diff --git a/.gitignore b/.gitignore
index 2245dfc..3b1b0f7 100644
--- a/.gitignore
+++ b/.gitignore
@@ -6,6 +6,7 @@ worker-configuration.d.ts
 *.tsbuildinfo
 .superpowers/
 docs/superpowers/plans/
+.worktrees/
 client_secret*
 CALENDAR_LOGIC.md
 CLAUDE.md
diff --git a/app/admin/App.tsx b/app/admin/App.tsx
index 7498c7c..5aa69fe 100644
--- a/app/admin/App.tsx
+++ b/app/admin/App.tsx
@@ -2,6 +2,7 @@ import { type ReactNode, useCallback, useEffect, useLayoutEffect, useState } fro
 import { adminApi, isAuthExpired, type Customer } from '../shared-ui/api.js';
 import {
   IconCalendar,
+  IconChartBar,
   IconClipboardCheck,
   IconCode,
   IconPaw,
@@ -14,6 +15,7 @@ import { AppsSection } from './sections/AppsSection';
 import { BookingsSection } from './sections/BookingsSection';
 import { BusinessSection } from './sections/BusinessSection';
 import { ClientsSection } from './sections/ClientsSection';
+import { EarningsSection } from './sections/EarningsSection';
 import { EmbedSection } from './sections/EmbedSection';
 import { PetsSection } from './sections/PetsSection';
 import { ServicesSection } from './sections/ServicesSection';
@@ -124,10 +126,19 @@ function Login({ onLogin }: { onLogin: (s: Session) => void }) {
 }
 
 type SectionKey =
-  'bookings' | 'business' | 'pets' | 'services' | 'timeoff' | 'clients' | 'apps' | 'embed';
+  | 'bookings'
+  | 'earnings'
+  | 'business'
+  | 'pets'
+  | 'services'
+  | 'timeoff'
+  | 'clients'
+  | 'apps'
+  | 'embed';
 
 const SECTIONS: { key: SectionKey; label: string; icon: typeof IconStore }[] = [
   { key: 'bookings', label: 'Bookings', icon: IconClipboardCheck },
+  { key: 'earnings', label: 'Earnings', icon: IconChartBar },
   { key: 'business', label: 'Business', icon: IconStore },
   { key: 'pets', label: 'Pet types', icon: IconPaw },
   { key: 'services', label: 'Services & rates', icon: IconTag },
@@ -277,6 +288,21 @@ function Dashboard({ session, onSignOut }: { session: Session; onSignOut: () =>
       setPreviewKey((k) => k + 1);
     });
 
+  const addService = (template: string, label: string) =>
+    run(async () => {
+      await adminFetch(token, `/api/${slug}/admin/services`, {
+        method: 'POST',
+        body: JSON.stringify({ template, label }),
+      });
+      await refresh();
+    });
+
+  const removeService = (type: string) =>
+    run(async () => {
+      await adminFetch(token, `/api/${slug}/admin/services/${type}`, { method: 'DELETE' });
+      await refresh();
+    });
+
   const connectCalendar = () =>
     run(async () => {
       const { url } = await adminApi.calendar.start(slug, token);
@@ -330,9 +356,19 @@ function Dashboard({ session, onSignOut }: { session: Session; onSignOut: () =>
     bookings: (
       <BookingsSection session={session} handleError={handle} clearError={() => setError('')} />
     ),
+    earnings: (
+      <EarningsSection session={session} handleError={handle} clearError={() => setError('')} />
+    ),
     business: <BusinessSection settings={settings} setSettings={setSettings} />,
     pets: <PetsSection settings={settings} setSettings={setSettings} />,
-    services: <ServicesSection settings={settings} setSettings={setSettings} />,
+    services: (
+      <ServicesSection
+        settings={settings}
+        setSettings={setSettings}
+        addService={addService}
+        removeService={removeService}
+      />
+    ),
     timeoff: (
       <TimeOffSection
         blocked={settings.blocked}
diff --git a/app/admin/PaymentsPanel.tsx b/app/admin/PaymentsPanel.tsx
new file mode 100644
index 0000000..667c58a
--- /dev/null
+++ b/app/admin/PaymentsPanel.tsx
@@ -0,0 +1,154 @@
+import { useEffect, useState } from 'react';
+import { adminApi, PAYMENT_METHODS, type Payment } from '../shared-ui/api.js';
+import type { Session } from './shared.js';
+
+/** Local 'YYYY-MM-DD' default for the paid-date field (the sitter can change it). */
+function todayStr(): string {
+  const d = new Date();
+  return `${d.getFullYear()}-${String(d.getMonth() + 1).padStart(2, '0')}-${String(d.getDate()).padStart(2, '0')}`;
+}
+
+/**
+ * One booking's payment ledger: existing payments (each deletable — deleting the record is the
+ * only correction mechanism) plus the record-payment form. Shared by BookingsSection (rows) and
+ * EarningsSection (outstanding table); `onChanged` lets each parent re-fetch its own payload.
+ */
+export function PaymentsPanel({
+  session,
+  bookingId,
+  onChanged,
+  handleError,
+  allowRecord = true,
+}: {
+  session: Session;
+  bookingId: string;
+  onChanged: () => void | Promise<void>;
+  handleError: (e: unknown) => void;
+  /** False for cancelled/declined bookings: the ledger is read-only (delete is the refund-
+   * correction mechanism), so the record-payment form is hidden. */
+  allowRecord?: boolean;
+}) {
+  const [payments, setPayments] = useState<Payment[] | null>(null);
+  const [amount, setAmount] = useState('');
+  const [method, setMethod] = useState<string>('cash');
+  const [paidDate, setPaidDate] = useState(todayStr);
+  const [note, setNote] = useState('');
+  const [busyId, setBusyId] = useState<string | null>(null);
+  const RECORDING = '__record__';
+
+  const amountNum = Number(amount);
+  const canSubmit = Number.isInteger(amountNum) && amountNum >= 1 && paidDate.trim() !== '';
+
+  const load = () =>
+    adminApi.payments
+      .list(session.slug, session.token, bookingId)
+      .then(({ payments: list }) => list);
+
+  useEffect(() => {
+    let active = true;
+    load()
+      .then((list) => active && setPayments(list))
+      .catch((e) => active && handleError(e));
+    return () => {
+      active = false;
+    };
+    // eslint-disable-next-line react-hooks/exhaustive-deps
+  }, [bookingId, session]);
+
+  const record = async () => {
+    if (busyId) return;
+    setBusyId(RECORDING);
+    try {
+      await adminApi.payments.record(session.slug, session.token, bookingId, {
+        amount: amountNum,
+        method,
+        paidDate,
+        ...(note.trim() ? { note: note.trim() } : {}),
+      });
+      setAmount('');
+      setNote('');
+      setPaidDate(todayStr());
+      setPayments(await load());
+      await onChanged();
+    } catch (e) {
+      handleError(e);
+    } finally {
+      setBusyId(null);
+    }
+  };
+
+  const remove = async (paymentId: string) => {
+    if (busyId) return;
+    setBusyId(paymentId);
+    try {
+      await adminApi.payments.remove(session.slug, session.token, bookingId, paymentId);
+      setPayments(await load());
+      await onChanged();
+    } catch (e) {
+      handleError(e);
+    } finally {
+      setBusyId(null);
+    }
+  };
+
+  if (!allowRecord && payments !== null && payments.length === 0) return null;
+
+  return (
+    <div className="pb-payments">
+      {payments === null ? (
+        <p>Loading…</p>
+      ) : payments.length === 0 ? (
+        allowRecord && <p className="pb-hint">No payments recorded yet.</p>
+      ) : (
+        <ul>
+          {payments.map((p) => (
+            <li key={p.id}>
+              <span>
+                ${p.amount} · {p.method} · {p.paidDate}
+                {p.note ? ` — ${p.note}` : ''}
+              </span>
+              <button disabled={busyId === p.id} onClick={() => void remove(p.id)}>
+                Delete
+              </button>
+            </li>
+          ))}
+        </ul>
+      )}
+      {allowRecord && (
+        <div className="pb-row">
+          <label className="pb-inline">
+            Amount ($)
+            <input
+              type="number"
+              min={1}
+              step={1}
+              value={amount}
+              onChange={(e) => setAmount(e.target.value)}
+            />
+          </label>
+          <label className="pb-inline">
+            Method
+            <select value={method} onChange={(e) => setMethod(e.target.value)}>
+              {PAYMENT_METHODS.map((m) => (
+                <option key={m} value={m}>
+                  {m}
+                </option>
+              ))}
+            </select>
+          </label>
+          <label className="pb-inline">
+            Date
+            <input type="date" value={paidDate} onChange={(e) => setPaidDate(e.target.value)} />
+          </label>
+          <label className="pb-inline">
+            Note
+            <input value={note} onChange={(e) => setNote(e.target.value)} />
+          </label>
+          <button disabled={busyId === RECORDING || !canSubmit} onClick={() => void record()}>
+            Record payment
+          </button>
+        </div>
+      )}
+    </div>
+  );
+}
diff --git a/app/admin/admin.css b/app/admin/admin.css
index 10d1612..e474b9c 100644
--- a/app/admin/admin.css
+++ b/app/admin/admin.css
@@ -538,6 +538,18 @@ body {
   margin-top: 4px;
 }
 
+/* ── Payments panel (shared by Bookings rows + Earnings outstanding table) ── */
+.pb-payments {
+  width: 100%;
+  border-top: 1px dashed var(--line);
+  margin-top: 8px;
+  padding-top: 8px;
+}
+
+.pb-payments .pb-row {
+  align-items: flex-end;
+}
+
 @media (prefers-reduced-motion: reduce) {
   .pb-wrap button {
     transition: none;
@@ -551,3 +563,84 @@ body {
     font-size: 16px; /* prevents iOS zoom-on-focus */
   }
 }
+
+/* ── Earnings section ──────────────────────────────────────────── */
+.pb-tiles {
+  display: grid;
+  grid-template-columns: repeat(auto-fit, minmax(130px, 1fr));
+  gap: 12px;
+  margin: 16px 0;
+}
+
+.pb-tile {
+  border: 1px solid var(--line);
+  border-radius: 10px;
+  padding: 12px;
+  display: flex;
+  flex-direction: column;
+}
+
+.pb-tile strong {
+  font-size: 1.4rem;
+  color: var(--ink);
+}
+
+.pb-tile span {
+  color: var(--soft);
+  font-size: 0.85rem;
+}
+
+.pb-earnings-chart {
+  width: 100%;
+  max-width: 480px;
+  display: block;
+}
+
+.pb-earnings-chart rect {
+  fill: var(--sage);
+}
+
+.pb-earnings-chart text {
+  fill: var(--soft);
+}
+
+.pb-hbars li {
+  display: grid;
+  grid-template-columns: 140px 1fr 60px;
+  align-items: center;
+  gap: 10px;
+  min-width: 0;
+}
+
+.pb-hbars li > span {
+  overflow: hidden;
+  text-overflow: ellipsis;
+  white-space: nowrap;
+  min-width: 0;
+}
+
+.pb-hbar {
+  background: var(--sage-wash);
+  border-radius: 4px;
+  height: 12px;
+}
+
+.pb-hbar-fill {
+  background: var(--sage);
+  border-radius: 4px;
+  height: 100%;
+  min-width: 2px;
+}
+
+.pb-truncate {
+  overflow: hidden;
+  text-overflow: ellipsis;
+  white-space: nowrap;
+  display: inline-block;
+  min-width: 0;
+}
+
+.pb-truncate-block {
+  display: block;
+  min-width: 0;
+}
diff --git a/app/admin/sections/BookingsSection.tsx b/app/admin/sections/BookingsSection.tsx
index 2a85805..23b94dd 100644
--- a/app/admin/sections/BookingsSection.tsx
+++ b/app/admin/sections/BookingsSection.tsx
@@ -1,6 +1,7 @@
 import { useEffect, useState } from 'react';
 import { adminApi, type AdminBooking } from '../../shared-ui/api.js';
 import { IconClipboardCheck } from '../../shared-ui/icons';
+import { PaymentsPanel } from '../PaymentsPanel';
 import type { Session } from '../shared.js';
 
 /** Renders the dates for one row: single date (+ time, for timed services) or a range. */
@@ -11,6 +12,10 @@ function formatWhen(b: AdminBooking): string {
 
 const byStartDate = (a: AdminBooking, b: AdminBooking) => a.startDate.localeCompare(b.startDate);
 
+/** True for bookings that aren't cancelled/declined — the payments ledger is fully editable for
+ * these; cancelled/declined rows show a read-only ledger only when they have payments to show. */
+const isActive = (b: AdminBooking) => b.status !== 'cancelled' && b.status !== 'declined';
+
 function chipClass(status: string): string {
   if (status === 'confirmed') return ' pb-chip-ok';
   if (status === 'cancelled') return ' pb-chip-bad';
@@ -18,6 +23,15 @@ function chipClass(status: string): string {
   return '';
 }
 
+/** Payment state for a row; null for unpaid rows. 'paid in full' covers overpayment/tips
+ * (paidTotal > estCost). Shown for cancelled/declined rows too, so a sitter reviewing a refund
+ * case can still see the amount. */
+function paidText(b: AdminBooking): string | null {
+  if (b.paidTotal === 0) return null;
+  if (b.estCost == null) return `paid $${b.paidTotal}`;
+  return b.paidTotal >= b.estCost ? 'paid in full' : `paid $${b.paidTotal} of $${b.estCost}`;
+}
+
 export function BookingsSection({
   session,
   handleError,
@@ -29,6 +43,7 @@ export function BookingsSection({
 }) {
   const [bookings, setBookings] = useState<AdminBooking[] | null>(null);
   const [busyId, setBusyId] = useState<string | null>(null);
+  const [openId, setOpenId] = useState<string | null>(null);
   const [message, setMessage] = useState('');
 
   const load = () =>
@@ -98,21 +113,39 @@ export function BookingsSection({
           Cancel
         </button>
       )}
+      {(isActive(b) || b.paidTotal > 0) && (
+        <button onClick={() => setOpenId(openId === b.id ? null : b.id)}>
+          {openId === b.id ? 'Close' : 'Payments'}
+        </button>
+      )}
     </span>
   );
 
-  const row = (b: AdminBooking) => (
-    <li key={b.id}>
-      <span>
-        {b.customerName || b.customerEmail || 'Unknown customer'} — {b.type}
-        <br />
-        {formatWhen(b)} · {b.petCount} pet{b.petCount === 1 ? '' : 's'}
-        {b.estCost != null ? ` · $${b.estCost}` : ''}{' '}
-        <span className={`pb-chip${chipClass(b.status)}`}>{b.status}</span>
-      </span>
-      {actionsFor(b)}
-    </li>
-  );
+  const row = (b: AdminBooking) => {
+    const paid = paidText(b);
+    return (
+      <li key={b.id}>
+        <span>
+          {b.customerName || b.customerEmail || 'Unknown customer'} — {b.type}
+          <br />
+          {formatWhen(b)} · {b.petCount} pet{b.petCount === 1 ? '' : 's'}
+          {b.estCost != null ? ` · $${b.estCost}` : ''}{' '}
+          <span className={`pb-chip${chipClass(b.status)}`}>{b.status}</span>
+          {paid && <> · {paid}</>}
+        </span>
+        {actionsFor(b)}
+        {(isActive(b) || b.paidTotal > 0) && openId === b.id && (
+          <PaymentsPanel
+            session={session}
+            bookingId={b.id}
+            onChanged={async () => setBookings(await load())}
+            handleError={handleError}
+            allowRecord={isActive(b)}
+          />
+        )}
+      </li>
+    );
+  };
 
   const pending = (bookings ?? []).filter((b) => b.status === 'pending').sort(byStartDate);
   const rest = (bookings ?? []).filter((b) => b.status !== 'pending').sort(byStartDate);
diff --git a/app/admin/sections/ClientsSection.tsx b/app/admin/sections/ClientsSection.tsx
index b16c32a..b5eee5f 100644
--- a/app/admin/sections/ClientsSection.tsx
+++ b/app/admin/sections/ClientsSection.tsx
@@ -1,5 +1,5 @@
 import { useState } from 'react';
-import type { Customer } from '../../shared-ui/api.js';
+import type { Customer, ImportResult } from '../../shared-ui/api.js';
 import { adminApi } from '../../shared-ui/api.js';
 import { IconUsers } from '../../shared-ui/icons';
 
@@ -84,6 +84,11 @@ export function ClientsSection({
   const [custName, setCustName] = useState('');
   const [custPhone, setCustPhone] = useState('');
   const [busy, setBusy] = useState(false);
+  const [csvFile, setCsvFile] = useState<File | null>(null);
+  const [sendInvites, setSendInvites] = useState(false);
+  const [importResult, setImportResult] = useState<ImportResult | null>(null);
+  const [importing, setImporting] = useState(false);
+  const [fileInputKey, setFileInputKey] = useState(0);
 
   /** Matches the old Dashboard run() semantics: clear the error banner at the START of each
    * action (so a stale error from an earlier failure doesn't outlive a later action), run the
@@ -121,6 +126,24 @@ export function ClientsSection({
   const removePet = (endUserId: string, petId: string) =>
     mutate(() => adminApi.customers.removePet(slug, token, endUserId, petId));
 
+  const runImport = async () => {
+    if (!csvFile || importing) return;
+    clearError();
+    setImporting(true);
+    try {
+      const csv = await csvFile.text();
+      const result = await adminApi.customers.import(slug, token, csv, sendInvites);
+      setImportResult(result);
+      setCsvFile(null);
+      setFileInputKey((k) => k + 1);
+      onCustomersChanged();
+    } catch (e) {
+      handleError(e);
+    } finally {
+      setImporting(false);
+    }
+  };
+
   return (
     <>
       <h2>
@@ -152,6 +175,53 @@ export function ClientsSection({
           {busy ? 'Adding…' : 'Add customer'}
         </button>
       </div>
+      <div className="pb-row">
+        <input
+          key={fileInputKey}
+          type="file"
+          accept=".csv"
+          onChange={(e) => {
+            setCsvFile(e.target.files?.[0] ?? null);
+            setImportResult(null);
+          }}
+        />
+        <label>
+          <input
+            type="checkbox"
+            checked={sendInvites}
+            onChange={(e) => setSendInvites(e.target.checked)}
+          />{' '}
+          Send invite emails to new clients
+        </label>
+        <button onClick={() => void runImport()} disabled={!csvFile || importing}>
+          {importing ? 'Importing…' : 'Import'}
+        </button>
+        <a href="/clients-import-example.csv" download>
+          Download example CSV
+        </a>
+      </div>
+      {importResult && (
+        <div className="pb-row">
+          <p>
+            Imported {importResult.importedCustomers} client
+            {importResult.importedCustomers === 1 ? '' : 's'} and {importResult.importedPets} pet
+            {importResult.importedPets === 1 ? '' : 's'}.
+            {importResult.invitesSent > 0 ? ` Sent ${importResult.invitesSent} invite(s).` : ''}
+            {importResult.invitesFailed > 0
+              ? ` ${importResult.invitesFailed} invite(s) failed to send.`
+              : ''}
+          </p>
+          {importResult.skippedRows.length > 0 && (
+            <ul>
+              {importResult.skippedRows.map((r) => (
+                <li key={r.row}>
+                  Row {r.row}: {r.reason}
+                </li>
+              ))}
+            </ul>
+          )}
+        </div>
+      )}
       <ul>
         {customers.map((cust) => (
           <li key={cust.id} className="pb-customer">
diff --git a/app/admin/sections/EarningsSection.tsx b/app/admin/sections/EarningsSection.tsx
new file mode 100644
index 0000000..75ca858
--- /dev/null
+++ b/app/admin/sections/EarningsSection.tsx
@@ -0,0 +1,225 @@
+import { useEffect, useRef, useState } from 'react';
+import { adminApi, type AnalyticsPayload } from '../../shared-ui/api.js';
+import { IconChartBar } from '../../shared-ui/icons';
+import { PaymentsPanel } from '../PaymentsPanel';
+import type { Session } from '../shared.js';
+
+const NO_PAYMENTS = 'No payments recorded yet.';
+
+const MONTH_NAMES = [
+  'Jan',
+  'Feb',
+  'Mar',
+  'Apr',
+  'May',
+  'Jun',
+  'Jul',
+  'Aug',
+  'Sep',
+  'Oct',
+  'Nov',
+  'Dec',
+];
+
+/** '2026-07' → 'Jul 26'. */
+function monthLabel(month: string): string {
+  const [y, m] = month.split('-');
+  return `${MONTH_NAMES[Number(m) - 1]} ${y.slice(2)}`;
+}
+
+/** Hand-rolled 12-bar SVG chart — no chart library (see the design's non-goals). */
+function MonthlyChart({ monthly }: { monthly: AnalyticsPayload['monthly'] }) {
+  const max = Math.max(1, ...monthly.map((m) => m.total));
+  const barW = 22;
+  const gap = 8;
+  const chartH = 110;
+  const width = monthly.length * (barW + gap) - gap;
+  return (
+    <svg
+      className="pb-earnings-chart"
+      viewBox={`0 0 ${width} ${chartH + 16}`}
+      role="img"
+      aria-label="Recorded revenue by month over the last 12 months"
+    >
+      {monthly.map((m, i) => {
+        const h = m.total === 0 ? 0 : Math.max(2, Math.round((m.total / max) * (chartH - 16)));
+        const x = i * (barW + gap);
+        return (
+          <g key={m.month}>
+            {m.total > 0 && m.total < 10000 && (
+              <text x={x + barW / 2} y={chartH - h - 3} textAnchor="middle" fontSize="7">
+                ${m.total}
+              </text>
+            )}
+            <rect x={x} y={chartH - h} width={barW} height={h} rx="2" />
+            <text x={x + barW / 2} y={chartH + 11} textAnchor="middle" fontSize="7">
+              {monthLabel(m.month)}
+            </text>
+          </g>
+        );
+      })}
+    </svg>
+  );
+}
+
+export function EarningsSection({
+  session,
+  handleError,
+  clearError,
+}: {
+  session: Session;
+  handleError: (e: unknown) => void;
+  clearError: () => void;
+}) {
+  const [data, setData] = useState<AnalyticsPayload | null>(null);
+  const [openId, setOpenId] = useState<string | null>(null);
+  const alive = useRef(true);
+
+  const load = () => adminApi.analytics.get(session.slug, session.token);
+
+  useEffect(() => {
+    let active = true;
+    load()
+      .then((d) => active && setData(d))
+      .catch((e) => active && handleError(e));
+    return () => {
+      active = false;
+    };
+    // eslint-disable-next-line react-hooks/exhaustive-deps
+  }, [session]);
+
+  useEffect(() => {
+    alive.current = true;
+    return () => {
+      alive.current = false;
+    };
+  }, []);
+
+  const reload = async () => {
+    clearError();
+    try {
+      const result = await load();
+      if (alive.current) {
+        setData(result);
+      }
+    } catch (e) {
+      if (alive.current) {
+        handleError(e);
+      }
+    }
+  };
+
+  if (data === null)
+    return (
+      <>
+        <h2>
+          <IconChartBar size={18} /> Earnings
+        </h2>
+        <p>Loading…</p>
+      </>
+    );
+
+  const hasPayments = data.byService.length > 0;
+  const maxService = Math.max(1, ...data.byService.map((s) => s.total));
+
+  return (
+    <>
+      <h2>
+        <IconChartBar size={18} /> Earnings
+      </h2>
+
+      <div className="pb-tiles">
+        <div className="pb-tile">
+          <strong>${data.tiles.thisMonth}</strong>
+          <span>This month</span>
+        </div>
+        <div className="pb-tile">
+          <strong>${data.tiles.lastMonth}</strong>
+          <span>Last month</span>
+        </div>
+        <div className="pb-tile">
+          <strong>${data.tiles.outstandingTotal}</strong>
+          <span>Outstanding</span>
+        </div>
+        <div className="pb-tile">
+          <strong>{data.tiles.outstandingCount}</strong>
+          <span>Unpaid bookings</span>
+        </div>
+      </div>
+
+      <h3>Revenue over time</h3>
+      {hasPayments ? (
+        <MonthlyChart monthly={data.monthly} />
+      ) : (
+        <p className="pb-hint">{NO_PAYMENTS}</p>
+      )}
+
+      <h3>By service (all-time)</h3>
+      {data.byService.length === 0 ? (
+        <p className="pb-hint">{NO_PAYMENTS}</p>
+      ) : (
+        <ul className="pb-hbars">
+          {data.byService.map((s) => (
+            <li key={s.serviceType}>
+              <span>{s.label}</span>
+              <div className="pb-hbar">
+                <div
+                  className="pb-hbar-fill"
+                  style={{ width: `${(s.total / maxService) * 100}%` }}
+                />
+              </div>
+              <span>${s.total}</span>
+            </li>
+          ))}
+        </ul>
+      )}
+
+      <h3>Top clients (all-time)</h3>
+      {data.topClients.length === 0 ? (
+        <p className="pb-hint">{NO_PAYMENTS}</p>
+      ) : (
+        <ul>
+          {data.topClients.map((t) => (
+            <li key={t.endUserId}>
+              <span className="pb-truncate" title={t.name || t.email || 'Unknown client'}>
+                {t.name || t.email || 'Unknown client'}
+              </span>
+              <span>
+                ${t.total} · {t.bookings} booking{t.bookings === 1 ? '' : 's'}
+              </span>
+            </li>
+          ))}
+        </ul>
+      )}
+
+      <h3>Outstanding balances</h3>
+      {data.outstanding.length === 0 ? (
+        <p className="pb-hint">No outstanding balances.</p>
+      ) : (
+        <ul>
+          {data.outstanding.map((o) => (
+            <li key={o.bookingId}>
+              <span className="pb-truncate-block" title={o.name || o.email || 'Unknown client'}>
+                <span className="pb-truncate">{o.name || o.email || 'Unknown client'}</span> —{' '}
+                {o.serviceType} ({o.startDate})
+                <br />
+                owes ${o.balance} (paid ${o.paidTotal} of ${o.estCost})
+              </span>
+              <button onClick={() => setOpenId(openId === o.bookingId ? null : o.bookingId)}>
+                {openId === o.bookingId ? 'Close' : 'Record payment'}
+              </button>
+              {openId === o.bookingId && (
+                <PaymentsPanel
+                  session={session}
+                  bookingId={o.bookingId}
+                  onChanged={reload}
+                  handleError={handleError}
+                />
+              )}
+            </li>
+          ))}
+        </ul>
+      )}
+    </>
+  );
+}
diff --git a/app/admin/sections/ServicesSection.tsx b/app/admin/sections/ServicesSection.tsx
index 0ef7721..685aa9b 100644
--- a/app/admin/sections/ServicesSection.tsx
+++ b/app/admin/sections/ServicesSection.tsx
@@ -1,12 +1,19 @@
+import { useState } from 'react';
 import { NullableNumberField } from './fields.js';
-import { IconTag } from '../../shared-ui/icons';
+import { IconPaw, IconTag, SERVICE_ICONS } from '../../shared-ui/icons';
 import type {
   QuestionForm,
   ServiceForm,
   ServiceOptionForm,
+  Settings,
   SettingsSectionProps,
 } from '../shared.js';
 
+function ServiceIcon({ icon }: { icon: string }) {
+  const Icon = SERVICE_ICONS[icon] ?? IconPaw;
+  return <Icon size={16} />;
+}
+
 const QUESTION_TYPES: QuestionForm['type'][] = ['text', 'yesno', 'number', 'select'];
 const QUESTION_TYPE_LABELS: Record<QuestionForm['type'], string> = {
   text: 'Text',
@@ -138,7 +145,59 @@ function QuestionRow({
   );
 }
 
-export function ServicesSection({ settings, setSettings }: SettingsSectionProps) {
+function AddServiceForm({
+  templates,
+  addService,
+}: {
+  templates: Settings['templates'];
+  addService: (template: string, label: string) => Promise<void>;
+}) {
+  const [template, setTemplate] = useState(templates[0]?.id ?? '');
+  const [label, setLabel] = useState('');
+  const [busy, setBusy] = useState(false);
+
+  const submit = async () => {
+    if (busy || !label.trim() || !template) return;
+    setBusy(true);
+    try {
+      await addService(template, label.trim());
+      setLabel('');
+    } finally {
+      setBusy(false);
+    }
+  };
+
+  return (
+    <div className="pb-inline">
+      <select value={template} onChange={(e) => setTemplate(e.target.value)}>
+        {templates.map((t) => (
+          <option key={t.id} value={t.id}>
+            {t.label}
+          </option>
+        ))}
+      </select>
+      <input
+        type="text"
+        placeholder="Service name"
+        value={label}
+        onChange={(e) => setLabel(e.target.value)}
+      />
+      <button type="button" onClick={() => void submit()} disabled={busy}>
+        {busy ? 'Adding…' : 'Add service'}
+      </button>
+    </div>
+  );
+}
+
+export function ServicesSection({
+  settings,
+  setSettings,
+  addService,
+  removeService,
+}: SettingsSectionProps & {
+  addService: (template: string, label: string) => Promise<void>;
+  removeService: (type: string) => Promise<void>;
+}) {
   return (
     <>
       <h2>
@@ -163,8 +222,13 @@ export function ServicesSection({ settings, setSettings }: SettingsSectionProps)
                 checked={s.enabled}
                 onChange={(e) => setService({ ...s, enabled: e.target.checked })}
               />
-              {s.label}
+              <ServiceIcon icon={s.icon} /> {s.label}
             </label>
+            {s.custom && (
+              <button type="button" onClick={() => void removeService(s.type)}>
+                Delete
+              </button>
+            )}
             {!s.hasDuration ? (
               <div className="pb-inline">
                 <input
@@ -358,6 +422,10 @@ export function ServicesSection({ settings, setSettings }: SettingsSectionProps)
           </div>
         );
       })}
+      <div className="pb-service">
+        <h3>Add service</h3>
+        <AddServiceForm templates={settings.templates} addService={addService} />
+      </div>
     </>
   );
 }
diff --git a/app/admin/shared.ts b/app/admin/shared.ts
index 52d274b..a0fd074 100644
--- a/app/admin/shared.ts
+++ b/app/admin/shared.ts
@@ -10,13 +10,16 @@ export type QuestionForm = Omit<ServiceQuestion, 'id'> & { id?: string };
 export type ServiceForm = ServiceConstraints & {
   type: string;
   label: string;
+  icon: string;
   hasDuration: boolean;
   rateUnit: string;
   shape: 'range' | 'single';
+  custom: boolean;
   enabled: boolean;
   options: ServiceOptionForm[];
   questions: QuestionForm[];
 };
+export type ServiceTemplate = { id: string; label: string };
 export type Settings = {
   displayName: string;
   accentColor: string;
@@ -28,6 +31,7 @@ export type Settings = {
   contactPhone: string | null;
   petTypes: { petType: string; enabled: boolean }[];
   services: ServiceForm[];
+  templates: ServiceTemplate[];
   blocked: { id: string; startDate: string; endDate: string | null }[];
   calendar: {
     status: string;
diff --git a/app/embed/BookTab.tsx b/app/embed/BookTab.tsx
index 2f30cc7..7d94f4f 100644
--- a/app/embed/BookTab.tsx
+++ b/app/embed/BookTab.tsx
@@ -14,8 +14,7 @@ import {
   type Pet,
   type TenantConfig,
 } from '../shared-ui/api';
-import { SERVICE_ICONS } from './services';
-import { IconCheck, IconPaw } from '../shared-ui/icons';
+import { IconCheck, IconPaw, SERVICE_ICONS } from '../shared-ui/icons';
 import { QuestionField } from './QuestionField';
 import { errorMsg, slug, parentOrigin } from './shared';
 
@@ -144,7 +143,7 @@ export function BookTab({
     <div className="bp-book">
       <div className="bp-service-grid">
         {config.services.map((s) => {
-          const Icon = SERVICE_ICONS[s.type] ?? IconPaw;
+          const Icon = SERVICE_ICONS[s.icon] ?? IconPaw;
           return (
             <button
               key={s.type}
diff --git a/app/embed/services.ts b/app/embed/services.ts
deleted file mode 100644
index 7274513..0000000
--- a/app/embed/services.ts
+++ /dev/null
@@ -1,18 +0,0 @@
-import type { ComponentType } from 'react';
-import {
-  IconBed,
-  IconClipboardCheck,
-  IconHome,
-  IconPaw,
-  IconSun,
-  type IconProps,
-} from '../shared-ui/icons';
-
-/** Display icons for the widget's service cards, keyed by the config service `type`. */
-export const SERVICE_ICONS: Record<string, ComponentType<IconProps>> = {
-  boarding: IconBed,
-  housesitting: IconHome,
-  daycare: IconSun,
-  walk: IconPaw,
-  checkin: IconClipboardCheck,
-};
diff --git a/app/shared-ui/api.ts b/app/shared-ui/api.ts
index 67a1dce..03587fd 100644
--- a/app/shared-ui/api.ts
+++ b/app/shared-ui/api.ts
@@ -1,5 +1,6 @@
 /** Tiny same-origin API client for the widget + admin pages. */
 
+export { PAYMENT_METHODS } from '../../src/shared/index.js';
 import type { ServiceConstraints, ServiceOption, ServiceQuestion } from '../../src/shared/index.js';
 
 // Re-exported as-is: the widget/admin config wire format is field-for-field the shared shape —
@@ -9,6 +10,7 @@ export type { ServiceOption, ServiceQuestion };
 export type ServiceConfig = ServiceConstraints & {
   type: string;
   label: string;
+  icon: string; // widget icon key: bed|home|sun|paw|clipboard
   shape: 'range' | 'single';
   rateUnit: 'night' | 'day' | 'visit';
   hasDuration: boolean;
@@ -62,6 +64,14 @@ export type Customer = {
   pets: Pet[];
 };
 
+export type ImportResult = {
+  importedCustomers: number;
+  importedPets: number;
+  invitesSent: number;
+  invitesFailed: number;
+  skippedRows: { row: number; reason: string }[];
+};
+
 export type AdminBooking = {
   id: string;
   customerEmail: string | null;
@@ -73,10 +83,47 @@ export type AdminBooking = {
   optionKey: string | null;
   petCount: number;
   estCost: number | null;
+  paidTotal: number;
   status: string;
   createdAt: string;
 };
 
+export type Payment = {
+  id: string;
+  amount: number;
+  method: string;
+  paidDate: string;
+  note: string | null;
+};
+
+export type AnalyticsPayload = {
+  tiles: {
+    thisMonth: number;
+    lastMonth: number;
+    outstandingTotal: number;
+    outstandingCount: number;
+  };
+  monthly: { month: string; total: number }[];
+  byService: { serviceType: string; label: string; total: number }[];
+  topClients: {
+    endUserId: string;
+    name: string | null;
+    email: string | null;
+    total: number;
+    bookings: number;
+  }[];
+  outstanding: {
+    bookingId: string;
+    name: string | null;
+    email: string | null;
+    serviceType: string;
+    startDate: string;
+    estCost: number;
+    paidTotal: number;
+    balance: number;
+  }[];
+};
+
 export class ApiError extends Error {
   constructor(
     public status: number,
@@ -203,6 +250,41 @@ export const adminApi = {
         method: 'DELETE',
         headers: authHeaders(token),
       }),
+    import: (slug: string, token: string, csv: string, sendInvites: boolean) =>
+      request<ImportResult>(`/api/${slug}/admin/customers/import`, {
+        method: 'POST',
+        headers: { ...jsonHeaders, ...authHeaders(token) },
+        body: JSON.stringify({ csv, sendInvites }),
+      }),
+  },
+  payments: {
+    list: (slug: string, token: string, bookingId: string) =>
+      request<{ payments: Payment[] }>(`/api/${slug}/admin/bookings/${bookingId}/payments`, {
+        headers: authHeaders(token),
+      }),
+    record: (
+      slug: string,
+      token: string,
+      bookingId: string,
+      body: { amount: number; method: string; paidDate: string; note?: string },
+    ) =>
+      request<{ payment: Payment; paidTotal: number }>(
+        `/api/${slug}/admin/bookings/${bookingId}/payments`,
+        {
+          method: 'POST',
+          headers: { ...jsonHeaders, ...authHeaders(token) },
+          body: JSON.stringify(body),
+        },
+      ),
+    remove: (slug: string, token: string, bookingId: string, paymentId: string) =>
+      request<unknown>(`/api/${slug}/admin/bookings/${bookingId}/payments/${paymentId}`, {
+        method: 'DELETE',
+        headers: authHeaders(token),
+      }),
+  },
+  analytics: {
+    get: (slug: string, token: string) =>
+      request<AnalyticsPayload>(`/api/${slug}/admin/analytics`, { headers: authHeaders(token) }),
   },
   bookings: {
     list: (slug: string, token: string) =>
diff --git a/app/shared-ui/icons.tsx b/app/shared-ui/icons.tsx
index 905ef9b..5bc442f 100644
--- a/app/shared-ui/icons.tsx
+++ b/app/shared-ui/icons.tsx
@@ -1,4 +1,4 @@
-import type { ReactNode } from 'react';
+import type { ComponentType, ReactNode } from 'react';
 
 /**
  * Pawbook's icon set: small inline SVGs on one consistent system — 24px grid,
@@ -147,6 +147,17 @@ export function IconStore({ size }: IconProps) {
   );
 }
 
+export function IconChartBar({ size }: IconProps) {
+  return (
+    <Svg size={size}>
+      <path d="M3 3v16a2 2 0 0 0 2 2h16" />
+      <path d="M7 16v-3" />
+      <path d="M12 16v-6" />
+      <path d="M17 16v-9" />
+    </Svg>
+  );
+}
+
 export function IconChevronLeft({ size }: IconProps) {
   return (
     <Svg size={size}>
@@ -170,3 +181,12 @@ export function IconCheck({ size }: IconProps) {
     </Svg>
   );
 }
+
+/** Service display icons, keyed by a service's `icon` field. Shared by the widget and admin UI. */
+export const SERVICE_ICONS: Record<string, ComponentType<IconProps>> = {
+  bed: IconBed,
+  home: IconHome,
+  sun: IconSun,
+  paw: IconPaw,
+  clipboard: IconClipboardCheck,
+};
diff --git a/docs/examples/clients-import-example.csv b/docs/examples/clients-import-example.csv
new file mode 100644
index 0000000..a9f39eb
--- /dev/null
+++ b/docs/examples/clients-import-example.csv
@@ -0,0 +1,5 @@
+Client Email,Client Name,Pet Name,Pet Type
+jess@example.com,Jess Nguyen,Bella,dog
+jess@example.com,Jess Nguyen,Mochi,cat
+sam@example.com,Sam Diaz,Rex,dog
+team@example.com,Team Co,,
diff --git a/docs/superpowers/specs/2026-07-07-custom-services-design.md b/docs/superpowers/specs/2026-07-07-custom-services-design.md
new file mode 100644
index 0000000..8f1566e
--- /dev/null
+++ b/docs/superpowers/specs/2026-07-07-custom-services-design.md
@@ -0,0 +1,116 @@
+# Custom services (agnostic Service abstraction) — design
+
+**Date:** 2026-07-07
+**Status:** Approved (user directed implementation; template-driven variant chosen)
+**Branch:** `custom-services`
+
+## Problem
+
+The service set is a closed, cross-tenant enum: `SERVICE_CATALOG` in
+`server/lib/services.ts` hardcodes five services, schema `CHECK`s repeat the
+list in three tables, and per-type behavior (shape, rate unit, duration,
+capacity semantics) lives in code keyed by that enum. A sitter cannot offer
+"Morning walk" and "Afternoon walk" as distinct bookable services.
+
+The 2026-07-04 time-windowed-services spec worked around this by putting
+windows on `TenantServiceOptions`, explicitly rejecting per-slot service types
+_because_ `ServiceType` was a closed enum. This design removes that
+limitation: services become per-tenant data rows, and the five built-ins
+become **templates**. (The window/capacity option columns from that spec can
+still layer on top later; nothing here conflicts with it.)
+
+## Design
+
+### Data model
+
+`TenantServices` becomes the authoritative, agnostic Service store. Each row
+carries its own behavior — every service has the same structure:
+
+```sql
+TenantServices (
+  TenantId, ServiceType,          -- ServiceType is now a per-tenant SLUG (e.g. 'morning-walk'); CHECK dropped
+  Enabled,
+  Label TEXT NOT NULL,            -- display name, sitter-chosen
+  Icon TEXT NOT NULL,             -- widget icon key: bed|home|sun|paw|clipboard
+  Shape TEXT CHECK ('range','single'),
+  RateUnit TEXT CHECK ('night','day','visit'),
+  HasDuration INTEGER,            -- options priced per duration?
+  CapacityKind TEXT CHECK ('boarding','housesit','none'),  -- which capacity POOL the service draws from
+  SortOrder INTEGER,
+  Questions, MinNights, MaxNights, MinPetCount, MaxPetCount  -- unchanged
+)
+```
+
+`ServiceType` `CHECK`s are dropped from `TenantServices`,
+`TenantServiceOptions`, and `BookingRequests` (SQLite table rebuilds).
+`'blocked'` stays a reserved `BookingRequests.ServiceType` value and a
+reserved slug.
+
+**CapacityKind names the capacity pool, not the service.** The shared
+capacity engine (`src/shared/booking/capacity.ts`) is untouched: `'boarding'`
+= pet-counted against `Tenants.MaxBoardingPets`, `'housesit'` = day-counted
+against `MaxHouseSitsPerDay` (incl. the ≤1-day overlap rule), `'none'` =
+unlimited (blocked days only). A custom "Luxury boarding" shares the boarding
+pet pool — capacity models the sitter's real-world resources, which don't
+multiply when a service is cloned.
+
+### Templates
+
+`SERVICE_CATALOG` becomes `SERVICE_TEMPLATES` — seed data + the "Add service"
+picker. Creating a service = pick a template + type a name; the template
+permanently fixes Shape/RateUnit/HasDuration/CapacityKind/Icon (behavior is
+not sitter-editable — no arbitrary combos, no new validation surface). Slug =
+slugify(label); collisions and `'blocked'` rejected; `UNIQUE (TenantId,
+ServiceType)` is the backstop.
+
+### Migration `0006_custom_services.sql`
+
+1. Rebuild `TenantServices` with the new columns, backfilling behavior from
+   the template values for the five known slugs.
+2. `INSERT OR IGNORE` the five built-in rows (Enabled=0) for every tenant, so
+   rows — not code — are the service list from now on.
+3. Rebuild `TenantServiceOptions` and `BookingRequests` without the
+   `ServiceType` CHECKs (indexes recreated).
+
+### Server
+
+- `ServiceType` the TypeScript type becomes `string`; `isServiceType` guards
+  are replaced by tenant-row lookups (which the routes already did for
+  enablement anyway).
+- `estimateCost` / `checkAvailability` / `monthAvailability` take the
+  `TenantService` row and read `Shape`/`CapacityKind` from it.
+- `listCapacityRows` joins `TenantServices` to select rows whose service
+  draws from a capacity pool (previously a hardcoded
+  `IN ('boarding','housesitting','blocked')`), returning `CapacityKind`.
+- Calendar sync: `SyncInput` gains `serviceLabel` (from the row); the GCal
+  `category` extended property stays the slug, and month-availability maps
+  slug → CapacityKind via the tenant's rows (unknown/legacy slugs fall back
+  exactly as before).
+- Admin routes: `GET/PUT /admin/settings` work off rows;
+  new `POST /admin/services` `{template, label}` (created disabled, priced +
+  enabled via the normal PUT) and `DELETE /admin/services/:type` (custom
+  services only, refused while any booking rows reference the slug).
+
+### Clients
+
+- Widget: already renders `config.services` generically; icons switch from a
+  slug-keyed map to the row's `icon` field (paw fallback).
+- Admin `ServicesSection`: renders the row list; adds an "Add service"
+  form (template picker + name) and a delete button on custom services.
+  Built-ins are disabled, never deleted.
+
+## Not built (deliberate)
+
+- Editing a service's behavior/template after creation, or renaming — delete
+  and recreate.
+- Fixed clock windows / per-slot capacity — that's the 2026-07-04 spec,
+  unimplemented here; custom services make its "morning walk" example
+  expressible today via separate services with duration options.
+- Per-service capacity pools — custom services share the tenant-level pools.
+
+## Testing
+
+Existing suite must pass with built-in slugs unchanged. New coverage: create
+service (slug derivation, collision, reserved slug), delete guards (custom
+only, no bookings), booking a custom boarding-pool service counts against
+`MaxBoardingPets`.
diff --git a/docs/superpowers/specs/2026-07-10-csv-client-import-design.md b/docs/superpowers/specs/2026-07-10-csv-client-import-design.md
new file mode 100644
index 0000000..16f5d93
--- /dev/null
+++ b/docs/superpowers/specs/2026-07-10-csv-client-import-design.md
@@ -0,0 +1,239 @@
+# CSV client/pet import — design
+
+**Date:** 2026-07-10
+**Status:** Approved (pending spec review)
+**Branch target:** off `custom-services`
+
+## Problem
+
+Sitters onboarding to Pawbook with an existing client list today can only add
+customers and pets one at a time via `ClientsSection.tsx`'s inline forms
+(`POST /:slug/admin/customers`, `POST /:slug/admin/customers/:id/pets`,
+`server/routes/admin.ts:548-604`). There's no way to bring in a spreadsheet of
+existing clients and their pets in one action.
+
+## Goals
+
+1. A sitter can upload a CSV of clients and their pets and have them imported
+   in one action.
+2. Re-uploading the same file (or an updated version) is safe — it never
+   creates duplicate clients or duplicate pets, whether the duplicate is
+   within the same file or against data already in the database.
+3. A file with some bad rows still imports everything that's valid, and tells
+   the sitter exactly which rows were skipped and why.
+4. The sitter chooses whether importing sends the same "you're invited"
+   email a manual add would trigger — useful when migrating a historical
+   list nobody should be emailed about yet.
+5. A documented example CSV exists both as a file in the repo and as a
+   one-click download from the import UI, so sitters know the exact format
+   to follow.
+
+## Non-goals
+
+- Editing or removing existing clients/pets via CSV — this is additive only
+  (create-or-reuse), matching `insertInvitedCustomer`'s existing semantics.
+  A follow-up CSV _export_ or _update_ flow is out of scope.
+- A preview-then-confirm step before committing the import. Because the
+  import is already non-destructive and idempotent (Goal 2), there's nothing
+  to undo — the sitter gets the full result report (what was created, what
+  was skipped and why) immediately after uploading, not before.
+- Any field not already on `EndUser`/`EndUserPet` (phone, pet notes/breed,
+  etc.). Adding those would need a schema migration unrelated to the import
+  mechanism itself; the CSV format only covers `Email`, `Name` (client) and
+  `Name`, `Type` (pet) — the same fields the single-add forms already
+  collect.
+- True `multipart/form-data` upload handling. No route in this codebase
+  parses multipart bodies today; adding that machinery buys nothing here
+  since CSV files of a sitter's client list are trivially small.
+
+## Alternatives considered
+
+**Client-side CSV parsing**, sending a pre-parsed JSON array of row objects
+instead of raw CSV text. Rejected: validation must be authoritative on the
+server regardless (client input can't be trusted), so parsing client-side
+would mean maintaining the parsing/validation logic in two places for no
+benefit — this codebase's only test infrastructure is server-side
+(`server/__tests__/*.test.ts`; there is no frontend test setup), so keeping
+all of it server-side keeps it testable in the existing way.
+
+**True multipart file upload** (`c.req.formData()`). Rejected: this would be
+the first multipart route in the codebase, adding a new request-parsing
+pattern for a file that's a few KB of text. Sending the file's text content
+as a plain JSON string field reuses the exact `adminApi`/`request<T>()`
+convention every other admin mutation already uses
+(`app/shared-ui/api.ts:92-97`).
+
+**Chosen: browser reads the file as text via the native `File.text()` API**,
+POSTs `{ csv: string, sendInvites: boolean }` as a normal JSON body to a new
+route, which does all parsing, validation, dedup, and importing server-side
+in one pass.
+
+## Design
+
+### 1. CSV format
+
+Four columns, one row per pet (a client with multiple pets repeats across
+multiple rows; a client with no pets yet gets one row with the pet columns
+blank):
+
+```
+Client Email,Client Name,Pet Name,Pet Type
+jess@example.com,Jess Nguyen,Bella,dog
+jess@example.com,Jess Nguyen,Mochi,cat
+sam@example.com,Sam Diaz,Rex,dog
+team@example.com,Team Co,,
+```
+
+- `Client Email` — required, validated against the existing `EMAIL_RE`
+  (`server/lib/validation.ts:10`).
+- `Client Name` — optional, same as the single-add form (blank → `null`).
+- `Pet Name` / `Pet Type` — both optional, but only meaningful together:
+  either both blank (client-only row) or both present. `Pet Type` must be
+  `dog` or `cat` (case-insensitive) **and** enabled for that tenant (same
+  two-part check the single-add pet route already applies —
+  `isPetType` + `listPetTypes(...).Enabled`, `server/routes/admin.ts:594,
+599-602`).
+
+An example file matching this exact format is committed to the repo at
+`docs/examples/clients-import-example.csv` and served as a static download
+link from the import UI (Section 4).
+
+### 2. CSV parser (`server/lib/csv.ts`, new file)
+
+A small hand-rolled row parser — not a dependency — since the format is four
+fixed columns and the only real complexity is RFC4180 quoting (a client name
+containing a comma, e.g. `"Doe, Jane"`, exported from Excel/Sheets with
+quotes). One function:
+
+```ts
+export function parseCsvRows(text: string): string[][];
+```
+
+Splits on newlines (tolerating `\r\n`), splits each line on commas outside
+quotes, and un-escapes `""` → `"` inside a quoted field. The caller (Section 3) treats row 1 as the header and ignores it (column order is fixed, not
+name-matched — matching the fixed 4-column format above; a header with
+different labels or order is not supported in this pass).
+
+### 3. Import route (`server/routes/admin.ts`)
+
+New route, alongside the existing customer routes:
+
+`POST /:slug/admin/customers/import` — body `{ csv: string, sendInvites: boolean }`.
+
+For each parsed row (1-indexed against the sitter's actual file, header = row 1):
+
+1. Validate `Client Email`. Invalid/blank → skip the whole row, record
+   `{ row, reason: 'Invalid email address' }`.
+2. `insertInvitedCustomer(db, tenant.Id, email, name)` — already idempotent
+   by `(TenantId, Email)` (`server/db/repo.ts:578-583`), reused as-is. This
+   is what makes re-uploading the same file safe for the client half of
+   every row.
+3. If `Pet Name`/`Pet Type` are both blank, row is done (client-only row).
+   If exactly one of the two is present, skip just the pet with a reason
+   (`'Pet type given without a pet name'` / `'Pet name given without a pet
+type'`) — the client from step 2 is still kept.
+4. If both are present: validate `Pet Type` (same two checks as the
+   single-add route). Invalid → skip just the pet, record the reason (client
+   from step 2 is still kept).
+5. **Dedup check**: before inserting, check whether this customer already
+   has a pet with this name — an in-memory `Map<endUserId, Set<petNameLower>>`
+   for the request, seeded per-customer on first encounter from
+   `listAllEndUserPetsByTenant` (already fetched once for the whole tenant,
+   `server/db/repo.ts` — reused to build the seed map rather than querying
+   per row) and updated as pets are added during this same run. A name
+   already in the set → skip, record `{ row, reason: 'Pet already exists for
+this client' }`. This one check is what makes both "duplicate row within
+   this file" and "re-uploading the same file later" safe — both look
+   identical to it.
+6. Otherwise `addEndUserPet(db, tenant.Id, endUserId, name, petType)` and add
+   the name to the dedup set.
+
+After all rows: if `sendInvites` is true, for every customer whose `Status`
+came back `'invited'` from step 2 (freshly created this run — reusing the
+same distinction the single-add route already makes), send the invite via
+`sendInvite` (`server/lib/email.ts`) with the same `widgetUrl` construction
+the single-add route uses (`admin.ts:562-564`). **Best-effort per email** —
+unlike the single-add route's `502` on send failure, a bulk import must
+never fail the whole request over one bad email address; a failed send is
+counted in `invitesFailed`, not surfaced as a skipped row (the customer/pet
+records are still created either way).
+
+Response:
+
+```ts
+{
+  importedCustomers: number, // count of rows whose client was newly created (not reused)
+  importedPets: number,
+  invitesSent: number,
+  invitesFailed: number,
+  skippedRows: Array<{ row: number; reason: string }>,
+}
+```
+
+### 4. Frontend (`app/admin/sections/ClientsSection.tsx`, `app/shared-ui/api.ts`, `app/admin/shared.ts`)
+
+- A file `<input type="file" accept=".csv">`, a "Send invite emails to new
+  clients" checkbox (defaulting unchecked — the safer default per Goal 4,
+  matching "migrating a historical list" being the more surprising direction
+  to get wrong), an "Import" button, and a "Download example CSV" link
+  (points at `docs/examples/clients-import-example.csv`, copied into the
+  built `dist/` assets the same way other static content is served — see
+  Section 5).
+- On import, `file.text()` reads the selected file, POSTs to the new
+  `adminApi.customers.import(slug, token, csv, sendInvites)` (added to
+  `app/shared-ui/api.ts` next to the existing `customers` namespace).
+- The result renders as an inline panel within `ClientsSection` (not the
+  transient sticky save-bar other mutations use) — showing the counts and,
+  when non-empty, the full `skippedRows` list with row numbers and reasons —
+  because this result can be multiple lines and the sitter needs time to
+  read it, unlike the 4-second transient success messages elsewhere.
+- After a successful import, the customer list refreshes the same way
+  `addCustomer`/`addPet` already trigger a refresh today (`App.tsx`'s
+  `withCustomerRefresh`/`reloadCustomers` pattern).
+
+### 5. Example CSV file
+
+`docs/examples/clients-import-example.csv` — the exact 4-row example shown
+in Section 1. Needs to be reachable as a real download from the admin UI;
+the simplest option reusing this repo's existing static-serving setup
+(Vite build → `ASSETS` binding) is copying it into `public/` (Vite's
+convention for files served as-is, unprocessed) rather than `docs/`, so it
+ships at a stable URL. Decision: keep the source of truth in
+`docs/examples/` (near this spec, easy for a developer to find) and also
+place an identical copy in `public/clients-import-example.csv` for the
+actual download link — two files, not a build step, since this is a single
+static file that changes rarely.
+
+## Error handling
+
+- Malformed CSV (e.g. inconsistent quoting) — the parser's job is to not
+  throw; a line that can't be cleanly split is treated as an invalid row
+  (all its columns skipped, reason `'Could not parse this row'`) rather than
+  aborting the whole import.
+- An empty file (header only or fully empty) — returns the same response
+  shape with all counts zero, not an error; the sitter sees "0 clients
+  imported" rather than a cryptic failure.
+- Invite email failures never abort the import or fail the request — counted
+  in `invitesFailed`, matching the "email must never affect what it's
+  attached to" pattern already established for booking-status emails
+  elsewhere in this codebase.
+
+## Testing
+
+`server/__tests__/customers-import.test.ts` (new):
+
+- Parser: quoted fields with embedded commas, `""`-escaped quotes within a
+  quoted field, `\r\n` line endings, a trailing blank line.
+- Happy path: a multi-row file creating several clients and pets, correct
+  `importedCustomers`/`importedPets` counts.
+- Skip reasons: invalid email, disabled/unknown pet type, pet name without a
+  type and vice versa — each produces the right `reason` string and the
+  right row number.
+- Dedup: the same client+pet appearing twice in one file only creates one
+  pet; re-running the exact same import a second time creates zero new pets
+  and zero new clients (client reused via existing idempotency, pet skipped
+  via the new dedup check).
+- `sendInvites` toggle: `true` sends invites only for freshly-created
+  clients (not ones that already existed), `false` sends none; a mocked
+  failing send is reflected in `invitesFailed` without failing the request
+  or skipping the client/pet records.
diff --git a/docs/superpowers/specs/2026-07-10-sitter-booking-dashboard-design.md b/docs/superpowers/specs/2026-07-10-sitter-booking-dashboard-design.md
new file mode 100644
index 0000000..9b16720
--- /dev/null
+++ b/docs/superpowers/specs/2026-07-10-sitter-booking-dashboard-design.md
@@ -0,0 +1,230 @@
+# Sitter booking dashboard: confirm/reject + calendar reconciliation — design
+
+**Date:** 2026-07-10
+**Status:** Approved (pending spec review)
+**Branch target:** off `custom-services`
+
+## Problem
+
+There is no admin UI for a sitter to see incoming booking requests or act on
+them. `insertBookingRequest` (`server/db/repo.ts:241`) creates every booking
+as `Status='pending'` or `'confirmed'` and that's the end of the road — no
+route lists bookings for a tenant, no route changes a booking's status, and
+`app/admin/App.tsx`'s `SECTIONS` array has no bookings entry. Every booking is
+also pushed to Google Calendar on creation (`syncBookingToCalendar`,
+`server/routes/bookings.ts:185`), but nothing ever reads back — if a sitter or
+customer edits/deletes the event directly in Google Calendar, Pawbook's DB
+never finds out, so the dashboard would show stale state.
+
+This exact feature (confirm/decline list + status route) already exists on
+`main` — merged via #15 and #17, function-for-function what this spec ports —
+but `main` and `custom-services` have diverged: `custom-services` replaced the
+static `SERVICE_CATALOG` with per-tenant `TenantServices` rows. Investigation
+below found the divergence doesn't actually touch the booking code path
+(neither the route nor the UI component reference `SERVICE_CATALOG`), so this
+is a near-verbatim port, not a rewrite.
+
+## Goals
+
+1. A sitter can see all booking requests for their tenant, grouped into
+   "needs your reply" (pending) and everything else, and confirm or decline a
+   pending request, or cancel a confirmed one.
+2. Every dashboard load reconciles against Google Calendar: if a synced
+   booking's calendar event was deleted directly in Calendar, the booking is
+   automatically marked cancelled before the list is returned.
+3. Reconciliation is cheap — a short-TTL KV cache means back-to-back page
+   loads don't each trigger a Calendar API call.
+4. The customer is notified by email on any status change, best-effort,
+   matching the existing "never let email failure affect the booking"
+   philosophy already used elsewhere in this codebase.
+
+## Non-goals
+
+- Deleting or updating the Google Calendar event when a sitter cancels or
+  declines from the dashboard. `main` shipped with this same gap (see its
+  `// ponytail:` comment on the status route) — carried forward unchanged
+  here; revisit if sitters complain about stale calendar entries.
+- Reconciling in the other direction in more detail than "event exists /
+  doesn't exist" — e.g. detecting a _time change_ on the calendar event and
+  reflecting it back onto `BookingRequests.StartDate`/`StartTime`. Out of
+  scope; a missing event is the only signal this pass acts on.
+- A manual "sync now" button. The cache TTL (Goal 3) is short enough that a
+  sitter reloading the page is sufficient; add a button later only if the TTL
+  proves too coarse in practice.
+- Blocked-day rows (`ServiceType='blocked'`) — excluded from every query and
+  route in this feature, same as `main`.
+
+## Alternatives considered
+
+**Cloudflare Cron Trigger for reconciliation**, decoupled from dashboard
+loads, reconciling all tenants on a fixed schedule. Rejected for now: adds a
+new infrastructure primitive (`wrangler.jsonc` cron config, a new entry
+point) for a prototype with a handful of tenants, and still leaves a lag
+window up to the schedule interval. The on-demand + KV-cache approach
+(Goal 3) gets "reasonably fresh, never hammers the API" without new
+infrastructure, reusing a pattern (`tenant-resolve.ts`) already proven in
+this codebase. Revisit if tenant count grows enough that per-load
+reconciliation cost matters.
+
+**Flag-only reconciliation** (show a mismatch warning, never auto-write) was
+considered and rejected per your answer during brainstorming — auto-cancelling
+keeps the list trustworthy without an extra manual step, and cancelling is
+already the correct terminal state for "the calendar event is gone."
+
+## Design
+
+### 1. Schema
+
+New migration `migrations/0007_booking_lifecycle.sql` (+ `sql/schema.sql`
+updated in lockstep), verbatim from `main`:
+
+```sql
+ALTER TABLE BookingRequests ADD COLUMN Declined INTEGER NOT NULL DEFAULT 0;
+```
+
+`Status` stays `CHECK (Status IN ('pending', 'confirmed', 'cancelled'))` —
+unchanged. A sitter's decline is stored as `Status='cancelled'` +
+`Declined=1` rather than widening the `CHECK`, because SQLite `CHECK`
+constraints can't be altered without a full table rebuild
+(`ALTER TABLE ... ADD COLUMN` is cheap; changing a `CHECK` is not). This is
+`main`'s already-reviewed approach — reused rather than re-litigated.
+
+`BOOKING_COLS` (`server/db/repo.ts:28`) gains `Declined`. A new
+`BOOKING_COLS_QUALIFIED` constant (`` `BookingRequests.${c}` `` for each
+column in `BOOKING_COLS`) is needed for the two new JOIN queries below —
+today's plain `BOOKING_COLS` string is unqualified, and both `BookingRequests`
+and `EndUsers` have an `Id` column, which is ambiguous once joined.
+
+### 2. Repo layer (`server/db/repo.ts`)
+
+Three functions, ported from `main` with `BOOKING_COLS_QUALIFIED` swapped in
+for `main`'s equivalent constant name:
+
+- `listBookingsForTenant(db, tenantId)` — all non-blocked bookings for a
+  tenant, `LEFT JOIN EndUsers` for `Email`/`Name`, ordered newest-first.
+- `updateBookingStatus(db, tenantId, id, status)` — the sitter-driven
+  transition. Guard is entirely in the SQL `WHERE` clause (atomic with the
+  write): `'declined'` only matches `Status='pending'` rows and sets
+  `Status='cancelled', Declined=1`; `'confirmed'`/`'cancelled'` match any
+  non-cancelled, non-blocked row. Returns whether a row actually changed.
+- `getBookingWithCustomer(db, tenantId, id)` — one booking joined with
+  customer contact info, for the notification email.
+
+### 3. Admin routes (`server/routes/admin.ts`)
+
+Ported verbatim from `main`, added alongside the existing customer/pet
+routes (same file, same `adminAuth`/`tenantMiddleware` stack every other
+admin route already uses):
+
+- `GET /:slug/admin/bookings` — calls the KV-cached reconciliation (Section 5)
+  first, then `listBookingsForTenant`, mapping `Declined ? 'declined' :
+Status` into the response `status` field (main's derived-status pattern).
+- `POST /:slug/admin/bookings/:id/status` — validates `status` is one of
+  `confirmed`/`declined`/`cancelled`, calls `updateBookingStatus`, 404s if no
+  row changed. On success, best-effort emails the customer via
+  `sendBookingStatusEmail` (Section 4) if `isEmailConfigured(c.env)` and the
+  booking has a customer email; returns `{ status, notified }` so the
+  dashboard can honestly tell the sitter whether the client was told.
+
+### 4. Email (`server/lib/email.ts`)
+
+New `sendBookingStatusEmail(env, to, displayName, statusWord, whenText)`,
+ported verbatim from `main` — same `resendPost` call shape as the existing
+`sendLoginCode`/`sendInvite`, throws if email isn't configured (caller
+catches and reports `notified: false`, same pattern already used for every
+other best-effort email in this codebase).
+
+### 5. Calendar reconciliation (`server/lib/calendar-sync.ts`)
+
+New function:
+
+```ts
+export async function reconcileBookingsWithCalendar(env: Env, tenant: Tenant): Promise<void>;
+```
+
+- No-ops immediately if there's no connected calendar provider
+  (`getProviderConnection(..., 'calendar')` missing or `Status !==
+'connected'`) — matches the existing guard at the top of
+  `syncBookingToCalendar`.
+- Lists events via the already-existing `listCalendarEvents` (already reads
+  back `extendedProperties.private.bookingId`, since `buildEventResource`
+  writes it on every synced event) over a fixed window: today − 1 day
+  through +180 days. A fixed window is simplest and matches this prototype's
+  scale; if bookings routinely land further out, switch to querying
+  `MIN`/`MAX(StartDate)` from open bookings instead.
+- Builds a `Set` of the `bookingId`s present in that event list.
+- Queries `BookingRequests` for this tenant where `GCalEventId IS NOT NULL`
+  and `Status != 'cancelled'`; for any row whose `Id` is missing from the
+  Calendar set, calls `updateBookingStatus(..., 'cancelled')` (plain cancel,
+  not decline — the sitter didn't decline it, the calendar event just isn't
+  there anymore).
+- Wrapped in `try/catch` at the call site (Section 6) — a Calendar API
+  failure (revoked token, rate limit, network) must never block the
+  dashboard from returning current DB state, matching the "Google failure
+  must never affect a booking" comment already on `syncBookingToCalendar`.
+
+### 6. KV cache (new function in `calendar-sync.ts`, alongside reconciliation)
+
+Mirrors `tenant-resolve.ts`'s read-through pattern exactly:
+
+```ts
+const CALENDAR_SYNC_TTL_SECONDS = 120;
+const calendarSyncKey = (tenantId: string) => `calendar-sync:${tenantId}:last`;
+
+export async function reconcileIfStale(env: Env, tenant: Tenant): Promise<void> {
+  const key = calendarSyncKey(tenant.Id);
+  if (await env.PAWBOOK_CACHE.get(key)) return; // reconciled recently, skip
+  try {
+    await reconcileBookingsWithCalendar(env, tenant);
+  } catch {
+    /* best-effort; next load tries again once the (unwritten) cache key expires */
+  }
+  await env.PAWBOOK_CACHE.put(key, '1', { expirationTtl: CALENDAR_SYNC_TTL_SECONDS });
+}
+```
+
+The cache key is written _after_ the attempt (success or failure) so a
+transient failure doesn't cause every subsequent load in the TTL window to
+retry — it backs off for the full TTL either way, same as any other
+best-effort background reconciliation. `GET /:slug/admin/bookings`
+(Section 3) calls `reconcileIfStale` before `listBookingsForTenant`.
+
+### 7. Frontend
+
+- `app/admin/sections/BookingsSection.tsx` — new file, ported verbatim from
+  `main`'s (confirmed via direct diff that it has no `SERVICE_CATALOG`
+  dependency: `b.type` renders the raw `ServiceType` slug, no label lookup).
+  Pending rows get Confirm/Decline buttons; confirmed rows get Cancel
+  (with a native `confirm()` guard, matching `main`); a save-bar-style
+  message reports whether the customer was emailed.
+- `app/shared-ui/api.ts` — add `AdminBooking` type and an `adminApi.bookings`
+  namespace (`list`, `setStatus`), ported verbatim from `main`.
+- `app/admin/App.tsx` — add `'bookings'` to the `SectionKey` union and
+  `SECTIONS` array (`app/admin/App.tsx:119-121`), rendered the same
+  registry-driven way every other section already is.
+
+## Error handling
+
+- Calendar reconciliation failures are swallowed (Section 5/6) — dashboard
+  always falls back to current DB state.
+- Invalid status-transition attempts (e.g. declining an already-confirmed
+  booking) are simply no-ops at the DB layer (`updateBookingStatus` returns
+  `false`) and surface as a 404 from the route, matching the existing
+  "row didn't change → not found" idiom used elsewhere in this file (e.g.
+  `removeEndUserPet`).
+- Email failures never block the status change — `notified: false` is
+  reported, matching `main`'s exact behavior.
+
+## Testing
+
+- `server/__tests__/admin-bookings.test.ts` (new, mirrors the existing
+  per-concern test file convention): `updateBookingStatus` transition guards
+  (pending→confirmed/declined, confirmed→cancelled, cancelled is terminal,
+  blocked rows never match), `GET`/`POST` route behavior including the
+  `notified` flag.
+- `server/__tests__/calendar-sync.test.ts` (extend existing, or new file if
+  none exists yet): `reconcileBookingsWithCalendar` cancels a booking whose
+  event is missing from `listCalendarEvents`, leaves one whose event is
+  present untouched, no-ops with no connected calendar provider.
+- Cache behavior: a mock KV covering the skip-on-fresh-key /
+  reconcile-on-miss branches of `reconcileIfStale`.
diff --git a/docs/superpowers/specs/2026-07-11-earnings-analytics-design.md b/docs/superpowers/specs/2026-07-11-earnings-analytics-design.md
new file mode 100644
index 0000000..1cea751
--- /dev/null
+++ b/docs/superpowers/specs/2026-07-11-earnings-analytics-design.md
@@ -0,0 +1,250 @@
+# Earnings analytics: payment tracking + dashboard — design
+
+**Date:** 2026-07-11
+**Status:** Revised after two-subagent review (fact-check vs codebase + design review); pending user approval
+**Branch target:** off `custom-services`
+
+## Problem
+
+Sitters have no view of the money side of their business. The only
+money-shaped data in the schema is `BookingRequests.EstCost` (an INTEGER
+whole-dollar _estimate_ computed at booking time) and per-option `Rate` on
+`TenantServiceOptions`. There is no record of what was actually paid, no
+paid/unpaid state, no payment processor, and no reporting of any kind — the
+admin app (`app/admin/App.tsx`) has sections for bookings, clients, services,
+etc., but nothing that aggregates.
+
+User decision during brainstorming: build **real payment tracking** (not
+EstCost-only pseudo-revenue, not a Stripe integration), then build analytics
+on recorded payments. A booking can have **multiple payment records**
+(deposits, partial payments); outstanding balance = `EstCost` minus payments
+recorded so far.
+
+## Goals
+
+1. A sitter can record payments against a booking (amount, method, date,
+   optional note), and delete a mistakenly-entered one.
+2. A new **Earnings** section in the admin dashboard shows:
+   - Stat tiles: revenue this month, revenue last month, total outstanding,
+     count of unpaid/partially-paid confirmed bookings.
+   - **Revenue over time**: monthly bar chart of the last 12 months of
+     recorded payments.
+   - **Breakdown by service**: revenue per service (horizontal bars).
+   - **Top clients**: highest-spending clients by recorded payments, with
+     booking counts.
+   - **Outstanding balances**: confirmed bookings not yet fully paid — who
+     owes what — with an inline "record payment" action.
+3. The Bookings section shows each booking's payment state (paid total vs
+   `EstCost`) and offers the same record-payment action, so a sitter can log
+   a payment at the moment they confirm a booking.
+4. All aggregation happens server-side in SQL (D1/SQLite `GROUP BY`); the
+   client renders one JSON payload.
+
+## Non-goals
+
+- **Payment processing.** No Stripe/PayPal APIs — sitters collect money
+  however they already do (cash, Venmo, Zelle…) and record it here. The
+  `Method` column keeps the door open for a processor later.
+- **Cents.** Amounts are INTEGER whole dollars, matching `EstCost` and
+  `Rate`. The rest of the schema is whole-dollar; introducing cents only for
+  payments would poison every aggregate with unit ambiguity.
+- **Invoicing/receipts.** No PDFs, no emails to clients about payments.
+- **Refunds / cancel-after-payment netting.** Revenue aggregates count
+  payments regardless of the booking's later status — cash already received
+  is real revenue (only the _outstanding_ query filters to confirmed).
+  There are no negative amounts (`CHECK (Amount > 0)`); deleting the
+  payment record is the only correction mechanism, which is why
+  `deletePayment` has no booking-status guard. Revisit if real refund
+  bookkeeping is ever needed.
+- **Charting library.** Charts are hand-rolled SVG/CSS — a 12-bar monthly
+  chart is ~30 lines of JSX, and the repo's only runtime deps are
+  hono/react/react-dom. Revisit if charts multiply or need
+  tooltips/zoom/legends.
+- **Date-range pickers / custom periods.** Fixed windows for v1: last 12
+  months for the time chart, all-time for service/client breakdowns.
+  Add filtering when a real sitter asks for it.
+- **Expense tracking.** "Spending" for a sitter's business (supplies, gas)
+  is a different feature; this is revenue-in only.
+
+## Alternatives considered
+
+**EstCost-only analytics (no payment tracking)** — zero schema change, but
+every number would be an estimate of money that may never have arrived, and
+"outstanding balances" would be impossible. Rejected by user during
+brainstorming.
+
+**Single paid/unpaid flag on BookingRequests** — one column instead of a
+table, but cannot represent deposits or partial payments, which are the norm
+for multi-hundred-dollar boarding stays. Rejected by user in favor of a
+Payments table.
+
+**Charting library (recharts et al.)** — ~100 kB+ into the admin bundle for
+four static bar charts. Rejected; hand-rolled SVG.
+
+## Design
+
+### 1. Schema
+
+New migration `migrations/0008_payments.sql` (+ `sql/schema.sql` updated in
+lockstep):
+
+```sql
+CREATE TABLE IF NOT EXISTS Payments (
+  Id TEXT PRIMARY KEY,
+  TenantId TEXT NOT NULL REFERENCES Tenants(Id),
+  BookingRequestId TEXT NOT NULL REFERENCES BookingRequests(Id),
+  Amount INTEGER NOT NULL CHECK (Amount > 0), -- whole dollars, matching EstCost/Rate
+  Method TEXT NOT NULL CHECK (Method IN ('cash', 'venmo', 'zelle', 'paypal', 'check', 'card', 'other')),
+  PaidDate TEXT NOT NULL, -- 'YYYY-MM-DD', sitter-entered (defaults to today in the UI)
+  Note TEXT,
+  CreatedAt TEXT NOT NULL DEFAULT (datetime('now'))
+);
+CREATE INDEX IF NOT EXISTS idx_Payments_Tenant_Date ON Payments (TenantId, PaidDate);
+CREATE INDEX IF NOT EXISTS idx_Payments_Tenant_Booking ON Payments (TenantId, BookingRequestId);
+```
+
+Follows the Model A invariant (TenantId on every table). `PaidDate` is a
+plain date the sitter types/accepts, not a server timestamp — payments are
+often recorded days after they happen, and monthly grouping should follow
+the sitter's stated date, not insertion time.
+
+### 2. Repo layer (`server/db/repo.ts`)
+
+New functions, all tenant-scoped like every existing query:
+
+- `insertPayment(db, { tenantId, bookingRequestId, amount, method, paidDate, note })`
+  — inserts iff the booking exists for this tenant, is not `ServiceType='blocked'`,
+  and is not cancelled. A plain `INSERT` has no `WHERE`, so this is an
+  `INSERT INTO Payments (...) SELECT ... FROM BookingRequests WHERE
+TenantId = ? AND Id = ? AND ServiceType != 'blocked' AND Status != 'cancelled'`
+  — a new idiom for `repo.ts` (no existing guarded insert to copy), atomic
+  like `updateBookingStatus`'s `UPDATE ... WHERE` guard. Returns whether a
+  row was inserted (`meta.changes`). `pending` bookings are **deliberately
+  allowed** — deposits are commonly collected before a booking is
+  confirmed. Note the outstanding table only lists confirmed bookings, so a
+  deposit on a pending booking won't appear there until confirmation.
+- `deletePayment(db, tenantId, bookingRequestId, paymentId)` — the `WHERE`
+  includes `BookingRequestId = ?` so a payment id paired with the wrong
+  booking id in the URL 404s instead of silently deleting. Deliberately has
+  **no status guard** (works on cancelled bookings too) — deleting the
+  record is the only correction mechanism for refunds (see Non-goals).
+  Returns whether a row changed (route 404s on false, the existing idiom).
+- `listPaymentsForBooking(db, tenantId, bookingRequestId)` — the individual
+  payment rows for one booking (date/amount/method/note), for the
+  payment-list UI below.
+- `listBookingsForTenant` (existing) gains a `PaidTotal` aggregate via
+  `LEFT JOIN (SELECT BookingRequestId, SUM(Amount) ...)` — one query, no
+  N+1.
+- `getAnalytics(db, tenantId)` — runs the four aggregate queries and
+  returns one object:
+  - **monthly**: `SELECT substr(PaidDate,1,7) AS Month, SUM(Amount) ... GROUP BY Month`
+    over the last 12 months (missing months filled to 0 in JS).
+  - **byService**: payments joined to `BookingRequests.ServiceType`, joined
+    to `TenantServices.Label` for display names, `GROUP BY ServiceType`,
+    all-time. Services deleted since payment keep the raw slug as label
+    (LEFT JOIN, `COALESCE(Label, ServiceType)`).
+  - **topClients**: payments joined through bookings to `EndUsers`,
+    `GROUP BY EndUserId`, `SUM(Amount)` + `COUNT(DISTINCT BookingRequestId)`,
+    ordered by total desc, `LIMIT 10`.
+  - **outstanding**: confirmed bookings where
+    `COALESCE(paid.Total, 0) < EstCost`, with customer name/email, EstCost,
+    paid total, ordered by balance desc. Rows with `EstCost IS NULL` are
+    excluded — a booking with no estimate can't have a computable balance.
+  - **tiles**: this-month / last-month revenue derived from **monthly** in
+    JS; outstanding total + count derived from **outstanding** in JS. No
+    extra queries.
+
+### 3. Admin routes (`server/routes/admin.ts`)
+
+Added to the existing chained Hono app (same `adminAuth` + tenant middleware
+stack as every other `/:slug/admin/*` route):
+
+- `GET /:slug/admin/analytics` — returns `getAnalytics` payload verbatim.
+- `GET /:slug/admin/bookings` (existing) — its response-mapping object
+  (`server/routes/admin.ts:~746`, the `status: r.Declined ? 'declined' :
+r.Status` block) gains `paidTotal: r.PaidTotal ?? 0` so the repo-layer
+  join actually reaches the client.
+- `POST /:slug/admin/bookings/:id/payments` — body
+  `{ amount, method, paidDate, note? }`. Validates: amount via the existing
+  `isValidRate` (whole dollars ≥ 1, `server/lib/services.ts`), method is
+  one of the allowed set, paidDate via the existing `isRealDate`
+  (`server/lib/validation.ts` — a bare `YYYY-MM-DD` regex accepts
+  2026-02-30, which would corrupt monthly bucketing). 404 if
+  `insertPayment` refuses (wrong tenant / blocked / cancelled). Returns the
+  created payment plus the booking's new paid total.
+- `DELETE /:slug/admin/bookings/:id/payments/:paymentId` — passes both ids
+  to `deletePayment`; 404 if nothing deleted (including a payment/booking
+  mismatch).
+- `GET /:slug/admin/bookings/:id/payments` — the individual payment rows
+  for one booking, backing the payment-list UI.
+
+No KV caching on the analytics endpoint — it's a handful of indexed
+aggregates over a prototype-scale D1; add caching only if it measurably
+drags.
+
+### 4. Frontend
+
+- **`app/admin/sections/EarningsSection.tsx`** (new) — fetches
+  `adminApi.analytics.get` on mount; renders stat tiles, the 12-month SVG
+  bar chart, by-service horizontal bars, top-clients table, and the
+  outstanding table with an inline record-payment form (amount, method
+  select, date defaulting to today, note). Recording a payment re-fetches
+  the payload. Empty states ("No payments recorded yet") for a brand-new
+  tenant. Because `byService`/`topClients` are all-time while the chart is
+  12 months, those two widgets are labeled "(all-time)".
+- **`app/admin/sections/BookingsSection.tsx`** — each non-blocked,
+  non-cancelled booking row additionally shows `paid $X of $Y` from the new
+  `paidTotal` field (`paid in full` once `paidTotal >= EstCost`, covering
+  overpayment/tips), plus a "Payments" action that expands an inline panel:
+  the booking's individual payment rows (date, amount, method, note) each
+  with a delete button, and the record-payment form beneath. Both record
+  and delete re-fetch the bookings list, mirroring the existing
+  `setStatus → reload` pattern in this file. The panel is a shared
+  component — **`app/admin/PaymentsPanel.tsx`** (list + form + delete) —
+  also used by EarningsSection's outstanding table (which re-fetches the
+  analytics payload instead). `app/admin/` currently only holds `App.tsx`;
+  a shared non-section component at that level is a new-but-consistent
+  placement.
+- **`app/shared-ui/api.ts`** — `AnalyticsPayload`, `Payment` types;
+  `adminApi.analytics.get` and `adminApi.payments.list/record/remove`;
+  `AdminBooking` gains `paidTotal`.
+- **`app/admin/App.tsx`** — `'earnings'` added to the `SectionKey` union,
+  `SECTIONS` array, and the `panels` record. Icon: reuse an existing
+  component from `app/shared-ui/icons.tsx` or add a new one there (icons do
+  not live in `App.tsx`; they're imported).
+- Charts follow the admin app's existing visual language (accent color from
+  tenant settings where the UI already does that); axis labels are plain
+  text, no interactivity.
+
+## Error handling
+
+- Payment validation failures → 400 with a message, same shape as existing
+  admin validation errors.
+- Recording against a cancelled/blocked/foreign booking → 404 (repo guard
+  returns null/false), matching the "row didn't change → not found" idiom.
+- Analytics endpoint has no partial-failure mode: it's read-only SELECTs;
+  any D1 error surfaces as the standard 500.
+- Frontend: sections don't render their own errors — they call the
+  `handleError` prop that funnels into `App.tsx`'s single app-level error
+  banner (`App.tsx:499`). EarningsSection does the same.
+
+## Testing
+
+Per-concern test files, mirroring the existing convention:
+
+- `server/__tests__/payments-repo.test.ts` — `insertPayment` guards
+  (cancelled booking refused, blocked row refused, cross-tenant refused,
+  pending booking _allowed_, happy path), `deletePayment` tenant scoping
+  and booking/payment-mismatch refusal (and that it works on a cancelled
+  booking), `listPaymentsForBooking`, paid-total aggregation on
+  `listBookingsForTenant`.
+- `server/__tests__/analytics.test.ts` — seed a tenant with bookings +
+  payments and assert each aggregate: monthly buckets (including
+  zero-filled months), by-service totals (including a deleted-service slug
+  fallback), top-client ordering and booking counts, outstanding math
+  (partial payment → correct balance; EstCost NULL excluded; fully-paid
+  excluded; cancelled excluded), and route-level validation (bad amount,
+  bad method, bad date → 400; foreign booking → 404).
+- No dedicated migration test: the repo only writes those for table-rebuild
+  migrations (0002/0003/0006); pure additive `CREATE TABLE` migrations
+  (0004, this one) rely on repo/route tests exercising the new table.
diff --git a/migrations/0006_custom_services.sql b/migrations/0006_custom_services.sql
new file mode 100644
index 0000000..01773db
--- /dev/null
+++ b/migrations/0006_custom_services.sql
@@ -0,0 +1,124 @@
+-- Custom services: TenantServices becomes the authoritative, agnostic Service store.
+-- Each row carries its own behavior (previously hardcoded per-type in SERVICE_CATALOG), the
+-- ServiceType CHECK enums are dropped from all three tables so ServiceType is a per-tenant slug,
+-- and every tenant gets rows for the five built-in templates (rows, not code, are the list now).
+-- See docs/superpowers/specs/2026-07-07-custom-services-design.md.
+-- Apply with:
+--   npx wrangler d1 execute pawbook-db --local  --file ./migrations/0006_custom_services.sql
+--   npx wrangler d1 execute pawbook-db --remote --file ./migrations/0006_custom_services.sql
+-- D1 runs a file inside a transaction where `PRAGMA foreign_keys` is a no-op; defer_foreign_keys
+-- is its supported escape hatch — FKs are re-checked at COMMIT, when the renamed tables are back.
+PRAGMA defer_foreign_keys = true;
+
+-- 0) Canonical template behavior — one definition, used to both backfill existing rows (1) and
+--    seed missing ones (2), instead of two independently hand-typed encodings that could drift.
+CREATE TEMP TABLE _service_templates (
+  ServiceType TEXT PRIMARY KEY,
+  Label TEXT NOT NULL,
+  Icon TEXT NOT NULL,
+  Shape TEXT NOT NULL,
+  RateUnit TEXT NOT NULL,
+  HasDuration INTEGER NOT NULL,
+  CapacityKind TEXT NOT NULL,
+  SortOrder INTEGER NOT NULL
+);
+INSERT INTO _service_templates
+  (ServiceType, Label, Icon, Shape, RateUnit, HasDuration, CapacityKind, SortOrder)
+VALUES
+  ('boarding', 'Boarding', 'bed', 'range', 'night', 0, 'boarding', 0),
+  ('housesitting', 'House sitting', 'home', 'range', 'night', 0, 'housesit', 1),
+  ('daycare', 'Day care', 'sun', 'single', 'day', 0, 'none', 2),
+  ('walk', 'Walks', 'paw', 'single', 'visit', 1, 'none', 3),
+  ('checkin', 'Check-ins', 'clipboard', 'single', 'visit', 1, 'none', 4);
+
+-- 1) Rebuild TenantServices with behavior columns, backfilled from _service_templates. The old
+--    ServiceType CHECK constrained every existing row to these 5 slugs, so the JOIN is exhaustive.
+CREATE TABLE TenantServices_new (
+  TenantId TEXT NOT NULL REFERENCES Tenants(Id),
+  ServiceType TEXT NOT NULL,
+  Enabled INTEGER NOT NULL DEFAULT 1,
+  Label TEXT NOT NULL,
+  Icon TEXT NOT NULL DEFAULT 'paw',
+  Shape TEXT NOT NULL CHECK (Shape IN ('range', 'single')),
+  RateUnit TEXT NOT NULL CHECK (RateUnit IN ('night', 'day', 'visit')),
+  HasDuration INTEGER NOT NULL DEFAULT 0,
+  -- Which capacity POOL the service draws from (not the service's name): 'boarding' = pet-counted
+  -- vs Tenants.MaxBoardingPets, 'housesit' = day-counted vs MaxHouseSitsPerDay, 'none' = unlimited.
+  CapacityKind TEXT NOT NULL DEFAULT 'none' CHECK (CapacityKind IN ('boarding', 'housesit', 'none')),
+  SortOrder INTEGER NOT NULL DEFAULT 0,
+  Questions TEXT NOT NULL DEFAULT '[]',
+  MinNights INTEGER,
+  MaxNights INTEGER,
+  MinPetCount INTEGER,
+  MaxPetCount INTEGER,
+  UNIQUE (TenantId, ServiceType)
+);
+
+INSERT INTO TenantServices_new
+  (TenantId, ServiceType, Enabled, Label, Icon, Shape, RateUnit, HasDuration, CapacityKind, SortOrder,
+   Questions, MinNights, MaxNights, MinPetCount, MaxPetCount)
+SELECT
+  ts.TenantId, ts.ServiceType, ts.Enabled, tpl.Label, tpl.Icon, tpl.Shape, tpl.RateUnit,
+  tpl.HasDuration, tpl.CapacityKind, tpl.SortOrder,
+  ts.Questions, ts.MinNights, ts.MaxNights, ts.MinPetCount, ts.MaxPetCount
+FROM TenantServices ts
+JOIN _service_templates tpl ON tpl.ServiceType = ts.ServiceType;
+
+DROP TABLE TenantServices;
+ALTER TABLE TenantServices_new RENAME TO TenantServices;
+
+-- 2) Every tenant gets a (disabled) row for each built-in template it doesn't already have,
+--    so the row set — not code — defines the tenant's service list from now on.
+INSERT OR IGNORE INTO TenantServices
+  (TenantId, ServiceType, Enabled, Label, Icon, Shape, RateUnit, HasDuration, CapacityKind, SortOrder)
+SELECT t.Id, tpl.ServiceType, 0, tpl.Label, tpl.Icon, tpl.Shape, tpl.RateUnit, tpl.HasDuration, tpl.CapacityKind, tpl.SortOrder
+FROM Tenants t
+CROSS JOIN _service_templates tpl;
+
+DROP TABLE _service_templates;
+
+-- 3) Rebuild TenantServiceOptions without the ServiceType CHECK (RateUnit CHECK kept).
+CREATE TABLE TenantServiceOptions_new (
+  Id TEXT PRIMARY KEY,
+  TenantId TEXT NOT NULL REFERENCES Tenants(Id),
+  ServiceType TEXT NOT NULL,
+  OptionKey TEXT NOT NULL,
+  Label TEXT NOT NULL,
+  DurationMinutes INTEGER,
+  Rate INTEGER NOT NULL,
+  RateUnit TEXT NOT NULL CHECK (RateUnit IN ('night', 'day', 'visit')),
+  UNIQUE (TenantId, ServiceType, OptionKey)
+);
+INSERT INTO TenantServiceOptions_new
+SELECT Id, TenantId, ServiceType, OptionKey, Label, DurationMinutes, Rate, RateUnit
+FROM TenantServiceOptions;
+DROP TABLE TenantServiceOptions;
+ALTER TABLE TenantServiceOptions_new RENAME TO TenantServiceOptions;
+
+-- 4) Rebuild BookingRequests without the ServiceType CHECK ('blocked' stays a reserved slug).
+CREATE TABLE BookingRequests_new (
+  Id TEXT PRIMARY KEY,
+  TenantId TEXT NOT NULL REFERENCES Tenants(Id),
+  EndUserId TEXT REFERENCES EndUsers(Id),
+  ServiceType TEXT NOT NULL,
+  StartDate TEXT NOT NULL,
+  EndDate TEXT,
+  OptionKey TEXT,
+  PetType TEXT,
+  PetCount INTEGER NOT NULL DEFAULT 1,
+  StartTime TEXT,
+  GCalEventId TEXT,
+  EstCost INTEGER,
+  Answers TEXT NOT NULL DEFAULT '{}',
+  Status TEXT NOT NULL DEFAULT 'pending' CHECK (Status IN ('pending', 'confirmed', 'cancelled')),
+  CreatedAt TEXT NOT NULL DEFAULT (datetime('now'))
+);
+INSERT INTO BookingRequests_new
+SELECT Id, TenantId, EndUserId, ServiceType, StartDate, EndDate, OptionKey, PetType, PetCount,
+       StartTime, GCalEventId, EstCost, Answers, Status, CreatedAt
+FROM BookingRequests;
+DROP TABLE BookingRequests;
+ALTER TABLE BookingRequests_new RENAME TO BookingRequests;
+CREATE INDEX IF NOT EXISTS idx_BookingRequests_Tenant_Dates ON BookingRequests (TenantId, StartDate);
+CREATE INDEX IF NOT EXISTS idx_BookingRequests_Tenant_User ON BookingRequests (TenantId, EndUserId);
+PRAGMA defer_foreign_keys = false;
diff --git a/migrations/0007_booking_lifecycle.sql b/migrations/0007_booking_lifecycle.sql
new file mode 100644
index 0000000..ab0259d
--- /dev/null
+++ b/migrations/0007_booking_lifecycle.sql
@@ -0,0 +1,9 @@
+-- Sitter confirm/decline dashboard: a pending request the sitter declines is stored as
+-- Status='cancelled' + this flag (Status stays a 3-value CHECK; SQLite can't widen a CHECK
+-- without a full table rebuild). See
+-- docs/superpowers/specs/2026-07-10-sitter-booking-dashboard-design.md.
+-- Run against provisioned DBs (local then remote):
+--   npx wrangler d1 execute pawbook-db --local  --file ./migrations/0007_booking_lifecycle.sql
+--   npx wrangler d1 execute pawbook-db --remote --file ./migrations/0007_booking_lifecycle.sql
+
+ALTER TABLE BookingRequests ADD COLUMN Declined INTEGER NOT NULL DEFAULT 0;
diff --git a/migrations/0008_contact_and_notes.sql b/migrations/0008_contact_and_notes.sql
deleted file mode 100644
index 8e321c6..0000000
--- a/migrations/0008_contact_and_notes.sql
+++ /dev/null
@@ -1,9 +0,0 @@
--- UX round: business contact info, client phone, pet care notes, and a distinct
--- "declined" marker for booking requests (kept as a flag beside the Status enum —
--- widening the Status CHECK would need a full table rebuild).
--- ponytail: fold Declined into Status if BookingRequests ever needs a rebuild migration anyway.
-ALTER TABLE Tenants ADD COLUMN ContactEmail TEXT;
-ALTER TABLE Tenants ADD COLUMN ContactPhone TEXT;
-ALTER TABLE EndUsers ADD COLUMN Phone TEXT;
-ALTER TABLE EndUserPets ADD COLUMN Notes TEXT;
-ALTER TABLE BookingRequests ADD COLUMN Declined INTEGER NOT NULL DEFAULT 0;
diff --git a/migrations/0008_payments.sql b/migrations/0008_payments.sql
new file mode 100644
index 0000000..db6c9fb
--- /dev/null
+++ b/migrations/0008_payments.sql
@@ -0,0 +1,21 @@
+-- Earnings analytics: real payment records against bookings. Multiple rows per booking
+-- (deposits/partial payments); amounts are whole dollars matching EstCost/Rate. PaidDate is
+-- sitter-entered (payments are often recorded days late; monthly grouping follows the sitter's
+-- stated date, not insertion time). See
+-- docs/superpowers/specs/2026-07-11-earnings-analytics-design.md.
+-- Run against provisioned DBs (local then remote):
+--   npx wrangler d1 execute pawbook-db --local  --file ./migrations/0008_payments.sql
+--   npx wrangler d1 execute pawbook-db --remote --file ./migrations/0008_payments.sql
+
+CREATE TABLE IF NOT EXISTS Payments (
+  Id TEXT PRIMARY KEY,
+  TenantId TEXT NOT NULL REFERENCES Tenants(Id),
+  BookingRequestId TEXT NOT NULL REFERENCES BookingRequests(Id),
+  Amount INTEGER NOT NULL CHECK (Amount > 0), -- whole dollars, matching EstCost/Rate
+  Method TEXT NOT NULL CHECK (Method IN ('cash', 'venmo', 'zelle', 'paypal', 'check', 'card', 'other')),
+  PaidDate TEXT NOT NULL, -- 'YYYY-MM-DD', sitter-entered (defaults to today in the UI)
+  Note TEXT,
+  CreatedAt TEXT NOT NULL DEFAULT (datetime('now'))
+);
+CREATE INDEX IF NOT EXISTS idx_Payments_Tenant_Date ON Payments (TenantId, PaidDate);
+CREATE INDEX IF NOT EXISTS idx_Payments_Tenant_Booking ON Payments (TenantId, BookingRequestId);
diff --git a/migrations/0006_service_slots.sql b/migrations/0009_service_slots.sql
similarity index 100%
rename from migrations/0006_service_slots.sql
rename to migrations/0009_service_slots.sql
diff --git a/migrations/0007_slot_index.sql b/migrations/0010_slot_index.sql
similarity index 100%
rename from migrations/0007_slot_index.sql
rename to migrations/0010_slot_index.sql
diff --git a/migrations/0011_contact_and_notes.sql b/migrations/0011_contact_and_notes.sql
new file mode 100644
index 0000000..b8beeb9
--- /dev/null
+++ b/migrations/0011_contact_and_notes.sql
@@ -0,0 +1,6 @@
+-- UX round: business contact info, client phone, pet care notes.
+-- Declined already added by 0007_booking_lifecycle.sql (custom-services lineage); not repeated here.
+ALTER TABLE Tenants ADD COLUMN ContactEmail TEXT;
+ALTER TABLE Tenants ADD COLUMN ContactPhone TEXT;
+ALTER TABLE EndUsers ADD COLUMN Phone TEXT;
+ALTER TABLE EndUserPets ADD COLUMN Notes TEXT;
diff --git a/migrations/README.md b/migrations/README.md
index a0bc0ae..49e1bc2 100644
--- a/migrations/README.md
+++ b/migrations/README.md
@@ -4,7 +4,7 @@
 
 Fresh databases are provisioned from `sql/schema.sql` + `sql/seed.sql`, **not** from this
 directory — `sql/schema.sql` is the canonical DDL and already includes everything through
-`0007_slot_index.sql`. Use:
+`0011_contact_and_notes.sql`. Use:
 
 ```
 npm run seed:local   # wrangler d1 execute pawbook-db --local  --file=./sql/schema.sql && ...seed.sql
@@ -15,54 +15,36 @@ Do **not** run `migrate:local` / `migrate:remote` (`wrangler d1 migrations apply
 freshly-seeded DB — the tables already exist (from schema.sql), so replaying these files would
 fail or duplicate work.
 
-## Existing/already-provisioned DBs — READ BEFORE RUNNING `migrate:*`
+## Existing/already-provisioned DBs
 
-Every DB that was ever provisioned before wrangler's migration tracking was introduced (i.e.
-any real DB in use today) had `0001`–`0007` applied manually via `wrangler d1 execute ... --file`.
-None of those runs went through `wrangler d1 migrations apply`, so **no `d1_migrations` tracking
-table exists on any real DB**, and wrangler doesn't know these seven migrations were already
-applied.
+No real DB in this project has ever gone through `wrangler d1 migrations apply` — every
+migration to date has been applied manually via `wrangler d1 execute ... --file`, so **no
+`d1_migrations` tracking table exists on any real DB**. `main`'s `migrate:local`/`migrate:remote`
+npm scripts exist but aren't the established convention here; this merge doesn't change that —
+keep applying new migration files manually with `d1 execute --file` until a deliberate decision
+is made to adopt tracked migrations.
 
-If you run `npm run migrate:local` / `migrate:remote` on one of these DBs without baselining
-first, wrangler will try to apply `0001_add_login_codes_attempts.sql` from scratch and fail
-(the `Attempts` column already exists) — and if that failure is ever worked around, `0002` is
-**data-destructive on re-run** (see the warning below). **Never run `migrate:remote` before
-baselining.**
+State as of this merge:
 
-### Baselining procedure (run once, per DB, before ever running `migrate:*`)
+- **Local dev DB**: has `0001`–`0008` applied (custom-services numbering — `0006_custom_services.sql`
+  through `0008_payments.sql`). Needs `0009_service_slots.sql`, `0010_slot_index.sql`,
+  `0011_contact_and_notes.sql` applied next, in that order.
+- **Remote DB**: has `0001`–`0005` applied. Needs the full `0006`–`0011` run, in order, at next
+  deploy — none of the custom-services, booking-lifecycle, payments, service-slots, slot-index,
+  or contact/notes migrations have reached it yet.
 
-Create wrangler's tracking table and mark `0001`–`0007` as already applied, without actually
-executing their statements again:
+Apply with, e.g.:
 
-```sql
-CREATE TABLE IF NOT EXISTS d1_migrations (
-  id INTEGER PRIMARY KEY AUTOINCREMENT,
-  name TEXT UNIQUE,
-  applied_at TIMESTAMP NOT NULL DEFAULT CURRENT_TIMESTAMP
-);
-
-INSERT INTO d1_migrations (name) VALUES ('0001_add_login_codes_attempts.sql');
-INSERT INTO d1_migrations (name) VALUES ('0002_tenant_config_limits.sql');
-INSERT INTO d1_migrations (name) VALUES ('0003_calendar_oauth_and_invites.sql');
-INSERT INTO d1_migrations (name) VALUES ('0004_customer_pets.sql');
-INSERT INTO d1_migrations (name) VALUES ('0005_service_rules.sql');
-INSERT INTO d1_migrations (name) VALUES ('0006_service_slots.sql');
-INSERT INTO d1_migrations (name) VALUES ('0007_slot_index.sql');
 ```
-
-Run this against `--local` and/or `--remote` with `wrangler d1 execute pawbook-db <flag> --command "..."`
-(or save it to a `.sql` file and use `--file`) for whichever environment you're baselining.
-Verify the filenames above against the current contents of this directory before running —
-if new migration files have been added since this README was written, extend the list to
-match (`ls migrations/`).
-
-Once baselined, `migrate:local` / `migrate:remote` will only apply migrations numbered after
-`0007`, which is the intended, safe use of those scripts going forward.
+npx wrangler d1 execute pawbook-db --local  --file=./migrations/0009_service_slots.sql
+npx wrangler d1 execute pawbook-db --local  --file=./migrations/0010_slot_index.sql
+npx wrangler d1 execute pawbook-db --local  --file=./migrations/0011_contact_and_notes.sql
+```
 
 ### ⚠️ `0002_tenant_config_limits.sql` is DATA-DESTRUCTIVE if ever re-run against a live DB
 
 It rebuilds the `Tenants` table, copying forward only 6 columns (`Id`, `Slug`, `DisplayName`,
 `AccentColor`, `MaxBoardingPets`, `CreatedAt`). Re-running it against a DB that already has real
 data in `MaxHouseSitsPerDay`, `MaxStayNights`, or `Timezone` **wipes those columns back to
-NULL** for every tenant. This is exactly what baselining (above) prevents — do the baseline
-INSERTs, never a real replay of `0002`, against any DB that already has this schema.
+NULL** for every tenant. Never re-run an already-applied migration against a live DB — write a
+new one instead.
diff --git a/public/clients-import-example.csv b/public/clients-import-example.csv
new file mode 100644
index 0000000..a9f39eb
--- /dev/null
+++ b/public/clients-import-example.csv
@@ -0,0 +1,5 @@
+Client Email,Client Name,Pet Name,Pet Type
+jess@example.com,Jess Nguyen,Bella,dog
+jess@example.com,Jess Nguyen,Mochi,cat
+sam@example.com,Sam Diaz,Rex,dog
+team@example.com,Team Co,,
diff --git a/server/__tests__/admin-bookings.test.ts b/server/__tests__/admin-bookings.test.ts
index 2c937a0..7777f4a 100644
--- a/server/__tests__/admin-bookings.test.ts
+++ b/server/__tests__/admin-bookings.test.ts
@@ -1,5 +1,6 @@
-import { describe, expect, it } from 'vitest';
+import { describe, expect, it, vi } from 'vitest';
 import app from '../index';
+import { insertBookingRequest } from '../db/repo';
 import { adminHeaders, createTestEnv, endUserToken, TENANT_A, TENANT_B } from './helpers';
 
 /** Books one dog (Bella, sunny-paws) for a 2-night boarding stay via the real customer flow. */
@@ -46,6 +47,20 @@ describe('admin booking lifecycle', () => {
     expect(bookings.some((b) => b.type === 'blocked')).toBe(false);
   });
 
+  it('404s for an unknown booking id', async () => {
+    const { env } = createTestEnv();
+    const res = await app.request(
+      '/api/sunny-paws/admin/bookings/nope/status',
+      {
+        method: 'POST',
+        headers: { ...(await adminHeaders(TENANT_A)), 'Content-Type': 'application/json' },
+        body: JSON.stringify({ status: 'confirmed' }),
+      },
+      env,
+    );
+    expect(res.status).toBe(404);
+  });
+
   it('POST confirm moves pending -> confirmed, reflected on the next GET', async () => {
     const { env } = createTestEnv();
     const created = (await (await bookBoarding(env, '2028-10-05', '2028-10-07')).json()) as {
@@ -127,6 +142,34 @@ describe('admin booking lifecycle', () => {
     expect(again.status).toBe(404);
   });
 
+  it('cancelling a booking never calls out to Google Calendar (no event delete/update on cancel)', async () => {
+    const { env } = createTestEnv();
+    const id = await insertBookingRequest(env.PAWBOOK_DB, TENANT_A, {
+      endUserId: null,
+      serviceType: 'boarding',
+      startDate: '2030-06-01',
+      endDate: '2030-06-03',
+      optionKey: 'standard',
+      petType: 'dog',
+      petCount: 1,
+      estCost: 100,
+      status: 'confirmed',
+    });
+    const spy = vi.spyOn(globalThis, 'fetch');
+    const res = await app.request(
+      `/api/sunny-paws/admin/bookings/${id}/status`,
+      {
+        method: 'POST',
+        headers: { ...(await adminHeaders(TENANT_A)), 'Content-Type': 'application/json' },
+        body: JSON.stringify({ status: 'cancelled' }),
+      },
+      env,
+    );
+    expect(res.status).toBe(200);
+    expect(spy).not.toHaveBeenCalled();
+    spy.mockRestore();
+  });
+
   it('POST with a bad status value is rejected with 400', async () => {
     const { env } = createTestEnv();
     const created = (await (await bookBoarding(env, '2028-10-12', '2028-10-14')).json()) as {
diff --git a/server/__tests__/analytics.test.ts b/server/__tests__/analytics.test.ts
new file mode 100644
index 0000000..9be5229
--- /dev/null
+++ b/server/__tests__/analytics.test.ts
@@ -0,0 +1,262 @@
+import { describe, expect, it } from 'vitest';
+import {
+  getAnalytics,
+  insertBookingRequest,
+  insertInvitedCustomer,
+  insertPayment,
+  updateBookingStatus,
+} from '../db/repo';
+import { createTestEnv, TENANT_A, TENANT_B } from './helpers';
+import app from '../index';
+import { getPacificDateStr } from '../../src/shared/index.js';
+import { adminHeaders } from './helpers';
+
+// Seeded clean-slate tenant (sql/seed.sql): has customers but NO bookings, so outstanding
+// assertions can be exact. TENANT_A/B each carry a seeded confirmed unpaid booking.
+const TENANT_C = 'tnt_pawsandrelax';
+
+// Fixed anchor for repo-level tests — the 12-month window is 2025-08 .. 2026-07.
+const TODAY = '2026-07-15';
+
+const makeBooking = (
+  env: Env,
+  tenantId: string,
+  over: {
+    endUserId?: string | null;
+    serviceType?: string;
+    estCost?: number | null;
+    status?: 'pending' | 'confirmed';
+  } = {},
+) =>
+  insertBookingRequest(env.PAWBOOK_DB, tenantId, {
+    endUserId: over.endUserId ?? null,
+    serviceType: over.serviceType ?? 'boarding',
+    startDate: '2030-01-01',
+    endDate: '2030-01-03',
+    optionKey: 'standard',
+    petType: 'dog',
+    petCount: 1,
+    estCost: over.estCost !== undefined ? over.estCost : 100,
+    status: over.status ?? 'confirmed',
+  });
+
+const pay = (
+  env: Env,
+  tenantId: string,
+  bookingRequestId: string,
+  amount: number,
+  paidDate = '2026-07-01',
+) =>
+  insertPayment(env.PAWBOOK_DB, tenantId, {
+    bookingRequestId,
+    amount,
+    method: 'cash',
+    paidDate,
+    note: null,
+  });
+
+describe('getAnalytics (repo)', () => {
+  it('monthly: 12 zero-filled buckets, oldest first, out-of-window payments excluded', async () => {
+    const { env } = createTestEnv();
+    const b1 = await makeBooking(env, TENANT_A);
+    await pay(env, TENANT_A, b1, 40, '2026-07-01');
+    await pay(env, TENANT_A, b1, 60, '2026-07-20');
+    await pay(env, TENANT_A, b1, 25, '2026-05-10');
+    await pay(env, TENANT_A, b1, 999, '2025-07-31'); // month 2025-07: just outside the window
+    const { monthly } = await getAnalytics(env.PAWBOOK_DB, TENANT_A, TODAY);
+    expect(monthly).toHaveLength(12);
+    expect(monthly[0]).toEqual({ Month: '2025-08', Total: 0 });
+    expect(monthly[11]).toEqual({ Month: '2026-07', Total: 100 });
+    expect(monthly.find((m) => m.Month === '2026-05')).toEqual({ Month: '2026-05', Total: 25 });
+    expect(monthly.find((m) => m.Month === '2025-07')).toBeUndefined();
+    expect(monthly.filter((m) => m.Total === 0)).toHaveLength(10);
+  });
+
+  it('byService: labels from TenantServices, slug fallback for deleted services, ordered by total desc', async () => {
+    const { env } = createTestEnv();
+    const boarding = await makeBooking(env, TENANT_A, { serviceType: 'boarding' });
+    const walk = await makeBooking(env, TENANT_A, { serviceType: 'walk' });
+    const gone = await makeBooking(env, TENANT_A, { serviceType: 'retired-svc' });
+    await pay(env, TENANT_A, boarding, 200);
+    await pay(env, TENANT_A, walk, 35);
+    await pay(env, TENANT_A, gone, 80);
+    const { byService } = await getAnalytics(env.PAWBOOK_DB, TENANT_A, TODAY);
+    expect(byService).toEqual([
+      { ServiceType: 'boarding', Label: 'Boarding', Total: 200 },
+      { ServiceType: 'retired-svc', Label: 'retired-svc', Total: 80 },
+      { ServiceType: 'walk', Label: 'Walks', Total: 35 },
+    ]);
+  });
+
+  it('revenue counts payments on later-cancelled bookings (cash received is real revenue)', async () => {
+    const { env } = createTestEnv();
+    const b1 = await makeBooking(env, TENANT_A);
+    await pay(env, TENANT_A, b1, 150);
+    await updateBookingStatus(env.PAWBOOK_DB, TENANT_A, b1, 'cancelled');
+    const { byService, monthly } = await getAnalytics(env.PAWBOOK_DB, TENANT_A, TODAY);
+    expect(byService).toEqual([{ ServiceType: 'boarding', Label: 'Boarding', Total: 150 }]);
+    expect(monthly[11].Total).toBe(150);
+  });
+
+  it('topClients: ordered by total desc, distinct booking counts, LIMIT 10', async () => {
+    const { env } = createTestEnv();
+    for (let i = 0; i < 12; i++) {
+      const user = await insertInvitedCustomer(
+        env.PAWBOOK_DB,
+        TENANT_C,
+        `client${i}@example.com`,
+        `Client ${i}`,
+      );
+      const bookingId = await makeBooking(env, TENANT_C, { endUserId: user.Id });
+      await pay(env, TENANT_C, bookingId, 10 + i);
+    }
+    const { topClients } = await getAnalytics(env.PAWBOOK_DB, TENANT_C, TODAY);
+    expect(topClients).toHaveLength(10); // clients 0 and 1 ($10, $11) fall off
+    expect(topClients[0]).toMatchObject({ Email: 'client11@example.com', Total: 21, Bookings: 1 });
+    expect(topClients.some((t) => t.Email === 'client0@example.com')).toBe(false);
+    expect(topClients.some((t) => t.Email === 'client1@example.com')).toBe(false);
+  });
+
+  it('topClients: two payments on one booking count as ONE booking; two bookings as two', async () => {
+    const { env } = createTestEnv();
+    // jess@example.com is pre-seeded (eu_pr_jess, 'Jess Demo', active); insertInvitedCustomer is idempotent and keeps the seeded row.
+    const jess = await insertInvitedCustomer(env.PAWBOOK_DB, TENANT_C, 'jess@example.com', 'Jess');
+    const b1 = await makeBooking(env, TENANT_C, { endUserId: jess.Id });
+    const b2 = await makeBooking(env, TENANT_C, { endUserId: jess.Id });
+    await pay(env, TENANT_C, b1, 30);
+    await pay(env, TENANT_C, b1, 20);
+    await pay(env, TENANT_C, b2, 50);
+    const { topClients } = await getAnalytics(env.PAWBOOK_DB, TENANT_C, TODAY);
+    expect(topClients).toEqual([
+      { EndUserId: jess.Id, Name: 'Jess Demo', Email: 'jess@example.com', Total: 100, Bookings: 2 },
+    ]);
+  });
+
+  it('outstanding: partial payments listed with paid totals, ordered by balance desc; paid/overpaid, NULL-EstCost, pending, and cancelled excluded', async () => {
+    const { env } = createTestEnv();
+    const partial = await makeBooking(env, TENANT_C, { estCost: 100 }); // owes 60
+    await pay(env, TENANT_C, partial, 40);
+    const unpaid = await makeBooking(env, TENANT_C, { estCost: 300 }); // owes 300
+    const paidInFull = await makeBooking(env, TENANT_C, { estCost: 100 });
+    await pay(env, TENANT_C, paidInFull, 100);
+    const overpaid = await makeBooking(env, TENANT_C, { estCost: 100 });
+    await pay(env, TENANT_C, overpaid, 120);
+    await makeBooking(env, TENANT_C, { estCost: null }); // no estimate -> no computable balance
+    await makeBooking(env, TENANT_C, { estCost: 500, status: 'pending' }); // not confirmed yet
+    const cancelled = await makeBooking(env, TENANT_C, { estCost: 400 });
+    await updateBookingStatus(env.PAWBOOK_DB, TENANT_C, cancelled, 'cancelled');
+    const { outstanding } = await getAnalytics(env.PAWBOOK_DB, TENANT_C, TODAY);
+    expect(outstanding.map((o) => o.BookingId)).toEqual([unpaid, partial]);
+    expect(outstanding[1]).toMatchObject({ EstCost: 100, PaidTotal: 40 });
+  });
+
+  it('outstanding is tenant-isolated (another tenant sees nothing of TENANT_C)', async () => {
+    const { env } = createTestEnv();
+    await makeBooking(env, TENANT_C, { estCost: 300 });
+    const { outstanding } = await getAnalytics(env.PAWBOOK_DB, TENANT_C, TODAY);
+    expect(outstanding).toHaveLength(1);
+    // TENANT_B's view contains only its own seeded unpaid booking (seed_ht_board1), never C's.
+    const other = await getAnalytics(env.PAWBOOK_DB, TENANT_B, TODAY);
+    expect(other.outstanding.map((o) => o.BookingId)).toEqual(['seed_ht_board1']);
+  });
+});
+
+describe('GET /:slug/admin/analytics (route)', () => {
+  // paws-and-relax has no seeded bookings and a NULL Timezone, so the route's "today"
+  // (getPacificDateStr default) matches what these tests compute.
+  const SLUG_C = 'paws-and-relax';
+
+  const getAnalyticsRoute = async (env: Env) =>
+    app.request(`/api/${SLUG_C}/admin/analytics`, { headers: await adminHeaders(TENANT_C) }, env);
+
+  it('401s without a token', async () => {
+    const { env } = createTestEnv();
+    const res = await app.request(`/api/${SLUG_C}/admin/analytics`, {}, env);
+    expect(res.status).toBe(401);
+  });
+
+  it('returns an all-zero payload for a tenant with no payments', async () => {
+    const { env } = createTestEnv();
+    const res = await getAnalyticsRoute(env);
+    expect(res.status).toBe(200);
+    const body = (await res.json()) as {
+      tiles: {
+        thisMonth: number;
+        lastMonth: number;
+        outstandingTotal: number;
+        outstandingCount: number;
+      };
+      monthly: { month: string; total: number }[];
+      byService: unknown[];
+      topClients: unknown[];
+      outstanding: unknown[];
+    };
+    expect(body.tiles).toEqual({
+      thisMonth: 0,
+      lastMonth: 0,
+      outstandingTotal: 0,
+      outstandingCount: 0,
+    });
+    expect(body.monthly).toHaveLength(12);
+    expect(body.monthly.every((m) => m.total === 0)).toBe(true);
+    expect(body.monthly[11].month).toBe(getPacificDateStr().slice(0, 7));
+    expect(body.byService).toEqual([]);
+    expect(body.topClients).toEqual([]);
+    expect(body.outstanding).toEqual([]);
+  });
+
+  it('derives tiles in JS and maps every aggregate to camelCase', async () => {
+    const { env } = createTestEnv();
+    // jess@example.com is pre-seeded (eu_pr_jess, 'Jess Demo', active); insertInvitedCustomer is idempotent and keeps the seeded row.
+    const jess = await insertInvitedCustomer(env.PAWBOOK_DB, TENANT_C, 'jess@example.com', 'Jess');
+    const bookingId = await makeBooking(env, TENANT_C, { endUserId: jess.Id, estCost: 300 });
+    const today = getPacificDateStr();
+    await pay(env, TENANT_C, bookingId, 100, today);
+    // A payment dated inside LAST month, for the lastMonth tile.
+    const [ty, tm] = today.split('-').map(Number);
+    const prev = new Date(Date.UTC(ty, tm - 2, 15));
+    const lastMonthDate = `${prev.getUTCFullYear()}-${String(prev.getUTCMonth() + 1).padStart(2, '0')}-15`;
+    await pay(env, TENANT_C, bookingId, 60, lastMonthDate);
+    const body = (await (await getAnalyticsRoute(env)).json()) as {
+      tiles: {
+        thisMonth: number;
+        lastMonth: number;
+        outstandingTotal: number;
+        outstandingCount: number;
+      };
+      monthly: { month: string; total: number }[];
+      byService: { serviceType: string; label: string; total: number }[];
+      topClients: {
+        endUserId: string;
+        name: string | null;
+        email: string | null;
+        total: number;
+        bookings: number;
+      }[];
+      outstanding: { bookingId: string; estCost: number; paidTotal: number; balance: number }[];
+    };
+    expect(body.tiles).toEqual({
+      thisMonth: 100,
+      lastMonth: 60,
+      outstandingTotal: 140, // 300 est - 160 paid
+      outstandingCount: 1,
+    });
+    expect(body.monthly[11]).toEqual({ month: today.slice(0, 7), total: 100 });
+    expect(body.byService).toEqual([{ serviceType: 'boarding', label: 'Boarding', total: 160 }]);
+    expect(body.topClients).toEqual([
+      { endUserId: jess.Id, name: 'Jess Demo', email: 'jess@example.com', total: 160, bookings: 1 },
+    ]);
+    expect(body.outstanding).toEqual([
+      {
+        bookingId,
+        name: 'Jess Demo',
+        email: 'jess@example.com',
+        serviceType: 'boarding',
+        startDate: '2030-01-01',
+        estCost: 300,
+        paidTotal: 160,
+        balance: 140,
+      },
+    ]);
+  });
+});
diff --git a/server/__tests__/availability.test.ts b/server/__tests__/availability.test.ts
index bc14359..8280c3e 100644
--- a/server/__tests__/availability.test.ts
+++ b/server/__tests__/availability.test.ts
@@ -2,10 +2,33 @@ import { describe, expect, it } from 'vitest';
 import app from '../index';
 import { countSlotBookings, insertBookingRequest, listSlotBookingCounts } from '../db/repo';
 import { checkAvailability, rowsToCapacityEvents } from '../lib/availability';
-import { SERVICE_CATALOG } from '../lib/services';
-import type { Tenant, TenantServiceOption } from '../types';
+import { SERVICE_TEMPLATES, type TemplateId } from '../lib/services';
+import type { Tenant, TenantService, TenantServiceOption } from '../types';
 import { createTestEnv, TENANT_A } from './helpers';
 
+/** A TenantService row cloned from a built-in template, as the migration/seed produces. */
+function svc(type: TemplateId, over: Partial<TenantService> = {}): TenantService {
+  const tpl = SERVICE_TEMPLATES[type];
+  return {
+    TenantId: TENANT_A,
+    ServiceType: type,
+    Enabled: 1,
+    Label: tpl.label,
+    Icon: tpl.icon,
+    Shape: tpl.shape,
+    RateUnit: tpl.rateUnit,
+    HasDuration: tpl.hasDuration ? 1 : 0,
+    CapacityKind: tpl.capacityKind,
+    SortOrder: 0,
+    Questions: [],
+    MinNights: null,
+    MaxNights: null,
+    MinPetCount: null,
+    MaxPetCount: null,
+    ...over,
+  };
+}
+
 function tenant(over: Partial<Tenant> = {}): Tenant {
   return {
     Id: TENANT_A,
@@ -166,7 +189,9 @@ describe('rowsToCapacityEvents', () => {
         GCalEventId: null,
         EstCost: null,
         Status: 'confirmed',
+        Declined: 0,
         CreatedAt: '',
+        CapacityKind: null,
       },
       {
         Id: '2',
@@ -182,7 +207,9 @@ describe('rowsToCapacityEvents', () => {
         GCalEventId: null,
         EstCost: 100,
         Status: 'pending',
+        Declined: 0,
         CreatedAt: '',
+        CapacityKind: 'boarding',
       },
     ]);
     expect(events[0]).toMatchObject({
@@ -254,7 +281,7 @@ describe('checkAvailability', () => {
   it('single-visit cost is the picked option price (no nights math)', async () => {
     const { env } = createTestEnv();
     const t = tenant();
-    const res = await checkAvailability(env, t, 'walk', opt({ Rate: 35 }), '2028-08-01', '');
+    const res = await checkAvailability(env, t, svc('walk'), opt({ Rate: 35 }), '2028-08-01', '');
     expect(res).toMatchObject({ available: true, estCost: 35 });
   });
 
@@ -268,7 +295,7 @@ describe('checkAvailability', () => {
       Rate: 50,
       RateUnit: 'night',
     });
-    const res = await checkAvailability(env, t, 'boarding', o, '2028-08-10', '2028-08-13', 1);
+    const res = await checkAvailability(env, t, svc('boarding'), o, '2028-08-10', '2028-08-13', 1);
     expect(res).toMatchObject({ available: true, estCost: 150, nights: 3 });
   });
 
@@ -283,9 +310,17 @@ describe('checkAvailability', () => {
       RateUnit: 'night',
     });
     // Seed: 1 pet boarding Jun 20-25. A house-sit Jun 21-23 overlaps boarding on Jun 21 AND 22.
-    const res = await checkAvailability(env, t, 'housesitting', o, '2028-06-21', '2028-06-23', 2);
+    const res = await checkAvailability(
+      env,
+      t,
+      svc('housesitting'),
+      o,
+      '2028-06-21',
+      '2028-06-23',
+      2,
+    );
     expect(res).toMatchObject({ available: false });
-    expect(SERVICE_CATALOG.housesitting.shape).toBe('range');
+    expect(SERVICE_TEMPLATES.housesitting.shape).toBe('range');
   });
 
   it('unlimited tenant (paws-and-relax) accepts overlapping boardings', async () => {
@@ -354,10 +389,10 @@ describe('checkAvailability', () => {
     });
     raw.prepare('UPDATE BookingRequests SET Status = ? WHERE Id = ?').run('cancelled', cancelledId);
 
-    const full = await checkAvailability(env, t, 'walk', slotOption, '2028-09-01', '');
+    const full = await checkAvailability(env, t, svc('walk'), slotOption, '2028-09-01', '');
     expect(full).toMatchObject({ available: false });
 
-    const otherDate = await checkAvailability(env, t, 'walk', slotOption, '2028-09-02', '');
+    const otherDate = await checkAvailability(env, t, svc('walk'), slotOption, '2028-09-02', '');
     expect(otherDate).toMatchObject({ available: true });
   });
 });
diff --git a/server/__tests__/booking-lifecycle-repo.test.ts b/server/__tests__/booking-lifecycle-repo.test.ts
new file mode 100644
index 0000000..f972714
--- /dev/null
+++ b/server/__tests__/booking-lifecycle-repo.test.ts
@@ -0,0 +1,104 @@
+import { describe, expect, it } from 'vitest';
+import {
+  getBookingWithCustomer,
+  insertBookingRequest,
+  listBookingsForTenant,
+  updateBookingStatus,
+} from '../db/repo';
+import { createTestEnv, TENANT_A, TENANT_B } from './helpers';
+
+describe('booking lifecycle repo', () => {
+  it('lists non-blocked bookings for a tenant, excluding other tenants', async () => {
+    const { env } = createTestEnv();
+    const a1 = await insertBookingRequest(env.PAWBOOK_DB, TENANT_A, {
+      endUserId: null,
+      serviceType: 'boarding',
+      startDate: '2030-01-01',
+      endDate: '2030-01-03',
+      optionKey: 'standard',
+      petType: 'dog',
+      petCount: 1,
+      estCost: 100,
+      status: 'pending',
+    });
+    await insertBookingRequest(env.PAWBOOK_DB, TENANT_B, {
+      endUserId: null,
+      serviceType: 'boarding',
+      startDate: '2030-01-02',
+      endDate: '2030-01-04',
+      optionKey: 'standard',
+      petType: 'dog',
+      petCount: 1,
+      estCost: 100,
+      status: 'pending',
+    });
+    const rows = await listBookingsForTenant(env.PAWBOOK_DB, TENANT_A);
+    // Verify tenant isolation: no TENANT_B rows
+    expect(rows.every((r) => r.TenantId === TENANT_A)).toBe(true);
+    // Verify non-blocked filtering: no 'blocked' service types
+    expect(rows.every((r) => r.ServiceType !== 'blocked')).toBe(true);
+    // Verify the created booking is in the list and has Declined=0
+    const createdRow = rows.find((r) => r.Id === a1)!;
+    expect(createdRow).toBeDefined();
+    expect(createdRow.Declined).toBe(0);
+  });
+
+  it('confirms a pending booking, then blocks re-declining it; cancel is terminal', async () => {
+    const { env } = createTestEnv();
+    const id = await insertBookingRequest(env.PAWBOOK_DB, TENANT_A, {
+      endUserId: null,
+      serviceType: 'boarding',
+      startDate: '2030-02-01',
+      endDate: '2030-02-03',
+      optionKey: 'standard',
+      petType: 'dog',
+      petCount: 1,
+      estCost: 100,
+      status: 'pending',
+    });
+    expect(await updateBookingStatus(env.PAWBOOK_DB, TENANT_A, id, 'confirmed')).toBe(true);
+    expect(await updateBookingStatus(env.PAWBOOK_DB, TENANT_A, id, 'declined')).toBe(false);
+    expect(await updateBookingStatus(env.PAWBOOK_DB, TENANT_A, id, 'cancelled')).toBe(true);
+    expect(await updateBookingStatus(env.PAWBOOK_DB, TENANT_A, id, 'confirmed')).toBe(false);
+  });
+
+  it('declining a pending booking sets Status=cancelled and Declined=1', async () => {
+    const { env } = createTestEnv();
+    const id = await insertBookingRequest(env.PAWBOOK_DB, TENANT_A, {
+      endUserId: null,
+      serviceType: 'walk',
+      startDate: '2030-03-01',
+      endDate: null,
+      optionKey: 'd30',
+      petType: 'dog',
+      petCount: 1,
+      estCost: 20,
+      status: 'pending',
+    });
+    expect(await updateBookingStatus(env.PAWBOOK_DB, TENANT_A, id, 'declined')).toBe(true);
+    const row = (await listBookingsForTenant(env.PAWBOOK_DB, TENANT_A)).find((r) => r.Id === id)!;
+    expect(row.Status).toBe('cancelled');
+    expect(row.Declined).toBe(1);
+  });
+
+  it('will not update a booking that belongs to another tenant', async () => {
+    const { env } = createTestEnv();
+    const id = await insertBookingRequest(env.PAWBOOK_DB, TENANT_A, {
+      endUserId: null,
+      serviceType: 'boarding',
+      startDate: '2030-04-01',
+      endDate: '2030-04-03',
+      optionKey: 'standard',
+      petType: 'dog',
+      petCount: 1,
+      estCost: 100,
+      status: 'pending',
+    });
+    expect(await updateBookingStatus(env.PAWBOOK_DB, TENANT_B, id, 'confirmed')).toBe(false);
+  });
+
+  it('getBookingWithCustomer returns null for an unknown id', async () => {
+    const { env } = createTestEnv();
+    expect(await getBookingWithCustomer(env.PAWBOOK_DB, TENANT_A, 'nope')).toBeNull();
+  });
+});
diff --git a/server/__tests__/booking-status-email.test.ts b/server/__tests__/booking-status-email.test.ts
new file mode 100644
index 0000000..69f082e
--- /dev/null
+++ b/server/__tests__/booking-status-email.test.ts
@@ -0,0 +1,48 @@
+import { afterEach, describe, expect, it, vi } from 'vitest';
+import { sendBookingStatusEmail } from '../lib/email';
+
+const env = { RESEND_API_KEY: 'k', RESEND_FROM: 'Pawbook <b@x.com>' } as unknown as Env;
+
+describe('sendBookingStatusEmail', () => {
+  afterEach(() => vi.restoreAllMocks());
+
+  it('posts a status email via Resend with the status word and date range', async () => {
+    const spy = vi
+      .spyOn(globalThis, 'fetch')
+      .mockResolvedValue(new Response('{}', { status: 200 }));
+    await sendBookingStatusEmail(
+      env,
+      'client@example.com',
+      'Sunny Paws',
+      'confirmed',
+      '2030-03-01 – 2030-03-04',
+    );
+    const init = spy.mock.calls[0][1] as RequestInit;
+    const body = JSON.parse(init.body as string);
+    expect(body.to).toBe('client@example.com');
+    expect(body.subject).toBe('Your booking with Sunny Paws was confirmed');
+    expect(body.html).toContain('2030-03-01 – 2030-03-04');
+  });
+
+  it('throws when email is not configured', async () => {
+    await expect(
+      sendBookingStatusEmail({} as Env, 'a@b.c', 'X', 'cancelled', '2030-01-01'),
+    ).rejects.toThrow();
+  });
+
+  it('HTML-escapes the display name', async () => {
+    const spy = vi
+      .spyOn(globalThis, 'fetch')
+      .mockResolvedValue(new Response('{}', { status: 200 }));
+    await sendBookingStatusEmail(
+      env,
+      'client@example.com',
+      '<img src=x onerror=alert(1)>',
+      'declined',
+      '2030-01-01',
+    );
+    const body = JSON.parse((spy.mock.calls[0][1] as RequestInit).body as string);
+    expect(body.html).not.toContain('<img');
+    expect(body.html).toContain('&lt;img');
+  });
+});
diff --git a/server/__tests__/calendar-reconcile.test.ts b/server/__tests__/calendar-reconcile.test.ts
new file mode 100644
index 0000000..ea51f66
--- /dev/null
+++ b/server/__tests__/calendar-reconcile.test.ts
@@ -0,0 +1,222 @@
+import { afterEach, describe, expect, it, vi } from 'vitest';
+import app from '../index';
+import { reconcileBookingsWithCalendar, reconcileIfStale } from '../lib/calendar-sync';
+import { insertBookingRequest, setBookingGCalEventId, setProviderTokens } from '../db/repo';
+import { encryptToken } from '../lib/token-crypto';
+import { addDays, DEFAULT_TIMEZONE, getPacificDateStr } from '../../src/shared/index.js';
+import { adminToken, createTestEnv, TENANT_A, TEST_SECRET } from './helpers';
+import type { Tenant } from '../types';
+
+const tenant = { Id: TENANT_A, Slug: 'sunny-paws', Timezone: null } as Tenant;
+
+// reconcileBookingsWithCalendar's query window is [today-1, today+180) relative to the *real*
+// clock (no fake timers here), so "in window" fixtures must be computed relative to actual today
+// rather than hardcoded — a hardcoded future date eventually ages out of the window.
+const TODAY = getPacificDateStr(new Date(), DEFAULT_TIMEZONE);
+const IN_WINDOW_START = addDays(TODAY, 10);
+const IN_WINDOW_END = addDays(TODAY, 13);
+
+async function connectCalendar(env: Env) {
+  await setProviderTokens(env.PAWBOOK_DB, TENANT_A, 'calendar', 'google-calendar', {
+    access: await encryptToken(TEST_SECRET, 'access-1'),
+    refresh: await encryptToken(TEST_SECRET, 'refresh-1'),
+    expiresAt: '2030-01-01T00:00:00Z', // far future — no refresh-token fetch needed
+    calendarId: 'primary',
+  });
+}
+
+function calendarListResponse(bookingIds: string[]) {
+  return new Response(
+    JSON.stringify({
+      items: bookingIds.map((id) => ({
+        summary: 'Boarding',
+        start: { date: IN_WINDOW_START },
+        end: { date: IN_WINDOW_END },
+        extendedProperties: { private: { pawbook: 'true', category: 'boarding', bookingId: id } },
+      })),
+    }),
+    { status: 200 },
+  );
+}
+
+async function seedSyncedBooking(
+  env: Env,
+  dates: { startDate: string; endDate: string } = {
+    startDate: IN_WINDOW_START,
+    endDate: IN_WINDOW_END,
+  },
+): Promise<string> {
+  const id = await insertBookingRequest(env.PAWBOOK_DB, TENANT_A, {
+    endUserId: null,
+    serviceType: 'boarding',
+    startDate: dates.startDate,
+    endDate: dates.endDate,
+    optionKey: 'standard',
+    petType: 'dog',
+    petCount: 1,
+    estCost: 150,
+    status: 'confirmed',
+  });
+  await setBookingGCalEventId(env.PAWBOOK_DB, TENANT_A, id, 'evt_1');
+  return id;
+}
+
+async function statusOf(env: Env, id: string): Promise<string> {
+  const row = await env.PAWBOOK_DB.prepare('SELECT Status FROM BookingRequests WHERE Id = ?')
+    .bind(id)
+    .first<{ Status: string }>();
+  return row!.Status;
+}
+
+async function bookingRow(
+  env: Env,
+  id: string,
+): Promise<{ Status: string; StartDate: string; EndDate: string | null }> {
+  const row = await env.PAWBOOK_DB.prepare(
+    'SELECT Status, StartDate, EndDate FROM BookingRequests WHERE Id = ?',
+  )
+    .bind(id)
+    .first<{ Status: string; StartDate: string; EndDate: string | null }>();
+  return row!;
+}
+
+describe('reconcileBookingsWithCalendar', () => {
+  afterEach(() => vi.restoreAllMocks());
+
+  it('cancels a synced booking whose event is missing from Calendar', async () => {
+    const { env } = createTestEnv();
+    await connectCalendar(env);
+    const id = await seedSyncedBooking(env);
+    vi.spyOn(globalThis, 'fetch').mockResolvedValue(calendarListResponse([])); // event deleted
+    await reconcileBookingsWithCalendar(env, tenant);
+    expect(await statusOf(env, id)).toBe('cancelled');
+  });
+
+  it('leaves a booking untouched when its event is still present', async () => {
+    const { env } = createTestEnv();
+    await connectCalendar(env);
+    const id = await seedSyncedBooking(env);
+    vi.spyOn(globalThis, 'fetch').mockResolvedValue(calendarListResponse([id]));
+    await reconcileBookingsWithCalendar(env, tenant);
+    expect(await statusOf(env, id)).toBe('confirmed');
+  });
+
+  it('no-ops when no calendar is connected', async () => {
+    const { env } = createTestEnv();
+    const spy = vi.spyOn(globalThis, 'fetch');
+    await reconcileBookingsWithCalendar(env, tenant);
+    expect(spy).not.toHaveBeenCalled();
+  });
+
+  it('throws instead of silently reconciling when the Calendar response is truncated, leaving the booking untouched', async () => {
+    const { env } = createTestEnv();
+    await connectCalendar(env);
+    const id = await seedSyncedBooking(env);
+    // Simulates a calendar with >2500 events in range: the booking's event would be missing from
+    // this (first) page, but listCalendarEvents throws instead of returning an incomplete list —
+    // so reconcileBookingsWithCalendar never reaches the "cancel missing bookings" loop.
+    vi.spyOn(globalThis, 'fetch').mockResolvedValue(
+      new Response(JSON.stringify({ items: [], nextPageToken: 'abc' }), { status: 200 }),
+    );
+    await expect(reconcileBookingsWithCalendar(env, tenant)).rejects.toThrow('result truncated');
+    expect(await statusOf(env, id)).toBe('confirmed');
+  });
+
+  it('leaves a booking outside the Calendar query window untouched, even though its event is absent from the response', async () => {
+    const { env } = createTestEnv();
+    await connectCalendar(env);
+    // Well outside any [today-1, today+180) window relative to actual real-world "today".
+    const id = await seedSyncedBooking(env, { startDate: '2020-01-01', endDate: '2020-01-04' });
+    // Simulates the booking being outside the query window: the response simply never contains it.
+    vi.spyOn(globalThis, 'fetch').mockResolvedValue(calendarListResponse([]));
+    await reconcileBookingsWithCalendar(env, tenant);
+    expect(await statusOf(env, id)).toBe('confirmed');
+  });
+
+  it('ignores a time change on an otherwise-present event — only presence of the bookingId is checked', async () => {
+    const { env } = createTestEnv();
+    await connectCalendar(env);
+    const id = await seedSyncedBooking(env); // default in-window dates
+    const before = await bookingRow(env, id);
+    // Event exists (same bookingId) but with different start/end dates than the DB row — still
+    // well within the query window, just not matching the DB row's own dates.
+    const shiftedStart = addDays(IN_WINDOW_START, 45);
+    const shiftedEnd = addDays(IN_WINDOW_END, 45);
+    vi.spyOn(globalThis, 'fetch').mockResolvedValue(
+      new Response(
+        JSON.stringify({
+          items: [
+            {
+              summary: 'Boarding',
+              start: { date: shiftedStart },
+              end: { date: shiftedEnd },
+              extendedProperties: {
+                private: { pawbook: 'true', category: 'boarding', bookingId: id },
+              },
+            },
+          ],
+        }),
+        { status: 200 },
+      ),
+    );
+    await reconcileBookingsWithCalendar(env, tenant);
+    expect(await bookingRow(env, id)).toEqual(before);
+  });
+});
+
+describe('reconcileIfStale', () => {
+  afterEach(() => vi.restoreAllMocks());
+
+  it('reconciles once, then skips within the TTL window', async () => {
+    const { env } = createTestEnv();
+    await connectCalendar(env);
+    const spy = vi.spyOn(globalThis, 'fetch').mockResolvedValue(calendarListResponse([]));
+    await reconcileIfStale(env, tenant);
+    expect(spy).toHaveBeenCalledTimes(1);
+    await reconcileIfStale(env, tenant);
+    expect(spy).toHaveBeenCalledTimes(1); // second call within the TTL skips Calendar entirely
+  });
+
+  it('writes the TTL marker even when reconciliation fails, throttling retries during an outage', async () => {
+    const { env } = createTestEnv();
+    await connectCalendar(env);
+    const spy = vi.spyOn(globalThis, 'fetch').mockResolvedValue(new Response('', { status: 500 })); // Calendar API failure
+    await reconcileIfStale(env, tenant);
+    expect(spy).toHaveBeenCalledTimes(1);
+    await reconcileIfStale(env, tenant);
+    expect(spy).toHaveBeenCalledTimes(1); // marker was written despite the first call's failure
+  });
+
+  it('does not cancel a booking when the Calendar response is truncated (nextPageToken present)', async () => {
+    const { env } = createTestEnv();
+    await connectCalendar(env);
+    const id = await seedSyncedBooking(env);
+    // >2500 events in range: the booking's event would be missing from this (first) page, but
+    // listCalendarEvents throws on truncation instead of returning an incomplete list, so the
+    // best-effort wrapper here swallows the error and leaves the booking's status alone.
+    vi.spyOn(globalThis, 'fetch').mockResolvedValue(
+      new Response(JSON.stringify({ items: [], nextPageToken: 'abc' }), { status: 200 }),
+    );
+    await expect(reconcileIfStale(env, tenant)).resolves.not.toThrow();
+    expect(await statusOf(env, id)).toBe('confirmed');
+  });
+});
+
+describe('GET /:slug/admin/bookings triggers reconciliation', () => {
+  afterEach(() => vi.restoreAllMocks());
+
+  it('cancels a booking whose calendar event is gone before returning the list', async () => {
+    const { env } = createTestEnv();
+    await connectCalendar(env);
+    const id = await seedSyncedBooking(env);
+    vi.spyOn(globalThis, 'fetch').mockResolvedValue(calendarListResponse([]));
+    const token = await adminToken(TENANT_A);
+    const res = await app.request(
+      '/api/sunny-paws/admin/bookings',
+      { headers: { Authorization: `Bearer ${token}` } },
+      env,
+    );
+    const body = (await res.json()) as { bookings: { id: string; status: string }[] };
+    expect(body.bookings.find((b) => b.id === id)?.status).toBe('cancelled');
+  });
+});
diff --git a/server/__tests__/calendar-sync.test.ts b/server/__tests__/calendar-sync.test.ts
index c670e31..abd7582 100644
--- a/server/__tests__/calendar-sync.test.ts
+++ b/server/__tests__/calendar-sync.test.ts
@@ -34,6 +34,7 @@ describe('syncBookingToCalendar', () => {
       bookingId: 'b1',
       endUserId: null,
       serviceType: 'boarding',
+      serviceLabel: 'Boarding',
       startDate: '2030-03-01',
       endDate: '2030-03-04',
       startTime: null,
@@ -56,6 +57,7 @@ describe('syncBookingToCalendar', () => {
       bookingId: 'b2',
       endUserId: null,
       serviceType: 'boarding',
+      serviceLabel: 'Boarding',
       startDate: '2030-03-01',
       endDate: '2030-03-04',
       startTime: null,
@@ -82,6 +84,7 @@ describe('syncBookingToCalendar', () => {
       bookingId: 'b3',
       endUserId: null,
       serviceType: 'boarding',
+      serviceLabel: 'Boarding',
       startDate: '2030-03-01',
       endDate: '2030-03-04',
       startTime: null,
diff --git a/server/__tests__/csv-parser.test.ts b/server/__tests__/csv-parser.test.ts
new file mode 100644
index 0000000..d754eb4
--- /dev/null
+++ b/server/__tests__/csv-parser.test.ts
@@ -0,0 +1,42 @@
+import { describe, expect, it } from 'vitest';
+import { parseCsvRows } from '../lib/csv';
+
+describe('parseCsvRows', () => {
+  it('splits a simple comma-separated file into rows and cells', () => {
+    const text = 'a,b,c\n1,2,3';
+    expect(parseCsvRows(text)).toEqual([
+      ['a', 'b', 'c'],
+      ['1', '2', '3'],
+    ]);
+  });
+
+  it('handles a quoted field containing a comma', () => {
+    const text = 'Client Email,Client Name\njess@example.com,"Doe, Jane"';
+    expect(parseCsvRows(text)).toEqual([
+      ['Client Email', 'Client Name'],
+      ['jess@example.com', 'Doe, Jane'],
+    ]);
+  });
+
+  it('un-escapes doubled quotes inside a quoted field', () => {
+    const text = 'a\n"She said ""hi"""';
+    expect(parseCsvRows(text)).toEqual([['a'], ['She said "hi"']]);
+  });
+
+  it('tolerates CRLF line endings', () => {
+    const text = 'a,b\r\n1,2';
+    expect(parseCsvRows(text)).toEqual([
+      ['a', 'b'],
+      ['1', '2'],
+    ]);
+  });
+
+  it('represents a blank line as a single empty-string cell, preserving row alignment', () => {
+    const text = 'a,b\n\n1,2\n\n';
+    expect(parseCsvRows(text)).toEqual([['a', 'b'], [''], ['1', '2'], [''], ['']]);
+  });
+
+  it('returns an empty array for an empty string', () => {
+    expect(parseCsvRows('')).toEqual([]);
+  });
+});
diff --git a/server/__tests__/custom-services.test.ts b/server/__tests__/custom-services.test.ts
new file mode 100644
index 0000000..23cd387
--- /dev/null
+++ b/server/__tests__/custom-services.test.ts
@@ -0,0 +1,231 @@
+import { describe, expect, it } from 'vitest';
+import app from '../index';
+import { createService, insertBookingRequest, setServiceConfig } from '../db/repo';
+import { adminToken, createTestEnv, TENANT_A } from './helpers';
+
+/** Admin Bearer headers for a tenant, optionally with a JSON content type. */
+async function auth(tenantId: string, json = false): Promise<Record<string, string>> {
+  const h: Record<string, string> = { Authorization: `Bearer ${await adminToken(tenantId)}` };
+  if (json) h['Content-Type'] = 'application/json';
+  return h;
+}
+
+async function createSvc(
+  env: Env,
+  body: Record<string, unknown>,
+): Promise<{ status: number; json: { type?: string; error?: string } }> {
+  const res = await app.request(
+    '/api/sunny-paws/admin/services',
+    { method: 'POST', headers: await auth(TENANT_A, true), body: JSON.stringify(body) },
+    env,
+  );
+  return { status: res.status, json: (await res.json()) as { type?: string; error?: string } };
+}
+
+describe('custom services — creation', () => {
+  it('creates a disabled service from a template, slug derived from the label', async () => {
+    const { env } = createTestEnv();
+    const { status, json } = await createSvc(env, { template: 'walk', label: 'Afternoon Walk!' });
+    expect(status).toBe(201);
+    expect(json.type).toBe('afternoon-walk');
+
+    // Visible in admin settings (disabled, template behavior, custom) but NOT in the public
+    // config until priced + enabled.
+    const settings = (await (
+      await app.request('/api/sunny-paws/admin/settings', { headers: await auth(TENANT_A) }, env)
+    ).json()) as {
+      services: { type: string; label: string; custom: boolean; enabled: boolean; shape: string }[];
+      templates: { id: string }[];
+    };
+    const created = settings.services.find((s) => s.type === 'afternoon-walk')!;
+    expect(created).toMatchObject({
+      label: 'Afternoon Walk!',
+      custom: true,
+      enabled: false,
+      shape: 'single',
+    });
+    expect(settings.templates.map((t) => t.id)).toContain('walk');
+
+    const cfg = (await (await app.request('/api/sunny-paws/config', {}, env)).json()) as {
+      services: { type: string }[];
+    };
+    expect(cfg.services.some((s) => s.type === 'afternoon-walk')).toBe(false);
+  });
+
+  it('rejects unknown templates, empty/punctuation labels, reserved and duplicate slugs', async () => {
+    const { env } = createTestEnv();
+    expect((await createSvc(env, { template: 'spa', label: 'Spa day' })).status).toBe(400);
+    expect((await createSvc(env, { template: 'walk', label: '   ' })).status).toBe(400);
+    expect((await createSvc(env, { template: 'walk', label: '---' })).status).toBe(400);
+    expect((await createSvc(env, { template: 'walk', label: 'Blocked' })).status).toBe(400);
+    // 'morning-walk' is seeded for Sunny Paws; 'walk' collides with the built-in row.
+    expect((await createSvc(env, { template: 'walk', label: 'Morning Walk' })).status).toBe(400);
+    expect((await createSvc(env, { template: 'walk', label: 'Walk' })).status).toBe(400);
+  });
+
+  it('rejects a template id that only matches via the JS `in` operator prototype chain', async () => {
+    const { env } = createTestEnv();
+    expect((await createSvc(env, { template: 'constructor', label: 'x' })).status).toBe(400);
+  });
+
+  it('a custom service whose slug collides with an Object.prototype key is still custom and deletable', async () => {
+    const { env } = createTestEnv();
+    const { status, json } = await createSvc(env, { template: 'walk', label: 'Constructor' });
+    expect(status).toBe(201);
+    expect(json.type).toBe('constructor');
+
+    const settings = (await (
+      await app.request('/api/sunny-paws/admin/settings', { headers: await auth(TENANT_A) }, env)
+    ).json()) as { services: { type: string; custom: boolean }[] };
+    expect(settings.services.find((s) => s.type === 'constructor')).toMatchObject({ custom: true });
+
+    const del = await app.request(
+      '/api/sunny-paws/admin/services/constructor',
+      { method: 'DELETE', headers: await auth(TENANT_A) },
+      env,
+    );
+    expect(del.status).toBe(204);
+  });
+
+  it('createService rejects a duplicate (TenantId, ServiceType) at the DB level', async () => {
+    const { env } = createTestEnv();
+    const svc = {
+      serviceType: 'race-walk',
+      label: 'Race Walk',
+      icon: 'paw',
+      shape: 'single' as const,
+      rateUnit: 'visit' as const,
+      hasDuration: true,
+      capacityKind: 'none' as const,
+      sortOrder: 99,
+    };
+    await createService(env.PAWBOOK_DB, TENANT_A, svc);
+    await expect(createService(env.PAWBOOK_DB, TENANT_A, svc)).rejects.toThrow(
+      /UNIQUE constraint failed/,
+    );
+  });
+});
+
+describe('custom services — booking', () => {
+  it('a seeded custom service (morning-walk) is bookable through the public availability path', async () => {
+    const { env } = createTestEnv();
+    const cfg = (await (await app.request('/api/sunny-paws/config', {}, env)).json()) as {
+      services: { type: string; label: string; icon: string; hasDuration: boolean }[];
+    };
+    const mw = cfg.services.find((s) => s.type === 'morning-walk')!;
+    expect(mw).toMatchObject({ label: 'Morning walk', icon: 'paw', hasDuration: true });
+
+    const avail = (await (
+      await app.request('/api/sunny-paws/availability?type=morning-walk&start=2028-08-01', {}, env)
+    ).json()) as { available: boolean; estCost: number };
+    expect(avail).toMatchObject({ available: true, estCost: 18 });
+  });
+
+  it('a custom boarding-pool service draws from the SAME pet capacity as built-in boarding', async () => {
+    const { env } = createTestEnv();
+    await createSvc(env, { template: 'boarding', label: 'Luxury Boarding' });
+    // Price + enable it via the normal settings PUT.
+    const put = await app.request(
+      '/api/sunny-paws/admin/settings',
+      {
+        method: 'PUT',
+        headers: await auth(TENANT_A, true),
+        body: JSON.stringify({
+          services: [
+            { type: 'luxury-boarding', enabled: true, options: [{ label: 'Suite', rate: 90 }] },
+          ],
+        }),
+      },
+      env,
+    );
+    expect(put.status).toBe(204);
+
+    // Fill Sunny Paws' 2-pet boarding pool via the CUSTOM service...
+    await insertBookingRequest(env.PAWBOOK_DB, TENANT_A, {
+      endUserId: null,
+      serviceType: 'luxury-boarding',
+      startDate: '2029-01-10',
+      endDate: '2029-01-15',
+      optionKey: 'standard',
+      petType: null,
+      petCount: 2,
+      estCost: null,
+      status: 'confirmed',
+    });
+    // ...and BUILT-IN boarding must see the pool as full on those dates.
+    const shared = (await (
+      await app.request(
+        '/api/sunny-paws/availability?type=boarding&start=2029-01-11&end=2029-01-13&pets=1',
+        {},
+        env,
+      )
+    ).json()) as { available: boolean };
+    expect(shared.available).toBe(false);
+  });
+});
+
+describe('custom services — deletion', () => {
+  it('deletes an unused custom service; it disappears from settings', async () => {
+    const { env } = createTestEnv();
+    await createSvc(env, { template: 'checkin', label: 'Evening Visit' });
+    const del = await app.request(
+      '/api/sunny-paws/admin/services/evening-visit',
+      { method: 'DELETE', headers: await auth(TENANT_A) },
+      env,
+    );
+    expect(del.status).toBe(204);
+    const settings = (await (
+      await app.request('/api/sunny-paws/admin/settings', { headers: await auth(TENANT_A) }, env)
+    ).json()) as { services: { type: string }[] };
+    expect(settings.services.some((s) => s.type === 'evening-visit')).toBe(false);
+  });
+
+  it('refuses to delete built-ins, unknown slugs, and services with booking history', async () => {
+    const { env } = createTestEnv();
+    const builtin = await app.request(
+      '/api/sunny-paws/admin/services/boarding',
+      { method: 'DELETE', headers: await auth(TENANT_A) },
+      env,
+    );
+    expect(builtin.status).toBe(400);
+
+    const unknown = await app.request(
+      '/api/sunny-paws/admin/services/teleport',
+      { method: 'DELETE', headers: await auth(TENANT_A) },
+      env,
+    );
+    expect(unknown.status).toBe(404);
+
+    // morning-walk gets a booking → 409, and it must still exist afterwards.
+    await insertBookingRequest(env.PAWBOOK_DB, TENANT_A, {
+      endUserId: null,
+      serviceType: 'morning-walk',
+      startDate: '2029-02-01',
+      endDate: null,
+      optionKey: 'd30',
+      petType: null,
+      petCount: 1,
+      estCost: 18,
+      status: 'confirmed',
+    });
+    const withBookings = await app.request(
+      '/api/sunny-paws/admin/services/morning-walk',
+      { method: 'DELETE', headers: await auth(TENANT_A) },
+      env,
+    );
+    expect(withBookings.status).toBe(409);
+  });
+
+  it('setServiceConfig reports no-op instead of silently succeeding when the row is gone', async () => {
+    const { env } = createTestEnv();
+    const updated = await setServiceConfig(env.PAWBOOK_DB, TENANT_A, 'no-such-service', {
+      enabled: true,
+      questions: [],
+      minNights: null,
+      maxNights: null,
+      minPetCount: null,
+      maxPetCount: null,
+    });
+    expect(updated).toBe(false);
+  });
+});
diff --git a/server/__tests__/customers-import.test.ts b/server/__tests__/customers-import.test.ts
new file mode 100644
index 0000000..5d38033
--- /dev/null
+++ b/server/__tests__/customers-import.test.ts
@@ -0,0 +1,209 @@
+import { afterEach, describe, expect, it, vi } from 'vitest';
+import app from '../index';
+import { adminToken, createTestEnv, TENANT_A } from './helpers';
+
+type ImportResult = {
+  importedCustomers: number;
+  importedPets: number;
+  invitesSent: number;
+  invitesFailed: number;
+  skippedRows: { row: number; reason: string }[];
+};
+
+async function importCsv(
+  env: Env,
+  csv: string,
+  sendInvites = false,
+): Promise<{ status: number; body: ImportResult }> {
+  const token = await adminToken(TENANT_A);
+  const res = await app.request(
+    '/api/sunny-paws/admin/customers/import',
+    {
+      method: 'POST',
+      headers: { Authorization: `Bearer ${token}`, 'Content-Type': 'application/json' },
+      body: JSON.stringify({ csv, sendInvites }),
+    },
+    env,
+  );
+  return { status: res.status, body: (await res.json()) as ImportResult };
+}
+
+describe('POST /:slug/admin/customers/import', () => {
+  afterEach(() => vi.restoreAllMocks());
+
+  it('imports clients and pets from a well-formed CSV', async () => {
+    const { env } = createTestEnv();
+    const csv =
+      'Client Email,Client Name,Pet Name,Pet Type\n' +
+      'new1@example.com,New One,Fido,dog\n' +
+      'new1@example.com,New One,Whiskers,cat\n' +
+      'new2@example.com,New Two,,\n';
+    const { status, body } = await importCsv(env, csv);
+    expect(status).toBe(200);
+    expect(body.importedCustomers).toBe(2);
+    expect(body.importedPets).toBe(2);
+    expect(body.skippedRows).toEqual([]);
+  });
+
+  it('reports the row and reason for an invalid email', async () => {
+    const { env } = createTestEnv();
+    const csv = 'Client Email,Client Name,Pet Name,Pet Type\nnot-an-email,X,,\n';
+    const { body } = await importCsv(env, csv);
+    expect(body.skippedRows).toEqual([{ row: 2, reason: 'Invalid email address' }]);
+    expect(body.importedCustomers).toBe(0);
+  });
+
+  it('skips a disabled/unknown pet type but still creates the client', async () => {
+    const { env } = createTestEnv();
+    const csv = 'Client Email,Client Name,Pet Name,Pet Type\nnew3@example.com,X,Ferret,ferret\n';
+    const { body } = await importCsv(env, csv);
+    expect(body.importedCustomers).toBe(1);
+    expect(body.importedPets).toBe(0);
+    expect(body.skippedRows).toEqual([{ row: 2, reason: "'ferret' is not an enabled pet type" }]);
+  });
+
+  it('skips a pet name given without a type, and vice versa', async () => {
+    const { env } = createTestEnv();
+    const csv =
+      'Client Email,Client Name,Pet Name,Pet Type\n' +
+      'new4@example.com,X,Rex,\n' +
+      'new5@example.com,Y,,dog\n';
+    const { body } = await importCsv(env, csv);
+    expect(body.skippedRows).toEqual([
+      { row: 2, reason: 'Pet name given without a pet type' },
+      { row: 3, reason: 'Pet type given without a pet name' },
+    ]);
+    expect(body.importedCustomers).toBe(2);
+  });
+
+  it('dedups a pet appearing twice in the same file, and across a repeated import', async () => {
+    const { env } = createTestEnv();
+    const csv =
+      'Client Email,Client Name,Pet Name,Pet Type\n' +
+      'dup@example.com,X,Bella,dog\n' +
+      'dup@example.com,X,Bella,dog\n';
+    const first = await importCsv(env, csv);
+    expect(first.body.importedPets).toBe(1);
+    expect(first.body.skippedRows).toEqual([
+      { row: 3, reason: 'Pet already exists for this client' },
+    ]);
+
+    const second = await importCsv(env, csv);
+    expect(second.body.importedCustomers).toBe(0); // client already existed
+    expect(second.body.importedPets).toBe(0);
+    expect(second.body.skippedRows).toHaveLength(2);
+  });
+
+  it('only sends invites for genuinely new customers, never for a pre-existing one', async () => {
+    const { env } = createTestEnv();
+    // jess@example.com is a seeded pre-existing customer for sunny-paws — must not be re-invited.
+    const csv =
+      'Client Email,Client Name,Pet Name,Pet Type\n' +
+      'jess@example.com,Jess,,\n' +
+      'brandnew@example.com,New,,\n';
+    const spy = vi
+      .spyOn(globalThis, 'fetch')
+      .mockResolvedValue(new Response('{}', { status: 200 }));
+    const envWithEmail = { ...env, RESEND_API_KEY: 'k', RESEND_FROM: 'Pawbook <b@x.com>' } as Env;
+    const { body } = await importCsv(envWithEmail, csv, true);
+    expect(body.importedCustomers).toBe(1); // only brandnew@
+    expect(body.invitesSent).toBe(1);
+    expect(spy).toHaveBeenCalledTimes(1);
+  });
+
+  it('does not fail the request when an invite send fails; counts it instead', async () => {
+    const { env } = createTestEnv();
+    const csv = 'Client Email,Client Name,Pet Name,Pet Type\nfailmail@example.com,X,,\n';
+    vi.spyOn(globalThis, 'fetch').mockResolvedValue(new Response('', { status: 500 }));
+    const envWithEmail = { ...env, RESEND_API_KEY: 'k', RESEND_FROM: 'Pawbook <b@x.com>' } as Env;
+    const { status, body } = await importCsv(envWithEmail, csv, true);
+    expect(status).toBe(200);
+    expect(body.importedCustomers).toBe(1);
+    expect(body.invitesFailed).toBe(1);
+    expect(body.invitesSent).toBe(0);
+  });
+
+  it('does not send invites when sendInvites is false, even with email configured', async () => {
+    const { env } = createTestEnv();
+    const csv = 'Client Email,Client Name,Pet Name,Pet Type\nnoinvite@example.com,X,,\n';
+    const spy = vi
+      .spyOn(globalThis, 'fetch')
+      .mockResolvedValue(new Response('{}', { status: 200 }));
+    const envWithEmail = { ...env, RESEND_API_KEY: 'k', RESEND_FROM: 'Pawbook <b@x.com>' } as Env;
+    const { body } = await importCsv(envWithEmail, csv, false);
+    expect(body.invitesSent).toBe(0);
+    expect(spy).not.toHaveBeenCalled();
+  });
+
+  it('treats an empty file (header only) as zero imports, not an error', async () => {
+    const { env } = createTestEnv();
+    const { status, body } = await importCsv(env, 'Client Email,Client Name,Pet Name,Pet Type\n');
+    expect(status).toBe(200);
+    expect(body.importedCustomers).toBe(0);
+    expect(body.skippedRows).toEqual([]);
+  });
+
+  it('rejects a file over the row cap before touching the database', async () => {
+    const { env, raw } = createTestEnv();
+    const countEndUsers = () =>
+      (raw.prepare('SELECT COUNT(*) AS n FROM EndUsers').get() as { n: number }).n;
+    const before = countEndUsers();
+    const header = 'Client Email,Client Name,Pet Name,Pet Type';
+    const rows = Array.from({ length: 501 }, (_, n) => `over${n}@example.com,Over ${n},,`).join(
+      '\n',
+    );
+    const token = await adminToken(TENANT_A);
+    const res = await app.request(
+      '/api/sunny-paws/admin/customers/import',
+      {
+        method: 'POST',
+        headers: { Authorization: `Bearer ${token}`, 'Content-Type': 'application/json' },
+        body: JSON.stringify({ csv: `${header}\n${rows}`, sendInvites: false }),
+      },
+      env,
+    );
+    expect(res.status).toBe(400);
+    const body = (await res.json()) as { error: string };
+    expect(body.error).toMatch(/501 rows/);
+    expect(body.error).toMatch(/500 or fewer/);
+    expect(countEndUsers()).toBe(before); // no rows should have been processed at all
+  });
+
+  it('preserves correct row numbers after a blank line in the file', async () => {
+    const { env } = createTestEnv();
+    // Blank line at position 2; without the fix this shifts the reported row number for the
+    // invalid-email row below by one.
+    const csv = 'Client Email,Client Name,Pet Name,Pet Type\n\nnot-an-email,X,,\n';
+    const { body } = await importCsv(env, csv);
+    expect(body.skippedRows).toEqual([{ row: 3, reason: 'Invalid email address' }]);
+  });
+
+  it('turns a single row DB failure into a skip instead of a 500', async () => {
+    vi.doMock('../db/repo', async (importOriginal) => {
+      const actual = await importOriginal<typeof import('../db/repo')>();
+      return {
+        ...actual,
+        addEndUserPet: vi.fn().mockRejectedValueOnce(new Error('boom')),
+      };
+    });
+    vi.resetModules();
+    const { default: freshApp } = await import('../index');
+    const { env } = createTestEnv();
+    const csv = 'Client Email,Client Name,Pet Name,Pet Type\nboom@example.com,X,Rex,dog\n';
+    const token = await adminToken(TENANT_A);
+    const res = await freshApp.request(
+      '/api/sunny-paws/admin/customers/import',
+      {
+        method: 'POST',
+        headers: { Authorization: `Bearer ${token}`, 'Content-Type': 'application/json' },
+        body: JSON.stringify({ csv, sendInvites: false }),
+      },
+      env,
+    );
+    expect(res.status).toBe(200);
+    const body = (await res.json()) as ImportResult;
+    expect(body.skippedRows).toEqual([{ row: 2, reason: 'Could not import this row' }]);
+    vi.doUnmock('../db/repo');
+    vi.resetModules();
+  });
+});
diff --git a/server/__tests__/google-calendar.test.ts b/server/__tests__/google-calendar.test.ts
index 68dad30..ff48dbe 100644
--- a/server/__tests__/google-calendar.test.ts
+++ b/server/__tests__/google-calendar.test.ts
@@ -4,6 +4,7 @@ import {
   buildEventResource,
   createEvent,
   exchangeCode,
+  listCalendarEvents,
   refreshAccessToken,
 } from '../lib/google-calendar';
 
@@ -167,4 +168,102 @@ describe('google-calendar', () => {
     expect(r.extendedProperties?.private.customerEmail).toBe('');
     expect(r.extendedProperties?.private.pawbook).toBe('true');
   });
+
+  describe('listCalendarEvents', () => {
+    it('normalizes an all-day event and a timed event', async () => {
+      const fakeBody = {
+        items: [
+          {
+            summary: 'Dog boarding',
+            start: { date: '2030-06-01' },
+            end: { date: '2030-06-04' },
+            extendedProperties: {
+              private: { pawbook: 'true', category: 'boarding', bookingId: 'bk-a' },
+            },
+          },
+          {
+            summary: 'Walk',
+            start: { dateTime: '2030-06-05T09:30:00-07:00' },
+            end: { dateTime: '2030-06-05T10:30:00-07:00' },
+            extendedProperties: {
+              private: { pawbook: 'true', category: 'walks', bookingId: 'bk-b' },
+            },
+          },
+        ],
+      };
+      vi.spyOn(globalThis, 'fetch').mockResolvedValue(
+        new Response(JSON.stringify(fakeBody), { status: 200 }),
+      );
+
+      const events = await listCalendarEvents(
+        'AT',
+        'primary',
+        '2030-06-01T00:00:00Z',
+        '2030-07-01T00:00:00Z',
+      );
+
+      expect(events).toHaveLength(2);
+      // all-day event
+      expect(events[0]).toEqual({
+        summary: 'Dog boarding',
+        start: '2030-06-01',
+        end: '2030-06-04',
+        private: { pawbook: 'true', category: 'boarding', bookingId: 'bk-a' },
+      });
+      // timed event — dateTime sliced to date part
+      expect(events[1]).toEqual({
+        summary: 'Walk',
+        start: '2030-06-05',
+        end: '2030-06-05',
+        private: { pawbook: 'true', category: 'walks', bookingId: 'bk-b' },
+      });
+    });
+
+    it('defaults to empty private map and empty summary when fields are absent', async () => {
+      const fakeBody = {
+        items: [{ start: { date: '2030-06-01' }, end: { date: '2030-06-02' } }],
+      };
+      vi.spyOn(globalThis, 'fetch').mockResolvedValue(
+        new Response(JSON.stringify(fakeBody), { status: 200 }),
+      );
+
+      const events = await listCalendarEvents('AT', 'primary', '2030-06-01Z', '2030-07-01Z');
+      expect(events[0].summary).toBe('');
+      expect(events[0].private).toEqual({});
+    });
+
+    it('sends the correct query parameters and Authorization header', async () => {
+      const spy = vi
+        .spyOn(globalThis, 'fetch')
+        .mockResolvedValue(new Response(JSON.stringify({ items: [] }), { status: 200 }));
+
+      await listCalendarEvents('MY_TOKEN', 'cal@group.calendar.google.com', 'tMin', 'tMax');
+
+      const [url, init] = spy.mock.calls[0] as [string, RequestInit];
+      expect(url).toContain(encodeURIComponent('cal@group.calendar.google.com'));
+      const parsed = new URL(url);
+      expect(parsed.searchParams.get('timeMin')).toBe('tMin');
+      expect(parsed.searchParams.get('timeMax')).toBe('tMax');
+      expect(parsed.searchParams.get('singleEvents')).toBe('true');
+      expect(parsed.searchParams.get('maxResults')).toBe('2500');
+      expect(parsed.searchParams.get('orderBy')).toBe('startTime');
+      expect((init.headers as Record<string, string>)['Authorization']).toBe('Bearer MY_TOKEN');
+    });
+
+    it('throws on a non-2xx response', async () => {
+      vi.spyOn(globalThis, 'fetch').mockResolvedValue(new Response('no', { status: 403 }));
+      await expect(
+        listCalendarEvents('AT', 'primary', '2030-06-01Z', '2030-07-01Z'),
+      ).rejects.toThrow('Google listCalendarEvents failed (403)');
+    });
+
+    it('throws when the response is truncated (nextPageToken present)', async () => {
+      vi.spyOn(globalThis, 'fetch').mockResolvedValue(
+        new Response(JSON.stringify({ items: [], nextPageToken: 'abc' }), { status: 200 }),
+      );
+      await expect(
+        listCalendarEvents('AT', 'primary', '2030-06-01Z', '2030-07-01Z'),
+      ).rejects.toThrow('result truncated');
+    });
+  });
 });
diff --git a/server/__tests__/migration-0006.test.ts b/server/__tests__/migration-0006.test.ts
new file mode 100644
index 0000000..840d9c9
--- /dev/null
+++ b/server/__tests__/migration-0006.test.ts
@@ -0,0 +1,166 @@
+import { readFileSync } from 'node:fs';
+import { join } from 'node:path';
+import { DatabaseSync } from 'node:sqlite';
+import { describe, expect, it } from 'vitest';
+
+const MIGRATION_PATH = join(
+  import.meta.dirname,
+  '..',
+  '..',
+  'migrations',
+  '0006_custom_services.sql',
+);
+
+/** Pre-0006 shapes of the three rebuilt tables (ServiceType CHECK enums still in place). */
+const OLD_DDL = `
+CREATE TABLE Tenants (
+  Id TEXT PRIMARY KEY,
+  Slug TEXT NOT NULL UNIQUE,
+  DisplayName TEXT NOT NULL,
+  AccentColor TEXT NOT NULL DEFAULT '#4f46e5',
+  MaxBoardingPets INTEGER,
+  MaxHouseSitsPerDay INTEGER,
+  MaxStayNights INTEGER,
+  Timezone TEXT,
+  CreatedAt TEXT NOT NULL DEFAULT (datetime('now'))
+);
+CREATE TABLE EndUsers (Id TEXT PRIMARY KEY);
+CREATE TABLE TenantServices (
+  TenantId TEXT NOT NULL REFERENCES Tenants(Id),
+  ServiceType TEXT NOT NULL CHECK (ServiceType IN ('boarding', 'housesitting', 'daycare', 'walk', 'checkin')),
+  Enabled INTEGER NOT NULL DEFAULT 1,
+  Questions TEXT NOT NULL DEFAULT '[]',
+  MinNights INTEGER,
+  MaxNights INTEGER,
+  MinPetCount INTEGER,
+  MaxPetCount INTEGER,
+  UNIQUE (TenantId, ServiceType)
+);
+CREATE TABLE TenantServiceOptions (
+  Id TEXT PRIMARY KEY,
+  TenantId TEXT NOT NULL REFERENCES Tenants(Id),
+  ServiceType TEXT NOT NULL CHECK (ServiceType IN ('boarding', 'housesitting', 'daycare', 'walk', 'checkin')),
+  OptionKey TEXT NOT NULL,
+  Label TEXT NOT NULL,
+  DurationMinutes INTEGER,
+  Rate INTEGER NOT NULL,
+  RateUnit TEXT NOT NULL CHECK (RateUnit IN ('night', 'day', 'visit')),
+  UNIQUE (TenantId, ServiceType, OptionKey)
+);
+CREATE TABLE BookingRequests (
+  Id TEXT PRIMARY KEY,
+  TenantId TEXT NOT NULL REFERENCES Tenants(Id),
+  EndUserId TEXT REFERENCES EndUsers(Id),
+  ServiceType TEXT NOT NULL CHECK (ServiceType IN ('boarding', 'housesitting', 'daycare', 'walk', 'checkin', 'blocked')),
+  StartDate TEXT NOT NULL,
+  EndDate TEXT,
+  OptionKey TEXT,
+  PetType TEXT,
+  PetCount INTEGER NOT NULL DEFAULT 1,
+  StartTime TEXT,
+  GCalEventId TEXT,
+  EstCost INTEGER,
+  Answers TEXT NOT NULL DEFAULT '{}',
+  Status TEXT NOT NULL DEFAULT 'pending' CHECK (Status IN ('pending', 'confirmed', 'cancelled')),
+  CreatedAt TEXT NOT NULL DEFAULT (datetime('now'))
+);
+CREATE INDEX idx_BookingRequests_Tenant_Dates ON BookingRequests (TenantId, StartDate);
+CREATE INDEX idx_BookingRequests_Tenant_User ON BookingRequests (TenantId, EndUserId);
+`;
+
+describe('migration 0006 — custom services rebuild', () => {
+  function migratedDb(): DatabaseSync {
+    const db = new DatabaseSync(':memory:');
+    db.exec(OLD_DDL);
+    db.exec(
+      `INSERT INTO Tenants (Id, Slug, DisplayName) VALUES ('t1', 's1', 'T1'), ('t2', 's2', 'T2')`,
+    );
+    // t1 has two service rows (one with config), t2 has none at all.
+    db.exec(`INSERT INTO TenantServices (TenantId, ServiceType, Enabled, Questions, MinNights)
+             VALUES ('t1', 'boarding', 1, '[{"id":"q1"}]', 2), ('t1', 'walk', 0, '[]', NULL)`);
+    db.exec(`INSERT INTO TenantServiceOptions (Id, TenantId, ServiceType, OptionKey, Label, DurationMinutes, Rate, RateUnit)
+             VALUES ('o1', 't1', 'walk', 'd30', '30 minutes', 30, 20, 'visit')`);
+    db.exec(`INSERT INTO BookingRequests (Id, TenantId, ServiceType, StartDate, EndDate, PetCount, Status)
+             VALUES ('b1', 't1', 'boarding', '2028-06-20', '2028-06-25', 2, 'confirmed'),
+                    ('b2', 't1', 'blocked', '2028-07-03', '2028-07-05', 1, 'confirmed')`);
+    db.exec(readFileSync(MIGRATION_PATH, 'utf8'));
+    return db;
+  }
+
+  it('backfills behavior columns from templates and preserves existing config', () => {
+    const db = migratedDb();
+    const boarding = db
+      .prepare(`SELECT * FROM TenantServices WHERE TenantId='t1' AND ServiceType='boarding'`)
+      .get() as Record<string, unknown>;
+    expect(boarding).toMatchObject({
+      Enabled: 1,
+      Label: 'Boarding',
+      Icon: 'bed',
+      Shape: 'range',
+      RateUnit: 'night',
+      HasDuration: 0,
+      CapacityKind: 'boarding',
+      Questions: '[{"id":"q1"}]',
+      MinNights: 2,
+    });
+    const walk = db
+      .prepare(
+        `SELECT Enabled, Shape, HasDuration, CapacityKind FROM TenantServices WHERE TenantId='t1' AND ServiceType='walk'`,
+      )
+      .get();
+    expect(walk).toMatchObject({
+      Enabled: 0,
+      Shape: 'single',
+      HasDuration: 1,
+      CapacityKind: 'none',
+    });
+  });
+
+  it('gives every tenant all five built-in rows; missing ones arrive disabled', () => {
+    const db = migratedDb();
+    const t1Count = db
+      .prepare(`SELECT COUNT(*) AS n FROM TenantServices WHERE TenantId='t1'`)
+      .get() as { n: number };
+    const t2 = db
+      .prepare(
+        `SELECT ServiceType, Enabled FROM TenantServices WHERE TenantId='t2' ORDER BY SortOrder`,
+      )
+      .all() as { ServiceType: string; Enabled: number }[];
+    expect(t1Count.n).toBe(5);
+    expect(t2.map((r) => r.ServiceType)).toEqual([
+      'boarding',
+      'housesitting',
+      'daycare',
+      'walk',
+      'checkin',
+    ]);
+    expect(t2.every((r) => r.Enabled === 0)).toBe(true);
+  });
+
+  it('drops the ServiceType CHECKs so custom slugs insert everywhere, preserves rows + FK integrity', () => {
+    const db = migratedDb();
+    // Options and bookings preserved.
+    expect(db.prepare(`SELECT COUNT(*) AS n FROM TenantServiceOptions`).get()).toMatchObject({
+      n: 1,
+    });
+    expect(db.prepare(`SELECT COUNT(*) AS n FROM BookingRequests`).get()).toMatchObject({ n: 2 });
+
+    // Custom slugs now insert into all three tables.
+    db.exec('PRAGMA foreign_keys=ON');
+    expect(() => {
+      db.exec(`INSERT INTO TenantServices (TenantId, ServiceType, Label, Shape, RateUnit)
+               VALUES ('t1', 'morning-walk', 'Morning walk', 'single', 'visit')`);
+      db.exec(`INSERT INTO TenantServiceOptions (Id, TenantId, ServiceType, OptionKey, Label, Rate, RateUnit)
+               VALUES ('o2', 't1', 'morning-walk', 'd30', '30 minutes', 18, 'visit')`);
+      db.exec(`INSERT INTO BookingRequests (Id, TenantId, ServiceType, StartDate)
+               VALUES ('b3', 't1', 'morning-walk', '2028-08-01')`);
+    }).not.toThrow();
+
+    expect(db.prepare('PRAGMA foreign_key_check').all()).toHaveLength(0);
+    // Indexes were recreated on the rebuilt BookingRequests.
+    const indexes = db.prepare(`PRAGMA index_list('BookingRequests')`).all() as { name: string }[];
+    const names = indexes.map((i) => i.name);
+    expect(names).toContain('idx_BookingRequests_Tenant_Dates');
+    expect(names).toContain('idx_BookingRequests_Tenant_User');
+  });
+});
diff --git a/server/__tests__/payments-repo.test.ts b/server/__tests__/payments-repo.test.ts
new file mode 100644
index 0000000..ab6c459
--- /dev/null
+++ b/server/__tests__/payments-repo.test.ts
@@ -0,0 +1,151 @@
+import { describe, expect, it } from 'vitest';
+import {
+  deletePayment,
+  insertBookingRequest,
+  insertPayment,
+  listBookingsForTenant,
+  listPaymentsForBooking,
+  updateBookingStatus,
+} from '../db/repo';
+import { createTestEnv, TENANT_A, TENANT_B } from './helpers';
+
+const makeBooking = (env: Env, tenantId: string, status: 'pending' | 'confirmed' = 'confirmed') =>
+  insertBookingRequest(env.PAWBOOK_DB, tenantId, {
+    endUserId: null,
+    serviceType: 'boarding',
+    startDate: '2030-01-01',
+    endDate: '2030-01-03',
+    optionKey: 'standard',
+    petType: 'dog',
+    petCount: 1,
+    estCost: 100,
+    status,
+  });
+
+const pay = (env: Env, tenantId: string, bookingRequestId: string, amount = 50) =>
+  insertPayment(env.PAWBOOK_DB, tenantId, {
+    bookingRequestId,
+    amount,
+    method: 'cash',
+    paidDate: '2026-07-01',
+    note: null,
+  });
+
+describe('payments repo', () => {
+  it('records a payment against a confirmed booking and lists it back', async () => {
+    const { env } = createTestEnv();
+    const bookingId = await makeBooking(env, TENANT_A);
+    const paymentId = await insertPayment(env.PAWBOOK_DB, TENANT_A, {
+      bookingRequestId: bookingId,
+      amount: 75,
+      method: 'venmo',
+      paidDate: '2026-07-02',
+      note: 'deposit',
+    });
+    expect(paymentId).not.toBeNull();
+    const rows = await listPaymentsForBooking(env.PAWBOOK_DB, TENANT_A, bookingId);
+    expect(rows).toHaveLength(1);
+    expect(rows[0]).toMatchObject({
+      Id: paymentId,
+      TenantId: TENANT_A,
+      BookingRequestId: bookingId,
+      Amount: 75,
+      Method: 'venmo',
+      PaidDate: '2026-07-02',
+      Note: 'deposit',
+    });
+  });
+
+  it('allows payments on a PENDING booking (deposits before confirmation)', async () => {
+    const { env } = createTestEnv();
+    const bookingId = await makeBooking(env, TENANT_A, 'pending');
+    expect(await pay(env, TENANT_A, bookingId)).not.toBeNull();
+  });
+
+  it('refuses a payment on a cancelled booking', async () => {
+    const { env } = createTestEnv();
+    const bookingId = await makeBooking(env, TENANT_A);
+    await updateBookingStatus(env.PAWBOOK_DB, TENANT_A, bookingId, 'cancelled');
+    expect(await pay(env, TENANT_A, bookingId)).toBeNull();
+  });
+
+  it('refuses a payment on a blocked sentinel row', async () => {
+    const { env } = createTestEnv();
+    const blockedId = await insertBookingRequest(env.PAWBOOK_DB, TENANT_A, {
+      endUserId: null,
+      serviceType: 'blocked',
+      startDate: '2030-02-01',
+      endDate: '2030-02-03',
+      optionKey: null,
+      petType: null,
+      petCount: 1,
+      estCost: null,
+      status: 'confirmed',
+    });
+    expect(await pay(env, TENANT_A, blockedId)).toBeNull();
+  });
+
+  it('refuses a cross-tenant payment (booking belongs to another tenant)', async () => {
+    const { env } = createTestEnv();
+    const bookingId = await makeBooking(env, TENANT_A);
+    expect(await pay(env, TENANT_B, bookingId)).toBeNull();
+  });
+
+  it('deletePayment is tenant-scoped and requires the matching booking id', async () => {
+    const { env } = createTestEnv();
+    const bookingId = await makeBooking(env, TENANT_A);
+    const otherBookingId = await makeBooking(env, TENANT_A);
+    const paymentId = (await pay(env, TENANT_A, bookingId))!;
+    // Wrong tenant: refused.
+    expect(await deletePayment(env.PAWBOOK_DB, TENANT_B, bookingId, paymentId)).toBe(false);
+    // Right tenant, WRONG booking id in the pair: refused (404 at the route, never a silent delete).
+    expect(await deletePayment(env.PAWBOOK_DB, TENANT_A, otherBookingId, paymentId)).toBe(false);
+    // Correct pair: deleted.
+    expect(await deletePayment(env.PAWBOOK_DB, TENANT_A, bookingId, paymentId)).toBe(true);
+    expect(await listPaymentsForBooking(env.PAWBOOK_DB, TENANT_A, bookingId)).toHaveLength(0);
+    // Gone now: a second delete reports false.
+    expect(await deletePayment(env.PAWBOOK_DB, TENANT_A, bookingId, paymentId)).toBe(false);
+  });
+
+  it('deletePayment works on a cancelled booking (delete is the only correction mechanism)', async () => {
+    const { env } = createTestEnv();
+    const bookingId = await makeBooking(env, TENANT_A);
+    const paymentId = (await pay(env, TENANT_A, bookingId))!;
+    await updateBookingStatus(env.PAWBOOK_DB, TENANT_A, bookingId, 'cancelled');
+    expect(await deletePayment(env.PAWBOOK_DB, TENANT_A, bookingId, paymentId)).toBe(true);
+  });
+
+  it('listPaymentsForBooking returns only that booking, newest paid-date first', async () => {
+    const { env } = createTestEnv();
+    const bookingId = await makeBooking(env, TENANT_A);
+    const otherBookingId = await makeBooking(env, TENANT_A);
+    await insertPayment(env.PAWBOOK_DB, TENANT_A, {
+      bookingRequestId: bookingId,
+      amount: 10,
+      method: 'cash',
+      paidDate: '2026-06-01',
+      note: null,
+    });
+    await insertPayment(env.PAWBOOK_DB, TENANT_A, {
+      bookingRequestId: bookingId,
+      amount: 20,
+      method: 'zelle',
+      paidDate: '2026-07-01',
+      note: null,
+    });
+    await pay(env, TENANT_A, otherBookingId, 999);
+    const rows = await listPaymentsForBooking(env.PAWBOOK_DB, TENANT_A, bookingId);
+    expect(rows.map((r) => r.Amount)).toEqual([20, 10]);
+  });
+
+  it('listBookingsForTenant aggregates PaidTotal (0 when unpaid)', async () => {
+    const { env } = createTestEnv();
+    const paidId = await makeBooking(env, TENANT_A);
+    const unpaidId = await makeBooking(env, TENANT_A);
+    await pay(env, TENANT_A, paidId, 30);
+    await pay(env, TENANT_A, paidId, 45);
+    const rows = await listBookingsForTenant(env.PAWBOOK_DB, TENANT_A);
+    expect(rows.find((r) => r.Id === paidId)?.PaidTotal).toBe(75);
+    expect(rows.find((r) => r.Id === unpaidId)?.PaidTotal).toBe(0);
+  });
+});
diff --git a/server/__tests__/payments-routes.test.ts b/server/__tests__/payments-routes.test.ts
new file mode 100644
index 0000000..91314d8
--- /dev/null
+++ b/server/__tests__/payments-routes.test.ts
@@ -0,0 +1,192 @@
+import { describe, expect, it } from 'vitest';
+import app from '../index';
+import { insertBookingRequest, insertPayment, updateBookingStatus } from '../db/repo';
+import { adminHeaders, createTestEnv, TENANT_A, TENANT_B } from './helpers';
+
+const makeBooking = (env: Env, tenantId: string, status: 'pending' | 'confirmed' = 'confirmed') =>
+  insertBookingRequest(env.PAWBOOK_DB, tenantId, {
+    endUserId: null,
+    serviceType: 'boarding',
+    startDate: '2030-01-01',
+    endDate: '2030-01-03',
+    optionKey: 'standard',
+    petType: 'dog',
+    petCount: 1,
+    estCost: 100,
+    status,
+  });
+
+const postPayment = async (env: Env, bookingId: string, body: unknown) =>
+  app.request(
+    `/api/sunny-paws/admin/bookings/${bookingId}/payments`,
+    {
+      method: 'POST',
+      headers: { ...(await adminHeaders(TENANT_A)), 'Content-Type': 'application/json' },
+      body: JSON.stringify(body),
+    },
+    env,
+  );
+
+const goodBody = { amount: 40, method: 'venmo', paidDate: '2026-07-11', note: 'deposit' };
+
+describe('admin payment routes', () => {
+  it('records a payment and returns it with the new paid total', async () => {
+    const { env } = createTestEnv();
+    const bookingId = await makeBooking(env, TENANT_A);
+    await insertPayment(env.PAWBOOK_DB, TENANT_A, {
+      bookingRequestId: bookingId,
+      amount: 10,
+      method: 'cash',
+      paidDate: '2026-07-01',
+      note: null,
+    });
+    const res = await postPayment(env, bookingId, goodBody);
+    expect(res.status).toBe(201);
+    const body = (await res.json()) as {
+      payment: {
+        id: string;
+        amount: number;
+        method: string;
+        paidDate: string;
+        note: string | null;
+      };
+      paidTotal: number;
+    };
+    expect(body.payment).toMatchObject({
+      amount: 40,
+      method: 'venmo',
+      paidDate: '2026-07-11',
+      note: 'deposit',
+    });
+    expect(body.paidTotal).toBe(50);
+  });
+
+  it('allows recording against a PENDING booking (deposits)', async () => {
+    const { env } = createTestEnv();
+    const bookingId = await makeBooking(env, TENANT_A, 'pending');
+    const res = await postPayment(env, bookingId, goodBody);
+    expect(res.status).toBe(201);
+  });
+
+  it('400s on a non-integer, zero, or missing amount', async () => {
+    const { env } = createTestEnv();
+    const bookingId = await makeBooking(env, TENANT_A);
+    for (const amount of [12.5, 0, -3, '40', undefined]) {
+      const res = await postPayment(env, bookingId, { ...goodBody, amount });
+      expect(res.status).toBe(400);
+    }
+  });
+
+  it('400s on an unknown payment method', async () => {
+    const { env } = createTestEnv();
+    const bookingId = await makeBooking(env, TENANT_A);
+    const res = await postPayment(env, bookingId, { ...goodBody, method: 'stripe' });
+    expect(res.status).toBe(400);
+  });
+
+  it('400s on an impossible calendar date (isRealDate, not just the regex)', async () => {
+    const { env } = createTestEnv();
+    const bookingId = await makeBooking(env, TENANT_A);
+    for (const paidDate of ['2026-02-30', '2026-13-01', 'not-a-date', undefined]) {
+      const res = await postPayment(env, bookingId, { ...goodBody, paidDate });
+      expect(res.status).toBe(400);
+    }
+  });
+
+  it('404s recording against a cancelled booking', async () => {
+    const { env } = createTestEnv();
+    const bookingId = await makeBooking(env, TENANT_A);
+    await updateBookingStatus(env.PAWBOOK_DB, TENANT_A, bookingId, 'cancelled');
+    expect((await postPayment(env, bookingId, goodBody)).status).toBe(404);
+  });
+
+  it('404s recording against a blocked sentinel row', async () => {
+    const { env } = createTestEnv();
+    const blockedId = await insertBookingRequest(env.PAWBOOK_DB, TENANT_A, {
+      endUserId: null,
+      serviceType: 'blocked',
+      startDate: '2030-02-01',
+      endDate: '2030-02-03',
+      optionKey: null,
+      petType: null,
+      petCount: 1,
+      estCost: null,
+      status: 'confirmed',
+    });
+    expect((await postPayment(env, blockedId, goodBody)).status).toBe(404);
+  });
+
+  it("404s recording against another tenant's booking", async () => {
+    const { env } = createTestEnv();
+    const foreignId = await makeBooking(env, TENANT_B);
+    expect((await postPayment(env, foreignId, goodBody)).status).toBe(404);
+  });
+
+  it("lists a booking's payments", async () => {
+    const { env } = createTestEnv();
+    const bookingId = await makeBooking(env, TENANT_A);
+    await postPayment(env, bookingId, goodBody);
+    const res = await app.request(
+      `/api/sunny-paws/admin/bookings/${bookingId}/payments`,
+      { headers: await adminHeaders(TENANT_A) },
+      env,
+    );
+    expect(res.status).toBe(200);
+    const body = (await res.json()) as { payments: { amount: number; method: string }[] };
+    expect(body.payments).toHaveLength(1);
+    expect(body.payments[0]).toMatchObject({ amount: 40, method: 'venmo' });
+  });
+
+  it('404s listing payments for a nonexistent booking', async () => {
+    const { env } = createTestEnv();
+    const res = await app.request(
+      '/api/sunny-paws/admin/bookings/nope/payments',
+      { headers: await adminHeaders(TENANT_A) },
+      env,
+    );
+    expect(res.status).toBe(404);
+  });
+
+  it('records a payment with an empty note as null', async () => {
+    const { env } = createTestEnv();
+    const bookingId = await makeBooking(env, TENANT_A);
+    const res = await postPayment(env, bookingId, { ...goodBody, note: '' });
+    expect(res.status).toBe(201);
+    const body = (await res.json()) as { payment: { note: string | null } };
+    expect(body.payment.note).toBeNull();
+  });
+
+  it('deletes a payment (204), 404s on repeat and on a booking/payment mismatch', async () => {
+    const { env } = createTestEnv();
+    const bookingId = await makeBooking(env, TENANT_A);
+    const otherBookingId = await makeBooking(env, TENANT_A);
+    const created = (await (await postPayment(env, bookingId, goodBody)).json()) as {
+      payment: { id: string };
+    };
+    const del = async (booking: string, payment: string) =>
+      app.request(
+        `/api/sunny-paws/admin/bookings/${booking}/payments/${payment}`,
+        { method: 'DELETE', headers: await adminHeaders(TENANT_A) },
+        env,
+      );
+    // Mismatched booking id in the URL: refused, nothing deleted.
+    expect((await del(otherBookingId, created.payment.id)).status).toBe(404);
+    expect((await del(bookingId, created.payment.id)).status).toBe(204);
+    expect((await del(bookingId, created.payment.id)).status).toBe(404);
+  });
+
+  it('the bookings list carries paidTotal', async () => {
+    const { env } = createTestEnv();
+    const bookingId = await makeBooking(env, TENANT_A);
+    await postPayment(env, bookingId, goodBody);
+    const res = await app.request(
+      '/api/sunny-paws/admin/bookings',
+      { headers: await adminHeaders(TENANT_A) },
+      env,
+    );
+    const body = (await res.json()) as { bookings: { id: string; paidTotal: number }[] };
+    expect(body.bookings.find((b) => b.id === bookingId)?.paidTotal).toBe(40);
+    // Seeded unpaid booking reports 0, not null/undefined.
+    expect(body.bookings.find((b) => b.id === 'seed_sp_board1')?.paidTotal).toBe(0);
+  });
+});
diff --git a/server/__tests__/services.test.ts b/server/__tests__/services.test.ts
index 2b9ebb1..d50686b 100644
--- a/server/__tests__/services.test.ts
+++ b/server/__tests__/services.test.ts
@@ -1,25 +1,32 @@
 import { describe, expect, it } from 'vitest';
 import {
   PET_TYPES,
-  SERVICE_CATALOG,
-  SERVICE_TYPES,
+  SERVICE_TEMPLATES,
+  TEMPLATE_IDS,
   isPetType,
-  isServiceType,
+  isTemplateId,
+  slugifyServiceLabel,
 } from '../lib/services';
 
-describe('service catalog', () => {
-  it('lists all five services with a shape and rate unit', () => {
-    expect(SERVICE_TYPES).toEqual(['boarding', 'housesitting', 'daycare', 'walk', 'checkin']);
-    expect(SERVICE_CATALOG.boarding.shape).toBe('range');
-    expect(SERVICE_CATALOG.walk.shape).toBe('single');
-    expect(SERVICE_CATALOG.daycare.rateUnit).toBe('day');
-    expect(SERVICE_CATALOG.walk.hasDuration).toBe(true);
-    expect(SERVICE_CATALOG.boarding.hasDuration).toBe(false);
+describe('service templates', () => {
+  it('lists all five templates with a shape and rate unit', () => {
+    expect(TEMPLATE_IDS).toEqual(['boarding', 'housesitting', 'daycare', 'walk', 'checkin']);
+    expect(SERVICE_TEMPLATES.boarding.shape).toBe('range');
+    expect(SERVICE_TEMPLATES.walk.shape).toBe('single');
+    expect(SERVICE_TEMPLATES.daycare.rateUnit).toBe('day');
+    expect(SERVICE_TEMPLATES.walk.hasDuration).toBe(true);
+    expect(SERVICE_TEMPLATES.boarding.hasDuration).toBe(false);
+  });
+
+  it('pins each template to a capacity pool', () => {
+    expect(SERVICE_TEMPLATES.boarding.capacityKind).toBe('boarding');
+    expect(SERVICE_TEMPLATES.housesitting.capacityKind).toBe('housesit');
+    expect(SERVICE_TEMPLATES.walk.capacityKind).toBe('none');
   });
 
   it('guards membership', () => {
-    expect(isServiceType('walk')).toBe(true);
-    expect(isServiceType('teleport')).toBe(false);
+    expect(isTemplateId('walk')).toBe(true);
+    expect(isTemplateId('teleport')).toBe(false);
     expect(isPetType('dog')).toBe(true);
     expect(isPetType('dragon')).toBe(false);
   });
@@ -28,3 +35,15 @@ describe('service catalog', () => {
     expect(PET_TYPES).toEqual(['dog', 'cat']);
   });
 });
+
+describe('slugifyServiceLabel', () => {
+  it('derives slugs from labels', () => {
+    expect(slugifyServiceLabel('Morning Walk!')).toBe('morning-walk');
+    expect(slugifyServiceLabel('  Café & Cuddles  ')).toBe('caf-cuddles');
+  });
+
+  it('returns empty for labels with no derivable identity', () => {
+    expect(slugifyServiceLabel('---')).toBe('');
+    expect(slugifyServiceLabel('!!!')).toBe('');
+  });
+});
diff --git a/server/db/repo.ts b/server/db/repo.ts
index 163a6ec..de8d632 100644
--- a/server/db/repo.ts
+++ b/server/db/repo.ts
@@ -1,7 +1,9 @@
 import type {
+  AnalyticsData,
   BookingRow,
   EndUser,
   EndUserPet,
+  PaymentRow,
   PetType,
   ProviderConnection,
   ProviderConnectionWithTokens,
@@ -11,7 +13,8 @@ import type {
   TenantServiceOption,
   TenantUser,
 } from '../types';
-import type { ServiceType } from '../lib/services';
+import type { CapacityKind, RateUnit, ServiceShape, ServiceType } from '../lib/services';
+import type { PaymentMethod } from '../lib/validation';
 import type { ServiceQuestion } from '../../src/shared/index.js';
 import { constantTimeEqual } from '../lib/timing';
 
@@ -26,7 +29,7 @@ const TENANT_COLS =
   'Id, Slug, DisplayName, AccentColor, MaxBoardingPets, MaxHouseSitsPerDay, MaxStayNights, Timezone, ContactEmail, ContactPhone';
 
 const BOOKING_COLS =
-  'Id, TenantId, EndUserId, ServiceType, StartDate, EndDate, StartTime, OptionKey, PetType, PetCount, EstCost, GCalEventId, Status, CreatedAt';
+  'Id, TenantId, EndUserId, ServiceType, StartDate, EndDate, StartTime, OptionKey, PetType, PetCount, EstCost, GCalEventId, Status, Declined, CreatedAt';
 
 /** BOOKING_COLS, table-qualified — needed once a query joins BookingRequests against another
  * table (EndUsers) that shares column names like Id/TenantId, which would otherwise be ambiguous. */
@@ -62,14 +65,79 @@ export async function getTenantUserByEmail(
 export async function listServices(db: D1Database, tenantId: string): Promise<TenantService[]> {
   const { results } = await db
     .prepare(
-      `SELECT TenantId, ServiceType, Enabled, Questions, MinNights, MaxNights, MinPetCount, MaxPetCount
-       FROM TenantServices WHERE TenantId = ?`,
+      `SELECT TenantId, ServiceType, Enabled, Label, Icon, Shape, RateUnit, HasDuration, CapacityKind,
+              SortOrder, Questions, MinNights, MaxNights, MinPetCount, MaxPetCount
+       FROM TenantServices WHERE TenantId = ? ORDER BY SortOrder, Label`,
     )
     .bind(tenantId)
     .all<Omit<TenantService, 'Questions'> & { Questions: string }>();
   return results.map((r) => ({ ...r, Questions: JSON.parse(r.Questions) as ServiceQuestion[] }));
 }
 
+/** Create a service from template-derived behavior. Callers validate slug/template beforehand. */
+export async function createService(
+  db: D1Database,
+  tenantId: string,
+  svc: {
+    serviceType: string;
+    label: string;
+    icon: string;
+    shape: ServiceShape;
+    rateUnit: RateUnit;
+    hasDuration: boolean;
+    capacityKind: CapacityKind;
+    sortOrder: number;
+  },
+): Promise<void> {
+  await db
+    .prepare(
+      `INSERT INTO TenantServices
+         (TenantId, ServiceType, Enabled, Label, Icon, Shape, RateUnit, HasDuration, CapacityKind, SortOrder)
+       VALUES (?, ?, 0, ?, ?, ?, ?, ?, ?, ?)`,
+    )
+    .bind(
+      tenantId,
+      svc.serviceType,
+      svc.label,
+      svc.icon,
+      svc.shape,
+      svc.rateUnit,
+      svc.hasDuration ? 1 : 0,
+      svc.capacityKind,
+      svc.sortOrder,
+    )
+    .run();
+}
+
+/** Delete a service and its options in one atomic batch. Callers enforce the no-bookings guard. */
+export async function deleteService(
+  db: D1Database,
+  tenantId: string,
+  serviceType: string,
+): Promise<void> {
+  await db.batch([
+    db
+      .prepare('DELETE FROM TenantServiceOptions WHERE TenantId = ? AND ServiceType = ?')
+      .bind(tenantId, serviceType),
+    db
+      .prepare('DELETE FROM TenantServices WHERE TenantId = ? AND ServiceType = ?')
+      .bind(tenantId, serviceType),
+  ]);
+}
+
+/** Bookings of ANY status referencing the slug — history included, so deletion never orphans it. */
+export async function countBookingsForService(
+  db: D1Database,
+  tenantId: string,
+  serviceType: string,
+): Promise<number> {
+  const row = await db
+    .prepare('SELECT COUNT(*) AS n FROM BookingRequests WHERE TenantId = ? AND ServiceType = ?')
+    .bind(tenantId, serviceType)
+    .first<{ n: number }>();
+  return row?.n ?? 0;
+}
+
 export async function listServiceOptions(
   db: D1Database,
   tenantId: string,
@@ -151,10 +219,14 @@ export async function consumeLoginCode(
   return row.EndUserId;
 }
 
+/** A booking row joined with its service's capacity pool (null for 'blocked' sentinel rows). */
+export type CapacityRow = BookingRow & { CapacityKind: Exclude<CapacityKind, 'none'> | null };
+
 /**
- * Rows that feed the capacity map: boarding + house-sitting + blocked, pending or confirmed,
- * overlapping [from, to). `excludeId` omits one row — used by the post-insert race check so a
- * just-created booking re-asks "do I still fit, ignoring myself?" against everyone else.
+ * Rows that feed the capacity map: bookings whose service draws from a capacity pool
+ * (CapacityKind boarding/housesit — custom services included) + blocked ranges, pending or
+ * confirmed, overlapping [from, to). `excludeId` omits one row — used by the post-insert race
+ * check so a just-created booking re-asks "do I still fit, ignoring myself?" against everyone else.
  */
 export async function listCapacityRows(
   db: D1Database,
@@ -162,18 +234,22 @@ export async function listCapacityRows(
   fromDate: string,
   toDateExclusive: string,
   excludeId?: string,
-): Promise<BookingRow[]> {
+): Promise<CapacityRow[]> {
+  const cols = BOOKING_COLS.split(', ')
+    .map((c) => `b.${c}`)
+    .join(', ');
   const { results } = await db
     .prepare(
-      `SELECT ${BOOKING_COLS}
-       FROM BookingRequests
-       WHERE TenantId = ? AND Status IN ('pending', 'confirmed')
-         AND ServiceType IN ('boarding', 'housesitting', 'blocked')
-         AND StartDate < ? AND COALESCE(EndDate, StartDate) >= ?
-         AND (? IS NULL OR Id != ?)`,
+      `SELECT ${cols}, s.CapacityKind
+       FROM BookingRequests b
+       LEFT JOIN TenantServices s ON s.TenantId = b.TenantId AND s.ServiceType = b.ServiceType
+       WHERE b.TenantId = ? AND b.Status IN ('pending', 'confirmed')
+         AND (b.ServiceType = 'blocked' OR s.CapacityKind IN ('boarding', 'housesit'))
+         AND b.StartDate < ? AND COALESCE(b.EndDate, b.StartDate) >= ?
+         AND (? IS NULL OR b.Id != ?)`,
     )
     .bind(tenantId, toDateExclusive, fromDate, excludeId ?? null, excludeId ?? null)
-    .all<BookingRow>();
+    .all<CapacityRow>();
   return results;
 }
 
@@ -324,24 +400,29 @@ export async function listBookingsForUser(
 /**
  * All non-blocked bookings for the sitter's admin list, newest-first, with the customer's
  * Email/Name joined in (NULL for a booking whose customer was later removed — EndUserId only
- * ever points at a row in the SAME tenant, enforced by how bookings are created).
+ * ever points at a row in the SAME tenant, enforced by how bookings are created), plus the
+ * total paid so far (0 for bookings with no payments).
  */
 export async function listBookingsForTenant(
   db: D1Database,
   tenantId: string,
-): Promise<(BookingRow & { Email: string | null; Name: string | null })[]> {
+): Promise<(BookingRow & { Email: string | null; Name: string | null; PaidTotal: number })[]> {
   const { results } = await db
     .prepare(
-      `SELECT ${BOOKING_COLS_QUALIFIED}, BookingRequests.Declined AS Declined,
-              EndUsers.Email AS Email, EndUsers.Name AS Name
+      `SELECT ${BOOKING_COLS_QUALIFIED}, EndUsers.Email AS Email, EndUsers.Name AS Name,
+              COALESCE(paid.Total, 0) AS PaidTotal
        FROM BookingRequests
        LEFT JOIN EndUsers ON EndUsers.Id = BookingRequests.EndUserId
          AND EndUsers.TenantId = BookingRequests.TenantId
+       LEFT JOIN (
+         SELECT BookingRequestId, SUM(Amount) AS Total
+         FROM Payments WHERE TenantId = ? GROUP BY BookingRequestId
+       ) paid ON paid.BookingRequestId = BookingRequests.Id
        WHERE BookingRequests.TenantId = ? AND BookingRequests.ServiceType != 'blocked'
        ORDER BY BookingRequests.StartDate DESC, BookingRequests.CreatedAt DESC`,
     )
-    .bind(tenantId)
-    .all<BookingRow & { Email: string | null; Name: string | null }>();
+    .bind(tenantId, tenantId)
+    .all<BookingRow & { Email: string | null; Name: string | null; PaidTotal: number }>();
   return results;
 }
 
@@ -398,6 +479,174 @@ export async function getBookingWithCustomer(
     .first<BookingRow & { Email: string | null; Name: string | null }>();
 }
 
+/**
+ * Record a payment iff the booking exists for THIS tenant, is not a 'blocked' sentinel, and is
+ * not cancelled — the guard lives in the SQL (INSERT ... SELECT ... WHERE) so it is atomic with
+ * the write, like updateBookingStatus's guarded UPDATE. 'pending' is deliberately allowed:
+ * deposits are commonly collected before a booking is confirmed. Returns the new payment id, or
+ * null when the guard refused (route 404s on null, the existing idiom).
+ */
+export async function insertPayment(
+  db: D1Database,
+  tenantId: string,
+  payment: {
+    bookingRequestId: string;
+    amount: number;
+    method: PaymentMethod;
+    paidDate: string;
+    note: string | null;
+  },
+): Promise<string | null> {
+  const id = crypto.randomUUID();
+  const result = await db
+    .prepare(
+      `INSERT INTO Payments (Id, TenantId, BookingRequestId, Amount, Method, PaidDate, Note)
+       SELECT ?, ?, ?, ?, ?, ?, ?
+       FROM BookingRequests
+       WHERE TenantId = ? AND Id = ? AND ServiceType != 'blocked' AND Status != 'cancelled'`,
+    )
+    .bind(
+      id,
+      tenantId,
+      payment.bookingRequestId,
+      payment.amount,
+      payment.method,
+      payment.paidDate,
+      payment.note,
+      tenantId,
+      payment.bookingRequestId,
+    )
+    .run();
+  return (result.meta as { changes?: number }).changes !== 0 ? id : null;
+}
+
+/**
+ * Delete one payment. The WHERE includes BookingRequestId so a payment id paired with the wrong
+ * booking id in the URL reports false (route 404s) instead of silently deleting. Deliberately NO
+ * booking-status guard — deleting the record is the only correction mechanism for refunds, so it
+ * must work on cancelled bookings too (see the design's Non-goals).
+ */
+export async function deletePayment(
+  db: D1Database,
+  tenantId: string,
+  bookingRequestId: string,
+  paymentId: string,
+): Promise<boolean> {
+  const result = await db
+    .prepare('DELETE FROM Payments WHERE TenantId = ? AND BookingRequestId = ? AND Id = ?')
+    .bind(tenantId, bookingRequestId, paymentId)
+    .run();
+  return (result.meta as { changes?: number }).changes !== 0;
+}
+
+export async function listPaymentsForBooking(
+  db: D1Database,
+  tenantId: string,
+  bookingRequestId: string,
+): Promise<PaymentRow[]> {
+  const { results } = await db
+    .prepare(
+      `SELECT Id, TenantId, BookingRequestId, Amount, Method, PaidDate, Note, CreatedAt
+       FROM Payments WHERE TenantId = ? AND BookingRequestId = ?
+       ORDER BY PaidDate DESC, CreatedAt DESC`,
+    )
+    .bind(tenantId, bookingRequestId)
+    .all<PaymentRow>();
+  return results;
+}
+
+/**
+ * The four earnings aggregates in one round trip (Promise.all over indexed SELECTs — no KV
+ * caching; revisit only if it measurably drags). `today` ('YYYY-MM-DD', tenant-timezone at the
+ * route) anchors the 12-month window; months with no payments are zero-filled here in JS.
+ * Revenue queries count payments regardless of the booking's later status — cash already
+ * received is real revenue; only `outstanding` filters to confirmed (and skips EstCost IS NULL:
+ * a booking with no estimate has no computable balance).
+ */
+export async function getAnalytics(
+  db: D1Database,
+  tenantId: string,
+  today: string,
+): Promise<AnalyticsData> {
+  // Last 12 calendar months ending with today's month, oldest first (e.g. '2025-08'..'2026-07').
+  const [y, m] = today.split('-').map(Number);
+  const months: string[] = [];
+  for (let i = 11; i >= 0; i--) {
+    const d = new Date(Date.UTC(y, m - 1 - i, 1));
+    months.push(`${d.getUTCFullYear()}-${String(d.getUTCMonth() + 1).padStart(2, '0')}`);
+  }
+  const windowStart = `${months[0]}-01`;
+  // Exclusive upper bound: first day of the month AFTER today's month. Without it, a future-dated
+  // payment (post-dated deposit, clock skew) would be summed into `Total` by SQL then discarded by
+  // the zero-fill map below since its month key isn't in `months` — silently dropping real revenue
+  // from the response instead of excluding it up front.
+  const nextMonth = new Date(Date.UTC(y, m, 1));
+  const windowEnd = `${nextMonth.getUTCFullYear()}-${String(nextMonth.getUTCMonth() + 1).padStart(2, '0')}-01`;
+
+  const [monthlyRes, byServiceRes, topClientsRes, outstandingRes] = await Promise.all([
+    db
+      .prepare(
+        `SELECT substr(PaidDate, 1, 7) AS Month, SUM(Amount) AS Total
+         FROM Payments WHERE TenantId = ? AND PaidDate >= ? AND PaidDate < ?
+         GROUP BY Month`,
+      )
+      .bind(tenantId, windowStart, windowEnd)
+      .all<AnalyticsData['monthly'][number]>(),
+    db
+      .prepare(
+        `SELECT b.ServiceType AS ServiceType, COALESCE(s.Label, b.ServiceType) AS Label,
+                SUM(p.Amount) AS Total
+         FROM Payments p
+         JOIN BookingRequests b ON b.Id = p.BookingRequestId AND b.TenantId = p.TenantId
+         LEFT JOIN TenantServices s ON s.TenantId = p.TenantId AND s.ServiceType = b.ServiceType
+         WHERE p.TenantId = ?
+         GROUP BY b.ServiceType
+         ORDER BY Total DESC`,
+      )
+      .bind(tenantId)
+      .all<AnalyticsData['byService'][number]>(),
+    db
+      .prepare(
+        `SELECT b.EndUserId AS EndUserId, u.Name AS Name, u.Email AS Email,
+                SUM(p.Amount) AS Total, COUNT(DISTINCT p.BookingRequestId) AS Bookings
+         FROM Payments p
+         JOIN BookingRequests b ON b.Id = p.BookingRequestId AND b.TenantId = p.TenantId
+         LEFT JOIN EndUsers u ON u.Id = b.EndUserId AND u.TenantId = b.TenantId
+         WHERE p.TenantId = ? AND b.EndUserId IS NOT NULL
+         GROUP BY b.EndUserId
+         ORDER BY Total DESC
+         LIMIT 10`,
+      )
+      .bind(tenantId)
+      .all<AnalyticsData['topClients'][number]>(),
+    db
+      .prepare(
+        `SELECT b.Id AS BookingId, u.Name AS Name, u.Email AS Email,
+                b.ServiceType AS ServiceType, b.StartDate AS StartDate,
+                b.EstCost AS EstCost, COALESCE(paid.Total, 0) AS PaidTotal
+         FROM BookingRequests b
+         LEFT JOIN EndUsers u ON u.Id = b.EndUserId AND u.TenantId = b.TenantId
+         LEFT JOIN (
+           SELECT BookingRequestId, SUM(Amount) AS Total
+           FROM Payments WHERE TenantId = ? GROUP BY BookingRequestId
+         ) paid ON paid.BookingRequestId = b.Id
+         WHERE b.TenantId = ? AND b.Status = 'confirmed' AND b.ServiceType != 'blocked'
+           AND b.EstCost IS NOT NULL AND COALESCE(paid.Total, 0) < b.EstCost
+         ORDER BY b.EstCost - COALESCE(paid.Total, 0) DESC`,
+      )
+      .bind(tenantId, tenantId)
+      .all<AnalyticsData['outstanding'][number]>(),
+  ]);
+
+  const byMonth = new Map(monthlyRes.results.map((r) => [r.Month, r.Total]));
+  return {
+    monthly: months.map((month) => ({ Month: month, Total: byMonth.get(month) ?? 0 })),
+    byService: byServiceRes.results,
+    topClients: topClientsRes.results,
+    outstanding: outstandingRes.results,
+  };
+}
+
 export async function listProviderConnections(
   db: D1Database,
   tenantId: string,
@@ -457,6 +706,11 @@ export async function updateTenantSettings(
     .run();
 }
 
+/**
+ * UPDATE-only: service rows are created explicitly (createService / seed / migration backfill).
+ * Returns false if no row matched (e.g. the service was deleted concurrently) — callers must not
+ * treat that as success, since a matching TenantServiceOptions write right after would orphan.
+ */
 export async function setServiceConfig(
   db: D1Database,
   tenantId: string,
@@ -469,26 +723,25 @@ export async function setServiceConfig(
     minPetCount: number | null;
     maxPetCount: number | null;
   },
-): Promise<void> {
-  await db
+): Promise<boolean> {
+  const result = await db
     .prepare(
-      `INSERT INTO TenantServices (TenantId, ServiceType, Enabled, Questions, MinNights, MaxNights, MinPetCount, MaxPetCount)
-       VALUES (?, ?, ?, ?, ?, ?, ?, ?)
-       ON CONFLICT (TenantId, ServiceType) DO UPDATE SET
-         Enabled = excluded.Enabled, Questions = excluded.Questions, MinNights = excluded.MinNights,
-         MaxNights = excluded.MaxNights, MinPetCount = excluded.MinPetCount, MaxPetCount = excluded.MaxPetCount`,
+      `UPDATE TenantServices SET
+         Enabled = ?, Questions = ?, MinNights = ?, MaxNights = ?, MinPetCount = ?, MaxPetCount = ?
+       WHERE TenantId = ? AND ServiceType = ?`,
     )
     .bind(
-      tenantId,
-      serviceType,
       config.enabled ? 1 : 0,
       JSON.stringify(config.questions),
       config.minNights,
       config.maxNights,
       config.minPetCount,
       config.maxPetCount,
+      tenantId,
+      serviceType,
     )
     .run();
+  return result.meta.changes > 0;
 }
 
 export async function replaceServiceOptions(
@@ -577,6 +830,29 @@ export async function deleteBlockedRange(
   return (result.meta as { changes?: number }).changes !== 0;
 }
 
+/**
+ * Ids of bookings synced to Calendar and not yet cancelled, bounded to [fromDate, toDateExclusive)
+ * — reconciliation's candidate set, restricted to the same window it queried Calendar for (a
+ * booking outside that window couldn't possibly have appeared in the Calendar response, so it must
+ * never be treated as "missing").
+ */
+export async function listSyncedBookingIds(
+  db: D1Database,
+  tenantId: string,
+  fromDate: string,
+  toDateExclusive: string,
+): Promise<string[]> {
+  const { results } = await db
+    .prepare(
+      `SELECT Id FROM BookingRequests
+       WHERE TenantId = ? AND GCalEventId IS NOT NULL AND Status != 'cancelled'
+         AND StartDate < ? AND COALESCE(EndDate, StartDate) >= ?`,
+    )
+    .bind(tenantId, toDateExclusive, fromDate)
+    .all<{ Id: string }>();
+  return results.map((r) => r.Id);
+}
+
 export async function getProviderConnection(
   db: D1Database,
   tenantId: string,
diff --git a/server/lib/availability.ts b/server/lib/availability.ts
index f94246c..7d6b532 100644
--- a/server/lib/availability.ts
+++ b/server/lib/availability.ts
@@ -15,9 +15,9 @@ import {
   countSlotBookings,
   listSlotBookingCounts,
   listUserBookingDatesInRange,
+  type CapacityRow,
 } from '../db/repo';
-import { SERVICE_CATALOG, type ServiceType } from '../lib/services';
-import type { BookingRow, Tenant, TenantServiceOption } from '../types';
+import type { Tenant, TenantService, TenantServiceOption } from '../types';
 
 /**
  * Per-tenant availability built on the shared capacity engine. The tenant's nullable config
@@ -30,14 +30,14 @@ function tenantLimits(tenant: Tenant): CapacityLimits {
   };
 }
 
-export function rowsToCapacityEvents(rows: BookingRow[]): CapacityEvent[] {
+export function rowsToCapacityEvents(rows: CapacityRow[]): CapacityEvent[] {
   return rows.map((row) => ({
     start_date: row.StartDate,
     end_date: row.EndDate ?? undefined,
     type:
       row.ServiceType === 'blocked'
         ? 'blocked'
-        : row.ServiceType === 'housesitting'
+        : row.CapacityKind === 'housesit'
           ? 'house-sit'
           : 'boarding',
     petCount: row.PetCount,
@@ -54,30 +54,31 @@ export type AvailabilityResult =
  * already know the dates can price a booking without a capacity read.
  */
 export function estimateCost(
-  serviceType: ServiceType,
+  service: TenantService,
   option: TenantServiceOption,
   startDate: string,
   endDateExclusive: string,
 ): number {
-  if (SERVICE_CATALOG[serviceType].shape !== 'range') return option.Rate;
+  if (service.Shape !== 'range') return option.Rate;
   return option.Rate * billableUnits(nightsBetween(startDate, endDateExclusive), 'night');
 }
 
-function serviceTypeToCapacityType(t: string): 'boarding' | 'house-sit' {
-  return t === 'housesitting' ? 'house-sit' : 'boarding';
+/** Range services always draw from a pool (templates pin range ⇒ boarding|housesit). */
+function capacityKindToRequestType(kind: TenantService['CapacityKind']): 'boarding' | 'house-sit' {
+  return kind === 'housesit' ? 'house-sit' : 'boarding';
 }
 
 async function checkRange(
   env: Env,
   tenant: Tenant,
-  serviceType: ServiceType,
+  service: TenantService,
   option: TenantServiceOption,
   startDate: string,
   endDateExclusive: string,
   petCount: number,
   excludeBookingId?: string,
 ): Promise<AvailabilityResult> {
-  const requestType = serviceTypeToCapacityType(serviceType);
+  const requestType = capacityKindToRequestType(service.CapacityKind);
   const limits = tenantLimits(tenant);
   // The engine (rangeHasConflict) already rejects an over-cap boarding request on its own. This
   // fast path is kept purely for UX + cost: it returns a SPECIFIC "exceeds capacity" reason (vs the
@@ -104,7 +105,7 @@ async function checkRange(
   }
   return {
     available: true,
-    estCost: estimateCost(serviceType, option, startDate, endDateExclusive),
+    estCost: estimateCost(service, option, startDate, endDateExclusive),
     nights: nightsBetween(startDate, endDateExclusive),
   };
 }
@@ -112,7 +113,7 @@ async function checkRange(
 async function checkSingle(
   env: Env,
   tenant: Tenant,
-  serviceType: ServiceType,
+  service: TenantService,
   option: TenantServiceOption,
   date: string,
   excludeBookingId?: string,
@@ -132,7 +133,7 @@ async function checkSingle(
     const count = await countSlotBookings(
       env.PAWBOOK_DB,
       tenant.Id,
-      serviceType,
+      service.ServiceType,
       option.OptionKey,
       date,
       excludeBookingId,
@@ -141,31 +142,31 @@ async function checkSingle(
       return { available: false, reason: 'That session is full.' };
     }
   }
-  return { available: true, estCost: estimateCost(serviceType, option, date, date) };
+  return { available: true, estCost: estimateCost(service, option, date, date) };
 }
 
 export function checkAvailability(
   env: Env,
   tenant: Tenant,
-  serviceType: ServiceType,
+  service: TenantService,
   option: TenantServiceOption,
   startDate: string,
   endDateExclusive: string,
   petCount = 1,
   excludeBookingId?: string,
 ): Promise<AvailabilityResult> {
-  return SERVICE_CATALOG[serviceType].shape === 'range'
+  return service.Shape === 'range'
     ? checkRange(
         env,
         tenant,
-        serviceType,
+        service,
         option,
         startDate,
         endDateExclusive,
         petCount,
         excludeBookingId,
       )
-    : checkSingle(env, tenant, serviceType, option, startDate, excludeBookingId);
+    : checkSingle(env, tenant, service, option, startDate, excludeBookingId);
 }
 
 export type MonthDay = {
@@ -185,7 +186,7 @@ export type MonthDay = {
 export async function monthAvailability(
   env: Env,
   tenant: Tenant,
-  serviceType: ServiceType,
+  service: TenantService,
   month: string, // YYYY-MM
   callerEndUserId: string,
   option: TenantServiceOption | null = null,
@@ -200,9 +201,7 @@ export async function monthAvailability(
   const monthEndExclusive = addDays(lastDay, 1);
 
   const requestType: 'boarding' | 'house-sit' | null =
-    serviceType === 'housesitting' || serviceType === 'boarding'
-      ? serviceTypeToCapacityType(serviceType)
-      : null;
+    service.CapacityKind === 'none' ? null : capacityKindToRequestType(service.CapacityKind);
 
   // Slot capacity is fetched ONCE for the whole grid (not per day), matching buildCapacity's
   // "build the map once" pattern, and run concurrently with the other D1 reads since none of
@@ -213,7 +212,7 @@ export async function monthAvailability(
       ? listSlotBookingCounts(
           env.PAWBOOK_DB,
           tenant.Id,
-          serviceType,
+          service.ServiceType,
           option!.OptionKey,
           monthStart,
           monthEndExclusive,
diff --git a/server/lib/calendar-sync.ts b/server/lib/calendar-sync.ts
index 6fc292a..f13f21c 100644
--- a/server/lib/calendar-sync.ts
+++ b/server/lib/calendar-sync.ts
@@ -1,12 +1,18 @@
-import { DEFAULT_TIMEZONE } from '../../src/shared/index.js';
+import { addDays, DEFAULT_TIMEZONE, getPacificDateStr } from '../../src/shared/index.js';
 import {
   getEndUserById,
   getProviderConnection,
+  listSyncedBookingIds,
   setBookingGCalEventId,
   setProviderTokens,
+  updateBookingStatus,
 } from '../db/repo';
-import { buildEventResource, createEvent, refreshAccessToken } from './google-calendar';
-import { SERVICE_CATALOG } from './services';
+import {
+  buildEventResource,
+  createEvent,
+  listCalendarEvents,
+  refreshAccessToken,
+} from './google-calendar';
 import type { ServiceType } from './services';
 import { decryptToken, encryptToken } from './token-crypto';
 import type { Tenant, ProviderConnectionWithTokens } from '../types';
@@ -14,7 +20,8 @@ import type { Tenant, ProviderConnectionWithTokens } from '../types';
 export type SyncInput = {
   bookingId: string;
   endUserId: string | null;
-  serviceType: ServiceType;
+  serviceType: ServiceType; // tenant service slug — stored as the event's category
+  serviceLabel: string;
   startDate: string;
   endDate: string | null;
   startTime: string | null;
@@ -61,7 +68,7 @@ export async function syncBookingToCalendar(env: Env, tenant: Tenant, b: SyncInp
     : null;
 
   const resource = buildEventResource({
-    serviceLabel: SERVICE_CATALOG[b.serviceType].label,
+    serviceLabel: b.serviceLabel,
     category: b.serviceType,
     bookingId: b.bookingId,
     startDate: b.startDate,
@@ -77,3 +84,56 @@ export async function syncBookingToCalendar(env: Env, tenant: Tenant, b: SyncInp
   const { id } = await createEvent(accessToken, conn.CalendarId ?? 'primary', resource);
   await setBookingGCalEventId(env.PAWBOOK_DB, tenant.Id, b.bookingId, id);
 }
+
+const CALENDAR_SYNC_TTL_SECONDS = 120;
+const calendarSyncKey = (tenantId: string) => `calendar-sync:${tenantId}:last`;
+
+/**
+ * Reconciles this tenant's synced bookings against Google Calendar: if a booking's event was
+ * deleted directly in Calendar (not through Pawbook), the booking is marked cancelled. Read-only
+ * against Google and strictly best-effort — a Calendar failure must never block the dashboard from
+ * returning current DB state, same philosophy as syncBookingToCalendar above.
+ */
+export async function reconcileBookingsWithCalendar(env: Env, tenant: Tenant): Promise<void> {
+  const conn = await getProviderConnection(env.PAWBOOK_DB, tenant.Id, 'calendar');
+  if (!conn || conn.Status !== 'connected' || !conn.AccessToken || !conn.RefreshToken) return;
+
+  const accessToken = await getCalendarAccessToken(env, tenant, conn);
+  const today = getPacificDateStr(new Date(), tenant.Timezone ?? DEFAULT_TIMEZONE);
+  const windowStart = addDays(today, -1);
+  const windowEndExclusive = addDays(today, 180);
+  const events = await listCalendarEvents(
+    accessToken,
+    conn.CalendarId ?? 'primary',
+    `${windowStart}T00:00:00Z`,
+    `${windowEndExclusive}T00:00:00Z`,
+  );
+  const liveBookingIds = new Set(events.map((e) => e.private.bookingId).filter(Boolean));
+
+  const candidates = await listSyncedBookingIds(
+    env.PAWBOOK_DB,
+    tenant.Id,
+    windowStart,
+    windowEndExclusive,
+  );
+  for (const id of candidates) {
+    if (!liveBookingIds.has(id)) {
+      await updateBookingStatus(env.PAWBOOK_DB, tenant.Id, id, 'cancelled');
+    }
+  }
+}
+
+/** Reconciles at most once per CALENDAR_SYNC_TTL_SECONDS per tenant, via PAWBOOK_CACHE. */
+export async function reconcileIfStale(env: Env, tenant: Tenant): Promise<void> {
+  const key = calendarSyncKey(tenant.Id);
+  if (await env.PAWBOOK_CACHE.get(key).catch(() => null)) return;
+  try {
+    await reconcileBookingsWithCalendar(env, tenant);
+  } catch {
+    /* best-effort; the dashboard falls back to current DB state */
+  } finally {
+    await env.PAWBOOK_CACHE.put(key, '1', { expirationTtl: CALENDAR_SYNC_TTL_SECONDS }).catch(
+      () => {},
+    );
+  }
+}
diff --git a/server/lib/csv.ts b/server/lib/csv.ts
new file mode 100644
index 0000000..37ebb4f
--- /dev/null
+++ b/server/lib/csv.ts
@@ -0,0 +1,42 @@
+/**
+ * Minimal RFC4180-ish CSV row parser: splits on commas outside quotes, un-escapes `""` to `"`
+ * inside a quoted field. Not a general CSV library — this codebase's only CSV use is the fixed
+ * 4-column client/pet import format (see
+ * docs/superpowers/specs/2026-07-10-csv-client-import-design.md), so a small hand-rolled parser
+ * avoids a dependency for a narrow, well-defined need.
+ */
+export function parseCsvRows(text: string): string[][] {
+  if (text === '') return [];
+  const rows: string[][] = [];
+  const lines = text.split(/\r\n|\r|\n/);
+  for (const line of lines) {
+    const cells: string[] = [];
+    let cell = '';
+    let inQuotes = false;
+    for (let i = 0; i < line.length; i++) {
+      const ch = line[i];
+      if (inQuotes) {
+        if (ch === '"') {
+          if (line[i + 1] === '"') {
+            cell += '"';
+            i++;
+          } else {
+            inQuotes = false;
+          }
+        } else {
+          cell += ch;
+        }
+      } else if (ch === '"') {
+        inQuotes = true;
+      } else if (ch === ',') {
+        cells.push(cell);
+        cell = '';
+      } else {
+        cell += ch;
+      }
+    }
+    cells.push(cell);
+    rows.push(cells);
+  }
+  return rows;
+}
diff --git a/server/lib/google-calendar.ts b/server/lib/google-calendar.ts
index 639a6cd..eedef76 100644
--- a/server/lib/google-calendar.ts
+++ b/server/lib/google-calendar.ts
@@ -133,6 +133,13 @@ type EventResource = {
   extendedProperties?: { private: Record<string, string> };
 };
 
+export type CalendarEvent = {
+  summary: string;
+  start: string; // 'YYYY-MM-DD' (all-day) or the date part of a dateTime
+  end: string; // exclusive end date, same normalization
+  private: Record<string, string>; // extendedProperties.private, or {}
+};
+
 function addMinutesToLocal(date: string, time: string, minutes: number): string {
   // Treat the wall-clock value as UTC purely for arithmetic; the timeZone field carries the real
   // zone, so adding minutes here yields the correct local end time (even across an hour/day roll).
@@ -176,3 +183,43 @@ export function buildEventResource(b: CalendarBooking): EventResource {
     extendedProperties,
   };
 }
+export async function listCalendarEvents(
+  accessToken: string,
+  calendarId: string,
+  timeMinISO: string,
+  timeMaxISO: string,
+): Promise<CalendarEvent[]> {
+  const params = new URLSearchParams({
+    timeMin: timeMinISO,
+    timeMax: timeMaxISO,
+    singleEvents: 'true',
+    maxResults: '2500',
+    orderBy: 'startTime',
+  });
+  const res = await fetch(
+    `https://www.googleapis.com/calendar/v3/calendars/${encodeURIComponent(calendarId)}/events?${params.toString()}`,
+    { headers: { Authorization: `Bearer ${accessToken}` } },
+  );
+  if (!res.ok) throw new Error(`Google listCalendarEvents failed (${res.status})`);
+  const j = (await res.json()) as {
+    items: Array<{
+      summary?: string;
+      start: { date?: string; dateTime?: string };
+      end: { date?: string; dateTime?: string };
+      extendedProperties?: { private?: Record<string, string> };
+    }>;
+    nextPageToken?: string;
+  };
+  // We don't paginate (see module comment / caller docs) — a truncated result must never be
+  // treated as "these events don't exist," since callers use absence to infer deletion. Fail
+  // loudly instead so callers' existing best-effort error handling skips the operation.
+  if (j.nextPageToken) {
+    throw new Error('Google listCalendarEvents: result truncated (more than 2500 events in range)');
+  }
+  return (j.items ?? []).map((item) => ({
+    summary: item.summary ?? '',
+    start: item.start.date ?? item.start.dateTime?.slice(0, 10) ?? '',
+    end: item.end.date ?? item.end.dateTime?.slice(0, 10) ?? '',
+    private: item.extendedProperties?.private ?? {},
+  }));
+}
diff --git a/server/lib/services.ts b/server/lib/services.ts
index f21766a..39bf60f 100644
--- a/server/lib/services.ts
+++ b/server/lib/services.ts
@@ -1,40 +1,95 @@
 /**
- * Single source of truth for the service set and pet species. Every layer (schema CHECK lists,
- * validation, availability branching, widget rendering) derives from these constants instead of
- * repeating service-type string literals. `shape` decides availability + date inputs; `rateUnit`
- * decides cost display and the billable-units multiplier.
+ * Service TEMPLATES and pet species. Services themselves are per-tenant TenantServices rows —
+ * every row carries its own behavior (`Shape` decides availability + date inputs, `RateUnit`
+ * decides cost display, `CapacityKind` names the capacity POOL it draws from). Templates exist
+ * only to (a) seed new tenants' defaults and (b) back the admin "Add service" picker: creating
+ * a service clones a template's behavior permanently, so sitters never mix arbitrary combos.
  */
 
 export type ServiceShape = 'range' | 'single';
 export type RateUnit = 'night' | 'day' | 'visit';
+/** 'boarding' = pet-counted vs MaxBoardingPets; 'housesit' = day-counted vs MaxHouseSitsPerDay;
+ * 'none' = unlimited (blocked days only). Pool names, not service names. */
+export type CapacityKind = 'boarding' | 'housesit' | 'none';
 
-type CatalogEntry = {
+/** Service identifiers are per-tenant slugs now — validated against TenantServices rows, not an enum. */
+export type ServiceType = string;
+
+export type ServiceTemplate = {
   label: string;
+  icon: string;
   shape: ServiceShape;
   rateUnit: RateUnit;
   hasDuration: boolean;
+  capacityKind: CapacityKind;
 };
 
-export const SERVICE_CATALOG = {
-  boarding: { label: 'Boarding', shape: 'range', rateUnit: 'night', hasDuration: false },
-  housesitting: { label: 'House sitting', shape: 'range', rateUnit: 'night', hasDuration: false },
-  daycare: { label: 'Day care', shape: 'single', rateUnit: 'day', hasDuration: false },
-  walk: { label: 'Walks', shape: 'single', rateUnit: 'visit', hasDuration: true },
-  checkin: { label: 'Check-ins', shape: 'single', rateUnit: 'visit', hasDuration: true },
-} as const satisfies Record<string, CatalogEntry>;
+// Order is intentional (admin/widget render order); keep boarding first to match prior default.
+export const SERVICE_TEMPLATES = {
+  boarding: {
+    label: 'Boarding',
+    icon: 'bed',
+    shape: 'range',
+    rateUnit: 'night',
+    hasDuration: false,
+    capacityKind: 'boarding',
+  },
+  housesitting: {
+    label: 'House sitting',
+    icon: 'home',
+    shape: 'range',
+    rateUnit: 'night',
+    hasDuration: false,
+    capacityKind: 'housesit',
+  },
+  daycare: {
+    label: 'Day care',
+    icon: 'sun',
+    shape: 'single',
+    rateUnit: 'day',
+    hasDuration: false,
+    capacityKind: 'none',
+  },
+  walk: {
+    label: 'Walks',
+    icon: 'paw',
+    shape: 'single',
+    rateUnit: 'visit',
+    hasDuration: true,
+    capacityKind: 'none',
+  },
+  checkin: {
+    label: 'Check-ins',
+    icon: 'clipboard',
+    shape: 'single',
+    rateUnit: 'visit',
+    hasDuration: true,
+    capacityKind: 'none',
+  },
+} as const satisfies Record<string, ServiceTemplate>;
 
-export type ServiceType = keyof typeof SERVICE_CATALOG;
+export type TemplateId = keyof typeof SERVICE_TEMPLATES;
 
-// Order is intentional (admin/widget render order); keep boarding first to match prior default.
-export const SERVICE_TYPES = Object.keys(SERVICE_CATALOG) as ServiceType[];
+export const TEMPLATE_IDS = Object.keys(SERVICE_TEMPLATES) as TemplateId[];
 
-export const PET_TYPES = ['dog', 'cat'] as const;
-export type PetType = (typeof PET_TYPES)[number];
+export function isTemplateId(value: unknown): value is TemplateId {
+  return typeof value === 'string' && Object.hasOwn(SERVICE_TEMPLATES, value);
+}
+
+/** 'blocked' is a BookingRequests sentinel (admin time-off), never a bookable service slug. */
+export const RESERVED_SERVICE_SLUGS = ['blocked'];
 
-export function isServiceType(value: unknown): value is ServiceType {
-  return typeof value === 'string' && value in SERVICE_CATALOG;
+/** "Morning Walk!" → 'morning-walk'. Empty result = label has no derivable identity (reject it). */
+export function slugifyServiceLabel(label: string): string {
+  return label
+    .toLowerCase()
+    .replace(/[^a-z0-9]+/g, '-')
+    .replace(/^-+|-+$/g, '');
 }
 
+export const PET_TYPES = ['dog', 'cat'] as const;
+export type PetType = (typeof PET_TYPES)[number];
+
 export function isPetType(value: unknown): value is PetType {
   return typeof value === 'string' && (PET_TYPES as readonly string[]).includes(value);
 }
diff --git a/server/lib/validation.ts b/server/lib/validation.ts
index eabf582..48e4fb3 100644
--- a/server/lib/validation.ts
+++ b/server/lib/validation.ts
@@ -1,4 +1,13 @@
-import { DATE_RE, getPacificDateStr, nightsBetween } from '../../src/shared/index.js';
+import {
+  DATE_RE,
+  getPacificDateStr,
+  nightsBetween,
+  PAYMENT_METHODS,
+  isPaymentMethod,
+  type PaymentMethod,
+} from '../../src/shared/index.js';
+
+export { PAYMENT_METHODS, isPaymentMethod, type PaymentMethod };
 
 /**
  * Shared request-validation guards. `DATE_RE` alone accepts impossible dates ("2026-02-30"),
diff --git a/server/routes/admin.ts b/server/routes/admin.ts
index c76ef44..d5de0b8 100644
--- a/server/routes/admin.ts
+++ b/server/routes/admin.ts
@@ -4,18 +4,26 @@ import {
   addEndUserPet,
   clearProviderConnection,
   countBookingPetRefs,
+  countBookingsForService,
   countBookingsForUser,
+  createService,
+  getAnalytics,
   getBookingWithCustomer,
   getEndUserById,
+  getEndUserByEmail,
   deleteBlockedRange,
   deleteCustomer,
+  deletePayment,
+  deleteService,
   getProviderConnection,
   insertBookingRequest,
   insertInvitedCustomer,
+  insertPayment,
   listAllEndUserPetsByTenant,
   listBlockedRanges,
   listBookingsForTenant,
   listCustomers,
+  listPaymentsForBooking,
   listPetTypes,
   listProviderConnections,
   listServiceOptions,
@@ -29,12 +37,22 @@ import {
   updateTenantSettings,
 } from '../db/repo';
 import { isEmailConfigured, sendBookingStatusEmail, sendInvite } from '../lib/email';
+import { parseCsvRows } from '../lib/csv';
+import { reconcileIfStale } from '../lib/calendar-sync';
 import { buildAuthUrl, revokeToken } from '../lib/google-calendar';
 import { adminAuth } from '../lib/middleware';
 import { signState } from '../lib/oauth-state';
 import { calendarView } from '../lib/providers';
 import { embedSnippets } from '../lib/snippet';
-import { isPetType, isServiceType, PET_TYPES, SERVICE_CATALOG } from '../lib/services';
+import {
+  isPetType,
+  isTemplateId,
+  PET_TYPES,
+  RESERVED_SERVICE_SLUGS,
+  SERVICE_TEMPLATES,
+  slugifyServiceLabel,
+  TEMPLATE_IDS,
+} from '../lib/services';
 import { decryptToken } from '../lib/token-crypto';
 import { invalidateTenantCache } from '../lib/tenant-resolve';
 import { NONCE_KEY } from './oauth';
@@ -43,6 +61,7 @@ import {
   DEFENSIVE_MAX_PET_COUNT,
   EMAIL_RE,
   isNullableLimit,
+  isPaymentMethod,
   isRealDate,
   isValidDuration,
   isValidRate,
@@ -51,9 +70,18 @@ import {
 } from '../lib/validation';
 import type { AppEnv } from '../types';
 import type { ServiceQuestion } from '../../src/shared/index.js';
+import { getPacificDateStr } from '../../src/shared/index.js';
 
 const COLOR_RE = /^#[0-9a-fA-F]{6}$/;
 
+/**
+ * Each pet-bearing row triggers several sequential D1 calls; an unbounded import can exceed
+ * Workers' subrequest/CPU ceiling mid-loop, which aborts outside the per-row try/catch and
+ * returns a bare 500 with no partial-import report. Cap row count so oversized files fail fast
+ * with an actionable error instead of a platform crash.
+ */
+const MAX_IMPORT_ROWS = 500;
+
 /** null/undefined (use default) or a timezone Intl accepts. */
 function isValidTimezone(value: unknown): value is string | null | undefined {
   if (value === null || value === undefined) return true;
@@ -136,7 +164,7 @@ type ResolvedOption = {
  * Returns an error message, or the resolved rows ready to persist.
  */
 function resolveServiceOptions(
-  meta: (typeof SERVICE_CATALOG)[keyof typeof SERVICE_CATALOG],
+  meta: { hasDuration: boolean },
   serviceLabel: string,
   opts: OptionBody[],
   existingKeys: Set<string>,
@@ -306,7 +334,6 @@ export const adminRoutes = new Hono<AppEnv>()
       listBlockedRanges(c.env.PAWBOOK_DB, tenant.Id),
       listProviderConnections(c.env.PAWBOOK_DB, tenant.Id),
     ]);
-    const enabledByType = new Map(services.map((s) => [s.ServiceType, Boolean(s.Enabled)]));
     return c.json({
       displayName: tenant.DisplayName,
       accentColor: tenant.AccentColor,
@@ -320,33 +347,34 @@ export const adminRoutes = new Hono<AppEnv>()
         petType: pt,
         enabled: petTypes.some((p) => p.PetType === pt && p.Enabled),
       })),
-      services: Object.entries(SERVICE_CATALOG).map(([type, meta]) => {
-        const svc = services.find((s) => s.ServiceType === type);
-        return {
-          type,
-          label: meta.label,
-          hasDuration: meta.hasDuration,
-          rateUnit: meta.rateUnit,
-          shape: meta.shape,
-          enabled: enabledByType.get(type as keyof typeof SERVICE_CATALOG) ?? false,
-          questions: svc?.Questions ?? [],
-          minNights: svc?.MinNights ?? null,
-          maxNights: svc?.MaxNights ?? null,
-          minPetCount: svc?.MinPetCount ?? null,
-          maxPetCount: svc?.MaxPetCount ?? null,
-          options: options
-            .filter((o) => o.ServiceType === type)
-            .map((o) => ({
-              optionKey: o.OptionKey,
-              label: o.Label,
-              durationMinutes: o.DurationMinutes,
-              rate: o.Rate,
-              startTime: o.StartTime,
-              endTime: o.EndTime,
-              capacity: o.Capacity,
-            })), // optionKey round-trips back on save so resolveServiceOptions can preserve identity
-        };
-      }),
+      services: services.map((svc) => ({
+        type: svc.ServiceType,
+        label: svc.Label,
+        icon: svc.Icon,
+        hasDuration: Boolean(svc.HasDuration),
+        rateUnit: svc.RateUnit,
+        shape: svc.Shape,
+        custom: !isTemplateId(svc.ServiceType),
+        enabled: Boolean(svc.Enabled),
+        questions: svc.Questions,
+        minNights: svc.MinNights,
+        maxNights: svc.MaxNights,
+        minPetCount: svc.MinPetCount,
+        maxPetCount: svc.MaxPetCount,
+        options: options
+          .filter((o) => o.ServiceType === svc.ServiceType)
+          .map((o) => ({
+            optionKey: o.OptionKey,
+            label: o.Label,
+            durationMinutes: o.DurationMinutes,
+            rate: o.Rate,
+            startTime: o.StartTime,
+            endTime: o.EndTime,
+            capacity: o.Capacity,
+          })), // optionKey round-trips back on save so resolveServiceOptions can preserve identity
+      })),
+      // "Add service" picker: template id + display label of each built-in behavior archetype.
+      templates: TEMPLATE_IDS.map((id) => ({ id, label: SERVICE_TEMPLATES[id].label })),
       blocked: blocked.map((b) => ({ id: b.Id, startDate: b.StartDate, endDate: b.EndDate })),
       calendar: calendarView(connections),
     });
@@ -420,23 +448,24 @@ export const adminRoutes = new Hono<AppEnv>()
     }
     const resolvedOptionsByType = new Map<string, ResolvedOption[]>();
     for (const svc of services) {
-      if (!isServiceType(svc.type)) return c.json({ error: 'Unknown service type.' }, 400);
-      const meta = SERVICE_CATALOG[svc.type];
+      const meta = currentServices.find((s) => s.ServiceType === svc.type);
+      if (!meta) return c.json({ error: 'Unknown service type.' }, 400);
+      const hasDuration = Boolean(meta.HasDuration);
       const opts = svc.options ?? [];
       if (svc.enabled && opts.length === 0)
-        return c.json({ error: `${meta.label} needs at least one price option.` }, 400);
+        return c.json({ error: `${meta.Label} needs at least one price option.` }, 400);
       // Non-duration services derive every optionKey as 'standard', so more than one would collide
       // on the (TenantId, ServiceType, OptionKey) UNIQUE constraint mid-write. Reject up front.
-      if (!meta.hasDuration && opts.length > 1)
-        return c.json({ error: `${meta.label} takes a single price.` }, 400);
+      if (!hasDuration && opts.length > 1)
+        return c.json({ error: `${meta.Label} takes a single price.` }, 400);
       const resolvedOptions = resolveServiceOptions(
-        meta,
-        meta.label,
+        { hasDuration },
+        meta.Label,
         opts,
-        existingKeysByType.get(svc.type) ?? new Set(),
+        existingKeysByType.get(svc.type as string) ?? new Set(),
       );
       if ('error' in resolvedOptions) return c.json({ error: resolvedOptions.error }, 400);
-      resolvedOptionsByType.set(svc.type, resolvedOptions.resolved);
+      resolvedOptionsByType.set(svc.type as string, resolvedOptions.resolved);
       for (const q of svc.questions ?? []) {
         const qError = validateQuestionBody(q);
         if (qError) return c.json({ error: qError }, 400);
@@ -445,19 +474,19 @@ export const adminRoutes = new Hono<AppEnv>()
         !isNullableLimit(svc.minNights ?? null, DEFENSIVE_MAX_NIGHTS) ||
         !isNullableLimit(svc.maxNights ?? null, DEFENSIVE_MAX_NIGHTS)
       )
-        return c.json({ error: `${meta.label}: nights must be a positive number, or blank.` }, 400);
+        return c.json({ error: `${meta.Label}: nights must be a positive number, or blank.` }, 400);
       if (svc.minNights != null && svc.maxNights != null && svc.minNights > svc.maxNights)
-        return c.json({ error: `${meta.label}: min nights cannot exceed max nights.` }, 400);
+        return c.json({ error: `${meta.Label}: min nights cannot exceed max nights.` }, 400);
       if (
         !isNullableLimit(svc.minPetCount ?? null, DEFENSIVE_MAX_PET_COUNT) ||
         !isNullableLimit(svc.maxPetCount ?? null, DEFENSIVE_MAX_PET_COUNT)
       )
         return c.json(
-          { error: `${meta.label}: pet count must be a positive number, or blank.` },
+          { error: `${meta.Label}: pet count must be a positive number, or blank.` },
           400,
         );
       if (svc.minPetCount != null && svc.maxPetCount != null && svc.minPetCount > svc.maxPetCount)
-        return c.json({ error: `${meta.label}: min pets cannot exceed max pets.` }, 400);
+        return c.json({ error: `${meta.Label}: min pets cannot exceed max pets.` }, 400);
     }
 
     await updateTenantSettings(c.env.PAWBOOK_DB, tenant.Id, {
@@ -475,9 +504,9 @@ export const adminRoutes = new Hono<AppEnv>()
         await setPetTypeEnabled(c.env.PAWBOOK_DB, tenant.Id, pt, petTypes.includes(pt));
     }
     for (const svc of services) {
-      const svcType = svc.type as keyof typeof SERVICE_CATALOG;
-      const meta = SERVICE_CATALOG[svcType];
-      const current = currentServices.find((s) => s.ServiceType === svcType);
+      const svcType = svc.type as string;
+      // Validation above guarantees a matching row exists.
+      const current = currentServices.find((s) => s.ServiceType === svcType)!;
       const questions: ServiceQuestion[] =
         svc.questions !== undefined
           ? svc.questions.map((q) => ({
@@ -490,17 +519,19 @@ export const adminRoutes = new Hono<AppEnv>()
               ...(q.type === 'text' && q.pattern ? { pattern: q.pattern } : {}),
               ...(q.type === 'select' ? { options: q.options } : {}),
             }))
-          : (current?.Questions ?? []);
-      await setServiceConfig(c.env.PAWBOOK_DB, tenant.Id, svcType, {
+          : current.Questions;
+      const updated = await setServiceConfig(c.env.PAWBOOK_DB, tenant.Id, svcType, {
         enabled: svc.enabled ?? false,
         questions,
-        minNights: 'minNights' in svc ? (svc.minNights ?? null) : (current?.MinNights ?? null),
-        maxNights: 'maxNights' in svc ? (svc.maxNights ?? null) : (current?.MaxNights ?? null),
-        minPetCount:
-          'minPetCount' in svc ? (svc.minPetCount ?? null) : (current?.MinPetCount ?? null),
-        maxPetCount:
-          'maxPetCount' in svc ? (svc.maxPetCount ?? null) : (current?.MaxPetCount ?? null),
+        minNights: 'minNights' in svc ? (svc.minNights ?? null) : current.MinNights,
+        maxNights: 'maxNights' in svc ? (svc.maxNights ?? null) : current.MaxNights,
+        minPetCount: 'minPetCount' in svc ? (svc.minPetCount ?? null) : current.MinPetCount,
+        maxPetCount: 'maxPetCount' in svc ? (svc.maxPetCount ?? null) : current.MaxPetCount,
       });
+      // The service existed when validated above but was deleted by a concurrent request since —
+      // stop before writing options for a slug that no longer exists.
+      if (!updated)
+        return c.json({ error: `${current.Label} was deleted. Refresh and retry.` }, 409);
       await replaceServiceOptions(
         c.env.PAWBOOK_DB,
         tenant.Id,
@@ -510,7 +541,7 @@ export const adminRoutes = new Hono<AppEnv>()
           label: o.label,
           durationMinutes: o.durationMinutes,
           rate: o.rate,
-          rateUnit: meta.rateUnit,
+          rateUnit: current.RateUnit,
           startTime: o.startTime,
           endTime: o.endTime,
           capacity: o.capacity,
@@ -523,6 +554,65 @@ export const adminRoutes = new Hono<AppEnv>()
     return c.body(null, 204);
   })
 
+  // Create a custom service from a template. The template permanently fixes behavior (shape,
+  // rate unit, duration, capacity pool); the sitter picks only the name. Created disabled with
+  // no options — priced and enabled through the normal settings PUT, same as any service.
+  .post('/:slug/admin/services', async (c) => {
+    const tenant = c.get('tenant');
+    const body = await c.req
+      .json<{ template?: string; label?: string }>()
+      .catch(() => ({}) as Record<string, never>);
+    if (!isTemplateId(body.template)) return c.json({ error: 'Unknown template.' }, 400);
+    const label = typeof body.label === 'string' ? body.label.trim() : '';
+    if (!label) return c.json({ error: 'Service name required.' }, 400);
+    const slug = slugifyServiceLabel(label);
+    if (!slug || RESERVED_SERVICE_SLUGS.includes(slug))
+      return c.json({ error: 'Pick a different service name.' }, 400);
+
+    const existing = await listServices(c.env.PAWBOOK_DB, tenant.Id);
+    if (existing.some((s) => s.ServiceType === slug))
+      return c.json({ error: 'A service with that name already exists.' }, 400);
+
+    const tpl = SERVICE_TEMPLATES[body.template];
+    try {
+      await createService(c.env.PAWBOOK_DB, tenant.Id, {
+        serviceType: slug,
+        label,
+        icon: tpl.icon,
+        shape: tpl.shape,
+        rateUnit: tpl.rateUnit,
+        hasDuration: tpl.hasDuration,
+        capacityKind: tpl.capacityKind,
+        sortOrder: Math.max(0, ...existing.map((s) => s.SortOrder)) + 1,
+      });
+    } catch (err) {
+      // The listServices check above can't see a concurrent insert of the same slug — fall back
+      // to the DB's UNIQUE(TenantId, ServiceType) constraint as the source of truth.
+      if (err instanceof Error && err.message.includes('UNIQUE constraint failed'))
+        return c.json({ error: 'A service with that name already exists.' }, 400);
+      throw err;
+    }
+    await invalidateTenantCache(tenant.Slug, c.env);
+    return c.json({ type: slug, label, template: body.template }, 201);
+  })
+
+  // Delete a CUSTOM service. Built-ins are disabled, never deleted; a slug any booking row
+  // references (any status — history included) can't be removed.
+  .delete('/:slug/admin/services/:type', async (c) => {
+    const tenant = c.get('tenant');
+    const type = c.req.param('type');
+    const existing = await listServices(c.env.PAWBOOK_DB, tenant.Id);
+    const service = existing.find((s) => s.ServiceType === type);
+    if (!service) return c.json({ error: 'Unknown service type.' }, 404);
+    if (isTemplateId(type))
+      return c.json({ error: 'Built-in services can be disabled, not deleted.' }, 400);
+    if ((await countBookingsForService(c.env.PAWBOOK_DB, tenant.Id, type)) > 0)
+      return c.json({ error: 'That service has bookings — disable it instead.' }, 409);
+    await deleteService(c.env.PAWBOOK_DB, tenant.Id, type);
+    await invalidateTenantCache(tenant.Slug, c.env);
+    return c.body(null, 204);
+  })
+
   .post('/:slug/admin/blocked', async (c) => {
     const tenant = c.get('tenant');
     const body = await c.req
@@ -711,9 +801,112 @@ export const adminRoutes = new Hono<AppEnv>()
     if (!removed) return c.json({ error: 'Not found.' }, 404);
     return c.body(null, 204);
   })
+  .post('/:slug/admin/customers/import', async (c) => {
+    const tenant = c.get('tenant');
+    const body = await c.req
+      .json<{ csv?: unknown; sendInvites?: unknown }>()
+      .catch(() => ({}) as { csv?: unknown; sendInvites?: unknown });
+    const csv = typeof body.csv === 'string' ? body.csv : '';
+    const sendInvites = body.sendInvites === true;
+
+    const rows = parseCsvRows(csv).slice(1); // row 1 is the header
+    if (rows.length > MAX_IMPORT_ROWS) {
+      return c.json(
+        {
+          error: `This file has ${rows.length} rows; split it into files of ${MAX_IMPORT_ROWS} or fewer and import in batches.`,
+        },
+        400,
+      );
+    }
+    const petTypesEnabled = new Set(
+      (await listPetTypes(c.env.PAWBOOK_DB, tenant.Id))
+        .filter((pt) => pt.Enabled)
+        .map((pt) => pt.PetType),
+    );
+    const existingPetNames = new Map<string, Set<string>>();
+    for (const pet of await listAllEndUserPetsByTenant(c.env.PAWBOOK_DB, tenant.Id)) {
+      const set = existingPetNames.get(pet.EndUserId) ?? new Set<string>();
+      set.add(pet.Name.toLowerCase());
+      existingPetNames.set(pet.EndUserId, set);
+    }
+
+    let importedCustomers = 0;
+    let importedPets = 0;
+    let invitesSent = 0;
+    let invitesFailed = 0;
+    const skippedRows: { row: number; reason: string }[] = [];
+    const freshCustomers: string[] = [];
+
+    for (const [i, cells] of rows.entries()) {
+      const row = i + 2; // 1-indexed against the sitter's file; +1 since the header was sliced off
+      if (cells.length === 1 && cells[0] === '') continue; // blank line — not a real row
+      if (cells.length < 4) {
+        skippedRows.push({ row, reason: 'Could not parse this row' });
+        continue;
+      }
+      const [rawEmail, rawName, rawPetName, rawPetType] = cells;
+      const email = rawEmail.trim().toLowerCase();
+      if (!EMAIL_RE.test(email)) {
+        skippedRows.push({ row, reason: 'Invalid email address' });
+        continue;
+      }
+
+      try {
+        const existing = await getEndUserByEmail(c.env.PAWBOOK_DB, tenant.Id, email);
+        const name = rawName.trim() || null;
+        const customer = await insertInvitedCustomer(c.env.PAWBOOK_DB, tenant.Id, email, name);
+        if (!existing) {
+          importedCustomers++;
+          freshCustomers.push(email);
+        }
+
+        const petName = rawPetName.trim();
+        const petType = rawPetType.trim().toLowerCase();
+        if (!petName && !petType) continue; // client-only row
+        if (petName && !petType) {
+          skippedRows.push({ row, reason: 'Pet name given without a pet type' });
+          continue;
+        }
+        if (!petName && petType) {
+          skippedRows.push({ row, reason: 'Pet type given without a pet name' });
+          continue;
+        }
+        if (!isPetType(petType) || !petTypesEnabled.has(petType)) {
+          skippedRows.push({ row, reason: `'${rawPetType.trim()}' is not an enabled pet type` });
+          continue;
+        }
+        const petSet = existingPetNames.get(customer.Id) ?? new Set<string>();
+        if (petSet.has(petName.toLowerCase())) {
+          skippedRows.push({ row, reason: 'Pet already exists for this client' });
+          continue;
+        }
+        await addEndUserPet(c.env.PAWBOOK_DB, tenant.Id, customer.Id, petName, petType);
+        petSet.add(petName.toLowerCase());
+        existingPetNames.set(customer.Id, petSet);
+        importedPets++;
+      } catch {
+        skippedRows.push({ row, reason: 'Could not import this row' });
+      }
+    }
+
+    if (sendInvites && isEmailConfigured(c.env)) {
+      const widgetUrl = new URL(`/embed/${tenant.Slug}`, c.req.url).toString();
+      for (const email of freshCustomers) {
+        try {
+          await sendInvite(c.env, email, tenant.DisplayName, widgetUrl);
+          invitesSent++;
+        } catch {
+          invitesFailed++;
+        }
+      }
+    }
+
+    return c.json({ importedCustomers, importedPets, invitesSent, invitesFailed, skippedRows });
+  })
 
   .get('/:slug/admin/bookings', async (c) => {
     const tenant = c.get('tenant');
+    await reconcileIfStale(c.env, tenant);
     const rows = await listBookingsForTenant(c.env.PAWBOOK_DB, tenant.Id);
     return c.json({
       bookings: rows.map((r) => ({
@@ -727,6 +920,7 @@ export const adminRoutes = new Hono<AppEnv>()
         optionKey: r.OptionKey,
         petCount: r.PetCount,
         estCost: r.EstCost,
+        paidTotal: r.PaidTotal ?? 0,
         status: r.Declined ? 'declined' : r.Status,
         createdAt: r.CreatedAt,
       })),
@@ -766,4 +960,115 @@ export const adminRoutes = new Hono<AppEnv>()
       }
     }
     return c.json({ status, notified });
+  })
+
+  .post('/:slug/admin/bookings/:id/payments', async (c) => {
+    const tenant = c.get('tenant');
+    const bookingId = c.req.param('id');
+    const body = await c.req
+      .json<{ amount?: unknown; method?: unknown; paidDate?: unknown; note?: unknown }>()
+      .catch(() => ({}) as Record<string, never>);
+    if (!isValidRate(body.amount))
+      return c.json({ error: 'Amount must be whole dollars ≥ 1.' }, 400);
+    if (!isPaymentMethod(body.method)) return c.json({ error: 'Unknown payment method.' }, 400);
+    if (typeof body.paidDate !== 'string' || !isRealDate(body.paidDate))
+      return c.json({ error: 'Invalid payment date.' }, 400);
+    const note = typeof body.note === 'string' && body.note.trim() !== '' ? body.note.trim() : null;
+    const paymentId = await insertPayment(c.env.PAWBOOK_DB, tenant.Id, {
+      bookingRequestId: bookingId,
+      amount: body.amount,
+      method: body.method,
+      paidDate: body.paidDate,
+      note,
+    });
+    // Guard refused: foreign, blocked, or cancelled booking (pending is deliberately allowed).
+    if (!paymentId) return c.json({ error: 'Not found.' }, 404);
+    const payments = await listPaymentsForBooking(c.env.PAWBOOK_DB, tenant.Id, bookingId);
+    const created = payments.find((p) => p.Id === paymentId);
+    if (!created) return c.json({ error: 'Not found.' }, 404);
+    return c.json(
+      {
+        payment: {
+          id: created.Id,
+          amount: created.Amount,
+          method: created.Method,
+          paidDate: created.PaidDate,
+          note: created.Note,
+        },
+        paidTotal: payments.reduce((sum, p) => sum + p.Amount, 0),
+      },
+      201,
+    );
+  })
+
+  .get('/:slug/admin/bookings/:id/payments', async (c) => {
+    const tenant = c.get('tenant');
+    const bookingId = c.req.param('id');
+    // Same existence guard as POST/DELETE: foreign booking or the 'blocked' sentinel 404s. Unlike
+    // POST, a cancelled booking is still viewable here — DELETE is the correction mechanism for it.
+    const booking = await getBookingWithCustomer(c.env.PAWBOOK_DB, tenant.Id, bookingId);
+    if (!booking || booking.ServiceType === 'blocked') return c.json({ error: 'Not found.' }, 404);
+    const rows = await listPaymentsForBooking(c.env.PAWBOOK_DB, tenant.Id, bookingId);
+    return c.json({
+      payments: rows.map((p) => ({
+        id: p.Id,
+        amount: p.Amount,
+        method: p.Method,
+        paidDate: p.PaidDate,
+        note: p.Note,
+      })),
+    });
+  })
+
+  .delete('/:slug/admin/bookings/:id/payments/:paymentId', async (c) => {
+    const tenant = c.get('tenant');
+    const deleted = await deletePayment(
+      c.env.PAWBOOK_DB,
+      tenant.Id,
+      c.req.param('id'),
+      c.req.param('paymentId'),
+    );
+    if (!deleted) return c.json({ error: 'Not found.' }, 404);
+    return c.body(null, 204);
+  })
+
+  // Earnings dashboard payload. All aggregation is SQL (getAnalytics); the tiles are derived
+  // here in JS from the aggregates — no extra queries, no KV caching (prototype-scale D1).
+  .get('/:slug/admin/analytics', async (c) => {
+    const tenant = c.get('tenant');
+    await reconcileIfStale(c.env, tenant);
+    const today = getPacificDateStr(undefined, tenant.Timezone ?? undefined);
+    const data = await getAnalytics(c.env.PAWBOOK_DB, tenant.Id, today);
+    const outstanding = data.outstanding.map((o) => ({
+      bookingId: o.BookingId,
+      name: o.Name,
+      email: o.Email,
+      serviceType: o.ServiceType,
+      startDate: o.StartDate,
+      estCost: o.EstCost,
+      paidTotal: o.PaidTotal,
+      balance: o.EstCost - o.PaidTotal,
+    }));
+    return c.json({
+      tiles: {
+        thisMonth: data.monthly.at(-1)?.Total ?? 0,
+        lastMonth: data.monthly.at(-2)?.Total ?? 0,
+        outstandingTotal: outstanding.reduce((sum, o) => sum + o.balance, 0),
+        outstandingCount: outstanding.length,
+      },
+      monthly: data.monthly.map((m) => ({ month: m.Month, total: m.Total })),
+      byService: data.byService.map((s) => ({
+        serviceType: s.ServiceType,
+        label: s.Label,
+        total: s.Total,
+      })),
+      topClients: data.topClients.map((t) => ({
+        endUserId: t.EndUserId,
+        name: t.Name,
+        email: t.Email,
+        total: t.Total,
+        bookings: t.Bookings,
+      })),
+      outstanding,
+    });
   });
diff --git a/server/routes/bookings.ts b/server/routes/bookings.ts
index 5b07c65..5b1909e 100644
--- a/server/routes/bookings.ts
+++ b/server/routes/bookings.ts
@@ -13,7 +13,6 @@ import {
 } from '../db/repo';
 import { checkAvailability, estimateCost, monthAvailability } from '../lib/availability';
 import { syncBookingToCalendar } from '../lib/calendar-sync';
-import { SERVICE_CATALOG, isServiceType } from '../lib/services';
 import { endUserAuth } from '../lib/middleware';
 import { isValidPetCount, validateBoardingRange, validateSingleDate } from '../lib/validation';
 import {
@@ -35,7 +34,9 @@ export const bookingRoutes = new Hono<AppEnv>()
     const type = c.req.query('type');
     const month = c.req.query('month') ?? '';
     const optionKey = c.req.query('option');
-    if (!isServiceType(type)) return c.json({ error: 'Unknown service type.' }, 400);
+    const services = await listServices(c.env.PAWBOOK_DB, tenant.Id);
+    const service = services.find((s) => s.ServiceType === type);
+    if (!service) return c.json({ error: 'Unknown service type.' }, 400);
     if (!/^\d{4}-\d{2}$/.test(month)) return c.json({ error: 'Bad month.' }, 400);
     const options = await listServiceOptions(c.env.PAWBOOK_DB, tenant.Id);
     const serviceOptions = options.filter((o) => o.ServiceType === type);
@@ -48,7 +49,14 @@ export const bookingRoutes = new Hono<AppEnv>()
       if (!found) return c.json({ error: 'Unknown service option.' }, 400);
       option = found;
     }
-    const result = await monthAvailability(c.env, tenant, type, month, c.get('endUserId'), option);
+    const result = await monthAvailability(
+      c.env,
+      tenant,
+      service,
+      month,
+      c.get('endUserId'),
+      option,
+    );
     return c.json(result);
   })
 
@@ -91,7 +99,9 @@ export const bookingRoutes = new Hono<AppEnv>()
           )
         : {};
 
-    if (!isServiceType(type)) return c.json({ error: 'Unknown service type.' }, 400);
+    const services = await listServices(c.env.PAWBOOK_DB, tenant.Id);
+    const service = services.find((s) => s.ServiceType === type);
+    if (!service) return c.json({ error: 'Unknown service type.' }, 400);
     if (petIds.length === 0) return c.json({ error: 'Choose at least one pet.' }, 400);
 
     const myPets = await listEndUserPets(c.env.PAWBOOK_DB, tenant.Id, c.get('endUserId'));
@@ -106,9 +116,7 @@ export const bookingRoutes = new Hono<AppEnv>()
     }
     const petType = chosen[0]!.PetType;
 
-    const services = await listServices(c.env.PAWBOOK_DB, tenant.Id);
-    const service = services.find((s) => s.ServiceType === type && s.Enabled);
-    if (!service) return c.json({ error: 'Service not offered.' }, 400);
+    if (!service.Enabled) return c.json({ error: 'Service not offered.' }, 400);
 
     const options = await listServiceOptions(c.env.PAWBOOK_DB, tenant.Id);
 
@@ -123,7 +131,7 @@ export const bookingRoutes = new Hono<AppEnv>()
     }
 
     // Re-validate dates at submit time with the same logic the widget used (PRD FR13).
-    const shape = SERVICE_CATALOG[type].shape;
+    const shape = service.Shape;
     const dateError =
       shape === 'range'
         ? validateBoardingRange(start, end, tenant.MaxStayNights, tenant.Timezone ?? undefined)
@@ -148,7 +156,7 @@ export const bookingRoutes = new Hono<AppEnv>()
     if (constraintsError) return c.json({ error: constraintsError }, 400);
 
     // Price is computed server-side (never trusted from the client) and is pure — no DB read.
-    const estCost = estimateCost(type, option, start, end);
+    const estCost = estimateCost(service, option, start, end);
 
     // Optimistic insert, then a single capacity check that excludes our own just-inserted row.
     // The check covers both "those dates were already full" and the check-then-insert race (a
@@ -156,7 +164,7 @@ export const bookingRoutes = new Hono<AppEnv>()
     // racers may both roll back — fail-safe, never an overbooking. This is the ONLY capacity read.
     const id = await insertBookingRequest(c.env.PAWBOOK_DB, tenant.Id, {
       endUserId: c.get('endUserId'),
-      serviceType: type,
+      serviceType: service.ServiceType,
       startDate: start,
       endDate,
       optionKey: option.OptionKey,
@@ -170,7 +178,7 @@ export const bookingRoutes = new Hono<AppEnv>()
 
     let check;
     try {
-      check = await checkAvailability(c.env, tenant, type, option, start, end, pets, id);
+      check = await checkAvailability(c.env, tenant, service, option, start, end, pets, id);
       if (!check.available) {
         await deleteBookingRequest(c.env.PAWBOOK_DB, tenant.Id, id);
         return c.json({ error: 'Sorry — those dates just filled up.' }, 409);
@@ -189,7 +197,8 @@ export const bookingRoutes = new Hono<AppEnv>()
     const sync = syncBookingToCalendar(c.env, tenant, {
       bookingId: id,
       endUserId: c.get('endUserId'),
-      serviceType: type,
+      serviceType: service.ServiceType,
+      serviceLabel: service.Label,
       startDate: start,
       endDate,
       startTime: option.StartTime,
diff --git a/server/routes/public.ts b/server/routes/public.ts
index 9dbe146..a31442c 100644
--- a/server/routes/public.ts
+++ b/server/routes/public.ts
@@ -1,7 +1,6 @@
 import { Hono } from 'hono';
 import { listPetTypes, listServiceOptions, listServices } from '../db/repo';
 import { checkAvailability } from '../lib/availability';
-import { isServiceType, SERVICE_CATALOG } from '../lib/services';
 import { isValidPetCount, validateBoardingRange, validateSingleDate } from '../lib/validation';
 import type { AppEnv } from '../types';
 
@@ -13,7 +12,6 @@ export const publicRoutes = new Hono<AppEnv>()
       listServiceOptions(c.env.PAWBOOK_DB, tenant.Id),
       listPetTypes(c.env.PAWBOOK_DB, tenant.Id),
     ]);
-    const enabled = new Set(services.filter((s) => s.Enabled).map((s) => s.ServiceType));
     return c.json({
       slug: tenant.Slug,
       displayName: tenant.DisplayName,
@@ -25,21 +23,22 @@ export const publicRoutes = new Hono<AppEnv>()
       contactEmail: tenant.ContactEmail,
       contactPhone: tenant.ContactPhone,
       petTypes: petTypes.filter((p) => p.Enabled).map((p) => p.PetType),
-      services: [...enabled].map((type) => {
-        const svc = services.find((s) => s.ServiceType === type)!;
-        return {
-          type,
-          label: SERVICE_CATALOG[type].label,
-          shape: SERVICE_CATALOG[type].shape,
-          rateUnit: SERVICE_CATALOG[type].rateUnit,
-          hasDuration: SERVICE_CATALOG[type].hasDuration,
+      services: services
+        .filter((s) => s.Enabled)
+        .map((svc) => ({
+          type: svc.ServiceType,
+          label: svc.Label,
+          icon: svc.Icon,
+          shape: svc.Shape,
+          rateUnit: svc.RateUnit,
+          hasDuration: Boolean(svc.HasDuration),
           questions: svc.Questions,
           minNights: svc.MinNights,
           maxNights: svc.MaxNights,
           minPetCount: svc.MinPetCount,
           maxPetCount: svc.MaxPetCount,
           options: options
-            .filter((o) => o.ServiceType === type)
+            .filter((o) => o.ServiceType === svc.ServiceType)
             .map((o) => ({
               optionKey: o.OptionKey,
               label: o.Label,
@@ -49,8 +48,7 @@ export const publicRoutes = new Hono<AppEnv>()
               endTime: o.EndTime,
               capacity: o.Capacity,
             })),
-        };
-      }),
+        })),
     });
   })
 
@@ -62,22 +60,23 @@ export const publicRoutes = new Hono<AppEnv>()
     const end = c.req.query('end') ?? '';
     const pets = Number(c.req.query('pets') ?? '1');
 
-    if (!isServiceType(type)) return c.json({ error: 'Unknown service type.' }, 400);
+    if (typeof type !== 'string' || !type) return c.json({ error: 'Unknown service type.' }, 400);
     if (!isValidPetCount(pets)) return c.json({ error: 'Invalid pet count.' }, 400);
 
     const [services, options] = await Promise.all([
       listServices(c.env.PAWBOOK_DB, tenant.Id),
       listServiceOptions(c.env.PAWBOOK_DB, tenant.Id),
     ]);
-    if (!services.some((s) => s.ServiceType === type && s.Enabled))
-      return c.json({ error: 'Service not offered.' }, 400);
+    const service = services.find((s) => s.ServiceType === type);
+    if (!service) return c.json({ error: 'Unknown service type.' }, 400);
+    if (!service.Enabled) return c.json({ error: 'Service not offered.' }, 400);
     const serviceOptions = options.filter((o) => o.ServiceType === type);
     const option = optionKey
       ? serviceOptions.find((o) => o.OptionKey === optionKey)
       : serviceOptions[0];
     if (!option) return c.json({ error: 'Unknown service option.' }, 400);
 
-    if (SERVICE_CATALOG[type].shape === 'range') {
+    if (service.Shape === 'range') {
       const rangeError = validateBoardingRange(
         start,
         end,
@@ -85,9 +84,9 @@ export const publicRoutes = new Hono<AppEnv>()
         tenant.Timezone ?? undefined,
       );
       if (rangeError) return c.json({ error: rangeError.error }, rangeError.status);
-      return c.json(await checkAvailability(c.env, tenant, type, option, start, end, pets));
+      return c.json(await checkAvailability(c.env, tenant, service, option, start, end, pets));
     }
     const dateError = validateSingleDate(start, tenant.Timezone ?? undefined);
     if (dateError) return c.json({ error: dateError.error }, dateError.status);
-    return c.json(await checkAvailability(c.env, tenant, type, option, start, ''));
+    return c.json(await checkAvailability(c.env, tenant, service, option, start, ''));
   });
diff --git a/server/types.ts b/server/types.ts
index 2f0ab11..94fbd75 100644
--- a/server/types.ts
+++ b/server/types.ts
@@ -1,7 +1,8 @@
-import type { PetType, RateUnit, ServiceType } from './lib/services';
+import type { CapacityKind, PetType, RateUnit, ServiceShape, ServiceType } from './lib/services';
+import type { PaymentMethod } from './lib/validation';
 import type { ServiceQuestion } from '../src/shared/index.js';
 
-export type { PetType, RateUnit, ServiceType };
+export type { CapacityKind, PetType, RateUnit, ServiceShape, ServiceType };
 
 export type Tenant = {
   Id: string;
@@ -25,8 +26,15 @@ export type TenantUser = {
 
 export type TenantService = {
   TenantId: string;
-  ServiceType: ServiceType;
+  ServiceType: ServiceType; // per-tenant slug
   Enabled: number;
+  Label: string;
+  Icon: string;
+  Shape: ServiceShape;
+  RateUnit: RateUnit;
+  HasDuration: number;
+  CapacityKind: CapacityKind;
+  SortOrder: number;
   Questions: ServiceQuestion[];
   MinNights: number | null;
   MaxNights: number | null;
@@ -94,6 +102,40 @@ export type BookingRow = {
   CreatedAt: string;
 };
 
+export type PaymentRow = {
+  Id: string;
+  TenantId: string;
+  BookingRequestId: string;
+  Amount: number;
+  Method: PaymentMethod;
+  PaidDate: string;
+  Note: string | null;
+  CreatedAt: string;
+};
+
+/** getAnalytics result: raw PascalCase aggregate rows. monthly is exactly 12 entries, oldest
+ * month first, zero-filled. The route maps to camelCase and derives the stat tiles in JS. */
+export type AnalyticsData = {
+  monthly: { Month: string; Total: number }[];
+  byService: { ServiceType: string; Label: string; Total: number }[];
+  topClients: {
+    EndUserId: string;
+    Name: string | null;
+    Email: string | null;
+    Total: number;
+    Bookings: number;
+  }[];
+  outstanding: {
+    BookingId: string;
+    Name: string | null;
+    Email: string | null;
+    ServiceType: string;
+    StartDate: string;
+    EstCost: number;
+    PaidTotal: number;
+  }[];
+};
+
 export type ProviderConnection = {
   Id: string;
   TenantId: string;
diff --git a/sql/schema.sql b/sql/schema.sql
index 7356949..cfdc2ea 100644
--- a/sql/schema.sql
+++ b/sql/schema.sql
@@ -27,10 +27,23 @@ CREATE TABLE IF NOT EXISTS TenantUsers (
   CreatedAt TEXT NOT NULL DEFAULT (datetime('now'))
 );
 
+-- The authoritative, agnostic Service store: one row per service a tenant offers, each carrying
+-- its own behavior. ServiceType is a per-tenant SLUG (built-ins: boarding/housesitting/daycare/
+-- walk/checkin; sitters add custom ones like 'morning-walk' from templates — SERVICE_TEMPLATES
+-- in server/lib/services.ts). 'blocked' is reserved (see BookingRequests).
 CREATE TABLE IF NOT EXISTS TenantServices (
   TenantId TEXT NOT NULL REFERENCES Tenants(Id),
-  ServiceType TEXT NOT NULL CHECK (ServiceType IN ('boarding', 'housesitting', 'daycare', 'walk', 'checkin')),
+  ServiceType TEXT NOT NULL,
   Enabled INTEGER NOT NULL DEFAULT 1,
+  Label TEXT NOT NULL,
+  Icon TEXT NOT NULL DEFAULT 'paw', -- widget icon key: bed|home|sun|paw|clipboard
+  Shape TEXT NOT NULL CHECK (Shape IN ('range', 'single')),
+  RateUnit TEXT NOT NULL CHECK (RateUnit IN ('night', 'day', 'visit')),
+  HasDuration INTEGER NOT NULL DEFAULT 0, -- options priced per duration (walk/check-in style)?
+  -- Which capacity POOL the service draws from (not the service's name): 'boarding' = pet-counted
+  -- vs Tenants.MaxBoardingPets, 'housesit' = day-counted vs MaxHouseSitsPerDay, 'none' = unlimited.
+  CapacityKind TEXT NOT NULL DEFAULT 'none' CHECK (CapacityKind IN ('boarding', 'housesit', 'none')),
+  SortOrder INTEGER NOT NULL DEFAULT 0,
   -- Per-service intake questions (JSON array of ServiceQuestion, see src/shared/booking/service-rules.ts)
   -- + optional booking-level limits. NULL limit = unlimited, matching the Tenants Max* convention.
   Questions TEXT NOT NULL DEFAULT '[]',
@@ -41,13 +54,13 @@ CREATE TABLE IF NOT EXISTS TenantServices (
   UNIQUE (TenantId, ServiceType)
 );
 
--- One row per priced option. Non-duration services (boarding/housesitting/daycare) have a single
--- option with DurationMinutes NULL; walks/check-ins have one row per sitter-defined duration.
+-- One row per priced option. Non-duration services have a single option with DurationMinutes
+-- NULL; HasDuration services (walk/check-in style) have one row per sitter-defined duration.
 -- Rate is free-typed whole dollars with NO relationship to duration.
 CREATE TABLE IF NOT EXISTS TenantServiceOptions (
   Id TEXT PRIMARY KEY,
   TenantId TEXT NOT NULL REFERENCES Tenants(Id),
-  ServiceType TEXT NOT NULL CHECK (ServiceType IN ('boarding', 'housesitting', 'daycare', 'walk', 'checkin')),
+  ServiceType TEXT NOT NULL,
   OptionKey TEXT NOT NULL,
   Label TEXT NOT NULL,
   DurationMinutes INTEGER,
@@ -100,7 +113,7 @@ CREATE TABLE IF NOT EXISTS BookingRequests (
   Id TEXT PRIMARY KEY,
   TenantId TEXT NOT NULL REFERENCES Tenants(Id),
   EndUserId TEXT REFERENCES EndUsers(Id),
-  ServiceType TEXT NOT NULL CHECK (ServiceType IN ('boarding', 'housesitting', 'daycare', 'walk', 'checkin', 'blocked')),
+  ServiceType TEXT NOT NULL, -- tenant service slug, or the reserved 'blocked'
   StartDate TEXT NOT NULL,
   EndDate TEXT, -- exclusive checkout for boarding/blocked ranges; NULL for single-day walks
   OptionKey TEXT, -- which TenantServiceOptions row the customer picked; NULL for blocked
@@ -140,6 +153,21 @@ CREATE TABLE IF NOT EXISTS BookingRequestPets (
   PRIMARY KEY (BookingRequestId, PetId)
 );
 
+-- Recorded payments against bookings (earnings analytics). Multiple rows per booking
+-- (deposits/partials); whole dollars matching EstCost/Rate. PaidDate is sitter-entered.
+CREATE TABLE IF NOT EXISTS Payments (
+  Id TEXT PRIMARY KEY,
+  TenantId TEXT NOT NULL REFERENCES Tenants(Id),
+  BookingRequestId TEXT NOT NULL REFERENCES BookingRequests(Id),
+  Amount INTEGER NOT NULL CHECK (Amount > 0), -- whole dollars, matching EstCost/Rate
+  Method TEXT NOT NULL CHECK (Method IN ('cash', 'venmo', 'zelle', 'paypal', 'check', 'card', 'other')),
+  PaidDate TEXT NOT NULL, -- 'YYYY-MM-DD', sitter-entered (defaults to today in the UI)
+  Note TEXT,
+  CreatedAt TEXT NOT NULL DEFAULT (datetime('now'))
+);
+CREATE INDEX IF NOT EXISTS idx_Payments_Tenant_Date ON Payments (TenantId, PaidDate);
+CREATE INDEX IF NOT EXISTS idx_Payments_Tenant_Booking ON Payments (TenantId, BookingRequestId);
+
 CREATE TABLE IF NOT EXISTS ProviderConnections (
   Id TEXT PRIMARY KEY,
   TenantId TEXT NOT NULL REFERENCES Tenants(Id),
diff --git a/sql/seed.sql b/sql/seed.sql
index 7f5618c..64cdcfc 100644
--- a/sql/seed.sql
+++ b/sql/seed.sql
@@ -21,19 +21,27 @@ INSERT OR REPLACE INTO TenantUsers (Id, TenantId, Email, PasswordHash) VALUES
   ('tu_dana', 'tnt_happytails', 'dana@happytails.test', 'pbkdf2$600000$03503c998c342f5f3704921e532a3e35$deac9874ed916391151ee6ce3b3aecb3a55c44123349729ae220d4762e911d07'),
   ('tu_pawsandrelax', 'tnt_pawsandrelax', 'admin@pawsandrelax.example', 'pbkdf2$600000$4f4aa1b2f29635a386a62fbce18336ae$8eaa4c479048f11664af6dd8a6118996921474eb6c72ba6c4b6caf66155fc6ae');
 
--- Which services each tenant offers (on/off only; prices live in TenantServiceOptions).
-INSERT OR REPLACE INTO TenantServices (TenantId, ServiceType, Enabled) VALUES
-  ('tnt_sunnypaws', 'boarding', 1),
-  ('tnt_sunnypaws', 'housesitting', 1),
-  ('tnt_sunnypaws', 'daycare', 1),
-  ('tnt_sunnypaws', 'walk', 1),
-  ('tnt_sunnypaws', 'checkin', 1),
-  ('tnt_happytails', 'boarding', 1),
-  ('tnt_happytails', 'daycare', 1),
-  ('tnt_happytails', 'walk', 1),
-  ('tnt_pawsandrelax', 'boarding', 1),
-  ('tnt_pawsandrelax', 'housesitting', 1),
-  ('tnt_pawsandrelax', 'walk', 1);
+-- Which services each tenant offers. Every tenant gets a row per built-in template (rows, not
+-- code, are the service list); Enabled mirrors what each demo sitter actually offers. Sunny Paws
+-- also has a CUSTOM service ('morning-walk', cloned from the walk template) to demo custom services.
+INSERT OR REPLACE INTO TenantServices
+  (TenantId, ServiceType, Enabled, Label, Icon, Shape, RateUnit, HasDuration, CapacityKind, SortOrder) VALUES
+  ('tnt_sunnypaws', 'boarding', 1, 'Boarding', 'bed', 'range', 'night', 0, 'boarding', 0),
+  ('tnt_sunnypaws', 'housesitting', 1, 'House sitting', 'home', 'range', 'night', 0, 'housesit', 1),
+  ('tnt_sunnypaws', 'daycare', 1, 'Day care', 'sun', 'single', 'day', 0, 'none', 2),
+  ('tnt_sunnypaws', 'walk', 1, 'Walks', 'paw', 'single', 'visit', 1, 'none', 3),
+  ('tnt_sunnypaws', 'checkin', 1, 'Check-ins', 'clipboard', 'single', 'visit', 1, 'none', 4),
+  ('tnt_sunnypaws', 'morning-walk', 1, 'Morning walk', 'paw', 'single', 'visit', 1, 'none', 5),
+  ('tnt_happytails', 'boarding', 1, 'Boarding', 'bed', 'range', 'night', 0, 'boarding', 0),
+  ('tnt_happytails', 'housesitting', 0, 'House sitting', 'home', 'range', 'night', 0, 'housesit', 1),
+  ('tnt_happytails', 'daycare', 1, 'Day care', 'sun', 'single', 'day', 0, 'none', 2),
+  ('tnt_happytails', 'walk', 1, 'Walks', 'paw', 'single', 'visit', 1, 'none', 3),
+  ('tnt_happytails', 'checkin', 0, 'Check-ins', 'clipboard', 'single', 'visit', 1, 'none', 4),
+  ('tnt_pawsandrelax', 'boarding', 1, 'Boarding', 'bed', 'range', 'night', 0, 'boarding', 0),
+  ('tnt_pawsandrelax', 'housesitting', 1, 'House sitting', 'home', 'range', 'night', 0, 'housesit', 1),
+  ('tnt_pawsandrelax', 'daycare', 0, 'Day care', 'sun', 'single', 'day', 0, 'none', 2),
+  ('tnt_pawsandrelax', 'walk', 1, 'Walks', 'paw', 'single', 'visit', 1, 'none', 3),
+  ('tnt_pawsandrelax', 'checkin', 0, 'Check-ins', 'clipboard', 'single', 'visit', 1, 'none', 4);
 
 -- Priced options. Non-duration services = single 'standard' option, DurationMinutes NULL.
 -- Walks/check-ins = sitter-defined (duration, price) rows; prices are free-typed (note the sitter's
@@ -47,6 +55,7 @@ INSERT OR REPLACE INTO TenantServiceOptions (Id, TenantId, ServiceType, OptionKe
   ('opt_sp_walk90', 'tnt_sunnypaws', 'walk', 'd90', '90 minutes', 90, 30, 'visit'),
   ('opt_sp_chk15', 'tnt_sunnypaws', 'checkin', 'd15', '15 minutes', 15, 12, 'visit'),
   ('opt_sp_chk30', 'tnt_sunnypaws', 'checkin', 'd30', '30 minutes', 30, 18, 'visit'),
+  ('opt_sp_mw30', 'tnt_sunnypaws', 'morning-walk', 'd30', '30 minutes', 30, 18, 'visit'),
   ('opt_ht_board', 'tnt_happytails', 'boarding', 'standard', 'Standard', NULL, 40, 'night'),
   ('opt_ht_day', 'tnt_happytails', 'daycare', 'standard', 'Standard', NULL, 35, 'day'),
   ('opt_ht_walk30', 'tnt_happytails', 'walk', 'd30', '30 minutes', 30, 25, 'visit'),
@@ -55,6 +64,12 @@ INSERT OR REPLACE INTO TenantServiceOptions (Id, TenantId, ServiceType, OptionKe
   ('opt_pr_house', 'tnt_pawsandrelax', 'housesitting', 'standard', 'Standard', NULL, 65, 'night'),
   ('opt_pr_walk30', 'tnt_pawsandrelax', 'walk', 'd30', '30 minutes', 30, 22, 'visit');
 
+-- One windowed group-slot option (capacity-limited, fixed clock window) to demo time-windowed
+-- services on a fresh seed, alongside morning-walk demoing custom services.
+INSERT OR REPLACE INTO TenantServiceOptions
+  (Id, TenantId, ServiceType, OptionKey, Label, DurationMinutes, Rate, RateUnit, StartTime, EndTime, Capacity) VALUES
+  ('opt_ht_group_walk', 'tnt_happytails', 'walk', 'group-8-9', 'Group walk 8:00-9:00am', 60, 18, 'visit', '08:00', '09:00', 3);
+
 -- Accepted species: Sunny Paws takes dogs + cats; Happy Tails dogs only; Paws & Relax dogs + cats.
 INSERT OR REPLACE INTO TenantPetTypes (TenantId, PetType, Enabled) VALUES
   ('tnt_sunnypaws', 'dog', 1),
@@ -95,8 +110,4 @@ INSERT OR REPLACE INTO BookingRequests (Id, TenantId, EndUserId, ServiceType, St
 
 INSERT OR REPLACE INTO ProviderConnections (Id, TenantId, Capability, Provider, Status) VALUES
   ('seed_sp_cal', 'tnt_sunnypaws', 'calendar', 'google-calendar', 'disconnected'),
-  ('seed_sp_crm', 'tnt_sunnypaws', 'crm', 'notion', 'disconnected'),
-  ('seed_sp_email', 'tnt_sunnypaws', 'email', 'gmail', 'disconnected'),
-  ('seed_ht_cal', 'tnt_happytails', 'calendar', 'google-calendar', 'disconnected'),
-  ('seed_ht_crm', 'tnt_happytails', 'crm', 'notion', 'disconnected'),
-  ('seed_ht_email', 'tnt_happytails', 'email', 'gmail', 'disconnected');
+  ('seed_ht_cal', 'tnt_happytails', 'calendar', 'google-calendar', 'disconnected');
diff --git a/src/shared/index.ts b/src/shared/index.ts
index d8b9474..4dd2dc1 100644
--- a/src/shared/index.ts
+++ b/src/shared/index.ts
@@ -34,3 +34,4 @@ export {
   type ServiceOption,
   type QuestionType,
 } from './booking/service-rules.js';
+export { PAYMENT_METHODS, isPaymentMethod, type PaymentMethod } from './payment-methods.js';
diff --git a/src/shared/payment-methods.ts b/src/shared/payment-methods.ts
new file mode 100644
index 0000000..cd709f6
--- /dev/null
+++ b/src/shared/payment-methods.ts
@@ -0,0 +1,20 @@
+/**
+ * How a sitter collected money. Mirrors the SQL CHECK on Payments.Method — keep in lockstep.
+ * Adding/removing a method here requires updating sql/schema.sql's CHECK constraint too (SQLite
+ * can't ALTER a CHECK, so that's a table-rebuild migration, not a plain column add).
+ */
+export const PAYMENT_METHODS = [
+  'cash',
+  'venmo',
+  'zelle',
+  'paypal',
+  'check',
+  'card',
+  'other',
+] as const;
+
+export type PaymentMethod = (typeof PAYMENT_METHODS)[number];
+
+export function isPaymentMethod(value: unknown): value is PaymentMethod {
+  return typeof value === 'string' && (PAYMENT_METHODS as readonly string[]).includes(value);
+}