text search
+     * by price/brand/stock gets identical filter behavior to narrowing a
+     * category listing, since both go through the same Meilisearch `filter`
+     * clause underneath.
+     */
+    public function search(
+        string $query,
+        ?ProductFilters $filters = null,
+        ?ProductSort $sort = null,
+        int $perPage = 24,
+        int $page = 1,
+    ): ProductListingResult {
+        $options = [
+            'attributesToSearchOn' => $this->searchableFields(),
+            'filter' => $this->filterBuilder->build($filters),
+        ];
+
+        if ($sort !== null) {
+            $options['sort'] = [$sort->toMeilisearchSort()];
+        }
+
+        $paginator = Product::search($query)
+            ->options($options)
+            ->paginateRaw(perPage: $perPage, page: $page);
+
+        $data = collect($this->localizer->hitsFrom($paginator))
+            ->map(fn (array $product) => $this->localizer->withLocalizedFields($product))
+            ->all();
+
+        $products = new LengthAwarePaginator(
+            items: $data,
+            total: $paginator->total(),
+            perPage: $paginator->perPage(),
+            currentPage: $paginator->currentPage(),
+            options: ['path' => LengthAwarePaginator::resolveCurrentPath()],
+        );
+
+        $priceBounds = $this->products->priceSliderBounds($filters, $filters?->minPrice, $filters?->maxPrice, $query);
+        $availableTags = $this->products->availableTags($filters, $query);
+
+        return new ProductListingResult($products, $priceBounds, $availableTags);
+    }
+
+    /**
+     * Targets every configured store language's fields, not just the current
+     * request locale plus the store default — a shopper browsing in Greek
+     * typing an English word (or vice versa) should still match a product
+     * whose only translation for that text happens to be in a third
+     * language. There's no per-request "current locale" concept in this
+     * method any more: which fields exist to search on is a property of the
+     * store's configured languages, not of who's asking.
+     *
+     * Also targets variants.options.value directly — a variant's option
+     * value (e.g. "Κάπτεν Γαμέρικα" on a "Name" option) is how ProductIndexer
+     * already indexes it (see mapVariant()), but it isn't one of Lunar's own
+     * attributes, so it can't come from AttributeManifest the way name/
+     * description do; it's a structural field of the document, added here
+     * directly instead. Not locale-suffixed like the attribute-manifest
+     * fields — option values are stored as one already-resolved string per
+     * variant (see ProductIndexer::translatedName()), not per-locale.
+     *
+     * @return array<int, string>
+     */
+    private function searchableFields(): array
+    {
+        $handles = AttributeManifest::getSearchableAttributes(Product::morphName())
+            ->pluck('handle');
+
+        $locales = Language::all()->pluck('code');
+
+        $attributeFields = $handles
+            ->crossJoin($locales)
+            ->map(fn (array $pair) => "{$pair[0]}_{$pair[1]}");
+
+        return $attributeFields
+            ->push('variants.options.value')
+            ->values()
+            ->all();
+    }
+}
diff --git a/src/Catalog/Services/ProductService.php b/src/Catalog/Services/ProductService.php
new file mode 100644
index 0000000..c3ba915
--- /dev/null
+++ b/src/Catalog/Services/ProductService.php
@@ -0,0 +1,297 @@
+<?php
+
+namespace Modules\Core\Catalog\Services;
+
+use Illuminate\Pagination\LengthAwarePaginator;
+use Lunar\Models\Product;
+use Modules\Core\Catalog\DTOs\PriceSliderBounds;
+use Modules\Core\Catalog\DTOs\ProductFilters;
+use Modules\Core\Catalog\DTOs\ProductListingResult;
+use Modules\Core\Catalog\Enums\ProductSort;
+use Modules\Core\Catalog\Support\ProductDocumentLocalizer;
+use Modules\Core\Catalog\Support\ProductFilterBuilder;
+
+/**
+ * Storefront product listing/filtering AND single-product lookup, all reading directly
+ * from the Meilisearch index (Modules\Core\Catalog\Services\ProductIndexer) - one data
+ * source, no ->get() model hydration anywhere in this service. Callers get plain arrays
+ * of the indexed document, not Eloquent models.
+ *
+ * Full-text query search lives separately in Modules\Core\Catalog\Services\
+ * ProductSearchService; this service is for browsing/filtering without a search term.
+ */
+class ProductService
+{
+    public function __construct(
+        private readonly ProductDocumentLocalizer $localizer,
+        private readonly ProductFilterBuilder $filterBuilder,
+    ) {}
+
+    /**
+     * One call for everything a listing page needs: the product page AND
+     * the price slider's bounds — a controller used to have to call this
+     * plus priceSliderBounds() separately and glue the results together
+     * itself; that orchestration now happens in here instead. Still issues
+     * two Meilisearch requests under the hood (the product search, and a
+     * separate price-facet-stats query — see priceSliderBounds()'s
+     * docblock for why they can't be merged into one without changing the
+     * slider's own UX), but the caller only ever makes one call.
+     *
+     * $filters->minPrice/$filters->maxPrice double as both the applied
+     * product filter AND the "is the slider actually narrowed" comparison
+     * in priceSliderBounds() — the same values, used two ways, so nothing
+     * new needs to be threaded through separately.
+     *
+     * The paginator itself is a real LengthAwarePaginator (not Scout's own
+     * paginateRaw() result - see "Meilisearch driver quirk" below) so a
+     * controller/view gets normal pagination behaviour ($products->links(),
+     * JSON serialization, etc.) without ever touching the raw Meilisearch
+     * response directly.
+     */
+    public function list(?ProductFilters $filters = null, int $perPage = 24, int $page = 1, ?ProductSort $sort = null): ProductListingResult
+    {
+        $options = ['filter' => $this->filterBuilder->build($filters)];
+
+        if ($sort !== null) {
+            $options['sort'] = [$sort->toMeilisearchSort()];
+        }
+
+        $paginator = Product::search('')
+            ->options($options)
+            ->paginateRaw(perPage: $perPage, page: $page);
+
+        $data = collect($this->localizer->hitsFrom($paginator))
+            ->map(fn (array $product) => $this->localizer->withLocalizedFields($product))
+            ->all();
+
+        $products = new LengthAwarePaginator(
+            items: $data,
+            total: $paginator->total(),
+            perPage: $paginator->perPage(),
+            currentPage: $paginator->currentPage(),
+            options: ['path' => LengthAwarePaginator::resolveCurrentPath()],
+        );
+
+        $priceBounds = $this->priceSliderBounds($filters, $filters?->minPrice, $filters?->maxPrice);
+        $availableTags = $this->availableTags($filters);
+
+        return new ProductListingResult($products, $priceBounds, $availableTags);
+    }
+
+    /**
+     * Every distinct `tags` value present on a product matching $filters,
+     * excluding $filters->tag itself — same "scoped but not self-collapsing"
+     * reasoning as priceRange() excluding `price` — so selecting a tag
+     * doesn't shrink the sidebar down to just that one tag. Sorted
+     * alphabetically; Meilisearch's facetDistribution has no defined order
+     * of its own.
+     *
+     * $query defaults to '' (every product, same as list()'s own default
+     * text query) — same reasoning as priceRange()'s own $query: pass the
+     * shopper's search text here too so a search page's own tag sidebar
+     * reflects only the products search actually matched. Public (not
+     * private, unlike the rest of this listing-only orchestration) so
+     * ProductSearchService::search() can reuse it directly rather than
+     * reimplementing the same facet call a second time.
+     *
+     * @return array<int, string>
+     */
+    public function availableTags(?ProductFilters $filters, string $query = ''): array
+    {
+        $filter = $this->filterBuilder->build($filters, exclude: ['tag']);
+        $tags = $this->rawFacets('tags', $filter, $query)['facetDistribution']['tags'] ?? [];
+
+        return collect($tags)->keys()->sort()->values()->all();
+    }
+
+    /**
+     * Facet value counts for the given filter/field, scoped to the SAME filters
+     * `list()` would apply. Note this does NOT exclude `$field` itself from
+     * `$filters` — e.g. `facets('brand', new ProductFilters(brand: 'Acme'))` would
+     * scope the counts to only "Acme" already, collapsing every other brand's count
+     * to whatever remains under that filter. For a standard "faceted sidebar" (every
+     * brand's count reflecting collection/price/stock filters but NOT the brand
+     * filter itself), build a `$filters` that omits the field being faceted on and
+     * apply that field's own filter separately in the UI/query layer.
+     *
+     * `$field` must be one of ProductIndexer's filterable fields; only discrete-value
+     * fields make sense here (`brand`, `tags`, `in_stock`) — a numeric field like
+     * `price` would return one "facet" per exact price, not a usable range bucket.
+     * Use `priceRange()` for `price` instead. `facets('tags', $filters)` is how a
+     * category page gets "which tags actually appear on products in this category" —
+     * pass a $filters that omits `tag` (see `build()`'s $exclude) so the tag list
+     * itself doesn't collapse to whichever tag is already selected.
+     *
+     * @return array<string, int> facet value => matching product count
+     */
+    public function facets(string $field, ?ProductFilters $filters = null): array
+    {
+        return $this->rawFacets($field, $this->filterBuilder->build($filters))['facetDistribution'][$field] ?? [];
+    }
+
+    /**
+     * The min/max `price` across products matching the given filters (minus
+     * `minPrice`/`maxPrice` themselves, same "scoped but not self-collapsing"
+     * reasoning as `facets()` — a price slider's own bounds shouldn't shrink to
+     * whatever range is currently selected). Backed by Meilisearch's `facetStats`,
+     * not `facetDistribution` — the right feature for a numeric field's range,
+     * where `facets('price')` would otherwise return one entry per exact price.
+     *
+     * $query defaults to '' (every product, same as list()'s own default text
+     * query) — pass the shopper's search text here too so a search page's own
+     * price slider spans only the products that search actually matched,
+     * rather than the whole catalog's price range.
+     *
+     * @return array{min: ?float, max: ?float} null/null if no product matches
+     */
+    public function priceRange(?ProductFilters $filters = null, string $query = ''): array
+    {
+        $filter = $this->filterBuilder->build($filters, exclude: ['price']);
+        $stats = $this->rawFacets('price', $filter, $query)['facetStats']['price'] ?? null;
+
+        return [
+            'min' => $stats['min'] ?? null,
+            'max' => $stats['max'] ?? null,
+        ];
+    }
+
+    /**
+     * priceRange() rounded to whole euros (floor/ceil, so the slider's ends
+     * are never tighter than what's actually in range) plus whether
+     * $selectedMinPrice/$selectedMaxPrice actually narrow it — the same
+     * "floor/ceil + is this a real filter" rule CategoryController and
+     * SearchController each used to duplicate inline. $selectedMinPrice/
+     * $selectedMaxPrice are the currently-applied filter values (e.g.
+     * CategoryListing::$minPrice), not part of $filters itself, since
+     * $filters here must already exclude price the way priceRange() expects.
+     */
+    public function priceSliderBounds(
+        ?ProductFilters $filters,
+        ?float $selectedMinPrice,
+        ?float $selectedMaxPrice,
+        string $query = '',
+    ): PriceSliderBounds {
+        $priceRange = $this->priceRange($filters, $query);
+
+        $floor = $priceRange['min'] !== null ? (int) floor($priceRange['min']) : null;
+        $ceil = $priceRange['max'] !== null ? (int) ceil($priceRange['max']) : null;
+
+        $filtered = ($selectedMinPrice !== null && $selectedMinPrice > ($floor ?? PHP_INT_MIN))
+            || ($selectedMaxPrice !== null && $selectedMaxPrice < ($ceil ?? PHP_INT_MAX));
+
+        return new PriceSliderBounds($floor, $ceil, $filtered);
+    }
+
+    private function rawFacets(string $field, ?string $filter, string $query = ''): array
+    {
+        return Product::search($query)
+            ->options([
+                'filter' => $filter,
+                'facets' => [$field],
+                'hitsPerPage' => 0,
+            ])
+            ->raw();
+    }
+
+    /**
+     * Look up a single product by its URL slug (any locale - slugs are indexed across
+     * all languages, see Modules\Core\Catalog\Services\ProductIndexer). Returns the full
+     * indexed product document, or null if no product has that slug.
+     */
+    public function getBySlug(string $slug): ?array
+    {
+        return $this->findOneWhere('slugs = "'.addcslashes($slug, '"\\').'"');
+    }
+
+    /**
+     * Look up a single product by its primary key. Returns the full indexed product
+     * document, or null if no product has that id.
+     */
+    public function getById(int $id): ?array
+    {
+        return $this->findOneWhere("id = \"{$id}\"");
+    }
+
+    /**
+     * The id/price/image of every variant on a product document (from
+     * getById()/getBySlug()'s own 'variants' array) — the base price and
+     * thumbnail a variant picker/swatch list needs, without a caller
+     * reaching into $product['variants'][n]['prices'][0]/['media'][0]
+     * itself. Domain shaping (which price/image represents a variant),
+     * not presentation — a card's href/layout stays a storefront concern
+     * (e.g. App\Catalog\ProductCard in 3dealer), but "the variant's price
+     * is its first price row" is a rule about the data, true regardless of
+     * which app renders it.
+     *
+     * @param  array  $product  A document from getById()/getBySlug().
+     * @return array<int, array{id: int, price: ?float, image: ?string}>
+     */
+    public function variantSummaries(array $product): array
+    {
+        return collect($product['variants'] ?? [])
+            ->map(fn (array $variant) => [
+                'id' => $variant['id'],
+                'price' => $variant['prices'][0]['price'] ?? null,
+                'image' => $variant['media'][0]['url'] ?? null,
+            ])
+            ->values()
+            ->all();
+    }
+
+    /**
+     * $limit random products, still scoped to the index's own default
+     * visibility (channel/status), unlike Eloquent's Product::inRandomOrder()
+     * which has no notion of that filtering at all — a random pick can never
+     * surface a hidden/unpublished product this way. Meilisearch itself has
+     * no ORDER BY RANDOM() equivalent, so this pulls every matching id only
+     * (attributesToRetrieve: ['id'], the lightest possible request — no
+     * name/media/variants/etc. for documents that will mostly be discarded),
+     * shuffles in PHP, then fetches the full localized documents for just
+     * the $limit ids actually picked.
+     *
+     * @return array<int, array>
+     */
+    public function random(int $limit): array
+    {
+        $raw = Product::search('')
+            ->options(['attributesToRetrieve' => ['id']])
+            ->raw();
+
+        $ids = collect($raw['hits'] ?? [])->pluck('id')->shuffle()->take($limit)->values();
+
+        if ($ids->isEmpty()) {
+            return [];
+        }
+
+        // Meilisearch's `id IN [...]` doesn't preserve the given order — it's
+        // an unordered set filter, not a list to iterate — so the shuffle
+        // above would otherwise be silently undone by whatever order the
+        // re-fetch comes back in. Re-sort the fetched documents back into
+        // $ids's already-shuffled order instead of trusting the response's.
+        $products = collect($this->findAllWhere('id IN ['.$ids->implode(', ').']'))
+            ->keyBy('id');
+
+        return $ids->map(fn ($id) => $products->get($id))->filter()->values()->all();
+    }
+
+    private function findOneWhere(string $filter): ?array
+    {
+        $products = $this->findAllWhere($filter, limit: 1);
+
+        return $products[0] ?? null;
+    }
+
+    /**
+     * @return array<int, array>
+     */
+    private function findAllWhere(string $filter, int $limit = 1000): array
+    {
+        $paginator = Product::search('')
+            ->options(['filter' => $filter])
+            ->paginateRaw(perPage: $limit, page: 1);
+
+        return collect($this->localizer->hitsFrom($paginator))
+            ->map(fn (array $product) => $this->localizer->withLocalizedFields($product))
+            ->all();
+    }
+}
diff --git a/src/Catalog/Services/RecommendationService.php b/src/Catalog/Services/RecommendationService.php
new file mode 100644
index 0000000..986884c
--- /dev/null
+++ b/src/Catalog/Services/RecommendationService.php
@@ -0,0 +1,47 @@
+<?php
+
+namespace Modules\Core\Catalog\Services;
+
+use Illuminate\Database\Eloquent\Collection;
+use Lunar\Models\Product;
+use Modules\Core\Catalog\Contracts\RecommendationRule;
+
+/**
+ * Runs each rule in config('catalog.recommendation_rules'), in order,
+ * topping up from each successive rule until $limit distinct products are
+ * collected or every rule is exhausted — e.g. 3 from SameCategoryRule
+ * (the product's category only has 3 other products) + 1 from RandomRule.
+ * No rule is special-cased as "the fallback" here; a store gets fallback
+ * behaviour purely by how it orders its own config (e.g. SameCategoryRule
+ * before RandomRule). Never returns the same product twice even if two
+ * rules would both suggest it (see RecommendationRule's $exclude), and
+ * never returns fewer than $limit unless the store genuinely doesn't have
+ * that many other products at all.
+ */
+class RecommendationService
+{
+    /**
+     * @return Collection<int, Product>
+     */
+    public function recommend(Product $product, int $limit = 4): Collection
+    {
+        $recommendations = new Collection();
+
+        foreach (config('catalog.recommendation_rules', []) as $ruleClass) {
+            if ($recommendations->count() >= $limit) {
+                break;
+            }
+
+            $exclude = [$product->id, ...$recommendations->pluck('id')];
+            $remaining = $limit - $recommendations->count();
+
+            /** @var RecommendationRule $rule */
+            $rule = app($ruleClass);
+            $recommendations = $recommendations->merge(
+                $rule->recommend($product, $remaining, $exclude)
+            );
+        }
+
+        return $recommendations->take($limit)->values();
+    }
+}
diff --git a/src/Catalog/Support/ProductDocumentLocalizer.php b/src/Catalog/Support/ProductDocumentLocalizer.php
new file mode 100644
index 0000000..fb43ebd
--- /dev/null
+++ b/src/Catalog/Support/ProductDocumentLocalizer.php
@@ -0,0 +1,86 @@
+<?php
+
+namespace Modules\Core\Catalog\Support;
+
+use Illuminate\Contracts\Pagination\LengthAwarePaginator as LengthAwarePaginatorContract;
+use Illuminate\Support\Facades\App;
+use Lunar\Base\AttributeManifest;
+use Lunar\FieldTypes\TranslatedText;
+use Lunar\Models\Product;
+use Modules\Core\Localization\Services\LanguageCache;
+
+/**
+ * Shared between Modules\Core\Catalog\Services\ProductService and
+ * ProductSearchService — both read the same kind of Meilisearch document
+ * (Modules\Core\Catalog\Services\ProductIndexer's shape) and need the
+ * exact same per-locale field resolution and raw-response unwrapping.
+ * Extracted rather than duplicated so a future fix to the localization-
+ * fallback logic only needs to be made once.
+ */
+class ProductDocumentLocalizer
+{
+    public function __construct(
+        private readonly LanguageCache $languages,
+        private readonly AttributeManifest $attributes,
+    ) {}
+
+    /**
+     * Resolves every translated Product attribute's current-locale value from the
+     * indexer's per-locale `{handle}_{locale}` fields (e.g. `name_el`, `name_en`,
+     * `seo_title_el`, ...) into a plain `{handle}` key, falling back to the store's
+     * default language (LanguageCache::defaultLocale()) when the current locale
+     * has no translation - e.g. a product with no English copy yet still shows its
+     * Greek name on /en/ rather than rendering blank.
+     *
+     * Which handles are translated is read from AttributeManifest - the same
+     * source Lunar's own ScoutIndexer reads when exploding a TranslatedText
+     * attribute into `{handle}_{locale}` keys at index time - rather than a fixed
+     * list, so a store's own custom translated attributes (e.g. `seo_title`) are
+     * picked up automatically with no change here. The raw per-locale keys are
+     * then stripped, since once resolved, callers only ever need the one that
+     * matched the current locale.
+     *
+     * Deliberately not config('app.locale') - App::setLocale() overwrites that
+     * config value on every request, so by request time it's just whatever the
+     * current locale already is, not a stable fallback.
+     */
+    public function withLocalizedFields(array $product): array
+    {
+        $locale = App::getLocale();
+        $fallbackLocale = $this->languages->defaultLocale();
+        $availableLocales = $this->languages->availableLocales();
+
+        foreach ($this->translatedAttributeHandles() as $handle) {
+            $product[$handle] = $product[$handle.'_'.$locale] ?? $product[$handle.'_'.$fallbackLocale] ?? null;
+
+            foreach ($availableLocales as $availableLocale) {
+                unset($product[$handle.'_'.$availableLocale]);
+            }
+        }
+
+        return $product;
+    }
+
+    /**
+     * For the Meilisearch driver, Scout's paginateRaw() puts the whole raw response
+     * (hits, query, processingTimeMs, ...) in items(), not a plain list of hits - the
+     * actual documents are under the 'hits' key.
+     */
+    public function hitsFrom(LengthAwarePaginatorContract $paginator): array
+    {
+        $rawResponse = $paginator->items();
+
+        return collect($rawResponse['hits'] ?? [])->values()->all();
+    }
+
+    /**
+     * @return array<int, string>
+     */
+    private function translatedAttributeHandles(): array
+    {
+        return $this->attributes->getSearchableAttributes((new Product)->getMorphClass())
+            ->filter(fn ($attribute) => $attribute->type === TranslatedText::class)
+            ->pluck('handle')
+            ->all();
+    }
+}
\ No newline at end of file
diff --git a/src/Catalog/Support/ProductFilterBuilder.php b/src/Catalog/Support/ProductFilterBuilder.php
new file mode 100644
index 0000000..dddf401
--- /dev/null
+++ b/src/Catalog/Support/ProductFilterBuilder.php
@@ -0,0 +1,41 @@
+<?php
+
+namespace Modules\Core\Catalog\Support;
+
+use Illuminate\Support\Collection;
+use Modules\Core\Catalog\DTOs\ProductFilters;
+
+/**
+ * Builds a Meilisearch `filter` clause from a ProductFilters DTO — extracted
+ * out of ProductService (where it originated, scoped to browsing/filtering
+ * without a search term) so ProductSearchService can apply the exact same
+ * filter semantics to a text query too, rather than reimplementing it.
+ */
+class ProductFilterBuilder
+{
+    /**
+     * @param  array<int, 'collectionId'|'brand'|'tag'|'price'|'inStockOnly'>  $exclude
+     *   filter fields to leave out even if set on $filters — e.g.
+     *   ProductService::priceRange() excludes 'price' so a price slider's own
+     *   bounds don't shrink to whatever range is already selected on it.
+     */
+    public function build(?ProductFilters $filters, array $exclude = []): ?string
+    {
+        if ($filters === null) {
+            return null;
+        }
+
+        $clauses = Collection::make([
+            'collectionId' => $filters->collectionId !== null ? "collection_ids = \"{$filters->collectionId}\"" : null,
+            'brand' => $filters->brand !== null ? 'brand = "'.addcslashes($filters->brand, '"\\').'"' : null,
+            'tag' => $filters->tag !== null ? 'tags = "'.addcslashes($filters->tag, '"\\').'"' : null,
+            'price' => Collection::make([
+                $filters->minPrice !== null ? "price >= {$filters->minPrice}" : null,
+                $filters->maxPrice !== null ? "price <= {$filters->maxPrice}" : null,
+            ])->filter()->join(' AND ') ?: null,
+            'inStockOnly' => $filters->inStockOnly ? 'in_stock = true' : null,
+        ])->except($exclude)->filter();
+
+        return $clauses->isEmpty() ? null : $clauses->join(' AND ');
+    }
+}
diff --git a/src/Checkout/Events/BillingAddressSet.php b/src/Checkout/Events/BillingAddressSet.php
new file mode 100644
index 0000000..9dd48b4
--- /dev/null
+++ b/src/Checkout/Events/BillingAddressSet.php
@@ -0,0 +1,20 @@
+<?php
+
+namespace Modules\Core\Checkout\Events;
+
+use Lunar\Base\Addressable;
+use Lunar\Models\Cart;
+
+/**
+ * Dispatched by CheckoutService::setBillingAddress() — see
+ * ShippingAddressSet's docblock for the full reasoning (Lunar dispatches no
+ * checkout-lifecycle events; this feeds funnel-stage tracking, not built
+ * yet).
+ */
+class BillingAddressSet
+{
+    public function __construct(
+        public readonly Cart $cart,
+        public readonly array|Addressable $address,
+    ) {}
+}
diff --git a/src/Checkout/Events/OrderPlaced.php b/src/Checkout/Events/OrderPlaced.php
new file mode 100644
index 0000000..262e22d
--- /dev/null
+++ b/src/Checkout/Events/OrderPlaced.php
@@ -0,0 +1,25 @@
+<?php
+
+namespace Modules\Core\Checkout\Events;
+
+use Lunar\Models\Order;
+
+/**
+ * Dispatched once an Order's placed_at is set — the handoff point between
+ * Checkout/Payment and Order (see docs/checkout.md's "Three-stage
+ * lifecycle"). Fired by Modules\Core\Order\Listeners\
+ * ApplyResolvedPaymentStatus once it resolves a PaymentCaptured/
+ * PaymentAuthorized event into an actual order status change, not by
+ * CheckoutService directly — a draft Order can exist (via
+ * CheckoutService::initiatePayment()) well before this fires, if payment
+ * resolves asynchronously (e.g. a redirect-based gateway). Checkout has no
+ * opinion about what happens after this fires; Order's own listeners are
+ * what react to it — e.g. a confirmation email, initializing order status
+ * tracking.
+ */
+class OrderPlaced
+{
+    public function __construct(
+        public readonly Order $order,
+    ) {}
+}
diff --git a/src/Checkout/Events/PaymentMethodSelected.php b/src/Checkout/Events/PaymentMethodSelected.php
new file mode 100644
index 0000000..4e29544
--- /dev/null
+++ b/src/Checkout/Events/PaymentMethodSelected.php
@@ -0,0 +1,20 @@
+<?php
+
+namespace Modules\Core\Checkout\Events;
+
+use Lunar\Models\Cart;
+
+/**
+ * Dispatched by CheckoutService::selectPaymentMethod() — carries the plain
+ * type key (e.g. 'cash-on-delivery', 'stripe'), same convention as
+ * CartService's events (a plain reference the listener resolves further
+ * itself, rather than an already-resolved object) since a payment type key
+ * has nothing further to eagerly resolve the way a ShippingOption does.
+ */
+class PaymentMethodSelected
+{
+    public function __construct(
+        public readonly Cart $cart,
+        public readonly string $type,
+    ) {}
+}
diff --git a/src/Checkout/Events/RecoveryConsentSet.php b/src/Checkout/Events/RecoveryConsentSet.php
new file mode 100644
index 0000000..127734d
--- /dev/null
+++ b/src/Checkout/Events/RecoveryConsentSet.php
@@ -0,0 +1,20 @@
+<?php
+
+namespace Modules\Core\Checkout\Events;
+
+use Lunar\Models\Cart;
+
+/**
+ * Dispatched by CheckoutService::setRecoveryConsent() every time the
+ * shopper's promotional/abandoned-cart-recovery opt-in changes — including
+ * an explicit opt-OUT (a later submit with the checkbox unticked), not
+ * just an opt-in. $consent is the new value, already written to
+ * Cart::meta by the time this fires.
+ */
+class RecoveryConsentSet
+{
+    public function __construct(
+        public readonly Cart $cart,
+        public readonly bool $consent,
+    ) {}
+}
diff --git a/src/Checkout/Events/ShippingAddressSet.php b/src/Checkout/Events/ShippingAddressSet.php
new file mode 100644
index 0000000..d996c04
--- /dev/null
+++ b/src/Checkout/Events/ShippingAddressSet.php
@@ -0,0 +1,22 @@
+<?php
+
+namespace Modules\Core\Checkout\Events;
+
+use Lunar\Base\Addressable;
+use Lunar\Models\Cart;
+
+/**
+ * Dispatched by CheckoutService::setShippingAddress() — Lunar itself
+ * dispatches no checkout-lifecycle events at all (same gap CartService's
+ * events fill for cart mutations; see docs/cart.md). Feeds
+ * abandoned-checkout stage tracking / conversion-funnel analytics (neither
+ * built yet — see docs/checkout.md), which is why $address is carried
+ * directly rather than requiring a listener to re-read it off the cart.
+ */
+class ShippingAddressSet
+{
+    public function __construct(
+        public readonly Cart $cart,
+        public readonly array|Addressable $address,
+    ) {}
+}
diff --git a/src/Checkout/Events/ShippingOptionSelected.php b/src/Checkout/Events/ShippingOptionSelected.php
new file mode 100644
index 0000000..60a0a64
--- /dev/null
+++ b/src/Checkout/Events/ShippingOptionSelected.php
@@ -0,0 +1,24 @@
+<?php
+
+namespace Modules\Core\Checkout\Events;
+
+use Lunar\DataTypes\ShippingOption;
+use Lunar\Models\Cart;
+
+/**
+ * Dispatched by CheckoutService::selectShippingOption() — carries the fully
+ * resolved ShippingOption (name, price, carrier identifier), not just the
+ * string identifier the caller passed in. Deliberate divergence from
+ * CartService's events, which carry a plain Cart/CartLine model reference —
+ * a live-priced carrier quote (see docs/checkout.md's note on
+ * ShippingManifest::getOptions() already being backed by the merged
+ * Shipping-Carriers ACS/Box Now live-rate drivers) is meaningfully more
+ * expensive for a listener to re-derive later than a CartLine reference is.
+ */
+class ShippingOptionSelected
+{
+    public function __construct(
+        public readonly Cart $cart,
+        public readonly ShippingOption $option,
+    ) {}
+}
diff --git a/src/Checkout/Exceptions/InvalidShippingOptionException.php b/src/Checkout/Exceptions/InvalidShippingOptionException.php
new file mode 100644
index 0000000..3c0ab38
--- /dev/null
+++ b/src/Checkout/Exceptions/InvalidShippingOptionException.php
@@ -0,0 +1,21 @@
+<?php
+
+namespace Modules\Core\Checkout\Exceptions;
+
+use RuntimeException;
+
+/**
+ * Thrown by CheckoutService::selectShippingOption() when the given
+ * identifier doesn't resolve to a real, currently-available ShippingOption
+ * for the cart — Lunar's own ShippingManifest::getOption() just returns
+ * null, it has no matching exception type of its own to reuse here (same
+ * reasoning as Modules\Core\Cart\Exceptions\InvalidCouponException for
+ * Discounts::validateCoupon()).
+ */
+class InvalidShippingOptionException extends RuntimeException
+{
+    public function __construct(public readonly string $identifier)
+    {
+        parent::__construct("The shipping option \"{$identifier}\" is not available for this cart.");
+    }
+}
diff --git a/src/Checkout/Exceptions/TermsNotAcceptedException.php b/src/Checkout/Exceptions/TermsNotAcceptedException.php
new file mode 100644
index 0000000..2e70fc5
--- /dev/null
+++ b/src/Checkout/Exceptions/TermsNotAcceptedException.php
@@ -0,0 +1,19 @@
+<?php
+
+namespace Modules\Core\Checkout\Exceptions;
+
+use RuntimeException;
+
+/**
+ * Thrown by CheckoutService::initiatePayment() when $termsAccepted is
+ * false — an Order is a consumer contract, and its acceptance must be
+ * refused rather than created-then-flagged. No Lunar exception type
+ * covers this, same reasoning as UnknownPaymentTypeException.
+ */
+class TermsNotAcceptedException extends RuntimeException
+{
+    public function __construct()
+    {
+        parent::__construct('The order cannot be placed until the terms have been accepted.');
+    }
+}
diff --git a/src/Checkout/Exceptions/UnknownPaymentTypeException.php b/src/Checkout/Exceptions/UnknownPaymentTypeException.php
new file mode 100644
index 0000000..e734d9c
--- /dev/null
+++ b/src/Checkout/Exceptions/UnknownPaymentTypeException.php
@@ -0,0 +1,21 @@
+<?php
+
+namespace Modules\Core\Checkout\Exceptions;
+
+use RuntimeException;
+
+/**
+ * Thrown by CheckoutService::selectPaymentMethod()/confirmPayment() when
+ * $type doesn't resolve to a registered Modules\Core\Checkout\Contracts\
+ * PaymentDriver (config('payment.drivers')) — same reasoning as
+ * InvalidShippingOptionException: nothing here has a matching Lunar
+ * exception type to reuse, so this is the boboko-owned signal instead of a
+ * silent no-op or an opaque container-resolution error.
+ */
+class UnknownPaymentTypeException extends RuntimeException
+{
+    public function __construct(public readonly string $type)
+    {
+        parent::__construct("The payment type \"{$type}\" is not registered.");
+    }
+}
diff --git a/src/Checkout/Services/CheckoutService.php b/src/Checkout/Services/CheckoutService.php
new file mode 100644
index 0000000..aad91d5
--- /dev/null
+++ b/src/Checkout/Services/CheckoutService.php
@@ -0,0 +1,314 @@
+<?php
+
+namespace Modules\Core\Checkout\Services;
+
+use Lunar\Exceptions\FingerprintMismatchException;
+use Lunar\Exceptions\Carts\CartException;
+use Illuminate\Support\Collection;
+use Illuminate\Support\Facades\Event;
+use Lunar\Base\Addressable;
+use Lunar\DataTypes\ShippingOption;
+use Lunar\Facades\ShippingManifest;
+use Lunar\Models\Cart;
+use Modules\Core\Cart\Services\CartService;
+use Modules\Core\Checkout\Events\BillingAddressSet;
+use Modules\Core\Checkout\Events\PaymentMethodSelected;
+use Modules\Core\Checkout\Events\RecoveryConsentSet;
+use Modules\Core\Checkout\Events\ShippingAddressSet;
+use Modules\Core\Checkout\Events\ShippingOptionSelected;
+use Modules\Core\Checkout\Exceptions\InvalidShippingOptionException;
+use Modules\Core\Checkout\Exceptions\TermsNotAcceptedException;
+use Modules\Core\Checkout\Exceptions\UnknownPaymentTypeException;
+use Modules\Core\Payment\DTOs\PaymentResult;
+use Modules\Core\Payment\Models\PaymentMethod;
+use Modules\Core\Payment\Services\PaymentDriverRegistry;
+use Modules\Core\Payment\Services\PaymentMethodCache;
+
+/**
+ * Storefront-facing checkout operations, mirroring
+ * Modules\Core\Cart\Services\CartService's shape — one boboko-owned API a
+ * storefront calls, keeping Lunar's own Cart/ShippingManifest primitives an
+ * implementation detail. See docs/checkout.md for the full design —
+ * Checkout is the middle of a three-stage lifecycle (Cart → Checkout →
+ * Order): it owns the placement moment itself (address, shipping selection,
+ * ensuring a draft Order exists) and hands off to Payment the instant that
+ * draft exists — see initiatePayment(). What happens to that Order
+ * afterward (status transitions, fulfillment) is deliberately out of
+ * scope here — see docs/payments.md and Checkout\Events\OrderPlaced's
+ * docblock for where that now lives.
+ *
+ * Depends on CartService for cart access rather than reaching into
+ * Lunar\Facades\CartSession directly a second time, so Checkout stays
+ * layered on top of Cart's own service boundary instead of duplicating it.
+ */
+class CheckoutService
+{
+    public function __construct(
+        private readonly CartService $cart,
+        private readonly PaymentDriverRegistry $paymentDrivers,
+        private readonly PaymentMethodCache $paymentMethods,
+    ) {}
+
+    public function setShippingAddress(array|Addressable $address): Cart
+    {
+        $cart = $this->cart->currentOrCreate()->setShippingAddress($address);
+
+        Event::dispatch(new ShippingAddressSet($cart, $address));
+
+        return $cart;
+    }
+
+    public function setBillingAddress(array|Addressable $address): Cart
+    {
+        $cart = $this->cart->currentOrCreate()->setBillingAddress($address);
+
+        Event::dispatch(new BillingAddressSet($cart, $address));
+
+        return $cart;
+    }
+
+    /**
+     * The shopper's promotional/abandoned-cart-recovery opt-in — a
+     * cart-level decision, deliberately independent of setShippingAddress()/
+     * setBillingAddress(): consent is given once, and must NOT be reset or
+     * re-asked just because the shopper later changes which address is on
+     * the cart (a different Addressable being set is not a withdrawal of
+     * consent). Only an explicit call to THIS method — the checkbox itself
+     * being submitted, checked or unchecked — ever changes it; calling it
+     * again with false is exactly how a later opt-out is recorded.
+     *
+     * Stored on Cart::meta (interim, per the legal design this implements —
+     * a real column/consent record is the eventual target) as
+     * recovery_consent (bool), recovery_consent_at (ISO 8601 timestamp,
+     * null when $consent is false), and recovery_consent_policy_version
+     * (config('legal.privacy_policy_version') at the moment of consent —
+     * so a later dispute is answered from what was actually agreed to,
+     * not whatever the policy says today). Separate from any future
+     * newsletter opt-in — recovery consent is its own scope, never merged
+     * with marketing-newsletter consent.
+     *
+     * Deliberately does not merge with the meta-writing pattern
+     * selectPaymentMethod() uses (read-merge-save in two separate
+     * statements) — this writes both meta keys in one save, since there's
+     * no dependency between recovery_consent and anything else needing to
+     * be persisted first.
+     */
+    public function setRecoveryConsent(bool $consent): Cart
+    {
+        $cart = $this->cart->currentOrCreate();
+
+        $cart->meta = [
+            ...($cart->meta?->toArray() ?? []),
+            'recovery_consent' => $consent,
+            'recovery_consent_at' => $consent ? now()->toIso8601String() : null,
+            'recovery_consent_policy_version' => $consent ? config('legal.privacy_policy_version') : null,
+        ];
+        $cart->save();
+
+        Event::dispatch(new RecoveryConsentSet($cart, $consent));
+
+        return $cart;
+    }
+
+    /**
+     * Every shipping option currently available for the cart — already
+     * fully backed by the merged Shipping-Carriers work: this runs every
+     * registered Lunar\Shipping\Interfaces\ShippingRateInterface driver
+     * (ACS/Box Now live-rate quoting alongside table-rate-shipping's own
+     * flat-rate/free-shipping/collection drivers) through
+     * ShippingManifest's pipeline. No rate-resolution logic lives here —
+     * this is a thin pass-through.
+     *
+     * @return Collection<int, ShippingOption>
+     */
+    public function getShippingOptions(): Collection
+    {
+        return ShippingManifest::getOptions($this->cart->currentOrCreate());
+    }
+
+    /**
+     * @throws InvalidShippingOptionException if $identifier doesn't resolve
+     *   to a real, currently-available option for the cart
+     */
+    public function selectShippingOption(string $identifier): Cart
+    {
+        $cartBefore = $this->cart->currentOrCreate();
+        $option = ShippingManifest::getOption($cartBefore, $identifier);
+
+        if ($option === null) {
+            throw new InvalidShippingOptionException($identifier);
+        }
+
+        $cart = $cartBefore->setShippingOption($option);
+
+        Event::dispatch(new ShippingOptionSelected($cart, $option));
+
+        return $cart;
+    }
+
+    /**
+     * Every payment method currently offered to the storefront, ordered by
+     * Modules\Core\Payment\Models\PaymentMethod::position — a row is
+     * offered only when ALL three checks pass, each meaning something
+     * different to an admin diagnosing why a method isn't showing up (see
+     * docs/payments.md):
+     *   1. `enabled` — an admin turned it on.
+     *   2. its `driver` still resolves via PaymentDriverRegistry — the
+     *      driver class hasn't been removed (see the `payment:sync-drivers`
+     *      command, which sets `driver_missing_at` when this fails; a row
+     *      with that set is excluded here regardless of `enabled`, so a
+     *      vanished driver can never silently look "available").
+     *   3. the resolved driver reports Configurable::isConfigured() — its
+     *      own runtime requirements (e.g. an API key) are met.
+     *
+     * @return Collection<int, PaymentMethod>
+     */
+    public function getPaymentMethods(): Collection
+    {
+        return $this->paymentMethods->all()
+            ->filter(fn (PaymentMethod $method) => $method->enabled && $method->driver_missing_at === null)
+            ->filter(fn (PaymentMethod $method) => $this->paymentDrivers->resolve($method->driver)?->isConfigured() ?? false)
+            ->values();
+    }
+
+    /**
+     * Records which payment type the shopper picked (Cart::meta
+     * ['payment_method']) — read by Modules\Core\Payment\Pipelines\
+     * Cart\ApplyPaymentMethodFee to add that method's own `data.fee` (if
+     * any) before recalculation.
+     *
+     * Also snapshots Cart::fingerprint() into meta, *after* saving the
+     * chosen type — the fingerprint has to reflect the final total
+     * including any payment-method-specific fee, which only exists once
+     * payment_method is set and the cart recalculates. Captured here,
+     * server-side, rather than asked of the storefront: this is the last
+     * moment before initiatePayment() that the shopper's reviewed total is
+     * known, and initiatePayment() reads it back internally instead of
+     * taking a fingerprint parameter — a storefront should never need to
+     * know Cart::fingerprint() exists.
+     *
+     * Does not itself call a payment driver — selecting a method and
+     * initiating payment against it are deliberately separate steps, same
+     * as selecting a shipping option happens before placing the order.
+     *
+     * @throws UnknownPaymentTypeException if $type isn't currently offered
+     *   — see getPaymentMethods() for what that means
+     */
+    public function selectPaymentMethod(string $type): Cart
+    {
+        if (! $this->getPaymentMethods()->contains('type', $type)) {
+            throw new UnknownPaymentTypeException($type);
+        }
+
+        $cart = $this->cart->currentOrCreate();
+        $cart->meta = [...($cart->meta?->toArray() ?? []), 'payment_method' => $type];
+        $cart->save();
+
+        // Cart::calculate() no-ops if this cart instance was already
+        // calculated earlier in the request (Cart::isCalculated()) — which
+        // it will have been if the shopper switches payment method after
+        // the checkout page's first render already calculated it. Without
+        // recalculate() forcing a fresh run, the just-saved payment_method
+        // (and any fee tied to it, see ApplyPaymentMethodFee) would never
+        // be reflected — the summary would keep showing whichever method
+        // was calculated first.
+        $cart = $cart->recalculate();
+        $cart->meta = [...($cart->meta?->toArray() ?? []), 'checkout_fingerprint' => $cart->fingerprint()];
+        $cart->save();
+
+        Event::dispatch(new PaymentMethodSelected($cart, $type));
+
+        return $cart;
+    }
+
+    /**
+     * The one storefront-facing "place this order and pay for it" call —
+     * the point where Checkout hands off to Payment. Ensures a draft
+     * Order exists (Cart::createOrder() — confirmed idempotent against a
+     * cart's own pre-existing, not-yet-placed-at draft; see
+     * vendor/lunarphp/core/src/Actions/Carts/CreateOrder.php), then
+     * resolves the payment method selected by selectPaymentMethod() and
+     * calls pay() or authorize() on its driver, per that method's own
+     * `capture_mode` column.
+     *
+     * Returns the driver's own PaymentResult UNCHANGED — this method does
+     * not wait for or resolve anything past what pay()/authorize() itself
+     * returns synchronously. A Pending result (an async gateway like
+     * Stripe requiring 3-D Secure/a redirect) is a normal, expected
+     * outcome, not an error — the caller (a storefront controller) is
+     * responsible for whatever the gateway needs next.
+     *
+     * The draft order's own $order->total (not the Cart's) is what gets
+     * passed as $amount — Order::$total is Lunar's own Price-cast
+     * attribute, already resolving the correct Currency via the order's
+     * own currency_code, and is the authoritative total once the draft
+     * row exists.
+     *
+     * $context passed to the driver is {cart_id, order_id} — the exact
+     * keys Modules\Core\Payment\Drivers\StripePaymentDriver::
+     * rememberIntent() already reads.
+     *
+     * Same fingerprint precondition the old placeOrder() had: mandatory,
+     * not optional, checked before the draft is created.
+     *
+     * $termsAccepted is likewise mandatory, not optional data a caller
+     * might omit — an Order is a consumer contract, and its acceptance
+     * must be refused (TermsNotAcceptedException, before createOrder() is
+     * ever called — the order is never created-then-flagged) rather than
+     * assumed. $policyVersion is recorded alongside it on the created
+     * Order's own meta (terms_accepted, terms_accepted_at,
+     * terms_accepted_policy_version) — the order-level equivalent of
+     * setRecoveryConsent()'s cart-level record, and the durable audit
+     * trail for a later "what did the shopper actually agree to"
+     * dispute. Written directly here (not via a separate event/listener)
+     * since the Order row this attaches to doesn't exist before
+     * createOrder() runs, and nothing else needs to react to this
+     * specific write independently of the order simply existing.
+     *
+     * @param  array<string, mixed>  $data  passed through untouched to
+     *   the driver's pay()/authorize() — e.g. Stripe's payment_method
+     *   token.
+     *
+     * @throws UnknownPaymentTypeException if the cart's selected
+     *   payment_method (from selectPaymentMethod()) is no longer offered
+     *   — re-checked here, not just at selection time, since a method
+     *   could be disabled (or its driver removed) in between
+     * @throws TermsNotAcceptedException if $termsAccepted is false
+     * @throws FingerprintMismatchException
+     * @throws CartException
+     */
+    public function initiatePayment(string $fingerprint, bool $termsAccepted, string $policyVersion, array $data = []): PaymentResult
+    {
+        if (! $termsAccepted) {
+            throw new TermsNotAcceptedException;
+        }
+
+        $cart = $this->cart->currentOrCreate();
+        $cart->checkFingerprint($fingerprint);
+
+        $type = $cart->meta['payment_method'] ?? null;
+        $method = $type !== null ? $this->getPaymentMethods()->firstWhere('type', $type) : null;
+
+        if ($method === null) {
+            throw new UnknownPaymentTypeException((string) $type);
+        }
+
+        $order = $cart->createOrder();
+
+        $order->meta = [
+            ...($order->meta?->toArray() ?? []),
+            'payment_method' => $type,
+            'terms_accepted' => true,
+            'terms_accepted_at' => now()->toIso8601String(),
+            'terms_accepted_policy_version' => $policyVersion,
+        ];
+        $order->save();
+
+        $driver = $this->paymentDrivers->resolve($method->driver);
+        $context = ['cart_id' => $cart->id, 'order_id' => $order->id];
+
+        return $method->capture_mode === 'authorize'
+            ? $driver->authorize($type, $order->total, $data, $context)
+            : $driver->pay($type, $order->total, $data, $context);
+    }
+}
diff --git a/src/Command/BackfillMissingSkusCommand.php b/src/Command/BackfillMissingSkusCommand.php
new file mode 100644
index 0000000..6bbbbed
--- /dev/null
+++ b/src/Command/BackfillMissingSkusCommand.php
@@ -0,0 +1,60 @@
+<?php
+
+namespace Modules\Core\Command;
+
+use Illuminate\Console\Command;
+use Lunar\Models\ProductVariant;
+
+/**
+ * One-off backfill for variants the Shopify import left with a blank SKU —
+ * not an importer bug, the source CSV rows genuinely had no `Variant SKU`
+ * value (see Modules\MigrateImport\Shopify\ShopifyExportImporter) — so
+ * this synthesizes one instead of re-running the import. Format is
+ * "SKU-P{product_id}-V{variant_id}": deterministic and guaranteed unique
+ * without a uniqueness check, since product_id/variant_id already are.
+ * Only variants with a null `sku` are touched.
+ */
+class BackfillMissingSkusCommand extends Command
+{
+    protected $signature = 'boboko:catalog:backfill-skus {--dry-run : List what would change without writing}';
+
+    protected $description = 'Generate a SKU for every product variant that is missing one';
+
+    public function handle(): void
+    {
+        $dryRun = (bool) $this->option('dry-run');
+
+        $query = ProductVariant::query()->whereNull('sku');
+        $total = $query->count();
+
+        if ($total === 0) {
+            $this->info('No variants are missing a SKU.');
+
+            return;
+        }
+
+        $this->info(($dryRun ? '[dry-run] ' : '') . "Backfilling SKUs for {$total} variant(s)...");
+
+        $bar = $this->output->createProgressBar($total);
+        $bar->start();
+
+        $query->chunkById(500, function ($variants) use ($dryRun, $bar) {
+            foreach ($variants as $variant) {
+                $sku = "SKU-P{$variant->product_id}-V{$variant->id}";
+
+                if ($dryRun) {
+                    $this->newLine();
+                    $this->line("Variant {$variant->id}: sku => {$sku}");
+                } else {
+                    $variant->update(['sku' => $sku]);
+                }
+
+                $bar->advance();
+            }
+        });
+
+        $bar->finish();
+        $this->newLine();
+        $this->info($dryRun ? 'Dry run complete — no changes were written.' : 'Done.');
+    }
+}
diff --git a/src/Command/CreateAdminCommand.php b/src/Command/CreateAdminCommand.php
index a728930..a281c42 100644
--- a/src/Command/CreateAdminCommand.php
+++ b/src/Command/CreateAdminCommand.php
@@ -2,6 +2,7 @@
 
 namespace Modules\Core\Command;
 
+use Lunar\Admin\Models\Staff;
 use Lunar\Admin\Console\Commands\MakeLunarAdminCommand;
 
 use function Laravel\Prompts\text;
@@ -31,7 +32,7 @@ class CreateAdminCommand extends MakeLunarAdminCommand
                 required: true,
                 validate: fn (string $email): ?string => match (true) {
                     ! filter_var($email, FILTER_VALIDATE_EMAIL) => 'The email address must be valid.',
-                    \Lunar\Admin\Models\Staff::where('email', $email)->exists() => 'A user with this email address already exists',
+                    Staff::where('email', $email)->exists() => 'A user with this email address already exists',
                     default => null,
                 },
             ),
diff --git a/src/Command/ExportCommand.php b/src/Command/ExportCommand.php
index 5a01855..4d6725a 100644
--- a/src/Command/ExportCommand.php
+++ b/src/Command/ExportCommand.php
@@ -2,6 +2,9 @@
 
 namespace Modules\Core\Command;
 
+use RecursiveIteratorIterator;
+use RecursiveDirectoryIterator;
+use FilesystemIterator;
 use Illuminate\Console\Command;
 use Illuminate\Support\Facades\Storage;
 use Modules\Core\ResultType\Error;
@@ -88,10 +91,10 @@ class ExportCommand extends Command
         $zip->addFile($sqlFile, basename($sqlFile));
 
         if (is_dir($filesDir)) {
-            $iterator = new \RecursiveIteratorIterator(
-                new \RecursiveDirectoryIterator(
+            $iterator = new RecursiveIteratorIterator(
+                new RecursiveDirectoryIterator(
                     $filesDir,
-                    \FilesystemIterator::SKIP_DOTS,
+                    FilesystemIterator::SKIP_DOTS,
                 ),
             );
             foreach ($iterator as $file) {
diff --git a/src/Command/InstallLunarCommand.php b/src/Command/InstallLunarCommand.php
index e07d3a3..c20f636 100644
--- a/src/Command/InstallLunarCommand.php
+++ b/src/Command/InstallLunarCommand.php
@@ -18,7 +18,10 @@ use Lunar\Models\Product;
 use Lunar\Models\ProductType;
 use Lunar\Models\TaxClass;
 use Lunar\Models\TaxZone;
-use Spatie\TranslationLoader\LanguageLine;
+use Modules\Core\Localization\Models\LanguageLine;
+use Modules\Core\Localization\Services\StorefrontLabels;
+use Modules\Core\Localization\Services\TranslationService;
+use Modules\Core\Payment\Models\PaymentMethod;
 
 /**
  * Overrides Lunar's own lunar:install to skip the interactive prompts (migrate
@@ -32,7 +35,7 @@ class InstallLunarCommand extends Command
 
     protected $description = 'Seed the default Lunar store data (countries, channel, currency, tax zone, attributes, product type)';
 
-    public function handle(): void
+    public function handle(TranslationService $translations): void
     {
         $this->components->info('Seeding default Lunar store data...');
 
@@ -63,6 +66,16 @@ class InstallLunarCommand extends Command
                 ]);
             }
 
+            if (! Language::where('code', 'el')->exists()) {
+                $this->components->info('Adding Greek language');
+
+                Language::create([
+                    'code' => 'el',
+                    'name' => 'Greek',
+                    'default' => false,
+                ]);
+            }
+
             if (! Currency::whereDefault(true)->exists()) {
                 $this->components->info('Adding a default currency (USD)');
 
@@ -242,10 +255,11 @@ class InstallLunarCommand extends Command
             }
         });
 
-        if (! LanguageLine::where('group', 'storefront')->exists()) {
-            $this->components->info('Seeding storefront label translations');
-            $this->seedStorefrontLabels();
-        }
+        $this->components->info('Seeding storefront label translations');
+        $this->seedStorefrontLabels($translations);
+
+        $this->components->info('Seeding payment method settings');
+        $this->seedPaymentMethods();
 
         $this->components->info('Publishing Filament assets');
         $this->call('filament:assets');
@@ -253,32 +267,68 @@ class InstallLunarCommand extends Command
         $this->components->info('Lunar default data seeded.');
     }
 
-    private function seedStorefrontLabels(): void
+    /**
+     * Per-key upsert, not an all-or-nothing "only seed if the group is empty" guard —
+     * a key already present in the database (including one an admin has since edited
+     * via the Filament Languages resource) is left untouched; only keys missing
+     * entirely are created. This is what makes it safe to add new keys to
+     * StorefrontLabels later and re-run this on an already-installed store without
+     * either skipping the new keys (the old all-or-nothing guard) or reverting an
+     * admin's edits back to the hardcoded default (a naive updateOrCreate would).
+     */
+    private function seedStorefrontLabels(TranslationService $translations): void
     {
-        $labels = [
-            'nav.home' => ['en' => 'Home', 'el' => 'Αρχική'],
-            'nav.products' => ['en' => 'Products', 'el' => 'Προϊόντα'],
-            'nav.cart' => ['en' => 'Cart', 'el' => 'Καλάθι'],
-            'nav.account' => ['en' => 'Account', 'el' => 'Λογαριασμός'],
-            'nav.back' => ['en' => 'Back', 'el' => 'Πίσω'],
-            'cart.empty' => ['en' => 'Your cart is empty', 'el' => 'Το καλάθι σας είναι άδειο'],
-            'cart.checkout' => ['en' => 'Checkout', 'el' => 'Ολοκλήρωση Παραγγελίας'],
-            'cart.total' => ['en' => 'Total', 'el' => 'Σύνολο'],
-            'cart.remove' => ['en' => 'Remove', 'el' => 'Αφαίρεση'],
-            'product.add_to_cart' => ['en' => 'Add to Cart', 'el' => 'Προσθήκη στο Καλάθι'],
-            'product.out_of_stock' => ['en' => 'Out of Stock', 'el' => 'Εξαντλήθηκε'],
-            'product.price' => ['en' => 'Price', 'el' => 'Τιμή'],
-            'auth.login' => ['en' => 'Log In', 'el' => 'Σύνδεση'],
-            'auth.logout' => ['en' => 'Log Out', 'el' => 'Αποσύνδεση'],
-            'search.placeholder' => ['en' => 'Search products…', 'el' => 'Αναζήτηση προϊόντων…'],
-        ];
+        $labels = StorefrontLabels::all();
+
+        $existingKeys = LanguageLine::where('group', 'storefront')
+            ->whereIn('key', array_keys($labels))
+            ->pluck('key');
 
         foreach ($labels as $key => $text) {
-            LanguageLine::create([
-                'group' => 'storefront',
-                'key' => $key,
-                'text' => $text,
-            ]);
+            if ($existingKeys->contains($key)) {
+                continue;
+            }
+
+            $translations->create('storefront', $key, $text);
         }
     }
+
+    /**
+     * A single, deliberately opinionated starter row on fresh install —
+     * `PaymentMethod` is now fully admin-creatable/deletable (see
+     * docs/payments.md), so this is no longer "seed every config-defined
+     * type," it's "give a fresh store one reasonable payment method to
+     * start from instead of zero." Every value here is a plain literal in
+     * THIS command, not sourced from config or PaymentDriverRegistry — a
+     * driver has no business carrying opinions about what its captured
+     * order status should be called; that's a merchant decision.
+     *
+     * Skip-if-exists on `type`, same idempotent convention as
+     * seedStorefrontLabels() — an admin who has since edited or deleted
+     * this row (via the Filament Payment Methods resource) is left alone;
+     * re-running lunar:install never recreates a deleted starter row.
+     *
+     * Seeded disabled — shouldn't go live for shoppers before staff have
+     * actually reviewed it and turned it on via the Payment Methods
+     * resource. See CheckoutService::getPaymentMethods().
+     */
+    private function seedPaymentMethods(): void
+    {
+        if (PaymentMethod::where('type', 'cash-on-delivery')->exists()) {
+            return;
+        }
+
+        PaymentMethod::create([
+            'type' => 'cash-on-delivery',
+            'name' => [
+                'en' => 'Cash on Delivery',
+                'el' => 'Αντικαταβολή',
+            ],
+            'driver' => 'cash-on-delivery',
+            'capture_mode' => 'pay',
+            'position' => 0,
+            'enabled' => false,
+            'data' => [],
+        ]);
+    }
 }
diff --git a/src/Command/SyncPaymentDriversCommand.php b/src/Command/SyncPaymentDriversCommand.php
new file mode 100644
index 0000000..c8bd59e
--- /dev/null
+++ b/src/Command/SyncPaymentDriversCommand.php
@@ -0,0 +1,52 @@
+<?php
+
+namespace Modules\Core\Command;
+
+use Illuminate\Console\Command;
+use Modules\Core\Payment\Models\PaymentMethod;
+use Modules\Core\Payment\Services\PaymentDriverRegistry;
+
+/**
+ * Reconciles every Modules\Core\Payment\Models\PaymentMethod row's `driver`
+ * column against PaymentDriverRegistry — the registry only knows "which
+ * driver classes exist THIS deploy," and only at the moment something
+ * calls resolve(); nothing else notices a driver disappearing (a package
+ * removed, a custom Registry::register() call deleted) on its own. Meant
+ * to run unconditionally on every container start/deploy (alongside
+ * `migrate`), not on a schedule — "did the set of registered drivers
+ * change" is a deploy-time event, cheap enough to check every single time
+ * regardless of whether anything actually changed. See docs/payments.md.
+ *
+ * Sets/clears `driver_missing_at` — deliberately NOT the `enabled` column,
+ * so an admin's own manual toggle is never confused with "the driver
+ * vanished," and a driver that comes back in a later deploy auto-clears
+ * this with no admin action needed.
+ */
+class SyncPaymentDriversCommand extends Command
+{
+    protected $signature = 'boboko:payment:sync-drivers';
+
+    protected $description = 'Flag PaymentMethod rows whose driver no longer resolves via the registry, and clear the flag for ones that do again';
+
+    public function handle(PaymentDriverRegistry $registry): int
+    {
+        $missing = 0;
+        $restored = 0;
+
+        PaymentMethod::query()->each(function (PaymentMethod $method) use ($registry, &$missing, &$restored) {
+            $resolves = $method->driver !== null && $registry->resolve($method->driver) !== null;
+
+            if (! $resolves && $method->driver_missing_at === null) {
+                $method->update(['driver_missing_at' => now()]);
+                $missing++;
+            } elseif ($resolves && $method->driver_missing_at !== null) {
+                $method->update(['driver_missing_at' => null]);
+                $restored++;
+            }
+        });
+
+        $this->components->info("Payment driver sync complete: {$missing} newly flagged, {$restored} restored.");
+
+        return self::SUCCESS;
+    }
+}
diff --git a/src/Command/TuneProductSearchCommand.php b/src/Command/TuneProductSearchCommand.php
new file mode 100644
index 0000000..e0687e1
--- /dev/null
+++ b/src/Command/TuneProductSearchCommand.php
@@ -0,0 +1,67 @@
+<?php
+
+namespace Modules\Core\Command;
+
+use Illuminate\Console\Command;
+use Laravel\Scout\EngineManager;
+use Laravel\Scout\Engines\MeilisearchEngine;
+use Lunar\Models\Product;
+
+/**
+ * lunarphp/meilisearch's own `lunar:meilisearch:setup` only pushes
+ * filterableAttributes/sortableAttributes (see MeilisearchSetup::handle())
+ * — it has no notion of typo tolerance or prefix search, and Meilisearch's
+ * defaults for both are loose enough to produce bad matches on short Greek
+ * words. Confirmed via showMatchesPosition that a query for "Κάπτεν" was
+ * matching "κανένας" purely through prefixSearch's default 'indexingTime'
+ * behavior (their edit distance is far past anything typo tolerance would
+ * bridge) — fixed by disabling prefix search below, verified afterward with
+ * "Super"/"Superheroes"-style prefix probes returning no results for a
+ * partial word. minWordSizeForTypos is tightened defensively alongside it
+ * so short words in general get less typo-tolerant fuzzing, even though a
+ * separate short-word collision case ("Κάπτεν" vs "κάποτε", high letter
+ * overlap despite real edit distance) persisted after both settings were
+ * confirmed live and wasn't fully root-caused — treated as a known,
+ * narrow edge case rather than a blocker. Run this after
+ * `lunar:meilisearch:setup`, whenever Product's index needs
+ * (re)provisioning.
+ *
+ * Disabling prefix search here is a deliberate tradeoff: it also turns off
+ * legitimate partial-word matching (typing "car" matching "cart" before
+ * you finish the word) — useful for a future autocomplete/search-as-you-
+ * type UI. If that's built later, re-enable prefixSearch deliberately then,
+ * informed by real UX needs, rather than leaving it on by accident today.
+ */
+class TuneProductSearchCommand extends Command
+{
+    protected $signature = 'lunar:meilisearch:tune-product-search';
+
+    protected $description = 'Tighten typo-tolerance and disable prefix search on the product search index';
+
+    public function handle(EngineManager $engineManager): void
+    {
+        /** @var MeilisearchEngine $engine */
+        $engine = $engineManager->createMeilisearchDriver();
+
+        $index = $engine->getIndex((new Product)->searchableAs());
+
+        $this->components->info('Updating typo tolerance for product search...');
+
+        $task = $index->updateTypoTolerance([
+            'minWordSizeForTypos' => [
+                'oneTypo' => 8,
+                'twoTypos' => 12,
+            ],
+        ]);
+
+        $engine->waitForTask($task['taskUid']);
+
+        $this->components->info('Disabling prefix search for product search...');
+
+        $task = $index->updatePrefixSearch('disabled');
+
+        $engine->waitForTask($task['taskUid']);
+
+        $this->components->info('Product search index tuned.');
+    }
+}
diff --git a/src/CorePlugin.php b/src/CorePlugin.php
index 348553d..0187933 100644
--- a/src/CorePlugin.php
+++ b/src/CorePlugin.php
@@ -2,6 +2,8 @@
 
 namespace Modules\Core;
 
+use Lunar\Admin\Filament\Resources\OrderResource\Pages\ManageOrder;
+use Lunar\Admin\Filament\Resources\OrderResource\Pages\Components\OrderItemsTable;
 use Filament\Contracts\Plugin;
 use Filament\Panel;
 use Illuminate\Database\Eloquent\Relations\HasMany;
@@ -10,25 +12,44 @@ use Illuminate\Support\Facades\Mail;
 use Lunar\Admin\Filament\Resources\CustomerResource;
 use Lunar\Admin\Filament\Resources\CustomerResource\Pages\EditCustomer;
 use Lunar\Admin\Filament\Resources\CustomerResource\Pages\ViewCustomer;
+use Lunar\Admin\Filament\Resources\ProductOptionResource;
+use Lunar\Admin\Filament\Resources\ProductOptionResource\RelationManagers\ValuesRelationManager;
+use Lunar\Admin\Filament\Resources\OrderResource;
 use Lunar\Admin\Filament\Resources\ProductResource;
 use Lunar\Admin\Filament\Resources\StaffResource;
 use Lunar\Admin\Models\Staff as LunarStaff;
 use Lunar\Admin\Support\Facades\LunarPanel;
 use Lunar\Models\Customer;
 use Lunar\Models\Product;
+use Lunar\Shipping\Filament\Resources\ShippingMethodResource;
+use Lunar\Shipping\Filament\Resources\ShippingMethodResource\Pages\ListShippingMethod;
 use Lunar\Shipping\ShippingPlugin;
 use Modules\Core\Auth\Extensions\StaffResourceExtension;
 use Modules\Core\Auth\Filament\Pages\Login;
 use Modules\Core\Auth\Mail\InviteMail;
+use Modules\Core\Cart\Filament\Resources\CartResource;
+use Modules\Core\Catalog\Filament\Extensions\ProductOptionResourceExtension;
+use Modules\Core\Catalog\Filament\Extensions\ValuesRelationManagerExtension;
 use Modules\Core\Localization\Filament\Resources\LanguageLineResource;
+use Modules\Core\Order\Filament\Extensions\OrderItemsTableExtension;
+use Modules\Core\Order\Filament\Extensions\OrderPaymentMethodSummaryExtension;
+use Modules\Core\Order\Filament\Extensions\OrderActionsExtension;
+use Modules\Core\Order\Filament\Extensions\OrderTransactionsExtension;
+use Modules\Core\Payment\Filament\Resources\PaymentMethodResource;
 use Modules\Core\Privacy\Filament\Extensions\CustomerErasureActionsExtension;
 use Modules\Core\Privacy\Filament\Extensions\CustomerErasureRelationsExtension;
 use Modules\Core\Privacy\Filament\Resources\DataErasureRequestResource;
 use Modules\Core\Privacy\Filament\Resources\DataExportRequestResource;
 use Modules\Core\Privacy\Models\DataErasureRequest;
 use Modules\Core\Privacy\Models\DataExportRequest;
-use Modules\Core\Review\Extensions\ProductResourceExtension;
+use Modules\Core\Review\Filament\Extensions\ProductResourceExtension;
 use Modules\Core\Review\Models\ProductReview;
+use Modules\Core\Shipping\Extensions\OrderShipmentsExtension;
+use Modules\Core\Shipping\Extensions\OrderViewExtension;
+use Modules\Core\Shipping\Extensions\ShippingMethodListExtension;
+use Modules\Core\Shipping\Extensions\ShippingMethodResourceExtension;
+use Modules\Core\Shipping\Filament\Resources\ManifestResource;
+use Modules\Core\Shipping\Filament\Resources\ShipmentResource;
 
 class CorePlugin implements Plugin
 {
@@ -48,12 +69,22 @@ class CorePlugin implements Plugin
                 LanguageLineResource::class,
                 DataErasureRequestResource::class,
                 DataExportRequestResource::class,
+                CartResource::class,
+                PaymentMethodResource::class,
+                ShipmentResource::class,
+                ManifestResource::class,
             ])
             ->plugin(ShippingPlugin::make());
 
         LunarPanel::extensions([
             StaffResource::class => StaffResourceExtension::class,
             ProductResource::class => ProductResourceExtension::class,
+            ProductOptionResource::class => ProductOptionResourceExtension::class,
+            ValuesRelationManager::class => ValuesRelationManagerExtension::class,
+            ShippingMethodResource::class => ShippingMethodResourceExtension::class,
+            ListShippingMethod::class => ShippingMethodListExtension::class,
+            ManageOrder::class => [OrderViewExtension::class, OrderActionsExtension::class, OrderTransactionsExtension::class, OrderPaymentMethodSummaryExtension::class, OrderShipmentsExtension::class],
+            OrderItemsTable::class => OrderItemsTableExtension::class,
             // headerActions() is resolved per PAGE class, not per resource class —
             // unlike extendForm()/extendTable(), which really are resource-keyed
             // (called statically from the Resource class itself). Registering this
@@ -110,9 +141,8 @@ class CorePlugin implements Plugin
             'password',
             'remember_token',
             'email_verified_at',
-            'two_factor_secret',
-            'two_factor_recovery_codes',
-            'two_factor_confirmed_at',
+            'app_authentication_secret',
+            'app_authentication_recovery_codes',
         ]);
 
         LunarStaff::created(function (LunarStaff $staff) {
diff --git a/src/Customer/Events/CustomerAddressCreated.php b/src/Customer/Events/CustomerAddressCreated.php
new file mode 100644
index 0000000..2afacf3
--- /dev/null
+++ b/src/Customer/Events/CustomerAddressCreated.php
@@ -0,0 +1,22 @@
+<?php
+
+namespace Modules\Core\Customer\Events;
+
+use Illuminate\Contracts\Auth\Authenticatable;
+use Lunar\Models\Address;
+
+/**
+ * Dispatched by Modules\Core\Customer\Services\CustomerAccountService::
+ * createAddress(). $causer is carried explicitly (unlike e.g.
+ * Modules\Core\Payment\Events\PaymentMethodCreated, which is always
+ * staff-caused implicitly) because this write happens on the `web`
+ * guard, not `staff` — a listener logging this needs to know who to
+ * attribute it to without guessing a guard.
+ */
+class CustomerAddressCreated
+{
+    public function __construct(
+        public readonly Address $address,
+        public readonly Authenticatable $causer,
+    ) {}
+}
diff --git a/src/Customer/Events/CustomerAddressDeleted.php b/src/Customer/Events/CustomerAddressDeleted.php
new file mode 100644
index 0000000..e644686
--- /dev/null
+++ b/src/Customer/Events/CustomerAddressDeleted.php
@@ -0,0 +1,17 @@
+<?php
+
+namespace Modules\Core\Customer\Events;
+
+use Illuminate\Contracts\Auth\Authenticatable;
+
+class CustomerAddressDeleted
+{
+    /**
+     * @param  array<string, mixed>  $address  Snapshot of the deleted
+     *   row — already gone from the database by dispatch time.
+     */
+    public function __construct(
+        public readonly array $address,
+        public readonly Authenticatable $causer,
+    ) {}
+}
diff --git a/src/Customer/Events/CustomerAddressUpdated.php b/src/Customer/Events/CustomerAddressUpdated.php
new file mode 100644
index 0000000..bdb4701
--- /dev/null
+++ b/src/Customer/Events/CustomerAddressUpdated.php
@@ -0,0 +1,19 @@
+<?php
+
+namespace Modules\Core\Customer\Events;
+
+use Illuminate\Contracts\Auth\Authenticatable;
+use Lunar\Models\Address;
+
+class CustomerAddressUpdated
+{
+    /**
+     * @param  array<string, mixed>  $old  Snapshot of the changed
+     *   attributes before the update.
+     */
+    public function __construct(
+        public readonly Address $address,
+        public readonly array $old,
+        public readonly Authenticatable $causer,
+    ) {}
+}
diff --git a/src/Customer/Events/CustomerProfileUpdated.php b/src/Customer/Events/CustomerProfileUpdated.php
new file mode 100644
index 0000000..63f5bd7
--- /dev/null
+++ b/src/Customer/Events/CustomerProfileUpdated.php
@@ -0,0 +1,19 @@
+<?php
+
+namespace Modules\Core\Customer\Events;
+
+use Illuminate\Contracts\Auth\Authenticatable;
+use Modules\Core\Customer\Models\Customer;
+
+class CustomerProfileUpdated
+{
+    /**
+     * @param  array<string, mixed>  $old  Snapshot of the changed
+     *   attributes before the update.
+     */
+    public function __construct(
+        public readonly Customer $customer,
+        public readonly array $old,
+        public readonly Authenticatable $causer,
+    ) {}
+}
diff --git a/src/Customer/Exceptions/AddressNotFoundException.php b/src/Customer/Exceptions/AddressNotFoundException.php
new file mode 100644
index 0000000..c215141
--- /dev/null
+++ b/src/Customer/Exceptions/AddressNotFoundException.php
@@ -0,0 +1,20 @@
+<?php
+
+namespace Modules\Core\Customer\Exceptions;
+
+use RuntimeException;
+
+/**
+ * Thrown by Modules\Core\Customer\Services\CustomerAccountService when an
+ * address id doesn't belong to the customer making the request — never
+ * a plain 404/ModelNotFoundException, so a storefront can't probe for
+ * another customer's address ids by trying sequential ones and reading
+ * the response shape.
+ */
+class AddressNotFoundException extends RuntimeException
+{
+    public function __construct()
+    {
+        parent::__construct('Address not found.');
+    }
+}
diff --git a/src/Customer/Exceptions/OrderNotFoundException.php b/src/Customer/Exceptions/OrderNotFoundException.php
new file mode 100644
index 0000000..d637ac1
--- /dev/null
+++ b/src/Customer/Exceptions/OrderNotFoundException.php
@@ -0,0 +1,19 @@
+<?php
+
+namespace Modules\Core\Customer\Exceptions;
+
+use RuntimeException;
+
+/**
+ * Thrown by Modules\Core\Customer\Services\CustomerAccountService when an
+ * order id doesn't belong to the customer making the request (or isn't
+ * placed yet) — never a plain 404/ModelNotFoundException, so a
+ * storefront can't probe for another customer's order ids.
+ */
+class OrderNotFoundException extends RuntimeException
+{
+    public function __construct()
+    {
+        parent::__construct('Order not found.');
+    }
+}
diff --git a/src/Customer/Listeners/LogCustomerAccountActivity.php b/src/Customer/Listeners/LogCustomerAccountActivity.php
new file mode 100644
index 0000000..1a7e4d0
--- /dev/null
+++ b/src/Customer/Listeners/LogCustomerAccountActivity.php
@@ -0,0 +1,61 @@
+<?php
+
+namespace Modules\Core\Customer\Listeners;
+
+use Lunar\Models\Address;
+use Modules\Core\Customer\Events\CustomerAddressCreated;
+use Modules\Core\Customer\Events\CustomerAddressDeleted;
+use Modules\Core\Customer\Events\CustomerAddressUpdated;
+use Modules\Core\Customer\Events\CustomerProfileUpdated;
+use Modules\Core\Logging\ActivityLogService;
+
+/**
+ * Same pattern as Payment\Listeners\LogPaymentMethodActivity — routes
+ * Modules\Core\Customer\Services\CustomerAccountService's own events
+ * through the shared Logging\ActivityLogService, giving every
+ * shopper-initiated address/profile change an audit trail (previously
+ * none existed at all for account self-service writes). $causer is
+ * passed through explicitly on every call, since these events are
+ * `web`-guard-caused, not `staff`-guard — see ActivityLogService's own
+ * docblock for why that parameter exists.
+ */
+class LogCustomerAccountActivity
+{
+    public function __construct(
+        private readonly ActivityLogService $activityLog,
+    ) {}
+
+    public function handleAddressCreated(CustomerAddressCreated $event): void
+    {
+        $this->activityLog->created($event->address, $event->address->getAttributes(), $event->causer);
+    }
+
+    public function handleAddressUpdated(CustomerAddressUpdated $event): void
+    {
+        $this->activityLog->updated(
+            $event->address,
+            $event->old,
+            $event->address->only(array_keys($event->old)),
+            $event->causer,
+        );
+    }
+
+    public function handleAddressDeleted(CustomerAddressDeleted $event): void
+    {
+        $subject = (new Address)->forceFill($event->address);
+        $subject->exists = true;
+        $subject->id = $event->address['id'];
+
+        $this->activityLog->deleted($subject, $event->address, $event->causer);
+    }
+
+    public function handleProfileUpdated(CustomerProfileUpdated $event): void
+    {
+        $this->activityLog->updated(
+            $event->customer,
+            $event->old,
+            $event->customer->only(array_keys($event->old)),
+            $event->causer,
+        );
+    }
+}
diff --git a/src/Customer/RelationManagers/AddressRelationManager.php b/src/Customer/RelationManagers/AddressRelationManager.php
index b430797..2041db4 100644
--- a/src/Customer/RelationManagers/AddressRelationManager.php
+++ b/src/Customer/RelationManagers/AddressRelationManager.php
@@ -2,12 +2,12 @@
 
 namespace Modules\Core\Customer\RelationManagers;
 
-use Filament\Forms\Components\Group;
+use Filament\Actions\CreateAction;
+use Filament\Actions\EditAction;
+use Filament\Actions\DeleteAction;
+use Filament\Schemas\Components\Group;
 use Filament\Forms\Components\Select;
 use Filament\Forms\Components\TextInput;
-use Filament\Tables\Actions\CreateAction;
-use Filament\Tables\Actions\DeleteAction;
-use Filament\Tables\Actions\EditAction;
 use Filament\Tables\Columns\TextColumn;
 use Filament\Tables\Table;
 use Illuminate\Database\Eloquent\Model;
@@ -38,9 +38,9 @@ class AddressRelationManager extends BaseAddressRelationManager
                 ),
             ])
             ->headerActions([
-                CreateAction::make()->form($this->addressForm()),
+                CreateAction::make()->schema($this->addressForm()),
             ])
-            ->actions([
+            ->recordActions([
                 EditAction::make('editAddress')
                     ->fillForm(fn (AddressContract $record): array => [
                         'line_one' => $record->line_one,
@@ -51,7 +51,7 @@ class AddressRelationManager extends BaseAddressRelationManager
                         'contact_email' => $record->contact_email,
                         'contact_phone' => $record->contact_phone,
                     ])
-                    ->form($this->addressForm()),
+                    ->schema($this->addressForm()),
                 DeleteAction::make('deleteAddress'),
             ]);
     }
diff --git a/src/Customer/RelationManagers/UserRelationManager.php b/src/Customer/RelationManagers/UserRelationManager.php
index ff3f862..0bb7fef 100644
--- a/src/Customer/RelationManagers/UserRelationManager.php
+++ b/src/Customer/RelationManagers/UserRelationManager.php
@@ -2,6 +2,8 @@
 
 namespace Modules\Core\Customer\RelationManagers;
 
+use Filament\Tables\Columns\TextColumn;
+use Filament\Actions\EditAction;
 use Filament\Forms\Components\TextInput;
 use Filament\Tables;
 use Filament\Tables\Table;
@@ -14,16 +16,16 @@ class UserRelationManager extends BaseUserRelationManager
     public function getDefaultTable(Table $table): Table
     {
         return $table->columns([
-            Tables\Columns\TextColumn::make('name')
+            TextColumn::make('name')
                 ->label(__('lunarpanel::user.table.name.label')),
-            Tables\Columns\TextColumn::make('email')
+            TextColumn::make('email')
                 ->label(__('lunarpanel::user.table.email.label')),
-        ])->actions([
-            Tables\Actions\EditAction::make('edit')
+        ])->recordActions([
+            EditAction::make('edit')
                 ->after(
                     fn (Model $record) => CustomerUserEdited::dispatch($record)
                 )
-                ->form([
+                ->schema([
                     TextInput::make('email')
                         ->label(__('lunarpanel::user.form.email.label'))
                         ->required()
diff --git a/src/Customer/Services/CustomerAccountService.php b/src/Customer/Services/CustomerAccountService.php
new file mode 100644
index 0000000..45d663c
--- /dev/null
+++ b/src/Customer/Services/CustomerAccountService.php
@@ -0,0 +1,255 @@
+<?php
+
+namespace Modules\Core\Customer\Services;
+
+use Illuminate\Contracts\Auth\Authenticatable;
+use Illuminate\Pagination\LengthAwarePaginator;
+use Illuminate\Support\Arr;
+use Illuminate\Support\Facades\Event;
+use Lunar\Models\Address;
+use Lunar\Models\Order;
+use LogicException;
+use Modules\Core\Customer\Events\CustomerAddressCreated;
+use Modules\Core\Customer\Events\CustomerAddressDeleted;
+use Modules\Core\Customer\Events\CustomerAddressUpdated;
+use Modules\Core\Customer\Events\CustomerProfileUpdated;
+use Modules\Core\Customer\Exceptions\AddressNotFoundException;
+use Modules\Core\Customer\Exceptions\OrderNotFoundException;
+use Modules\Core\Customer\Models\Customer;
+
+/**
+ * The storefront-facing "My Account" API — mirrors Modules\Core\Cart\
+ * Services\CartService's shape, one boboko-owned service a storefront
+ * calls, so Lunar's own Customer/Order/Address models stay an
+ * implementation detail. Every method is scoped to the given
+ * Authenticatable's own Customer::latestCustomer() (see docs/modules.md
+ * "Customer/User Pairing") — there is no method here that accepts a bare
+ * order/address id without also requiring the owning user, precisely so
+ * a controller built on top of this can't accidentally leak one
+ * customer's data to another by trusting a client-supplied id alone.
+ *
+ * $user->latestCustomer() can be null for a User that has no paired
+ * Customer yet (shouldn't happen via the normal OTP-login cascade — see
+ * Modules\Core\Auth\Events\UserCreated — but is defended against anyway,
+ * since nothing stops a User row existing without one, e.g. seeded data)
+ * — every method returns an empty/null result rather than throwing in
+ * that case, since "no customer paired yet" isn't a not-found error, it's
+ * a legitimately empty account.
+ *
+ * Address/profile writes go through an explicit column allowlist
+ * (WRITABLE_ADDRESS_FIELDS/WRITABLE_PROFILE_FIELDS) rather than trusting
+ * Lunar\Models\Address/Customer's own $guarded = [] — that flag makes
+ * every column mass-assignable at the model layer, including
+ * customer_id on addresses, so a caller passing through an unfiltered
+ * request array (a real risk for a storefront controller built directly
+ * against this service) could otherwise reassign an address to a
+ * different customer entirely, or overwrite created_at/id. Arr::only()
+ * silently drops anything not on the allowlist rather than erroring —
+ * this is a safety boundary, not form validation (a storefront still
+ * validates its own request shape before calling this).
+ *
+ * Authorization here IS the ownership scoping itself, not a separate
+ * layer bolted on top — there is deliberately no Laravel Policy/Gate
+ * class for Order/Address, since a policy is meaningless without a
+ * controller calling authorize() against it, and this branch is scoped
+ * to backend services only (no routes/controllers — see the branch's own
+ * commit history). Every public method below takes Authenticatable $user
+ * as a required first argument and resolves everything else (Order,
+ * Address, Customer) strictly through that user's own
+ * latestCustomer() — there is no method that looks anything up by a bare
+ * id alone. A future storefront controller cannot "forget" the
+ * authorization check the way it could with a separate policy class,
+ * because the check IS how every lookup happens; skipping it isn't an
+ * option the method signatures allow.
+ */
+class CustomerAccountService
+{
+    private const WRITABLE_ADDRESS_FIELDS = [
+        'title', 'first_name', 'last_name', 'company_name',
+        'line_one', 'line_two', 'line_three', 'city', 'state', 'postcode',
+        'delivery_instructions', 'contact_email', 'contact_phone',
+        'country_id', 'shipping_default', 'billing_default',
+    ];
+
+    private const WRITABLE_PROFILE_FIELDS = [
+        'title', 'first_name', 'last_name', 'company_name', 'vat_no',
+    ];
+
+    public function customer(Authenticatable $user): ?Customer
+    {
+        /** @var Customer|null */
+        return $user->latestCustomer();
+    }
+
+    /**
+     * Placed orders only (placed_at IS NOT NULL) — a draft/abandoned
+     * order with no placed_at is checkout-in-progress state, not
+     * something that belongs in order history.
+     */
+    public function orders(Authenticatable $user, int $perPage = 15): LengthAwarePaginator
+    {
+        $customer = $this->customer($user);
+
+        if (! $customer) {
+            return new LengthAwarePaginator([], 0, $perPage);
+        }
+
+        return $customer->orders()
+            ->whereNotNull('placed_at')
+            ->latest('placed_at')
+            ->paginate($perPage);
+    }
+
+    /**
+     * @throws OrderNotFoundException if $orderId doesn't belong to this
+     *   customer, or belongs to a draft (never placed) order
+     */
+    public function order(Authenticatable $user, int $orderId): Order
+    {
+        $customer = $this->customer($user);
+
+        $order = $customer
+            ?->orders()
+            ->whereNotNull('placed_at')
+            ->with(['lines', 'shippingAddress', 'billingAddress', 'transactions', 'shipments'])
+            ->find($orderId);
+
+        if (! $order) {
+            throw new OrderNotFoundException;
+        }
+
+        return $order;
+    }
+
+    public function addresses(Authenticatable $user): iterable
+    {
+        $customer = $this->customer($user);
+
+        return $customer?->addresses ?? collect();
+    }
+
+    /**
+     * @param  array<string, mixed>  $data  Any key not in
+     *   WRITABLE_ADDRESS_FIELDS is silently dropped — see this class's
+     *   own docblock.
+     */
+    public function createAddress(Authenticatable $user, array $data): Address
+    {
+        $customer = $this->customerOrFail($user);
+
+        $address = $customer->addresses()->create(Arr::only($data, self::WRITABLE_ADDRESS_FIELDS));
+
+        $this->enforceSingleDefault($customer, $address);
+        $address->refresh();
+
+        Event::dispatch(new CustomerAddressCreated($address, $user));
+
+        return $address;
+    }
+
+    /**
+     * @throws AddressNotFoundException if $addressId doesn't belong to
+     *   this customer
+     */
+    public function updateAddress(Authenticatable $user, int $addressId, array $data): Address
+    {
+        $address = $this->ownedAddress($user, $addressId);
+        $old = $address->only(array_keys(Arr::only($data, self::WRITABLE_ADDRESS_FIELDS)));
+
+        $address->update(Arr::only($data, self::WRITABLE_ADDRESS_FIELDS));
+
+        $this->enforceSingleDefault($address->customer, $address);
+        $address->refresh();
+
+        Event::dispatch(new CustomerAddressUpdated($address, $old, $user));
+
+        return $address;
+    }
+
+    /**
+     * @throws AddressNotFoundException if $addressId doesn't belong to
+     *   this customer
+     */
+    public function deleteAddress(Authenticatable $user, int $addressId): void
+    {
+        $address = $this->ownedAddress($user, $addressId);
+        $snapshot = $address->getAttributes();
+
+        $address->delete();
+
+        Event::dispatch(new CustomerAddressDeleted($snapshot, $user));
+    }
+
+    /**
+     * Lunar has no built-in action enforcing "at most one shipping
+     * default / one billing default per customer" — a raw update() could
+     * otherwise leave two addresses both flagged shipping_default. Runs
+     * after every create/update, unconditionally (cheap — at most two
+     * single-row UPDATEs, only fired when the just-written address
+     * itself is a default), clearing the flag on every OTHER address of
+     * the same customer.
+     */
+    private function enforceSingleDefault(Customer $customer, Address $address): void
+    {
+        if ($address->shipping_default) {
+            $customer->addresses()->where('id', '!=', $address->id)->update(['shipping_default' => false]);
+        }
+
+        if ($address->billing_default) {
+            $customer->addresses()->where('id', '!=', $address->id)->update(['billing_default' => false]);
+        }
+    }
+
+    /**
+     * @throws AddressNotFoundException if $addressId doesn't belong to
+     *   this customer
+     */
+    private function ownedAddress(Authenticatable $user, int $addressId): Address
+    {
+        $customer = $this->customer($user);
+
+        $address = $customer?->addresses()->find($addressId);
+
+        if (! $address) {
+            throw new AddressNotFoundException;
+        }
+
+        return $address;
+    }
+
+    /**
+     * @param  array<string, mixed>  $data  Any key not in
+     *   WRITABLE_PROFILE_FIELDS is silently dropped — see this class's
+     *   own docblock.
+     */
+    public function updateProfile(Authenticatable $user, array $data): Customer
+    {
+        $customer = $this->customerOrFail($user);
+        $old = $customer->only(array_keys(Arr::only($data, self::WRITABLE_PROFILE_FIELDS)));
+
+        $customer->update(Arr::only($data, self::WRITABLE_PROFILE_FIELDS));
+        $customer->refresh();
+
+        Event::dispatch(new CustomerProfileUpdated($customer, $old, $user));
+
+        return $customer;
+    }
+
+    /**
+     * @throws LogicException if $user has no paired Customer at all —
+     *   distinct from AddressNotFoundException/OrderNotFoundException
+     *   (which mean "this id isn't yours"), this means the account
+     *   itself is in an invariant-violating state the normal OTP-login
+     *   cascade should never produce.
+     */
+    private function customerOrFail(Authenticatable $user): Customer
+    {
+        $customer = $this->customer($user);
+
+        if (! $customer) {
+            throw new LogicException('This user has no paired Customer record.');
+        }
+
+        return $customer;
+    }
+}
diff --git a/src/Localization/Filament/Resources/LanguageLineResource.php b/src/Localization/Filament/Resources/LanguageLineResource.php
index 3fe9469..8d4b718 100644
--- a/src/Localization/Filament/Resources/LanguageLineResource.php
+++ b/src/Localization/Filament/Resources/LanguageLineResource.php
@@ -2,8 +2,17 @@
 
 namespace Modules\Core\Localization\Filament\Resources;
 
+use Filament\Schemas\Schema;
+use Filament\Forms\Components\TextInput;
+use Filament\Schemas\Components\Fieldset;
+use Filament\Tables\Columns\TextColumn;
+use Filament\Tables\Filters\SelectFilter;
+use Modules\Core\Localization\Filament\Resources\LanguageLineResource\Pages\ListLanguageLines;
+use Modules\Core\Localization\Filament\Resources\LanguageLineResource\Pages\CreateLanguageLine;
+use Modules\Core\Localization\Filament\Resources\LanguageLineResource\Pages\EditLanguageLine;
+use Filament\Forms\Components\Textarea;
+use Illuminate\Support\Collection;
 use Filament\Forms;
-use Filament\Forms\Form;
 use Filament\Resources\Resource;
 use Filament\Tables;
 use Filament\Tables\Table;
@@ -15,29 +24,29 @@ class LanguageLineResource extends Resource
 {
     protected static ?string $model = LanguageLine::class;
 
-    protected static ?string $navigationIcon = 'heroicon-o-language';
+    protected static string | \BackedEnum | null $navigationIcon = 'heroicon-o-language';
 
-    protected static ?string $navigationGroup = 'Settings';
+    protected static string | \UnitEnum | null $navigationGroup = 'Settings';
 
     protected static ?string $modelLabel = 'Translation';
 
     protected static ?string $pluralModelLabel = 'Translations';
 
-    public static function form(Form $form): Form
+    public static function form(Schema $schema): Schema
     {
-        return $form->schema([
-            Forms\Components\TextInput::make('group')
+        return $schema->components([
+            TextInput::make('group')
                 ->required()
                 ->maxLength(255)
                 ->default('storefront')
                 ->helperText('Namespace for this label, e.g. "storefront" for e-shop UI text.'),
 
-            Forms\Components\TextInput::make('key')
+            TextInput::make('key')
                 ->required()
                 ->maxLength(255)
                 ->helperText('Dot-notation key, e.g. "nav.cart".'),
 
-            Forms\Components\Fieldset::make('Translations')
+            Fieldset::make('Translations')
                 ->schema(static::localeInputs()),
         ]);
     }
@@ -46,16 +55,16 @@ class LanguageLineResource extends Resource
     {
         return $table
             ->columns([
-                Tables\Columns\TextColumn::make('group')
+                TextColumn::make('group')
                     ->badge()
                     ->sortable(),
-                Tables\Columns\TextColumn::make('key')
+                TextColumn::make('key')
                     ->searchable()
                     ->sortable(),
                 ...static::localeColumns(),
             ])
             ->filters([
-                Tables\Filters\SelectFilter::make('group')
+                SelectFilter::make('group')
                     ->options(fn () => LanguageLine::query()->distinct()->pluck('group', 'group')),
             ])
             ->defaultSort('key');
@@ -69,38 +78,38 @@ class LanguageLineResource extends Resource
     public static function getPages(): array
     {
         return [
-            'index' => Pages\ListLanguageLines::route('/'),
-            'create' => Pages\CreateLanguageLine::route('/create'),
-            'edit' => Pages\EditLanguageLine::route('/{record}/edit'),
+            'index' => ListLanguageLines::route('/'),
+            'create' => CreateLanguageLine::route('/create'),
+            'edit' => EditLanguageLine::route('/{record}/edit'),
         ];
     }
 
     /**
-     * @return array<Forms\Components\Textarea>
+     * @return array<Textarea>
      */
     private static function localeInputs(): array
     {
         return static::localeCodes()
-            ->map(fn (string $code) => Forms\Components\Textarea::make("text.{$code}")
+            ->map(fn (string $code) => Textarea::make("text.{$code}")
                 ->label(strtoupper($code))
                 ->rows(2))
             ->all();
     }
 
     /**
-     * @return array<Tables\Columns\TextColumn>
+     * @return array<TextColumn>
      */
     private static function localeColumns(): array
     {
         return static::localeCodes()
-            ->map(fn (string $code) => Tables\Columns\TextColumn::make("text.{$code}")
+            ->map(fn (string $code) => TextColumn::make("text.{$code}")
                 ->label(strtoupper($code))
                 ->limit(40)
                 ->toggleable())
             ->all();
     }
 
-    private static function localeCodes(): \Illuminate\Support\Collection
+    private static function localeCodes(): Collection
     {
         return Language::query()->pluck('code');
     }
diff --git a/src/Localization/Filament/Resources/LanguageLineResource/Pages/CreateLanguageLine.php b/src/Localization/Filament/Resources/LanguageLineResource/Pages/CreateLanguageLine.php
index 7870fe2..8705623 100644
--- a/src/Localization/Filament/Resources/LanguageLineResource/Pages/CreateLanguageLine.php
+++ b/src/Localization/Filament/Resources/LanguageLineResource/Pages/CreateLanguageLine.php
@@ -5,7 +5,7 @@ namespace Modules\Core\Localization\Filament\Resources\LanguageLineResource\Page
 use Filament\Resources\Pages\CreateRecord;
 use Illuminate\Database\Eloquent\Model;
 use Modules\Core\Localization\Filament\Resources\LanguageLineResource;
-use Modules\Core\Localization\TranslationService;
+use Modules\Core\Localization\Services\TranslationService;
 
 class CreateLanguageLine extends CreateRecord
 {
diff --git a/src/Localization/Filament/Resources/LanguageLineResource/Pages/EditLanguageLine.php b/src/Localization/Filament/Resources/LanguageLineResource/Pages/EditLanguageLine.php
index 80c864a..b42453a 100644
--- a/src/Localization/Filament/Resources/LanguageLineResource/Pages/EditLanguageLine.php
+++ b/src/Localization/Filament/Resources/LanguageLineResource/Pages/EditLanguageLine.php
@@ -2,12 +2,13 @@
 
 namespace Modules\Core\Localization\Filament\Resources\LanguageLineResource\Pages;
 
+use Filament\Actions\DeleteAction;
 use Filament\Actions;
 use Filament\Actions\Action;
 use Filament\Resources\Pages\EditRecord;
 use Illuminate\Database\Eloquent\Model;
 use Modules\Core\Localization\Filament\Resources\LanguageLineResource;
-use Modules\Core\Localization\TranslationService;
+use Modules\Core\Localization\Services\TranslationService;
 use Spatie\TranslationLoader\LanguageLine;
 
 class EditLanguageLine extends EditRecord
@@ -17,7 +18,7 @@ class EditLanguageLine extends EditRecord
     protected function getHeaderActions(): array
     {
         return [
-            Actions\DeleteAction::make()
+            DeleteAction::make()
                 ->action(function (LanguageLine $record) {
                     app(TranslationService::class)->delete($record);
 
diff --git a/src/Localization/Filament/Resources/LanguageLineResource/Pages/ListLanguageLines.php b/src/Localization/Filament/Resources/LanguageLineResource/Pages/ListLanguageLines.php
index 12c7b37..c57ceeb 100644
--- a/src/Localization/Filament/Resources/LanguageLineResource/Pages/ListLanguageLines.php
+++ b/src/Localization/Filament/Resources/LanguageLineResource/Pages/ListLanguageLines.php
@@ -2,6 +2,7 @@
 
 namespace Modules\Core\Localization\Filament\Resources\LanguageLineResource\Pages;
 
+use Filament\Actions\CreateAction;
 use Filament\Actions;
 use Filament\Resources\Pages\ListRecords;
 use Modules\Core\Localization\Filament\Resources\LanguageLineResource;
@@ -13,7 +14,7 @@ class ListLanguageLines extends ListRecords
     protected function getHeaderActions(): array
     {
         return [
-            Actions\CreateAction::make(),
+            CreateAction::make(),
         ];
     }
 }
diff --git a/src/Localization/Listeners/FlushLanguageCache.php b/src/Localization/Listeners/FlushLanguageCache.php
index 575811c..e79016c 100644
--- a/src/Localization/Listeners/FlushLanguageCache.php
+++ b/src/Localization/Listeners/FlushLanguageCache.php
@@ -5,12 +5,14 @@ namespace Modules\Core\Localization\Listeners;
 use Modules\Core\Localization\Events\LanguageCreated;
 use Modules\Core\Localization\Events\LanguageDeleted;
 use Modules\Core\Localization\Events\LanguageUpdated;
-use Modules\Core\Localization\LocaleMiddleware;
+use Modules\Core\Localization\Services\LanguageCache;
 
 class FlushLanguageCache
 {
+    public function __construct(private readonly LanguageCache $languages) {}
+
     public function handle(LanguageCreated|LanguageUpdated|LanguageDeleted $event): void
     {
-        LocaleMiddleware::forgetLanguagesCache();
+        $this->languages->forget();
     }
 }
diff --git a/src/Localization/LocaleMiddleware.php b/src/Localization/Middleware/LocaleMiddleware.php
similarity index 59%
rename from src/Localization/LocaleMiddleware.php
rename to src/Localization/Middleware/LocaleMiddleware.php
index 5bd1f51..da1352c 100644
--- a/src/Localization/LocaleMiddleware.php
+++ b/src/Localization/Middleware/LocaleMiddleware.php
@@ -1,24 +1,24 @@
 <?php
 
-namespace Modules\Core\Localization;
+namespace Modules\Core\Localization\Middleware;
 
 use Closure;
 use Illuminate\Http\Request;
 use Illuminate\Support\Collection;
 use Illuminate\Support\Facades\App;
-use Illuminate\Support\Facades\Cache;
 use Illuminate\Support\Facades\URL;
 use Illuminate\Support\Facades\View;
 use Lunar\Models\Language;
+use Modules\Core\Localization\Services\LanguageCache;
 use Symfony\Component\HttpFoundation\Response;
 
 class LocaleMiddleware
 {
-    private const CACHE_KEY = 'core.localization.languages';
+    public function __construct(private readonly LanguageCache $languages) {}
 
     public function handle(Request $request, Closure $next): Response
     {
-        $languages = $this->availableLanguages();
+        $languages = $this->languages->all();
 
         if ($languages->isEmpty()) {
             return $next($request);
@@ -45,41 +45,37 @@ class LocaleMiddleware
         return $next($request);
     }
 
-    public static function forgetLanguagesCache(): void
-    {
-        Cache::forget(self::CACHE_KEY);
-    }
-
     /**
-     * The store's default language code (e.g. 'el') - the fixed fallback other
-     * locale-aware code (Modules\Core\Catalog\ProductService) should use, as
-     * opposed to config('app.locale') which App::setLocale() mutates per
-     * request and so can't serve as a stable fallback.
-     */
-    public static function defaultLocale(): ?string
-    {
-        return (new self)->availableLanguages()->firstWhere('default', true)?->code;
-    }
-
-    /**
-     * Shares the current/alternate locale (and the alternate's URL) with all
-     * views, so the header language switcher and layout hreflang tags don't
-     * have to recompute it.
+     * Shares the current locale and every OTHER available locale (each with its
+     * own URL for the current page) with all views, so the header language
+     * switcher and layout hreflang tags don't have to recompute it.
+     *
+     * `altLocales` is a collection, not a single value — firstWhere('code', '!=',
+     * ...) would only ever surface one alternate, which happens to look correct
+     * with exactly 2 configured languages (there's only one "other" to find) but
+     * silently drops every locale past the first for a 3+ language store, with no
+     * error, just fewer switcher options than actually configured. A view iterates
+     * `$altLocales` to render as many links/dropdown entries as there are
+     * alternates, whether that's 1 or 10.
      */
     private function shareLocaleViewData(Request $request, Language $language, Collection $languages): void
     {
-        $altLanguage = $languages->firstWhere('code', '!=', $language->code);
         $route = $request->route();
         $routeName = $route?->getName();
 
+        $altLocales = $languages
+            ->reject(fn (Language $other) => $other->code === $language->code)
+            ->map(fn (Language $other) => [
+                'code' => $other->code,
+                'name' => $other->name,
+                'url' => $routeName
+                    ? route($routeName, array_merge($route->parameters(), ['locale' => $other->code]))
+                    : url('/'.$other->code),
+            ])
+            ->values();
+
         View::share('currentLocale', $language->code);
-        View::share('altLocale', $altLanguage?->code);
-        View::share(
-            'altLocaleUrl',
-            $altLanguage && $routeName
-                ? route($routeName, array_merge($route->parameters(), ['locale' => $altLanguage->code]))
-                : ($altLanguage ? url('/'.$altLanguage->code) : null),
-        );
+        View::share('altLocales', $altLocales);
     }
 
     private function redirectToLocalizedUrl(Request $request, Collection $languages): Response
@@ -108,12 +104,4 @@ class LocaleMiddleware
         return $languages->firstWhere('default', true)?->code
             ?? $languages->first()->code;
     }
-
-    private function availableLanguages(): Collection
-    {
-        return Cache::rememberForever(
-            self::CACHE_KEY,
-            fn () => Language::query()->get(['id', 'code', 'name', 'default']),
-        );
-    }
 }
diff --git a/src/Localization/Models/LanguageLine.php b/src/Localization/Models/LanguageLine.php
new file mode 100644
index 0000000..17f4766
--- /dev/null
+++ b/src/Localization/Models/LanguageLine.php
@@ -0,0 +1,32 @@
+<?php
+
+namespace Modules\Core\Localization\Models;
+
+use Modules\Core\Localization\Services\LanguageCache;
+use Spatie\TranslationLoader\LanguageLine as BaseLanguageLine;
+
+/**
+ * Overrides the base package's locale fallback (config('app.fallback_locale'), a
+ * static .env value) with the store's actual default language — Lunar's
+ * `languages.default` flag, the same source LocaleMiddleware/LanguageCache already
+ * treat as the single source of truth for "this store's default language".
+ *
+ * Without this, changing the default language via the Filament Languages resource
+ * has no effect on which locale an untranslated storefront label falls back to —
+ * two disconnected "default locale" concepts silently drifting apart. Swapped in
+ * via config('translation-loader.model') (see LocalizationServiceProvider), the
+ * package's own documented extension point for this.
+ */
+class LanguageLine extends BaseLanguageLine
+{
+    public function getTranslation(string $locale): ?string
+    {
+        if (isset($this->text[$locale])) {
+            return $this->text[$locale];
+        }
+
+        $fallback = app(LanguageCache::class)->defaultLocale();
+
+        return $fallback !== null ? ($this->text[$fallback] ?? null) : null;
+    }
+}
diff --git a/src/Localization/LanguageCacheObserver.php b/src/Localization/Observers/LanguageCacheObserver.php
similarity index 93%
rename from src/Localization/LanguageCacheObserver.php
rename to src/Localization/Observers/LanguageCacheObserver.php
index 774ce41..668aa98 100644
--- a/src/Localization/LanguageCacheObserver.php
+++ b/src/Localization/Observers/LanguageCacheObserver.php
@@ -1,6 +1,6 @@
 <?php
 
-namespace Modules\Core\Localization;
+namespace Modules\Core\Localization\Observers;
 
 use Illuminate\Support\Facades\Event;
 use Lunar\Models\Language;
diff --git a/src/Localization/Services/LanguageCache.php b/src/Localization/Services/LanguageCache.php
new file mode 100644
index 0000000..21e7d96
--- /dev/null
+++ b/src/Localization/Services/LanguageCache.php
@@ -0,0 +1,58 @@
+<?php
+
+namespace Modules\Core\Localization\Services;
+
+use Illuminate\Support\Collection;
+use Illuminate\Support\Facades\Cache;
+use Lunar\Models\Language;
+
+/**
+ * Cached read layer over Lunar's `languages` table — the single source both
+ * Modules\Core\Localization\Middleware\LocaleMiddleware (request-time locale resolution) and
+ * any other locale-aware code (e.g. Modules\Core\Catalog\Services\ProductService) read
+ * from, so the language list is fetched once per cache lifetime rather than once
+ * per caller. Cached forever, invalidated via forget() by
+ * Modules\Core\Localization\Listeners\FlushLanguageCache on
+ * LanguageCreated/LanguageUpdated/LanguageDeleted.
+ */
+class LanguageCache
+{
+    private const CACHE_KEY = 'core.localization.languages';
+
+    public function all(): Collection
+    {
+        return Cache::rememberForever(
+            self::CACHE_KEY,
+            fn () => Language::query()->get(['id', 'code', 'name', 'default']),
+        );
+    }
+
+    /**
+     * The store's default language code (e.g. 'el') - the fixed fallback other
+     * locale-aware code should use, as opposed to config('app.locale') which
+     * App::setLocale() mutates per request and so can't serve as a stable
+     * fallback.
+     */
+    public function defaultLocale(): ?string
+    {
+        return $this->all()->firstWhere('default', true)?->code;
+    }
+
+    /**
+     * Every configured store locale code (e.g. ['el', 'en']) - for code that needs
+     * to enumerate all locales a TranslatedText attribute was indexed under (see
+     * Modules\Core\Catalog\Services\ProductService::withLocalizedFields()), rather than
+     * hardcoding locale codes.
+     *
+     * @return array<int, string>
+     */
+    public function availableLocales(): array
+    {
+        return $this->all()->pluck('code')->all();
+    }
+
+    public function forget(): void
+    {
+        Cache::forget(self::CACHE_KEY);
+    }
+}
diff --git a/src/Localization/Services/StorefrontLabels.php b/src/Localization/Services/StorefrontLabels.php
new file mode 100644
index 0000000..5d02114
--- /dev/null
+++ b/src/Localization/Services/StorefrontLabels.php
@@ -0,0 +1,90 @@
+<?php
+
+namespace Modules\Core\Localization\Services;
+
+/**
+ * Default storefront UI label translations (group `storefront`), seeded by
+ * Modules\Core\Command\InstallLunarCommand. Kept as its own class, separate from
+ * the seeding logic, so the actual label list can be scanned/diffed without wading
+ * through the upsert mechanics — see InstallLunarCommand::seedStorefrontLabels()
+ * for how (and how safely) these get written.
+ */
+class StorefrontLabels
+{
+    /**
+     * @return array<string, array<string, string>> keyed by `group.key` dot-notation,
+     *   each value a locale => text map (`en`/`el`).
+     */
+    public static function all(): array
+    {
+        return [
+            'nav.home' => ['en' => 'Home', 'el' => 'Αρχική'],
+            'nav.products' => ['en' => 'Products', 'el' => 'Προϊόντα'],
+            'nav.cart' => ['en' => 'Cart', 'el' => 'Καλάθι'],
+            'nav.account' => ['en' => 'Account', 'el' => 'Λογαριασμός'],
+            'nav.back' => ['en' => 'Back', 'el' => 'Πίσω'],
+            'nav.contact' => ['en' => 'Contact', 'el' => 'Επικοινωνία'],
+            'nav.close' => ['en' => 'Close', 'el' => 'Κλείσιμο'],
+            'cart.empty' => ['en' => 'Your cart is empty', 'el' => 'Το καλάθι σας είναι άδειο'],
+            'cart.checkout' => ['en' => 'Checkout', 'el' => 'Ολοκλήρωση Παραγγελίας'],
+            'cart.total' => ['en' => 'Total', 'el' => 'Σύνολο'],
+            'cart.remove' => ['en' => 'Remove', 'el' => 'Αφαίρεση'],
+            'product.add_to_cart' => ['en' => 'Add to Cart', 'el' => 'Προσθήκη στο Καλάθι'],
+            'product.out_of_stock' => ['en' => 'Out of Stock', 'el' => 'Εξαντλήθηκε'],
+            'product.price' => ['en' => 'Price', 'el' => 'Τιμή'],
+            'product.description' => ['en' => 'Description', 'el' => 'Περιγραφή'],
+            'product.no_image' => ['en' => 'No image', 'el' => 'Χωρίς εικόνα'],
+            'product.read_more' => ['en' => 'Read more', 'el' => 'Περισσότερα'],
+            'product.reviews' => ['en' => 'Reviews', 'el' => 'Αξιολογήσεις'],
+            'auth.login' => ['en' => 'Log In', 'el' => 'Σύνδεση'],
+            'auth.logout' => ['en' => 'Log Out', 'el' => 'Αποσύνδεση'],
+            'search.placeholder' => ['en' => 'Search products…', 'el' => 'Αναζήτηση προϊόντων…'],
+            'search.results_for' => ['en' => 'Search results for ', 'el' => 'Αποτελέσματα αναζήτησης για '],
+            'customer_reviews' => [
+                'en' => '{0} No customer reviews|{1} :count customer review|[2,*] :count customer reviews',
+                'el' => '{0} Καμία αξιολόγηση πελάτη|{1} :count αξιολόγηση πελάτη|[2,*] :count αξιολογήσεις πελατών',
+            ],
+            'pagination.nav_label' => ['en' => 'Pagination', 'el' => 'Σελιδοποίηση'],
+            'pagination.next' => ['en' => 'Next page', 'el' => 'Επόμενη σελίδα'],
+            'pagination.previous' => ['en' => 'Previous page', 'el' => 'Προηγούμενη σελίδα'],
+            'pagination.page' => ['en' => 'Page :page', 'el' => 'Σελίδα :page'],
+            'review.rating' => ['en' => 'Rating', 'el' => 'Βαθμολογία'],
+            'review.write_label' => ['en' => 'Write a review', 'el' => 'Γράψε μια αξιολόγηση'],
+            'review.name' => ['en' => 'Name', 'el' => 'Όνομα'],
+            'review.name_optional' => ['en' => 'Optional', 'el' => 'Προαιρετικό'],
+            'review.email' => ['en' => 'Email', 'el' => 'Email'],
+            'review.email_not_published' => ['en' => 'Will not be published', 'el' => 'Δεν θα δημοσιευτεί'],
+            'review.save_info' => [
+                'en' => 'Save my name and email for the next time I comment.',
+                'el' => 'Αποθήκευσε το όνομα και το email μου για την επόμενη φορά που θα σχολιάσω.',
+            ],
+            'review.submit' => ['en' => 'Submit', 'el' => 'Υποβολή'],
+            'review.stars_count' => ['en' => '{1} :count star|[2,*] :count stars', 'el' => '{1} :count αστέρι|[2,*] :count αστέρια'],
+            'review.no_reviews_yet' => ['en' => 'No reviews yet.', 'el' => 'Δεν υπάρχουν αξιολογήσεις ακόμα.'],
+            'review.write_first' => ['en' => 'Write the first review', 'el' => 'Γράψε την πρώτη'],
+            'review.write_new' => ['en' => 'Add a review', 'el' => 'Πρόσθεσε μια'],
+            'review.for_product' => ['en' => 'review for ":name"', 'el' => 'αξιολόγηση για το «:name»'],
+            'shop.showing_results' => [
+                'en' => '{0} No products found|{1} Showing :first–:last of :total result|[2,*] Showing :first–:last of :total results',
+                'el' => '{0} Δεν βρέθηκαν προϊόντα|{1} Εμφάνιση :first–:last από :total αποτέλεσμα|[2,*] Εμφάνιση :first–:last από :total αποτελέσματα',
+            ],
+            'shop.all_products' => ['en' => 'All Products', 'el' => 'Όλα τα Προϊόντα'],
+            'shop.sort_label' => ['en' => 'Sort products', 'el' => 'Ταξινόμηση προϊόντων'],
+            'shop.sort_default' => ['en' => 'Default sorting', 'el' => 'Προεπιλεγμένη ταξινόμηση'],
+            'shop.sort_popularity' => ['en' => 'Popularity', 'el' => 'Δημοφιλή'],
+            'shop.sort_price_asc' => ['en' => 'Price: Low to High', 'el' => 'Τιμή: Αύξουσα'],
+            'shop.sort_price_desc' => ['en' => 'Price: High to Low', 'el' => 'Τιμή: Φθίνουσα'],
+            'shop.sort_newest' => ['en' => 'Newest', 'el' => 'Νεότερα'],
+            'shop.no_products' => ['en' => 'No products found in this category.', 'el' => 'Δεν βρέθηκαν προϊόντα σε αυτή την κατηγορία.'],
+            'shop.search_label' => ['en' => 'Search products', 'el' => 'Αναζήτηση προϊόντων'],
+            'shop.search_placeholder' => ['en' => 'Search products…', 'el' => 'Αναζήτησε προϊόντα…'],
+            'shop.filter_price' => ['en' => 'Filter by price', 'el' => 'Φίλτρο τιμής'],
+            'shop.price_min' => ['en' => 'Min price', 'el' => 'Ελάχιστη τιμή'],
+            'shop.price_max' => ['en' => 'Max price', 'el' => 'Μέγιστη τιμή'],
+            'shop.reset' => ['en' => 'Reset', 'el' => 'Επαναφορά'],
+            'shop.apply' => ['en' => 'Apply', 'el' => 'Εφαρμογή'],
+            'shop.availability' => ['en' => 'Availability', 'el' => 'Διαθεσιμότητα'],
+            'shop.in_stock_only' => ['en' => 'In-stock products only', 'el' => 'Μόνο διαθέσιμα προϊόντα'],
+        ];
+    }
+}
diff --git a/src/Localization/TranslationReader.php b/src/Localization/Services/TranslationReader.php
similarity index 93%
rename from src/Localization/TranslationReader.php
rename to src/Localization/Services/TranslationReader.php
index 4f57c70..5cce8fb 100644
--- a/src/Localization/TranslationReader.php
+++ b/src/Localization/Services/TranslationReader.php
@@ -1,6 +1,6 @@
 <?php
 
-namespace Modules\Core\Localization;
+namespace Modules\Core\Localization\Services;
 
 use Illuminate\Support\Facades\App;
 use Spatie\TranslationLoader\LanguageLine;
diff --git a/src/Localization/TranslationService.php b/src/Localization/Services/TranslationService.php
similarity index 97%
rename from src/Localization/TranslationService.php
rename to src/Localization/Services/TranslationService.php
index b6bf271..f7a0237 100644
--- a/src/Localization/TranslationService.php
+++ b/src/Localization/Services/TranslationService.php
@@ -1,6 +1,6 @@
 <?php
 
-namespace Modules\Core\Localization;
+namespace Modules\Core\Localization\Services;
 
 use Illuminate\Support\Facades\Event;
 use Modules\Core\Localization\Events\TranslationCreated;
diff --git a/src/Logging/ActivityLogService.php b/src/Logging/ActivityLogService.php
index afc3f6e..30ce3d2 100644
--- a/src/Logging/ActivityLogService.php
+++ b/src/Logging/ActivityLogService.php
@@ -2,25 +2,31 @@
 
 namespace Modules\Core\Logging;
 
+use Illuminate\Contracts\Auth\Authenticatable;
 use Illuminate\Database\Eloquent\Model;
 
 /**
  * Thin wrapper around Spatie Activity Log that standardises the log channel,
- * actor (authenticated staff member), and property shape for all domain events.
+ * actor, and property shape for all domain events.
  *
  * All logs are written to the 'lunar' channel. The subject is always an
- * Eloquent model, and the actor is resolved from the 'staff' guard at call time.
+ * Eloquent model. $causer defaults to the 'staff' guard's current user —
+ * every existing caller of this class is admin-side — but can be passed
+ * explicitly for a non-staff actor (e.g. a customer editing their own
+ * address on the `web` guard — see Modules\Core\Customer\Services\
+ * CustomerAccountService, which passes the acting User rather than
+ * relying on this default resolving to null for a web-guard session).
  */
 class ActivityLogService
 {
     /**
      * Log a creation event. $attributes describes the initial state.
      */
-    public function created(Model $subject, array $attributes): void
+    public function created(Model $subject, array $attributes, ?Authenticatable $causer = null): void
     {
         activity('lunar')
             ->performedOn($subject)
-            ->causedBy(auth('staff')->user())
+            ->causedBy($causer ?? auth('staff')->user())
             ->withProperties(['attributes' => $attributes])
             ->log('created');
     }
@@ -28,11 +34,11 @@ class ActivityLogService
     /**
      * Log an update event. $old holds the previous values, $attributes the new ones.
      */
-    public function updated(Model $subject, array $old, array $attributes): void
+    public function updated(Model $subject, array $old, array $attributes, ?Authenticatable $causer = null): void
     {
         activity('lunar')
             ->performedOn($subject)
-            ->causedBy(auth('staff')->user())
+            ->causedBy($causer ?? auth('staff')->user())
             ->withProperties(['old' => $old, 'attributes' => $attributes])
             ->log('updated');
     }
@@ -40,11 +46,11 @@ class ActivityLogService
     /**
      * Log a failed operation. $attributes provides context (e.g. error message, service).
      */
-    public function failed(Model $subject, array $attributes): void
+    public function failed(Model $subject, array $attributes, ?Authenticatable $causer = null): void
     {
         activity('lunar')
             ->performedOn($subject)
-            ->causedBy(auth('staff')->user())
+            ->causedBy($causer ?? auth('staff')->user())
             ->withProperties(['attributes' => $attributes])
             ->log('failed');
     }
@@ -52,11 +58,11 @@ class ActivityLogService
     /**
      * Log a deletion event. $attributes provides context (e.g. reason, name).
      */
-    public function deleted(Model $subject, array $attributes): void
+    public function deleted(Model $subject, array $attributes, ?Authenticatable $causer = null): void
     {
         activity('lunar')
             ->performedOn($subject)
-            ->causedBy(auth('staff')->user())
+            ->causedBy($causer ?? auth('staff')->user())
             ->withProperties(['attributes' => $attributes])
             ->log('deleted');
     }
diff --git a/src/MigrateImport/ImporterFactory.php b/src/MigrateImport/ImporterFactory.php
index 7f1a617..84f492d 100644
--- a/src/MigrateImport/ImporterFactory.php
+++ b/src/MigrateImport/ImporterFactory.php
@@ -2,6 +2,7 @@
 
 namespace Modules\Core\MigrateImport;
 
+use InvalidArgumentException;
 use Modules\Core\MigrateImport\JudgeMe\JudgeMeExportImporter;
 use Modules\Core\MigrateImport\Shopify\ShopifyExportImporter;
 
@@ -15,7 +16,7 @@ class ImporterFactory
             ['judgeme', 'export'] => new JudgeMeExportImporter,
             // ["woocommerce", "export"] => new WooCommerceExportImporter(),
             // ["woocommerce", "api"] => new WooCommerceApiImporter(),
-            default => throw new \InvalidArgumentException(
+            default => throw new InvalidArgumentException(
                 "No importer available for source \"{$spec->source}\" with type \"{$spec->type}\".",
             ),
         };
diff --git a/src/MigrateImport/JudgeMe/JudgeMeCsvReader.php b/src/MigrateImport/JudgeMe/JudgeMeCsvReader.php
index 13b3df8..b17f90e 100644
--- a/src/MigrateImport/JudgeMe/JudgeMeCsvReader.php
+++ b/src/MigrateImport/JudgeMe/JudgeMeCsvReader.php
@@ -2,6 +2,8 @@
 
 namespace Modules\Core\MigrateImport\JudgeMe;
 
+use RuntimeException;
+
 class JudgeMeCsvReader
 {
     /**
@@ -12,7 +14,7 @@ class JudgeMeCsvReader
         $handle = fopen($csvPath, 'r');
 
         if ($handle === false) {
-            throw new \RuntimeException("Could not open CSV file: {$csvPath}");
+            throw new RuntimeException("Could not open CSV file: {$csvPath}");
         }
 
         $headers = fgetcsv($handle);
diff --git a/src/MigrateImport/JudgeMe/JudgeMeExportImporter.php b/src/MigrateImport/JudgeMe/JudgeMeExportImporter.php
index 937a133..c657972 100644
--- a/src/MigrateImport/JudgeMe/JudgeMeExportImporter.php
+++ b/src/MigrateImport/JudgeMe/JudgeMeExportImporter.php
@@ -2,6 +2,7 @@
 
 namespace Modules\Core\MigrateImport\JudgeMe;
 
+use Throwable;
 use Illuminate\Support\Carbon;
 use Illuminate\Support\Facades\Log;
 use Modules\Core\MigrateImport\Importer;
@@ -75,7 +76,7 @@ class JudgeMeExportImporter implements Importer
         foreach ($urls as $url) {
             try {
                 $review->addMediaFromUrl($url)->toMediaCollection(ProductReview::IMAGES_COLLECTION);
-            } catch (\Throwable $e) {
+            } catch (Throwable $e) {
                 Log::warning('JudgeMe import: failed to download review image', [
                     'review_id' => $review->id,
                     'url' => $url,
diff --git a/src/MigrateImport/JudgeMe/Resolvers/ProductResolver.php b/src/MigrateImport/JudgeMe/Resolvers/ProductResolver.php
index ad68d91..d1cf3b9 100644
--- a/src/MigrateImport/JudgeMe/Resolvers/ProductResolver.php
+++ b/src/MigrateImport/JudgeMe/Resolvers/ProductResolver.php
@@ -7,13 +7,23 @@ use Lunar\Models\Url;
 
 class ProductResolver
 {
+    /**
+     * A slug can have more than one `lunar_urls` row pointing at it across import
+     * batches — e.g. a product soft-deleted and re-imported leaves its old URL row
+     * behind, still matching the same slug. Picking "whichever Url row matches
+     * first" (as a plain Url::where('slug', ...)->first() would) can resolve to a
+     * soft-deleted product, silently failing every downstream write for that
+     * product (e.g. JudgeMeExportImporter logging "no product found" for a handle
+     * that, in isolation, clearly exists). Join against `lunar_products` directly
+     * so only a URL pointing at a live (non-deleted) product resolves.
+     */
     public function resolve(string $handle): ?Product
     {
-        $url = Url::query()
-            ->where('slug', $handle)
-            ->where('element_type', (new Product)->getMorphClass())
+        return Product::query()
+            ->join('lunar_urls', 'lunar_urls.element_id', '=', 'lunar_products.id')
+            ->where('lunar_urls.slug', $handle)
+            ->where('lunar_urls.element_type', (new Product)->getMorphClass())
+            ->select('lunar_products.*')
             ->first();
-
-        return $url?->element;
     }
 }
diff --git a/src/MigrateImport/Shopify/Resolvers/ProductOptionResolver.php b/src/MigrateImport/Shopify/Resolvers/ProductOptionResolver.php
index e4582f4..3bb9b0e 100644
--- a/src/MigrateImport/Shopify/Resolvers/ProductOptionResolver.php
+++ b/src/MigrateImport/Shopify/Resolvers/ProductOptionResolver.php
@@ -16,10 +16,16 @@ class ProductOptionResolver
         // the same option instead of creating a near-duplicate.
         $handle = Str::slug($name) ?: 'option';
 
+        // 'label' must be set even though nothing here reads it back — a null
+        // label crashes Lunar's own ProductOptionIndexer::toSearchableArray()
+        // (foreach (null as ...)) the moment this option gets reindexed, since
+        // it assumes every ProductOption always has one. Same value as 'name'
+        // is a reasonable default; Shopify's CSV has no separate "label" concept.
         return ProductOption::query()->firstOrCreate(
             ['handle' => $handle],
             [
                 'name' => [DefaultLocale::code() => $name],
+                'label' => [DefaultLocale::code() => $name],
                 'shared' => true,
             ],
         );
diff --git a/src/MigrateImport/Shopify/ShopifyCsvReader.php b/src/MigrateImport/Shopify/ShopifyCsvReader.php
index 6fe903f..ef79352 100644
--- a/src/MigrateImport/Shopify/ShopifyCsvReader.php
+++ b/src/MigrateImport/Shopify/ShopifyCsvReader.php
@@ -2,6 +2,8 @@
 
 namespace Modules\Core\MigrateImport\Shopify;
 
+use RuntimeException;
+
 class ShopifyCsvReader
 {
     /**
@@ -12,7 +14,7 @@ class ShopifyCsvReader
         $handle = fopen($csvPath, 'r');
 
         if ($handle === false) {
-            throw new \RuntimeException("Could not open CSV file: {$csvPath}");
+            throw new RuntimeException("Could not open CSV file: {$csvPath}");
         }
 
         $headers = fgetcsv($handle);
diff --git a/src/MigrateImport/Shopify/ShopifyExportImporter.php b/src/MigrateImport/Shopify/ShopifyExportImporter.php
index 6b3b23b..72ae6ce 100644
--- a/src/MigrateImport/Shopify/ShopifyExportImporter.php
+++ b/src/MigrateImport/Shopify/ShopifyExportImporter.php
@@ -2,6 +2,8 @@
 
 namespace Modules\Core\MigrateImport\Shopify;
 
+use Lunar\Models\TaxClass;
+use Lunar\Models\ProductOption;
 use Illuminate\Support\Facades\Log;
 use Lunar\Models\Collection;
 use Lunar\Models\CollectionGroup;
@@ -23,6 +25,7 @@ use Modules\Core\MigrateImport\Shopify\Resolvers\ProductOptionResolver;
 use Modules\Core\MigrateImport\Shopify\Resolvers\ProductTypeResolver;
 use Modules\Core\MigrateImport\Shopify\Resolvers\TagResolver;
 use Modules\Core\MigrateImport\Shopify\Resolvers\TaxClassResolver;
+use Spatie\MediaLibrary\MediaCollections\Models\Media;
 
 class ShopifyExportImporter implements Importer
 {
@@ -111,7 +114,7 @@ class ShopifyExportImporter implements Importer
         $options = $this->attachOptions($product, $row);
 
         foreach ($group->variantRows as $index => $variantRow) {
-            $this->importVariant($product, $group->handle, $index, $variantRow, $taxClass, $currency, $options);
+            $this->importVariant($product, $group->handle, $index, $variantRow, $taxClass, $currency, $options, $imagesPath);
         }
 
         foreach ($group->imageRows as $index => $imageRow) {
@@ -120,7 +123,7 @@ class ShopifyExportImporter implements Importer
     }
 
     /**
-     * @return array<int, \Lunar\Models\ProductOption>
+     * @return array<int, ProductOption>
      */
     private function attachOptions(Product $product, array $row): array
     {
@@ -146,9 +149,10 @@ class ShopifyExportImporter implements Importer
         string $handle,
         int $index,
         array $row,
-        \Lunar\Models\TaxClass $taxClass,
+        TaxClass $taxClass,
         Currency $currency,
         array $options,
+        string $imagesPath,
     ): void {
         $externalId = "{$handle}#{$index}";
         $existing = ImportMapping::resolve(self::SOURCE, 'variant', $externalId);
@@ -180,6 +184,26 @@ class ShopifyExportImporter implements Importer
             : null;
 
         $this->priceResolver->resolve($variant, $currency, $price, $comparePrice);
+
+        // Shopify's own "Variant Image" column — the one image a variant picker
+        // actually swaps to when that variant is selected — distinct from the
+        // product's full gallery (imageRows below). Often the same file as one
+        // of the product's own image rows, sometimes not yet imported at all
+        // (e.g. a variant-only image never listed as its own image row) — either
+        // way resolveOrImportImage() handles both via the same Image Src dedup
+        // key, so whichever of importVariant()/importImage() runs first for a
+        // given src does the actual import.
+        $variantImageSrc = trim((string) ($row['Variant Image'] ?? ''));
+
+        if ($variantImageSrc !== '') {
+            $media = $this->resolveOrImportImage($product, $handle, $variantImageSrc, 1, $imagesPath);
+
+            if ($media) {
+                $variant->images()->syncWithoutDetaching([
+                    $media->id => ['primary' => true, 'position' => 1],
+                ]);
+            }
+        }
     }
 
     private function importImage(
@@ -189,29 +213,54 @@ class ShopifyExportImporter implements Importer
         array $row,
         string $imagesPath,
     ): void {
-        $externalId = $row['Image Src'] ?: "{$handle}#image-{$index}";
         $position = (int) ($row['Image Position'] ?? $index + 1);
 
-        if (ImportMapping::resolve(self::SOURCE, 'image', $externalId)) {
-            return;
+        $this->resolveOrImportImage($product, $handle, $row['Image Src'], $position, $imagesPath);
+    }
+
+    /**
+     * Resolves the Media already imported for $imageSrc (recorded under
+     * source_type 'image', keyed by Image Src — the same URL Shopify repeats
+     * across a product's own image rows and any variant's "Variant Image"
+     * column), importing it via AssetResolver if this is the first time this
+     * src has been seen. Shared by importImage() (product gallery) and
+     * importVariant() (variant-specific image) so the same physical file is
+     * never uploaded to Spatie MediaLibrary twice just because Shopify's flat
+     * CSV format repeats the URL on multiple rows.
+     */
+    private function resolveOrImportImage(
+        Product $product,
+        string $handle,
+        string $imageSrc,
+        int $position,
+        string $imagesPath,
+    ): ?Media {
+        $externalId = $imageSrc ?: "{$handle}#image-{$position}";
+
+        $existing = ImportMapping::resolve(self::SOURCE, 'image', $externalId);
+
+        if ($existing instanceof Media) {
+            return $existing;
         }
 
-        $localFile = $this->findLocalFile($imagesPath, $row['Image Src']);
+        $localFile = $this->findLocalFile($imagesPath, $imageSrc);
 
         if ($localFile === null) {
             Log::warning('Shopify import: image file not found', [
                 'handle' => $handle,
-                'image_src' => $row['Image Src'],
+                'image_src' => $imageSrc,
             ]);
 
-            return;
+            return null;
         }
 
         $media = $this->assetResolver->resolve($product, $localFile, $position);
 
         if ($media) {
-            ImportMapping::record(self::SOURCE, 'image', $externalId, $product);
+            ImportMapping::record(self::SOURCE, 'image', $externalId, $media);
         }
+
+        return $media;
     }
 
     private function findLocalFile(string $imagesPath, string $imageSrc): ?string
diff --git a/src/Notification/NotificationRegistry.php b/src/Notification/NotificationRegistry.php
index d6eee86..a73c4e9 100644
--- a/src/Notification/NotificationRegistry.php
+++ b/src/Notification/NotificationRegistry.php
@@ -2,6 +2,7 @@
 
 namespace Modules\Core\Notification;
 
+use Throwable;
 use Illuminate\Support\Facades\Event;
 
 class NotificationRegistry
@@ -44,7 +45,7 @@ class NotificationRegistry
                         $notification->delay($event->delaySeconds);
                     }
                     $notification->notifiable()->notify($notification);
-                } catch (\Throwable $e) {
+                } catch (Throwable $e) {
                     report($e);
                 }
             });
diff --git a/src/Option/LazyOption.php b/src/Option/LazyOption.php
index 0e92ce8..215d780 100644
--- a/src/Option/LazyOption.php
+++ b/src/Option/LazyOption.php
@@ -2,6 +2,9 @@
 
 namespace Modules\Core\Option;
 
+use InvalidArgumentException;
+use Exception;
+use RuntimeException;
 use Traversable;
 
 /**
@@ -39,7 +42,7 @@ final class LazyOption extends Option
     public function __construct($callback, array $arguments = [])
     {
         if (!is_callable($callback)) {
-            throw new \InvalidArgumentException("Invalid callback given");
+            throw new InvalidArgumentException("Invalid callback given");
         }
 
         $this->callback = $callback;
@@ -71,7 +74,7 @@ final class LazyOption extends Option
         return $this->option()->getOrCall($callable);
     }
 
-    public function getOrThrow(\Exception $ex)
+    public function getOrThrow(Exception $ex)
     {
         return $this->option()->getOrThrow($ex);
     }
@@ -146,7 +149,7 @@ final class LazyOption extends Option
             if ($option instanceof Option) {
                 $this->option = $option;
             } else {
-                throw new \RuntimeException(
+                throw new RuntimeException(
                     sprintf("Expected instance of %s", Option::class),
                 );
             }
diff --git a/src/Option/None.php b/src/Option/None.php
index 59b16cc..818e22b 100644
--- a/src/Option/None.php
+++ b/src/Option/None.php
@@ -2,6 +2,8 @@
 
 namespace Modules\Core\Option;
 
+use RuntimeException;
+use Exception;
 use EmptyIterator;
 
 /**
@@ -24,7 +26,7 @@ final class None extends Option
 
     public function get()
     {
-        throw new \RuntimeException("None has no value.");
+        throw new RuntimeException("None has no value.");
     }
 
     public function getOrCall($callable)
@@ -37,7 +39,7 @@ final class None extends Option
         return $default;
     }
 
-    public function getOrThrow(\Exception $ex)
+    public function getOrThrow(Exception $ex)
     {
         throw $ex;
     }
diff --git a/src/Option/Option.php b/src/Option/Option.php
index 52caa83..c9915e1 100644
--- a/src/Option/Option.php
+++ b/src/Option/Option.php
@@ -2,6 +2,7 @@
 
 namespace Modules\Core\Option;
 
+use Exception;
 use ArrayAccess;
 use IteratorAggregate;
 
@@ -164,7 +165,7 @@ abstract class Option implements IteratorAggregate
     abstract public function getOrCall($callable);
 
     /** @return T */
-    abstract public function getOrThrow(\Exception $ex);
+    abstract public function getOrThrow(Exception $ex);
 
     abstract public function isEmpty(): bool;
 
diff --git a/src/Option/Some.php b/src/Option/Some.php
index e3d4739..7faf94a 100644
--- a/src/Option/Some.php
+++ b/src/Option/Some.php
@@ -2,6 +2,7 @@
 
 namespace Modules\Core\Option;
 
+use RuntimeException;
 use ArrayIterator;
 use Exception;
 
@@ -56,7 +57,7 @@ final class Some extends Option
         return $this->value;
     }
 
-    public function getOrThrow(\Exception $ex)
+    public function getOrThrow(Exception $ex)
     {
         return $this->value;
     }
@@ -88,7 +89,7 @@ final class Some extends Option
         /** @var mixed */
         $rs = $callable($this->value);
         if (!$rs instanceof Option) {
-            throw new \RuntimeException(
+            throw new RuntimeException(
                 "Callables passed to flatMap() must return an Option. Maybe you should use map() instead?",
             );
         }
diff --git a/src/Order/Commands/CloseExpiredReturnWindows.php b/src/Order/Commands/CloseExpiredReturnWindows.php
new file mode 100644
index 0000000..2f65408
--- /dev/null
+++ b/src/Order/Commands/CloseExpiredReturnWindows.php
@@ -0,0 +1,68 @@
+<?php
+
+namespace Modules\Core\Order\Commands;
+
+use Illuminate\Console\Command;
+use Lunar\Models\Order;
+use Modules\Core\Order\Events\OrderCompleted;
+use Modules\Core\Order\Services\OrderStatusWriter;
+
+/**
+ * Auto-completes a carrier order once its 14-day return window has
+ * elapsed with no return requested — the automatic counterpart to the
+ * staff "Update Status" action's manual completion. Store-pickup orders
+ * have no return-window step at all (Modules\Core\Order\Listeners\
+ * CompleteOrderOnPickedUp completes them immediately), so this only ever
+ * touches carrier orders sitting in 'delivered' (the status also carrying
+ * "return window is open" — see AdvanceFulfillmentOnDelivered).
+ *
+ * Registered at exactly dailyAt('00:00') in
+ * Modules\Core\Providers\OrderServiceProvider — a compliance requirement
+ * that this run at exact midnight, not Laravel's own arbitrary default
+ * time for a plain daily() schedule.
+ *
+ * "When did the window open" is read from order_status_transitions rather
+ * than Order::updated_at, which any unrelated field write would bump —
+ * this is the concrete reason the audit table exists beyond pure logging.
+ *
+ * Window length is config('core.order.return_window_days') — a legal/
+ * policy value a store may need to change without a code deploy, not a
+ * hardcoded constant.
+ */
+class CloseExpiredReturnWindows extends Command
+{
+    protected $signature = 'boboko:order:close-expired-return-windows';
+
+    protected $description = 'Auto-complete carrier orders whose return window has elapsed with no return requested.';
+
+    public function handle(OrderStatusWriter $writer): void
+    {
+        $cutoff = now()->subDays(config('core.order.return_window_days', 14));
+
+        $orderIds = Order::query()
+            ->where('status', 'delivered')
+            ->whereHas('statusTransitions', function ($query) use ($cutoff) {
+                $query->where('to_status', 'delivered')
+                    ->where('created_at', '<=', $cutoff);
+            })
+            ->pluck('id');
+
+        $completed = 0;
+
+        foreach ($orderIds as $orderId) {
+            $order = Order::find($orderId);
+
+            if (! $order || $order->status !== 'delivered') {
+                continue; // idempotent no-op — moved on since the query ran
+            }
+
+            $writer->write($order, 'completed', self::class);
+
+            OrderCompleted::dispatch($order);
+
+            $completed++;
+        }
+
+        $this->components->info("Completed {$completed} order(s) past their return window.");
+    }
+}
diff --git a/src/Order/DTOs/OrderFulfillmentResult.php b/src/Order/DTOs/OrderFulfillmentResult.php
new file mode 100644
index 0000000..32ca635
--- /dev/null
+++ b/src/Order/DTOs/OrderFulfillmentResult.php
@@ -0,0 +1,30 @@
+<?php
+
+namespace Modules\Core\Order\DTOs;
+
+/**
+ * What a Modules\Core\Order\Services\OrderFulfillmentService method
+ * returns instead of throwing/echoing a Filament notification directly —
+ * keeps that service usable outside a Filament action (a future API
+ * endpoint, a console command, a test) without dragging
+ * Filament\Notifications\Notification along. Modules\Core\Shipping\
+ * Extensions\OrderViewExtension is the one place that translates this
+ * into an actual on-screen notification.
+ */
+final class OrderFulfillmentResult
+{
+    private function __construct(
+        public readonly bool $success,
+        public readonly string $message,
+    ) {}
+
+    public static function success(string $message): self
+    {
+        return new self(true, $message);
+    }
+
+    public static function failure(string $message): self
+    {
+        return new self(false, $message);
+    }
+}
diff --git a/src/Order/Enums/FulfillmentStatus.php b/src/Order/Enums/FulfillmentStatus.php
new file mode 100644
index 0000000..1f13890
--- /dev/null
+++ b/src/Order/Enums/FulfillmentStatus.php
@@ -0,0 +1,15 @@
+<?php
+
+namespace Modules\Core\Order\Enums;
+
+/**
+ * Derived from Shipment/ShipmentInfo — no equivalent existed anywhere in
+ * Lunar or this codebase before OrderStatus::fulfillment().
+ */
+enum FulfillmentStatus: string
+{
+    case Unfulfilled = 'unfulfilled';
+    case Shipped = 'shipped';
+    case PartiallyShipped = 'partially-shipped';
+    case Delivered = 'delivered';
+}
diff --git a/src/Order/Enums/PaymentStatus.php b/src/Order/Enums/PaymentStatus.php
new file mode 100644
index 0000000..e5f8438
--- /dev/null
+++ b/src/Order/Enums/PaymentStatus.php
@@ -0,0 +1,17 @@
+<?php
+
+namespace Modules\Core\Order\Enums;
+
+/**
+ * Same states/logic as Lunar's own ManageOrder::paymentStatus(), which
+ * only exists as a Filament-page Livewire #[Computed] method — this is
+ * that same derivation, reusable from anywhere via Order::paymentStatus().
+ */
+enum PaymentStatus: string
+{
+    case Offline = 'offline';
+    case Uncaptured = 'uncaptured';
+    case Captured = 'captured';
+    case PartialRefund = 'partial-refund';
+    case Refunded = 'refunded';
+}
diff --git a/src/Order/Events/OrderCaptured.php b/src/Order/Events/OrderCaptured.php
new file mode 100644
index 0000000..1b2e7e7
--- /dev/null
+++ b/src/Order/Events/OrderCaptured.php
@@ -0,0 +1,24 @@
+<?php
+
+namespace Modules\Core\Order\Events;
+
+use Illuminate\Foundation\Events\Dispatchable;
+use Lunar\Models\Order;
+use Lunar\Models\Transaction;
+
+/**
+ * Dispatched by TransactionObserver::saved() when a Transaction's type
+ * changes to 'capture' (from 'intent') and succeeds. Unlike refunds,
+ * Lunar's Stripe driver (StoreCharges) reuses the same Transaction row
+ * across intent -> capture rather than creating a new one, so this can't
+ * key off `wasRecentlyCreated` the way OrderRefunded does.
+ */
+class OrderCaptured
+{
+    use Dispatchable;
+
+    public function __construct(
+        public readonly Order $order,
+        public readonly Transaction $transaction,
+    ) {}
+}
diff --git a/src/Order/Events/OrderCompleted.php b/src/Order/Events/OrderCompleted.php
new file mode 100644
index 0000000..7ab3d2c
--- /dev/null
+++ b/src/Order/Events/OrderCompleted.php
@@ -0,0 +1,25 @@
+<?php
+
+namespace Modules\Core\Order\Events;
+
+use Illuminate\Foundation\Events\Dispatchable;
+use Lunar\Models\Order;
+
+/**
+ * The one terminal signal every notification/reporting concern that only
+ * cares about "this order is fully done" should listen to, regardless of
+ * which path actually got it there — dispatched by all four:
+ * Modules\Core\Order\Listeners\CompleteOrderOnPickedUp (store-pickup),
+ * Modules\Core\Order\Commands\CloseExpiredReturnWindows (carrier,
+ * automatic 14-day return-window expiry), or Modules\Core\Shipping\
+ * Extensions\OrderViewExtension's "Mark Completed" action (manual
+ * universal fallback, either branch).
+ */
+class OrderCompleted
+{
+    use Dispatchable;
+
+    public function __construct(
+        public readonly Order $order,
+    ) {}
+}
diff --git a/src/Order/Events/OrderDelivered.php b/src/Order/Events/OrderDelivered.php
new file mode 100644
index 0000000..3e011bf
--- /dev/null
+++ b/src/Order/Events/OrderDelivered.php
@@ -0,0 +1,24 @@
+<?php
+
+namespace Modules\Core\Order\Events;
+
+use Illuminate\Foundation\Events\Dispatchable;
+use Lunar\Models\Order;
+use Modules\Core\Shipping\Models\ShipmentInfo;
+
+/**
+ * Dispatched by Order's DeriveOrderDeliveredFromShipment listener, which
+ * reacts to Shipping's ShipmentStatusUpdatedByCarrier — delivery is a
+ * tracking checkpoint, not a manual status write, so it never goes through
+ * OrderStatusUpdated. Order.status itself is left untouched here; this is
+ * only the signal for delivery notifications and similar reactions.
+ */
+class OrderDelivered
+{
+    use Dispatchable;
+
+    public function __construct(
+        public readonly Order $order,
+        public readonly ShipmentInfo $shipmentInfo,
+    ) {}
+}
diff --git a/src/Order/Events/OrderDispatched.php b/src/Order/Events/OrderDispatched.php
new file mode 100644
index 0000000..116338a
--- /dev/null
+++ b/src/Order/Events/OrderDispatched.php
@@ -0,0 +1,29 @@
+<?php
+
+namespace Modules\Core\Order\Events;
+
+use Illuminate\Foundation\Events\Dispatchable;
+use Lunar\Models\Order;
+use Modules\Core\Shipping\Models\ShipmentInfo;
+
+/**
+ * Dispatched by either of the two paths that move a carrier order's
+ * `status` to 'dispatched' — Modules\Core\Order\Listeners\
+ * AdvanceFulfillmentOnCarrierCheckpoint (automatic, reacting to a real
+ * carrier checkpoint) or Modules\Core\Order\Services\
+ * OrderFulfillmentService::createShipmentAndDispatch() (staff-driven, via
+ * the single "Update Status" action). $shipmentInfo is nullable
+ * specifically because of that second path — populated with the
+ * triggering checkpoint when it's real, null when staff drove it
+ * manually. Mirrors OrderDelivered's {order, shipmentInfo} shape, just
+ * with the nullability this one event additionally needs.
+ */
+class OrderDispatched
+{
+    use Dispatchable;
+
+    public function __construct(
+        public readonly Order $order,
+        public readonly ?ShipmentInfo $shipmentInfo = null,
+    ) {}
+}
diff --git a/src/Order/Events/OrderPaidChanged.php b/src/Order/Events/OrderPaidChanged.php
new file mode 100644
index 0000000..a9e679a
--- /dev/null
+++ b/src/Order/Events/OrderPaidChanged.php
@@ -0,0 +1,25 @@
+<?php
+
+namespace Modules\Core\Order\Events;
+
+use Illuminate\Foundation\Events\Dispatchable;
+use Lunar\Models\Order;
+
+/**
+ * Dispatched by Modules\Core\Order\Services\OrderStatusWriter::markPaid()
+ * whenever Order::paid flips to true — entirely independent of the
+ * `status` column (see OrderStatusFlow's own docblock for why payment
+ * timing, especially for cash-on-delivery, cannot be modeled as a step in
+ * that sequence). Order::status changes are instead picked up generically
+ * by Modules\Core\Order\Events\OrderStatusUpdated (dispatched by
+ * OrderObserver whenever `status` changes, regardless of writer).
+ */
+class OrderPaidChanged
+{
+    use Dispatchable;
+
+    public function __construct(
+        public readonly Order $order,
+        public readonly string $causeClass,
+    ) {}
+}
diff --git a/src/Order/Events/OrderPickedUp.php b/src/Order/Events/OrderPickedUp.php
new file mode 100644
index 0000000..6f570c1
--- /dev/null
+++ b/src/Order/Events/OrderPickedUp.php
@@ -0,0 +1,25 @@
+<?php
+
+namespace Modules\Core\Order\Events;
+
+use Illuminate\Foundation\Events\Dispatchable;
+use Lunar\Models\Order;
+
+/**
+ * Dispatched by Modules\Core\Order\Services\OrderFulfillmentService::
+ * markPickedUp(), the staff-driven "Update Status" action's handling of
+ * the 'picked_up' target — the customer has collected a store-pickup
+ * order in person. Store-pickup only; a carrier order's equivalent
+ * "arrived" moment is OrderDelivered. Modules\Core\Order\Listeners\
+ * CompleteOrderOnPickedUp reacts to this by moving `status` straight to
+ * 'completed' — no return-window step for store-pickup, per the business
+ * design.
+ */
+class OrderPickedUp
+{
+    use Dispatchable;
+
+    public function __construct(
+        public readonly Order $order,
+    ) {}
+}
diff --git a/src/Order/Events/OrderReadyForDispatch.php b/src/Order/Events/OrderReadyForDispatch.php
new file mode 100644
index 0000000..db44be6
--- /dev/null
+++ b/src/Order/Events/OrderReadyForDispatch.php
@@ -0,0 +1,23 @@
+<?php
+
+namespace Modules\Core\Order\Events;
+
+use Illuminate\Foundation\Events\Dispatchable;
+use Lunar\Models\Order;
+
+/**
+ * Dispatched by Modules\Core\Shipping\Extensions\OrderViewExtension's
+ * "Mark Ready" action, carrier branch (Order::isStorePickupOrder() ===
+ * false) — staff has packed/staged the order for carrier handoff.
+ * Staff-internal: nothing customer-facing happens at this moment, so no
+ * notification listens to this event (compare OrderReadyForPickup, which
+ * does trigger a customer email).
+ */
+class OrderReadyForDispatch
+{
+    use Dispatchable;
+
+    public function __construct(
+        public readonly Order $order,
+    ) {}
+}
diff --git a/src/Order/Events/OrderReadyForPickup.php b/src/Order/Events/OrderReadyForPickup.php
new file mode 100644
index 0000000..9fbaded
--- /dev/null
+++ b/src/Order/Events/OrderReadyForPickup.php
@@ -0,0 +1,22 @@
+<?php
+
+namespace Modules\Core\Order\Events;
+
+use Illuminate\Foundation\Events\Dispatchable;
+use Lunar\Models\Order;
+
+/**
+ * Dispatched by Modules\Core\Shipping\Extensions\OrderViewExtension's
+ * "Mark Ready" action, store-pickup branch (Order::isStorePickupOrder()
+ * === true) — staff has packed/staged the order for the customer to
+ * collect in store. Drives Modules\Core\Order\Notifications\
+ * OrderPickupReadyNotification ("come collect your order").
+ */
+class OrderReadyForPickup
+{
+    use Dispatchable;
+
+    public function __construct(
+        public readonly Order $order,
+    ) {}
+}
diff --git a/src/Order/Events/OrderRefunded.php b/src/Order/Events/OrderRefunded.php
new file mode 100644
index 0000000..de8f2eb
--- /dev/null
+++ b/src/Order/Events/OrderRefunded.php
@@ -0,0 +1,25 @@
+<?php
+
+namespace Modules\Core\Order\Events;
+
+use Illuminate\Foundation\Events\Dispatchable;
+use Lunar\Models\Order;
+use Lunar\Models\Transaction;
+
+/**
+ * Dispatched by TransactionObserver::saved() whenever a successful
+ * type=refund Transaction row is written — every payment driver (Lunar's
+ * own StripePaymentType::refund(), or a future boboko-owned driver for a
+ * provider Lunar doesn't ship) creates a new row for each refund, so
+ * `created` alone (filtered to type+success) is enough here, unlike
+ * captures which can reuse an existing row.
+ */
+class OrderRefunded
+{
+    use Dispatchable;
+
+    public function __construct(
+        public readonly Order $order,
+        public readonly Transaction $transaction,
+    ) {}
+}
diff --git a/src/Order/Events/OrderStatusChanged.php b/src/Order/Events/OrderStatusChanged.php
new file mode 100644
index 0000000..3763169
--- /dev/null
+++ b/src/Order/Events/OrderStatusChanged.php
@@ -0,0 +1,30 @@
+<?php
+
+namespace Modules\Core\Order\Events;
+
+use Illuminate\Foundation\Events\Dispatchable;
+use Lunar\Models\Order;
+
+/**
+ * Dispatched by Modules\Core\Order\Services\OrderStatusWriter::write()
+ * alongside the generic Modules\Core\Order\Events\OrderStatusUpdated
+ * (which Modules\Core\Order\Observers\OrderObserver dispatches for ANY
+ * `status` write, regardless of cause, and which
+ * OrderStatusUpdatedNotification already listens to). This event exists
+ * only because the audit trail (Modules\Core\Order\Listeners\
+ * RecordStatusTransition) needs $causeClass, which OrderStatusUpdated
+ * does not carry — OrderStatusWriter is the only writer of `status` this
+ * package has left, so it's the only place that needs to know its own
+ * cause.
+ */
+class OrderStatusChanged
+{
+    use Dispatchable;
+
+    public function __construct(
+        public readonly Order $order,
+        public readonly ?string $previousStatus,
+        public readonly string $newStatus,
+        public readonly string $causeClass,
+    ) {}
+}
diff --git a/src/Order/Events/OrderStatusUpdated.php b/src/Order/Events/OrderStatusUpdated.php
new file mode 100644
index 0000000..cf1b809
--- /dev/null
+++ b/src/Order/Events/OrderStatusUpdated.php
@@ -0,0 +1,25 @@
+<?php
+
+namespace Modules\Core\Order\Events;
+
+use Illuminate\Foundation\Events\Dispatchable;
+use Lunar\Models\Order;
+
+/**
+ * Dispatched by OrderObserver::updated() whenever an Order's status column
+ * changes, regardless of what wrote it — Filament's UpdateStatusAction,
+ * artisan tinker, a future API. Lunar's own UpdatesOrderStatus trait fires
+ * mailers inline, but only for that one admin action; this event is the
+ * general-purpose hook everything else (our own mailers, automations,
+ * derived payment/fulfillment status) should listen to instead.
+ */
+class OrderStatusUpdated
+{
+    use Dispatchable;
+
+    public function __construct(
+        public readonly Order $order,
+        public readonly ?string $previousStatus,
+        public readonly string $newStatus,
+    ) {}
+}
diff --git a/src/Order/Filament/Extensions/OrderActionsExtension.php b/src/Order/Filament/Extensions/OrderActionsExtension.php
new file mode 100644
index 0000000..d90a11c
--- /dev/null
+++ b/src/Order/Filament/Extensions/OrderActionsExtension.php
@@ -0,0 +1,210 @@
+<?php
+
+namespace Modules\Core\Order\Filament\Extensions;
+
+use Filament\Actions\Action;
+use Filament\Forms\Components\Select;
+use Filament\Notifications\Notification;
+use Filament\Support\Exceptions\Halt;
+use Lunar\Admin\Support\Extending\ViewPageExtension;
+use Lunar\Models\Transaction;
+use Modules\Core\Payment\Contracts\SupportsRefunds;
+use Modules\Core\Payment\Models\CoreTransaction;
+use Modules\Core\Payment\Services\PaymentDriverRegistry;
+use Modules\Core\Payment\Support\TransactionDriverAdapter;
+use ReflectionProperty;
+
+/**
+ * Fixes a real bug in Lunar's own admin panel, not anything specific to how
+ * boboko resolves payment drivers: ManageOrder::getRefundAction() and
+ * ::getCaptureAction() (vendor/lunarphp/lunar/.../ManageOrder.php) both
+ * report a failed refund/capture by calling, in this order:
+ *   $action->failureNotification(...); $action->failure(); $action->halt();
+ * but Filament\Actions\Concerns\InteractsWithActions::callMountedAction()
+ * only ever calls sendFailureNotification() from a match($action->getStatus())
+ * block that runs AFTER the action's call() returns normally — halt() throws
+ * Filament\Support\Exceptions\Halt, which is caught in an earlier catch block
+ * that rolls back the DB transaction and returns null, never reaching that
+ * match block. So the notification set via failureNotification() is built
+ * but never sent: the admin sees the modal just close/reset with no
+ * indication anything happened. This was always broken in Lunar; it was
+ * invisible before because nothing in this codebase's Transaction::driver()
+ * could return a real, honest failure — see Payment\Support\
+ * TransactionDriverAdapter's own docblock for that history.
+ *
+ * Fix, for refund: same notification fix, but the action() closure is
+ * replaced outright (not wrapped) rather than reused, because refund also
+ * needs a "Refund via" driver Select added to the modal (see
+ * fixRefundAction()) and the actual call routed through
+ * Payment\Support\TransactionDriverAdapter::refundVia() instead of
+ * Lunar\Models\Transaction::refund() — see fixRefundAction()'s own
+ * docblock.
+ *
+ * Fix, for capture: same notification fix, but the action() closure is
+ * also replaced outright — the actual call is routed through
+ * Payment\Support\TransactionDriverAdapter::capture() instead of
+ * Lunar\Models\Transaction::capture() (see fixCaptureAction()), so a
+ * manual backoffice capture goes through the app's own payment driver
+ * registry and dispatches Payment\Events\PaymentCaptured exactly like a
+ * checkout-time capture does — the vendor path resolved
+ * Lunar\Facades\Payments (an entirely separate, unused driver registry)
+ * and never dispatched that event, which is why Order::status used to
+ * stay stuck on 'awaiting_payment' after a manual capture even though
+ * Modules\Core\Order\Listeners\ApplyResolvedPaymentStatus now advances it
+ * on PaymentCaptured.
+ */
+class OrderActionsExtension extends ViewPageExtension
+{
+    public function headerActions(array $actions): array
+    {
+        return array_map(
+            fn (Action $action) => match ($action->getName()) {
+                'refund' => $this->fixRefundAction($action),
+                'capture' => $this->fixCaptureAction($action),
+                default => $action,
+            },
+            $actions,
+        );
+    }
+
+    /**
+     * Combines both refund-only changes on top of the failure-notification
+     * fix every action here gets: adds a "Refund via" driver Select
+     * (defaulting to the transaction's own driver) to the modal, and
+     * replaces the actual refund call with one that honours that field —
+     * calling Payment\Support\TransactionDriverAdapter::refundVia()
+     * directly (bypassing Lunar\Models\Transaction::refund(), whose fixed
+     * refund(int $amount, $notes = null) signature has no room for a
+     * driver override) whenever the admin picked a driver other than the
+     * transaction's own. When left at the default, behaviour is identical
+     * to calling $transaction->refund() — refundVia() resolves to the same
+     * driver either way.
+     *
+     * The Select is appended to Lunar's own schema closure (read via
+     * reflection — HasSchema::$schema has no public getter) rather than
+     * replacing it outright, so the transaction/amount/notes/confirm
+     * fields Lunar already built are untouched.
+     */
+    private function fixRefundAction(Action $action): Action
+    {
+        $originalSchema = $this->readProtectedProperty($action, 'schema');
+
+        $action->schema(function (array $arguments) use ($action, $originalSchema) {
+            $fields = is_callable($originalSchema)
+                ? $action->evaluate($originalSchema, $arguments)
+                : ($originalSchema ?? []);
+
+            return [
+                ...$fields,
+                Select::make('driver')
+                    ->label('Refund via')
+                    ->options(fn () => $this->refundCapableDriverLabels())
+                    ->default(fn ($get) => $this->driverKeyForTransaction($get('transaction')))
+                    ->native(false)
+                    ->required(),
+            ];
+        });
+
+        return $action->action(function (array $data, Action $action) {
+            $transaction = Transaction::find($data['transaction']);
+
+            if (! $transaction instanceof CoreTransaction) {
+                $action->failureNotification(fn () => Notification::make('refund_failure')->danger()->title('Transaction not found.'))
+                    ->sendFailureNotification();
+
+                throw new Halt;
+            }
+
+            $adapter = app(TransactionDriverAdapter::class);
+            $driverKey = $data['driver'] ?? $adapter->driverKeyFor($transaction);
+
+            $response = $adapter->refundVia($transaction, $driverKey, (int) bcmul((string) $data['amount'], (string) $transaction->order->currency->factor), $data['notes'] ?? null);
+
+            if (! $response->success) {
+                $action->failureNotification(
+                    fn () => Notification::make('refund_failure')->color('danger')->title($response->message)
+                )->sendFailureNotification();
+
+                throw new Halt;
+            }
+
+            $action->success();
+        });
+    }
+
+    /**
+     * Mirrors fixRefundAction()'s notification fix, but for the "amount"
+     * field already on the vendor schema — no extra field needed, since
+     * capture always goes back through the transaction's own original
+     * driver (there's no equivalent to refunding via a different driver).
+     */
+    private function fixCaptureAction(Action $action): Action
+    {
+        return $action->action(function (array $data, Action $action) {
+            $transaction = Transaction::find($data['transaction']);
+
+            if (! $transaction instanceof CoreTransaction) {
+                $action->failureNotification(fn () => Notification::make('capture_failure')->danger()->title('Transaction not found.'))
+                    ->sendFailureNotification();
+
+                throw new Halt;
+            }
+
+            $response = app(TransactionDriverAdapter::class)->capture(
+                $transaction,
+                (int) bcmul((string) $data['amount'], (string) $transaction->order->currency->factor),
+            );
+
+            if (! $response->success) {
+                $action->failureNotification(
+                    fn () => Notification::make('capture_failure')->color('danger')->title($response->message)
+                )->sendFailureNotification();
+
+                throw new Halt;
+            }
+
+            $action->success();
+        });
+    }
+
+    /**
+     * @return array<string, string>
+     */
+    private function refundCapableDriverLabels(): array
+    {
+        $registry = app(PaymentDriverRegistry::class);
+
+        $labels = [];
+
+        foreach ($registry->all() as $key => $driverClass) {
+            if (app($driverClass) instanceof SupportsRefunds) {
+                $labels[$key] = $registry->label($key) ?? $key;
+            }
+        }
+
+        return $labels;
+    }
+
+    private function driverKeyForTransaction(mixed $transactionId): ?string
+    {
+        if (blank($transactionId)) {
+            return null;
+        }
+
+        $transaction = Transaction::find($transactionId);
+
+        if (! $transaction instanceof CoreTransaction) {
+            return null;
+        }
+
+        return app(TransactionDriverAdapter::class)->driverKeyFor($transaction);
+    }
+
+    private function readProtectedProperty(object $object, string $property): mixed
+    {
+        $reflected = new ReflectionProperty($object, $property);
+        $reflected->setAccessible(true);
+
+        return $reflected->getValue($object);
+    }
+}
diff --git a/src/Order/Filament/Extensions/OrderItemsTableExtension.php b/src/Order/Filament/Extensions/OrderItemsTableExtension.php
new file mode 100644
index 0000000..7a8bcc8
--- /dev/null
+++ b/src/Order/Filament/Extensions/OrderItemsTableExtension.php
@@ -0,0 +1,50 @@
+<?php
+
+namespace Modules\Core\Order\Filament\Extensions;
+
+use Filament\Actions\BulkAction;
+use Filament\Support\Exceptions\Halt;
+use Filament\Tables\Table;
+use Lunar\Admin\Support\Extending\BaseExtension;
+
+/**
+ * Same fix as OrderActionsExtension, applied to the order lines
+ * table's "bulk_refund" toolbar action (Lunar\Admin\...\OrderItemsTable::
+ * getBulkRefundAction()) — see that class's docblock for the underlying
+ * Filament bug (failureNotification()+failure()+halt() never actually
+ * sends the notification, because halt()'s Halt exception is caught before
+ * Filament reaches the code that would send it).
+ */
+class OrderItemsTableExtension extends BaseExtension
+{
+    public function extendTable(Table $table): Table
+    {
+        return $table->toolbarActions(
+            array_map(
+                fn ($action) => $action instanceof BulkAction && $action->getName() === 'bulk_refund'
+                    ? $this->fixFailureNotification($action)
+                    : $action,
+                $table->getToolbarActions(),
+            ),
+        );
+    }
+
+    private function fixFailureNotification(BulkAction $action): BulkAction
+    {
+        $originalAction = $action->getActionFunction();
+
+        if ($originalAction === null) {
+            return $action;
+        }
+
+        return $action->action(function (array $arguments) use ($action, $originalAction) {
+            try {
+                return $action->evaluate($originalAction, $arguments);
+            } catch (Halt $exception) {
+                $action->sendFailureNotification();
+
+                throw $exception;
+            }
+        });
+    }
+}
diff --git a/src/Order/Filament/Extensions/OrderPaymentMethodSummaryExtension.php b/src/Order/Filament/Extensions/OrderPaymentMethodSummaryExtension.php
new file mode 100644
index 0000000..29bb4f2
--- /dev/null
+++ b/src/Order/Filament/Extensions/OrderPaymentMethodSummaryExtension.php
@@ -0,0 +1,49 @@
+<?php
+
+namespace Modules\Core\Order\Filament\Extensions;
+
+use Filament\Infolists\Components\TextEntry;
+use Lunar\Admin\Support\Extending\ViewPageExtension;
+use Lunar\Models\Order;
+use Modules\Core\Payment\Models\PaymentMethod;
+
+/**
+ * Adds a "Payment Method" entry to the order summary sidebar — previously
+ * nowhere on the order page told staff which payment method a shopper
+ * actually used. Reads Order.meta['payment_method'] (written by
+ * Modules\Core\Checkout\Services\CheckoutService::initiatePayment()), the
+ * same source Modules\Core\Order\Services\OrderStatusFlow::isCod() reads,
+ * so this entry and the "Mark Paid" action's visibility always agree on
+ * what payment method an order used. Falls back to the most recent
+ * Transaction.driver for an order placed before that field existed.
+ *
+ * Uses the extendOrderSummarySchema hook, same as the deleted 3-axis
+ * OrderStatusSummaryExtension did — see that class's git history for the
+ * hook's own docblock/rationale.
+ */
+class OrderPaymentMethodSummaryExtension extends ViewPageExtension
+{
+    public function extendOrderSummarySchema(array $schema): array
+    {
+        $schema[] = TextEntry::make('payment_method')
+            ->label('Payment method')
+            ->state(fn (Order $record) => $this->resolveLabel($record))
+            ->placeholder('—')
+            ->alignEnd();
+
+        return $schema;
+    }
+
+    private function resolveLabel(Order $record): ?string
+    {
+        $type = $record->meta['payment_method'] ?? $record->transactions()->latest('id')->value('driver');
+
+        if ($type === null) {
+            return null;
+        }
+
+        $method = PaymentMethod::where('type', $type)->first();
+
+        return $method?->translate('name') ?? $type;
+    }
+}
diff --git a/src/Order/Filament/Extensions/OrderTransactionsExtension.php b/src/Order/Filament/Extensions/OrderTransactionsExtension.php
new file mode 100644
index 0000000..d2f4390
--- /dev/null
+++ b/src/Order/Filament/Extensions/OrderTransactionsExtension.php
@@ -0,0 +1,33 @@
+<?php
+
+namespace Modules\Core\Order\Filament\Extensions;
+
+use Filament\Infolists\Components\RepeatableEntry;
+use Lunar\Admin\Support\Extending\ViewPageExtension;
+use Modules\Core\Order\Filament\Infolists\TransactionEntry;
+
+/**
+ * Swaps Lunar\Admin\Support\Infolists\Components\Transaction for our own
+ * TransactionEntry in the order page's transactions list — same component,
+ * different Blade view, so a Transaction.meta['notes'] value (written by
+ * a manual/attested driver like Payment\Drivers\BankTransferPaymentDriver)
+ * actually renders somewhere, instead of only the notes column Lunar's own
+ * view reads (see TransactionEntry's own docblock for why that column is
+ * usually empty for a successful manual payment/refund).
+ *
+ * Uses the extendTransactionsRepeatableEntry hook ManageOrder's own
+ * DisplaysTransactions trait already calls
+ * (getTransactionsRepeatableEntry() → callStaticLunarHook(
+ * 'extendTransactionsRepeatableEntry', ...)) — a class/component swap via
+ * a Lunar-provided hook, the same category of extension already used
+ * throughout CorePlugin, not a Blade view-path override.
+ */
+class OrderTransactionsExtension extends ViewPageExtension
+{
+    public function extendTransactionsRepeatableEntry(RepeatableEntry $entry): RepeatableEntry
+    {
+        return $entry->schema([
+            TransactionEntry::make('transaction_detail'),
+        ]);
+    }
+}
diff --git a/src/Order/Filament/Infolists/TransactionEntry.php b/src/Order/Filament/Infolists/TransactionEntry.php
new file mode 100644
index 0000000..e708202
--- /dev/null
+++ b/src/Order/Filament/Infolists/TransactionEntry.php
@@ -0,0 +1,30 @@
+<?php
+
+namespace Modules\Core\Order\Filament\Infolists;
+
+use Lunar\Admin\Support\Infolists\Components\Transaction as LunarTransactionEntry;
+
+/**
+ * Same component as Lunar's own Transaction infolist entry — only the
+ * Blade view differs, to also show Transaction.meta['notes'] (what
+ * Payment\Drivers\BankTransferPaymentDriver and any other manual/attested
+ * driver write a staff-entered note into — see that driver's own
+ * docblock) when the notes column itself is empty. The notes column is
+ * populated by Order\Services\TransactionRecorder from
+ * PaymentResult::$failureReason, which is only ever set on a FAILED
+ * result — a successful manual payment/refund's note would otherwise be
+ * recorded (Transaction.meta) but never shown anywhere in the admin
+ * panel, since Lunar's own view only ever reads the notes column.
+ *
+ * Registered in place of Lunar's own Transaction component via
+ * Order\Filament\Extensions\OrderTransactionsExtension's
+ * extendTransactionsRepeatableEntry() hook (see that class), not a
+ * view-path override — this is the same "swap the concrete
+ * class/component" pattern already used throughout CorePlugin
+ * (LunarPanel::extensions()), rather than shadowing Lunar's Blade file
+ * from underneath it.
+ */
+class TransactionEntry extends LunarTransactionEntry
+{
+    protected string $view = 'core::order.infolists.transaction';
+}
diff --git a/src/Order/Listeners/AdvanceFulfillmentOnCarrierCheckpoint.php b/src/Order/Listeners/AdvanceFulfillmentOnCarrierCheckpoint.php
new file mode 100644
index 0000000..e5451bc
--- /dev/null
+++ b/src/Order/Listeners/AdvanceFulfillmentOnCarrierCheckpoint.php
@@ -0,0 +1,49 @@
+<?php
+
+namespace Modules\Core\Order\Listeners;
+
+use Modules\Core\Order\Events\OrderDispatched;
+use Modules\Core\Order\Services\OrderStatusWriter;
+use Modules\Core\Shipping\Enums\TrackingStatus;
+use Modules\Core\Shipping\Events\ShipmentStatusUpdatedByCarrier;
+
+/**
+ * The automatic half of "Dispatched" — the manual fallback is the staff
+ * "Update Status" action (Modules\Core\Shipping\Extensions\
+ * OrderViewExtension). Listens to ShipmentStatusUpdatedByCarrier directly,
+ * the same event Modules\Core\Order\Listeners\DeriveOrderDeliveredFromShipment
+ * listens to.
+ *
+ * Reacts to either TrackingStatus::CollectedFromSender (the carrier
+ * collected the parcel from the merchant) or InTransit directly, for a
+ * carrier that skips straight there without a distinct collection
+ * checkpoint.
+ *
+ * Guarded to only fire from 'ready_for_dispatch' — a late/duplicate
+ * checkpoint, or an order the manual action already advanced, is a
+ * silent no-op.
+ */
+class AdvanceFulfillmentOnCarrierCheckpoint
+{
+    public function __construct(
+        private readonly OrderStatusWriter $writer,
+    ) {}
+
+    public function handle(ShipmentStatusUpdatedByCarrier $event): void
+    {
+        if ($event->shipmentInfo->status !== TrackingStatus::InTransit
+            && $event->shipmentInfo->status !== TrackingStatus::CollectedFromSender) {
+            return;
+        }
+
+        $order = $event->shipmentInfo->shipment->order;
+
+        if (! $order || $order->status !== 'ready_for_dispatch') {
+            return;
+        }
+
+        $this->writer->write($order, 'dispatched', self::class);
+
+        OrderDispatched::dispatch($order, $event->shipmentInfo);
+    }
+}
diff --git a/src/Order/Listeners/AdvanceFulfillmentOnDelivered.php b/src/Order/Listeners/AdvanceFulfillmentOnDelivered.php
new file mode 100644
index 0000000..1ca6e9b
--- /dev/null
+++ b/src/Order/Listeners/AdvanceFulfillmentOnDelivered.php
@@ -0,0 +1,43 @@
+<?php
+
+namespace Modules\Core\Order\Listeners;
+
+use Modules\Core\Order\Events\OrderDelivered;
+use Modules\Core\Order\Services\OrderStatusWriter;
+
+/**
+ * Writes `status` to 'delivered' once a carrier confirms delivery, rather
+ * than jumping straight to 'completed'. Carrier orders get a return
+ * window between delivery and completion (see Modules\Core\Order\
+ * Commands\CloseExpiredReturnWindows, which auto-completes an order once
+ * that window elapses) — 'delivered' is both "the parcel arrived" and
+ * "the return window is now open"; nothing distinguishes those as
+ * separate instants, they're the same moment, so there is only the one
+ * status value.
+ *
+ * Kept separate from Modules\Core\Order\Listeners\
+ * DeriveOrderDeliveredFromShipment, which only ever dispatches
+ * OrderDelivered — deriving "was this delivered" and acting on it by
+ * writing `status` are deliberately two different listeners.
+ *
+ * Guarded to only fire from 'dispatched' — a duplicate/late Delivered
+ * checkpoint, or an order a manual action already moved past, is a
+ * silent no-op.
+ */
+class AdvanceFulfillmentOnDelivered
+{
+    public function __construct(
+        private readonly OrderStatusWriter $writer,
+    ) {}
+
+    public function handle(OrderDelivered $event): void
+    {
+        $order = $event->order;
+
+        if ($order->status !== 'dispatched') {
+            return;
+        }
+
+        $this->writer->write($order, 'delivered', self::class);
+    }
+}
diff --git a/src/Order/Listeners/ApplyResolvedPaymentStatus.php b/src/Order/Listeners/ApplyResolvedPaymentStatus.php
new file mode 100644
index 0000000..28d6524
--- /dev/null
+++ b/src/Order/Listeners/ApplyResolvedPaymentStatus.php
@@ -0,0 +1,119 @@
+<?php
+
+namespace Modules\Core\Order\Listeners;
+
+use Illuminate\Support\Facades\Event;
+use Lunar\Models\Order;
+use Modules\Core\Checkout\Events\OrderPlaced;
+use Modules\Core\Order\Enums\PaymentStatus;
+use Modules\Core\Order\Services\OrderStatusFlow;
+use Modules\Core\Order\Services\OrderStatusWriter;
+use Modules\Core\Order\Support\OrderStatus;
+use Modules\Core\Payment\Events\PaymentAuthorized;
+use Modules\Core\Payment\Events\PaymentCaptured;
+use Modules\Core\Payment\Events\PaymentRefunded;
+
+/**
+ * Registered against PaymentCaptured, PaymentAuthorized, AND
+ * PaymentRefunded (see OrderServiceProvider).
+ *
+ * PaymentCaptured writes both Order::paid/paid_at (via
+ * OrderStatusWriter::markPaid()) AND advances `status` out of
+ * 'awaiting_payment' to the next step in the order's flow (see
+ * OrderStatusFlow::nextOptions()) — re-confirmed with the user: a
+ * captured payment, manual or via Stripe's webhook, should never leave an
+ * order sitting at 'awaiting_payment'. Only fires when status is still
+ * exactly 'awaiting_payment', so a duplicate/delayed capture event never
+ * regresses an order staff already advanced further. PaymentAuthorized
+ * only marks paid — an authorization is not yet captured funds, so
+ * status stays put until the actual capture.
+ *
+ * A refund still moves `status` (returned -> refunded/partially_refunded)
+ * — refunds are a normal step in Modules\Core\Order\Services\
+ * OrderStatusFlow's own sequence, unlike captures. Derives
+ * Refunded/PartialRefund from Modules\Core\Order\Support\OrderStatus::
+ * payment() — the existing, unchanged derived-enum logic, reused rather
+ * than reimplemented.
+ *
+ * Reads $event->context['order_id'] to find which Order this outcome
+ * belongs to — Payment has no concept of an Order.
+ *
+ * Dispatches Checkout\Events\OrderPlaced itself, once placed_at is set.
+ * Never fires from the PaymentRefunded path — a refund can only ever
+ * happen after an order was already placed.
+ *
+ * Deliberately does NOT react to PaymentVoided.
+ */
+class ApplyResolvedPaymentStatus
+{
+    public function __construct(
+        private readonly OrderStatusWriter $writer,
+        private readonly OrderStatusFlow $flow,
+    ) {}
+
+    public function handle(PaymentCaptured|PaymentAuthorized|PaymentRefunded $event): void
+    {
+        $orderId = $event->context['order_id'] ?? null;
+
+        if ($orderId === null) {
+            return;
+        }
+
+        $order = Order::findOrFail($orderId);
+
+        if ($event instanceof PaymentRefunded) {
+            $this->applyRefund($order, $event);
+
+            return;
+        }
+
+        $wasPlaced = ! blank($order->placed_at);
+
+        $this->writer->markPaid($order, $event::class);
+
+        if ($event instanceof PaymentCaptured) {
+            $this->advancePastAwaitingPayment($order, $event);
+        }
+
+        if (! $wasPlaced) {
+            $order->update(['placed_at' => $order->placed_at ?? now()]);
+            Event::dispatch(new OrderPlaced($order));
+        }
+    }
+
+    private function advancePastAwaitingPayment(Order $order, PaymentCaptured $event): void
+    {
+        if ($order->status !== 'awaiting_payment') {
+            return;
+        }
+
+        $next = $this->flow->nextOptions($order);
+        $target = array_key_first($next);
+
+        if ($target !== null) {
+            $this->writer->write($order, $target, $event::class);
+        }
+    }
+
+    /**
+     * Requires the refund Transaction row to already exist (Modules\Core\
+     * Order\Listeners\RecordPaymentTransaction must run first — see
+     * OrderServiceProvider's listener registration order for
+     * PaymentRefunded), so the relation is refreshed here rather than
+     * trusted from a possibly-stale $order instance.
+     */
+    private function applyRefund(Order $order, PaymentRefunded $event): void
+    {
+        $order->load('transactions');
+
+        $target = match (OrderStatus::payment($order)) {
+            PaymentStatus::Refunded => 'refunded',
+            PaymentStatus::PartialRefund => 'partially_refunded',
+            default => null,
+        };
+
+        if ($target !== null && $order->status !== $target) {
+            $this->writer->write($order, $target, $event::class);
+        }
+    }
+}
diff --git a/src/Order/Listeners/CompleteOrderOnPickedUp.php b/src/Order/Listeners/CompleteOrderOnPickedUp.php
new file mode 100644
index 0000000..581a9e3
--- /dev/null
+++ b/src/Order/Listeners/CompleteOrderOnPickedUp.php
@@ -0,0 +1,39 @@
+<?php
+
+namespace Modules\Core\Order\Listeners;
+
+use Modules\Core\Order\Events\OrderCompleted;
+use Modules\Core\Order\Events\OrderPickedUp;
+use Modules\Core\Order\Services\OrderStatusWriter;
+
+/**
+ * The store-pickup mirror of AdvanceFulfillmentOnDelivered — reacts to
+ * OrderPickedUp (dispatched by Modules\Core\Order\Services\
+ * OrderFulfillmentService::markPickedUp() the moment staff confirm the
+ * customer collected the order) by moving `status` straight to
+ * 'completed'. No return-window step for store-pickup orders, per the
+ * business design — unlike the carrier branch, there is no 'delivered'
+ * intermediate value on this path.
+ *
+ * Guarded to only fire from 'picked_up' — a duplicate dispatch (e.g. a
+ * stale page re-submitting the action) is a silent no-op.
+ */
+class CompleteOrderOnPickedUp
+{
+    public function __construct(
+        private readonly OrderStatusWriter $writer,
+    ) {}
+
+    public function handle(OrderPickedUp $event): void
+    {
+        $order = $event->order;
+
+        if ($order->status !== 'picked_up') {
+            return;
+        }
+
+        $this->writer->write($order, 'completed', self::class);
+
+        OrderCompleted::dispatch($order);
+    }
+}
diff --git a/src/Order/Listeners/DecrementStockOnOrderPlaced.php b/src/Order/Listeners/DecrementStockOnOrderPlaced.php
new file mode 100644
index 0000000..67e497f
--- /dev/null
+++ b/src/Order/Listeners/DecrementStockOnOrderPlaced.php
@@ -0,0 +1,64 @@
+<?php
+
+namespace Modules\Core\Order\Listeners;
+
+use Illuminate\Support\Facades\DB;
+use Lunar\Models\Product;
+use Lunar\Models\ProductVariant;
+use Modules\Core\Checkout\Events\OrderPlaced;
+
+/**
+ * The only place ProductVariant::stock is written as a result of an order —
+ * fires once per order regardless of capture_mode/driver, same reasoning as
+ * Modules\Core\Order\Notifications\OrderPlacedNotification: OrderPlaced is
+ * dispatched exactly once, from the one place an order's placed_at
+ * actually gets set (Modules\Core\Order\Listeners\ApplyResolvedPaymentStatus),
+ * so this can't double-decrement across a capture/authorize/refund sequence
+ * the way listening to PaymentCaptured directly could.
+ *
+ * Only decrements for `purchasable === 'in_stock'` variants — 'always' and
+ * 'backorder' variants are deliberately allowed to sell past (or without
+ * regard to) their stock count already (see ProductVariant::
+ * canBeFulfilledAtQuantity()), so decrementing their stock would just make
+ * that column an inaccurate, decreasingly-negative number with no purchasing
+ * consequence. Only `OrderLine::type === 'physical'` lines are considered —
+ * a digital line has no stock to decrement (ProductVariant::getType()).
+ *
+ * A single UPDATE per variant (`DB::table(...)->decrement()`), not a
+ * read-then-write on the Eloquent model — avoids a lost-update race between
+ * two orders decrementing the same variant concurrently, and skips
+ * Modules\Core\Catalog\Services\ProductIndexer::stock's staleness gap for
+ * the DB value itself even though the search index still only refreshes on
+ * the next reindex event/nightly job (see that class's own docblock).
+ *
+ * Never lets stock go negative (`GREATEST(stock - qty, 0)` via a raw
+ * expression) — an order can still be placed against a variant whose stock
+ * was already fully consumed by another concurrent order (Lunar has no
+ * stock-reservation step at cart/checkout time), so this is a best-effort
+ * count, not a hard inventory guarantee.
+ */
+class DecrementStockOnOrderPlaced
+{
+    public function handle(OrderPlaced $event): void
+    {
+        $lines = $event->order->lines()
+            ->where('type', 'physical')
+            ->where('purchasable_type', ProductVariant::morphName())
+            ->get(['purchasable_id', 'quantity']);
+
+        foreach ($lines as $line) {
+            DB::table((new ProductVariant())->getTable())
+                ->where('id', $line->purchasable_id)
+                ->where('purchasable', 'in_stock')
+                ->update([
+                    'stock' => DB::raw('GREATEST(stock - '.(int) $line->quantity.', 0)'),
+                ]);
+        }
+
+        $productIds = ProductVariant::whereIn('id', $lines->pluck('purchasable_id'))
+            ->pluck('product_id')
+            ->unique();
+
+        Product::whereIn('id', $productIds)->get()->each->searchable();
+    }
+}
diff --git a/src/Order/Listeners/DeriveOrderDeliveredFromShipment.php b/src/Order/Listeners/DeriveOrderDeliveredFromShipment.php
new file mode 100644
index 0000000..582431f
--- /dev/null
+++ b/src/Order/Listeners/DeriveOrderDeliveredFromShipment.php
@@ -0,0 +1,31 @@
+<?php
+
+namespace Modules\Core\Order\Listeners;
+
+use Modules\Core\Order\Events\OrderDelivered;
+use Modules\Core\Shipping\Enums\TrackingStatus;
+use Modules\Core\Shipping\Events\ShipmentStatusUpdatedByCarrier;
+
+/**
+ * Translates a carrier tracking checkpoint into OrderDelivered — the event
+ * OrderDeliveredNotification (via NotificationRegistry) actually listens
+ * to. Kept separate from the notification itself so the "is this checkpoint
+ * a delivery" filtering doesn't leak into notification code.
+ */
+class DeriveOrderDeliveredFromShipment
+{
+    public function handle(ShipmentStatusUpdatedByCarrier $event): void
+    {
+        if ($event->shipmentInfo->status !== TrackingStatus::Delivered) {
+            return;
+        }
+
+        $order = $event->shipmentInfo->shipment->order;
+
+        if (! $order) {
+            return;
+        }
+
+        OrderDelivered::dispatch($order, $event->shipmentInfo);
+    }
+}
diff --git a/src/Order/Listeners/MarkDeliveryFailedOnCarrierCheckpoint.php b/src/Order/Listeners/MarkDeliveryFailedOnCarrierCheckpoint.php
new file mode 100644
index 0000000..96cab9f
--- /dev/null
+++ b/src/Order/Listeners/MarkDeliveryFailedOnCarrierCheckpoint.php
@@ -0,0 +1,35 @@
+<?php
+
+namespace Modules\Core\Order\Listeners;
+
+use Modules\Core\Order\Services\OrderStatusWriter;
+use Modules\Core\Shipping\Enums\TrackingStatus;
+use Modules\Core\Shipping\Events\ShipmentStatusUpdatedByCarrier;
+
+/**
+ * Wires TrackingStatus::Failed to the 'delivery_failed' status for the
+ * first time — previously an unused enum case. Guarded to only fire from
+ * 'dispatched': a stale/duplicate checkpoint, or an order a manual action
+ * already moved past, is a silent no-op.
+ */
+class MarkDeliveryFailedOnCarrierCheckpoint
+{
+    public function __construct(
+        private readonly OrderStatusWriter $writer,
+    ) {}
+
+    public function handle(ShipmentStatusUpdatedByCarrier $event): void
+    {
+        if ($event->shipmentInfo->status !== TrackingStatus::Failed) {
+            return;
+        }
+
+        $order = $event->shipmentInfo->shipment->order;
+
+        if (! $order || $order->status !== 'dispatched') {
+            return;
+        }
+
+        $this->writer->write($order, 'delivery_failed', self::class);
+    }
+}
diff --git a/src/Order/Listeners/RecordPaymentTransaction.php b/src/Order/Listeners/RecordPaymentTransaction.php
new file mode 100644
index 0000000..ae88025
--- /dev/null
+++ b/src/Order/Listeners/RecordPaymentTransaction.php
@@ -0,0 +1,57 @@
+<?php
+
+namespace Modules\Core\Order\Listeners;
+
+use Lunar\Models\Order;
+use Modules\Core\Order\Services\TransactionRecorder;
+use Modules\Core\Payment\Events\PaymentAuthorized;
+use Modules\Core\Payment\Events\PaymentCaptured;
+use Modules\Core\Payment\Events\PaymentRefunded;
+use Modules\Core\Payment\Events\PaymentVoided;
+
+/**
+ * Writes the Transaction row for a successful payment outcome — the
+ * "record what happened" half of reacting to Payment's events, separate
+ * from Modules\Core\Order\Listeners\ApplyResolvedPaymentStatus's "update
+ * the order's status" half. Both listen to the same events for the same
+ * reason: two independent reactions to one payment outcome, neither
+ * calling the other (see docs/payments.md).
+ *
+ * Only registered against the SUCCESS events (PaymentCaptured,
+ * PaymentAuthorized, PaymentVoided, PaymentRefunded) — a Failed event
+ * never reaches here, since a failed attempt moved no money and settled
+ * nothing worth auditing as a Transaction row (see OrderServiceProvider's
+ * registration and docs/payments.md's "Explicitly out of scope" section
+ * on why no Failed-side Order reaction exists at all).
+ *
+ * Same defensive $context['order_id'] ?? null early-return as
+ * ApplyResolvedPaymentStatus — $context is caller-supplied and optional,
+ * and this listener must not crash for a future non-Checkout caller of
+ * pay()/authorize() with no order_id in its context.
+ */
+class RecordPaymentTransaction
+{
+    public function __construct(
+        private readonly TransactionRecorder $transactions,
+    ) {}
+
+    public function handle(PaymentCaptured|PaymentAuthorized|PaymentVoided|PaymentRefunded $event): void
+    {
+        $orderId = $event->context['order_id'] ?? null;
+
+        if ($orderId === null) {
+            return;
+        }
+
+        $order = Order::findOrFail($orderId);
+
+        $type = match ($event::class) {
+            PaymentAuthorized::class => 'intent',
+            PaymentCaptured::class => 'capture',
+            PaymentRefunded::class => 'refund',
+            PaymentVoided::class => 'void',
+        };
+
+        $this->transactions->record($order, $type, $event->type, $event->result);
+    }
+}
diff --git a/src/Order/Listeners/RecordStatusTransition.php b/src/Order/Listeners/RecordStatusTransition.php
new file mode 100644
index 0000000..bb70d21
--- /dev/null
+++ b/src/Order/Listeners/RecordStatusTransition.php
@@ -0,0 +1,33 @@
+<?php
+
+namespace Modules\Core\Order\Listeners;
+
+use Modules\Core\Order\Events\OrderPaidChanged;
+use Modules\Core\Order\Events\OrderStatusChanged;
+use Modules\Core\Order\Services\OrderStatusTransitionRecorder;
+
+/**
+ * The one place order_status_transitions rows actually get written —
+ * listens to OrderStatusChanged (every write of the single `status`
+ * column, via Modules\Core\Order\Services\OrderStatusWriter::write()) and
+ * OrderPaidChanged (every write of Order::paid, via
+ * OrderStatusWriter::markPaid()). paid isn't really a "status", but gets
+ * one consistent audit trail entry ('paid', with a null from_status)
+ * rather than a second, separate table.
+ */
+class RecordStatusTransition
+{
+    public function __construct(
+        private readonly OrderStatusTransitionRecorder $recorder,
+    ) {}
+
+    public function handleStatusChanged(OrderStatusChanged $event): void
+    {
+        $this->recorder->record($event->order, $event->previousStatus, $event->newStatus, $event->causeClass);
+    }
+
+    public function handlePaidChanged(OrderPaidChanged $event): void
+    {
+        $this->recorder->record($event->order, null, 'paid', $event->causeClass);
+    }
+}
diff --git a/src/Order/Models/OrderStatusTransition.php b/src/Order/Models/OrderStatusTransition.php
new file mode 100644
index 0000000..b16f28c
--- /dev/null
+++ b/src/Order/Models/OrderStatusTransition.php
@@ -0,0 +1,29 @@
+<?php
+
+namespace Modules\Core\Order\Models;
+
+use Illuminate\Database\Eloquent\Model;
+use Illuminate\Database\Eloquent\Relations\BelongsTo;
+use Lunar\Models\Order;
+
+/**
+ * One append-only row per write to Order::status (plus one synthetic
+ * 'paid' entry per Order::paid write — see
+ * Modules\Core\Order\Listeners\RecordStatusTransition) — see
+ * database/migrations/2026_09_11_000002_create_order_status_transitions_table.php
+ * and Modules\Core\Order\Services\OrderStatusTransitionRecorder, which is
+ * the only thing that ever creates a row. Never updated after creation —
+ * $timestamps is disabled since there's no updated_at column and
+ * created_at is DB-defaulted (`useCurrent()`), not Eloquent-managed.
+ */
+class OrderStatusTransition extends Model
+{
+    public $timestamps = false;
+
+    protected $guarded = [];
+
+    public function order(): BelongsTo
+    {
+        return $this->belongsTo(Order::class);
+    }
+}
diff --git a/src/Order/Notifications/OrderCapturedNotification.php b/src/Order/Notifications/OrderCapturedNotification.php
new file mode 100644
index 0000000..87f59ab
--- /dev/null
+++ b/src/Order/Notifications/OrderCapturedNotification.php
@@ -0,0 +1,50 @@
+<?php
+
+namespace Modules\Core\Order\Notifications;
+
+use Illuminate\Notifications\AnonymousNotifiable;
+use Illuminate\Notifications\Messages\MailMessage;
+use Illuminate\Support\Facades\Notification as NotificationFacade;
+use Modules\Core\Notification\BaseNotification;
+use Modules\Core\Order\Events\OrderCaptured;
+
+class OrderCapturedNotification extends BaseNotification
+{
+    public function __construct(private readonly OrderCaptured $event) {}
+
+    public static function getKey(): string
+    {
+        return 'order.captured.customer.mail';
+    }
+
+    public static function listensTo(): string
+    {
+        return OrderCaptured::class;
+    }
+
+    public function via(object $notifiable): array
+    {
+        return ['mail'];
+    }
+
+    public function notifiable(): AnonymousNotifiable
+    {
+        $order = $this->event->order;
+
+        $email = $order->billingAddress?->contact_email ?? $order->shippingAddress?->contact_email;
+
+        return NotificationFacade::route('mail', $email);
+    }
+
+    public function toMail(object $notifiable): MailMessage
+    {
+        $order = $this->event->order;
+
+        return (new MailMessage)
+            ->subject(__('Payment captured for your order :reference', ['reference' => $order->reference]))
+            ->view('core::order.notifications.captured', [
+                'reference' => $order->reference,
+                'amount' => $this->event->transaction->amount->formatted,
+            ]);
+    }
+}
diff --git a/src/Order/Notifications/OrderCompletedNotification.php b/src/Order/Notifications/OrderCompletedNotification.php
new file mode 100644
index 0000000..14ef7cd
--- /dev/null
+++ b/src/Order/Notifications/OrderCompletedNotification.php
@@ -0,0 +1,49 @@
+<?php
+
+namespace Modules\Core\Order\Notifications;
+
+use Illuminate\Notifications\AnonymousNotifiable;
+use Illuminate\Notifications\Messages\MailMessage;
+use Illuminate\Support\Facades\Notification as NotificationFacade;
+use Modules\Core\Notification\BaseNotification;
+use Modules\Core\Order\Events\OrderCompleted;
+
+class OrderCompletedNotification extends BaseNotification
+{
+    public function __construct(private readonly OrderCompleted $event) {}
+
+    public static function getKey(): string
+    {
+        return 'order.completed.customer.mail';
+    }
+
+    public static function listensTo(): string
+    {
+        return OrderCompleted::class;
+    }
+
+    public function via(object $notifiable): array
+    {
+        return ['mail'];
+    }
+
+    public function notifiable(): AnonymousNotifiable
+    {
+        $order = $this->event->order;
+
+        $email = $order->billingAddress?->contact_email ?? $order->shippingAddress?->contact_email;
+
+        return NotificationFacade::route('mail', $email);
+    }
+
+    public function toMail(object $notifiable): MailMessage
+    {
+        $order = $this->event->order;
+
+        return (new MailMessage)
+            ->subject(__('Your order :reference is complete', ['reference' => $order->reference]))
+            ->view('core::order.notifications.completed', [
+                'reference' => $order->reference,
+            ]);
+    }
+}
diff --git a/src/Order/Notifications/OrderDeliveredNotification.php b/src/Order/Notifications/OrderDeliveredNotification.php
new file mode 100644
index 0000000..8c68d47
--- /dev/null
+++ b/src/Order/Notifications/OrderDeliveredNotification.php
@@ -0,0 +1,49 @@
+<?php
+
+namespace Modules\Core\Order\Notifications;
+
+use Illuminate\Notifications\AnonymousNotifiable;
+use Illuminate\Notifications\Messages\MailMessage;
+use Illuminate\Support\Facades\Notification as NotificationFacade;
+use Modules\Core\Notification\BaseNotification;
+use Modules\Core\Order\Events\OrderDelivered;
+
+class OrderDeliveredNotification extends BaseNotification
+{
+    public function __construct(private readonly OrderDelivered $event) {}
+
+    public static function getKey(): string
+    {
+        return 'order.delivered.customer.mail';
+    }
+
+    public static function listensTo(): string
+    {
+        return OrderDelivered::class;
+    }
+
+    public function via(object $notifiable): array
+    {
+        return ['mail'];
+    }
+
+    public function notifiable(): AnonymousNotifiable
+    {
+        $order = $this->event->order;
+
+        $email = $order->billingAddress?->contact_email ?? $order->shippingAddress?->contact_email;
+
+        return NotificationFacade::route('mail', $email);
+    }
+
+    public function toMail(object $notifiable): MailMessage
+    {
+        $order = $this->event->order;
+
+        return (new MailMessage)
+            ->subject(__('Your order :reference has been delivered', ['reference' => $order->reference]))
+            ->view('core::order.notifications.delivered', [
+                'reference' => $order->reference,
+            ]);
+    }
+}
diff --git a/src/Order/Notifications/OrderDispatchedNotification.php b/src/Order/Notifications/OrderDispatchedNotification.php
new file mode 100644
index 0000000..46bc43c
--- /dev/null
+++ b/src/Order/Notifications/OrderDispatchedNotification.php
@@ -0,0 +1,54 @@
+<?php
+
+namespace Modules\Core\Order\Notifications;
+
+use Illuminate\Notifications\AnonymousNotifiable;
+use Illuminate\Notifications\Messages\MailMessage;
+use Illuminate\Support\Facades\Notification as NotificationFacade;
+use Modules\Core\Notification\BaseNotification;
+use Modules\Core\Order\Events\OrderDispatched;
+
+/**
+ * Fills a real, previously-unfilled customer-communication gap — before
+ * this redesign nothing notified a customer when their carrier order left
+ * the building at all.
+ */
+class OrderDispatchedNotification extends BaseNotification
+{
+    public function __construct(private readonly OrderDispatched $event) {}
+
+    public static function getKey(): string
+    {
+        return 'order.dispatched.customer.mail';
+    }
+
+    public static function listensTo(): string
+    {
+        return OrderDispatched::class;
+    }
+
+    public function via(object $notifiable): array
+    {
+        return ['mail'];
+    }
+
+    public function notifiable(): AnonymousNotifiable
+    {
+        $order = $this->event->order;
+
+        $email = $order->billingAddress?->contact_email ?? $order->shippingAddress?->contact_email;
+
+        return NotificationFacade::route('mail', $email);
+    }
+
+    public function toMail(object $notifiable): MailMessage
+    {
+        $order = $this->event->order;
+
+        return (new MailMessage)
+            ->subject(__('Your order :reference is on its way', ['reference' => $order->reference]))
+            ->view('core::order.notifications.dispatched', [
+                'reference' => $order->reference,
+            ]);
+    }
+}
diff --git a/src/Order/Notifications/OrderPickupReadyNotification.php b/src/Order/Notifications/OrderPickupReadyNotification.php
new file mode 100644
index 0000000..49c5844
--- /dev/null
+++ b/src/Order/Notifications/OrderPickupReadyNotification.php
@@ -0,0 +1,59 @@
+<?php
+
+namespace Modules\Core\Order\Notifications;
+
+use Illuminate\Notifications\AnonymousNotifiable;
+use Illuminate\Notifications\Messages\MailMessage;
+use Illuminate\Support\Facades\Notification as NotificationFacade;
+use Modules\Core\Notification\BaseNotification;
+use Modules\Core\Order\Events\OrderReadyForPickup;
+
+/**
+ * "Your order is ready to collect" — listens to the specific
+ * OrderReadyForPickup event (dispatched by Modules\Core\Shipping\
+ * Extensions\OrderViewExtension's "Mark Ready" action, store-pickup
+ * branch only), not the generic OrderStatusUpdated. Modules\Core\Order\
+ * Notifications\OrderStatusUpdatedNotification still separately
+ * suppresses itself for the legacy 'ready-for-pickup' status string, kept
+ * defensively even though nothing writes that literal value to
+ * Order::status anymore after this redesign.
+ */
+class OrderPickupReadyNotification extends BaseNotification
+{
+    public function __construct(private readonly OrderReadyForPickup $event) {}
+
+    public static function getKey(): string
+    {
+        return 'order.pickup_ready.customer.mail';
+    }
+
+    public static function listensTo(): string
+    {
+        return OrderReadyForPickup::class;
+    }
+
+    public function via(object $notifiable): array
+    {
+        return ['mail'];
+    }
+
+    public function notifiable(): AnonymousNotifiable
+    {
+        $order = $this->event->order;
+
+        $email = $order->billingAddress?->contact_email ?? $order->shippingAddress?->contact_email;
+
+        return NotificationFacade::route('mail', $email);
+    }
+
+    public function toMail(object $notifiable): MailMessage
+    {
+        $order = $this->event->order;
+
+        return (new MailMessage)
+            ->subject(__('Your order :reference is ready for pickup', ['reference' => $order->reference]))
+            ->view('core::order.notifications.pickup-ready', [
+                'reference' => $order->reference,
+            ]);
+    }
+}
diff --git a/src/Order/Notifications/OrderPlacedNotification.php b/src/Order/Notifications/OrderPlacedNotification.php
new file mode 100644
index 0000000..b2138c3
--- /dev/null
+++ b/src/Order/Notifications/OrderPlacedNotification.php
@@ -0,0 +1,62 @@
+<?php
+
+namespace Modules\Core\Order\Notifications;
+
+use Illuminate\Notifications\AnonymousNotifiable;
+use Illuminate\Notifications\Messages\MailMessage;
+use Illuminate\Support\Facades\Notification as NotificationFacade;
+use Modules\Core\Checkout\Events\OrderPlaced;
+use Modules\Core\Notification\BaseNotification;
+
+/**
+ * The order confirmation email — fires once, for every capture_mode and
+ * driver alike (Stripe, offline, bank-transfer), since OrderPlaced is
+ * dispatched from the one place an order's placed_at actually gets set
+ * (Modules\Core\Order\Listeners\ApplyResolvedPaymentStatus), not from a
+ * driver-specific event like OrderCaptured. Before this existed, an
+ * offline/bank-transfer order got no placement email at all — only a
+ * Stripe (auto-captured) order did, via OrderCapturedNotification, which is
+ * a different concern (payment confirmation, not order confirmation) that
+ * happens to fire at the same moment for that one driver.
+ */
+class OrderPlacedNotification extends BaseNotification
+{
+    public function __construct(private readonly OrderPlaced $event) {}
+
+    public static function getKey(): string
+    {
+        return 'order.placed.customer.mail';
+    }
+
+    public static function listensTo(): string
+    {
+        return OrderPlaced::class;
+    }
+
+    public function via(object $notifiable): array
+    {
+        return ['mail'];
+    }
+
+    public function notifiable(): AnonymousNotifiable
+    {
+        $order = $this->event->order;
+
+        $email = $order->billingAddress?->contact_email ?? $order->shippingAddress?->contact_email;
+
+        return NotificationFacade::route('mail', $email);
+    }
+
+    public function toMail(object $notifiable): MailMessage
+    {
+        $order = $this->event->order;
+
+        return (new MailMessage)
+            ->subject(__('Your order :reference is confirmed', ['reference' => $order->reference]))
+            ->view('core::order.notifications.placed', [
+                'reference' => $order->reference,
+                'total' => $order->total->formatted,
+                'lines' => $order->lines,
+            ]);
+    }
+}
diff --git a/src/Order/Notifications/OrderRefundedNotification.php b/src/Order/Notifications/OrderRefundedNotification.php
new file mode 100644
index 0000000..b5a4d3e
--- /dev/null
+++ b/src/Order/Notifications/OrderRefundedNotification.php
@@ -0,0 +1,50 @@
+<?php
+
+namespace Modules\Core\Order\Notifications;
+
+use Illuminate\Notifications\AnonymousNotifiable;
+use Illuminate\Notifications\Messages\MailMessage;
+use Illuminate\Support\Facades\Notification as NotificationFacade;
+use Modules\Core\Notification\BaseNotification;
+use Modules\Core\Order\Events\OrderRefunded;
+
+class OrderRefundedNotification extends BaseNotification
+{
+    public function __construct(private readonly OrderRefunded $event) {}
+
+    public static function getKey(): string
+    {
+        return 'order.refunded.customer.mail';
+    }
+
+    public static function listensTo(): string
+    {
+        return OrderRefunded::class;
+    }
+
+    public function via(object $notifiable): array
+    {
+        return ['mail'];
+    }
+
+    public function notifiable(): AnonymousNotifiable
+    {
+        $order = $this->event->order;
+
+        $email = $order->billingAddress?->contact_email ?? $order->shippingAddress?->contact_email;
+
+        return NotificationFacade::route('mail', $email);
+    }
+
+    public function toMail(object $notifiable): MailMessage
+    {
+        $order = $this->event->order;
+
+        return (new MailMessage)
+            ->subject(__('A refund has been issued for your order :reference', ['reference' => $order->reference]))
+            ->view('core::order.notifications.refunded', [
+                'reference' => $order->reference,
+                'amount' => $this->event->transaction->amount->formatted,
+            ]);
+    }
+}
diff --git a/src/Order/Notifications/OrderStatusUpdatedNotification.php b/src/Order/Notifications/OrderStatusUpdatedNotification.php
new file mode 100644
index 0000000..099c0a0
--- /dev/null
+++ b/src/Order/Notifications/OrderStatusUpdatedNotification.php
@@ -0,0 +1,62 @@
+<?php
+
+namespace Modules\Core\Order\Notifications;
+
+use Illuminate\Notifications\AnonymousNotifiable;
+use Illuminate\Notifications\Messages\MailMessage;
+use Illuminate\Support\Facades\Notification as NotificationFacade;
+use Modules\Core\Notification\BaseNotification;
+use Modules\Core\Order\Events\OrderStatusUpdated;
+
+class OrderStatusUpdatedNotification extends BaseNotification
+{
+    public function __construct(private readonly OrderStatusUpdated $event) {}
+
+    public static function getKey(): string
+    {
+        return 'order.status_updated.customer.mail';
+    }
+
+    public static function listensTo(): string
+    {
+        return OrderStatusUpdated::class;
+    }
+
+    /**
+     * 'ready-for-pickup' has its own, richer notification
+     * (Modules\Core\Order\Notifications\OrderPickupReadyNotification) —
+     * both listen to the same OrderStatusUpdated event via
+     * NotificationRegistry, so without this the customer would get two
+     * emails for that one transition. Returning no channels is the
+     * standard Laravel way to suppress a notification outright.
+     */
+    public function via(object $notifiable): array
+    {
+        if ($this->event->newStatus === 'ready-for-pickup') {
+            return [];
+        }
+
+        return ['mail'];
+    }
+
+    public function notifiable(): AnonymousNotifiable
+    {
+        $order = $this->event->order;
+
+        $email = $order->billingAddress?->contact_email ?? $order->shippingAddress?->contact_email;
+
+        return NotificationFacade::route('mail', $email);
+    }
+
+    public function toMail(object $notifiable): MailMessage
+    {
+        $order = $this->event->order;
+
+        return (new MailMessage)
+            ->subject(__('Your order :reference has been updated', ['reference' => $order->reference]))
+            ->view('core::order.notifications.status-updated', [
+                'reference' => $order->reference,
+                'statusLabel' => config("lunar.orders.statuses.{$order->status}.label", $order->status),
+            ]);
+    }
+}
diff --git a/src/Order/Observers/OrderObserver.php b/src/Order/Observers/OrderObserver.php
new file mode 100644
index 0000000..ea7979e
--- /dev/null
+++ b/src/Order/Observers/OrderObserver.php
@@ -0,0 +1,36 @@
+<?php
+
+namespace Modules\Core\Order\Observers;
+
+use Lunar\Models\Order;
+use Modules\Core\Order\Events\OrderStatusUpdated;
+
+/**
+ * Generically dispatches OrderStatusUpdated for ANY write to `status`,
+ * regardless of what wrote it (Modules\Core\Order\Services\
+ * OrderStatusWriter, artisan tinker, a future API) — the general-purpose
+ * hook notifications listen to. OrderStatusWriter separately dispatches
+ * its own OrderStatusChanged (carrying $causeClass, which this event does
+ * not) for the audit trail — see Modules\Core\Order\Listeners\
+ * RecordStatusTransition.
+ *
+ * Does NOT try to generically watch Order::paid — an earlier design had
+ * this observer thread a "what caused this" value through a runtime
+ * $order->statusTransitionCause property, abandoned because
+ * Lunar\Models\Order's $guarded = [] means Eloquent tries to persist any
+ * property set that way as a real column. OrderStatusWriter::markPaid()
+ * dispatches OrderPaidChanged directly instead.
+ */
+class OrderObserver
+{
+    public function updated(Order $order): void
+    {
+        if ($order->wasChanged('status')) {
+            OrderStatusUpdated::dispatch(
+                $order,
+                $order->getOriginal('status'),
+                $order->status,
+            );
+        }
+    }
+}
diff --git a/src/Order/Observers/TransactionObserver.php b/src/Order/Observers/TransactionObserver.php
new file mode 100644
index 0000000..d5b862f
--- /dev/null
+++ b/src/Order/Observers/TransactionObserver.php
@@ -0,0 +1,27 @@
+<?php
+
+namespace Modules\Core\Order\Observers;
+
+use Lunar\Models\Transaction;
+use Modules\Core\Order\Events\OrderCaptured;
+use Modules\Core\Order\Events\OrderRefunded;
+
+class TransactionObserver
+{
+    public function saved(Transaction $transaction): void
+    {
+        if (! $transaction->success) {
+            return;
+        }
+
+        if ($transaction->type === 'refund' && $transaction->wasRecentlyCreated) {
+            OrderRefunded::dispatch($transaction->order, $transaction);
+
+            return;
+        }
+
+        if ($transaction->type === 'capture' && $transaction->wasChanged('type')) {
+            OrderCaptured::dispatch($transaction->order, $transaction);
+        }
+    }
+}
diff --git a/src/Order/Services/OrderFulfillmentService.php b/src/Order/Services/OrderFulfillmentService.php
new file mode 100644
index 0000000..1874883
--- /dev/null
+++ b/src/Order/Services/OrderFulfillmentService.php
@@ -0,0 +1,169 @@
+<?php
+
+namespace Modules\Core\Order\Services;
+
+use Lunar\Models\Order;
+use Lunar\Shipping\Models\ShippingMethod;
+use Modules\Core\Order\DTOs\OrderFulfillmentResult;
+use Modules\Core\Order\Events\OrderPickedUp;
+use Modules\Core\Order\Events\OrderReadyForDispatch;
+use Modules\Core\Order\Events\OrderReadyForPickup;
+use Modules\Core\Shipping\Contracts\CarrierFulfillmentInterface;
+use Modules\Core\Shipping\DTOs\ShipmentRequest;
+use Throwable;
+
+/**
+ * The staff-facing fulfillment/return/payment workflow behind the three
+ * header actions in Modules\Core\Shipping\Extensions\OrderViewExtension
+ * ("Create Shipment", "Update Status", "Mark Paid") — every guard check,
+ * status write (via Modules\Core\Order\Services\OrderStatusWriter), and
+ * event dispatch lives here, keeping this workflow usable and testable
+ * independent of Filament.
+ *
+ * Every method re-validates its own precondition internally (not just
+ * trusted from the caller's own visible()-equivalent check) — protects
+ * against a stale page load racing a concurrent automatic transition
+ * (e.g. a carrier tracking checkpoint advancing the same order between
+ * page load and button click).
+ */
+class OrderFulfillmentService
+{
+    public function __construct(
+        private readonly OrderStatusWriter $writer,
+        private readonly OrderStatusFlow $flow,
+    ) {}
+
+    public function markReady(Order $order): OrderFulfillmentResult
+    {
+        if ($order->status !== 'processing') {
+            return OrderFulfillmentResult::failure('This order must be in Processing before it can be marked ready.');
+        }
+
+        $target = $order->isStorePickupOrder() ? 'ready_for_pickup' : 'ready_for_dispatch';
+
+        $this->writer->write($order, $target, self::class.'::markReady');
+
+        if ($order->isStorePickupOrder()) {
+            OrderReadyForPickup::dispatch($order);
+        } else {
+            OrderReadyForDispatch::dispatch($order);
+        }
+
+        return OrderFulfillmentResult::success('Order marked ready.');
+    }
+
+    public function createShipmentAndDispatch(Order $order, ShipmentRequest $request): OrderFulfillmentResult
+    {
+        if ($order->status !== 'ready_for_dispatch') {
+            return OrderFulfillmentResult::failure('This order is not ready to be dispatched.');
+        }
+
+        $service = $this->resolveFulfillmentService($order);
+
+        if (! $service) {
+            return OrderFulfillmentResult::failure('No carrier fulfillment integration is configured for this order.');
+        }
+
+        try {
+            $service->createShipment($order, $request);
+        } catch (Throwable $e) {
+            report($e);
+
+            return OrderFulfillmentResult::failure('Failed to create shipment: '.$e->getMessage());
+        }
+
+        $this->writer->write($order, 'dispatched', self::class.'::createShipmentAndDispatch');
+
+        return OrderFulfillmentResult::success('Shipment created and order dispatched.');
+    }
+
+    public function markPickedUp(Order $order): OrderFulfillmentResult
+    {
+        if ($order->status !== 'ready_for_pickup') {
+            return OrderFulfillmentResult::failure('This order is not ready for pickup.');
+        }
+
+        $this->writer->write($order, 'picked_up', self::class.'::markPickedUp');
+
+        OrderPickedUp::dispatch($order);
+
+        return OrderFulfillmentResult::success('Order marked as picked up.');
+    }
+
+    /**
+     * The general-purpose entry point for any transition with no special
+     * side effect — a manual override, not restricted to the guided next
+     * step(s), so staff can revert to an earlier status in the order's
+     * own branch. Validates $to is actually a member of
+     * OrderStatusFlow::allOptions() before writing (server-side
+     * re-validation of whatever the Select offered) — still refuses a
+     * status from the WRONG branch or an unknown value.
+     */
+    public function transitionTo(Order $order, string $to): OrderFulfillmentResult
+    {
+        if (! array_key_exists($to, $this->flow->allOptions($order))) {
+            return OrderFulfillmentResult::failure('That status is not valid for this order.');
+        }
+
+        $this->writer->write($order, $to, self::class.'::transitionTo');
+
+        return OrderFulfillmentResult::success('Order status updated.');
+    }
+
+    /**
+     * Independent of `status` entirely — offered by the single "Update
+     * Status" action regardless of current status (see
+     * OrderStatusFlow::canMarkPaid()).
+     */
+    public function markPaid(Order $order): OrderFulfillmentResult
+    {
+        if (! $this->flow->canMarkPaid($order)) {
+            return OrderFulfillmentResult::failure('This order cannot be marked paid right now.');
+        }
+
+        $this->writer->markPaid($order, self::class.'::markPaid');
+
+        return OrderFulfillmentResult::success('Order marked as paid.');
+    }
+
+    public function canCreateShipment(Order $order): bool
+    {
+        return $order->status === 'ready_for_dispatch'
+            && ! $order->isStorePickupOrder()
+            && $order->shipments()->exists() === false
+            && $this->resolveFulfillmentService($order) !== null;
+    }
+
+    /**
+     * Public wrapper around resolveCarrier() — Modules\Core\Shipping\
+     * Extensions\OrderViewExtension needs to know which carrier an order
+     * uses to branch the "Create Shipment" form (Box Now's box-size
+     * repeater vs. every other carrier's plain weight field).
+     */
+    public function carrierFor(Order $order): ?string
+    {
+        return $this->resolveCarrier($order);
+    }
+
+    private function resolveCarrier(Order $order): ?string
+    {
+        $code = $order->shippingAddress?->shipping_option;
+
+        if (! $code) {
+            return null;
+        }
+
+        return ShippingMethod::where('code', $code)->value('driver');
+    }
+
+    private function resolveFulfillmentService(Order $order): ?CarrierFulfillmentInterface
+    {
+        $carrier = $this->resolveCarrier($order);
+
+        if (! $carrier) {
+            return null;
+        }
+
+        return app(CarrierFulfillmentInterface::class, ['carrier' => $carrier]);
+    }
+}
diff --git a/src/Order/Services/OrderStatusFlow.php b/src/Order/Services/OrderStatusFlow.php
new file mode 100644
index 0000000..daa4ed5
--- /dev/null
+++ b/src/Order/Services/OrderStatusFlow.php
@@ -0,0 +1,140 @@
+<?php
+
+namespace Modules\Core\Order\Services;
+
+use Lunar\Models\Order;
+use Modules\Core\Payment\Models\PaymentMethod;
+
+/**
+ * Two status sequences — carrier, pickup (Order::isStorePickupOrder()) —
+ * NOT four. Payment method (prepaid vs. cash-on-delivery) does not affect
+ * the status SEQUENCE at all; it only affects Order::paid, an entirely
+ * separate field this class also offers a transition for (see
+ * canMarkPaid()). `status` never includes a "paid" step — COD
+ * reconciliation can happen at any point in, or after, the fulfillment
+ * journey (same-day to months later), so it cannot occupy a fixed slot in
+ * a linear sequence.
+ */
+class OrderStatusFlow
+{
+    private const FLOW_CARRIER = [
+        'awaiting_payment', 'processing', 'ready_for_dispatch', 'dispatched',
+        'delivered', 'completed', 'return_requested', 'returned',
+    ];
+
+    private const FLOW_PICKUP = [
+        'awaiting_payment', 'processing', 'ready_for_pickup', 'picked_up',
+        'completed', 'return_requested', 'returned',
+    ];
+
+    private const REFUND_OPTIONS = ['partially_refunded', 'refunded'];
+
+    private const RETURN_ELIGIBLE_FROM = ['delivered', 'picked_up', 'completed'];
+
+    public function resolveFlow(Order $order): array
+    {
+        return $order->isStorePickupOrder() ? self::FLOW_PICKUP : self::FLOW_CARRIER;
+    }
+
+    /**
+     * Order.meta['payment_method'] (written by
+     * Modules\Core\Checkout\Services\CheckoutService::initiatePayment())
+     * is the durable source of truth. Falls back to the most recent
+     * Transaction.driver (a payment TYPE slug) only if meta is missing —
+     * e.g. an order placed before this field existed.
+     */
+    public function isCod(Order $order): bool
+    {
+        $type = $order->meta['payment_method'] ?? $order->transactions()->latest('id')->value('driver');
+
+        if ($type === null) {
+            return false;
+        }
+
+        return PaymentMethod::where('type', $type)->value('driver') === 'cash-on-delivery';
+    }
+
+    /**
+     * @return array<string, string> value => label — every status in the
+     *   order's own branch (carrier or pickup), plus the refund options,
+     *   for a manual-override "New status" select. Deliberately not
+     *   filtered to nextOptions()'s guided next-step(s) — staff can jump
+     *   to any status in their branch, including reverting to an earlier
+     *   one (e.g. undoing a mistaken click). transitionTo() still
+     *   validates $to is actually a member of this set server-side.
+     */
+    public function allOptions(Order $order): array
+    {
+        $statuses = [...$this->resolveFlow($order), ...self::REFUND_OPTIONS, 'delivery_failed'];
+
+        return collect($statuses)
+            ->unique()
+            ->mapWithKeys(fn (string $status) => [$status => $this->label($status)])
+            ->all();
+    }
+
+    /**
+     * @return array<string, string> value => label — status-sequence
+     *   transitions offered as the guided next step(s). Does not include
+     *   the "mark paid" pseudo-option — see canMarkPaid().
+     */
+    public function nextOptions(Order $order): array
+    {
+        $flow = $this->resolveFlow($order);
+        $current = $order->status;
+        $position = array_search($current, $flow, true);
+
+        $options = [];
+
+        if ($position !== false && isset($flow[$position + 1])) {
+            $options[] = $flow[$position + 1];
+        }
+
+        // delivery_failed — a possible outcome of any delivery attempt,
+        // carrier flow only, checked on $current directly (not on the
+        // flow's literal next value) since it's a branch on the attempt
+        // itself, not on sequence position.
+        if ($current === 'dispatched') {
+            $options[] = 'delivery_failed';
+        }
+
+        // From delivery_failed: retry dispatch, or give up and treat as
+        // a return.
+        if ($current === 'delivery_failed') {
+            array_push($options, 'dispatched', 'return_requested');
+        }
+
+        if (in_array($current, self::RETURN_ELIGIBLE_FROM, true)) {
+            $options[] = 'return_requested';
+        }
+
+        if ($current === 'return_requested') {
+            $options[] = 'returned';
+        }
+
+        if ($current === 'returned') {
+            array_push($options, ...self::REFUND_OPTIONS);
+        }
+
+        return collect($options)
+            ->unique()
+            ->mapWithKeys(fn (string $status) => [$status => $this->label($status)])
+            ->all();
+    }
+
+    /**
+     * Whether the "mark paid" option should be offered right now —
+     * entirely independent of $order->status. True whenever this is a
+     * cash-on-delivery order and payment hasn't been recorded yet,
+     * regardless of fulfillment progress (before OR after completed).
+     */
+    public function canMarkPaid(Order $order): bool
+    {
+        return ! $order->paid && $this->isCod($order);
+    }
+
+    private function label(string $status): string
+    {
+        return (string) str($status)->replace('_', ' ')->title();
+    }
+}
diff --git a/src/Order/Services/OrderStatusTransitionRecorder.php b/src/Order/Services/OrderStatusTransitionRecorder.php
new file mode 100644
index 0000000..a6e24af
--- /dev/null
+++ b/src/Order/Services/OrderStatusTransitionRecorder.php
@@ -0,0 +1,27 @@
+<?php
+
+namespace Modules\Core\Order\Services;
+
+use Lunar\Models\Order;
+use Modules\Core\Order\Models\OrderStatusTransition;
+
+/**
+ * The single place every order_status_transitions row gets written —
+ * called by Modules\Core\Order\Listeners\RecordStatusTransition, itself
+ * listening to Modules\Core\Order\Events\OrderStatusChanged and
+ * OrderPaidChanged, dispatched by Modules\Core\Order\Services\
+ * OrderStatusWriter (the only writer of Order::status/paid left in this
+ * package).
+ */
+final class OrderStatusTransitionRecorder
+{
+    public function record(Order $order, ?string $from, string $to, string $eventClass): void
+    {
+        OrderStatusTransition::create([
+            'order_id' => $order->id,
+            'from_status' => $from,
+            'to_status' => $to,
+            'event_class' => $eventClass,
+        ]);
+    }
+}
diff --git a/src/Order/Services/OrderStatusWriter.php b/src/Order/Services/OrderStatusWriter.php
new file mode 100644
index 0000000..8f9b588
--- /dev/null
+++ b/src/Order/Services/OrderStatusWriter.php
@@ -0,0 +1,55 @@
+<?php
+
+namespace Modules\Core\Order\Services;
+
+use Lunar\Models\Order;
+use Modules\Core\Order\Events\OrderPaidChanged;
+use Modules\Core\Order\Events\OrderStatusChanged;
+
+/**
+ * The one place Order::status/paid actually get written — replaces the
+ * earlier per-axis Modules\Core\Order\Services\OrderAxisWriter now that
+ * there is a single status column plus one independent `paid` field (see
+ * Modules\Core\Order\Services\OrderStatusFlow's own docblock for why
+ * payment timing is not a status-sequence step).
+ *
+ * write() relies on Modules\Core\Order\Observers\OrderObserver to
+ * generically dispatch OrderStatusUpdated whenever `status` actually
+ * changes — there's no separate axis-changed event to dispatch here
+ * anymore, since there's only one column left to watch. markPaid() is
+ * genuinely independent: it dispatches its own OrderPaidChanged, since
+ * OrderObserver only watches `status`, not `paid`.
+ *
+ * Cause is passed explicitly through every call rather than smuggled
+ * through a runtime property on the model — Lunar\Models\Order has
+ * $guarded = [], so Eloquent treats ANY property assignment as a real
+ * column to persist; an earlier design that tried
+ * $order->statusTransitionCause = ... broke immediately with an
+ * "undefined column" error the moment ->update() ran.
+ */
+class OrderStatusWriter
+{
+    public function write(Order $order, string $to, string $causeClass): void
+    {
+        $from = $order->status;
+
+        if ($from === $to) {
+            return;
+        }
+
+        $order->update(['status' => $to]);
+
+        OrderStatusChanged::dispatch($order, $from, $to, $causeClass);
+    }
+
+    public function markPaid(Order $order, string $causeClass): void
+    {
+        if ($order->paid) {
+            return;
+        }
+
+        $order->update(['paid' => true, 'paid_at' => now()]);
+
+        OrderPaidChanged::dispatch($order, $causeClass);
+    }
+}
diff --git a/src/Order/Services/TransactionRecorder.php b/src/Order/Services/TransactionRecorder.php
new file mode 100644
index 0000000..423959a
--- /dev/null
+++ b/src/Order/Services/TransactionRecorder.php
@@ -0,0 +1,57 @@
+<?php
+
+namespace Modules\Core\Order\Services;
+
+use Lunar\Models\Order;
+use Lunar\Models\Transaction;
+use Modules\Core\Payment\DTOs\PaymentResult;
+use Modules\Core\Payment\Enums\PaymentResultStatus;
+
+/**
+ * Writes the Transaction row a Payment operation's PaymentResult becomes —
+ * the one place that translates Payment's gateway-agnostic result into
+ * Lunar's own transactions table, in the same shape lunarphp/stripe's own
+ * StoreCharges already writes (type, success, amount, reference, driver).
+ * Lives in Order, not Payment — Transaction.order_id is required, and
+ * Payment never writes to another module's models (see docs/payments.md);
+ * this is the "read the event, do the write" half of that boundary, same
+ * shape as Modules\Core\Order\Listeners\ApplyResolvedPaymentStatus.
+ *
+ * Kept as its own class (not inlined into the listener that calls it) so a
+ * future admin action (a manually-triggered capture/refund from Filament)
+ * can write a row the same way, without going through an event at all.
+ */
+class TransactionRecorder
+{
+    /**
+     * $type is Lunar's own transaction type string — 'intent' (an
+     * authorize()-produced hold), 'capture' (settled funds, whether via
+     * pay() directly or capture() settling a prior intent), 'refund',
+     * 'void' is NOT one of Lunar's three built-in types (Order::
+     * paymentStatus() only ever reads 'intent'/'capture'/'refund' — see
+     * Modules\Core\Order\Support\OrderStatus::payment()) — a void never
+     * moved money, so it's still recorded for audit but $success reflects
+     * whether the RELEASE succeeded, not a captured amount.
+     *
+     * $driver is the payment type key (e.g. 'stripe', 'cash-on-delivery'),
+     * not a class name — matches the $type PaymentCaptured/etc. events
+     * themselves carry, and what Transaction.driver already means
+     * elsewhere in this codebase (see the old, now-removed
+     * TransactionRecorder this replaces).
+     */
+    public function record(Order $order, string $type, string $driver, PaymentResult $result): Transaction
+    {
+        return $order->transactions()->create([
+            'success' => $result->status === PaymentResultStatus::Succeeded,
+            'type' => $type,
+            'driver' => $driver,
+            'amount' => $result->amount->value,
+            'reference' => $result->reference,
+            'status' => $result->status->name,
+            'notes' => $result->failureReason,
+            'card_type' => $result->meta['card_type'] ?? null,
+            'last_four' => $result->meta['last_four'] ?? null,
+            'meta' => $result->meta,
+        ]);
+    }
+}
diff --git a/src/Order/Support/OrderStatus.php b/src/Order/Support/OrderStatus.php
new file mode 100644
index 0000000..364aa6e
--- /dev/null
+++ b/src/Order/Support/OrderStatus.php
@@ -0,0 +1,93 @@
+<?php
+
+namespace Modules\Core\Order\Support;
+
+use Lunar\Models\Order;
+use Modules\Core\Order\Enums\FulfillmentStatus;
+use Modules\Core\Order\Enums\PaymentStatus;
+use Modules\Core\Shipping\Enums\TrackingStatus;
+
+/**
+ * Payment/fulfillment state, derived on read from transactions and
+ * shipments rather than stored — mirrors the logic Lunar's own
+ * ManageOrder::paymentStatus() computes as a Livewire #[Computed] method
+ * (Filament-page-only, not reusable), reimplemented here as a plain,
+ * queryable value any code can call via Order::macro() in
+ * OrderServiceProvider.
+ */
+class OrderStatus
+{
+    public static function payment(Order $order): PaymentStatus
+    {
+        $transactions = $order->transactions;
+
+        $intentTotal = $transactions
+            ->filter(fn ($t) => $t->type === 'intent' && $t->success)
+            ->sum('amount.value');
+
+        $captureTotal = $transactions
+            ->filter(fn ($t) => $t->type === 'capture' && $t->success)
+            ->sum('amount.value');
+
+        $refundTotal = $transactions
+            ->filter(fn ($t) => $t->type === 'refund' && $t->success)
+            ->sum('amount.value');
+
+        $total = $intentTotal ?: $captureTotal;
+
+        if (! $total) {
+            return PaymentStatus::Offline;
+        }
+
+        if (
+            ($refundTotal && $refundTotal < $total) ||
+            ($captureTotal && $captureTotal < $intentTotal)
+        ) {
+            return PaymentStatus::PartialRefund;
+        }
+
+        if ($refundTotal >= $total) {
+            return PaymentStatus::Refunded;
+        }
+
+        if ($captureTotal >= $intentTotal) {
+            return PaymentStatus::Captured;
+        }
+
+        return PaymentStatus::Uncaptured;
+    }
+
+    /**
+     * Reads shipments.shipmentInfo if already eager-loaded (the caller's
+     * job — e.g. Order::with('shipments.shipmentInfo')) and picks the
+     * latest checkpoint in PHP, instead of Shipment::latestShipmentInfo()'s
+     * per-shipment query — calling this across a list of orders would
+     * otherwise be an extra query per shipment.
+     */
+    public static function fulfillment(Order $order): FulfillmentStatus
+    {
+        $shipments = $order->shipments->reject(fn ($shipment) => $shipment->cancelled_at !== null);
+
+        if ($shipments->isEmpty()) {
+            return FulfillmentStatus::Unfulfilled;
+        }
+
+        $latestStatuses = $shipments->map(function ($shipment) {
+            $latest = $shipment->relationLoaded('shipmentInfo')
+                ? $shipment->shipmentInfo->sortByDesc('occurred_at')->first()
+                : $shipment->latestShipmentInfo();
+
+            return $latest?->status ?? TrackingStatus::Pending;
+        });
+
+        if ($latestStatuses->every(fn (TrackingStatus $status) => $status === TrackingStatus::Delivered)) {
+            return FulfillmentStatus::Delivered;
+        }
+
+        if ($latestStatuses->contains(fn (TrackingStatus $status) => $status === TrackingStatus::Delivered)) {
+            return FulfillmentStatus::PartiallyShipped;
+        }
+
+        return FulfillmentStatus::Shipped;
+    }
+}
diff --git a/src/Payment/Contracts/Configurable.php b/src/Payment/Contracts/Configurable.php
new file mode 100644
index 0000000..caa7da0
--- /dev/null
+++ b/src/Payment/Contracts/Configurable.php
@@ -0,0 +1,22 @@
+<?php
+
+namespace Modules\Core\Payment\Contracts;
+
+/**
+ * Every driver implements this, orthogonal to which payment operations
+ * (SupportsPay, SupportsAuthorization, ...) it supports — whether a driver
+ * can actually be used right now is a separate question from what it's
+ * capable of when it can be. An offline driver has no external dependency
+ * to be missing and always returns true; a gateway driver checks its own
+ * credentials/API key.
+ */
+interface Configurable
+{
+    /**
+     * Independent of any admin-facing enabled/disabled toggle a caller
+     * might also apply on top — this is only about whether the driver
+     * itself is usable right now (e.g. Stripe with no API key configured
+     * is never usable, regardless of any such toggle).
+     */
+    public function isConfigured(): bool;
+}
diff --git a/src/Payment/Contracts/HandlesPaymentCallback.php b/src/Payment/Contracts/HandlesPaymentCallback.php
new file mode 100644
index 0000000..bce6500
--- /dev/null
+++ b/src/Payment/Contracts/HandlesPaymentCallback.php
@@ -0,0 +1,50 @@
+<?php
+
+namespace Modules\Core\Payment\Contracts;
+
+use Modules\Core\Payment\DTOs\PaymentResult;
+
+/**
+ * The async counterpart to SupportsPay::pay()/SupportsAuthorization::
+ * authorize() — implemented only by a driver whose gateway can't resolve
+ * one of those synchronously (a redirect the shopper completes elsewhere,
+ * a webhook that arrives later). A driver whose pay()/authorize() always
+ * returns a terminal PaymentResult (Succeeded/Failed) in the same call
+ * never implements this — there is nothing left to call back.
+ *
+ * Resolves into the SAME events the original pay()/authorize() call would
+ * have produced had it resolved synchronously — PaymentCaptured/
+ * PaymentCaptureFailed for a pending pay(), PaymentAuthorized/
+ * PaymentAuthorizationFailed for a pending authorize(). Which pair
+ * applies is up to the driver to track (e.g. against whatever it stored
+ * when the original call returned Pending), not something this method's
+ * signature can express generically.
+ */
+interface HandlesPaymentCallback
+{
+    /**
+     * $reference is the gateway's own identifier for the pending attempt
+     * (the same value the original pay()/authorize() call returned via
+     * PaymentResult::$reference) — how the driver finds which attempt
+     * this callback belongs to.
+     *
+     * $data carries whatever the callback/webhook payload contains
+     * (Stripe: ['payment_intent' => $id], a redirect-based provider: its
+     * query params or POST body) — passed explicitly by the caller rather
+     * than the driver reaching into the global request(), so this works
+     * the same whether it's called from a synchronous HTTP request or an
+     * async webhook job with no active request at all.
+     *
+     * $context is opaque to the driver, carried through untouched into
+     * whichever Payment event this callback produces — see SupportsPay::
+     * pay()'s own $context param for the full reasoning. A driver that
+     * needs the ORIGINAL context from the pay()/authorize() call (a
+     * webhook's own payload carries none of its own) must have persisted
+     * it itself when that call returned Pending — Payment provides no
+     * storage for this.
+     *
+     * @param  array<string, mixed>  $data
+     * @param  array<string, mixed>  $context
+     */
+    public function handleCallback(string $reference, array $data, array $context = []): PaymentResult;
+}
diff --git a/src/Payment/Contracts/SupportsAuthorization.php b/src/Payment/Contracts/SupportsAuthorization.php
new file mode 100644
index 0000000..5f43a0d
--- /dev/null
+++ b/src/Payment/Contracts/SupportsAuthorization.php
@@ -0,0 +1,37 @@
+<?php
+
+namespace Modules\Core\Payment\Contracts;
+
+use Lunar\DataTypes\Price;
+use Modules\Core\Payment\DTOs\PaymentResult;
+
+/**
+ * A driver's hold-only operation (Mastercard's "Authorize", Nexi's
+ * ActionType::PREAUTH(), Stripe's capture_method=manual) — places a hold
+ * on the customer's payment method without moving any funds. Only a
+ * driver that also implements SupportsCaptures/SupportsVoids can do
+ * anything with the resulting hold afterward; implementing this alone
+ * with neither of those would leave the hold to simply expire
+ * (typically ~7 days, gateway-dependent) with no way to settle or release
+ * it early.
+ *
+ * A driver capable of both authorize-then-settle AND an atomic charge
+ * (most card gateways) implements this alongside SupportsPay — which one
+ * gets called for a given payment attempt is the CALLER's choice (a
+ * policy decision), not something this driver decides for itself.
+ *
+ * Dispatches Modules\Core\Payment\Events\PaymentAuthorized or
+ * PaymentAuthorizationFailed based on the returned PaymentResult's status,
+ * unless $result->status is Pending — see SupportsPay's docblock for the
+ * same async-resolution note.
+ */
+interface SupportsAuthorization
+{
+    /**
+     * Same $type/$amount/$data/$context reasoning as SupportsPay::pay().
+     *
+     * @param  array<string, mixed>  $data
+     * @param  array<string, mixed>  $context
+     */
+    public function authorize(string $type, Price $amount, array $data = [], array $context = []): PaymentResult;
+}
diff --git a/src/Payment/Contracts/SupportsCaptures.php b/src/Payment/Contracts/SupportsCaptures.php
new file mode 100644
index 0000000..dd4e6c6
--- /dev/null
+++ b/src/Payment/Contracts/SupportsCaptures.php
@@ -0,0 +1,39 @@
+<?php
+
+namespace Modules\Core\Payment\Contracts;
+
+use Lunar\DataTypes\Price;
+use Modules\Core\Payment\DTOs\PaymentResult;
+
+/**
+ * Settles a PRIOR SupportsAuthorization::authorize() hold — only ever
+ * valid against a reference that call (or a HandlesPaymentCallback
+ * resolving it) produced, never called standalone. A driver with no
+ * authorize-then-settle model at all (most redirect/wallet gateways, any
+ * offline driver) never implements this — it settles everything through
+ * SupportsPay::pay() in one step instead.
+ *
+ * Dispatches Modules\Core\Payment\Events\PaymentCaptured or
+ * PaymentCaptureFailed — the same terminal events SupportsPay::pay()
+ * produces, since "money has been captured" is the same business fact
+ * regardless of which path reached it.
+ */
+interface SupportsCaptures
+{
+    /**
+     * $reference is the identifier SupportsAuthorization::authorize()
+     * returned (PaymentResult::$reference) for the hold being settled.
+     *
+     * $amount is Lunar's own Price (never a gateway's own minor-unit
+     * scale — see PaymentResult's docblock), and lets a driver capture
+     * less than the full authorized amount (e.g. shipping less than
+     * ordered) — up to the driver/gateway whether a partial capture also
+     * releases the remainder or leaves it capturable again later
+     * (multicapture-style gateways). Required explicitly, not derived by
+     * the driver from a live gateway lookup — the caller (whatever placed
+     * the original authorize() call) already knows it.
+     *
+     * @param  array<string, mixed>  $context
+     */
+    public function capture(string $reference, Price $amount, array $context = []): PaymentResult;
+}
\ No newline at end of file
diff --git a/src/Payment/Contracts/SupportsPay.php b/src/Payment/Contracts/SupportsPay.php
new file mode 100644
index 0000000..ea3cfc2
--- /dev/null
+++ b/src/Payment/Contracts/SupportsPay.php
@@ -0,0 +1,52 @@
+<?php
+
+namespace Modules\Core\Payment\Contracts;
+
+use Lunar\DataTypes\Price;
+use Modules\Core\Payment\DTOs\PaymentResult;
+
+/**
+ * A driver's atomic charge — authorize and capture in one gateway call
+ * (Mastercard's own "Pay" operation, Nexi's ActionType::PAY(), Stripe's
+ * capture_method=automatic, or an offline driver with no gateway at all).
+ * Distinct from SupportsAuthorization: a driver that only ever settles in
+ * one step implements this and nothing else — there is no separate hold
+ * to later capture() or void().
+ *
+ * Dispatches Modules\Core\Payment\Events\PaymentCaptured or
+ * PaymentCaptureFailed based on the returned PaymentResult's status,
+ * unless $result->status is Pending (an async gateway that hasn't
+ * resolved yet — see HandlesPaymentCallback for how that gets resolved
+ * later, from a separate call this method's return value does not wait
+ * on).
+ */
+interface SupportsPay
+{
+    /**
+     * $type is the payment type key being charged (e.g. 'cash-on-delivery',
+     * 'stripe') — passed through even though most drivers only ever serve
+     * one type, because a driver shared across several types needs it to
+     * look up that type's own config.
+     *
+     * $amount is required, not optional data a caller might omit — there
+     * is no way to process a payment without knowing what to charge.
+     * Lunar's own Price (bundling its own currency) — the same money
+     * representation every other Payment contract method takes/returns,
+     * see PaymentResult's own docblock.
+     *
+     * $data carries whatever ELSE the gateway needs (customer details, a
+     * payment method token) — the caller's responsibility to assemble,
+     * since a driver has no notion of a cart or order to pull them from
+     * itself.
+     *
+     * $context is opaque to the driver — carried through untouched into
+     * whichever Payment event this call (or a later handleCallback()
+     * resolving it) produces, so the caller can correlate the result back
+     * to whatever it needs, without Payment ever needing to know what
+     * that is.
+     *
+     * @param  array<string, mixed>  $data
+     * @param  array<string, mixed>  $context
+     */
+    public function pay(string $type, Price $amount, array $data = [], array $context = []): PaymentResult;
+}
diff --git a/src/Payment/Contracts/SupportsRefunds.php b/src/Payment/Contracts/SupportsRefunds.php
new file mode 100644
index 0000000..1950f99
--- /dev/null
+++ b/src/Payment/Contracts/SupportsRefunds.php
@@ -0,0 +1,35 @@
+<?php
+
+namespace Modules\Core\Payment\Contracts;
+
+use Lunar\DataTypes\Price;
+use Modules\Core\Payment\DTOs\PaymentResult;
+
+/**
+ * Reverses settled funds — independent of SupportsCaptures/SupportsVoids:
+ * a driver that only ever settles via SupportsPay::pay() (no separate
+ * authorize step) can still implement this, since a refund targets money
+ * already taken regardless of how it got taken. A driver implements this
+ * whenever its gateway exposes any refund capability at all, whether or
+ * not it also supports authorize-then-capture.
+ *
+ * Dispatches Modules\Core\Payment\Events\PaymentRefunded or
+ * PaymentRefundFailed.
+ */
+interface SupportsRefunds
+{
+    /**
+     * $reference is the identifier the original SupportsPay::pay() or
+     * SupportsCaptures::capture() call returned for the settled funds
+     * being refunded.
+     *
+     * $amount is Lunar's own Price (never a gateway's own minor-unit
+     * scale — see PaymentResult's docblock), allowing a partial refund; a
+     * gateway may allow multiple partial refunds against one settlement,
+     * up to its own total. Required explicitly, same reasoning as
+     * SupportsCaptures::capture()'s own $amount.
+     *
+     * @param  array<string, mixed>  $context
+     */
+    public function refund(string $reference, Price $amount, array $context = []): PaymentResult;
+}
diff --git a/src/Payment/Contracts/SupportsVoids.php b/src/Payment/Contracts/SupportsVoids.php
new file mode 100644
index 0000000..8612c9f
--- /dev/null
+++ b/src/Payment/Contracts/SupportsVoids.php
@@ -0,0 +1,35 @@
+<?php
+
+namespace Modules\Core\Payment\Contracts;
+
+use Lunar\DataTypes\Price;
+use Modules\Core\Payment\DTOs\PaymentResult;
+
+/**
+ * Cancels a PRIOR SupportsAuthorization::authorize() hold WITHOUT
+ * settling it — the "actually, never mind" exit SupportsCaptures::capture()
+ * doesn't take. No funds ever moved, so this is not a refund: there is
+ * nothing to give back, only a hold to release early (rather than letting
+ * it simply expire on its own).
+ *
+ * Dispatches Modules\Core\Payment\Events\PaymentVoided or
+ * PaymentVoidFailed.
+ */
+interface SupportsVoids
+{
+    /**
+     * $reference is the identifier SupportsAuthorization::authorize()
+     * returned for the hold being released.
+     *
+     * $amount is the authorized amount being released — Lunar's own
+     * Price, same as every other Payment contract method (see
+     * PaymentResult's own docblock). Required explicitly: the caller
+     * (whatever placed the original authorize() call) already knows it,
+     * same reasoning as SupportsCaptures::capture()'s own $amount — a
+     * driver shouldn't need a live gateway lookup just to know what it's
+     * releasing.
+     *
+     * @param  array<string, mixed>  $context
+     */
+    public function void(string $reference, Price $amount, array $context = []): PaymentResult;
+}
diff --git a/src/Payment/DTOs/PaymentContinuation.php b/src/Payment/DTOs/PaymentContinuation.php
new file mode 100644
index 0000000..ba4e8fb
--- /dev/null
+++ b/src/Payment/DTOs/PaymentContinuation.php
@@ -0,0 +1,20 @@
+<?php
+
+namespace Modules\Core\Payment\DTOs;
+
+use Modules\Core\Payment\Enums\PaymentContinuationType;
+
+/**
+ * What a caller does next with a Pending PaymentResult, gateway-agnostic —
+ * see PaymentContinuationType for the two shapes. Deliberately minimal:
+ * this is NOT a return to the deleted PaymentInitiation DTO (which also
+ * carried mode/reference/meta) — reference already lives on PaymentResult
+ * itself, and mode is now this DTO's own $type.
+ */
+final class PaymentContinuation
+{
+    public function __construct(
+        public readonly PaymentContinuationType $type,
+        public readonly string $value,
+    ) {}
+}
diff --git a/src/Payment/DTOs/PaymentResult.php b/src/Payment/DTOs/PaymentResult.php
new file mode 100644
index 0000000..a6108b4
--- /dev/null
+++ b/src/Payment/DTOs/PaymentResult.php
@@ -0,0 +1,66 @@
+<?php
+
+namespace Modules\Core\Payment\DTOs;
+
+use Lunar\DataTypes\Price;
+use Modules\Core\Payment\Enums\PaymentResultStatus;
+
+/**
+ * The one shape every Payment operation (pay, authorize, capture, void,
+ * refund, handleCallback) returns, regardless of driver — a caller never
+ * writes gateway-specific branching to read the outcome.
+ *
+ * Deliberately not one-size-fits-all in richness underneath: a gateway's
+ * own response can be as sparse as Nexi's capture (just an operation id +
+ * timestamp, no echoed amount or status) or as rich as Stripe's
+ * PaymentIntent (status, amounts, decline classification, full error
+ * detail). $status/$reference/$amount are the only fields every driver can
+ * always populate — $amount from what WE requested, not necessarily
+ * echoed by the gateway. Everything else is best-effort normalization;
+ * $raw is the unconditional escape hatch for genuine audit fidelity
+ * (the untouched gateway response), so nothing is ever lost even when a
+ * gateway has no field to normalize into $failureReason/$retriable.
+ */
+final class PaymentResult
+{
+    /**
+     * @param  $amount  Lunar's own money type (Lunar\DataTypes\Price —
+     *   integer minor units bundled with its Currency), the SAME
+     *   representation every contract method takes/returns — never a
+     *   gateway's own minor-unit scale. Each driver converts at its own
+     *   boundary (e.g. StripeManager::toStripeAmount()/fromStripeAmount())
+     *   before calling out to, or after reading back from, its gateway —
+     *   Payment itself only ever speaks Lunar's Price.
+     * @param  $failureReason  a human-readable reason, only meaningful
+     *   when $status is Failed — the driver's own normalization of
+     *   whatever the gateway called it (Stripe's decline_code message,
+     *   Nexi's ErrorsInner::$description, ...).
+     * @param  $retriable  whether the caller should offer "try again" with
+     *   the SAME payment method, vs. "use a different one" — real,
+     *   gateway-native distinction on Stripe (decline_code soft/hard) and
+     *   Mastercard (merchantAdviceCode / scheme soft-decline codes), but
+     *   Nexi's OperationResult has no such signal at all. Defaults to
+     *   false (assume not safely retriable) rather than guessing when a
+     *   driver's gateway has no such classification.
+     * @param  $raw  the untouched gateway response body — always
+     *   populated, even when the gateway's own fields were too sparse to
+     *   normalize into anything above.
+     * @param  $meta  driver-specific extras that don't fit the normalized
+     *   fields above (e.g. a card's last four digits).
+     * @param  $continuation  only meaningful when $status is Pending —
+     *   what the caller does next (a redirect URL, a client secret for
+     *   frontend JS), gateway-agnostic. Null for every other status, and
+     *   for any driver whose pay()/authorize() never returns Pending
+     *   (e.g. OfflinePaymentDriver).
+     */
+    public function __construct(
+        public readonly PaymentResultStatus $status,
+        public readonly string $reference,
+        public readonly Price $amount,
+        public readonly ?string $failureReason = null,
+        public readonly bool $retriable = false,
+        public readonly array $raw = [],
+        public readonly array $meta = [],
+        public readonly ?PaymentContinuation $continuation = null,
+    ) {}
+}
\ No newline at end of file
diff --git a/src/Payment/Drivers/BankTransferPaymentDriver.php b/src/Payment/Drivers/BankTransferPaymentDriver.php
new file mode 100644
index 0000000..da8ab1f
--- /dev/null
+++ b/src/Payment/Drivers/BankTransferPaymentDriver.php
@@ -0,0 +1,74 @@
+<?php
+
+namespace Modules\Core\Payment\Drivers;
+
+use Illuminate\Support\Str;
+use Lunar\DataTypes\Price;
+use Modules\Core\Payment\Contracts\Configurable;
+use Modules\Core\Payment\Contracts\SupportsPay;
+use Modules\Core\Payment\Contracts\SupportsRefunds;
+use Modules\Core\Payment\DTOs\PaymentResult;
+use Modules\Core\Payment\Enums\PaymentResultStatus;
+use Modules\Core\Payment\Events\PaymentCaptured;
+use Modules\Core\Payment\Events\PaymentRefunded;
+
+/**
+ * Manual/attested, same trust model as OfflinePaymentDriver — there is no
+ * bank API to call, so both pay() and refund() decide success immediately
+ * on a staff member's say-so (they've already sent/received the wire
+ * outside the system). Distinct from OfflinePaymentDriver in intent: this
+ * exists so a payment taken through a DIFFERENT method (e.g.
+ * cash-on-delivery) can still be REFUNDED via bank transfer — an admin
+ * chooses this driver explicitly in the refund action, independent of
+ * which driver the original payment went through (see
+ * Payment\Support\TransactionDriverAdapter::refundVia() and
+ * Order\Filament\Extensions\OrderActionsExtension). pay() exists so
+ * the same driver also covers receiving a payment by bank transfer, but
+ * the admin UI for that (bank reference, notes, proof-of-transfer upload)
+ * is deliberately not built yet — see the follow-up work tracked from this
+ * session; pay() itself is complete and usable via the registry today.
+ *
+ * $reference is generated here for the same reason as OfflinePaymentDriver's
+ * pay(): there is no gateway to hand one back. 'notes' in $context (not
+ * $data — refund() has no $data parameter) is folded into
+ * PaymentResult::$meta, which Order\Services\TransactionRecorder::record()
+ * already writes straight into Transaction.meta with no extra plumbing.
+ */
+class BankTransferPaymentDriver implements Configurable, SupportsPay, SupportsRefunds
+{
+    /**
+     * Always true — no external dependency to be missing.
+     */
+    public function isConfigured(): bool
+    {
+        return true;
+    }
+
+    public function pay(string $type, Price $amount, array $data = [], array $context = []): PaymentResult
+    {
+        $result = new PaymentResult(
+            status: PaymentResultStatus::Succeeded,
+            reference: 'bank-transfer-'.Str::uuid(),
+            amount: $amount,
+            meta: array_filter(['notes' => $data['notes'] ?? null]),
+        );
+
+        PaymentCaptured::dispatch($type, $result, $context);
+
+        return $result;
+    }
+
+    public function refund(string $reference, Price $amount, array $context = []): PaymentResult
+    {
+        $result = new PaymentResult(
+            status: PaymentResultStatus::Succeeded,
+            reference: 'bank-transfer-'.Str::uuid(),
+            amount: $amount,
+            meta: array_filter(['notes' => $context['notes'] ?? null]),
+        );
+
+        PaymentRefunded::dispatch('bank-transfer', $result, $context);
+
+        return $result;
+    }
+}
diff --git a/src/Payment/Drivers/CashOnDeliveryPaymentDriver.php b/src/Payment/Drivers/CashOnDeliveryPaymentDriver.php
new file mode 100644
index 0000000..866167b
--- /dev/null
+++ b/src/Payment/Drivers/CashOnDeliveryPaymentDriver.php
@@ -0,0 +1,50 @@
+<?php
+
+namespace Modules\Core\Payment\Drivers;
+
+use Illuminate\Support\Str;
+use Lunar\DataTypes\Price;
+use Modules\Core\Payment\Contracts\Configurable;
+use Modules\Core\Payment\Contracts\SupportsPay;
+use Modules\Core\Payment\DTOs\PaymentResult;
+use Modules\Core\Payment\Enums\PaymentResultStatus;
+
+/**
+ * Cash-on-delivery/cash-on-pickup — the shopper pays staff in person, at
+ * delivery or pickup, not at checkout, and reconciliation can happen
+ * anywhere from same-day to months later, entirely independent of the
+ * order's fulfillment progress (this is WHY Order::paid is its own field,
+ * not a status-sequence step — see Modules\Core\Order\Services\
+ * OrderStatusFlow's own docblock).
+ *
+ * Unlike OfflinePaymentDriver (cash-in-hand, immediate capture), pay()
+ * here must NOT dispatch PaymentCaptured — doing so would immediately
+ * flip Order::paid via Modules\Core\Order\Listeners\
+ * ApplyResolvedPaymentStatus, which is exactly wrong: no money has
+ * changed hands yet. Returns PaymentResultStatus::Pending instead — the
+ * documented convention for "unresolved" (see SupportsPay's own
+ * docblock). ApplyResolvedPaymentStatus and RecordPaymentTransaction both
+ * only listen to Captured/Authorized/Voided/Refunded, so a Pending result
+ * triggers neither.
+ *
+ * Order::paid only ever becomes true for a COD order via staff explicitly
+ * marking it received (Modules\Core\Order\Services\
+ * OrderFulfillmentService::markPaid()), offered by the single "Update
+ * Status" action at any time, independent of status.
+ */
+class CashOnDeliveryPaymentDriver implements Configurable, SupportsPay
+{
+    public function isConfigured(): bool
+    {
+        return true;
+    }
+
+    public function pay(string $type, Price $amount, array $data = [], array $context = []): PaymentResult
+    {
+        return new PaymentResult(
+            status: PaymentResultStatus::Pending,
+            reference: 'cod-'.Str::uuid(),
+            amount: $amount,
+        );
+    }
+}
diff --git a/src/Payment/Drivers/OfflinePaymentDriver.php b/src/Payment/Drivers/OfflinePaymentDriver.php
new file mode 100644
index 0000000..ac008cc
--- /dev/null
+++ b/src/Payment/Drivers/OfflinePaymentDriver.php
@@ -0,0 +1,52 @@
+<?php
+
+namespace Modules\Core\Payment\Drivers;
+
+use Illuminate\Support\Str;
+use Lunar\DataTypes\Price;
+use Modules\Core\Payment\Contracts\Configurable;
+use Modules\Core\Payment\Contracts\SupportsPay;
+use Modules\Core\Payment\DTOs\PaymentResult;
+use Modules\Core\Payment\Enums\PaymentResultStatus;
+use Modules\Core\Payment\Events\PaymentCaptured;
+
+/**
+ * Cash-in-hand — a shopper paying in person at the moment of pickup, with
+ * nothing left to reconcile afterward, so capture is immediate. NOT used
+ * for cash-on-delivery, which has its own Modules\Core\Payment\Drivers\
+ * CashOnDeliveryPaymentDriver — COD payment happens at an unpredictable
+ * later time (same-day to months), so it must not capture immediately the
+ * way this driver does. There is no separate hold-then-settle model
+ * (SupportsAuthorization/SupportsCaptures/SupportsVoids) and no async
+ * resolution (HandlesPaymentCallback) — pay() decides success immediately
+ * and dispatches PaymentCaptured before returning.
+ *
+ * $reference is generated here (not supplied by a gateway, since there is
+ * none) purely so PaymentCaptured, and anything downstream keying on it,
+ * have something to identify this attempt by.
+ */
+class OfflinePaymentDriver implements Configurable, SupportsPay
+{
+    /**
+     * Always true — no external dependency to be missing.
+     */
+    public function isConfigured(): bool
+    {
+        return true;
+    }
+
+    public function pay(string $type, Price $amount, array $data = [], array $context = []): PaymentResult
+    {
+        $reference = 'offline-'.Str::uuid();
+
+        $result = new PaymentResult(
+            status: PaymentResultStatus::Succeeded,
+            reference: $reference,
+            amount: $amount,
+        );
+
+        PaymentCaptured::dispatch($type, $result, $context);
+
+        return $result;
+    }
+}
\ No newline at end of file
diff --git a/src/Payment/Drivers/StripePaymentDriver.php b/src/Payment/Drivers/StripePaymentDriver.php
new file mode 100644
index 0000000..b304a37
--- /dev/null
+++ b/src/Payment/Drivers/StripePaymentDriver.php
@@ -0,0 +1,412 @@
+<?php
+
+namespace Modules\Core\Payment\Drivers;
+
+use Lunar\DataTypes\Price;
+use Lunar\Models\Currency;
+use Modules\Core\Payment\Contracts\Configurable;
+use Modules\Core\Payment\Contracts\HandlesPaymentCallback;
+use Modules\Core\Payment\Contracts\SupportsAuthorization;
+use Modules\Core\Payment\Contracts\SupportsCaptures;
+use Modules\Core\Payment\Contracts\SupportsPay;
+use Modules\Core\Payment\Contracts\SupportsRefunds;
+use Modules\Core\Payment\Contracts\SupportsVoids;
+use Modules\Core\Payment\DTOs\PaymentContinuation;
+use Modules\Core\Payment\DTOs\PaymentResult;
+use Modules\Core\Payment\Enums\PaymentContinuationType;
+use Modules\Core\Payment\Enums\PaymentResultStatus;
+use Modules\Core\Payment\Events\PaymentAuthorizationFailed;
+use Modules\Core\Payment\Events\PaymentAuthorized;
+use Modules\Core\Payment\Events\PaymentCaptureFailed;
+use Modules\Core\Payment\Events\PaymentCaptured;
+use Modules\Core\Payment\Events\PaymentRefundFailed;
+use Modules\Core\Payment\Events\PaymentRefunded;
+use Modules\Core\Payment\Events\PaymentVoidFailed;
+use Modules\Core\Payment\Events\PaymentVoided;
+use Modules\Core\Payment\Models\StripePaymentIntent;
+use Modules\Core\Payment\Support\StripeManager;
+use Stripe\Exception\ApiErrorException;
+use Stripe\PaymentIntent;
+
+/**
+ * Talks to Stripe's PaymentIntent API directly — deliberately NOT via
+ * Lunar's own checkout flow (lunarphp/stripe, since removed — see
+ * Modules\Core\Payment\Support\StripeManager's own docblock), which took a
+ * Lunar\Models\Cart and derived amount/currency from it. Payment must
+ * never receive a Cart (see docs/payments.md) — pay()/authorize() already
+ * receive $amount explicitly as their own required Lunar Price parameter
+ * (see PaymentResult's own docblock), the caller's job to assemble, same
+ * as every other driver.
+ *
+ * Every amount that crosses this class's own boundary is converted right
+ * there: Lunar's Price -> Stripe's minor-unit int going INTO a gateway
+ * call (StripeManager::toStripeAmount()), Stripe's response amount ->
+ * Lunar's Price coming back OUT (StripeManager::fromStripeAmount()).
+ * Nothing outside this class ever sees a Stripe-scaled integer.
+ *
+ * Correlating a later handleCallback() (a separate request — a webhook)
+ * back to whatever $context identified this attempt is solved via real
+ * cart_id/order_id columns on Modules\Core\Payment\Models\
+ * StripePaymentIntent (a table this app now owns outright, already shaped
+ * for exactly this), not a generic context blob. See docs/payments.md
+ * "Async resolution" for the full reasoning.
+ */
+class StripePaymentDriver implements
+    Configurable,
+    SupportsPay,
+    SupportsAuthorization,
+    SupportsCaptures,
+    SupportsVoids,
+    SupportsRefunds,
+    HandlesPaymentCallback
+{
+    public function __construct(
+        private readonly StripeManager $stripe,
+    ) {}
+
+    /**
+     * Same key StripeManager reads its API key from — no key, no usable
+     * driver.
+     */
+    public function isConfigured(): bool
+    {
+        return filled(config('services.stripe.key'));
+    }
+    /**
+     * Atomic charge — capture_method: automatic. Stripe still frequently
+     * confirms into requires_action/requires_confirmation rather than
+     * succeeded in the same call (3-D Secure, most real cards) — Pending
+     * is a normal outcome here, not an edge case, resolved later via
+     * handleCallback().
+     */
+    public function pay(string $type, Price $amount, array $data = [], array $context = []): PaymentResult
+    {
+        return $this->createAndConfirm($type, $amount, $data, $context, captureMethod: 'automatic');
+    }
+
+    /**
+     * Hold only — capture_method: manual. Resolves to Pending or an
+     * authorized (requires_capture) intent, never succeeded directly:
+     * Stripe never captures on its own for a manual intent.
+     */
+    public function authorize(string $type, Price $amount, array $data = [], array $context = []): PaymentResult
+    {
+        return $this->createAndConfirm($type, $amount, $data, $context, captureMethod: 'manual');
+    }
+
+    private function createAndConfirm(string $type, Price $amount, array $data, array $context, string $captureMethod): PaymentResult
+    {
+        $params = [
+            'amount' => StripeManager::toStripeAmount($amount->value, $amount->currency),
+            'currency' => $amount->currency->code,
+            'capture_method' => $captureMethod,
+            'confirm' => true,
+            // 'never' rather than the client-side paymentMethodTypes: ['card']
+            // restriction alone — the storefront's Payment Element already
+            // excludes every redirect-based method, but without this Stripe
+            // still falls back to whatever's enabled in the Dashboard and
+            // demands a return_url on confirm. Setting this unconditionally
+            // (not only when no payment_method is given) matches the actual
+            // flow: a payment_method is always supplied here.
+            'automatic_payment_methods' => ['enabled' => true, 'allow_redirects' => 'never'],
+        ];
+
+        if (isset($data['payment_method'])) {
+            $params['payment_method'] = $data['payment_method'];
+        }
+
+        try {
+            $paymentIntent = $this->stripe->getClient()->paymentIntents->create($params);
+        } catch (ApiErrorException $e) {
+            return $this->declined($type, $amount, $e, $context, authorizing: $captureMethod === 'manual');
+        }
+
+        $this->rememberIntent($paymentIntent, $type, $context);
+
+        return $this->resultFromIntent($type, $paymentIntent, $amount, $context, authorizing: $captureMethod === 'manual');
+    }
+
+    public function handleCallback(string $reference, array $data, array $context = []): PaymentResult
+    {
+        [$intentModel, $type, $context] = $this->resolveIntentModel($reference, $context, $data['type'] ?? '');
+
+        $paymentIntent = $this->stripe->getClient()->paymentIntents->retrieve($reference);
+
+        $authorizing = $paymentIntent->capture_method === PaymentIntent::CAPTURE_METHOD_MANUAL;
+
+        if ($paymentIntent->status === PaymentIntent::STATUS_REQUIRES_CAPTURE && ! $authorizing) {
+            // automatic capture_method, but Stripe stopped short of
+            // capturing (rare, but the API contract allows it) — finish
+            // the job pay() started.
+            $paymentIntent = $this->stripe->getClient()->paymentIntents->capture($reference);
+        }
+
+        $intentModel?->update(['status' => $paymentIntent->status]);
+
+        $amount = $this->priceFromIntent($paymentIntent);
+
+        return $this->resultFromIntent($type, $paymentIntent, $amount, $context, $authorizing);
+    }
+
+    public function capture(string $reference, Price $amount, array $context = []): PaymentResult
+    {
+        [$intentModel, $type, $context] = $this->resolveIntentModel($reference, $context);
+
+        try {
+            $paymentIntent = $this->stripe->getClient()->paymentIntents->capture($reference, [
+                'amount_to_capture' => StripeManager::toStripeAmount($amount->value, $amount->currency),
+            ]);
+        } catch (ApiErrorException $e) {
+            $result = $this->failure($amount, $e, $reference);
+            PaymentCaptureFailed::dispatch($type, $result, $context);
+
+            return $result;
+        }
+
+        $intentModel?->update(['status' => $paymentIntent->status]);
+
+        $result = new PaymentResult(
+            status: $paymentIntent->status === PaymentIntent::STATUS_SUCCEEDED
+                ? PaymentResultStatus::Succeeded
+                : PaymentResultStatus::Failed,
+            reference: $paymentIntent->id,
+            amount: $amount,
+            raw: $paymentIntent->toArray(),
+            meta: $this->cardMetaFromIntent($paymentIntent),
+        );
+
+        $paymentIntent->status === PaymentIntent::STATUS_SUCCEEDED
+            ? PaymentCaptured::dispatch($type, $result, $context)
+            : PaymentCaptureFailed::dispatch($type, $result, $context);
+
+        return $result;
+    }
+
+    public function void(string $reference, Price $amount, array $context = []): PaymentResult
+    {
+        [$intentModel, $type, $context] = $this->resolveIntentModel($reference, $context);
+
+        try {
+            $paymentIntent = $this->stripe->getClient()->paymentIntents->cancel($reference);
+        } catch (ApiErrorException $e) {
+            $result = $this->failure($amount, $e, $reference);
+            PaymentVoidFailed::dispatch($type, $result, $context);
+
+            return $result;
+        }
+
+        $intentModel?->update(['status' => $paymentIntent->status]);
+
+        $result = new PaymentResult(
+            status: $paymentIntent->status === PaymentIntent::STATUS_CANCELED
+                ? PaymentResultStatus::Succeeded
+                : PaymentResultStatus::Failed,
+            reference: $paymentIntent->id,
+            amount: $amount,
+            raw: $paymentIntent->toArray(),
+        );
+
+        $paymentIntent->status === PaymentIntent::STATUS_CANCELED
+            ? PaymentVoided::dispatch($type, $result, $context)
+            : PaymentVoidFailed::dispatch($type, $result, $context);
+
+        return $result;
+    }
+
+    public function refund(string $reference, Price $amount, array $context = []): PaymentResult
+    {
+        [$intentModel, $type, $context] = $this->resolveIntentModel($reference, $context);
+
+        try {
+            $refund = $this->stripe->getClient()->refunds->create([
+                'payment_intent' => $reference,
+                'amount' => StripeManager::toStripeAmount($amount->value, $amount->currency),
+            ]);
+        } catch (ApiErrorException $e) {
+            $result = $this->failure($amount, $e, $reference);
+            PaymentRefundFailed::dispatch($type, $result, $context);
+
+            return $result;
+        }
+
+        $result = new PaymentResult(
+            status: $refund->status !== 'failed' ? PaymentResultStatus::Succeeded : PaymentResultStatus::Failed,
+            reference: $refund->id,
+            amount: $amount,
+            raw: $refund->toArray(),
+        );
+
+        $refund->status !== 'failed'
+            ? PaymentRefunded::dispatch($type, $result, $context)
+            : PaymentRefundFailed::dispatch($type, $result, $context);
+
+        return $result;
+    }
+
+    private function rememberIntent(PaymentIntent $paymentIntent, string $type, array $context): ?StripePaymentIntent
+    {
+        if (! ($context['cart_id'] ?? null)) {
+            return null;
+        }
+
+        return StripePaymentIntent::create([
+            'intent_id' => $paymentIntent->id,
+            'cart_id' => $context['cart_id'],
+            'order_id' => $context['order_id'] ?? null,
+            'status' => $paymentIntent->status,
+            'payment_type' => $type,
+            'context' => $context,
+        ]);
+    }
+
+    /**
+     * The one lookup every method past initiate() shares: find the
+     * StripePaymentIntent row this $reference belongs to, then recover
+     * $type/$context from it — the original context, if any, always
+     * takes precedence over whatever the caller passed in (see
+     * handleCallback()'s own note: a webhook caller usually has none of
+     * its own).
+     *
+     * $typeFallback only matters when there's no $intentModel to read
+     * payment_type from — handleCallback() has its own $data['type'] to
+     * fall back to; capture()/void()/refund() have nothing better than ''.
+     *
+     * @return array{0: ?StripePaymentIntent, 1: string, 2: array<string, mixed>}
+     */
+    private function resolveIntentModel(string $reference, array $context, string $typeFallback = ''): array
+    {
+        $intentModel = StripePaymentIntent::where('intent_id', $reference)->first();
+
+        return [
+            $intentModel,
+            $intentModel?->payment_type ?? $typeFallback,
+            $intentModel?->context ?? $context,
+        ];
+    }
+
+    /**
+     * Converts a live Stripe PaymentIntent's own amount/currency back
+     * into Lunar's Price — the one place this class reads a Stripe
+     * response's amount without already holding the Price that produced
+     * it (handleCallback() has no $data['amount'] to fall back on, unlike
+     * pay()/authorize()).
+     */
+    private function priceFromIntent(PaymentIntent $paymentIntent): Price
+    {
+        $currency = Currency::whereRaw('lower(code) = ?', [strtolower($paymentIntent->currency)])->firstOrFail();
+
+        return new Price(
+            (int) StripeManager::fromStripeAmount($paymentIntent->amount, $currency),
+            $currency,
+        );
+    }
+
+    private function resultFromIntent(
+        string $type,
+        PaymentIntent $paymentIntent,
+        Price $amount,
+        array $context,
+        bool $authorizing,
+    ): PaymentResult {
+        $status = match ($paymentIntent->status) {
+            PaymentIntent::STATUS_SUCCEEDED => PaymentResultStatus::Succeeded,
+            PaymentIntent::STATUS_REQUIRES_CAPTURE => $authorizing ? PaymentResultStatus::Succeeded : PaymentResultStatus::Pending,
+            PaymentIntent::STATUS_CANCELED => PaymentResultStatus::Failed,
+            default => PaymentResultStatus::Pending,
+        };
+
+        $continuation = $status === PaymentResultStatus::Pending
+            ? new PaymentContinuation(PaymentContinuationType::ClientSecret, $paymentIntent->client_secret)
+            : null;
+
+        $result = new PaymentResult(
+            status: $status,
+            reference: $paymentIntent->id,
+            amount: $amount,
+            failureReason: $paymentIntent->last_payment_error->message ?? null,
+            raw: $paymentIntent->toArray(),
+            meta: $status === PaymentResultStatus::Pending ? [] : $this->cardMetaFromIntent($paymentIntent),
+            continuation: $continuation,
+        );
+
+        if ($status === PaymentResultStatus::Pending) {
+            return $result;
+        }
+
+        $succeeded = $status === PaymentResultStatus::Succeeded;
+
+        if ($authorizing) {
+            $succeeded
+                ? PaymentAuthorized::dispatch($type, $result, $context)
+                : PaymentAuthorizationFailed::dispatch($type, $result, $context);
+        } else {
+            $succeeded
+                ? PaymentCaptured::dispatch($type, $result, $context)
+                : PaymentCaptureFailed::dispatch($type, $result, $context);
+        }
+
+        return $result;
+    }
+
+    /**
+     * card_type/last_four for Modules\Core\Order\Services\
+     * TransactionRecorder to map onto Transaction (see PaymentResult::
+     * $meta's own docblock) — same fields, same source
+     * (payment_method_details on the underlying Charge) as lunarphp/
+     * stripe's own StoreCharges, just reached via latest_charge instead of
+     * an order-level charge list, since this driver has no Order/Cart to
+     * enumerate charges from.
+     *
+     * @return array{card_type?: string, last_four?: string}
+     */
+    private function cardMetaFromIntent(PaymentIntent $paymentIntent): array
+    {
+        $chargeId = $paymentIntent->latest_charge;
+
+        if (blank($chargeId)) {
+            return [];
+        }
+
+        $charge = $this->stripe->getCharge(is_string($chargeId) ? $chargeId : $chargeId->id);
+
+        $paymentType = collect($charge->payment_method_details)->keys()->first();
+        $details = collect($charge->payment_method_details)->first();
+
+        if (blank($details)) {
+            return [];
+        }
+
+        return array_filter([
+            'card_type' => $details['brand'] ?? $paymentType,
+            'last_four' => $details['last4'] ?? null,
+        ], fn ($value) => filled($value));
+    }
+
+    private function declined(string $type, Price $amount, ApiErrorException $e, array $context, bool $authorizing): PaymentResult
+    {
+        $result = $this->failure($amount, $e);
+
+        $authorizing
+            ? PaymentAuthorizationFailed::dispatch($type, $result, $context)
+            : PaymentCaptureFailed::dispatch($type, $result, $context);
+
+        return $result;
+    }
+
+    private function failure(Price $amount, ApiErrorException $e, string $reference = ''): PaymentResult
+    {
+        $stripeError = $e->getError();
+
+        return new PaymentResult(
+            status: PaymentResultStatus::Failed,
+            reference: $reference ?: ($stripeError->payment_intent->id ?? ''),
+            amount: $amount,
+            failureReason: $e->getMessage(),
+            retriable: in_array($stripeError->decline_code ?? null, [
+                'do_not_honor', 'insufficient_funds', 'card_velocity_exceeded',
+                'processing_error', 'try_again_later', 'issuer_not_available',
+            ], true),
+            raw: $stripeError?->toArray() ?? [],
+        );
+    }
+}
diff --git a/src/Payment/Enums/PaymentContinuationType.php b/src/Payment/Enums/PaymentContinuationType.php
new file mode 100644
index 0000000..68cc2cc
--- /dev/null
+++ b/src/Payment/Enums/PaymentContinuationType.php
@@ -0,0 +1,17 @@
+<?php
+
+namespace Modules\Core\Payment\Enums;
+
+/**
+ * What a caller of a Pending PaymentResult needs to do next, gateway-
+ * agnostically. Only meaningful when PaymentResult::$continuation is not
+ * null (status === Pending).
+ */
+enum PaymentContinuationType
+{
+    /** Send the shopper to $continuation->value (a URL) — a redirect-based gateway. */
+    case Redirect;
+
+    /** Hand $continuation->value (a client secret) to frontend JS — Stripe Elements-style. */
+    case ClientSecret;
+}
diff --git a/src/Payment/Enums/PaymentResultStatus.php b/src/Payment/Enums/PaymentResultStatus.php
new file mode 100644
index 0000000..7b0dcbb
--- /dev/null
+++ b/src/Payment/Enums/PaymentResultStatus.php
@@ -0,0 +1,24 @@
+<?php
+
+namespace Modules\Core\Payment\Enums;
+
+/**
+ * The normalized outcome of a single gateway operation (pay, authorize,
+ * capture, void, refund) — never the gateway's own raw status string
+ * (Stripe's "succeeded", Nexi's "EXECUTED", Mastercard's own codes), so a
+ * caller never needs gateway-specific knowledge to know what happened.
+ */
+enum PaymentResultStatus
+{
+    case Succeeded;
+    case Failed;
+
+    /**
+     * The gateway hasn't resolved this operation yet and won't in the same
+     * call — e.g. Stripe's requires_action, a redirect the shopper hasn't
+     * completed. A driver returning this from initiate()/handleCallback()
+     * has not yet dispatched a terminal event; something else (a later
+     * callback) is expected to resolve it.
+     */
+    case Pending;
+}
diff --git a/src/Payment/Events/PaymentAuthorizationFailed.php b/src/Payment/Events/PaymentAuthorizationFailed.php
new file mode 100644
index 0000000..cc55b27
--- /dev/null
+++ b/src/Payment/Events/PaymentAuthorizationFailed.php
@@ -0,0 +1,27 @@
+<?php
+
+namespace Modules\Core\Payment\Events;
+
+use Illuminate\Foundation\Events\Dispatchable;
+use Modules\Core\Payment\DTOs\PaymentResult;
+
+/**
+ * Dispatched when SupportsAuthorization::authorize() (or a
+ * HandlesPaymentCallback::handleCallback() resolving it later) determines
+ * the gateway did not grant the requested hold. $result->retriable is how
+ * a listener knows whether "try again with the same method" is reasonable
+ * — see PaymentResult's own docblock.
+ */
+class PaymentAuthorizationFailed
+{
+    use Dispatchable;
+
+    /**
+     * @param  array<string, mixed>  $context
+     */
+    public function __construct(
+        public readonly string $type,
+        public readonly PaymentResult $result,
+        public readonly array $context = [],
+    ) {}
+}
diff --git a/src/Payment/Events/PaymentAuthorized.php b/src/Payment/Events/PaymentAuthorized.php
new file mode 100644
index 0000000..53f16b9
--- /dev/null
+++ b/src/Payment/Events/PaymentAuthorized.php
@@ -0,0 +1,32 @@
+<?php
+
+namespace Modules\Core\Payment\Events;
+
+use Illuminate\Foundation\Events\Dispatchable;
+use Modules\Core\Payment\DTOs\PaymentResult;
+
+/**
+ * Dispatched by a driver's SupportsAuthorization::authorize() (or, for an
+ * async gateway, HandlesPaymentCallback::handleCallback() resolving that
+ * same authorize() call later) once a hold has been placed — no funds have
+ * moved yet, see SupportsCaptures/SupportsVoids for what happens next.
+ *
+ * Carries $result (the full PaymentResult, not just a reference) plus
+ * $type and $context — same reasoning throughout Payment's events: Payment
+ * has no concept of a cart, an order, or a checkout fingerprint, so
+ * whatever a listener needs to react travels through $context untouched,
+ * opaque to Payment itself.
+ */
+class PaymentAuthorized
+{
+    use Dispatchable;
+
+    /**
+     * @param  array<string, mixed>  $context
+     */
+    public function __construct(
+        public readonly string $type,
+        public readonly PaymentResult $result,
+        public readonly array $context = [],
+    ) {}
+}
\ No newline at end of file
diff --git a/src/Payment/Events/PaymentCaptureFailed.php b/src/Payment/Events/PaymentCaptureFailed.php
new file mode 100644
index 0000000..e5f8b7d
--- /dev/null
+++ b/src/Payment/Events/PaymentCaptureFailed.php
@@ -0,0 +1,29 @@
+<?php
+
+namespace Modules\Core\Payment\Events;
+
+use Illuminate\Foundation\Events\Dispatchable;
+use Modules\Core\Payment\DTOs\PaymentResult;
+
+/**
+ * Dispatched when SupportsPay::pay() or SupportsCaptures::capture() (or a
+ * HandlesPaymentCallback::handleCallback() resolving either later) fails
+ * to take the money — whether that's a sale-mode gateway declining the
+ * charge outright, or a capture call against an existing authorization
+ * being rejected. Same terminal-event symmetry as PaymentCaptured: this is
+ * the one "capture attempt failed" event regardless of which path
+ * produced it.
+ */
+class PaymentCaptureFailed
+{
+    use Dispatchable;
+
+    /**
+     * @param  array<string, mixed>  $context
+     */
+    public function __construct(
+        public readonly string $type,
+        public readonly PaymentResult $result,
+        public readonly array $context = [],
+    ) {}
+}
\ No newline at end of file
diff --git a/src/Payment/Events/PaymentCaptured.php b/src/Payment/Events/PaymentCaptured.php
new file mode 100644
index 0000000..fb2502d
--- /dev/null
+++ b/src/Payment/Events/PaymentCaptured.php
@@ -0,0 +1,31 @@
+<?php
+
+namespace Modules\Core\Payment\Events;
+
+use Illuminate\Foundation\Events\Dispatchable;
+use Modules\Core\Payment\DTOs\PaymentResult;
+
+/**
+ * The one "money has actually been taken" event, dispatched from either of
+ * two different call paths that end at the same business fact:
+ *   - SupportsPay::pay() — an atomic authorize+capture gateway call
+ *     (Mastercard's "Pay", Stripe's capture_method=automatic, an offline
+ *     driver's immediate success).
+ *   - SupportsCaptures::capture() — settling a PRIOR authorize() hold.
+ * Whether the money moved in one gateway call or two is a driver-internal
+ * detail; a listener reacting to "a payment has been captured" never
+ * needs to know or care which path produced this event.
+ */
+class PaymentCaptured
+{
+    use Dispatchable;
+
+    /**
+     * @param  array<string, mixed>  $context
+     */
+    public function __construct(
+        public readonly string $type,
+        public readonly PaymentResult $result,
+        public readonly array $context = [],
+    ) {}
+}
\ No newline at end of file
diff --git a/src/Payment/Events/PaymentMethodCreated.php b/src/Payment/Events/PaymentMethodCreated.php
new file mode 100644
index 0000000..092cdc0
--- /dev/null
+++ b/src/Payment/Events/PaymentMethodCreated.php
@@ -0,0 +1,12 @@
+<?php
+
+namespace Modules\Core\Payment\Events;
+
+use Modules\Core\Payment\Models\PaymentMethod;
+
+class PaymentMethodCreated
+{
+    public function __construct(
+        public readonly PaymentMethod $method,
+    ) {}
+}
diff --git a/src/Payment/Events/PaymentMethodDeleted.php b/src/Payment/Events/PaymentMethodDeleted.php
new file mode 100644
index 0000000..d4a2f16
--- /dev/null
+++ b/src/Payment/Events/PaymentMethodDeleted.php
@@ -0,0 +1,15 @@
+<?php
+
+namespace Modules\Core\Payment\Events;
+
+class PaymentMethodDeleted
+{
+    /**
+     * @param  array<string, mixed>  $method  Snapshot of the deleted row —
+     *   already gone from the database by dispatch time, so this can't be
+     *   a fresh PaymentMethod model instance.
+     */
+    public function __construct(
+        public readonly array $method,
+    ) {}
+}
diff --git a/src/Payment/Events/PaymentMethodUpdated.php b/src/Payment/Events/PaymentMethodUpdated.php
new file mode 100644
index 0000000..3e6e50b
--- /dev/null
+++ b/src/Payment/Events/PaymentMethodUpdated.php
@@ -0,0 +1,17 @@
+<?php
+
+namespace Modules\Core\Payment\Events;
+
+use Modules\Core\Payment\Models\PaymentMethod;
+
+class PaymentMethodUpdated
+{
+    /**
+     * @param  array<string, mixed>  $old  Snapshot of the changed attributes
+     *   before the update.
+     */
+    public function __construct(
+        public readonly PaymentMethod $method,
+        public readonly array $old,
+    ) {}
+}
diff --git a/src/Payment/Events/PaymentMethodsReordered.php b/src/Payment/Events/PaymentMethodsReordered.php
new file mode 100644
index 0000000..e327320
--- /dev/null
+++ b/src/Payment/Events/PaymentMethodsReordered.php
@@ -0,0 +1,17 @@
+<?php
+
+namespace Modules\Core\Payment\Events;
+
+class PaymentMethodsReordered
+{
+    /**
+     * @param  array<int, int>  $ids  PaymentMethod ids, in their new order —
+     *   the same array Filament's own reorderTable() already wrote to the
+     *   database directly (bulk SQL, not PaymentMethodService::update() —
+     *   see PaymentMethodResource's own docblock for why this is the one
+     *   PaymentMethod write that doesn't go through the service).
+     */
+    public function __construct(
+        public readonly array $ids,
+    ) {}
+}
diff --git a/src/Payment/Events/PaymentRefundFailed.php b/src/Payment/Events/PaymentRefundFailed.php
new file mode 100644
index 0000000..faaab7f
--- /dev/null
+++ b/src/Payment/Events/PaymentRefundFailed.php
@@ -0,0 +1,24 @@
+<?php
+
+namespace Modules\Core\Payment\Events;
+
+use Illuminate\Foundation\Events\Dispatchable;
+use Modules\Core\Payment\DTOs\PaymentResult;
+
+/**
+ * Dispatched when SupportsRefunds::refund() fails to return settled funds
+ * — e.g. the gateway rejects refunding more than was originally captured.
+ */
+class PaymentRefundFailed
+{
+    use Dispatchable;
+
+    /**
+     * @param  array<string, mixed>  $context
+     */
+    public function __construct(
+        public readonly string $type,
+        public readonly PaymentResult $result,
+        public readonly array $context = [],
+    ) {}
+}
\ No newline at end of file
diff --git a/src/Payment/Events/PaymentRefunded.php b/src/Payment/Events/PaymentRefunded.php
new file mode 100644
index 0000000..cc6c74c
--- /dev/null
+++ b/src/Payment/Events/PaymentRefunded.php
@@ -0,0 +1,27 @@
+<?php
+
+namespace Modules\Core\Payment\Events;
+
+use Illuminate\Foundation\Events\Dispatchable;
+use Modules\Core\Payment\DTOs\PaymentResult;
+
+/**
+ * Dispatched by SupportsRefunds::refund() once settled funds (from a prior
+ * pay() or capture()) have actually been returned — full or partial.
+ * Independent of whether the original settlement was a sale or an
+ * authorize-then-capture: a refund only ever targets money that was
+ * genuinely taken, regardless of how it got taken.
+ */
+class PaymentRefunded
+{
+    use Dispatchable;
+
+    /**
+     * @param  array<string, mixed>  $context
+     */
+    public function __construct(
+        public readonly string $type,
+        public readonly PaymentResult $result,
+        public readonly array $context = [],
+    ) {}
+}
\ No newline at end of file
diff --git a/src/Payment/Events/PaymentVoidFailed.php b/src/Payment/Events/PaymentVoidFailed.php
new file mode 100644
index 0000000..4bde3e2
--- /dev/null
+++ b/src/Payment/Events/PaymentVoidFailed.php
@@ -0,0 +1,25 @@
+<?php
+
+namespace Modules\Core\Payment\Events;
+
+use Illuminate\Foundation\Events\Dispatchable;
+use Modules\Core\Payment\DTOs\PaymentResult;
+
+/**
+ * Dispatched when SupportsVoids::void() fails to release a prior
+ * authorization — e.g. the hold already expired or was already captured,
+ * so there was nothing left to void.
+ */
+class PaymentVoidFailed
+{
+    use Dispatchable;
+
+    /**
+     * @param  array<string, mixed>  $context
+     */
+    public function __construct(
+        public readonly string $type,
+        public readonly PaymentResult $result,
+        public readonly array $context = [],
+    ) {}
+}
\ No newline at end of file
diff --git a/src/Payment/Events/PaymentVoided.php b/src/Payment/Events/PaymentVoided.php
new file mode 100644
index 0000000..d2d28b6
--- /dev/null
+++ b/src/Payment/Events/PaymentVoided.php
@@ -0,0 +1,27 @@
+<?php
+
+namespace Modules\Core\Payment\Events;
+
+use Illuminate\Foundation\Events\Dispatchable;
+use Modules\Core\Payment\DTOs\PaymentResult;
+
+/**
+ * Dispatched by SupportsVoids::void() once a prior authorization hold has
+ * been released without ever settling — the "actually, never mind" exit
+ * from an authorize() that SupportsCaptures::capture() would otherwise
+ * have settled. No funds ever moved, so this is distinct from
+ * PaymentRefunded (which reverses money that was actually taken).
+ */
+class PaymentVoided
+{
+    use Dispatchable;
+
+    /**
+     * @param  array<string, mixed>  $context
+     */
+    public function __construct(
+        public readonly string $type,
+        public readonly PaymentResult $result,
+        public readonly array $context = [],
+    ) {}
+}
diff --git a/src/Payment/Filament/Resources/PaymentMethodResource.php b/src/Payment/Filament/Resources/PaymentMethodResource.php
new file mode 100644
index 0000000..5a441d6
--- /dev/null
+++ b/src/Payment/Filament/Resources/PaymentMethodResource.php
@@ -0,0 +1,266 @@
+<?php
+
+namespace Modules\Core\Payment\Filament\Resources;
+
+use Filament\Actions\Action;
+use Filament\Forms\Components\Select;
+use Filament\Forms\Components\TextInput;
+use Filament\Resources\Resource;
+use Filament\Schemas\Components\Component;
+use Filament\Tables\Columns\IconColumn;
+use Filament\Tables\Columns\TextColumn;
+use Filament\Tables\Columns\ToggleColumn;
+use Filament\Tables\Table;
+use Illuminate\Support\Facades\Event;
+use Lunar\Admin\Support\Forms\Components\TranslatedText;
+use Modules\Core\Payment\Contracts\Configurable;
+use Modules\Core\Payment\Events\PaymentMethodsReordered;
+use Modules\Core\Payment\Filament\Resources\PaymentMethodResource\Pages\ListPaymentMethods;
+use Modules\Core\Payment\Models\PaymentMethod;
+use Modules\Core\Payment\Services\PaymentDriverRegistry;
+use Modules\Core\Payment\Services\PaymentMethodCache;
+use Modules\Core\Payment\Services\PaymentMethodService;
+
+/**
+ * The DB-instance layer for Payment (see docs/payments.md) — admin
+ * creatable/deletable, same as Lunar's own ShippingMethodResource. A row's
+ * `driver` is picked from a Select populated by
+ * PaymentDriverRegistry::labels() (mirrors Modules\Core\Shipping\
+ * Extensions\ShippingMethodResourceExtension::driverSelect()'s use of
+ * Shipping::getSupportedDrivers()), not a hardcoded options list, and
+ * never the raw driver class name — a third-party driver registered from
+ * its own package's service provider shows up here with no change to
+ * this class.
+ *
+ * Every write goes through Modules\Core\Payment\Services\
+ * PaymentMethodService — create/edit/delete/the enabled toggle all call
+ * it, not PaymentMethod::create()/update()/delete() directly, so cache
+ * invalidation and event dispatch happen in one place. The ONE exception
+ * is drag-to-reorder: Filament's own reorderTable() always writes the new
+ * `position` values via its own raw bulk SQL query before our
+ * afterReordering() hook ever runs — there is no seam to route that
+ * specific write through the service (short of disabling drag-reorder
+ * entirely and rebuilding it from scratch), so that hook only forgets the
+ * cache and dispatches PaymentMethodsReordered; the data itself is
+ * already correct in the database by the time it fires.
+ *
+ * `driver_missing_at` (set by the `boboko:payment:sync-drivers` command
+ * when a row's driver no longer resolves) drives the "Driver status"
+ * column, deliberately distinct from `enabled` — an admin needs to tell
+ * "I turned this off" apart from "this driver isn't usable right now" at
+ * a glance, not have both look like the same disabled state. That column
+ * also folds in Configurable::isConfigured() (e.g. Stripe with no API key
+ * set) — a class-resolves-but-isn't-usable state that CheckoutService::
+ * getPaymentMethods() filters out identically to a missing driver, so an
+ * admin needs the same at-a-glance warning for it, not just a silently
+ * absent checkout option.
+ *
+ */
+class PaymentMethodResource extends Resource
+{
+    protected static ?string $model = PaymentMethod::class;
+
+    protected static string|\BackedEnum|null $navigationIcon = 'heroicon-o-credit-card';
+
+    protected static string|\UnitEnum|null $navigationGroup = 'Settings';
+
+    protected static ?string $modelLabel = 'Payment Method';
+
+    protected static ?string $pluralModelLabel = 'Payment Methods';
+
+    public static function table(Table $table): Table
+    {
+        return $table
+            ->columns([
+                TextColumn::make('position')
+                    ->label('Order')
+                    ->sortable(),
+                TextColumn::make('name')
+                    ->label('Name')
+                    ->state(fn (PaymentMethod $record) => $record->translate('name')),
+                TextColumn::make('type')
+                    ->label('Type'),
+                TextColumn::make('driver')
+                    ->label('Driver')
+                    ->formatStateUsing(fn (?string $state) => static::driverLabel($state)),
+                IconColumn::make('driver_missing_at')
+                    ->label('Driver status')
+                    ->boolean()
+                    ->state(fn (PaymentMethod $record) => ! $record->driver_missing_at && static::driverIsConfigured($record->driver))
+                    ->trueIcon('heroicon-o-check-circle')
+                    ->falseIcon('heroicon-o-exclamation-triangle')
+                    ->trueColor('success')
+                    ->falseColor('danger')
+                    ->tooltip(fn (PaymentMethod $record) => static::driverStatusTooltip($record)),
+                ToggleColumn::make('enabled')
+                    ->label('Enabled')
+                    ->updateStateUsing(fn (PaymentMethod $record, $state) => app(PaymentMethodService::class)
+                        ->update($record, ['enabled' => $state])),
+                TextColumn::make('data.fee')
+                    ->label('Fee')
+                    ->formatStateUsing(fn (?int $state) => $state
+                        ? number_format($state / 100, 2)
+                        : '—'),
+                TextColumn::make('updated_at')
+                    ->label('Last updated')
+                    ->dateTime(),
+            ])
+            ->reorderable('position')
+            ->afterReordering(function (array $order) {
+                app(PaymentMethodCache::class)->forget();
+
+                Event::dispatch(new PaymentMethodsReordered(array_map('intval', array_values($order))));
+            })
+            ->recordActions([
+                static::editAction(),
+                static::editFeeAction(),
+                static::deleteAction(),
+            ])
+            ->defaultSort('position');
+    }
+
+    /**
+     * @return array<Component>
+     */
+    public static function getFormComponents(): array
+    {
+        return [
+            TranslatedText::make('name')
+                ->label('Name')
+                ->required(),
+            TextInput::make('type')
+                ->label('Type')
+                ->helperText('Machine-facing slug — stored on the cart/order, used by other code to identify this method. Cannot be changed once orders reference it.')
+                ->required()
+                ->unique(ignoreRecord: true)
+                ->maxLength(255),
+            static::getDriverFormComponent(),
+            Select::make('capture_mode')
+                ->label('Capture mode')
+                ->helperText('Whether checkout charges immediately, or places a hold to settle later.')
+                ->options([
+                    'pay' => 'Charge immediately',
+                    'authorize' => 'Hold now, charge later',
+                ])
+                ->default('pay')
+                ->live()
+                ->required(),
+        ];
+    }
+
+    public static function getDriverFormComponent(): Component
+    {
+        return Select::make('driver')
+            ->label('Driver')
+            ->options(fn () => app(PaymentDriverRegistry::class)->labels())
+            ->required();
+    }
+
+    public static function getPages(): array
+    {
+        return [
+            'index' => ListPaymentMethods::route('/'),
+        ];
+    }
+
+    public static function canCreate(): bool
+    {
+        return true;
+    }
+
+    public static function canDelete($record = null): bool
+    {
+        return true;
+    }
+
+    private static function editAction(): Action
+    {
+        return Action::make('edit')
+            ->label('Edit')
+            ->icon('heroicon-o-pencil-square')
+            ->schema(static::getFormComponents())
+            ->fillForm(fn (PaymentMethod $record) => $record->only([
+                'name', 'type', 'driver', 'capture_mode',
+            ]))
+            ->action(fn (PaymentMethod $record, array $data) => app(PaymentMethodService::class)->update($record, $data));
+    }
+
+    /**
+     * $data['fee'] is stored as an integer minor unit (cents), matching
+     * Lunar's own Price convention everywhere else in this codebase — the
+     * form collects/displays a decimal and converts at the boundary.
+     */
+    private static function editFeeAction(): Action
+    {
+        return Action::make('edit_fee')
+            ->label('Edit fee')
+            ->icon('heroicon-o-pencil')
+            ->schema([
+                TextInput::make('fee')
+                    ->label('Fee')
+                    ->numeric()
+                    ->minValue(0)
+                    ->step(0.01)
+                    ->helperText('Flat surcharge added when this payment method is selected.'),
+            ])
+            ->fillForm(fn (PaymentMethod $record) => [
+                'fee' => filled($record->data['fee'] ?? null) ? $record->data['fee'] / 100 : null,
+            ])
+            ->action(function (PaymentMethod $record, array $data) {
+                app(PaymentMethodService::class)->update($record, [
+                    'data' => [
+                        ...$record->data->toArray(),
+                        'fee' => filled($data['fee']) ? (int) round($data['fee'] * 100) : null,
+                    ],
+                ]);
+            });
+    }
+
+    private static function deleteAction(): Action
+    {
+        return Action::make('delete')
+            ->label('Delete')
+            ->icon('heroicon-o-trash')
+            ->color('danger')
+            ->requiresConfirmation()
+            ->action(fn (PaymentMethod $record) => app(PaymentMethodService::class)->delete($record));
+    }
+
+    private static function driverLabel(?string $key): string
+    {
+        if ($key === null) {
+            return '—';
+        }
+
+        return app(PaymentDriverRegistry::class)->label($key) ?? $key;
+    }
+
+    /**
+     * False for a missing driver too, since Configurable::isConfigured()
+     * has nothing to ask in that case — driverStatusTooltip() below is
+     * what tells the two reasons apart for the admin.
+     */
+    private static function driverIsConfigured(?string $key): bool
+    {
+        $driver = $key ? app(PaymentDriverRegistry::class)->resolve($key) : null;
+
+        if (! $driver instanceof Configurable) {
+            return false;
+        }
+
+        return $driver->isConfigured();
+    }
+
+    private static function driverStatusTooltip(PaymentMethod $record): string
+    {
+        if ($record->driver_missing_at) {
+            return 'Driver not found as of '.$record->driver_missing_at->diffForHumans();
+        }
+
+        if (! static::driverIsConfigured($record->driver)) {
+            return 'Driver resolves, but is missing required configuration (e.g. an API key) — it will not be offered at checkout.';
+        }
+
+        return 'Driver resolves correctly and is fully configured.';
+    }
+}
diff --git a/src/Payment/Filament/Resources/PaymentMethodResource/Pages/ListPaymentMethods.php b/src/Payment/Filament/Resources/PaymentMethodResource/Pages/ListPaymentMethods.php
new file mode 100644
index 0000000..5e318c2
--- /dev/null
+++ b/src/Payment/Filament/Resources/PaymentMethodResource/Pages/ListPaymentMethods.php
@@ -0,0 +1,32 @@
+<?php
+
+namespace Modules\Core\Payment\Filament\Resources\PaymentMethodResource\Pages;
+
+use Filament\Actions;
+use Filament\Resources\Pages\ListRecords;
+use Modules\Core\Payment\Filament\Resources\PaymentMethodResource;
+use Modules\Core\Payment\Models\PaymentMethod;
+use Modules\Core\Payment\Services\PaymentMethodService;
+
+class ListPaymentMethods extends ListRecords
+{
+    protected static string $resource = PaymentMethodResource::class;
+
+    protected function getHeaderActions(): array
+    {
+        return [
+            Actions\CreateAction::make()
+                ->schema(PaymentMethodResource::getFormComponents())
+                ->fillForm(fn () => [
+                    'position' => (PaymentMethod::max('position') ?? 0) + 1,
+                    'enabled' => false,
+                    'data' => [],
+                ])
+                // Every PaymentMethod write goes through PaymentMethodService
+                // — see PaymentMethodResource's own docblock — so this
+                // replaces CreateAction's default $model::create($data), not
+                // just the form/fill behavior above.
+                ->using(fn (array $data) => app(PaymentMethodService::class)->create($data)),
+        ];
+    }
+}
diff --git a/src/Payment/Http/Controllers/StripeWebhookController.php b/src/Payment/Http/Controllers/StripeWebhookController.php
new file mode 100644
index 0000000..67fc7f4
--- /dev/null
+++ b/src/Payment/Http/Controllers/StripeWebhookController.php
@@ -0,0 +1,45 @@
+<?php
+
+namespace Modules\Core\Payment\Http\Controllers;
+
+use Illuminate\Http\JsonResponse;
+use Illuminate\Http\Request;
+use Illuminate\Routing\Controller;
+use Modules\Core\Payment\Drivers\StripePaymentDriver;
+use Stripe\Webhook;
+
+/**
+ * A boboko-owned webhook endpoint for Stripe — never went through Lunar's
+ * own Payments::driver('stripe') flow (the flow StripePaymentDriver was
+ * built to replace, see that class's own docblock), and lunarphp/stripe
+ * has since been removed entirely (see Modules\Core\Payment\Support\
+ * StripeManager's own docblock). Signature verification is handled by
+ * Modules\Core\Payment\Http\Middleware\StripeWebhookMiddleware, registered
+ * on this route (see src/Payment/routes/webhooks.php) — pure Stripe SDK
+ * verification + event-type filtering. This controller verifies the
+ * signature again itself (Webhook::constructEvent()) to get the
+ * constructed Event object — the middleware doesn't stash one anywhere
+ * reusable, it only gates the request through.
+ *
+ * Resolves the driver directly by class, not via
+ * Modules\Core\Payment\Services\PaymentDriverRegistry — this endpoint is
+ * inherently Stripe-specific (Stripe's own webhook payload carries no
+ * boboko payment-type key, only its own payment_intent id), and
+ * StripePaymentDriver::handleCallback() already recovers $type itself
+ * from the StripePaymentIntent row pay()/authorize() wrote.
+ */
+class StripeWebhookController extends Controller
+{
+    public function __invoke(Request $request, StripePaymentDriver $driver): JsonResponse
+    {
+        $event = Webhook::constructEvent(
+            $request->getContent(),
+            $request->header('Stripe-Signature'),
+            config('services.stripe.webhooks.lunar'),
+        );
+
+        $driver->handleCallback($event->data->object->id, $event->data->object->toArray());
+
+        return response()->json(['webhook_successful' => true]);
+    }
+}
diff --git a/src/Payment/Http/Middleware/StripeWebhookMiddleware.php b/src/Payment/Http/Middleware/StripeWebhookMiddleware.php
new file mode 100644
index 0000000..6a1fd4c
--- /dev/null
+++ b/src/Payment/Http/Middleware/StripeWebhookMiddleware.php
@@ -0,0 +1,51 @@
+<?php
+
+namespace Modules\Core\Payment\Http\Middleware;
+
+use Closure;
+use Illuminate\Http\Request;
+use Stripe\Exception\SignatureVerificationException;
+use Stripe\Exception\UnexpectedValueException;
+use Stripe\Webhook;
+
+/**
+ * First-party replacement for Lunar\Stripe\Http\Middleware\
+ * StripeWebhookMiddleware (lunarphp/stripe removed — see
+ * Modules\Core\Payment\Support\StripeManager's own docblock). Registered
+ * on the same route as before (src/Payment/routes/webhooks.php) purely to
+ * gate malformed/irrelevant requests before they reach
+ * Modules\Core\Payment\Http\Controllers\StripeWebhookController, which
+ * re-verifies the signature itself (see that controller's own docblock)
+ * to get the constructed Event object — this duplication predates the
+ * package removal and is left unchanged here.
+ */
+class StripeWebhookMiddleware
+{
+    public function handle(Request $request, ?Closure $next = null)
+    {
+        $secret = config('services.stripe.webhooks.lunar');
+        $stripeSig = $request->header('Stripe-Signature');
+
+        try {
+            $event = Webhook::constructEvent(
+                $request->getContent(),
+                $stripeSig,
+                $secret
+            );
+        } catch (UnexpectedValueException|SignatureVerificationException $e) {
+            abort(400, $e->getMessage());
+        }
+
+        if (! in_array(
+            $event->type,
+            [
+                'payment_intent.payment_failed',
+                'payment_intent.succeeded',
+            ]
+        )) {
+            return response('', 200);
+        }
+
+        return $next($request);
+    }
+}
diff --git a/src/Payment/Listeners/LogPaymentMethodActivity.php b/src/Payment/Listeners/LogPaymentMethodActivity.php
new file mode 100644
index 0000000..dea4871
--- /dev/null
+++ b/src/Payment/Listeners/LogPaymentMethodActivity.php
@@ -0,0 +1,60 @@
+<?php
+
+namespace Modules\Core\Payment\Listeners;
+
+use Modules\Core\Logging\ActivityLogService;
+use Modules\Core\Payment\Events\PaymentMethodCreated;
+use Modules\Core\Payment\Events\PaymentMethodDeleted;
+use Modules\Core\Payment\Events\PaymentMethodUpdated;
+use Modules\Core\Payment\Models\PaymentMethod;
+
+/**
+ * Same pattern as Localization\Listeners\LogTranslationActivity — routes
+ * PaymentMethodService's own events through the existing
+ * Logging\ActivityLogService instead of PaymentMethod separately opting
+ * into Lunar\Base\Traits\LogsActivity (Spatie's generic model-observer
+ * logging): PaymentMethodUpdated::$old and PaymentMethodDeleted::$method
+ * already carry richer, deliberate before/after context than Eloquent's
+ * own dirty-attribute diffing would reconstruct on its own.
+ *
+ * PaymentMethodDeleted's snapshot is a plain array (the row is already
+ * gone from the database by dispatch time — see that event's own
+ * docblock), so performedOn() gets an unsaved PaymentMethod instance
+ * built from it purely to carry the right subject_type/id, not a real
+ * persisted model.
+ *
+ * PaymentMethodsReordered is deliberately NOT logged here — it's a
+ * multi-row position change (ActivityLogService's methods all take one
+ * Model $subject) for a low-stakes, purely-cosmetic setting, not worth
+ * forcing into a one-subject shape or adding a new method to the shared
+ * service for.
+ */
+class LogPaymentMethodActivity
+{
+    public function __construct(
+        private readonly ActivityLogService $activityLog,
+    ) {}
+
+    public function handleCreated(PaymentMethodCreated $event): void
+    {
+        $this->activityLog->created($event->method, $event->method->getAttributes());
+    }
+
+    public function handleUpdated(PaymentMethodUpdated $event): void
+    {
+        $this->activityLog->updated(
+            $event->method,
+            $event->old,
+            $event->method->only(array_keys($event->old)),
+        );
+    }
+
+    public function handleDeleted(PaymentMethodDeleted $event): void
+    {
+        $subject = (new PaymentMethod)->forceFill($event->method);
+        $subject->exists = true;
+        $subject->id = $event->method['id'];
+
+        $this->activityLog->deleted($subject, $event->method);
+    }
+}
diff --git a/src/Payment/Models/CoreTransaction.php b/src/Payment/Models/CoreTransaction.php
new file mode 100644
index 0000000..af26e79
--- /dev/null
+++ b/src/Payment/Models/CoreTransaction.php
@@ -0,0 +1,32 @@
+<?php
+
+namespace Modules\Core\Payment\Models;
+
+use Lunar\Models\Transaction;
+use Modules\Core\Payment\Support\TransactionDriverAdapter;
+
+/**
+ * Registered via Lunar\Facades\ModelManifest::replace(Lunar\Models\
+ * Contracts\Transaction::class, self::class) in PaymentServiceProvider —
+ * the same contract-swap mechanism this codebase already uses for
+ * Customer/Staff. Every place Lunar's own code resolves a transaction via
+ * Transaction::modelClass() (which reads this replacement, see
+ * Lunar\Base\Traits\HasModelExtending::modelClass()) — including
+ * Order::transactions()'s own hasMany(Transaction::modelClass()) relation
+ * — gets an instance of THIS class instead of the vendor's own
+ * Lunar\Models\Transaction. No override anywhere else is needed: this is
+ * the one seam that makes $order->transactions, and everything the admin
+ * panel's refund/capture actions call on one of those rows, silently run
+ * through our own system.
+ *
+ * Only driver() is overridden — refund()/capture()/paymentChecks() on the
+ * parent class all just call driver()->{method}(), so replacing what
+ * driver() returns is the entire fix (see TransactionDriverAdapter).
+ */
+class CoreTransaction extends Transaction
+{
+    public function driver(): TransactionDriverAdapter
+    {
+        return app(TransactionDriverAdapter::class);
+    }
+}
diff --git a/src/Payment/Models/PaymentMethod.php b/src/Payment/Models/PaymentMethod.php
new file mode 100644
index 0000000..6ff63ea
--- /dev/null
+++ b/src/Payment/Models/PaymentMethod.php
@@ -0,0 +1,52 @@
+<?php
+
+namespace Modules\Core\Payment\Models;
+
+use Illuminate\Database\Eloquent\Casts\AsArrayObject;
+use Illuminate\Database\Eloquent\Model;
+use Lunar\Base\Traits\HasTranslations;
+
+/**
+ * A merchant-configured payment method — the DB-instance layer, admin
+ * creatable/deletable, same split Modules\Core\Shipping's own
+ * shipping_methods table already has (see docs/payments.md):
+ *   - type: unique, machine-facing slug (Cart::meta['payment_method'],
+ *     ApplyPaymentMethodFee's lookup key, every Payment event's $type).
+ *   - name: admin-facing label, locale-keyed JSON (e.g.
+ *     {"en": "Cash On Delivery", "el": "Αντικαταβολή"}) — same shape/
+ *     resolution as Product/Collection names (Lunar\Base\Traits\
+ *     HasTranslations), just applied directly to this column rather than
+ *     through attribute_data, since this is a merchant settings row, not
+ *     a catalog attribute. Rendered in Filament via Lunar's own
+ *     Lunar\Admin\Support\Forms\Components\TranslatedText — one input per
+ *     configured Language row, no bespoke translation UI. Resolve a
+ *     display string with $method->translate('name') (locale defaults to
+ *     app()->getLocale(), falling back to the store's default language).
+ *   - driver: the Modules\Core\Payment\Services\PaymentDriverRegistry key
+ *     — NOT the same as `type`, and not unique (two rows can share one
+ *     driver, e.g. two differently-named offline-style methods).
+ *   - capture_mode: 'pay' or 'authorize' — which SupportsPay/
+ *     SupportsAuthorization method CheckoutService::initiatePayment()
+ *     calls for this row.
+ *   - position: admin-controlled display/checkout order.
+ *   - driver_missing_at: set by `payment:sync-drivers` when `driver` no
+ *     longer resolves via the registry — separate from `enabled`, so a
+ *     driver vanishing (a deploy removed it) is never confused with an
+ *     admin's own manual toggle.
+ *   - data: jsonb, driver-specific settings that don't warrant their own
+ *     column (starts with 'fee', the offline flat surcharge).
+ */
+class PaymentMethod extends Model
+{
+    use HasTranslations;
+
+    protected $guarded = [];
+
+    protected $casts = [
+        'enabled' => 'boolean',
+        'position' => 'integer',
+        'driver_missing_at' => 'datetime',
+        'name' => 'array',
+        'data' => AsArrayObject::class,
+    ];
+}
diff --git a/src/Payment/Models/StripePaymentIntent.php b/src/Payment/Models/StripePaymentIntent.php
new file mode 100644
index 0000000..afefe12
--- /dev/null
+++ b/src/Payment/Models/StripePaymentIntent.php
@@ -0,0 +1,32 @@
+<?php
+
+namespace Modules\Core\Payment\Models;
+
+use Lunar\Base\BaseModel;
+
+/**
+ * First-party replacement for Lunar\Stripe\Models\StripePaymentIntent (the
+ * lunarphp/stripe package was removed — see Modules\Core\Payment\Support\
+ * StripeManager's own docblock). Same table (lunar_stripe_payment_intents,
+ * created by database/migrations/..._create_stripe_payment_intents_table,
+ * a first-party copy of the vendor migration), including the app-owned
+ * `context`/`payment_type` columns Modules\Core\Payment\Drivers\
+ * StripePaymentDriver::handleCallback() needs to recover $context/$type
+ * across the separate request a webhook arrives on — see that class's own
+ * docblock for "Async resolution".
+ *
+ * Extends Lunar\Base\BaseModel (from lunarphp/core, unaffected by removing
+ * lunarphp/stripe) purely so table-prefix resolution
+ * (config('lunar.database.table_prefix')) stays identical to how the
+ * vendor model resolved it — this table was created under that prefix.
+ */
+class StripePaymentIntent extends BaseModel
+{
+    protected $table = 'stripe_payment_intents';
+
+    protected $guarded = [];
+
+    protected $casts = [
+        'context' => 'array',
+    ];
+}
diff --git a/src/Payment/Pipelines/Cart/ApplyPaymentMethodFee.php b/src/Payment/Pipelines/Cart/ApplyPaymentMethodFee.php
new file mode 100644
index 0000000..3be6995
--- /dev/null
+++ b/src/Payment/Pipelines/Cart/ApplyPaymentMethodFee.php
@@ -0,0 +1,49 @@
+<?php
+
+namespace Modules\Core\Payment\Pipelines\Cart;
+
+use Closure;
+use Lunar\Base\ValueObjects\Cart\ShippingBreakdownItem;
+use Lunar\DataTypes\Price;
+use Lunar\Models\Contracts\Cart as CartContract;
+use Modules\Core\Payment\Models\PaymentMethod;
+
+final class ApplyPaymentMethodFee
+{
+    /**
+     * Called just before cart totals are calculated, right after
+     * Lunar\Pipelines\Cart\ApplyShipping. Generic across every
+     * Modules\Core\Payment\Models\PaymentMethod row, not just cash on
+     * delivery — whichever type the shopper picked (Cart::meta
+     * ['payment_method']), its own `data.fee` (set via the Filament "Edit
+     * fee" action) is applied if present, no matter its slug/name/driver.
+     *
+     * Must add the fee as its own Lunar\Base\ValueObjects\Cart\
+     * ShippingBreakdownItem on $cart->shippingBreakdown rather than
+     * bumping $cart->shippingTotal directly — the later Lunar\Pipelines\
+     * Cart\CalculateTax step unconditionally recomputes shippingTotal
+     * (and shipping tax) from shippingBreakdown's item sum, so a value
+     * set only on the plain property is silently discarded before the
+     * cart finishes calculating.
+     *
+     * @param  Closure(CartContract): mixed  $next
+     */
+    public function handle(CartContract $cart, Closure $next): mixed
+    {
+        $type = $cart->meta['payment_method'] ?? null;
+
+        if ($type) {
+            $fee = (int) (PaymentMethod::where('type', $type)->first()?->data['fee'] ?? 0);
+
+            if ($fee > 0) {
+                $cart->shippingBreakdown->items->put('payment-method-fee', new ShippingBreakdownItem(
+                    name: 'Payment method fee',
+                    identifier: 'payment-method-fee',
+                    price: new Price($fee, $cart->currency, 1),
+                ));
+            }
+        }
+
+        return $next($cart);
+    }
+}
diff --git a/src/Payment/Services/PaymentDriverRegistry.php b/src/Payment/Services/PaymentDriverRegistry.php
new file mode 100644
index 0000000..4a00663
--- /dev/null
+++ b/src/Payment/Services/PaymentDriverRegistry.php
@@ -0,0 +1,107 @@
+<?php
+
+namespace Modules\Core\Payment\Services;
+
+/**
+ * Which payment driver CLASSES exist this deploy — the code-registry layer,
+ * mirroring Lunar\Shipping\Managers\ShippingManager's own built-in-methods
+ * + Manager::extend() pattern, but purpose-built rather than extending
+ * Illuminate\Support\Manager: Manager's create{X}Driver() convention fits
+ * a uniform one-interface-per-driver contract (ShippingRateInterface); a
+ * Payment driver instead implements several independent, opt-in capability
+ * interfaces at once (Configurable, SupportsPay, SupportsAuthorization,
+ * ...), so there's no single "the" method to generate per driver.
+ *
+ * Deliberately knows NOTHING about Modules\Core\Payment\Models\PaymentMethod
+ * or the database — resolve() is a pure "does this key still exist"
+ * lookup. Whether a resolved driver is administratively enabled, or
+ * reports itself Configurable::isConfigured(), is the DOMAIN's job
+ * (Modules\Core\Checkout\Services\CheckoutService::getPaymentMethods()) —
+ * see docs/payments.md. This split is what lets the identical registry
+ * shape be lifted for a future Invoicing/AntiFraud domain without dragging
+ * Payment-specific concepts along with it.
+ *
+ * Built-in drivers are registered in Modules\Core\Providers\
+ * PaymentServiceProvider::boot() via register(); a consuming app or a
+ * future payment-provider package registers its own the same way, from
+ * its own service provider's boot() — exactly how Shipping::extend() works
+ * for ACS/Box Now (src/Providers/ShippingServiceProvider.php).
+ */
+class PaymentDriverRegistry
+{
+    /**
+     * @var array<string, string>
+     */
+    private array $drivers = [];
+
+    /**
+     * @var array<string, string>
+     */
+    private array $labels = [];
+
+    /**
+     * $key is the registry key a Modules\Core\Payment\Models\PaymentMethod
+     * row's own `driver` column stores — NOT the same as that row's `type`
+     * (its merchant-facing slug). Two rows can share one driver key (e.g.
+     * both 'cash-on-delivery' and 'cash-in-hand' using the same 'offline'
+     * driver with different type/name/fee).
+     *
+     * $label is a short, human-readable name (e.g. "Stripe", "Offline /
+     * Manual") — this is where that comes from, not $driverClass's own
+     * FQCN. Payment's driver classes implement several independent,
+     * opt-in capability interfaces (Configurable, SupportsPay, ...), none
+     * of which carries a display name the way Lunar\Shipping\Interfaces\
+     * ShippingRateInterface::name() does for every shipping driver — the
+     * registry is the one place that DOES know every driver at once, so
+     * it's the natural (and only) place to also hold this.
+     */
+    public function register(string $key, string $driverClass, string $label): void
+    {
+        $this->drivers[$key] = $driverClass;
+        $this->labels[$key] = $label;
+    }
+
+    /**
+     * Null if $key was never registered — deliberately non-throwing, same
+     * reasoning the old PaymentDriverResolver already had: a caller
+     * checking availability (or the payment:sync-drivers command checking
+     * every PaymentMethod row) needs "not found" to be a normal, silent
+     * result, not an exception to catch.
+     */
+    public function resolve(string $key): ?object
+    {
+        $driverClass = $this->drivers[$key] ?? null;
+
+        return $driverClass ? app($driverClass) : null;
+    }
+
+    /**
+     * Every registered key => driver class — what payment:sync-drivers
+     * checks every PaymentMethod row's `driver` column against.
+     *
+     * @return array<string, string>
+     */
+    public function all(): array
+    {
+        return $this->drivers;
+    }
+
+    /**
+     * Every registered key => human-readable label — what a Filament
+     * driver Select populates its options from (mirroring
+     * ShippingMethodResourceExtension::driverSelect()'s use of
+     * Shipping::getSupportedDrivers(), which reads each driver's own
+     * name()) — never the raw class name from all().
+     *
+     * @return array<string, string>
+     */
+    public function labels(): array
+    {
+        return $this->labels;
+    }
+
+    public function label(string $key): ?string
+    {
+        return $this->labels[$key] ?? null;
+    }
+}
diff --git a/src/Payment/Services/PaymentMethodCache.php b/src/Payment/Services/PaymentMethodCache.php
new file mode 100644
index 0000000..99a4750
--- /dev/null
+++ b/src/Payment/Services/PaymentMethodCache.php
@@ -0,0 +1,41 @@
+<?php
+
+namespace Modules\Core\Payment\Services;
+
+use Illuminate\Support\Collection;
+use Illuminate\Support\Facades\Cache;
+use Modules\Core\Payment\Models\PaymentMethod;
+
+/**
+ * Cached read layer over PaymentMethod — the single source both
+ * Modules\Core\Checkout\Services\CheckoutService (checkout-time
+ * availability) and anything else needing the payment-method list (e.g.
+ * PaymentServiceProvider's Lunar\Facades\Payments shim, order screens
+ * showing a transaction's driver) read from, so the table is fetched once
+ * per cache lifetime rather than once per caller/request. Mirrors
+ * Modules\Core\Localization\Services\LanguageCache's exact shape.
+ *
+ * Cached forever, invalidated via forget() by
+ * Modules\Core\Payment\Observers\FlushPaymentMethodCache on
+ * PaymentMethod::saved()/deleted() — no bespoke Created/Updated/Deleted
+ * event trio needed, unlike LanguageCache's (Language is a Lunar-owned
+ * model reacted to indirectly); PaymentMethod is entirely our own model,
+ * so a plain Eloquent observer is the direct route.
+ */
+class PaymentMethodCache
+{
+    private const CACHE_KEY = 'core.payment.methods';
+
+    public function all(): Collection
+    {
+        return Cache::rememberForever(
+            self::CACHE_KEY,
+            fn () => PaymentMethod::query()->orderBy('position')->get(),
+        );
+    }
+
+    public function forget(): void
+    {
+        Cache::forget(self::CACHE_KEY);
+    }
+}
diff --git a/src/Payment/Services/PaymentMethodService.php b/src/Payment/Services/PaymentMethodService.php
new file mode 100644
index 0000000..737d277
--- /dev/null
+++ b/src/Payment/Services/PaymentMethodService.php
@@ -0,0 +1,82 @@
+<?php
+
+namespace Modules\Core\Payment\Services;
+
+use Illuminate\Support\Collection;
+use Illuminate\Support\Facades\Event;
+use Modules\Core\Payment\Events\PaymentMethodCreated;
+use Modules\Core\Payment\Events\PaymentMethodDeleted;
+use Modules\Core\Payment\Events\PaymentMethodUpdated;
+use Modules\Core\Payment\Models\PaymentMethod;
+
+/**
+ * The single write (AND read) gateway for PaymentMethod — every Filament
+ * resource/action calls this, not PaymentMethod::create()/update()/delete()
+ * directly, so cache invalidation is one explicit step colocated with the
+ * mutation (not hidden in a model observer) and every admin change to a
+ * payment method dispatches a matching event, the same convention
+ * Modules\Core\Cart\Services\CartService already established for its own
+ * mutating methods.
+ *
+ * list() is what PaymentMethodCache actually reads through — see that
+ * class for why this needs caching at all (Modules\Core\Checkout\
+ * Services\CheckoutService and PaymentServiceProvider's Lunar\Facades\
+ * Payments shim both read the full payment-method list on the hot path).
+ */
+class PaymentMethodService
+{
+    public function __construct(
+        private readonly PaymentMethodCache $cache,
+    ) {}
+
+    /**
+     * @return Collection<int, PaymentMethod>
+     */
+    public function list(): Collection
+    {
+        return $this->cache->all();
+    }
+
+    /**
+     * @param  array<string, mixed>  $data
+     */
+    public function create(array $data): PaymentMethod
+    {
+        $method = PaymentMethod::create($data);
+
+        $this->cache->forget();
+
+        Event::dispatch(new PaymentMethodCreated($method));
+
+        return $method;
+    }
+
+    /**
+     * @param  array<string, mixed>  $data
+     */
+    public function update(PaymentMethod $method, array $data): PaymentMethod
+    {
+        $old = $method->only(array_keys($data));
+
+        $method->update($data);
+
+        $this->cache->forget();
+
+        Event::dispatch(new PaymentMethodUpdated($method, $old));
+
+        return $method;
+    }
+
+    public function delete(PaymentMethod $method): void
+    {
+        $snapshot = $method->only([
+            'id', 'type', 'name', 'driver', 'capture_mode', 'position', 'enabled',
+        ]);
+
+        $method->delete();
+
+        $this->cache->forget();
+
+        Event::dispatch(new PaymentMethodDeleted($snapshot));
+    }
+}
diff --git a/src/Payment/Support/StripeManager.php b/src/Payment/Support/StripeManager.php
new file mode 100644
index 0000000..dc2f82e
--- /dev/null
+++ b/src/Payment/Support/StripeManager.php
@@ -0,0 +1,126 @@
+<?php
+
+namespace Modules\Core\Payment\Support;
+
+use Lunar\Models\Contracts\Currency as CurrencyContract;
+use Stripe\Charge;
+use Stripe\StripeClient;
+
+/**
+ * First-party replacement for Lunar\Stripe\Facades\Stripe +
+ * Lunar\Stripe\Managers\StripeManager — lunarphp/stripe was removed once
+ * Modules\Core\Payment\Drivers\StripePaymentDriver already replaced every
+ * bit of Lunar's own Stripe payment flow (see that class's own docblock);
+ * all that remained load-bearing from the package was raw API-client
+ * access and amount conversion, neither of which is Lunar-specific. Only
+ * the methods StripePaymentDriver actually called are kept — no
+ * fetchOrCreateIntent()/cart-bound helpers, which belonged to Lunar's own
+ * (unused) checkout flow.
+ *
+ * getClient()/getCharge() call the Stripe SDK directly rather than going
+ * through a facade — StripePaymentDriver resolves this class via the
+ * container instead, same as every other dependency it takes.
+ */
+class StripeManager
+{
+    public function getClient(): StripeClient
+    {
+        return new StripeClient([
+            'api_key' => config('services.stripe.key'),
+        ]);
+    }
+
+    public function getCharge(string $chargeId): Charge
+    {
+        return $this->getClient()->charges->retrieve($chargeId);
+    }
+
+    /**
+     * Zero-decimal currencies, per Stripe. The amount sent to Stripe is the
+     * major unit amount as-is.
+     *
+     * @see https://docs.stripe.com/currencies#zero-decimal
+     */
+    protected const ZERO_DECIMAL_CURRENCIES = [
+        'bif', 'clp', 'djf', 'gnf', 'jpy', 'kmf', 'krw', 'mga', 'pyg',
+        'rwf', 'ugx', 'vnd', 'vuv', 'xaf', 'xof', 'xpf',
+    ];
+
+    /**
+     * Three-decimal currencies, per Stripe. The amount sent to Stripe is the
+     * major unit amount multiplied by 1000.
+     *
+     * @see https://docs.stripe.com/currencies#three-decimal
+     */
+    protected const THREE_DECIMAL_CURRENCIES = ['bhd', 'jod', 'kwd', 'omr', 'tnd'];
+
+    /**
+     * HUF, TWD and UGX are ISO zero-decimal currencies, but Stripe still
+     * requires amounts to be sent as if they had two decimal places.
+     *
+     * @see https://docs.stripe.com/currencies#special-cases
+     */
+    protected const SPECIAL_ZERO_DECIMAL_CURRENCIES = ['huf', 'twd', 'ugx'];
+
+    /**
+     * Convert a Lunar price value to the amount expected by Stripe.
+     *
+     * Lunar stores prices as integers scaled by `Currency::decimal_places`,
+     * which merchants can set independently of what Stripe expects for a
+     * given currency. This converts back to the major unit amount first,
+     * then re-scales it to whatever sub-unit Stripe requires for the
+     * currency, so the result is correct regardless of how the merchant has
+     * configured `Currency::decimal_places`.
+     *
+     * @see https://docs.stripe.com/currencies
+     */
+    public static function toStripeAmount(int $value, CurrencyContract $currency): int
+    {
+        return self::rescale($value, max($currency->decimal_places, 0), self::stripeDecimalPlaces($currency));
+    }
+
+    /**
+     * Convert an amount received from Stripe back to a Lunar price value,
+     * scaled by `Currency::decimal_places`. Inverse of `toStripeAmount()`.
+     */
+    public static function fromStripeAmount(int $amount, CurrencyContract $currency): int
+    {
+        return self::rescale($amount, self::stripeDecimalPlaces($currency), max($currency->decimal_places, 0));
+    }
+
+    /**
+     * The number of decimal places Stripe expects amounts in for a currency.
+     */
+    protected static function stripeDecimalPlaces(CurrencyContract $currency): int
+    {
+        $code = strtolower($currency->code);
+
+        // UGX is also in the zero-decimal list; the special case takes precedence.
+        if (in_array($code, self::SPECIAL_ZERO_DECIMAL_CURRENCIES, true)) {
+            return 2;
+        }
+
+        if (in_array($code, self::ZERO_DECIMAL_CURRENCIES, true)) {
+            return 0;
+        }
+
+        if (in_array($code, self::THREE_DECIMAL_CURRENCIES, true)) {
+            return 3;
+        }
+
+        return 2;
+    }
+
+    protected static function rescale(int $value, int $fromDecimalPlaces, int $toDecimalPlaces): int
+    {
+        $exponent = $toDecimalPlaces - $fromDecimalPlaces;
+
+        if ($exponent >= 0) {
+            return $value * (10 ** $exponent);
+        }
+
+        $divisor = 10 ** (-$exponent);
+
+        return intdiv(abs($value) + intdiv($divisor, 2), $divisor) * ($value < 0 ? -1 : 1);
+    }
+}
diff --git a/src/Payment/Support/TransactionDriverAdapter.php b/src/Payment/Support/TransactionDriverAdapter.php
new file mode 100644
index 0000000..4496a55
--- /dev/null
+++ b/src/Payment/Support/TransactionDriverAdapter.php
@@ -0,0 +1,144 @@
+<?php
+
+namespace Modules\Core\Payment\Support;
+
+use Lunar\Base\DataTransferObjects\PaymentCapture;
+use Lunar\Base\DataTransferObjects\PaymentChecks;
+use Lunar\Base\DataTransferObjects\PaymentRefund;
+use Lunar\DataTypes\Price;
+use Lunar\Models\Contracts\Transaction;
+use Modules\Core\Payment\Contracts\SupportsCaptures;
+use Modules\Core\Payment\Contracts\SupportsRefunds;
+use Modules\Core\Payment\Enums\PaymentResultStatus;
+use Modules\Core\Payment\Services\PaymentDriverRegistry;
+use Modules\Core\Payment\Services\PaymentMethodCache;
+
+/**
+ * What Modules\Core\Payment\Models\CoreTransaction::driver() returns
+ * instead of Lunar\Facades\Payments::driver($this->driver) — the point
+ * where every Lunar-native caller of a transaction's driver (today: the
+ * admin panel's "Refund"/"Capture" header actions on the order page,
+ * ManageOrder::getRefundAction()/getCaptureAction() — see
+ * $transaction->refund()/->capture() in vendor/lunarphp/core/src/Models/
+ * Transaction.php) transparently lands on OUR real payment system instead
+ * of Lunar's own, entirely separate, unused PaymentManager.
+ *
+ * Implements Lunar\Base\PaymentTypeInterface's refund()/capture()/
+ * getPaymentChecks() signatures exactly — each takes the Transaction as
+ * its own first argument (confirmed from vendor/lunarphp/core/src/Models/
+ * Transaction.php: `$this->driver()->refund($this, $amount, $notes)`),
+ * so this class holds no transaction state of its own; CoreTransaction's
+ * driver() can return one shared instance for any transaction.
+ *
+ * $transaction->driver is a Modules\Core\Payment\Models\PaymentMethod.type
+ * value (what Modules\Core\Order\Services\TransactionRecorder writes into
+ * Transaction.driver) — this resolves the REAL registry key from that
+ * type via PaymentMethodCache, then the real driver instance from
+ * PaymentDriverRegistry, so refund()/capture() called here call the
+ * ACTUAL Stripe/etc. driver, never a fake/no-op stand-in. If either
+ * lookup fails (the PaymentMethod row or its driver no longer exists),
+ * refund()/capture() report failure rather than silently doing nothing.
+ */
+class TransactionDriverAdapter
+{
+    public function __construct(
+        private readonly PaymentMethodCache $paymentMethods,
+        private readonly PaymentDriverRegistry $registry,
+    ) {}
+
+    public function refund(Transaction $transaction, int $amount, ?string $notes = null): PaymentRefund
+    {
+        return $this->refundVia($transaction, $this->driverKeyFor($transaction), $amount, $notes);
+    }
+
+    /**
+     * The PaymentDriverRegistry key $transaction was originally taken
+     * through — what refund()/capture() resolve against by default, and
+     * what Order\Filament\Extensions\OrderActionsExtension defaults
+     * its "Refund via" driver Select to, before an admin overrides it.
+     */
+    public function driverKeyFor(Transaction $transaction): ?string
+    {
+        return $this->paymentMethods->all()->firstWhere('type', $transaction->driver)?->driver;
+    }
+
+    /**
+     * Same as refund(), but against an explicitly chosen driver rather than
+     * the one $transaction was originally taken through — e.g. refunding a
+     * cash-on-delivery order via a Bank Transfer driver instead of trying
+     * (and failing) to refund through the offline driver that took the
+     * original payment. $driverKey is a PaymentDriverRegistry key (e.g.
+     * 'bank-transfer'), not a PaymentMethod.type — the two only coincide
+     * when refunding through the transaction's own original driver.
+     *
+     * Called directly by Order\Filament\Extensions\
+     * OrderActionsExtension when the admin picks a different driver
+     * in the refund modal, bypassing Lunar\Models\Transaction::refund()
+     * (whose fixed refund(int $amount, $notes = null) signature has no
+     * room for a driver override) — see that extension's own docblock.
+     */
+    public function refundVia(Transaction $transaction, ?string $driverKey, int $amount, ?string $notes = null): PaymentRefund
+    {
+        $driver = $driverKey !== null ? $this->registry->resolve($driverKey) : null;
+
+        if (! $driver instanceof SupportsRefunds) {
+            return new PaymentRefund(success: false, message: 'This payment method does not support refunds.');
+        }
+
+        $result = $driver->refund(
+            $transaction->reference,
+            $this->priceFor($transaction, $amount),
+            ['notes' => $notes, 'order_id' => $transaction->order_id],
+        );
+
+        return new PaymentRefund(
+            success: $result->status === PaymentResultStatus::Succeeded,
+            message: $result->failureReason,
+        );
+    }
+
+    public function capture(Transaction $transaction, int $amount = 0): PaymentCapture
+    {
+        $driver = $this->resolveDriver($transaction);
+
+        if (! $driver instanceof SupportsCaptures) {
+            return new PaymentCapture(success: false, message: 'This payment method does not support a separate capture step.');
+        }
+
+        $result = $driver->capture(
+            $transaction->reference,
+            $this->priceFor($transaction, $amount ?: $transaction->amount->value),
+            ['order_id' => $transaction->order_id],
+        );
+
+        return new PaymentCapture(
+            success: $result->status === PaymentResultStatus::Succeeded,
+            message: $result->failureReason ?? '',
+        );
+    }
+
+    /**
+     * Lunar's own PaymentChecks DTO (address/postcode/CVC verification
+     * results) has no equivalent in our own contracts — none of our
+     * drivers currently surface this level of gateway-specific detail.
+     * Empty, not null: Lunar's admin panel iterates this collection to
+     * render a checks list, so it needs to always be a valid (possibly
+     * empty) PaymentChecks, never missing entirely.
+     */
+    public function getPaymentChecks(Transaction $transaction): PaymentChecks
+    {
+        return new PaymentChecks;
+    }
+
+    private function resolveDriver(Transaction $transaction): ?object
+    {
+        $driverKey = $this->driverKeyFor($transaction);
+
+        return $driverKey !== null ? $this->registry->resolve($driverKey) : null;
+    }
+
+    private function priceFor(Transaction $transaction, int $amount): Price
+    {
+        return new Price($amount, $transaction->order->currency);
+    }
+}
diff --git a/src/Payment/routes/webhooks.php b/src/Payment/routes/webhooks.php
new file mode 100644
index 0000000..2036925
--- /dev/null
+++ b/src/Payment/routes/webhooks.php
@@ -0,0 +1,14 @@
+<?php
+
+use Illuminate\Foundation\Http\Middleware\VerifyCsrfToken;
+use Illuminate\Support\Facades\Route;
+use Modules\Core\Payment\Http\Controllers\StripeWebhookController;
+use Modules\Core\Payment\Http\Middleware\StripeWebhookMiddleware;
+
+Route::post(
+    config('payment.stripe.webhook_path', 'payments/stripe/webhook'),
+    StripeWebhookController::class
+)
+    ->middleware([StripeWebhookMiddleware::class, 'api'])
+    ->withoutMiddleware([VerifyCsrfToken::class])
+    ->name('payment.stripe.webhook');
diff --git a/src/Providers/CartServiceProvider.php b/src/Providers/CartServiceProvider.php
new file mode 100644
index 0000000..81a9ba3
--- /dev/null
+++ b/src/Providers/CartServiceProvider.php
@@ -0,0 +1,23 @@
+<?php
+
+namespace Modules\Core\Providers;
+
+use Illuminate\Console\Scheduling\Schedule;
+use Illuminate\Support\ServiceProvider;
+use Modules\Core\Cart\Commands\DetectAbandonedCarts;
+
+class CartServiceProvider extends ServiceProvider
+{
+    public function boot(): void
+    {
+        if ($this->app->runningInConsole()) {
+            $this->commands([DetectAbandonedCarts::class]);
+        }
+
+        $this->app->booted(function () {
+            $this->app->make(Schedule::class)
+                ->command(DetectAbandonedCarts::class)
+                ->hourly();
+        });
+    }
+}
diff --git a/src/Providers/CatalogServiceProvider.php b/src/Providers/CatalogServiceProvider.php
new file mode 100644
index 0000000..428dffc
--- /dev/null
+++ b/src/Providers/CatalogServiceProvider.php
@@ -0,0 +1,66 @@
+<?php
+
+namespace Modules\Core\Providers;
+
+use Illuminate\Console\Scheduling\Schedule;
+use Illuminate\Support\Facades\Event;
+use Illuminate\Support\ServiceProvider;
+use Lunar\Models\Product;
+use Lunar\Models\ProductOption;
+use Lunar\Models\ProductOptionValue;
+use Modules\Core\Catalog\Events\ProductDeleted;
+use Modules\Core\Catalog\Events\ProductSaved;
+use Modules\Core\Catalog\Listeners\ReindexProductsRecommendingProduct;
+use Modules\Core\Catalog\Observers\ProductOptionReindexObserver;
+use Modules\Core\Catalog\OptionTypes\ColorOptionType;
+use Modules\Core\Catalog\Services\ProductOptionTypeManager;
+
+class CatalogServiceProvider extends ServiceProvider
+{
+    public function register(): void
+    {
+        $this->mergeConfigFrom(__DIR__ . '/../../config/catalog.php', 'catalog');
+    }
+
+    public function boot(): void
+    {
+        $this->publishes([
+            __DIR__ . '/../../config/catalog.php' => config_path('catalog.php'),
+        ], 'core-config');
+
+        ProductOptionTypeManager::get()->register([
+            ColorOptionType::class,
+        ]);
+
+        $observer = new ProductOptionReindexObserver;
+
+        ProductOption::saved(fn (ProductOption $option) => $observer->optionSaved($option));
+        ProductOption::deleted(fn (ProductOption $option) => $observer->optionDeleted($option));
+
+        ProductOptionValue::saved(fn (ProductOptionValue $value) => $observer->valueSaved($value));
+        ProductOptionValue::deleted(fn (ProductOptionValue $value) => $observer->valueDeleted($value));
+
+        Product::saved(fn (Product $product) => Event::dispatch(new ProductSaved($product)));
+        Product::deleted(fn (Product $product) => Event::dispatch(new ProductDeleted($product->id)));
+
+        Event::listen(ProductSaved::class, [ReindexProductsRecommendingProduct::class, 'handleSaved']);
+        Event::listen(ProductDeleted::class, [ReindexProductsRecommendingProduct::class, 'handleDeleted']);
+
+        $this->app->booted(function () {
+            // A full nightly reindex, on top of the per-event reindexing
+            // above — catches everything event-driven reindexing
+            // deliberately doesn't cover: a newly-created product not yet
+            // appearing as a recommendation elsewhere, in_stock/price
+            // drifting from an order decrementing stock outside a product
+            // save, and any other staleness ProductIndexer's own docblock
+            // already documents as accepted between reindexes. --refresh
+            // re-syncs filterable/sortable field settings too, not just
+            // documents, so a deploy that changed ProductIndexer's field
+            // list self-heals here even if `lunar:meilisearch:setup`
+            // wasn't run manually after that deploy.
+            $this->app->make(Schedule::class)
+                ->command('lunar:search:index', ['Lunar\\Models\\Product', '--refresh'])
+                ->dailyAt('03:00');
+        });
+    }
+}
diff --git a/src/Providers/CheckoutServiceProvider.php b/src/Providers/CheckoutServiceProvider.php
new file mode 100644
index 0000000..3b35b84
--- /dev/null
+++ b/src/Providers/CheckoutServiceProvider.php
@@ -0,0 +1,13 @@
+<?php
+
+namespace Modules\Core\Providers;
+
+use Illuminate\Support\ServiceProvider;
+
+class CheckoutServiceProvider extends ServiceProvider
+{
+    public function register(): void
+    {
+        $this->mergeConfigFrom(__DIR__ . '/../../config/legal.php', 'legal');
+    }
+}
diff --git a/src/Providers/CoreServiceProvider.php b/src/Providers/CoreServiceProvider.php
index 598ee91..f21ad10 100644
--- a/src/Providers/CoreServiceProvider.php
+++ b/src/Providers/CoreServiceProvider.php
@@ -5,12 +5,14 @@ namespace Modules\Core\Providers;
 use Illuminate\Support\Facades\Blade;
 use Illuminate\Support\ServiceProvider;
 use Modules\Core\Command\AnonymizeCommand;
+use Modules\Core\Command\BackfillMissingSkusCommand;
 use Modules\Core\Command\ExportCleanupCommand;
 use Modules\Core\Command\ExportCommand;
 use Modules\Core\Command\ImportCommand;
 use Modules\Core\Command\InstallLunarCommand;
 use Modules\Core\Command\MigrateImportCommand;
 use Modules\Core\Command\ProcessErasureRequestsCommand;
+use Modules\Core\Command\TuneProductSearchCommand;
 
 class CoreServiceProvider extends ServiceProvider
 {
@@ -24,6 +26,7 @@ class CoreServiceProvider extends ServiceProvider
         $this->loadViewsFrom(__DIR__ . '/../../resources/views', 'core');
         Blade::anonymousComponentPath(__DIR__ . '/../../resources/views', 'core');
         $this->loadMigrationsFrom(__DIR__ . '/../../database/migrations');
+        $this->loadTranslationsFrom(__DIR__ . '/../../lang', 'core');
 
         $this->publishes([
             __DIR__ . '/../../config/core.php' => config_path('core.php'),
@@ -36,7 +39,7 @@ class CoreServiceProvider extends ServiceProvider
         ], 'core-assets');
 
         if ($this->app->runningInConsole()) {
-            $this->commands([AnonymizeCommand::class, ExportCommand::class, ExportCleanupCommand::class, ImportCommand::class, MigrateImportCommand::class, ProcessErasureRequestsCommand::class]);
+            $this->commands([AnonymizeCommand::class, ExportCommand::class, ExportCleanupCommand::class, ImportCommand::class, MigrateImportCommand::class, TuneProductSearchCommand::class, BackfillMissingSkusCommand::class, ProcessErasureRequestsCommand::class]);
 
             //Overriding lunar:install
             $this->app->booted(fn() => $this->commands([InstallLunarCommand::class]));
diff --git a/src/Providers/CustomerServiceProvider.php b/src/Providers/CustomerServiceProvider.php
index 525006c..4b5f995 100644
--- a/src/Providers/CustomerServiceProvider.php
+++ b/src/Providers/CustomerServiceProvider.php
@@ -7,7 +7,12 @@ use Illuminate\Support\ServiceProvider;
 use Lunar\Facades\ModelManifest;
 use Lunar\Models\Contracts\Customer as LunarCustomer;
 use Modules\Core\Auth\Events\UserCreated;
+use Modules\Core\Customer\Events\CustomerAddressCreated;
+use Modules\Core\Customer\Events\CustomerAddressDeleted;
+use Modules\Core\Customer\Events\CustomerAddressUpdated;
+use Modules\Core\Customer\Events\CustomerProfileUpdated;
 use Modules\Core\Customer\Listeners\CreateCustomerForUser;
+use Modules\Core\Customer\Listeners\LogCustomerAccountActivity;
 use Modules\Core\Customer\Models\Customer;
 
 class CustomerServiceProvider extends ServiceProvider
@@ -17,5 +22,10 @@ class CustomerServiceProvider extends ServiceProvider
         ModelManifest::replace(LunarCustomer::class, Customer::class);
 
         Event::listen(UserCreated::class, CreateCustomerForUser::class);
+
+        Event::listen(CustomerAddressCreated::class, [LogCustomerAccountActivity::class, 'handleAddressCreated']);
+        Event::listen(CustomerAddressUpdated::class, [LogCustomerAccountActivity::class, 'handleAddressUpdated']);
+        Event::listen(CustomerAddressDeleted::class, [LogCustomerAccountActivity::class, 'handleAddressDeleted']);
+        Event::listen(CustomerProfileUpdated::class, [LogCustomerAccountActivity::class, 'handleProfileUpdated']);
     }
 }
diff --git a/src/Providers/LocalizationServiceProvider.php b/src/Providers/LocalizationServiceProvider.php
index d2392eb..112d481 100644
--- a/src/Providers/LocalizationServiceProvider.php
+++ b/src/Providers/LocalizationServiceProvider.php
@@ -11,15 +11,26 @@ use Modules\Core\Localization\Events\LanguageUpdated;
 use Modules\Core\Localization\Events\TranslationCreated;
 use Modules\Core\Localization\Events\TranslationDeleted;
 use Modules\Core\Localization\Events\TranslationUpdated;
-use Modules\Core\Localization\LanguageCacheObserver;
 use Modules\Core\Localization\Listeners\FlushLanguageCache;
 use Modules\Core\Localization\Listeners\FlushTranslationCache;
 use Modules\Core\Localization\Listeners\LogTranslationActivity;
 use Modules\Core\Localization\Listeners\MigrateTranslationsForRenamedLanguage;
-use Modules\Core\Localization\LocaleMiddleware;
+use Modules\Core\Localization\Middleware\LocaleMiddleware;
+use Modules\Core\Localization\Models\LanguageLine;
+use Modules\Core\Localization\Observers\LanguageCacheObserver;
 
 class LocalizationServiceProvider extends ServiceProvider
 {
+    public function register(): void
+    {
+        // Must run before Spatie\TranslationLoader\TranslationServiceProvider's
+        // register() merges its own config defaults - mergeConfigFrom() only fills
+        // in keys not already set, so setting this here (regardless of provider
+        // boot order) makes it win over the package's default
+        // Spatie\TranslationLoader\LanguageLine::class.
+        config(['translation-loader.model' => LanguageLine::class]);
+    }
+
     public function boot(): void
     {
         $this->app['router']->aliasMiddleware('locale', LocaleMiddleware::class);
diff --git a/src/Providers/OrderServiceProvider.php b/src/Providers/OrderServiceProvider.php
new file mode 100644
index 0000000..b5b57e5
--- /dev/null
+++ b/src/Providers/OrderServiceProvider.php
@@ -0,0 +1,113 @@
+<?php
+
+namespace Modules\Core\Providers;
+
+use Illuminate\Console\Scheduling\Schedule as ConsoleSchedule;
+use Illuminate\Support\Facades\Event;
+use Illuminate\Support\ServiceProvider;
+use Lunar\Models\Order;
+use Lunar\Models\Transaction;
+use Modules\Core\Checkout\Events\OrderPlaced;
+use Modules\Core\Notification\NotificationRegistry;
+use Modules\Core\Order\Commands\CloseExpiredReturnWindows;
+use Modules\Core\Order\Events\OrderDelivered;
+use Modules\Core\Order\Events\OrderPaidChanged;
+use Modules\Core\Order\Events\OrderPickedUp;
+use Modules\Core\Order\Events\OrderStatusChanged;
+use Modules\Core\Order\Listeners\AdvanceFulfillmentOnCarrierCheckpoint;
+use Modules\Core\Order\Listeners\AdvanceFulfillmentOnDelivered;
+use Modules\Core\Order\Listeners\ApplyResolvedPaymentStatus;
+use Modules\Core\Order\Listeners\CompleteOrderOnPickedUp;
+use Modules\Core\Order\Listeners\DecrementStockOnOrderPlaced;
+use Modules\Core\Order\Listeners\DeriveOrderDeliveredFromShipment;
+use Modules\Core\Order\Listeners\MarkDeliveryFailedOnCarrierCheckpoint;
+use Modules\Core\Order\Listeners\RecordPaymentTransaction;
+use Modules\Core\Order\Listeners\RecordStatusTransition;
+use Modules\Core\Order\Models\OrderStatusTransition;
+use Modules\Core\Order\Notifications\OrderCapturedNotification;
+use Modules\Core\Order\Notifications\OrderCompletedNotification;
+use Modules\Core\Order\Notifications\OrderDeliveredNotification;
+use Modules\Core\Order\Notifications\OrderDispatchedNotification;
+use Modules\Core\Order\Notifications\OrderPickupReadyNotification;
+use Modules\Core\Order\Notifications\OrderPlacedNotification;
+use Modules\Core\Order\Notifications\OrderRefundedNotification;
+use Modules\Core\Order\Notifications\OrderStatusUpdatedNotification;
+use Modules\Core\Order\Observers\OrderObserver;
+use Modules\Core\Order\Observers\TransactionObserver;
+use Modules\Core\Order\Support\OrderStatus;
+use Modules\Core\Payment\Events\PaymentAuthorized;
+use Modules\Core\Payment\Events\PaymentCaptured;
+use Modules\Core\Payment\Events\PaymentRefunded;
+use Modules\Core\Payment\Events\PaymentVoided;
+use Modules\Core\Shipping\Events\ShipmentStatusUpdatedByCarrier;
+
+class OrderServiceProvider extends ServiceProvider
+{
+    public function boot(): void
+    {
+        Order::observe(OrderObserver::class);
+        Transaction::observe(TransactionObserver::class);
+
+        Order::macro('paymentStatus', fn () => OrderStatus::payment($this));
+        Order::macro('fulfillmentStatus', fn () => OrderStatus::fulfillment($this));
+
+        Order::resolveRelationUsing('statusTransitions', function ($order) {
+            return $order->hasMany(OrderStatusTransition::class);
+        });
+
+        Event::listen(ShipmentStatusUpdatedByCarrier::class, DeriveOrderDeliveredFromShipment::class);
+        Event::listen(ShipmentStatusUpdatedByCarrier::class, AdvanceFulfillmentOnCarrierCheckpoint::class);
+        Event::listen(ShipmentStatusUpdatedByCarrier::class, MarkDeliveryFailedOnCarrierCheckpoint::class);
+        Event::listen(OrderDelivered::class, AdvanceFulfillmentOnDelivered::class);
+        Event::listen(OrderPickedUp::class, CompleteOrderOnPickedUp::class);
+
+        Event::listen(PaymentCaptured::class, ApplyResolvedPaymentStatus::class);
+        Event::listen(PaymentAuthorized::class, ApplyResolvedPaymentStatus::class);
+        Event::listen(PaymentCaptured::class, RecordPaymentTransaction::class);
+        Event::listen(PaymentAuthorized::class, RecordPaymentTransaction::class);
+        Event::listen(PaymentVoided::class, RecordPaymentTransaction::class);
+        // RecordPaymentTransaction must run before ApplyResolvedPaymentStatus
+        // for PaymentRefunded specifically — the latter now reads
+        // $order->transactions (via OrderStatus::payment()) to resolve
+        // Refunded vs PartiallyRefunded, which requires the refund
+        // Transaction row to already exist.
+        Event::listen(PaymentRefunded::class, RecordPaymentTransaction::class);
+        Event::listen(PaymentRefunded::class, ApplyResolvedPaymentStatus::class);
+
+        Event::listen(OrderPlaced::class, DecrementStockOnOrderPlaced::class);
+
+        Event::listen(OrderStatusChanged::class, [RecordStatusTransition::class, 'handleStatusChanged']);
+        Event::listen(OrderPaidChanged::class, [RecordStatusTransition::class, 'handlePaidChanged']);
+
+        NotificationRegistry::get()->register([
+            OrderDeliveredNotification::class,
+            OrderStatusUpdatedNotification::class,
+            OrderRefundedNotification::class,
+            OrderCapturedNotification::class,
+            OrderPlacedNotification::class,
+            OrderPickupReadyNotification::class,
+            OrderDispatchedNotification::class,
+            OrderCompletedNotification::class,
+        ]);
+
+        // Lets the consuming app override copy/markup without forking core
+        // — published into resources/views/vendor/core/order/notifications,
+        // which loadViewsFrom() (CoreServiceProvider) already resolves
+        // ahead of the package's own views for the `core::` namespace.
+        $this->publishes([
+            __DIR__ . '/../../resources/views/order/notifications' => resource_path('views/vendor/core/order/notifications'),
+        ], 'core-views');
+
+        if ($this->app->runningInConsole()) {
+            $this->commands([CloseExpiredReturnWindows::class]);
+        }
+
+        // Exact midnight per an explicit compliance requirement — not a
+        // loose dailyAt() offset or plain daily().
+        $this->app->booted(function () {
+            $this->app->make(ConsoleSchedule::class)
+                ->command(CloseExpiredReturnWindows::class)
+                ->dailyAt('00:00');
+        });
+    }
+}
diff --git a/src/Providers/PaymentServiceProvider.php b/src/Providers/PaymentServiceProvider.php
new file mode 100644
index 0000000..dc31e43
--- /dev/null
+++ b/src/Providers/PaymentServiceProvider.php
@@ -0,0 +1,80 @@
+<?php
+
+namespace Modules\Core\Providers;
+
+use Illuminate\Support\Facades\Event;
+use Illuminate\Support\ServiceProvider;
+use Lunar\Facades\ModelManifest;
+use Lunar\Models\Contracts\Transaction as TransactionContract;
+use Lunar\Pipelines\Cart\ApplyShipping;
+use Modules\Core\Command\SyncPaymentDriversCommand;
+use Modules\Core\Payment\Drivers\BankTransferPaymentDriver;
+use Modules\Core\Payment\Drivers\CashOnDeliveryPaymentDriver;
+use Modules\Core\Payment\Drivers\OfflinePaymentDriver;
+use Modules\Core\Payment\Drivers\StripePaymentDriver;
+use Modules\Core\Payment\Events\PaymentMethodCreated;
+use Modules\Core\Payment\Events\PaymentMethodDeleted;
+use Modules\Core\Payment\Events\PaymentMethodUpdated;
+use Modules\Core\Payment\Listeners\LogPaymentMethodActivity;
+use Modules\Core\Payment\Models\CoreTransaction;
+use Modules\Core\Payment\Services\PaymentDriverRegistry;
+
+class PaymentServiceProvider extends ServiceProvider
+{
+    public function register(): void
+    {
+        $this->mergeConfigFrom(__DIR__ . '/../../config/payment.php', 'payment');
+
+        $this->app->singleton(PaymentDriverRegistry::class);
+    }
+
+    public function boot(): void
+    {
+        $registry = $this->app->make(PaymentDriverRegistry::class);
+        $registry->register('offline', OfflinePaymentDriver::class, 'Offline / Manual');
+        $registry->register('stripe', StripePaymentDriver::class, 'Stripe');
+        $registry->register('bank-transfer', BankTransferPaymentDriver::class, 'Bank Transfer');
+        $registry->register('cash-on-delivery', CashOnDeliveryPaymentDriver::class, 'Cash on Delivery');
+
+        $cartPipeline = config('lunar.cart.pipelines.cart', []);
+        $insertAfter = array_search(ApplyShipping::class, $cartPipeline, true);
+
+        foreach (config('payment.cart_pipeline', []) as $pipe) {
+            if (in_array($pipe, $cartPipeline, true)) {
+                continue;
+            }
+
+            if ($insertAfter === false) {
+                $cartPipeline[] = $pipe;
+            } else {
+                array_splice($cartPipeline, $insertAfter + 1, 0, [$pipe]);
+                $insertAfter++;
+            }
+        }
+
+        config(['lunar.cart.pipelines.cart' => $cartPipeline]);
+
+        // Same contract-swap mechanism this codebase already uses for
+        // Customer/Staff (see e.g. consuming apps' own AppServiceProvider,
+        // ModelManifest::replace(Contracts\Customer::class, ...)) — every
+        // place Lunar's own code resolves a transaction via
+        // Transaction::modelClass() (Order::transactions()'s own relation
+        // included) gets Modules\Core\Payment\Models\CoreTransaction
+        // instead of the vendor's own Transaction. That subclass's
+        // driver() override is the ENTIRE fix for the admin panel's
+        // refund/capture actions silently landing on our real payment
+        // system — see CoreTransaction's own docblock. Lunar's own
+        // Payments facade/PaymentManager is never touched at all.
+        ModelManifest::replace(TransactionContract::class, CoreTransaction::class);
+
+        Event::listen(PaymentMethodCreated::class, [LogPaymentMethodActivity::class, 'handleCreated']);
+        Event::listen(PaymentMethodUpdated::class, [LogPaymentMethodActivity::class, 'handleUpdated']);
+        Event::listen(PaymentMethodDeleted::class, [LogPaymentMethodActivity::class, 'handleDeleted']);
+
+        $this->loadRoutesFrom(__DIR__ . '/../Payment/routes/webhooks.php');
+
+        if ($this->app->runningInConsole()) {
+            $this->commands([SyncPaymentDriversCommand::class]);
+        }
+    }
+}
diff --git a/src/Providers/ReviewServiceProvider.php b/src/Providers/ReviewServiceProvider.php
index 0651a6c..87bea35 100644
--- a/src/Providers/ReviewServiceProvider.php
+++ b/src/Providers/ReviewServiceProvider.php
@@ -9,8 +9,8 @@ use Modules\Core\Review\Models\ProductReview;
  * Keeps a product's Meilisearch document in sync with its reviews. A review is
  * created/edited independently of its product (customer submission, staff reply),
  * so the product's own save/update events never fire for it — without this listener,
- * Modules\Core\Search\ProductIndexer's review data would only refresh on the next
- * full product reindex.
+ * Modules\Core\Catalog\Services\ProductIndexer's review data would only refresh on
+ * the next full product reindex.
  */
 class ReviewServiceProvider extends ServiceProvider
 {
diff --git a/src/Providers/ShippingServiceProvider.php b/src/Providers/ShippingServiceProvider.php
new file mode 100644
index 0000000..55e8121
--- /dev/null
+++ b/src/Providers/ShippingServiceProvider.php
@@ -0,0 +1,157 @@
+<?php
+
+namespace Modules\Core\Providers;
+
+use Illuminate\Console\Scheduling\Schedule as ConsoleSchedule;
+use Illuminate\Support\Facades\Event;
+use Illuminate\Support\ServiceProvider;
+use Livewire\Livewire;
+use Livewire\Mechanisms\ComponentRegistry;
+use Lunar\Models\Order;
+use Lunar\Shipping\Facades\Shipping;
+use Lunar\Shipping\Filament\Resources\ShippingZoneResource\Pages\ManageShippingRates as VendorManageShippingRates;
+use Lunar\Shipping\Models\ShippingMethod;
+use Modules\Core\Cart\Events\CartCleared;
+use Modules\Core\Cart\Events\CartLineAdded;
+use Modules\Core\Cart\Events\CartLineRemoved;
+use Modules\Core\Cart\Events\CartLineUpdated;
+use Modules\Core\Checkout\Events\ShippingAddressSet;
+use Modules\Core\Shipping\Carriers\Acs\AcsClient;
+use Modules\Core\Shipping\Carriers\Acs\AcsFulfillmentService;
+use Modules\Core\Shipping\Carriers\Acs\AcsRateDriver;
+use Modules\Core\Shipping\Carriers\Acs\Jobs\WarmAcsAreaCacheJob;
+use Modules\Core\Shipping\Carriers\BoxNow\BoxNowClient;
+use Modules\Core\Shipping\Carriers\BoxNow\BoxNowFulfillmentService;
+use Modules\Core\Shipping\Carriers\BoxNow\BoxNowRateDriver;
+use Modules\Core\Shipping\Contracts\CarrierFulfillmentInterface;
+use Modules\Core\Shipping\Filament\Pages\ManageShippingRates;
+use Modules\Core\Shipping\Jobs\PollShipmentTrackingJob;
+use Modules\Core\Shipping\Listeners\InvalidateShippingOptions;
+use Modules\Core\Shipping\Support\FulfillmentType;
+use Modules\Core\Shipping\Models\Shipment;
+
+class ShippingServiceProvider extends ServiceProvider
+{
+    public function register(): void
+    {
+        $this->mergeConfigFrom(__DIR__ . '/../../config/shippingCarriers/acs.php', 'acs');
+        $this->mergeConfigFrom(__DIR__ . '/../../config/shippingCarriers/boxnow.php', 'boxnow');
+
+        $this->app->singleton(AcsClient::class, fn () => new AcsClient(config('acs')));
+        $this->app->singleton(BoxNowClient::class, fn () => new BoxNowClient(config('boxnow')));
+
+        $this->app->bind(CarrierFulfillmentInterface::class, function ($app, array $params) {
+            return match ($params['carrier'] ?? null) {
+                'acs' => $app->make(AcsFulfillmentService::class),
+                'box-now' => $app->make(BoxNowFulfillmentService::class),
+                default => null,
+            };
+        });
+
+        // The vendor Rates page has no extension hook, so we swap it for
+        // our subclass everywhere. Route::get($path, VendorClass::class)
+        // instantiates the vendor class directly via the container for the
+        // initial full-page load (bypassing Livewire's component registry
+        // entirely), so this container bind is required in addition to the
+        // Livewire::component() re-registration below — the bind covers
+        // first load, the Livewire registration covers every AJAX
+        // round-trip (form submits, table interactions) afterwards.
+        $this->app->bind(VendorManageShippingRates::class, ManageShippingRates::class);
+    }
+
+    public function boot(): void
+    {
+        $this->publishes([
+            __DIR__ . '/../../config/shippingCarriers/acs.php' => config_path('shippingCarriers/acs.php'),
+            __DIR__ . '/../../config/shippingCarriers/boxnow.php' => config_path('shippingCarriers/boxnow.php'),
+        ], 'core-config');
+
+        // Signed-URL auth only, same model as Lunar's own vendor
+        // lunar.pdf.download route — see Modules\Core\Shipping\Http\
+        // Controllers\DownloadShipmentLabelController's own docblock.
+        $this->loadRoutesFrom(__DIR__ . '/../Shipping/routes/web.php');
+
+        Order::resolveRelationUsing('shipments', function ($order) {
+            return $order->hasMany(Shipment::class);
+        });
+
+        // Order has no direct ShippingMethod relation — shippingAddress.
+        // shipping_option is only ever a code string (see
+        // Modules\Core\Shipping\Extensions\OrderViewExtension::
+        // resolveCarrier() for the same lookup pattern already used to
+        // resolve a carrier driver from it).
+        //
+        // Resolves via Modules\Core\Shipping\Support\FulfillmentType (driver-
+        // declared for acs/box-now, merchant-configured data['fulfillment_type']
+        // fallback for table-rate-shipping's generic drivers) rather than
+        // through a ShippingMethod::macro('isStorePickup', ...) —
+        // Lunar\Base\Traits\HasModelExtending::__callStatic() (used by
+        // Lunar\Shipping\Models\ShippingMethod via Lunar\Base\BaseModel)
+        // intercepts EVERY unmatched static call, including macro()
+        // itself, and dispatches it as (new static)->macro(...) instead
+        // of forwarding to Macroable — so a macro registered this way
+        // silently never gets stored, and hasMacro() always returns
+        // false. (Lunar\Models\Order is unaffected because it declares
+        // its own macro() method directly, bypassing __callStatic
+        // entirely — that's why Order::macro('isStorePickupOrder', ...)
+        // below still works.)
+        Order::macro('isStorePickupOrder', function () {
+            /** @var Order $this */
+            $code = $this->shippingAddress?->shipping_option;
+
+            if (! $code) {
+                return false;
+            }
+
+            // ->value('data') is deliberately avoided here — on Postgres,
+            // ->value()/->pluck() on a JSON column silently return the
+            // wrong result (works fine in ->where(), not in a column
+            // projection); loading the model and reading its cast
+            // attribute avoids that entirely.
+            $method = ShippingMethod::where('code', $code)->first();
+
+            return $method && FulfillmentType::isStorePickup($method);
+        });
+
+        foreach ([CartLineAdded::class, CartLineUpdated::class, CartLineRemoved::class, CartCleared::class, ShippingAddressSet::class] as $event) {
+            Event::listen($event, [InvalidateShippingOptions::class, 'handle']);
+        }
+
+        // Deferred: the Shipping facade resolves a binding registered in
+        // lunarphp/table-rate-shipping's own ShippingServiceProvider::boot(),
+        // and provider boot order between packages isn't guaranteed.
+        $this->app->booted(function () {
+            Shipping::extend('acs', fn ($app) => $app->make(AcsRateDriver::class));
+            Shipping::extend('box-now', fn ($app) => $app->make(BoxNowRateDriver::class));
+
+            $this->app->make(ConsoleSchedule::class)
+                ->job(new WarmAcsAreaCacheJob)
+                ->dailyAt('06:00')
+                ->when(fn () => ShippingMethod::where('driver', 'acs')->exists());
+
+            $this->app->make(ConsoleSchedule::class)
+                ->job(new PollShipmentTrackingJob)
+                ->everyThirtyMinutes();
+
+            $this->overrideRatesPageLivewireComponent();
+        });
+    }
+
+    /**
+     * The vendor Rates page has no extension hook, so we swap it for our
+     * subclass (see Shipping/Filament/Pages/ManageShippingRates). Filament
+     * already registered the vendor class as a Livewire component under a
+     * name derived from its class string (see
+     * Panel::registerLivewireComponents()); Livewire's own registry is a
+     * simple last-write-wins name => class map, so re-registering the same
+     * derived name against our subclass here overrides it — keeping the
+     * route, sub-navigation, and every Livewire round-trip (including form
+     * submissions) pointed at one consistent component identity.
+     */
+    private function overrideRatesPageLivewireComponent(): void
+    {
+        $name = $this->app->make(ComponentRegistry::class)->getName(VendorManageShippingRates::class);
+
+        Livewire::component($name, ManageShippingRates::class);
+    }
+}
diff --git a/src/Recovery/Events/CartAbandoned.php b/src/Recovery/Events/CartAbandoned.php
new file mode 100644
index 0000000..fa7ae7e
--- /dev/null
+++ b/src/Recovery/Events/CartAbandoned.php
@@ -0,0 +1,31 @@
+<?php
+
+namespace Modules\Core\Recovery\Events;
+
+use Lunar\Models\Cart;
+
+/**
+ * A cart has gone stale (no activity for config('core.cart.abandoned_after'))
+ * with NO order ever started — the shopper added items and never began
+ * checkout. Weak purchase-intent signal: usually a browsing/price-check
+ * action, not a near-purchase. Distinct from CheckoutAbandoned, which fires
+ * for a cart that DID reach checkout (a draft Order exists) but never placed
+ * it — a much stronger intent signal, and reachable via the email/address
+ * checkout itself usually captures even for a guest.
+ *
+ * Lives under Recovery, not Cart — abandonment detection/tracking is
+ * deliberately kept out of the Cart module entirely, including its event
+ * definitions, so Cart has no abandonment-related code at all. See
+ * docs/cart.md and docs/recovery-strategies.md.
+ *
+ * "Abandoned" is a derived state (stale updated_at), not something that
+ * transitions via a normal Eloquent write, so there's no natural model-event
+ * hook to dispatch this from directly — detection is Recovery's own concern
+ * (not yet built; design notes in docs/recovery-strategies.md).
+ */
+class CartAbandoned
+{
+    public function __construct(
+        public readonly Cart $cart,
+    ) {}
+}
diff --git a/src/Recovery/Events/CheckoutAbandoned.php b/src/Recovery/Events/CheckoutAbandoned.php
new file mode 100644
index 0000000..d83a37b
--- /dev/null
+++ b/src/Recovery/Events/CheckoutAbandoned.php
@@ -0,0 +1,33 @@
+<?php
+
+namespace Modules\Core\Recovery\Events;
+
+use Lunar\Models\Cart;
+use Lunar\Models\Order;
+
+/**
+ * A cart's checkout has gone stale (no activity for
+ * config('core.cart.abandoned_after')) with a draft Order already created
+ * (Order::isDraft() — placed_at IS NULL) but never placed. Strong
+ * purchase-intent signal — the shopper committed to checking out, something
+ * blocked completion. Distinct from CartAbandoned, which fires for a cart
+ * with no order at all (weak intent, usually unreachable). Checkout
+ * typically captures an email/address even for a guest, so this state is
+ * normally reachable regardless of login status.
+ *
+ * Lives under Recovery, not Checkout/Cart — abandonment detection/tracking
+ * is deliberately kept out of both modules entirely, including its event
+ * definitions. See docs/cart.md and docs/recovery-strategies.md.
+ *
+ * "Abandoned" is a derived state (stale updated_at, no placed_at), not
+ * something that transitions via a normal Eloquent write — detection is
+ * Recovery's own concern (not yet built; design notes in
+ * docs/recovery-strategies.md).
+ */
+class CheckoutAbandoned
+{
+    public function __construct(
+        public readonly Cart $cart,
+        public readonly Order $order,
+    ) {}
+}
diff --git a/src/ResultType/Error.php b/src/ResultType/Error.php
index f6b457b..1f434b6 100644
--- a/src/ResultType/Error.php
+++ b/src/ResultType/Error.php
@@ -4,6 +4,7 @@ declare(strict_types=1);
 
 namespace Modules\Core\ResultType;
 
+use Modules\Core\Option\Option;
 use Modules\Core\Option\None;
 use Modules\Core\Option\Some;
 
@@ -11,7 +12,7 @@ use Modules\Core\Option\Some;
  * @template T
  * @template E
  *
- * @extends \Modules\Core\ResultType\Result<T,E>
+ * @extends Result<T, E>
  */
 final class Error extends Result
 {
@@ -39,7 +40,7 @@ final class Error extends Result
      *
      * @param F $value
      *
-     * @return \Modules\Core\ResultType\Result<T,F>
+     * @return Result<T, F>
      */
     public static function create($value): Error
     {
@@ -49,7 +50,7 @@ final class Error extends Result
     /**
      * Get the success option value.
      *
-     * @return \Modules\Core\Option\Option<T>
+     * @return Option<T>
      */
     public function success()
     {
@@ -63,7 +64,7 @@ final class Error extends Result
      *
      * @param callable(T):S $f
      *
-     * @return \Modules\Core\ResultType\Result<S,E>
+     * @return Result<S, E>
      */
     public function map(callable $f): Result
     {
@@ -76,20 +77,20 @@ final class Error extends Result
      * @template S
      * @template F
      *
-     * @param callable(T):\Modules\Core\ResultType\Result<S,F> $f
+     * @param callable(T):Result<S, F> $f
      *
-     * @return \Modules\Core\ResultType\Result<S,F>
+     * @return Result<S, F>
      */
     public function flatMap(callable $f): Result
     {
-        /** @var \Modules\Core\ResultType\Result<S,F> */
+        /** @var Result<S, F> */
         return self::create($this->value);
     }
 
     /**
      * Get the error option value.
      *
-     * @return \Modules\Core\Option\Option<E>
+     * @return Option<E>
      */
     public function error(): Some
     {
@@ -103,7 +104,7 @@ final class Error extends Result
      *
      * @param callable(E):F $f
      *
-     * @return \Modules\Core\ResultType\Result<T,F>
+     * @return Result<T, F>
      */
     public function mapError(callable $f): Result
     {
diff --git a/src/ResultType/Result.php b/src/ResultType/Result.php
index 9a5646a..5e75cee 100644
--- a/src/ResultType/Result.php
+++ b/src/ResultType/Result.php
@@ -4,6 +4,8 @@ declare(strict_types=1);
 
 namespace Modules\Core\ResultType;
 
+use Modules\Core\Option\Option;
+
 /**
  * @template T
  * @template E
@@ -13,7 +15,7 @@ abstract class Result
     /**
      * Get the success option value.
      *
-     * @return \Modules\Core\Option\Option<T>
+     * @return Option<T>
      */
     abstract public function success();
 
@@ -24,7 +26,7 @@ abstract class Result
      *
      * @param callable(T):S $f
      *
-     * @return \Modules\Core\ResultType\Result<S,E>
+     * @return Result<S, E>
      */
     abstract public function map(callable $f);
 
@@ -34,16 +36,16 @@ abstract class Result
      * @template S
      * @template F
      *
-     * @param callable(T):\Modules\Core\ResultType\Result<S,F> $f
+     * @param callable(T):Result<S, F> $f
      *
-     * @return \Modules\Core\ResultType\Result<S,F>
+     * @return Result<S, F>
      */
     abstract public function flatMap(callable $f);
 
     /**
      * Get the error option value.
      *
-     * @return \Modules\Core\Option\Option<E>
+     * @return Option<E>
      */
     abstract public function error();
 
@@ -54,7 +56,7 @@ abstract class Result
      *
      * @param callable(E):F $f
      *
-     * @return \Modules\Core\ResultType\Result<T,F>
+     * @return Result<T, F>
      */
     abstract public function mapError(callable $f);
 }
diff --git a/src/ResultType/Success.php b/src/ResultType/Success.php
index c36fa97..a17c1f8 100644
--- a/src/ResultType/Success.php
+++ b/src/ResultType/Success.php
@@ -4,6 +4,7 @@ declare(strict_types=1);
 
 namespace Modules\Core\ResultType;
 
+use Modules\Core\Option\Option;
 use Modules\Core\Option\None;
 use Modules\Core\Option\Some;
 
@@ -11,7 +12,7 @@ use Modules\Core\Option\Some;
  * @template T
  * @template E
  *
- * @extends \Modules\Core\ResultType\Result<T,E>
+ * @extends Result<T, E>
  */
 final class Success extends Result
 {
@@ -39,7 +40,7 @@ final class Success extends Result
      *
      * @param S $value
      *
-     * @return \Modules\Core\ResultType\Result<S,E>
+     * @return Result<S, E>
      */
     public static function create($value): Success
     {
@@ -49,7 +50,7 @@ final class Success extends Result
     /**
      * Get the success option value.
      *
-     * @return \Modules\Core\Option\Option<T>
+     * @return Option<T>
      */
     public function success(): Some
     {
@@ -63,7 +64,7 @@ final class Success extends Result
      *
      * @param callable(T):S $f
      *
-     * @return \Modules\Core\ResultType\Result<S,E>
+     * @return Result<S, E>
      */
     public function map(callable $f): Result
     {
@@ -76,9 +77,9 @@ final class Success extends Result
      * @template S
      * @template F
      *
-     * @param callable(T):\Modules\Core\ResultType\Result<S,F> $f
+     * @param callable(T):Result<S, F> $f
      *
-     * @return \Modules\Core\ResultType\Result<S,F>
+     * @return Result<S, F>
      */
     public function flatMap(callable $f)
     {
@@ -88,7 +89,7 @@ final class Success extends Result
     /**
      * Get the error option value.
      *
-     * @return \Modules\Core\Option\Option<E>
+     * @return Option<E>
      */
     public function error()
     {
@@ -102,7 +103,7 @@ final class Success extends Result
      *
      * @param callable(E):F $f
      *
-     * @return \Modules\Core\ResultType\Result<T,F>
+     * @return Result<T, F>
      */
     public function mapError(callable $f): Result
     {
diff --git a/src/Review/Extensions/ProductResourceExtension.php b/src/Review/Filament/Extensions/ProductResourceExtension.php
similarity index 78%
rename from src/Review/Extensions/ProductResourceExtension.php
rename to src/Review/Filament/Extensions/ProductResourceExtension.php
index 120154e..9d36031 100644
--- a/src/Review/Extensions/ProductResourceExtension.php
+++ b/src/Review/Filament/Extensions/ProductResourceExtension.php
@@ -1,9 +1,9 @@
 <?php
 
-namespace Modules\Core\Review\Extensions;
+namespace Modules\Core\Review\Filament\Extensions;
 
 use Lunar\Admin\Support\Extending\ResourceExtension;
-use Modules\Core\Review\Pages\ManageProductReviews;
+use Modules\Core\Review\Filament\Pages\ManageProductReviews;
 
 class ProductResourceExtension extends ResourceExtension
 {
diff --git a/src/Review/Pages/ManageProductReviews.php b/src/Review/Filament/Pages/ManageProductReviews.php
similarity index 91%
rename from src/Review/Pages/ManageProductReviews.php
rename to src/Review/Filament/Pages/ManageProductReviews.php
index a81d1ce..2ee43bf 100644
--- a/src/Review/Pages/ManageProductReviews.php
+++ b/src/Review/Filament/Pages/ManageProductReviews.php
@@ -1,16 +1,16 @@
 <?php
 
-namespace Modules\Core\Review\Pages;
+namespace Modules\Core\Review\Filament\Pages;
 
-use Filament\Forms\Components\Group;
+use Filament\Schemas\Schema;
+use Filament\Schemas\Components\Group;
+use Filament\Actions\ViewAction;
+use Filament\Actions\Action;
+use Filament\Actions\DeleteAction;
+use Filament\Actions\DeleteBulkAction;
 use Filament\Forms\Components\Placeholder;
 use Filament\Forms\Components\Textarea;
 use Filament\Forms\Components\TextInput;
-use Filament\Forms\Form;
-use Filament\Tables\Actions\Action;
-use Filament\Tables\Actions\DeleteAction;
-use Filament\Tables\Actions\DeleteBulkAction;
-use Filament\Tables\Actions\ViewAction;
 use Filament\Tables\Columns\TextColumn;
 use Filament\Tables\Table;
 use Illuminate\Support\Carbon;
@@ -40,10 +40,10 @@ class ManageProductReviews extends BaseManageRelatedRecords
         return 'Reviews';
     }
 
-    public function form(Form $form): Form
+    public function form(Schema $schema): Schema
     {
-        return $form
-            ->schema([
+        return $schema
+            ->components([
                 TextInput::make('rating')
                     ->label('Rating')
                     ->disabled(),
@@ -127,12 +127,12 @@ class ManageProductReviews extends BaseManageRelatedRecords
             ->filters([
                 //
             ])
-            ->actions([
+            ->recordActions([
                 ViewAction::make(),
                 Action::make('reply')
                     ->label(fn (ProductReview $record) => $record->reply ? 'Edit reply' : 'Reply')
                     ->icon('heroicon-o-chat-bubble-left-right')
-                    ->form([
+                    ->schema([
                         Textarea::make('reply')
                             ->label('Reply')
                             ->required(),
@@ -146,7 +146,7 @@ class ManageProductReviews extends BaseManageRelatedRecords
                     }),
                 DeleteAction::make(),
             ])
-            ->bulkActions([
+            ->toolbarActions([
                 DeleteBulkAction::make(),
             ]);
     }
diff --git a/src/Review/Models/ProductReview.php b/src/Review/Models/ProductReview.php
index 978c17e..32a257e 100644
--- a/src/Review/Models/ProductReview.php
+++ b/src/Review/Models/ProductReview.php
@@ -5,8 +5,11 @@ namespace Modules\Core\Review\Models;
 use Illuminate\Database\Eloquent\Model;
 use Illuminate\Database\Eloquent\Relations\BelongsTo;
 use Lunar\Models\Product;
+use Spatie\Image\Enums\BorderType;
+use Spatie\Image\Enums\Fit;
 use Spatie\MediaLibrary\HasMedia;
 use Spatie\MediaLibrary\InteractsWithMedia;
+use Spatie\MediaLibrary\MediaCollections\Models\Media;
 
 class ProductReview extends Model implements HasMedia
 {
@@ -30,4 +33,23 @@ class ProductReview extends Model implements HasMedia
     {
         $this->addMediaCollection(self::IMAGES_COLLECTION);
     }
+
+    /**
+     * Unlike Product/ProductVariant, this model sits outside Lunar's own
+     * MediaDefinitionsInterface (Lunar\Base\StandardMediaDefinitions), which is
+     * what registers the 'small' conversion those models get automatically. Without
+     * this, Modules\Core\Catalog\Services\ProductIndexer::mapMedia() — shared across
+     * product, variant, and review media — throws Spatie\MediaLibrary\MediaCollections\
+     * Exceptions\InvalidConversion the first time a review has an image, since
+     * $media->getUrl('small') has no matching conversion to resolve.
+     */
+    public function registerMediaConversions(?Media $media = null): void
+    {
+        $this->addMediaConversion('small')
+            ->fit(Fit::Fill, 300, 300)
+            ->border(0, BorderType::Overlay, color: '#FFF')
+            ->background('#FFF')
+            ->sharpen(10)
+            ->keepOriginalImageFormat();
+    }
 }
diff --git a/src/Search/ProductIndexer.php b/src/Search/ProductIndexer.php
deleted file mode 100644
index cd6fc3d..0000000
--- a/src/Search/ProductIndexer.php
+++ /dev/null
@@ -1,177 +0,0 @@
-<?php
-
-namespace Modules\Core\Search;
-
-use Illuminate\Database\Eloquent\Builder;
-use Illuminate\Database\Eloquent\Model;
-use Lunar\Models\Currency;
-use Lunar\Models\Price;
-use Lunar\Models\Product;
-use Lunar\Models\ProductVariant;
-use Lunar\Search\ProductIndexer as BaseProductIndexer;
-use Modules\Core\Review\Models\ProductReview;
-use Spatie\MediaLibrary\MediaCollections\Models\Media;
-
-/**
- * Extends Lunar's own indexer so Modules\Core\Catalog\ProductService can serve both
- * listing/filtering AND single-product lookups from Meilisearch alone — one data
- * source, no separate database read path for a product detail page. Adds:
- *   - collections (ids, filterable) and collection_names (display)
- *   - slugs (every locale's Url::slug for the product, filterable) — lets
- *     ProductService::getBySlug() resolve a product from the index directly, with
- *     no database read at all
- *   - price (cheapest variant, filterable) and full per-variant pricing
- *   - variants: sku, stock, purchasable, option values, prices, media
- *   - the full media gallery (not just the single thumbnail Lunar's base indexer sends)
- *   - tags
- *   - reviews: public-safe fields only (see mapReview() — reviewer_email is deliberately
- *     excluded, it's PII with no storefront use), including staff replies, plus an
- *     average rating
- *
- * A review is created/edited independently of its product (Modules\Core\Providers\
- * ReviewServiceProvider re-indexes the product on review create/update/delete), so
- * this data doesn't go stale between full reindexes.
- *
- * New fields aren't filterable in Meilisearch until `php artisan lunar:meilisearch:setup`
- * re-syncs index settings, and existing documents need `lunar:search:index --refresh` to
- * pick up the new shape — see docs/product-listing.md. If SCOUT_QUEUE is enabled, the
- * queue worker also needs restarting after deploying changes to this class (see
- * docs/lunar.md "Gotchas" — a running worker keeps stale indexer code in memory).
- */
-class ProductIndexer extends BaseProductIndexer
-{
-    public function getFilterableFields(): array
-    {
-        return [
-            ...parent::getFilterableFields(),
-            'id',
-            'brand',
-            'collections',
-            'price',
-            'slugs',
-        ];
-    }
-
-    public function makeAllSearchableUsing(Builder $query): Builder
-    {
-        return parent::makeAllSearchableUsing($query)->with([
-            'collections',
-            'media',
-            'tags',
-            'urls',
-            'variants.images',
-            'variants.prices',
-            'variants.values.option',
-        ]);
-    }
-
-    public function toSearchableArray(Model $model): array
-    {
-        /** @var Product $model */
-        $data = parent::toSearchableArray($model);
-
-        $currency = Currency::getDefault();
-        $reviews = ProductReview::where('product_id', $model->id)->with('media')->get();
-
-        $data['collections'] = $model->collections->pluck('id')->map(fn ($id) => (string) $id)->all();
-        $data['collection_names'] = $model->collections->map(fn ($collection) => $collection->translateAttribute('name'))->all();
-        $data['slugs'] = $model->urls->pluck('slug')->unique()->values()->all();
-        $data['tags'] = $model->tags->pluck('value')->all();
-        $data['media'] = $model->media->map(fn (Media $media) => $this->mapMedia($media))->all();
-        $data['variants'] = $model->variants->map(fn (ProductVariant $variant) => $this->mapVariant($variant, $currency))->all();
-        $data['price'] = $this->cheapestPrice($model, $currency);
-        $data['reviews'] = $reviews->map(fn (ProductReview $review) => $this->mapReview($review))->all();
-        $data['review_count'] = $reviews->count();
-        $data['average_rating'] = $reviews->isEmpty() ? null : round($reviews->avg('rating'), 1);
-
-        return $data;
-    }
-
-    private function mapVariant(ProductVariant $variant, Currency $currency): array
-    {
-        return [
-            'id' => $variant->id,
-            'sku' => $variant->sku,
-            'stock' => $variant->stock,
-            'purchasable' => $variant->purchasable,
-            'options' => $variant->values->map(fn ($value) => [
-                'option' => $this->translatedName($value->option->name),
-                'value' => $this->translatedName($value->name),
-                'meta' => $value->meta,
-            ])->all(),
-            'prices' => $variant->prices->map(fn (Price $price) => [
-                'currency_id' => $price->currency_id,
-                'customer_group_id' => $price->customer_group_id,
-                'price' => $price->price->decimal(),
-                'compare_price' => $price->compare_price?->decimal(),
-                'min_quantity' => $price->min_quantity,
-            ])->all(),
-            'media' => $variant->images->map(fn (Media $media) => $this->mapMedia($media))->all(),
-        ];
-    }
-
-    /**
-     * Public-safe fields only — reviewer_email is PII with no storefront use and is
-     * deliberately excluded, unlike every other column on the review. reply/replied_at
-     * (the staff response) are included since they're meant to be shown alongside the
-     * review on the storefront.
-     */
-    private function mapReview(ProductReview $review): array
-    {
-        return [
-            'id' => $review->id,
-            'title' => $review->title,
-            'body' => $review->body,
-            'rating' => $review->rating,
-            'reviewed_at' => $review->reviewed_at?->timestamp,
-            'reviewer_name' => $review->reviewer_name,
-            'reply' => $review->reply,
-            'replied_at' => $review->replied_at?->timestamp,
-            'location' => $review->location,
-            'media' => $review->media->map(fn (Media $media) => $this->mapMedia($media))->all(),
-        ];
-    }
-
-    /**
-     * ProductOption/ProductOptionValue's `name` is a plain locale-keyed array cast
-     * (AsArrayObject) directly on the column — unlike Product/Collection/Brand, it is
-     * not stored in attribute_data. Lunar's translateAttribute() only reads
-     * attribute_data, so it silently returns null for these two models; this reads
-     * the array directly instead. Falls back to the first available locale if the
-     * current one is missing. Not a general replacement for translateAttribute() —
-     * every other translated field in this indexer (product/collection name and
-     * description) genuinely is attribute_data-backed and translateAttribute() is
-     * correct for those.
-     */
-    private function translatedName(mixed $name): ?string
-    {
-        $names = is_array($name) ? $name : (array) $name;
-
-        return $names[app()->getLocale()] ?? reset($names) ?: null;
-    }
-
-    private function mapMedia(Media $media): array
-    {
-        return [
-            'id' => $media->id,
-            'url' => $media->getUrl(),
-            'thumb' => $media->getUrl('small'),
-        ];
-    }
-
-    /**
-     * The cheapest variant's base price (no customer group) in the default currency,
-     * as a float in major units — e.g. 19.99, not 1999. Null if the product has no
-     * variant with a price in that currency yet, so it's excluded from price filters
-     * rather than sorting to the bottom as if it were free.
-     */
-    private function cheapestPrice(Product $model, Currency $currency): ?float
-    {
-        $price = $model->variants
-            ->flatMap(fn ($variant) => $variant->prices)
-            ->filter(fn ($price) => $price->currency_id === $currency->id && $price->customer_group_id === null)
-            ->min(fn ($price) => $price->price->value);
-
-        return $price !== null ? $price / (10 ** $currency->decimal_places) : null;
-    }
-}
diff --git a/src/Search/ProductSearchService.php b/src/Search/ProductSearchService.php
deleted file mode 100644
index 94827ba..0000000
--- a/src/Search/ProductSearchService.php
+++ /dev/null
@@ -1,56 +0,0 @@
-<?php
-
-namespace Modules\Core\Search;
-
-use Illuminate\Database\Eloquent\Collection;
-use Illuminate\Support\Facades\App;
-use Lunar\Facades\AttributeManifest;
-use Lunar\Models\Language;
-use Lunar\Models\Product;
-
-/**
- * Lunar's Meilisearch indexer flattens translated attributes into locale-suffixed
- * fields on a single document (name_en, name_el, description_en, description_el —
- * see Lunar\Search\ScoutIndexer::mapSearchableAttributes()), not separate indexes
- * or a filterable locale field. Locale-aware search means choosing which fields
- * to search on, not filtering results by locale.
- */
-class ProductSearchService
-{
-    /**
-     * @return Collection<int, Product>
-     */
-    public function search(string $query, ?string $locale = null): Collection
-    {
-        $locale ??= App::getLocale();
-        $defaultLocale = Language::getDefault()->code;
-
-        return Product::search($query)
-            ->options([
-                'attributesToSearchOn' => $this->searchableFields($locale, $defaultLocale),
-            ])
-            ->get();
-    }
-
-    /**
-     * Target the resolved locale's fields plus the default locale's fields, so a
-     * product that's only ever been translated into the default language still
-     * surfaces when searched in another locale, instead of becoming invisible
-     * until every product is fully translated.
-     *
-     * @return array<int, string>
-     */
-    private function searchableFields(string $locale, string $defaultLocale): array
-    {
-        $handles = AttributeManifest::getSearchableAttributes(Product::morphName())
-            ->pluck('handle');
-
-        $locales = array_unique([$locale, $defaultLocale]);
-
-        return $handles
-            ->crossJoin($locales)
-            ->map(fn (array $pair) => "{$pair[0]}_{$pair[1]}")
-            ->values()
-            ->all();
-    }
-}
diff --git a/src/Shipping/Carriers/Acs/AcsArea.php b/src/Shipping/Carriers/Acs/AcsArea.php
new file mode 100644
index 0000000..a4fe1b5
--- /dev/null
+++ b/src/Shipping/Carriers/Acs/AcsArea.php
@@ -0,0 +1,11 @@
+<?php
+
+namespace Modules\Core\Shipping\Carriers\Acs;
+
+class AcsArea
+{
+    public function __construct(
+        public readonly string $stationId,
+        public readonly int $branchId,
+    ) {}
+}
diff --git a/src/Shipping/Carriers/Acs/AcsClient.php b/src/Shipping/Carriers/Acs/AcsClient.php
new file mode 100644
index 0000000..540921e
--- /dev/null
+++ b/src/Shipping/Carriers/Acs/AcsClient.php
@@ -0,0 +1,34 @@
+<?php
+
+namespace Modules\Core\Shipping\Carriers\Acs;
+
+use Illuminate\Support\Facades\Http;
+
+class AcsClient
+{
+    public function __construct(private readonly array $config) {}
+
+    public function call(string $alias, array $parameters = []): AcsResponse
+    {
+        $response = Http::withHeaders([
+            'AcsApiKey' => $this->config['api_key'],
+        ])
+            ->timeout($this->config['timeout'])
+            ->post($this->config['base_url'], [
+                'ACSAlias' => $alias,
+                'ACSInputParameters' => array_merge($this->credentialParams(), $parameters),
+            ]);
+
+        return AcsResponse::fromHttpResponse($response);
+    }
+
+    private function credentialParams(): array
+    {
+        return [
+            'Company_ID' => $this->config['company_id'],
+            'Company_Password' => $this->config['company_password'],
+            'User_ID' => $this->config['user_id'],
+            'User_Password' => $this->config['user_password'],
+        ];
+    }
+}
diff --git a/src/Shipping/Carriers/Acs/AcsFulfillmentService.php b/src/Shipping/Carriers/Acs/AcsFulfillmentService.php
new file mode 100644
index 0000000..f2f67d3
--- /dev/null
+++ b/src/Shipping/Carriers/Acs/AcsFulfillmentService.php
@@ -0,0 +1,216 @@
+<?php
+
+namespace Modules\Core\Shipping\Carriers\Acs;
+
+use RuntimeException;
+use Illuminate\Support\Carbon;
+use Illuminate\Support\Collection;
+use Lunar\Models\Order;
+use Modules\Core\Shipping\Contracts\CarrierFulfillmentInterface;
+use Modules\Core\Shipping\Contracts\SupportsManifestBatching;
+use Modules\Core\Shipping\Contracts\SupportsTracking;
+use Modules\Core\Shipping\Carriers\Acs\Exceptions\AcsApiException;
+use Modules\Core\Shipping\DTOs\ManifestResult;
+use Modules\Core\Shipping\DTOs\ShipmentRequest;
+use Modules\Core\Shipping\DTOs\TrackingCheckpoint;
+use Modules\Core\Shipping\Enums\TrackingStatus;
+use Modules\Core\Shipping\Models\Manifest;
+use Modules\Core\Shipping\Models\Shipment;
+
+class AcsFulfillmentService implements CarrierFulfillmentInterface, SupportsManifestBatching, SupportsTracking
+{
+    public function __construct(
+        private readonly AcsClient $client,
+        private readonly AreaResolver $areaResolver,
+    ) {}
+
+    public function createShipment(Order $order, ShipmentRequest $request): Shipment
+    {
+        $address = $order->shippingAddress;
+        $destination = $this->areaResolver->resolve($address->postcode);
+        $weight = $request->weight ?? 0.5;
+
+        $params = [
+            'Pickup_Date' => now()->toDateString(),
+            'Sender' => config('acs.sender.name'),
+            'Recipient_Name' => trim("{$address->first_name} {$address->last_name}"),
+            'Recipient_Address' => $address->line_one,
+            'Recipient_Zipcode' => $address->postcode,
+            'Recipient_Region' => $address->city,
+            'Recipient_Phone' => $address->contact_phone,
+            'Recipient_Country' => 'GR',
+            'Acs_Station_Branch_Destination' => $destination->branchId,
+            'Billing_Code' => config('acs.billing_code'),
+            'Charge_Type' => 2,
+            'Item_Quantity' => $request->packageCount,
+            'Weight' => $weight,
+        ];
+
+        if ($request->paymentMode === 'cod') {
+            $params['Cod_Ammount'] = $request->amountToCollect ?? $order->total->decimal;
+            $params['Cod_Payment_Way'] = 0; // cash
+            $params['Acs_Delivery_Products'] = 'COD';
+        }
+
+        $response = $this->client->call('ACS_Create_Voucher', $params)->throwIfError();
+
+        $voucherNo = (string) $response->valueOutput['Voucher_No'];
+
+        $shipment = Shipment::create([
+            'order_id' => $order->id,
+            'carrier' => 'acs',
+            'tracking_reference' => $voucherNo,
+            'meta' => [
+                'station_destination' => $destination->stationId,
+                'weight' => $weight,
+                'pickup_date' => now()->toDateString(),
+            ],
+        ]);
+
+        if ($request->packageCount > 1) {
+            $this->persistMultipartVouchers($shipment);
+        }
+
+        return $shipment;
+    }
+
+    public function printLabel(Shipment $shipment): string
+    {
+        $response = $this->client->call('ACS_Print_Voucher', [
+            'Voucher_No' => $shipment->tracking_reference,
+            'Print_Type' => 2,
+            'Start_Position' => 1,
+        ])->throwIfError();
+
+        $shipment->update(['label_printed_at' => now()]);
+
+        return $response->valueOutput[$shipment->tracking_reference] ?? '';
+    }
+
+    public function cancelShipment(Shipment $shipment): void
+    {
+        if ($shipment->manifest_id) {
+            throw new RuntimeException('Cannot cancel a shipment already included in an issued manifest.');
+        }
+
+        $this->client->call('ACS_Delete_Voucher', [
+            'Voucher_No' => $shipment->tracking_reference,
+        ])->throwIfError();
+
+        $shipment->update(['cancelled_at' => now()]);
+    }
+
+    public function pendingForManifest(): Collection
+    {
+        return Shipment::query()
+            ->where('carrier', 'acs')
+            ->whereNull('manifest_id')
+            ->whereNull('cancelled_at')
+            ->get();
+    }
+
+    public function issueManifest(Collection $shipments): ManifestResult
+    {
+        $unprinted = $shipments->whereNull('label_printed_at');
+
+        if ($unprinted->isNotEmpty()) {
+            return ManifestResult::blocked($unprinted, 'unprinted');
+        }
+
+        $response = $this->client->call('ACS_Issue_Pickup_List', [
+            'Pickup_Date' => now()->toDateString(),
+            'MyData' => null,
+        ])->throwIfError();
+
+        $pickupListNo = (string) $response->valueOutput['PickupList_No'];
+
+        $manifest = Manifest::create([
+            'carrier' => 'acs',
+            'reference' => $pickupListNo,
+            'shipment_count' => $shipments->count(),
+            'issued_at' => now(),
+        ]);
+
+        $shipments->each(fn (Shipment $shipment) => $shipment->update([
+            'manifest_id' => $manifest->id,
+        ]));
+
+        return ManifestResult::success($manifest, $shipments);
+    }
+
+    public function trackShipment(Shipment $shipment): Collection
+    {
+        $response = $this->client->call('ACS_TrackingDetails', [
+            'Voucher_No' => $shipment->tracking_reference,
+        ])->throwIfError();
+
+        $rows = $response->tableOutput['Table_Data'] ?? [];
+
+        // ACS's per-checkpoint data (checkpoint_action) is free text with no
+        // status code, so the final checkpoint's status is corroborated
+        // against the structured summary call rather than guessed from text.
+        $isDelivered = $this->isDelivered($shipment);
+
+        return collect($rows)->values()->map(function (array $row, int $index) use ($rows, $isDelivered) {
+            $isLast = $index === count($rows) - 1;
+
+            return new TrackingCheckpoint(
+                status: $isLast && $isDelivered
+                    ? TrackingStatus::Delivered
+                    : $this->guessStatusFromAction($row['checkpoint_action'] ?? ''),
+                carrierStatus: $row['checkpoint_action'] ?? null,
+                message: $row['checkpoint_action'] ?? null,
+                location: $row['checkpoint_location'] ?? null,
+                occurredAt: Carbon::parse($row['checkpoint_date_time']),
+                meta: $row,
+            );
+        });
+    }
+
+    private function isDelivered(Shipment $shipment): bool
+    {
+        try {
+            $response = $this->client->call('ACS_Trackingsummary', [
+                'Voucher_No' => $shipment->tracking_reference,
+            ])->throwIfError();
+        } catch (AcsApiException) {
+            return false;
+        }
+
+        return (int) ($response->valueOutput['shipment_status'] ?? 0) === 4;
+    }
+
+    private function guessStatusFromAction(string $action): TrackingStatus
+    {
+        $action = strtolower($action);
+
+        // TODO: no live ACS payload sample yet showing a distinct
+        // collection checkpoint separate from transit ("arrival"/
+        // "departure" already map to InTransit) — add a str_contains()
+        // arm mapping to TrackingStatus::CollectedFromSender here once
+        // one is confirmed.
+        return match (true) {
+            str_contains($action, 'delivery to consignee') => TrackingStatus::Delivered,
+            str_contains($action, 'on delivery') => TrackingStatus::OutForDelivery,
+            str_contains($action, 'arrival') || str_contains($action, 'departure') => TrackingStatus::InTransit,
+            default => TrackingStatus::Pending,
+        };
+    }
+
+    private function persistMultipartVouchers(Shipment $mainShipment): void
+    {
+        $response = $this->client->call('ACS_Get_Multipart_Vouchers', [
+            'Main_Voucher_No' => $mainShipment->tracking_reference,
+        ])->throwIfError();
+
+        foreach ($response->tableOutput['Table_Data'] ?? [] as $row) {
+            Shipment::create([
+                'order_id' => $mainShipment->order_id,
+                'carrier' => 'acs',
+                'tracking_reference' => $row['MultiPart_Voucher_No'],
+                'parent_reference' => $mainShipment->tracking_reference,
+                'meta' => $mainShipment->meta?->toArray() ?? [],
+            ]);
+        }
+    }
+}
diff --git a/src/Shipping/Carriers/Acs/AcsRateDriver.php b/src/Shipping/Carriers/Acs/AcsRateDriver.php
new file mode 100644
index 0000000..5a780a6
--- /dev/null
+++ b/src/Shipping/Carriers/Acs/AcsRateDriver.php
@@ -0,0 +1,116 @@
+<?php
+
+namespace Modules\Core\Shipping\Carriers\Acs;
+
+use Lunar\DataTypes\Price;
+use Lunar\DataTypes\ShippingOption;
+use Lunar\Shipping\DataTransferObjects\ShippingOptionRequest;
+use Lunar\Shipping\Interfaces\ShippingRateInterface;
+use Lunar\Shipping\Models\ShippingRate;
+use Modules\Core\Shipping\Carriers\Acs\Exceptions\AcsApiException;
+use Modules\Core\Shipping\Concerns\CachesLivePricing;
+use Modules\Core\Shipping\Concerns\ResolvesFixedPricing;
+use Modules\Core\Shipping\Contracts\DeclaresFulfillmentType;
+use Modules\Core\Shipping\Contracts\SupportsLivePricing;
+use Modules\Core\Shipping\Support\ShippingMethodName;
+use Modules\Core\Shipping\Support\WeightCalculator;
+
+class AcsRateDriver implements ShippingRateInterface, SupportsLivePricing, DeclaresFulfillmentType
+{
+    use ResolvesFixedPricing;
+    use CachesLivePricing;
+
+    public ShippingRate $shippingRate;
+
+    public function __construct(
+        private readonly AcsClient $client,
+        private readonly AreaResolver $areaResolver,
+    ) {}
+
+    public function name(): string
+    {
+        return 'ACS Courier';
+    }
+
+    public function fulfillmentType(): string
+    {
+        return 'carrier';
+    }
+
+    public function description(): string
+    {
+        return 'Live rate quote from ACS Courier.';
+    }
+
+    public function resolve(ShippingOptionRequest $shippingOptionRequest): ?ShippingOption
+    {
+        $shippingRate = $shippingOptionRequest->shippingRate;
+        $shippingMethod = $shippingRate->shippingMethod;
+        $cart = $shippingOptionRequest->cart;
+
+        if (($shippingMethod->data['charge_by'] ?? 'cart_total') !== 'live') {
+            return $this->resolveFixedPrice($shippingRate, $shippingMethod, $cart);
+        }
+
+        $postcode = $cart->shippingAddress?->postcode;
+
+        if (! $postcode) {
+            return null;
+        }
+
+        return $this->resolveLivePrice($shippingRate, $shippingMethod, $cart, $postcode);
+    }
+
+    /**
+     * Wrapped in CachesLivePricing's cache so a live-pricing outage within
+     * the cache window still serves the last successful quote instead of
+     * immediately falling back. A cold cache during an outage falls back
+     * to the rate's own configured static price (resolveFixedPrice()) —
+     * see ManageShippingRates, which now allows a static price to be
+     * configured on a "live" rate specifically for this fallback.
+     */
+    private function resolveLivePrice(ShippingRate $shippingRate, $shippingMethod, $cart, string $postcode): ?ShippingOption
+    {
+        return $this->cached($shippingRate, $cart, function () use ($shippingRate, $shippingMethod, $cart, $postcode) {
+            try {
+                $destination = $this->areaResolver->resolve($postcode);
+
+                $response = $this->client->call('ACS_Price_Calculation', [
+                    'Billing_Code' => config('acs.billing_code'),
+                    'Acs_Station_Destination' => $destination->stationId,
+                    'Weight' => $this->totalWeightInKg($cart),
+                    'Pickup_Date' => now()->toDateString(),
+                    'Charge_Type' => 2,
+                ])->throwIfError();
+            } catch (AcsApiException $e) {
+                report($e);
+
+                return $this->resolveFixedPrice($shippingRate, $shippingMethod, $cart);
+            }
+
+            $amount = (int) round(($response->valueOutput['Total_Ammount'] ?? 0) * 100);
+
+            return new ShippingOption(
+                name: ShippingMethodName::resolve($shippingMethod) ?: $this->name(),
+                description: $shippingMethod->description ?: $this->description(),
+                identifier: $shippingRate->getIdentifier(),
+                price: new Price($amount, $cart->currency, 1),
+                taxClass: $shippingRate->getTaxClass(),
+                taxReference: $shippingRate->getTaxReference(),
+                meta: ['acs_station_destination' => $destination->stationId],
+            );
+        });
+    }
+
+    public function on(ShippingRate $shippingRate): self
+    {
+        $this->shippingRate = $shippingRate;
+
+        return $this;
+    }
+
+    private function totalWeightInKg($cart): float
+    {
+        return max(WeightCalculator::totalKg($cart->lines), 0.5); // ACS minimum billable weight
+    }
+}
diff --git a/src/Shipping/Carriers/Acs/AcsResponse.php b/src/Shipping/Carriers/Acs/AcsResponse.php
new file mode 100644
index 0000000..3e1255d
--- /dev/null
+++ b/src/Shipping/Carriers/Acs/AcsResponse.php
@@ -0,0 +1,43 @@
+<?php
+
+namespace Modules\Core\Shipping\Carriers\Acs;
+
+use Illuminate\Http\Client\Response;
+use Modules\Core\Shipping\Carriers\Acs\Exceptions\AcsApiException;
+
+class AcsResponse
+{
+    private function __construct(
+        public readonly bool $hasError,
+        public readonly ?string $errorMessage,
+        public readonly array $valueOutput,
+        public readonly array $tableOutput,
+    ) {}
+
+    public static function fromHttpResponse(Response $response): self
+    {
+        $body = $response->json() ?? [];
+
+        // ACS's own JSON key is misspelled ("Responce") — preserved here verbatim.
+        $output = $body['ACSOutputResponce'] ?? [];
+
+        return new self(
+            hasError: (bool) ($body['ACSExecution_HasError'] ?? ! $response->successful()),
+            errorMessage: $body['ACSExecutionErrorMessage'] ?? null,
+            valueOutput: $output['ACSValueOutput'][0] ?? [],
+            tableOutput: $output['ACSTableOutput'] ?? [],
+        );
+    }
+
+    public function throwIfError(): self
+    {
+        if ($this->hasError) {
+            throw new AcsApiException(
+                $this->errorMessage ?? ($this->valueOutput['Error_Message'] ?? 'Unknown ACS API error'),
+                $this->tableOutput,
+            );
+        }
+
+        return $this;
+    }
+}
diff --git a/src/Shipping/Carriers/Acs/AreaResolver.php b/src/Shipping/Carriers/Acs/AreaResolver.php
new file mode 100644
index 0000000..a87398f
--- /dev/null
+++ b/src/Shipping/Carriers/Acs/AreaResolver.php
@@ -0,0 +1,81 @@
+<?php
+
+namespace Modules\Core\Shipping\Carriers\Acs;
+
+use Illuminate\Support\Facades\Cache;
+use Modules\Core\Shipping\Carriers\Acs\Exceptions\AcsApiException;
+
+class AreaResolver
+{
+    public const CACHE_KEY = 'acs.areas';
+
+    public function __construct(private readonly AcsClient $client) {}
+
+    /**
+     * Resolve a Greek postcode to its ACS station/branch codes.
+     *
+     * Reads from the table warmed daily by WarmAcsAreaCacheJob. Falls
+     * back to a live lookup for that single postcode if the warmed cache is
+     * missing (e.g. the daily job never ran or failed) or doesn't contain it.
+     */
+    public function resolve(string $postcode): AcsArea
+    {
+        $areas = Cache::get(self::CACHE_KEY);
+
+        if ($areas !== null && isset($areas[$postcode])) {
+            return $this->toArea($areas[$postcode]);
+        }
+
+        return $this->toArea($this->fetch($postcode));
+    }
+
+    /**
+     * Fetch and cache the full country's postcode-to-station map in one call.
+     */
+    public function warmAll(): void
+    {
+        $areas = [];
+
+        foreach ($this->fetchAll() as $row) {
+            $areas[$row['Zip_Code']] = $row;
+        }
+
+        Cache::forever(self::CACHE_KEY, $areas);
+    }
+
+    private function fetch(string $postcode): array
+    {
+        $response = $this->client->call('ACS_Area_Find_By_Zip_Code', [
+            'Zip_Code' => $postcode,
+            'Show_Only_Inaccessible_Areas' => 0,
+            'Country' => 'GR',
+        ])->throwIfError();
+
+        $area = $response->tableOutput['Table_Data'][0] ?? null;
+
+        if (! $area) {
+            throw new AcsApiException("No ACS area found for postcode {$postcode}");
+        }
+
+        return $area;
+    }
+
+    private function fetchAll(): array
+    {
+        $response = $this->client->call('ACS_Area_Find_By_Zip_Code', [
+            'Zip_Code' => null,
+            'Show_Only_Inaccessible_Areas' => 0,
+            'Country' => 'GR',
+        ])->throwIfError();
+
+        return $response->tableOutput['Table_Data'] ?? [];
+    }
+
+    private function toArea(array $row): AcsArea
+    {
+        return new AcsArea(
+            stationId: $row['Station_ID'],
+            branchId: (int) $row['Branch_ID'],
+        );
+    }
+}
diff --git a/src/Shipping/Carriers/Acs/Exceptions/AcsApiException.php b/src/Shipping/Carriers/Acs/Exceptions/AcsApiException.php
new file mode 100644
index 0000000..75ed50c
--- /dev/null
+++ b/src/Shipping/Carriers/Acs/Exceptions/AcsApiException.php
@@ -0,0 +1,13 @@
+<?php
+
+namespace Modules\Core\Shipping\Carriers\Acs\Exceptions;
+
+use RuntimeException;
+
+class AcsApiException extends RuntimeException
+{
+    public function __construct(string $message, public readonly array $tableOutput = [])
+    {
+        parent::__construct($message);
+    }
+}
diff --git a/src/Shipping/Carriers/Acs/Jobs/WarmAcsAreaCacheJob.php b/src/Shipping/Carriers/Acs/Jobs/WarmAcsAreaCacheJob.php
new file mode 100644
index 0000000..7d87393
--- /dev/null
+++ b/src/Shipping/Carriers/Acs/Jobs/WarmAcsAreaCacheJob.php
@@ -0,0 +1,27 @@
+<?php
+
+namespace Modules\Core\Shipping\Carriers\Acs\Jobs;
+
+use Illuminate\Bus\Queueable;
+use Illuminate\Contracts\Queue\ShouldQueue;
+use Illuminate\Foundation\Bus\Dispatchable;
+use Illuminate\Queue\InteractsWithQueue;
+use Illuminate\Queue\SerializesModels;
+use Modules\Core\Shipping\Carriers\Acs\AreaResolver;
+
+class WarmAcsAreaCacheJob implements ShouldQueue
+{
+    use Dispatchable;
+    use InteractsWithQueue;
+    use Queueable;
+    use SerializesModels;
+
+    public int $tries = 3;
+
+    public int $backoff = 60;
+
+    public function handle(AreaResolver $areaResolver): void
+    {
+        $areaResolver->warmAll();
+    }
+}
diff --git a/src/Shipping/Carriers/BoxNow/BoxNowClient.php b/src/Shipping/Carriers/BoxNow/BoxNowClient.php
new file mode 100644
index 0000000..dd8bbea
--- /dev/null
+++ b/src/Shipping/Carriers/BoxNow/BoxNowClient.php
@@ -0,0 +1,97 @@
+<?php
+
+namespace Modules\Core\Shipping\Carriers\BoxNow;
+
+use Illuminate\Support\Facades\Cache;
+use Illuminate\Support\Facades\Http;
+use Modules\Core\Shipping\Carriers\BoxNow\Exceptions\BoxNowApiException;
+
+class BoxNowClient
+{
+    private const TOKEN_CACHE_KEY = 'boxnow.access_token';
+
+    public function __construct(private readonly array $config) {}
+
+    /**
+     * GET/POST against the main delivery/parcel API, authenticated with a
+     * cached Bearer token.
+     */
+    public function request(string $method, string $path, array $payload = []): array
+    {
+        $response = Http::withToken($this->token())
+            ->timeout($this->config['timeout'])
+            ->{$method}("{$this->config['base_url']}{$path}", $payload);
+
+        if ($response->status() === 401) {
+            // Token expired early / was revoked — refresh once and retry.
+            Cache::forget(self::TOKEN_CACHE_KEY);
+
+            $response = Http::withToken($this->token())
+                ->timeout($this->config['timeout'])
+                ->{$method}("{$this->config['base_url']}{$path}", $payload);
+        }
+
+        if ($response->failed()) {
+            throw new BoxNowApiException(
+                "Box Now API error ({$response->status()}) on {$method} {$path}",
+                $response->json() ?? [],
+            );
+        }
+
+        return $response->json() ?? [];
+    }
+
+    /**
+     * The origins/destinations lookups are served faster from a separate
+     * location API host, per Box Now's own documentation.
+     */
+    public function locationRequest(string $path, array $query = []): array
+    {
+        $response = Http::withToken($this->token())
+            ->timeout($this->config['timeout'])
+            ->get("{$this->config['location_api_url']}{$path}", $query);
+
+        if ($response->failed()) {
+            throw new BoxNowApiException(
+                "Box Now location API error ({$response->status()}) on GET {$path}",
+                $response->json() ?? [],
+            );
+        }
+
+        return $response->json() ?? [];
+    }
+
+    /**
+     * Fetch raw bytes (e.g. a PDF label) rather than JSON.
+     */
+    public function requestRaw(string $path): string
+    {
+        $response = Http::withToken($this->token())
+            ->timeout($this->config['timeout'])
+            ->get("{$this->config['base_url']}{$path}");
+
+        if ($response->failed()) {
+            throw new BoxNowApiException("Box Now API error ({$response->status()}) on GET {$path}");
+        }
+
+        return $response->body();
+    }
+
+    private function token(): string
+    {
+        return Cache::remember(self::TOKEN_CACHE_KEY, now()->addMinutes(55), function () {
+            $response = Http::timeout($this->config['timeout'])
+                ->post("{$this->config['base_url']}/auth-sessions", [
+                    'grant_type' => 'client_credentials',
+                    'client_id' => $this->config['client_id'],
+                    'client_secret' => $this->config['client_secret'],
+                ]);
+
+            if ($response->failed()) {
+                throw new BoxNowApiException('Box Now authentication failed', $response->json() ?? []);
+            }
+
+            return $response->json('access_token');
+        });
+    }
+}
diff --git a/src/Shipping/Carriers/BoxNow/BoxNowFulfillmentService.php b/src/Shipping/Carriers/BoxNow/BoxNowFulfillmentService.php
new file mode 100644
index 0000000..971df90
--- /dev/null
+++ b/src/Shipping/Carriers/BoxNow/BoxNowFulfillmentService.php
@@ -0,0 +1,178 @@
+<?php
+
+namespace Modules\Core\Shipping\Carriers\BoxNow;
+
+use Illuminate\Support\Carbon;
+use Illuminate\Support\Collection;
+use Lunar\Models\Order;
+use Modules\Core\Shipping\Carriers\BoxNow\Exceptions\BoxNowApiException;
+use Modules\Core\Shipping\Contracts\CarrierFulfillmentInterface;
+use Modules\Core\Shipping\Contracts\SupportsTracking;
+use Modules\Core\Shipping\DTOs\ShipmentRequest;
+use Modules\Core\Shipping\DTOs\TrackingCheckpoint;
+use Modules\Core\Shipping\Enums\TrackingStatus;
+use Modules\Core\Shipping\Models\Shipment;
+
+/**
+ * Unlike ACS, Box Now has no manifest/pickup-list step — creating a
+ * delivery request also books the courier pickup, so this only implements
+ * CarrierFulfillmentInterface (not SupportsManifestBatching).
+ *
+ * Box Now delivers to lockers, not addresses. The storefront locker-picker
+ * is out of scope for this pass — createShipment() requires the chosen
+ * locker's Box Now locationId via ShipmentRequest::$destinationLocationId
+ * (e.g. set manually by admin staff until checkout UI exists — see
+ * Modules\Core\Shipping\Extensions\OrderViewExtension, which locks the
+ * field instead once the shopper's own checkout selection is present in
+ * $order->shippingAddress->meta['box_now_locker']).
+ *
+ * Box Now ships by compartment size, not weight — unlike ACS, which bills
+ * by kg. One 'items' entry per box in ShipmentRequest::$boxes, so an order
+ * needing more than one physical parcel (doesn't fit one compartment)
+ * sends that many entries in a single delivery request rather than
+ * several separate ones.
+ */
+class BoxNowFulfillmentService implements CarrierFulfillmentInterface, SupportsTracking
+{
+    private const COMPARTMENT_SIZES = ['S' => 1, 'M' => 2, 'L' => 3];
+
+    public function __construct(private readonly BoxNowClient $client) {}
+
+    public function createShipment(Order $order, ShipmentRequest $request): Shipment
+    {
+        $address = $order->shippingAddress;
+        $destinationLocationId = $request->destinationLocationId;
+
+        if (! $destinationLocationId) {
+            throw new BoxNowApiException('No Box Now locker (locationId) was provided for this shipment.');
+        }
+
+        if (empty($request->boxes)) {
+            throw new BoxNowApiException('At least one box (compartment size) is required for a Box Now shipment.');
+        }
+
+        $isCod = $request->paymentMode === 'cod';
+
+        $response = $this->client->request('post', '/delivery-requests', [
+            'orderNumber' => $order->reference.'-'.$order->id,
+            'invoiceValue' => number_format($order->total->decimal, 2, '.', ''),
+            'paymentMode' => $isCod ? 'cod' : 'prepaid',
+            'amountToBeCollected' => $isCod
+                ? number_format($request->amountToCollect ?? $order->total->decimal, 2, '.', '')
+                : '0.00',
+            'origin' => [
+                'contactNumber' => config('boxnow.sender.phone'),
+                'contactEmail' => config('boxnow.sender.email'),
+                'contactName' => config('boxnow.sender.name'),
+                'locationId' => config('boxnow.origin_location_id'),
+            ],
+            'destination' => [
+                'contactNumber' => $address->contact_phone,
+                'contactEmail' => $address->contact_email,
+                'contactName' => trim("{$address->first_name} {$address->last_name}"),
+                'locationId' => $destinationLocationId,
+            ],
+            'items' => collect($request->boxes)->values()->map(fn (string $size, int $index) => [
+                'id' => $order->id.'-'.($index + 1),
+                'name' => 'Order '.$order->reference.' (box '.($index + 1).')',
+                'value' => '0.00',
+                'compartmentSize' => self::COMPARTMENT_SIZES[$size] ?? self::COMPARTMENT_SIZES['S'],
+            ])->all(),
+        ]);
+
+        $parcels = collect($response['parcels'] ?? []);
+
+        if ($parcels->isEmpty()) {
+            throw new BoxNowApiException('Box Now delivery request succeeded but returned no parcel ids.', $response);
+        }
+
+        // One Shipment row per box/parcel — each is independently
+        // trackable/printable/cancellable via its own tracking_reference
+        // (printLabel()/cancelShipment()/trackShipment() below already
+        // operate per-Shipment), even though all boxes were submitted in
+        // one delivery request. Siblings are linked via the shared
+        // delivery_request_id in meta.
+        $shipments = $parcels->map(fn (array $parcel) => Shipment::create([
+            'order_id' => $order->id,
+            'carrier' => 'box-now',
+            'tracking_reference' => (string) $parcel['id'],
+            'meta' => [
+                'delivery_request_id' => $response['id'] ?? null,
+                'locker_id' => $destinationLocationId,
+            ],
+        ]));
+
+        return $shipments->first();
+    }
+
+    public function printLabel(Shipment $shipment): string
+    {
+        $bytes = $this->client->requestRaw("/parcels/{$shipment->tracking_reference}/label.pdf");
+
+        $shipment->update(['label_printed_at' => now()]);
+
+        return $bytes;
+    }
+
+    public function cancelShipment(Shipment $shipment): void
+    {
+        $this->client->request('post', "/parcels/{$shipment->tracking_reference}:cancel");
+
+        $shipment->update(['cancelled_at' => now()]);
+    }
+
+    public function trackShipment(Shipment $shipment): Collection
+    {
+        $response = $this->client->request('get', '/parcels', [
+            'parcelId' => $shipment->tracking_reference,
+        ]);
+
+        $parcel = $response['data'][0] ?? null;
+
+        if (! $parcel) {
+            return collect();
+        }
+
+        $events = $parcel['events'] ?? [];
+
+        // Fall back to a single checkpoint from the parcel's current state
+        // if Box Now didn't return a detailed events history.
+        if (empty($events)) {
+            $events = [[
+                'type' => $parcel['state'] ?? 'new',
+                'locationDisplayName' => null,
+                'createTime' => $parcel['updateTime'] ?? $parcel['createTime'] ?? now()->toIso8601String(),
+            ]];
+        }
+
+        return collect($events)->map(fn (array $event) => new TrackingCheckpoint(
+            status: $this->mapState($event['type'] ?? $parcel['state'] ?? 'new'),
+            carrierStatus: $event['type'] ?? $parcel['state'] ?? null,
+            message: null,
+            location: $event['locationDisplayName'] ?? null,
+            occurredAt: Carbon::parse($event['createTime']),
+            meta: $event,
+        ));
+    }
+
+    private function mapState(string $state): TrackingStatus
+    {
+        // TODO: confirm against a live BoxNow webhook payload whether a
+        // distinct collected-from-sender state exists (e.g. between 'new'
+        // and 'in-transit') before mapping it to
+        // TrackingStatus::CollectedFromSender — BoxNow's own model is
+        // locker-drop-off-based, so it may not have one. No guessed match
+        // arm added; 'new' still falls through to Pending, InTransit
+        // remains the earliest recognized checkpoint.
+        return match ($state) {
+            'new' => TrackingStatus::Pending,
+            'in-transit', 'in-depot' => TrackingStatus::InTransit,
+            'in-final-destination', 'wait-for-load' => TrackingStatus::OutForDelivery,
+            'delivered' => TrackingStatus::Delivered,
+            'returned', 'accepted-for-return' => TrackingStatus::Returned,
+            'cancelled' => TrackingStatus::Cancelled,
+            'expired-return', 'missing' => TrackingStatus::Failed,
+            default => TrackingStatus::Unknown,
+        };
+    }
+}
diff --git a/src/Shipping/Carriers/BoxNow/BoxNowRateDriver.php b/src/Shipping/Carriers/BoxNow/BoxNowRateDriver.php
new file mode 100644
index 0000000..cd9c392
--- /dev/null
+++ b/src/Shipping/Carriers/BoxNow/BoxNowRateDriver.php
@@ -0,0 +1,54 @@
+<?php
+
+namespace Modules\Core\Shipping\Carriers\BoxNow;
+
+use Lunar\DataTypes\ShippingOption;
+use Lunar\Shipping\DataTransferObjects\ShippingOptionRequest;
+use Lunar\Shipping\Interfaces\ShippingRateInterface;
+use Lunar\Shipping\Models\ShippingRate;
+use Modules\Core\Shipping\Concerns\ResolvesFixedPricing;
+use Modules\Core\Shipping\Contracts\DeclaresFulfillmentType;
+
+/**
+ * Box Now has no pricing API, so this always resolves the method's normal
+ * charge_by + price-break configuration — the same mechanism the built-in
+ * flat-rate/ship-by drivers use. Does not implement SupportsLivePricing:
+ * there is no live option to offer.
+ */
+class BoxNowRateDriver implements ShippingRateInterface, DeclaresFulfillmentType
+{
+    use ResolvesFixedPricing;
+
+    public ShippingRate $shippingRate;
+
+    public function name(): string
+    {
+        return 'Box Now Locker Delivery';
+    }
+
+    public function fulfillmentType(): string
+    {
+        return 'carrier';
+    }
+
+    public function description(): string
+    {
+        return 'Deliver to a Box Now parcel locker.';
+    }
+
+    public function resolve(ShippingOptionRequest $shippingOptionRequest): ?ShippingOption
+    {
+        return $this->resolveFixedPrice(
+            $shippingOptionRequest->shippingRate,
+            $shippingOptionRequest->shippingRate->shippingMethod,
+            $shippingOptionRequest->cart,
+        );
+    }
+
+    public function on(ShippingRate $shippingRate): self
+    {
+        $this->shippingRate = $shippingRate;
+
+        return $this;
+    }
+}
diff --git a/src/Shipping/Carriers/BoxNow/Exceptions/BoxNowApiException.php b/src/Shipping/Carriers/BoxNow/Exceptions/BoxNowApiException.php
new file mode 100644
index 0000000..59bc0c9
--- /dev/null
+++ b/src/Shipping/Carriers/BoxNow/Exceptions/BoxNowApiException.php
@@ -0,0 +1,13 @@
+<?php
+
+namespace Modules\Core\Shipping\Carriers\BoxNow\Exceptions;
+
+use RuntimeException;
+
+class BoxNowApiException extends RuntimeException
+{
+    public function __construct(string $message, public readonly array $body = [])
+    {
+        parent::__construct($message);
+    }
+}
diff --git a/src/Shipping/Concerns/CachesLivePricing.php b/src/Shipping/Concerns/CachesLivePricing.php
new file mode 100644
index 0000000..a069ab5
--- /dev/null
+++ b/src/Shipping/Concerns/CachesLivePricing.php
@@ -0,0 +1,39 @@
+<?php
+
+namespace Modules\Core\Shipping\Concerns;
+
+use Closure;
+use Illuminate\Support\Facades\Cache;
+use Lunar\DataTypes\ShippingOption;
+use Lunar\Models\Cart;
+use Lunar\Shipping\Models\ShippingRate;
+
+/**
+ * Shared by any Modules\Core\Shipping\Contracts\SupportsLivePricing driver —
+ * a live carrier price quote is a real, billed API call, but stable from
+ * one fetch to the next within a single checkout attempt. Keyed by rate id
+ * + cart id, so two different live-priced rates (e.g. ACS and a future
+ * carrier) never collide — each is its own ShippingRate row. Not shared
+ * across carts: the quote depends on cart-specific weight/quantity/
+ * destination (see docs/checkout.md).
+ *
+ * Invalidated by Modules\Core\Shipping\Listeners\InvalidateShippingOptions on
+ * the only two things that can change what this cart's quote should be: a
+ * cart line changing (add/update/remove/clear) or the shipping address
+ * changing. Deliberately NOT invalidated on order placement — the price
+ * the shopper was quoted must still be there if anything re-reads it after
+ * the order exists; Cart::createOrder() persists the resolved price onto
+ * the order anyway, so nothing should be re-querying the live driver for
+ * that cart again regardless of cache state.
+ */
+trait CachesLivePricing
+{
+    private function cached(ShippingRate $shippingRate, Cart $cart, Closure $resolve): ?ShippingOption
+    {
+        return Cache::remember(
+            "shipping.live_price.{$shippingRate->id}.{$cart->id}",
+            now()->addMinutes(30),
+            $resolve,
+        );
+    }
+}
diff --git a/src/Shipping/Concerns/ResolvesFixedPricing.php b/src/Shipping/Concerns/ResolvesFixedPricing.php
new file mode 100644
index 0000000..ea2ce52
--- /dev/null
+++ b/src/Shipping/Concerns/ResolvesFixedPricing.php
@@ -0,0 +1,45 @@
+<?php
+
+namespace Modules\Core\Shipping\Concerns;
+
+use Lunar\DataTypes\ShippingOption;
+use Lunar\Facades\Pricing;
+use Lunar\Shipping\Models\ShippingMethod;
+use Lunar\Shipping\Models\ShippingRate;
+use Modules\Core\Shipping\Support\FulfillmentType;
+use Modules\Core\Shipping\Support\ShippingMethodName;
+
+/**
+ * Shared by any carrier driver that also supports Lunar's own price-break
+ * pricing (charge_by = cart_total | weight) as a fallback to, or standalone
+ * alternative for, live API pricing. Mirrors the vendor ShipBy driver's
+ * charge_by handling exactly, so behavior is consistent with the rest of
+ * Lunar's shipping system rather than inventing a separate mechanism.
+ */
+trait ResolvesFixedPricing
+{
+    private function resolveFixedPrice(ShippingRate $shippingRate, ShippingMethod $shippingMethod, $cart): ?ShippingOption
+    {
+        $chargeBy = $shippingMethod->data['charge_by'] ?? 'cart_total';
+
+        $tier = $chargeBy === 'weight'
+            ? $cart->lines->load('purchasable')->sum(fn ($line) => ($line->purchasable->weight_value ?? 0) * $line->quantity)
+            : $cart->lines->sum('subTotal.value');
+
+        $pricing = Pricing::for($shippingRate)->qty($tier)->get();
+
+        if (! $pricing->matched) {
+            return null;
+        }
+
+        return new ShippingOption(
+            name: ShippingMethodName::resolve($shippingMethod) ?: $this->name(),
+            description: $shippingMethod->description ?: $this->description(),
+            identifier: $shippingRate->getIdentifier(),
+            price: $pricing->matched->price,
+            taxClass: $shippingRate->getTaxClass(),
+            taxReference: $shippingRate->getTaxReference(),
+            collect: FulfillmentType::isStorePickup($shippingMethod),
+        );
+    }
+}
diff --git a/src/Shipping/Contracts/CarrierFulfillmentInterface.php b/src/Shipping/Contracts/CarrierFulfillmentInterface.php
new file mode 100644
index 0000000..0411a96
--- /dev/null
+++ b/src/Shipping/Contracts/CarrierFulfillmentInterface.php
@@ -0,0 +1,25 @@
+<?php
+
+namespace Modules\Core\Shipping\Contracts;
+
+use Lunar\Models\Order;
+use Modules\Core\Shipping\DTOs\ShipmentRequest;
+use Modules\Core\Shipping\Models\Shipment;
+
+interface CarrierFulfillmentInterface
+{
+    /**
+     * Create a shipment with the carrier for the given order.
+     */
+    public function createShipment(Order $order, ShipmentRequest $request): Shipment;
+
+    /**
+     * Fetch the printable label for a shipment (raw file bytes).
+     */
+    public function printLabel(Shipment $shipment): string;
+
+    /**
+     * Cancel a shipment with the carrier.
+     */
+    public function cancelShipment(Shipment $shipment): void;
+}
diff --git a/src/Shipping/Contracts/DeclaresFulfillmentType.php b/src/Shipping/Contracts/DeclaresFulfillmentType.php
new file mode 100644
index 0000000..7eced62
--- /dev/null
+++ b/src/Shipping/Contracts/DeclaresFulfillmentType.php
@@ -0,0 +1,25 @@
+<?php
+
+namespace Modules\Core\Shipping\Contracts;
+
+/**
+ * Optional contract a shipping rate driver implements to declare whether
+ * it fulfils via carrier delivery or in-store pickup — e.g.
+ * Modules\Core\Shipping\Carriers\Acs\AcsRateDriver and BoxNowRateDriver
+ * are unambiguously carrier-only, so this is a hardcoded fact about the
+ * driver, not something a merchant should have to configure per row.
+ *
+ * table-rate-shipping's own generic drivers (flat-rate, ship-by,
+ * free-shipping) don't implement this — they're genuinely ambiguous (a
+ * merchant could configure one for either carrier delivery or store
+ * pickup), so Modules\Core\Shipping\Support\FulfillmentType::resolve()
+ * falls back to ShippingMethod.data['fulfillment_type'] (still merchant-
+ * overridable) only for drivers that don't implement this contract.
+ */
+interface DeclaresFulfillmentType
+{
+    /**
+     * @return 'carrier'|'store_pickup'
+     */
+    public function fulfillmentType(): string;
+}
diff --git a/src/Shipping/Contracts/SupportsLivePricing.php b/src/Shipping/Contracts/SupportsLivePricing.php
new file mode 100644
index 0000000..ff14a40
--- /dev/null
+++ b/src/Shipping/Contracts/SupportsLivePricing.php
@@ -0,0 +1,12 @@
+<?php
+
+namespace Modules\Core\Shipping\Contracts;
+
+/**
+ * Marker for a Lunar\Shipping\Interfaces\ShippingRateInterface driver that
+ * calculates its price from a live carrier API rather than the manually
+ * configured ShippingRate price/price-breaks. Admin UI uses this to hide
+ * the manual pricing fields for such drivers — carriers without a pricing
+ * API simply don't implement it, and manual pricing remains required.
+ */
+interface SupportsLivePricing {}
diff --git a/src/Shipping/Contracts/SupportsManifestBatching.php b/src/Shipping/Contracts/SupportsManifestBatching.php
new file mode 100644
index 0000000..fd9ba39
--- /dev/null
+++ b/src/Shipping/Contracts/SupportsManifestBatching.php
@@ -0,0 +1,24 @@
+<?php
+
+namespace Modules\Core\Shipping\Contracts;
+
+use Illuminate\Support\Collection;
+use Modules\Core\Shipping\DTOs\ManifestResult;
+
+/**
+ * Optional capability for carriers that batch shipments into a manifest
+ * before courier pickup (e.g. ACS's end-of-day pickup list). Carriers
+ * without this concept simply don't implement it.
+ */
+interface SupportsManifestBatching
+{
+    /**
+     * Shipments created but not yet included in an issued manifest.
+     */
+    public function pendingForManifest(): Collection;
+
+    /**
+     * Finalize the given shipments into a manifest with the carrier.
+     */
+    public function issueManifest(Collection $shipments): ManifestResult;
+}
diff --git a/src/Shipping/Contracts/SupportsTracking.php b/src/Shipping/Contracts/SupportsTracking.php
new file mode 100644
index 0000000..7e1f8b8
--- /dev/null
+++ b/src/Shipping/Contracts/SupportsTracking.php
@@ -0,0 +1,23 @@
+<?php
+
+namespace Modules\Core\Shipping\Contracts;
+
+use Illuminate\Support\Collection;
+use Modules\Core\Shipping\DTOs\TrackingCheckpoint;
+use Modules\Core\Shipping\Models\Shipment;
+
+/**
+ * Optional capability for carriers that expose shipment tracking. Carriers
+ * without a tracking API simply don't implement it.
+ */
+interface SupportsTracking
+{
+    /**
+     * Return the shipment's known checkpoints from the carrier — as many
+     * as the carrier's API returns in one call, not just the latest one.
+     * Deduplication against what's already stored happens elsewhere.
+     *
+     * @return Collection<int, TrackingCheckpoint>
+     */
+    public function trackShipment(Shipment $shipment): Collection;
+}
diff --git a/src/Shipping/DTOs/ManifestResult.php b/src/Shipping/DTOs/ManifestResult.php
new file mode 100644
index 0000000..9342298
--- /dev/null
+++ b/src/Shipping/DTOs/ManifestResult.php
@@ -0,0 +1,28 @@
+<?php
+
+namespace Modules\Core\Shipping\DTOs;
+
+use Illuminate\Support\Collection;
+use Modules\Core\Shipping\Models\Manifest;
+
+class ManifestResult
+{
+    private function __construct(
+        public readonly bool $success,
+        public readonly ?string $reference,
+        public readonly ?Manifest $manifest,
+        public readonly Collection $includedShipments,
+        public readonly Collection $blockedShipments,
+        public readonly ?string $reason,
+    ) {}
+
+    public static function success(Manifest $manifest, Collection $includedShipments): self
+    {
+        return new self(true, $manifest->reference, $manifest, $includedShipments, collect(), null);
+    }
+
+    public static function blocked(Collection $blockedShipments, string $reason): self
+    {
+        return new self(false, null, null, collect(), $blockedShipments, $reason);
+    }
+}
diff --git a/src/Shipping/DTOs/ShipmentRequest.php b/src/Shipping/DTOs/ShipmentRequest.php
new file mode 100644
index 0000000..4665eff
--- /dev/null
+++ b/src/Shipping/DTOs/ShipmentRequest.php
@@ -0,0 +1,31 @@
+<?php
+
+namespace Modules\Core\Shipping\DTOs;
+
+/**
+ * Carrier-agnostic input for CarrierFulfillmentInterface::createShipment().
+ * Every field is optional — a carrier reads only what it needs and ignores
+ * the rest (e.g. destinationLocationId/boxes only matter to locker-delivery
+ * carriers like Box Now; ACS has no use for either — it ships by weight,
+ * not by box/compartment size).
+ */
+class ShipmentRequest
+{
+    /**
+     * @param  array<int, string>  $boxes  Box Now only — one entry per
+     *   physical parcel, each a compartment size ('S'|'M'|'L'). A single
+     *   shipment can be split across several lockers of the same
+     *   destinationLocationId's collection point, e.g. two Large boxes for
+     *   an order that doesn't fit one compartment. Empty for every other
+     *   carrier, which ships as a single package described by $weight
+     *   instead.
+     */
+    public function __construct(
+        public readonly ?float $weight = null,
+        public readonly int $packageCount = 1,
+        public readonly ?string $destinationLocationId = null,
+        public readonly ?string $paymentMode = null,
+        public readonly ?float $amountToCollect = null,
+        public readonly array $boxes = [],
+    ) {}
+}
diff --git a/src/Shipping/DTOs/TrackingCheckpoint.php b/src/Shipping/DTOs/TrackingCheckpoint.php
new file mode 100644
index 0000000..085b1e6
--- /dev/null
+++ b/src/Shipping/DTOs/TrackingCheckpoint.php
@@ -0,0 +1,22 @@
+<?php
+
+namespace Modules\Core\Shipping\DTOs;
+
+use Carbon\CarbonInterface;
+use Modules\Core\Shipping\Enums\TrackingStatus;
+
+/**
+ * One normalized checkpoint in a shipment's carrier-reported history.
+ * Returned (potentially several at once) by SupportsTracking::trackShipment().
+ */
+class TrackingCheckpoint
+{
+    public function __construct(
+        public readonly TrackingStatus $status,
+        public readonly ?string $carrierStatus,
+        public readonly ?string $message,
+        public readonly ?string $location,
+        public readonly CarbonInterface $occurredAt,
+        public readonly array $meta = [],
+    ) {}
+}
diff --git a/src/Shipping/Enums/TrackingStatus.php b/src/Shipping/Enums/TrackingStatus.php
new file mode 100644
index 0000000..5f0b9fb
--- /dev/null
+++ b/src/Shipping/Enums/TrackingStatus.php
@@ -0,0 +1,48 @@
+<?php
+
+namespace Modules\Core\Shipping\Enums;
+
+/**
+ * Normalized shipment status, mapped from each carrier's own status codes
+ * (e.g. ACS's shipment_status/non_delivery_reason_code, Box Now's parcel
+ * state) so the rest of the system never needs to know carrier-specific
+ * vocabulary.
+ */
+enum TrackingStatus: string
+{
+    case Pending = 'pending';
+
+    /**
+     * The carrier collected the parcel from the merchant — deliberately
+     * NOT named "PickedUp" to avoid colliding with the unrelated
+     * order status 'picked_up' (Modules\Core\Order\Services\
+     * OrderStatusFlow), which means the opposite end of a different flow
+     * (a CUSTOMER collecting a store-pickup order). Consumed by
+     * Modules\Core\Order\Listeners\AdvanceFulfillmentOnCarrierCheckpoint.
+     *
+     * Not yet mapped from either carrier driver's own checkpoint data —
+     * see Carriers\BoxNow\BoxNowFulfillmentService::mapState() and
+     * Carriers\Acs\AcsFulfillmentService::guessStatusFromAction() for
+     * TODOs on confirming against real payload samples before adding a
+     * mapping. Until then this case exists but nothing produces it, and
+     * InTransit remains the effective first real checkpoint for both
+     * carriers.
+     */
+    case CollectedFromSender = 'collected_from_sender';
+
+    case InTransit = 'in_transit';
+    case OutForDelivery = 'out_for_delivery';
+    case Delivered = 'delivered';
+    case Failed = 'failed';
+    case Returned = 'returned';
+    case Cancelled = 'cancelled';
+    case Unknown = 'unknown';
+
+    public function isTerminal(): bool
+    {
+        return match ($this) {
+            self::Delivered, self::Returned, self::Cancelled => true,
+            default => false,
+        };
+    }
+}
diff --git a/src/Shipping/Events/ShipmentStatusUpdatedByCarrier.php b/src/Shipping/Events/ShipmentStatusUpdatedByCarrier.php
new file mode 100644
index 0000000..590dfd9
--- /dev/null
+++ b/src/Shipping/Events/ShipmentStatusUpdatedByCarrier.php
@@ -0,0 +1,17 @@
+<?php
+
+namespace Modules\Core\Shipping\Events;
+
+use Illuminate\Foundation\Events\Dispatchable;
+use Modules\Core\Shipping\Models\ShipmentInfo;
+
+/**
+ * Fired once per newly-recorded ShipmentInfo checkpoint. Listeners (e.g.
+ * customer notifications, order status sync) are added separately.
+ */
+class ShipmentStatusUpdatedByCarrier
+{
+    use Dispatchable;
+
+    public function __construct(public readonly ShipmentInfo $shipmentInfo) {}
+}
diff --git a/src/Shipping/Extensions/OrderShipmentsExtension.php b/src/Shipping/Extensions/OrderShipmentsExtension.php
new file mode 100644
index 0000000..0298812
--- /dev/null
+++ b/src/Shipping/Extensions/OrderShipmentsExtension.php
@@ -0,0 +1,186 @@
+<?php
+
+namespace Modules\Core\Shipping\Extensions;
+
+use Filament\Actions\Action;
+use Filament\Infolists\Components\RepeatableEntry;
+use Filament\Infolists\Components\TextEntry;
+use Filament\Notifications\Notification;
+use Filament\Schemas\Components\Section;
+use Illuminate\Support\Facades\URL;
+use Lunar\Admin\Support\Extending\ViewPageExtension;
+use Modules\Core\Shipping\Contracts\CarrierFulfillmentInterface;
+use Modules\Core\Shipping\Models\Shipment;
+use Throwable;
+
+/**
+ * Adds a "Shipments" section to the order page's main column — previously
+ * "Create Shipment" (Modules\Core\Shipping\Extensions\OrderViewExtension)
+ * had no counterpart anywhere on the order to actually SEE what it
+ * created (carrier, tracking reference, current status, whether a label's
+ * been printed or the shipment cancelled). One row per Shipment record —
+ * a Box Now order with several boxes shows one row per box/parcel (see
+ * Modules\Core\Shipping\Carriers\BoxNow\BoxNowFulfillmentService, which
+ * creates one Shipment row per parcel Box Now returns), not one row per
+ * "Create Shipment" click.
+ *
+ * Uses the extendInfolistSchema hook (main column — alongside shipping
+ * address, order lines, totals, transactions, timeline), not
+ * extendInfolistAsideSchema (sidebar) — a shipment list can grow long
+ * (multi-box Box Now orders, a re-dispatched order after a delivery
+ * failure) and reads more naturally as a main-column section like
+ * Transactions, not a compact sidebar entry.
+ *
+ * Each shipment renders as two inline-labelled lines (carrier + tracking
+ * reference, then status + timestamp) rather than a grid of individually
+ * stacked label/value blocks — Filament's own multi-column grid still
+ * collapses to one column below its lg breakpoint (1024px), which is
+ * exactly where the admin's main content area commonly sits with the
+ * sidebar open, so a 5-6 field grid reads as a wall of repeated labels
+ * there.
+ *
+ * "Print Label" opens Modules\Core\Shipping\Http\Controllers\
+ * DownloadShipmentLabelController via a short-lived signed URL — the same
+ * auth model (and Action wiring pattern) Lunar's own vendor PdfDownload
+ * action uses for order PDFs. Previously the only place that called
+ * CarrierFulfillmentInterface::printLabel() (Modules\Core\Shipping\
+ * Filament\Pages\ManagePickupManifests) discarded the returned bytes
+ * entirely — this is the first place that actually delivers a label to
+ * staff.
+ */
+class OrderShipmentsExtension extends ViewPageExtension
+{
+    /**
+     * Inserted right after Transactions and before Timeline — vendor
+     * ManageOrder::getInfolistSchema() builds this array as
+     * [shipping, orderLines, orderTotals, transactions, timeline] (see
+     * Lunar\Admin\...\Concerns\DisplaysTransactions/DisplaysTimeline), so
+     * splicing at index 4 lands the new section there regardless of how
+     * many earlier entries any OTHER extension on this same hook has
+     * already added/removed — counting from the end (timeline is always
+     * last) would be equally fragile to some other extension appending
+     * its own section after timeline, so this anchors on the known
+     * vendor order instead.
+     */
+    public function extendInfolistSchema(array $schema): array
+    {
+        array_splice($schema, 4, 0, [$this->shipmentsSection()]);
+
+        return $schema;
+    }
+
+    private function shipmentsSection(): Section
+    {
+        return Section::make('shipments')
+            ->heading('Shipments')
+            ->compact()
+            ->collapsed(fn ($record) => $record->shipments->isEmpty())
+            ->collapsible(fn ($record) => $record->shipments->isNotEmpty())
+            ->schema([
+                RepeatableEntry::make('shipments')
+                    ->hiddenLabel()
+                    ->placeholder('No shipments have been created for this order yet.')
+                    ->contained(true)
+                    ->schema([
+                        TextEntry::make('tracking_reference')
+                            ->label(fn (Shipment $record) => $this->carrierLabel($record))
+                            ->inlineLabel()
+                            ->copyable(),
+                        TextEntry::make('status')
+                            ->label('Status')
+                            ->inlineLabel()
+                            ->state(fn (Shipment $record) => $this->statusLabel($record))
+                            ->badge()
+                            ->color(fn (Shipment $record) => $this->statusColor($record))
+                            ->helperText(fn (Shipment $record) => $this->helperText($record))
+                            ->suffixActions([
+                                Action::make('print_label')
+                                    ->label('Print Label')
+                                    ->icon('heroicon-o-printer')
+                                    ->url(fn (Shipment $record) => URL::temporarySignedRoute(
+                                        'shipments.label',
+                                        now()->addMinutes(5),
+                                        ['shipment' => $record->id],
+                                    ), shouldOpenInNewTab: true)
+                                    ->visible(fn (Shipment $record) => ! $record->cancelled_at),
+                                Action::make('cancel_shipment')
+                                    ->label('Cancel')
+                                    ->icon('heroicon-o-x-circle')
+                                    ->color('danger')
+                                    ->requiresConfirmation()
+                                    ->modalDescription('Cancels this shipment with the carrier. This cannot be undone.')
+                                    ->action(fn (Shipment $record) => $this->cancel($record))
+                                    ->visible(fn (Shipment $record) => ! $record->cancelled_at),
+                            ]),
+                    ]),
+            ]);
+    }
+
+    private function carrierLabel(Shipment $record): string
+    {
+        return match ($record->carrier) {
+            'acs' => 'ACS',
+            'box-now' => 'Box Now',
+            default => (string) str($record->carrier)->title(),
+        };
+    }
+
+    private function helperText(Shipment $record): string
+    {
+        $parts = ['Created '.$record->created_at->format('Y-m-d H:i')];
+
+        if ($record->carrier === 'box-now' && $locker = $record->meta['locker_id'] ?? null) {
+            $parts[] = 'Locker '.$locker;
+        }
+
+        return implode(' · ', $parts);
+    }
+
+    private function statusLabel(Shipment $record): string
+    {
+        if ($record->cancelled_at) {
+            return 'Cancelled';
+        }
+
+        $latest = $record->latestShipmentInfo();
+
+        return $latest ? (string) str($latest->status->value)->replace('_', ' ')->title() : 'Pending';
+    }
+
+    private function statusColor(Shipment $record): string
+    {
+        if ($record->cancelled_at) {
+            return 'danger';
+        }
+
+        return match ($record->latestShipmentInfo()?->status?->value) {
+            'delivered' => 'success',
+            'failed', 'returned' => 'danger',
+            'in_transit', 'out_for_delivery', 'collected_from_sender' => 'warning',
+            default => 'gray',
+        };
+    }
+
+    private function cancel(Shipment $record): void
+    {
+        $service = app(CarrierFulfillmentInterface::class, ['carrier' => $record->carrier]);
+
+        try {
+            $service->cancelShipment($record);
+        } catch (Throwable $e) {
+            report($e);
+
+            Notification::make()
+                ->title('Failed to cancel shipment: '.$e->getMessage())
+                ->color('danger')
+                ->send();
+
+            return;
+        }
+
+        Notification::make()
+            ->title('Shipment cancelled.')
+            ->color('success')
+            ->send();
+    }
+}
diff --git a/src/Shipping/Extensions/OrderViewExtension.php b/src/Shipping/Extensions/OrderViewExtension.php
new file mode 100644
index 0000000..f792860
--- /dev/null
+++ b/src/Shipping/Extensions/OrderViewExtension.php
@@ -0,0 +1,229 @@
+<?php
+
+namespace Modules\Core\Shipping\Extensions;
+
+use Filament\Actions\Action;
+use Filament\Forms\Components\Repeater;
+use Filament\Forms\Components\Select;
+use Filament\Forms\Components\TextInput;
+use Filament\Notifications\Notification;
+use Lunar\Admin\Support\Extending\ViewPageExtension;
+use Lunar\Models\Order;
+use Modules\Core\Order\DTOs\OrderFulfillmentResult;
+use Modules\Core\Order\Services\OrderFulfillmentService;
+use Modules\Core\Order\Services\OrderStatusFlow;
+use Modules\Core\Shipping\DTOs\ShipmentRequest;
+use Modules\Core\Shipping\Support\WeightCalculator;
+
+/**
+ * Filament wiring only (labels, icons, visibility, form schema) for the
+ * staff-facing status workflow — every guard check, status write, and
+ * event dispatch lives in Modules\Core\Order\Services\
+ * OrderFulfillmentService/OrderStatusFlow, resolved via app() (a
+ * ViewPageExtension is instantiated by Lunar's own extension mechanism,
+ * not the container, so there's no constructor-injection seam here).
+ *
+ * Strips Lunar's own "Update Status" header action (registered by vendor
+ * ManageOrder as Action::make('update_status')) and replaces it with our
+ * own action of the same name — vendor's writes $record->status directly
+ * with no audit trail, no branch validation, and no side effects. Our
+ * replacement offers every status in the order's own branch (carrier or
+ * pickup — see OrderStatusFlow::allOptions()), not just the guided next
+ * step, so staff can freely revert to an earlier status too. It is a
+ * PLAIN status write — picking 'dispatched' here does not create a real
+ * shipment (see "Create Shipment" below for that).
+ *
+ * "Create Shipment" is its own separate header action, visible only for a
+ * carrier order sitting at 'ready_for_dispatch' — this is the one action
+ * that talks to a real carrier API and writes Order::status to
+ * 'dispatched' as a side effect of that succeeding, so it needs its own
+ * weight/locker inputs specific to that one real-world action, not
+ * bundled into the general-purpose status select where they'd appear for
+ * every revert/manual-override use of 'dispatched' too. The form branches
+ * on which carrier the order actually uses
+ * (OrderFulfillmentService::carrierFor()): a weight-billed carrier (ACS)
+ * gets a single TOTAL weight field for the whole shipment (ACS has no
+ * per-package weight concept — one Weight value is sent alongside
+ * Item_Quantity in the same ACS_Create_Voucher call, see
+ * AcsFulfillmentService::createShipment()), pre-filled from the order's
+ * own line weights (Modules\Core\Shipping\Support\WeightCalculator) but
+ * still staff-editable, plus a package count (ShipmentRequest::
+ * $packageCount) — more than 1 issues a main voucher plus a
+ * multi-part sub-voucher per extra package (persistMultipartVouchers()),
+ * each recorded as its own Shipment row sharing the same total weight in
+ * meta. Box Now, which bills by compartment size rather than
+ * weight, gets a repeatable list of boxes (one row per physical parcel,
+ * each with its own S/M/L size) instead — see
+ * Modules\Core\Shipping\Carriers\BoxNow\BoxNowFulfillmentService for how
+ * multiple boxes become multiple Shipment rows from one delivery request.
+ * Box Now's locker is locked to read-only once the shopper's own checkout
+ * selection ($order->shippingAddress->meta['box_now_locker']) is present
+ * — staff can only fill it in manually for the (current, checkout-UI-less)
+ * case where nothing set it yet.
+ *
+ * "Mark Paid" is a third, separate header action — Order::paid is
+ * independent of `status` (see OrderStatusFlow's own docblock), so it
+ * doesn't belong bundled into the status select either. Visible only when
+ * the order's payment method doesn't auto-capture at checkout (currently
+ * only cash-on-delivery — see OrderStatusFlow::canMarkPaid()); a
+ * processor-managed method (Stripe) or an immediate-capture offline
+ * method (cash-in-hand, bank-transfer) sets Order::paid automatically via
+ * Modules\Core\Order\Listeners\ApplyResolvedPaymentStatus, so this button
+ * never appears for those.
+ *
+ * Also strips Lunar's own "Download PDF" header action (getDefaultHeaderActions()
+ * in vendor ManageOrder) — its lunarpanel::pdf.order template does not meet
+ * Greek AADE e-invoicing requirements, so it must not be offered as a
+ * downloadable document until a compliant invoice generator exists.
+ */
+class OrderViewExtension extends ViewPageExtension
+{
+    public function headerActions(array $actions): array
+    {
+        $actions = array_filter($actions, fn ($action) => method_exists($action, 'getName')
+            ? ! in_array($action->getName(), ['download_pdf', 'update_status'], true)
+            : true);
+
+        $actions[] = $this->createShipmentAction();
+        $actions[] = $this->updateStatusAction();
+        $actions[] = $this->markPaidAction();
+
+        return $actions;
+    }
+
+    private function createShipmentAction(): Action
+    {
+        return Action::make('create_shipment')
+            ->label('Create Shipment')
+            ->icon('heroicon-o-truck')
+            ->modalSubmitActionLabel('Create Shipment')
+            ->schema(function (Order $record) {
+                $isBoxNow = $this->service()->carrierFor($record) === 'box-now';
+                $lockerId = $record->shippingAddress?->meta['box_now_locker']['locationId'] ?? null;
+
+                if (! $isBoxNow) {
+                    return [
+                        TextInput::make('weight')
+                            ->label('Total weight (kg)')
+                            ->numeric()
+                            ->minValue(0)
+                            ->default(fn () => round(WeightCalculator::totalKg($record->lines), 2) ?: null)
+                            ->helperText("Calculated from the order's line weights — adjust if needed, or leave blank to use the carrier's default. One figure for the whole shipment, not per package."),
+                        TextInput::make('package_count')
+                            ->label('Number of packages')
+                            ->numeric()
+                            ->integer()
+                            ->minValue(1)
+                            ->default(1)
+                            ->required()
+                            ->helperText('More than 1 issues a main voucher plus a sub-voucher per extra package, all sharing the total weight above.'),
+                    ];
+                }
+
+                return [
+                    TextInput::make('destination_location_id')
+                        ->label('Box Now locker ID')
+                        ->default($lockerId)
+                        // Locked once the shopper's own checkout selection is
+                        // known — staff should not be able to redirect a
+                        // parcel to a different locker than the one the
+                        // customer picked. Only editable for the (current,
+                        // checkout-UI-less) case where nothing set it yet.
+                        ->disabled(filled($lockerId))
+                        ->dehydrated()
+                        ->required()
+                        ->helperText($lockerId
+                            ? 'Set by the customer at checkout.'
+                            : 'No locker was selected at checkout — enter it manually.'),
+                    Repeater::make('boxes')
+                        ->label('Boxes')
+                        ->schema([
+                            Select::make('size')
+                                ->label('Size')
+                                ->options(['S' => 'Small', 'M' => 'Medium', 'L' => 'Large'])
+                                ->default('S')
+                                ->native(false)
+                                ->required(),
+                        ])
+                        ->defaultItems(1)
+                        ->addActionLabel('Add another box')
+                        ->minItems(1)
+                        ->helperText('One row per physical parcel — Box Now ships by compartment size, not weight.'),
+                ];
+            })
+            ->action(function (Order $record, array $data, Action $action) {
+                $result = $this->service()->createShipmentAndDispatch(
+                    $record,
+                    new ShipmentRequest(
+                        weight: filled($data['weight'] ?? null) ? (float) $data['weight'] : null,
+                        packageCount: (int) ($data['package_count'] ?? 1),
+                        destinationLocationId: $data['destination_location_id'] ?? null,
+                        boxes: collect($data['boxes'] ?? [])->pluck('size')->all(),
+                    ),
+                );
+
+                $this->notify($result);
+
+                if (! $result->success) {
+                    $action->halt();
+                }
+            })
+            ->visible(fn (Order $record) => $this->service()->canCreateShipment($record));
+    }
+
+    private function updateStatusAction(): Action
+    {
+        return Action::make('update_status')
+            ->label('Update Status')
+            ->icon('heroicon-o-adjustments-horizontal')
+            ->schema(fn (Order $record) => [
+                Select::make('to_status')
+                    ->label('New status')
+                    ->options(app(OrderStatusFlow::class)->allOptions($record))
+                    ->default($record->status)
+                    ->native(false)
+                    ->required(),
+            ])
+            ->action(function (Order $record, array $data, Action $action) {
+                $to = $data['to_status'];
+                $service = $this->service();
+
+                $result = match (true) {
+                    ($to === 'ready_for_dispatch' || $to === 'ready_for_pickup') && $record->status === 'processing' => $service->markReady($record),
+                    $to === 'picked_up' && $record->status === 'ready_for_pickup' => $service->markPickedUp($record),
+                    default => $service->transitionTo($record, $to),
+                };
+
+                $this->notify($result);
+
+                if (! $result->success) {
+                    $action->halt();
+                }
+            });
+    }
+
+    private function markPaidAction(): Action
+    {
+        return Action::make('mark_paid')
+            ->label('Mark Paid')
+            ->icon('heroicon-o-banknotes')
+            ->color('success')
+            ->requiresConfirmation()
+            ->modalDescription('Confirms payment for this order has been received outside the system.')
+            ->visible(fn (Order $record) => app(OrderStatusFlow::class)->canMarkPaid($record))
+            ->action(fn (Order $record) => $this->notify($this->service()->markPaid($record)));
+    }
+
+    private function service(): OrderFulfillmentService
+    {
+        return app(OrderFulfillmentService::class);
+    }
+
+    private function notify(OrderFulfillmentResult $result): void
+    {
+        Notification::make()
+            ->title($result->message)
+            ->color($result->success ? 'success' : 'danger')
+            ->send();
+    }
+}
diff --git a/src/Shipping/Extensions/ShippingMethodListExtension.php b/src/Shipping/Extensions/ShippingMethodListExtension.php
new file mode 100644
index 0000000..3eb5b4b
--- /dev/null
+++ b/src/Shipping/Extensions/ShippingMethodListExtension.php
@@ -0,0 +1,49 @@
+<?php
+
+namespace Modules\Core\Shipping\Extensions;
+
+use Filament\Actions\CreateAction;
+use Filament\Schemas\Components\Group;
+use Filament\Actions;
+use Filament\Forms\Components\Select;
+use Lunar\Admin\Support\Extending\BaseExtension;
+use Lunar\Shipping\Facades\Shipping;
+use Lunar\Shipping\Filament\Resources\ShippingMethodResource;
+
+/**
+ * ListShippingMethod::getDefaultHeaderActions() builds its CreateAction's
+ * form inline (calling ShippingMethodResource::getDriverFormComponent()
+ * directly, a hardcoded 2-option Select) rather than through the resource's
+ * own extendForm() pipeline, so ShippingMethodResourceExtension's driver
+ * fix never reaches it. Re-declares the same create-action form with a
+ * dynamic driver Select instead.
+ */
+class ShippingMethodListExtension extends BaseExtension
+{
+    public function headerActions(array $actions): array
+    {
+        foreach ($actions as $action) {
+            if ($action instanceof CreateAction) {
+                $action->schema([
+                    ShippingMethodResource::getNameFormComponent(),
+                    Group::make([
+                        ShippingMethodResource::getCodeFormComponent(),
+                        $this->driverSelect(),
+                    ])->columns(2),
+                    ShippingMethodResource::getDescriptionFormComponent(),
+                ]);
+            }
+        }
+
+        return $actions;
+    }
+
+    private function driverSelect(): Select
+    {
+        return Select::make('driver')
+            ->label('Type')
+            ->options(fn () => collect(Shipping::getSupportedDrivers())
+                ->mapWithKeys(fn ($driver, $key) => [$key => $driver->name()]))
+            ->default('flat-rate');
+    }
+}
diff --git a/src/Shipping/Extensions/ShippingMethodResourceExtension.php b/src/Shipping/Extensions/ShippingMethodResourceExtension.php
new file mode 100644
index 0000000..d905058
--- /dev/null
+++ b/src/Shipping/Extensions/ShippingMethodResourceExtension.php
@@ -0,0 +1,289 @@
+<?php
+
+namespace Modules\Core\Shipping\Extensions;
+
+use Filament\Schemas\Schema;
+use Filament\Schemas\Components\Component;
+use Filament\Schemas\Components\Concerns\HasChildComponents;
+use Filament\Schemas\Components\Utilities\Get;
+use InvalidArgumentException;
+use Filament\Forms\Components\Select;
+use Filament\Tables\Columns\TextColumn;
+use Filament\Tables\Table;
+use Lunar\Admin\Support\Extending\ResourceExtension;
+use Lunar\Admin\Support\Forms\Components\TranslatedText;
+use Lunar\Shipping\Facades\Shipping;
+use Modules\Core\Shipping\Contracts\DeclaresFulfillmentType;
+use Modules\Core\Shipping\Contracts\SupportsLivePricing;
+use Modules\Core\Shipping\Support\ShippingMethodName;
+
+class ShippingMethodResourceExtension extends ResourceExtension
+{
+    public function extendForm(Schema $schema): Schema
+    {
+        return $schema->components(
+            $this->replaceFulfillmentTypeField(
+                $this->replaceChargeByField(
+                    $this->replaceNameField(
+                        $this->replaceDriverField($schema->getComponents())
+                    )
+                )
+            )
+        );
+    }
+
+    /**
+     * Replaces the vendor's plain-string `name` TextInput with
+     * Lunar's own TranslatedText — `name` is now a locale-keyed JSON
+     * column (see database/migrations/..._make_shipping_methods_name_translatable.php),
+     * same shape/resolution as PaymentMethod.name and Product/Collection
+     * names (Lunar\Base\Traits\HasTranslations).
+     */
+    private function replaceNameField(array $components): array
+    {
+        return array_map(function (Component $component) {
+            if (method_exists($component, 'getName') && $component->getName() === 'name') {
+                return $this->translatedNameField();
+            }
+
+            if (in_array(HasChildComponents::class, class_uses_recursive($component), true)) {
+                $component->schema($this->replaceNameField($component->getChildComponents()));
+            }
+
+            return $component;
+        }, $components);
+    }
+
+    /**
+     * ShippingMethod.name is a locale-keyed JSON column (see database/
+     * migrations/..._make_shipping_methods_name_translatable.php), but
+     * ShippingMethod is a vendor Eloquent model with no cast declared for
+     * it — Lunar\Shipping\Models\ShippingMethod only casts `data`, and
+     * there's no ModelManifest contract wired up to swap in a first-party
+     * subclass that adds one (Contracts\ShippingMethod exists but is
+     * never bound — see this class's own git history/nameColumn() for
+     * the same gap on the read side). TranslatedText itself round-trips
+     * plain array state, so afterStateHydrated()/dehydrateStateUsing()
+     * decode/encode the raw JSON string at the field boundary instead —
+     * the model attribute is a string on the way in and out, only ever
+     * an array while Filament's schema state holds it.
+     */
+    private function translatedNameField(): TranslatedText
+    {
+        $field = TranslatedText::make('name')
+            ->label('Name')
+            ->required()
+            ->afterStateHydrated(function (TranslatedText $component, $state) {
+                $decoded = json_decode((string) $state, true);
+                $component->state(is_array($decoded) ? $decoded : []);
+            })
+            ->dehydrateStateUsing(fn ($state) => json_encode(is_array($state) ? $state : []));
+
+        $field->expanded = true;
+
+        return $field;
+    }
+
+    /**
+     * Inserts the `fulfillment_type` Select right after `charge_by`, in
+     * the SAME Group (vendor's own `Group::make([getChargeByFormComponent()])
+     * ->columns(2)`) — formerly appended at the very end of the whole
+     * form, disconnected from `driver`/`charge_by`, the decisions it
+     * actually relates to. Only rendered at all for a driver that DOESN'T
+     * already declare its own fulfillment type (see Modules\Core\Shipping\
+     * Contracts\DeclaresFulfillmentType, Modules\Core\Shipping\Support\
+     * FulfillmentType) — acs/box-now are unambiguously carrier-only, so
+     * asking a merchant to also pick "Carrier delivery" for every ACS/Box
+     * Now method was redundant, error-prone config with no real decision
+     * behind it. Still offered for table-rate-shipping's generic drivers
+     * (flat-rate, ship-by, free-shipping), which are genuinely ambiguous.
+     */
+    private function replaceFulfillmentTypeField(array $components): array
+    {
+        $result = [];
+
+        foreach ($components as $component) {
+            $result[] = $component;
+
+            if (method_exists($component, 'getName') && $component->getName() === 'charge_by') {
+                $result[] = $this->fulfillmentTypeSelect();
+            } elseif (in_array(HasChildComponents::class, class_uses_recursive($component), true)) {
+                $component->schema($this->replaceFulfillmentTypeField($component->getChildComponents()));
+            }
+        }
+
+        return $result;
+    }
+
+    private function fulfillmentTypeSelect(): Select
+    {
+        return Select::make('data.fulfillment_type')
+            ->label('Fulfillment type')
+            ->options([
+                'carrier' => 'Carrier delivery',
+                'store_pickup' => 'Collect in store',
+            ])
+            ->default('carrier')
+            ->required()
+            ->visible(fn (Get $get) => $this->driverIsFulfillmentAmbiguous($get('../driver')))
+            ->helperText('Whether an order using this method is handed to a carrier, or collected by the customer in person.');
+    }
+
+    private function driverIsFulfillmentAmbiguous(?string $driver): bool
+    {
+        if (! $driver) {
+            return true;
+        }
+
+        try {
+            return ! Shipping::driver($driver) instanceof DeclaresFulfillmentType;
+        } catch (InvalidArgumentException) {
+            return true;
+        }
+    }
+
+    /**
+     * Extend the vendor's cart_total/weight charge_by Select with a third
+     * "live" option — only offered when the currently selected driver
+     * supports live pricing (see SupportsLivePricing). Picking it is what
+     * tells the driver to call its carrier API instead of resolving a
+     * price break.
+     */
+    private function replaceChargeByField(array $components): array
+    {
+        return array_map(function (Component $component) {
+            if (method_exists($component, 'getName') && $component->getName() === 'charge_by') {
+                return $this->chargeBySelect();
+            }
+
+            if (in_array(HasChildComponents::class, class_uses_recursive($component), true)) {
+                $component->schema(
+                    $this->replaceChargeByField($component->getChildComponents())
+                );
+            }
+
+            return $component;
+        }, $components);
+    }
+
+    private function chargeBySelect(): Select
+    {
+        return Select::make('charge_by')
+            ->label('Charge by')
+            ->options(function (Get $get) {
+                $options = [
+                    'cart_total' => 'Cart Total',
+                    'weight' => 'Weight',
+                ];
+
+                // "charge_by" is nested inside a Group with
+                // ->statePath('data'), while "driver" sits one level up, at
+                // the form root. Note: an *absolute* path here would need to
+                // additionally account for the page's own form wrapper
+                // (EditRecord::getFormStatePath() === 'data'), which relative
+                // paths never cross — so "../driver" (relative) is the
+                // correct, page-independent way to reach it, not an
+                // absolute 'driver' string.
+                if ($this->driverSupportsLivePricing($get('../driver'))) {
+                    $options['live'] = 'Live API pricing';
+                }
+
+                return $options;
+            })
+            ->live();
+    }
+
+    private function driverSupportsLivePricing(?string $driver): bool
+    {
+        if (! $driver) {
+            return false;
+        }
+
+        try {
+            return Shipping::driver($driver) instanceof SupportsLivePricing;
+        } catch (InvalidArgumentException) {
+            return false;
+        }
+    }
+
+    public function extendTable(Table $table): Table
+    {
+        return $table->columns(
+            array_map(function ($column) {
+                if (method_exists($column, 'getName') && $column->getName() === 'driver') {
+                    return $this->driverColumn();
+                }
+
+                if (method_exists($column, 'getName') && $column->getName() === 'name') {
+                    return $this->nameColumn();
+                }
+
+                return $column;
+            }, $table->getColumns())
+        );
+    }
+
+    private function driverColumn(): TextColumn
+    {
+        return TextColumn::make('driver')
+            ->label('Type')
+            ->formatStateUsing(fn ($state) => $this->driverLabel($state));
+    }
+
+    /**
+     * `name` is a locale-keyed JSON column (see Modules\Core\Shipping\
+     * Support\ShippingMethodName's own docblock for why it needs manual
+     * decoding rather than a model cast). Uses ->state() rather than
+     * ->formatStateUsing(), which would otherwise have Filament iterate a
+     * would-be array state as a multi-value list (one formatted cell per
+     * locale) instead of a single string.
+     */
+    private function nameColumn(): TextColumn
+    {
+        return TextColumn::make('name')
+            ->label('Name')
+            ->state(fn ($record) => ShippingMethodName::resolve($record));
+    }
+
+    private function driverLabel(string $key): string
+    {
+        $driver = collect(Shipping::getSupportedDrivers())->get($key);
+
+        return $driver?->name() ?? $key;
+    }
+
+    /**
+     * Recursively walk the form tree and replace the hardcoded driver
+     * Select (nested inside Section > Group) with one listing every
+     * registered driver, built-in or custom.
+     *
+     * @param array<Component> $components
+     * @return array<Component>
+     */
+    private function replaceDriverField(array $components): array
+    {
+        return array_map(function (Component $component) {
+            if (method_exists($component, 'getName') && $component->getName() === 'driver') {
+                return $this->driverSelect();
+            }
+
+            if (in_array(HasChildComponents::class, class_uses_recursive($component), true)) {
+                $component->schema(
+                    $this->replaceDriverField($component->getChildComponents())
+                );
+            }
+
+            return $component;
+        }, $components);
+    }
+
+    private function driverSelect(): Select
+    {
+        return Select::make('driver')
+            ->label('Type')
+            ->options(fn () => collect(Shipping::getSupportedDrivers())
+                ->mapWithKeys(fn ($driver, $key) => [$key => $driver->name()]))
+            ->default('flat-rate')
+            ->live();
+    }
+}
diff --git a/src/Shipping/Filament/Pages/ManageShippingRates.php b/src/Shipping/Filament/Pages/ManageShippingRates.php
new file mode 100644
index 0000000..000c2cf
--- /dev/null
+++ b/src/Shipping/Filament/Pages/ManageShippingRates.php
@@ -0,0 +1,120 @@
+<?php
+
+namespace Modules\Core\Shipping\Filament\Pages;
+
+use Filament\Schemas\Schema;
+use Filament\Schemas\Components\Utilities\Get;
+use Filament\Forms\Components\TextInput;
+use Filament\Tables\Columns\TextColumn;
+use Filament\Tables\Table;
+use Illuminate\Database\Eloquent\Model;
+use Lunar\Shipping\Filament\Resources\ShippingZoneResource\Pages\ManageShippingRates as BaseManageShippingRates;
+use Lunar\Shipping\Models\ShippingMethod;
+use Lunar\Shipping\Models\ShippingRate;
+
+/**
+ * Bound in place of the vendor ManageShippingRates page via the container
+ * (see ShippingServiceProvider), since that page has no extension hook of
+ * its own. Every reference to the vendor class name — routes, sub-nav,
+ * ShippingZoneResource::getPages() — is untouched; the container simply
+ * hands back this subclass whenever the vendor class is resolved.
+ *
+ * Relabels the price / price-break fields for a rate whose method has
+ * charge_by = "live" (see ShippingMethodResourceExtension, which adds that
+ * option to methods whose driver supports live pricing) — they stay
+ * visible and editable, but as the fallback price used when the live API
+ * call fails (see AcsRateDriver::resolveLivePrice()), not the primary
+ * price. Pricing strategy (cart_total / weight / live) stays entirely on
+ * the Shipping Method, matching Lunar's own existing charge_by convention;
+ * nothing new is stored on the rate itself.
+ *
+ * Also re-binds the vendor price field's afterStateHydrated(): the vendor
+ * callback reads $record->basePrices->first()->price->decimal with no
+ * null-guard, which crashes on any rate with no basePrices row — routine
+ * for a live rate that has never had a fallback price configured. Same
+ * logic, just null-safe.
+ */
+class ManageShippingRates extends BaseManageShippingRates
+{
+    public function form(Schema $schema): Schema
+    {
+        $schema = parent::form($schema);
+
+        return $schema->components(
+            $this->labelPriceFieldsAsFallbackWhenLive($schema->getComponents())
+        );
+    }
+
+    private function labelPriceFieldsAsFallbackWhenLive(array $components): array
+    {
+        $isLive = fn (Get $get) => static::methodChargeBy($get('shipping_method_id')) === 'live';
+
+        foreach ($components as $component) {
+            if (! method_exists($component, 'getName')) {
+                continue;
+            }
+
+            if ($component->getName() === 'price') {
+                $component->required(fn (Get $get) => ! $isLive($get))
+                    ->helperText(fn (Get $get) => $isLive($get)
+                        ? 'Used only if the live API call fails.'
+                        : null)
+                    ->afterStateHydrated(static function (TextInput $component, ?Model $record = null): void {
+                        if (! $record) {
+                            return;
+                        }
+
+                        $basePrice = $record->basePrices->first();
+
+                        $component->state($basePrice?->price->decimal);
+                    });
+            }
+
+            if ($component->getName() === 'prices') {
+                $component->helperText(fn (Get $get) => $isLive($get)
+                    ? 'Used only if the live API call fails.'
+                    : null);
+            }
+        }
+
+        return $components;
+    }
+
+    public function table(Table $table): Table
+    {
+        $table = parent::table($table);
+
+        return $table->columns(
+            array_map(function ($column) {
+                if (method_exists($column, 'getName') && $column->getName() === 'basePrices.0') {
+                    return TextColumn::make('basePrices.0')
+                        ->label(__('lunarpanel.shipping::relationmanagers.shipping_rates.table.price.label'))
+                        ->formatStateUsing(function ($state, ShippingRate $record) {
+                            if (static::methodChargeBy($record->shipping_method_id) === 'live') {
+                                return $state === null
+                                    ? 'Live API pricing, no fallback set'
+                                    : $state->price->formatted.' (fallback)';
+                            }
+
+                            return $state?->price->formatted;
+                        });
+                }
+
+                return $column;
+            }, $table->getColumns())
+        );
+    }
+
+    protected static function methodChargeBy(ShippingMethod|int|string|null $method): ?string
+    {
+        if (blank($method)) {
+            return null;
+        }
+
+        if (! $method instanceof ShippingMethod) {
+            $method = ShippingMethod::find($method);
+        }
+
+        return $method?->data['charge_by'] ?? null;
+    }
+}
diff --git a/src/Shipping/Filament/Resources/ManifestResource.php b/src/Shipping/Filament/Resources/ManifestResource.php
new file mode 100644
index 0000000..91f18dc
--- /dev/null
+++ b/src/Shipping/Filament/Resources/ManifestResource.php
@@ -0,0 +1,66 @@
+<?php
+
+namespace Modules\Core\Shipping\Filament\Resources;
+
+use Filament\Actions\ViewAction;
+use Filament\Resources\Resource;
+use Filament\Tables\Columns\TextColumn;
+use Filament\Tables\Table;
+use Modules\Core\Shipping\Filament\Resources\ManifestResource\Pages\ListManifests;
+use Modules\Core\Shipping\Filament\Resources\ManifestResource\Pages\ViewManifest;
+use Modules\Core\Shipping\Filament\Resources\ManifestResource\RelationManagers\ShipmentsRelationManager;
+use Modules\Core\Shipping\Models\Manifest;
+
+/**
+ * Issued manifests — Modules\Core\Shipping\Models\Manifest is the only
+ * record of "which shipments were on manifest X, and when" this codebase
+ * keeps; ACS's own ACS_Issue_Pickup_List call returns nothing beyond a
+ * reference number, so there is nothing to re-fetch from the carrier
+ * later (see that model's own docblock). Complements
+ * Modules\Core\Shipping\Filament\Resources\ShipmentResource, which only
+ * ever shows shipments NOT YET on a manifest.
+ */
+class ManifestResource extends Resource
+{
+    protected static ?string $model = Manifest::class;
+
+    protected static string | \BackedEnum | null $navigationIcon = 'heroicon-o-clipboard-document-list';
+
+    protected static string | \UnitEnum | null $navigationGroup = 'Sales';
+
+    protected static ?string $navigationLabel = 'Issued Manifests';
+
+    protected static ?string $modelLabel = 'Manifest';
+
+    protected static ?int $navigationSort = 101;
+
+    public static function table(Table $table): Table
+    {
+        return $table
+            ->columns([
+                TextColumn::make('carrier')->badge(),
+                TextColumn::make('reference')->label('Reference')->copyable(),
+                TextColumn::make('shipment_count')->label('Shipments'),
+                TextColumn::make('issued_at')->label('Issued')->dateTime(),
+            ])
+            ->recordActions([
+                ViewAction::make(),
+            ])
+            ->defaultSort('issued_at', 'desc');
+    }
+
+    public static function getRelations(): array
+    {
+        return [
+            ShipmentsRelationManager::class,
+        ];
+    }
+
+    public static function getPages(): array
+    {
+        return [
+            'index' => ListManifests::route('/'),
+            'view' => ViewManifest::route('/{record}'),
+        ];
+    }
+}
diff --git a/src/Shipping/Filament/Resources/ManifestResource/Pages/ListManifests.php b/src/Shipping/Filament/Resources/ManifestResource/Pages/ListManifests.php
new file mode 100644
index 0000000..36c9eec
--- /dev/null
+++ b/src/Shipping/Filament/Resources/ManifestResource/Pages/ListManifests.php
@@ -0,0 +1,28 @@
+<?php
+
+namespace Modules\Core\Shipping\Filament\Resources\ManifestResource\Pages;
+
+use Filament\Resources\Pages\ListRecords;
+use Filament\Schemas\Components\Tabs\Tab;
+use Illuminate\Database\Eloquent\Builder;
+use Lunar\Shipping\Facades\Shipping;
+use Modules\Core\Shipping\Contracts\SupportsManifestBatching;
+use Modules\Core\Shipping\Filament\Resources\ManifestResource;
+use Modules\Core\Shipping\Filament\Resources\ShipmentResource;
+
+class ListManifests extends ListRecords
+{
+    protected static string $resource = ManifestResource::class;
+
+    public function getTabs(): array
+    {
+        $carriers = collect(Shipping::getSupportedDrivers())
+            ->keys()
+            ->filter(fn (string $carrier) => ShipmentResource::fulfillmentService($carrier) instanceof SupportsManifestBatching);
+
+        return $carriers->mapWithKeys(fn (string $carrier) => [
+            $carrier => Tab::make(ucwords(str_replace('-', ' ', $carrier)))
+                ->modifyQueryUsing(fn (Builder $query) => $query->where('carrier', $carrier)),
+        ])->all();
+    }
+}
diff --git a/src/Shipping/Filament/Resources/ManifestResource/Pages/ViewManifest.php b/src/Shipping/Filament/Resources/ManifestResource/Pages/ViewManifest.php
new file mode 100644
index 0000000..7a316f6
--- /dev/null
+++ b/src/Shipping/Filament/Resources/ManifestResource/Pages/ViewManifest.php
@@ -0,0 +1,33 @@
+<?php
+
+namespace Modules\Core\Shipping\Filament\Resources\ManifestResource\Pages;
+
+use Filament\Infolists\Components\TextEntry;
+use Filament\Resources\Pages\ViewRecord;
+use Filament\Schemas\Schema;
+use Modules\Core\Shipping\Filament\Resources\ManifestResource;
+
+/**
+ * Relation managers (ShipmentsRelationManager) are registered on
+ * ManifestResource::getRelations() — the actual wiring point
+ * (Filament\Resources\Pages\Concerns\HasRelationManagers::
+ * getAllRelationManagers() reads from Resource::getRelations(), not from
+ * an override here). An earlier version of this page overrode
+ * getRelationManagers() directly, bypassing that trait's own
+ * canViewForRecord()/caching logic and causing a broken Livewire
+ * component mount (surfaced as a 419/redirect loop on this exact page).
+ */
+class ViewManifest extends ViewRecord
+{
+    protected static string $resource = ManifestResource::class;
+
+    public function infolist(Schema $schema): Schema
+    {
+        return $schema->components([
+            TextEntry::make('carrier')->badge(),
+            TextEntry::make('reference')->label('Reference')->copyable(),
+            TextEntry::make('shipment_count')->label('Shipments'),
+            TextEntry::make('issued_at')->label('Issued')->dateTime(),
+        ]);
+    }
+}
diff --git a/src/Shipping/Filament/Resources/ManifestResource/RelationManagers/ShipmentsRelationManager.php b/src/Shipping/Filament/Resources/ManifestResource/RelationManagers/ShipmentsRelationManager.php
new file mode 100644
index 0000000..44b1eba
--- /dev/null
+++ b/src/Shipping/Filament/Resources/ManifestResource/RelationManagers/ShipmentsRelationManager.php
@@ -0,0 +1,39 @@
+<?php
+
+namespace Modules\Core\Shipping\Filament\Resources\ManifestResource\RelationManagers;
+
+use Filament\Actions\Action;
+use Filament\Resources\RelationManagers\RelationManager;
+use Filament\Tables\Columns\TextColumn;
+use Filament\Tables\Table;
+use Modules\Core\Shipping\Filament\Resources\ShipmentResource;
+use Modules\Core\Shipping\Models\Shipment;
+
+/**
+ * The shipments a given Manifest actually included — read-only (a
+ * shipment's manifest membership is set once, at issueManifest() time,
+ * never edited here). Reuses ShipmentResource::printShipment() for the
+ * "Print" action rather than duplicating its try/catch-and-notify
+ * handling.
+ */
+class ShipmentsRelationManager extends RelationManager
+{
+    protected static string $relationship = 'shipments';
+
+    public function table(Table $table): Table
+    {
+        return $table
+            ->columns([
+                TextColumn::make('tracking_reference')->label('Tracking #'),
+                TextColumn::make('order.reference')->label('Order'),
+                TextColumn::make('label_printed_at')->label('Printed')->dateTime()->placeholder('Not printed'),
+                TextColumn::make('cancelled_at')->label('Cancelled')->dateTime()->placeholder('—'),
+            ])
+            ->recordActions([
+                Action::make('print')
+                    ->label('Print')
+                    ->icon('heroicon-o-printer')
+                    ->action(fn (Shipment $record) => ShipmentResource::printShipment($record)),
+            ]);
+    }
+}
diff --git a/src/Shipping/Filament/Resources/ShipmentResource.php b/src/Shipping/Filament/Resources/ShipmentResource.php
new file mode 100644
index 0000000..82835e9
--- /dev/null
+++ b/src/Shipping/Filament/Resources/ShipmentResource.php
@@ -0,0 +1,153 @@
+<?php
+
+namespace Modules\Core\Shipping\Filament\Resources;
+
+use Filament\Actions\Action;
+use Filament\Actions\BulkAction;
+use Filament\Notifications\Notification;
+use Filament\Resources\Resource;
+use Filament\Tables\Columns\TextColumn;
+use Filament\Tables\Table;
+use Illuminate\Database\Eloquent\Builder;
+use Illuminate\Support\Collection;
+use Modules\Core\Shipping\Contracts\CarrierFulfillmentInterface;
+use Modules\Core\Shipping\Contracts\SupportsManifestBatching;
+use Modules\Core\Shipping\Filament\Resources\ShipmentResource\Pages\ListShipments;
+use Modules\Core\Shipping\Models\Shipment;
+use Throwable;
+
+/**
+ * Replaces the standalone Modules\Core\Shipping\Filament\Pages\
+ * ManagePickupManifests page — a bare Page has no access to Filament's
+ * resource-level pill-tab UI (Filament\Resources\Concerns\HasTabs is
+ * scoped to ListRecords), so carrier-by-carrier separation
+ * (ListShipments::getTabs(), one tab per SupportsManifestBatching
+ * implementer) needed a real Resource to attach to.
+ *
+ * Shows only shipments NOT yet on an issued manifest — see
+ * Modules\Core\Shipping\Filament\Resources\ManifestResource for
+ * shipments that already are.
+ */
+class ShipmentResource extends Resource
+{
+    protected static ?string $model = Shipment::class;
+
+    protected static string | \BackedEnum | null $navigationIcon = 'heroicon-o-truck';
+
+    protected static string | \UnitEnum | null $navigationGroup = 'Sales';
+
+    protected static ?string $navigationLabel = 'Pending Vouchers';
+
+    protected static ?string $modelLabel = 'Shipment';
+
+    protected static ?int $navigationSort = 100;
+
+    public static function getEloquentQuery(): Builder
+    {
+        return parent::getEloquentQuery()
+            ->whereNull('manifest_id')
+            ->whereNull('cancelled_at');
+    }
+
+    public static function table(Table $table): Table
+    {
+        return $table
+            ->columns([
+                TextColumn::make('carrier')->badge(),
+                TextColumn::make('tracking_reference')->label('Tracking #'),
+                TextColumn::make('order.reference')->label('Order'),
+                TextColumn::make('label_printed_at')->label('Printed')->dateTime()->placeholder('Not printed'),
+            ])
+            ->recordActions([
+                Action::make('print')
+                    ->label('Print')
+                    ->icon('heroicon-o-printer')
+                    ->action(fn (Shipment $record) => self::printShipment($record)),
+            ])
+            ->toolbarActions([
+                BulkAction::make('print_selected')
+                    ->label('Print selected')
+                    ->icon('heroicon-o-printer')
+                    ->action(fn (Collection $records) => $records->each(fn (Shipment $shipment) => self::printShipment($shipment))),
+                BulkAction::make('issue_manifest')
+                    ->label('Issue Manifest')
+                    ->icon('heroicon-o-check-circle')
+                    ->action(fn (Collection $records) => self::issueManifest($records)),
+            ]);
+    }
+
+    public static function printShipment(Shipment $shipment): void
+    {
+        $service = self::fulfillmentService($shipment->carrier);
+
+        if (! $service) {
+            Notification::make()
+                ->title("No fulfillment integration configured for {$shipment->carrier}.")
+                ->danger()
+                ->send();
+
+            return;
+        }
+
+        try {
+            $service->printLabel($shipment);
+        } catch (Throwable $e) {
+            report($e);
+
+            Notification::make()
+                ->title("Failed to print label for {$shipment->tracking_reference}: {$e->getMessage()}")
+                ->danger()
+                ->send();
+        }
+    }
+
+    public static function issueManifest(Collection $shipments): void
+    {
+        $shipments->groupBy('carrier')->each(function (Collection $group, string $carrier) {
+            $service = self::fulfillmentService($carrier);
+
+            if (! $service instanceof SupportsManifestBatching) {
+                return;
+            }
+
+            try {
+                $result = $service->issueManifest($group);
+            } catch (Throwable $e) {
+                report($e);
+
+                Notification::make()
+                    ->title("Failed to issue manifest for {$carrier}: {$e->getMessage()}")
+                    ->danger()
+                    ->send();
+
+                return;
+            }
+
+            if (! $result->success) {
+                Notification::make()
+                    ->title("Manifest blocked for {$carrier}: {$result->reason}")
+                    ->danger()
+                    ->send();
+
+                return;
+            }
+
+            Notification::make()
+                ->title("Manifest issued for {$carrier}: {$result->reference}")
+                ->success()
+                ->send();
+        });
+    }
+
+    public static function fulfillmentService(string $carrier): ?CarrierFulfillmentInterface
+    {
+        return app(CarrierFulfillmentInterface::class, ['carrier' => $carrier]);
+    }
+
+    public static function getPages(): array
+    {
+        return [
+            'index' => ListShipments::route('/'),
+        ];
+    }
+}
diff --git a/src/Shipping/Filament/Resources/ShipmentResource/Pages/ListShipments.php b/src/Shipping/Filament/Resources/ShipmentResource/Pages/ListShipments.php
new file mode 100644
index 0000000..331ec9c
--- /dev/null
+++ b/src/Shipping/Filament/Resources/ShipmentResource/Pages/ListShipments.php
@@ -0,0 +1,36 @@
+<?php
+
+namespace Modules\Core\Shipping\Filament\Resources\ShipmentResource\Pages;
+
+use Filament\Resources\Pages\ListRecords;
+use Filament\Schemas\Components\Tabs\Tab;
+use Illuminate\Database\Eloquent\Builder;
+use Lunar\Shipping\Facades\Shipping;
+use Modules\Core\Shipping\Contracts\SupportsManifestBatching;
+use Modules\Core\Shipping\Filament\Resources\ShipmentResource;
+
+/**
+ * One tab per carrier that actually implements SupportsManifestBatching
+ * (ACS today) — a carrier with no manifest concept at all (Box Now,
+ * which books courier pickup at shipment-creation time, no separate
+ * batching step) never gets a tab here, since there is nothing to batch.
+ * Adding a new carrier (e.g. Speedex) that also implements the contract
+ * needs zero changes to this page — the tab list is derived from
+ * Shipping::getSupportedDrivers(), not hardcoded.
+ */
+class ListShipments extends ListRecords
+{
+    protected static string $resource = ShipmentResource::class;
+
+    public function getTabs(): array
+    {
+        $carriers = collect(Shipping::getSupportedDrivers())
+            ->keys()
+            ->filter(fn (string $carrier) => ShipmentResource::fulfillmentService($carrier) instanceof SupportsManifestBatching);
+
+        return $carriers->mapWithKeys(fn (string $carrier) => [
+            $carrier => Tab::make(ucwords(str_replace('-', ' ', $carrier)))
+                ->modifyQueryUsing(fn (Builder $query) => $query->where('carrier', $carrier)),
+        ])->all();
+    }
+}
diff --git a/src/Shipping/Http/Controllers/DownloadShipmentLabelController.php b/src/Shipping/Http/Controllers/DownloadShipmentLabelController.php
new file mode 100644
index 0000000..c2a1d5c
--- /dev/null
+++ b/src/Shipping/Http/Controllers/DownloadShipmentLabelController.php
@@ -0,0 +1,55 @@
+<?php
+
+namespace Modules\Core\Shipping\Http\Controllers;
+
+use Illuminate\Http\Request;
+use Illuminate\Routing\Controller;
+use Modules\Core\Shipping\Contracts\CarrierFulfillmentInterface;
+use Modules\Core\Shipping\Models\Shipment;
+
+/**
+ * Streams a carrier's raw label bytes (CarrierFulfillmentInterface::
+ * printLabel() — already whatever file format the carrier's own API
+ * returns, e.g. a PDF for both ACS and Box Now today) straight to the
+ * browser. Only reachable via a short-lived signed URL (see
+ * Modules\Core\Shipping\Extensions\OrderShipmentsExtension's "Print
+ * Label" action) — the same auth model Lunar's own vendor
+ * DownloadPdfController uses for order PDFs (a valid signature IS the
+ * auth check; there is no separate staff-session check here, matching
+ * that precedent), so the link only works for the few minutes it's
+ * actually open in a browser tab.
+ *
+ * Looks the Shipment up manually from a plain {shipment} id rather than
+ * relying on implicit route-model-binding — this route is registered via
+ * loadRoutesFrom() with no middleware group (see
+ * Modules\Core\Providers\ShippingServiceProvider::boot()), so
+ * SubstituteBindings never runs and a type-hinted Shipment parameter
+ * silently resolves to an empty, non-existent model instead of 404ing.
+ *
+ * Sets label_printed_at as a side effect of a successful stream — this is
+ * the first place in the codebase that actually delivers a label's bytes
+ * to a human; the existing Modules\Core\Shipping\Filament\Pages\
+ * ManagePickupManifests "Print" action calls printLabel() too, but only
+ * to mark the timestamp, discarding the returned bytes entirely (no
+ * download route existed until this one).
+ */
+class DownloadShipmentLabelController extends Controller
+{
+    public function __invoke(Request $request, int $shipment)
+    {
+        if (! $request->hasValidSignature()) {
+            abort(401);
+        }
+
+        $shipment = Shipment::findOrFail($shipment);
+
+        $service = app(CarrierFulfillmentInterface::class, ['carrier' => $shipment->carrier]);
+
+        $bytes = $service->printLabel($shipment);
+
+        return response($bytes, 200, [
+            'Content-Type' => 'application/pdf',
+            'Content-Disposition' => 'inline; filename="shipment-'.$shipment->tracking_reference.'.pdf"',
+        ]);
+    }
+}
diff --git a/src/Shipping/Jobs/PollShipmentTrackingJob.php b/src/Shipping/Jobs/PollShipmentTrackingJob.php
new file mode 100644
index 0000000..7714e22
--- /dev/null
+++ b/src/Shipping/Jobs/PollShipmentTrackingJob.php
@@ -0,0 +1,107 @@
+<?php
+
+namespace Modules\Core\Shipping\Jobs;
+
+use Illuminate\Bus\Queueable;
+use Illuminate\Contracts\Queue\ShouldQueue;
+use Illuminate\Foundation\Bus\Dispatchable;
+use Illuminate\Queue\InteractsWithQueue;
+use Illuminate\Queue\SerializesModels;
+use Lunar\Shipping\Facades\Shipping;
+use Modules\Core\Shipping\Contracts\CarrierFulfillmentInterface;
+use Modules\Core\Shipping\Contracts\SupportsTracking;
+use Modules\Core\Shipping\Enums\TrackingStatus;
+use Modules\Core\Shipping\Events\ShipmentStatusUpdatedByCarrier;
+use Modules\Core\Shipping\Models\Shipment;
+use Modules\Core\Shipping\Models\ShipmentInfo;
+
+/**
+ * Carrier-agnostic: polls every Shipment not yet in a terminal state,
+ * skipping carriers whose fulfillment service doesn't implement
+ * SupportsTracking. New checkpoints are recorded in shipment_info and
+ * dispatch ShipmentStatusUpdatedByCarrier — one event per new checkpoint.
+ */
+class PollShipmentTrackingJob implements ShouldQueue
+{
+    use Dispatchable;
+    use InteractsWithQueue;
+    use Queueable;
+    use SerializesModels;
+
+    public int $tries = 3;
+
+    public int $backoff = 60;
+
+    public function handle(): void
+    {
+        $trackableCarriers = collect(Shipping::getSupportedDrivers())->keys()->filter(
+            fn (string $carrier) => $this->fulfillmentService($carrier) instanceof SupportsTracking
+        );
+
+        if ($trackableCarriers->isEmpty()) {
+            return;
+        }
+
+        Shipment::query()
+            ->whereIn('carrier', $trackableCarriers)
+            ->whereNull('cancelled_at')
+            ->whereDoesntHave('shipmentInfo', function ($query) {
+                $query->whereIn('status', [
+                    TrackingStatus::Delivered->value,
+                    TrackingStatus::Returned->value,
+                    TrackingStatus::Cancelled->value,
+                ]);
+            })
+            ->chunkById(50, function ($shipments) {
+                $shipments->groupBy('carrier')->each(
+                    fn ($group, $carrier) => $this->pollCarrierShipments($carrier, $group)
+                );
+            });
+    }
+
+    private function pollCarrierShipments(string $carrier, $shipments): void
+    {
+        $service = $this->fulfillmentService($carrier);
+
+        if (! $service instanceof SupportsTracking) {
+            return;
+        }
+
+        foreach ($shipments as $shipment) {
+            $this->recordNewCheckpoints($shipment, $service->trackShipment($shipment));
+        }
+    }
+
+    private function recordNewCheckpoints(Shipment $shipment, $checkpoints): void
+    {
+        $existing = $shipment->shipmentInfo()
+            ->get(['status', 'occurred_at'])
+            ->map(fn ($info) => $info->status->value.'|'.$info->occurred_at->toIso8601String())
+            ->flip();
+
+        foreach ($checkpoints as $checkpoint) {
+            $fingerprint = $checkpoint->status->value.'|'.$checkpoint->occurredAt->toIso8601String();
+
+            if ($existing->has($fingerprint)) {
+                continue;
+            }
+
+            $info = ShipmentInfo::create([
+                'shipment_id' => $shipment->id,
+                'status' => $checkpoint->status,
+                'carrier_status' => $checkpoint->carrierStatus,
+                'message' => $checkpoint->message,
+                'location' => $checkpoint->location,
+                'occurred_at' => $checkpoint->occurredAt,
+                'meta' => $checkpoint->meta,
+            ]);
+
+            ShipmentStatusUpdatedByCarrier::dispatch($info);
+        }
+    }
+
+    private function fulfillmentService(string $carrier): ?CarrierFulfillmentInterface
+    {
+        return app(CarrierFulfillmentInterface::class, ['carrier' => $carrier]);
+    }
+}
diff --git a/src/Shipping/Listeners/InvalidateShippingOptions.php b/src/Shipping/Listeners/InvalidateShippingOptions.php
new file mode 100644
index 0000000..dc7d893
--- /dev/null
+++ b/src/Shipping/Listeners/InvalidateShippingOptions.php
@@ -0,0 +1,76 @@
+<?php
+
+namespace Modules\Core\Shipping\Listeners;
+
+use Illuminate\Support\Facades\Cache;
+use Lunar\Facades\ShippingManifest;
+use Lunar\Shipping\Facades\Shipping;
+use Lunar\Shipping\Models\ShippingRate;
+use Modules\Core\Cart\Events\CartCleared;
+use Modules\Core\Cart\Events\CartLineAdded;
+use Modules\Core\Cart\Events\CartLineRemoved;
+use Modules\Core\Cart\Events\CartLineUpdated;
+use Modules\Core\Checkout\Events\ShippingAddressSet;
+use Modules\Core\Shipping\Contracts\SupportsLivePricing;
+
+/**
+ * Invalidates everything that caches or memoises resolved shipping options
+ * for a cart, on the only two things that can change what they should be: a
+ * cart line changing (weight/quantity) or the shipping address changing
+ * (destination).
+ *
+ * Two things need clearing here, both stale for the same reason:
+ *
+ * - Modules\Core\Shipping\Concerns\CachesLivePricing's per-rate cache (see
+ *   that trait's docblock for why order placement is deliberately not a
+ *   trigger). Only rates whose method's driver implements
+ *   SupportsLivePricing are ever cached by it, so only their ids need a
+ *   forget() call — no need to touch every ShippingRate row on every cart
+ *   change.
+ * - Lunar\Base\ShippingManifest's $options collection, which is a
+ *   request-lifetime singleton: ShippingManifest::getOptions() re-runs the
+ *   modifier pipeline on every call but never clears $options first, and
+ *   addOption() keeps the first entry per identifier and silently drops any
+ *   later one — so an option resolved for an earlier address/cart state
+ *   shadows the correct one after that state changes, within the same
+ *   request. clearOptions() forces the next getOptions() call to resolve
+ *   fresh.
+ */
+class InvalidateShippingOptions
+{
+    public function handle(CartLineAdded|CartLineUpdated|CartLineRemoved|CartCleared|ShippingAddressSet $event): void
+    {
+        $cart = $event->cart;
+
+        foreach ($this->livePricingRateIds() as $rateId) {
+            Cache::forget("shipping.live_price.{$rateId}.{$cart->id}");
+        }
+
+        ShippingManifest::clearOptions();
+    }
+
+    /**
+     * @return array<int>
+     */
+    private function livePricingRateIds(): array
+    {
+        return ShippingRate::query()
+            ->whereHas('shippingMethod', fn ($query) => $query->whereIn(
+                'driver',
+                $this->liveDriverKeys(),
+            ))
+            ->pluck('id')
+            ->all();
+    }
+
+    /**
+     * @return array<string>
+     */
+    private function liveDriverKeys(): array
+    {
+        return Shipping::getSupportedDrivers()
+            ->filter(fn ($driver) => $driver instanceof SupportsLivePricing)
+            ->keys()
+            ->all();
+    }
+}
diff --git a/src/Shipping/Models/Manifest.php b/src/Shipping/Models/Manifest.php
new file mode 100644
index 0000000..a79d2de
--- /dev/null
+++ b/src/Shipping/Models/Manifest.php
@@ -0,0 +1,28 @@
+<?php
+
+namespace Modules\Core\Shipping\Models;
+
+use Illuminate\Database\Eloquent\Model;
+use Illuminate\Database\Eloquent\Relations\HasMany;
+
+/**
+ * A carrier pickup-list/manifest as WE recorded it at the moment it was
+ * issued (Modules\Core\Shipping\Contracts\SupportsManifestBatching::
+ * issueManifest()) — the carrier's own API (ACS's ACS_Issue_Pickup_List
+ * included) typically returns nothing beyond a reference number, so this
+ * table is the only place "which shipments were on manifest X, and when"
+ * is ever recorded; it cannot be re-derived from the carrier later.
+ */
+class Manifest extends Model
+{
+    protected $guarded = [];
+
+    protected $casts = [
+        'issued_at' => 'datetime',
+    ];
+
+    public function shipments(): HasMany
+    {
+        return $this->hasMany(Shipment::class);
+    }
+}
diff --git a/src/Shipping/Models/Shipment.php b/src/Shipping/Models/Shipment.php
new file mode 100644
index 0000000..e760f30
--- /dev/null
+++ b/src/Shipping/Models/Shipment.php
@@ -0,0 +1,40 @@
+<?php
+
+namespace Modules\Core\Shipping\Models;
+
+use Illuminate\Database\Eloquent\Casts\AsArrayObject;
+use Illuminate\Database\Eloquent\Model;
+use Illuminate\Database\Eloquent\Relations\BelongsTo;
+use Illuminate\Database\Eloquent\Relations\HasMany;
+use Lunar\Models\Order;
+
+class Shipment extends Model
+{
+    protected $guarded = [];
+
+    protected $casts = [
+        'meta' => AsArrayObject::class,
+        'label_printed_at' => 'datetime',
+        'cancelled_at' => 'datetime',
+    ];
+
+    public function order(): BelongsTo
+    {
+        return $this->belongsTo(Order::class);
+    }
+
+    public function manifest(): BelongsTo
+    {
+        return $this->belongsTo(Manifest::class);
+    }
+
+    public function shipmentInfo(): HasMany
+    {
+        return $this->hasMany(ShipmentInfo::class);
+    }
+
+    public function latestShipmentInfo(): ?ShipmentInfo
+    {
+        return $this->shipmentInfo()->latest('occurred_at')->first();
+    }
+}
diff --git a/src/Shipping/Models/ShipmentInfo.php b/src/Shipping/Models/ShipmentInfo.php
new file mode 100644
index 0000000..b2a401d
--- /dev/null
+++ b/src/Shipping/Models/ShipmentInfo.php
@@ -0,0 +1,31 @@
+<?php
+
+namespace Modules\Core\Shipping\Models;
+
+use Illuminate\Database\Eloquent\Casts\AsArrayObject;
+use Illuminate\Database\Eloquent\Model;
+use Illuminate\Database\Eloquent\Relations\BelongsTo;
+use Modules\Core\Shipping\Enums\TrackingStatus;
+
+/**
+ * One recorded checkpoint in a Shipment's carrier-reported tracking
+ * history. Append-only — never updated in place, so the full history is
+ * preserved rather than overwriting the last-known status.
+ */
+class ShipmentInfo extends Model
+{
+    protected $table = 'shipment_info';
+
+    protected $guarded = [];
+
+    protected $casts = [
+        'status' => TrackingStatus::class,
+        'occurred_at' => 'datetime',
+        'meta' => AsArrayObject::class,
+    ];
+
+    public function shipment(): BelongsTo
+    {
+        return $this->belongsTo(Shipment::class);
+    }
+}
diff --git a/src/Shipping/Support/FulfillmentType.php b/src/Shipping/Support/FulfillmentType.php
new file mode 100644
index 0000000..84b6373
--- /dev/null
+++ b/src/Shipping/Support/FulfillmentType.php
@@ -0,0 +1,60 @@
+<?php
+
+namespace Modules\Core\Shipping\Support;
+
+use Lunar\Shipping\Facades\Shipping;
+use Lunar\Shipping\Models\ShippingMethod;
+use Modules\Core\Shipping\Contracts\DeclaresFulfillmentType;
+
+/**
+ * The single source of truth for "is this ShippingMethod a carrier
+ * delivery or an in-store pickup" — replaces a merchant-facing
+ * data['fulfillment_type'] Select that used to exist for every method
+ * regardless of driver. Modules\Core\Shipping\Carriers\Acs\AcsRateDriver
+ * and BoxNowRateDriver are unambiguously carrier-only (see
+ * Modules\Core\Shipping\Contracts\DeclaresFulfillmentType's own
+ * docblock), so asking a merchant to also pick "Carrier delivery" for
+ * every ACS/Box Now method was redundant, error-prone config with no
+ * real decision behind it.
+ *
+ * table-rate-shipping's own generic drivers (flat-rate, ship-by,
+ * free-shipping) don't implement DeclaresFulfillmentType — a merchant
+ * could genuinely configure one for either purpose (e.g. "Flat Rate —
+ * Athens Store Pickup") — so those still fall back to the merchant-set
+ * data['fulfillment_type'], defaulting to 'carrier' when unset.
+ */
+class FulfillmentType
+{
+    public static function resolve(ShippingMethod $method): string
+    {
+        $driver = collect(Shipping::getSupportedDrivers())->get($method->driver);
+
+        if ($driver instanceof DeclaresFulfillmentType) {
+            return $driver->fulfillmentType();
+        }
+
+        return $method->data['fulfillment_type'] ?? 'carrier';
+    }
+
+    public static function isStorePickup(ShippingMethod $method): bool
+    {
+        return static::resolve($method) === 'store_pickup';
+    }
+
+    /**
+     * Whether the merchant-facing "Fulfillment type" Select should be
+     * shown at all for a given driver — hidden entirely for a driver that
+     * already declares its own fulfillment type, since there is no real
+     * decision left for the merchant to make.
+     */
+    public static function isConfigurableFor(?string $driverKey): bool
+    {
+        if ($driverKey === null) {
+            return true;
+        }
+
+        $driver = collect(Shipping::getSupportedDrivers())->get($driverKey);
+
+        return ! $driver instanceof DeclaresFulfillmentType;
+    }
+}
diff --git a/src/Shipping/Support/ShippingMethodName.php b/src/Shipping/Support/ShippingMethodName.php
new file mode 100644
index 0000000..572f6a1
--- /dev/null
+++ b/src/Shipping/Support/ShippingMethodName.php
@@ -0,0 +1,35 @@
+<?php
+
+namespace Modules\Core\Shipping\Support;
+
+use Illuminate\Support\Arr;
+use Lunar\Shipping\Models\ShippingMethod;
+
+/**
+ * ShippingMethod.name is a locale-keyed JSON column (see database/
+ * migrations/..._make_shipping_methods_name_translatable.php, and
+ * Modules\Core\Shipping\Extensions\ShippingMethodResourceExtension for
+ * the Filament form/table side), but ShippingMethod is a vendor Eloquent
+ * model with no cast declared for it — Lunar\Shipping\Models\
+ * ShippingMethod only casts `data`, and there's no ModelManifest contract
+ * wired up by the package to swap in a first-party subclass that adds
+ * one (Contracts\ShippingMethod exists but is never bound). So `$method->
+ * name` returns the raw JSON string, not a decoded array — this resolves
+ * it the same way Lunar\Base\Traits\HasTranslations::translate() would,
+ * shared by every rate driver that builds a Lunar\DataTypes\ShippingOption
+ * (Modules\Core\Shipping\Concerns\ResolvesFixedPricing, Modules\Core\
+ * Shipping\Carriers\Acs\AcsRateDriver) plus the Filament table column.
+ */
+class ShippingMethodName
+{
+    public static function resolve(ShippingMethod $method, ?string $locale = null): ?string
+    {
+        $decoded = json_decode((string) $method->getRawOriginal('name'), true);
+
+        if (! is_array($decoded)) {
+            return $method->getRawOriginal('name');
+        }
+
+        return Arr::get($decoded, $locale ?: app()->getLocale()) ?: Arr::first($decoded);
+    }
+}
diff --git a/src/Shipping/Support/WeightCalculator.php b/src/Shipping/Support/WeightCalculator.php
new file mode 100644
index 0000000..4ca4ea0
--- /dev/null
+++ b/src/Shipping/Support/WeightCalculator.php
@@ -0,0 +1,47 @@
+<?php
+
+namespace Modules\Core\Shipping\Support;
+
+use Illuminate\Support\Collection;
+
+/**
+ * Sums ProductVariant::weight_value/weight_unit across a collection of
+ * Cart/Order lines into a single kg figure — the same conversion table
+ * Modules\Core\Shipping\Carriers\Acs\AcsRateDriver::totalWeightInKg()
+ * already used privately for live rate quoting, now shared so
+ * Modules\Core\Shipping\Extensions\OrderViewExtension's "Create Shipment"
+ * weight default can compute the identical figure for an already-placed
+ * Order instead of duplicating the unit table.
+ */
+class WeightCalculator
+{
+    /**
+     * @param  Collection  $lines  Cart::$lines or Order::$lines, each with
+     *   its purchasable relation loaded (or loadable — ->load('purchasable')
+     *   is called here if not already eager-loaded).
+     */
+    public static function totalKg(Collection $lines): float
+    {
+        $weight = 0.0;
+
+        foreach ($lines->load('purchasable') as $line) {
+            $variant = $line->purchasable;
+
+            if (! $variant || ! $variant->weight_value) {
+                continue;
+            }
+
+            $unit = $variant->weight_unit ?? 'kg';
+            $value = (float) $variant->weight_value;
+
+            $weight += match ($unit) {
+                'g' => $value / 1000,
+                'lb' => $value * 0.45359237,
+                'oz' => $value * 0.0283495231,
+                default => $value, // kg
+            } * $line->quantity;
+        }
+
+        return $weight;
+    }
+}
diff --git a/src/Shipping/routes/web.php b/src/Shipping/routes/web.php
new file mode 100644
index 0000000..ec0f91e
--- /dev/null
+++ b/src/Shipping/routes/web.php
@@ -0,0 +1,7 @@
+<?php
+
+use Illuminate\Support\Facades\Route;
+use Modules\Core\Shipping\Http\Controllers\DownloadShipmentLabelController;
+
+Route::get('shipments/{shipment}/label', DownloadShipmentLabelController::class)
+    ->name('shipments.label');