Fix CI FPM worker config test

[codex] Fix register CVR welcome email rendering

Dockerfile

@@ -40,6 +40,7 @@ COPY . /var/www/html
 
 # Copy Nginx configuration file
 COPY nginx.conf /etc/nginx/nginx.conf
+COPY services/php/php-fpm-pool.conf /usr/local/etc/php-fpm.d/zz-pleno-workers.conf
 
 # Install Composer
 COPY --from=composer:2.6 /usr/bin/composer /usr/bin/composer

Dockerfile.coolify-api

@@ -47,6 +47,7 @@ RUN set -eux; \
 
 COPY services/nginx/app/ /var/www/html/
 COPY services/php/docker-entrypoint.sh /usr/local/bin/docker-entrypoint.sh
+COPY services/php/php-fpm-pool.conf /usr/local/etc/php-fpm.d/zz-pleno-workers.conf
 COPY services/coolify/api/nginx.conf /etc/nginx/nginx.conf
 COPY services/coolify/api/start.sh /usr/local/bin/coolify-api-start
 

openapi.yaml

@@ -6266,6 +6266,33 @@ paths:
         '401': { $ref: '#/components/responses/Unauthorized' }
         '403': { $ref: '#/components/responses/Forbidden' }
 
+  /order-bookings/completion-confirmation/resend:
+    post:
+      tags:
+        - Bookings
+      summary: Resend order booking completion confirmation
+      description: Resends the customer completion confirmation email with the wash certificate for a completed order booking. Requires `complete_bookings` and access to the booking's department.
+      operationId: resendOrderBookingCompletionConfirmation
+      requestBody:
+        required: true
+        content:
+          application/json:
+            schema:
+              type: object
+              required: [id]
+              properties:
+                id: {type: integer}
+      responses:
+        '200':
+          description: Completion confirmation resent successfully
+          content:
+            application/json:
+              schema: {}
+        '400': { $ref: '#/components/responses/BadRequest' }
+        '401': { $ref: '#/components/responses/Unauthorized' }
+        '403': { $ref: '#/components/responses/Forbidden' }
+        '409': { $ref: '#/components/responses/Conflict' }
+
   /order-bookings/complete:
     post:
       tags:

scripts/php-ci-test.sh

@@ -128,7 +128,16 @@ tar \
   -C services/nginx/app -cf - . \
   | docker compose $compose_files exec -T php1 tar -C /var/www/html -xf -
 
+docker compose $compose_files exec -T php1 sh -lc 'rm -rf /var/www/repo-root && mkdir -p /var/www/repo-root'
+tar \
+  -cf - \
+  Dockerfile \
+  Dockerfile.coolify-api \
+  services/php/Dockerfile \
+  services/php/php-fpm-pool.conf \
+  | docker compose $compose_files exec -T php1 tar -C /var/www/repo-root -xf -
+
 composer_install
 
 docker compose $compose_files exec -T php1 sh -lc \
-  "cd /var/www/html && composer test:ci:$suite"
+  "cd /var/www/html && PLENO_REPO_ROOT_FOR_TESTS=/var/www/repo-root composer test:ci:$suite"

services/nginx/app/classes/attachments.php

@@ -133,8 +133,14 @@ class attachments implements attachments_i
     protected function fetchAttachmentRows(string $type, array $object_ids, array $options = []): array
     {
         $options = $this->normalizeAttachmentOptions($options);
+        $rawType = trim($type, '`');
+        $objectTypes = array_values(array_unique([
+            $rawType,
+            '`' . $rawType . '`',
+        ]));
+
         return (new object_attachments_o())->getFieldsWhereIn([
-            'object_type' => $type,
+            'object_type' => $objectTypes,
             'object_id' => $object_ids,
             'deleted_at' => null
         ], $options);

services/nginx/app/classes/email.php

@@ -128,13 +128,13 @@ use Psr\Http\Client\ClientExceptionInterface;
     private function sendEmailMailerSend(string $to, string $recipient_name, string $subject, string $message, string $html = null, string $references = null, array $attachments = []): void
     {
         if (self::isFakeDeliveryEnabled()) {
-            self::$fake_deliveries[] = [
+            self::recordFakeDelivery([
                 'to' => $to,
                 'recipient_name' => $recipient_name,
                 'subject' => $subject,
                 'message' => $message,
                 'html' => $html,
-            ];
+            ]);
             return;
         }
 
@@ -225,6 +225,72 @@ use Psr\Http\Client\ClientExceptionInterface;
     public static function resetFakeDeliveries(): void
     {
         self::$fake_deliveries = [];
+        $path = self::getFakeDeliveriesPath();
+        if ($path !== null && is_file($path)) {
+            unlink($path);
+        }
+    }
+
+    public static function syncFakeDeliveries(): void
+    {
+        $path = self::getFakeDeliveriesPath();
+        if ($path === null || !is_file($path)) {
+            self::$fake_deliveries = [];
+            return;
+        }
+
+        $lines = file($path, FILE_IGNORE_NEW_LINES | FILE_SKIP_EMPTY_LINES);
+        if ($lines === false) {
+            self::$fake_deliveries = [];
+            return;
+        }
+
+        $deliveries = [];
+        foreach ($lines as $line) {
+            $delivery = json_decode($line, true);
+            if (is_array($delivery)) {
+                $deliveries[] = $delivery;
+            }
+        }
+
+        self::$fake_deliveries = $deliveries;
+    }
+
+    private static function recordFakeDelivery(array $delivery): void
+    {
+        self::$fake_deliveries[] = $delivery;
+
+        $path = self::getFakeDeliveriesPath();
+        if ($path === null) {
+            return;
+        }
+
+        $directory = dirname($path);
+        if (!is_dir($directory)) {
+            mkdir($directory, 0777, true);
+        }
+
+        file_put_contents($path, json_encode($delivery, JSON_UNESCAPED_UNICODE | JSON_UNESCAPED_SLASHES) . PHP_EOL, FILE_APPEND | LOCK_EX);
+    }
+
+    private static function getFakeDeliveriesPath(): ?string
+    {
+        if (!self::isFakeDeliveryEnabled()) {
+            return null;
+        }
+
+        $configuredPath = trim((string)(getenv('EMAIL_FAKE_DELIVERIES_PATH') ?: ''));
+        if ($configuredPath !== '') {
+            return $configuredPath;
+        }
+
+        if (getenv('RUN_API_TESTS') !== '1') {
+            return null;
+        }
+
+        return rtrim(sys_get_temp_dir(), DIRECTORY_SEPARATOR)
+            . DIRECTORY_SEPARATOR
+            . 'truckwash-email-fake-deliveries-' . md5((string)getcwd()) . '.jsonl';
     }
 
     private static function isFakeDeliveryEnabled(): bool

services/nginx/app/classes/pdf_store.php

@@ -47,8 +47,12 @@ class pdf_store implements minio_pdfs_i
      */
     public function download(string $file): string
     {
+        if ($this->shouldUseLocalTestStorage()) {
+            return $this->getLocalTestObjectPath($file);
+        }
+
         $path = '/tmp/' . $file;
-        $result = self::getS3Client()->getObject([
+        self::getS3Client()->getObject([
             'Bucket' => self::getBucket(),
             'Key' => $file,
             'SaveAs' => $path

services/nginx/app/classes/slack.php

@@ -134,7 +134,7 @@ class slack implements notification_i
             . "Status: $status";
     }
 
-    public function send_message(string $string, string $module = null): void
+    public function send_message(string $string, ?string $module = null): void
     {
         global $SLACK_DEFAULT_WEBHOOK;
         // Format the message if a module is provided
@@ -147,7 +147,7 @@ class slack implements notification_i
 
     public function send_customer_registration_notification(int $customer_number): self
     {
-        $webhook = trim((string)$this->getConfig()->customer_registration_webhook_url->getVariableValue());
+        $webhook = $this->get_customer_registration_webhook_url();
         if ($webhook === '') {
             return $this;
         }
@@ -160,6 +160,52 @@ class slack implements notification_i
         return $this;
     }
 
+    /**
+     * Send a sanitized customer-registration test notification to the saved Slack webhook.
+     *
+     * @return array{configured:bool,sent:bool,message:string}
+     */
+    public function test_customer_registration_webhook(): array
+    {
+        $webhook = $this->get_customer_registration_webhook_url();
+        if ($webhook === '') {
+            return [
+                'configured' => false,
+                'sent' => false,
+                'message' => 'Slack customer registration webhook URL is not configured.',
+            ];
+        }
+
+        $result = $this->send_webhook_message(
+            $this->format_customer_registration_test(),
+            $webhook
+        );
+        $sent = $this->is_webhook_send_successful($result);
+
+        self::add_log($sent
+            ? 'Slack customer registration test webhook sent successfully.'
+            : 'Slack customer registration test webhook failed.'
+        );
+
+        return [
+            'configured' => true,
+            'sent' => $sent,
+            'message' => $sent
+                ? 'Slack test message sent successfully.'
+                : 'Slack test message failed.',
+        ];
+    }
+
+    protected function get_customer_registration_webhook_url(): string
+    {
+        return trim((string)$this->getConfig()->customer_registration_webhook_url->getVariableValue());
+    }
+
+    public function is_webhook_send_successful(string $result): bool
+    {
+        return !str_starts_with($result, 'Failed to send message:');
+    }
+
     public function format_customer_registration(int $customer_number): string
     {
         $customer = (new users_o())->getUserByCustomerNumber($customer_number);
@@ -178,4 +224,10 @@ class slack implements notification_i
             . "Customer: $customerName ($safeCustomerNumber)\n"
             . "Open in Superuser: $customerUrl";
     }
+
+    public function format_customer_registration_test(): string
+    {
+        return "*Truck Wash Slack test*\n"
+            . "Customer registration notifications are configured correctly.";
+    }
 }

services/nginx/app/modules/email/templates/email_template_new_customer.php

@@ -2,7 +2,8 @@
 
 namespace email\templates;
 
-use email\helpers\email_template;use objects\users_o;
+use email\helpers\email_template;
+use objects\users_o;
 
 class email_template_new_customer
 {
@@ -52,6 +53,7 @@ class email_template_new_customer
      */
     public function generate_html(): string
     {
+        $customer_label = htmlspecialchars($this->getCustomerRegistrationLabel(), ENT_QUOTES, 'UTF-8');
         ob_start();
         # Start of the html
         ?>
@@ -73,7 +75,7 @@ class email_template_new_customer
 
                                 <!-- Intro -->
                                 <p class="container-text-md" style="color:#000000;font-size:16px;line-height:1.5;margin:0 0 18px 0;mso-line-height-rule:exactly;">
-                                    Tak for din registrering af <?=((new users_o())->getCustomerName((int)$this->customer_number))?><?=(((new users_o())->getCustomerEcocomicData((int)$this->customer_number)->economic_customer->corporateIdentificationNumber) ? ' (' . (new users_o())->getCustomerEcocomicData((int)$this->customer_number)->economic_customer->corporateIdentificationNumber . ')' : '')?> som kunde hos Truck Wash.
+                                    Tak for din registrering af <?=$customer_label?> som kunde hos Truck Wash.
                                 </p>
 
                                 <!-- You can now wash your trucks -->
@@ -185,4 +187,19 @@ class email_template_new_customer
         # End of the html
         return ob_get_clean();
     }
+
+    private function getCustomerRegistrationLabel(): string
+    {
+        $customer = (new users_o())->getUserByCustomerNumber($this->customer_number);
+        $customer_name = trim((string)($customer->getCustomerName($this->customer_number) ?? ''));
+        $customer_label = $customer_name === '' ? 'virksomhed (CVR)' : $customer_name;
+
+        $customer->getCustomerEcocomicData($this->customer_number);
+        $corporate_identification_number = trim((string)($customer->economic_customer->corporateIdentificationNumber ?? ''));
+        if ($corporate_identification_number !== '') {
+            $customer_label .= ' (' . $corporate_identification_number . ')';
+        }
+
+        return $customer_label;
+    }
 }

services/nginx/app/modules/selfserve/classes/selfserve_studio_graph.php

@@ -48,8 +48,8 @@ class selfserve_studio_graph
 {
     private const DEFAULT_PATH_MAX_STATES = 2048;
     private const MAX_PATH_MAX_STATES = 2048;
-    private const DEFAULT_PATH_SAMPLE_LIMIT = 200;
-    private const MAX_PATH_SAMPLE_LIMIT = 200;
+    private const DEFAULT_PATH_SAMPLE_LIMIT = 2048;
+    private const MAX_PATH_SAMPLE_LIMIT = 2048;
 
     /** @var array<string,array<int,string>> */
     private array $columnCache = [];

services/nginx/app/modules/selfserve/classes/selfserve_wash_flow.php

@@ -425,7 +425,7 @@ class selfserve_wash_flow implements selfserve_wash_flow_i
         return $this->getSessionSummary((int)$session->id);
     }
 
-    public function completeLatestSessionForLane(int $laneId, ?string $reg = null, ?int $customerNumber = null, ?int $orderId = null): ?array
+    public function completeLatestSessionForLane(int $laneId, ?string $reg = null, ?int $customerNumber = null, ?int $orderId = null, bool $disableRelays = true): ?array
     {
         $session = $reg !== null
             ? $this->findLatestOpenSession($laneId, selfserve::standardize_registration($reg), $customerNumber)
@@ -438,7 +438,9 @@ class selfserve_wash_flow implements selfserve_wash_flow_i
         if (!$session->markCompletedIfOpen($orderId)) {
             return $this->getSessionSummary((int)$session->id);
         }
-        $this->disableMachineRelayForCompletedWash($laneId);
+        if ($disableRelays) {
+            $this->disableMachineRelayForCompletedWash($laneId);
+        }
         $this->logSessionEvent((int)$session->id, selfserve_wash_event_type::SESSION_COMPLETED, [
             'lane_id' => $laneId,
             'reg' => $reg === null ? (string)$session->reg->value() : selfserve::standardize_registration($reg),

services/nginx/app/modules/selfserve/interfaces/selfserve_wash_flow_i.php

@@ -14,7 +14,7 @@ interface selfserve_wash_flow_i
 
     public function getLatestSessionSummary(int $laneId, string $reg): array;
 
-    public function completeLatestSessionForLane(int $laneId, ?string $reg = null, ?int $customerNumber = null, ?int $orderId = null): ?array;
+    public function completeLatestSessionForLane(int $laneId, ?string $reg = null, ?int $customerNumber = null, ?int $orderId = null, bool $disableRelays = true): ?array;
 
     public function forceStopLane(int $laneId, ?int $sessionId = null, bool $bill = false, ?string $reason = null, ?int $userId = null): array;
 }

services/nginx/app/modules/selfserve/selfserve.md

@@ -439,7 +439,7 @@ Public methods:
 | `recordMachineStartWebhook(int $laneId, ?string $reg = null, array $payload = [])` | The machine button or hardware event fired. | Full session summary after the machine-start event. |
 | `getSessionSummary(int $sessionId)` | You have a session id already. | Full session summary. |
 | `getLatestSessionSummary(int $laneId, string $reg)` | You want the latest session for a lane and vehicle. | Full session summary. |
-| `completeLatestSessionForLane(int $laneId, ?string $reg = null, ?int $customerNumber = null, ?int $orderId = null)` | STOP has finished and you want to close the latest open session. | Full summary, or `null` if no open session exists. |
+| `completeLatestSessionForLane(int $laneId, ?string $reg = null, ?int $customerNumber = null, ?int $orderId = null, bool $disableRelays = true)` | STOP has finished and you want to close the latest open session. Normal STOP passes `false` because it already disabled relays before opening the exit port. | Full summary, or `null` if no open session exists. |
 
 Key implementation details:
 

services/nginx/app/modules/selfserve/traits/selfserve_lane_command_t.php

@@ -538,7 +538,8 @@ trait selfserve_lane_command_t
                 $this->id,
                 $this->getLicensePlate() ?: null,
                 $this->getCustomerNumber() ?: null,
-                method_exists($this, 'getLastInvoiceOrderId') ? $this->getLastInvoiceOrderId() : null
+                method_exists($this, 'getLastInvoiceOrderId') ? $this->getLastInvoiceOrderId() : null,
+                false
             );
         } catch (\Throwable) {
             // Session completion must not block STOP flow.

services/nginx/app/objects/customer_password_reset_keys_o.php

@@ -18,13 +18,18 @@ class customer_password_reset_keys_o extends db
     public object_property $updated_at;
     public object_property $deleted_at;
     const TOKEN_LENGTH = 32;
-    const TOKEN_EXPIRY_SECONDS = 3600; // 1 hour
+    const TOKEN_EXPIRY_SECONDS = 72 * 60 * 60; // 72 hours
 
     public function structure(): void
     {
         $this->setTable('customer_password_reset_keys');
     }
 
+    private function validTokenWhereClause(): string
+    {
+        return "deleted_at IS NULL AND created_at >= DATE_SUB(NOW(), INTERVAL " . self::TOKEN_EXPIRY_SECONDS . " SECOND)";
+    }
+
 
     /**
      * Add a new customer reset key
@@ -65,9 +70,8 @@ class customer_password_reset_keys_o extends db
         if (strlen($token) !== self::TOKEN_LENGTH) {
             return null;
         }
-        // Query the database for a valid token
-        $current_time = date('Y-m-d H:i:s');
-        $sql = "SELECT id FROM $this->table WHERE token = '" . $db->escape_string($token) . "' AND deleted_at IS NULL AND created_at >= DATE_SUB('$current_time', INTERVAL " . self::TOKEN_EXPIRY_SECONDS . " SECOND) LIMIT 1";
+        // Query the database for a valid token using the same clock that writes created_at.
+        $sql = "SELECT id FROM $this->table WHERE token = '" . $db->escape_string($token) . "' AND " . $this->validTokenWhereClause() . " LIMIT 1";
         $result = $db->query($sql);
         if ($result->num_rows === 0) {
             return null;
@@ -85,13 +89,11 @@ class customer_password_reset_keys_o extends db
      */
     public function isValidToken(): bool
     {
+        global $db;
         self::requireSelected();
-        $created_at = strtotime($this->created_at->value());
-        $current_time = time();
-        return (
-            ($current_time - $created_at) <= self::TOKEN_EXPIRY_SECONDS) &&
-            ($this->deleted_at->value() === null
-            );
+        $sql = "SELECT id FROM $this->table WHERE id = " . (int)$this->id . " AND " . $this->validTokenWhereClause() . " LIMIT 1";
+        $result = $db->query($sql);
+        return $result->num_rows > 0;
     }
 
     /**
@@ -140,4 +142,4 @@ class customer_password_reset_keys_o extends db
     {
         //TODO: Add cache invalidation
     }
-}
+}

services/nginx/app/objects/users_o.php

@@ -127,40 +127,47 @@ class users_o extends db
 
     private function importCustomerFromExternalSource(int $customer_number): object|bool
     {
-        global $db;
         // Get the customer data from the external source
         $economic = new economicCustomers();
         $customer_data = $economic->getCustomerId($customer_number);
-        // DEBUG: Return the customer data
-        // Check if the customer exists
         if ($customer_data) {
-            // Avoid SQL injection
-            $customer_number = $db->escape_string($customer_data->customerNumber);
-            // Double check if the customer exists
-            $sql = "SELECT * FROM $this->table WHERE customer_number = '$customer_number'";
-            $result = $db->query($sql);
-            if ($result->num_rows > 0) {
-                $this->id = $result->fetch_assoc()['id'];
-                $this->getObjectProperties();
-            } else {
-                // Import the customer
-                $this->add($customer_number, '', 0);
-                // Nullify the password
-                $this->password->nullify();
-                // If the customer has an email address, save it
-                if (isset($customer_data->email)) {
-                    $this->email->set($customer_data->email);
-                }
-                // If the customer has a name, save it as the display name
-                if (isset($customer_data->name)) {
-                    $this->display_name->set($customer_data->name);
-                }
-            }
+            return $this->importCustomerFromEconomicCustomerData($customer_data);
         }
-        // Else return false
+
         return false;
     }
 
+    public function importCustomerFromEconomicCustomerData(object $customer_data): users_o|bool
+    {
+        global $db;
+
+        if (!isset($customer_data->customerNumber) || !is_numeric($customer_data->customerNumber)) {
+            return false;
+        }
+
+        $customer_number = $db->escape_string((string)$customer_data->customerNumber);
+        $sql = "SELECT * FROM $this->table WHERE customer_number = '$customer_number'";
+        $result = $db->query($sql);
+        if ($result->num_rows > 0) {
+            $this->id = (int)$result->fetch_assoc()['id'];
+            $this->getObjectProperties();
+            return $this;
+        }
+
+        $this->add($customer_number, '', 0);
+        $this->password->nullify();
+
+        if (isset($customer_data->email)) {
+            $this->email->set($customer_data->email);
+        }
+
+        if (isset($customer_data->name)) {
+            $this->display_name->set($customer_data->name);
+        }
+
+        return $this;
+    }
+
     /**
      * @throws Exception
      */
@@ -258,7 +265,7 @@ class users_o extends db
      * @param int|null $user_id The user id to add the attribute to
      * @throws Exception If the user is not selected, and the user_id is null
      */
-    public function addAttribute(string $attribute, int $user_id = null): void
+    public function addAttribute(string $attribute, ?int $user_id = null): void
     {
         global $db;
         if ($user_id === null) {
@@ -272,7 +279,7 @@ class users_o extends db
         $db->query($sql);
     }
 
-    public function deleteAttribute(string $attribute, int $user_id = null): void
+    public function deleteAttribute(string $attribute, ?int $user_id = null): void
     {
         global $db;
         if ($user_id === null) {
@@ -304,7 +311,7 @@ class users_o extends db
         $db->query($sql);
     }
 
-    public function doesUserHaveAttribute(string $attribute, int $user_id = null): bool
+    public function doesUserHaveAttribute(string $attribute, ?int $user_id = null): bool
     {
         global $db;
         if ($user_id === null) {
@@ -518,8 +525,12 @@ class users_o extends db
         return customer_name_cache_payload_builder::build($cached_name, $fallback_name);
     }
 
-    public function getCustomerEcocomicData(int $customer_number = null): users_o
+    public function getCustomerEcocomicData(?int $customer_number = null): users_o
     {
+        if ($customer_number !== null && !isset($this->id)) {
+            $this->getUserByCustomerNumber($customer_number);
+        }
+
         // Check if the customer number is set
         if (!isset($this->customer_number) && $customer_number === null) {
             return $this;
@@ -531,7 +542,9 @@ class users_o extends db
             return $this;
         }
 
-        $cachedCustomer = $this->getCached('economic_customer');
+        $cachedCustomer = isset($this->id) && $this->id > 0
+            ? $this->getCached('economic_customer')
+            : null;
         if (is_object($cachedCustomer)) {
             $cachedCustomerNumber = (int)($cachedCustomer->customerNumber ?? $cachedCustomer->customer_number ?? 0);
             if ($cachedCustomerNumber === $customer_number) {
@@ -717,7 +730,7 @@ class users_o extends db
         $this->permissions = $perms;
     }
 
-    public function getUserAttributes(int $user_id = null): array
+    public function getUserAttributes(?int $user_id = null): array
     {
         global $db;
         if ($user_id === null) {
@@ -1106,7 +1119,7 @@ class users_o extends db
      * Set the password for the user
      * @throws Exception If the user is not selected
      */
-    public function setPassword(string $password = null): void
+    public function setPassword(?string $password = null): void
     {
         self::requireSelected();
         global $db;

services/nginx/app/openapi.yaml

@@ -6266,6 +6266,33 @@ paths:
         '401': { $ref: '#/components/responses/Unauthorized' }
         '403': { $ref: '#/components/responses/Forbidden' }
 
+  /order-bookings/completion-confirmation/resend:
+    post:
+      tags:
+        - Bookings
+      summary: Resend order booking completion confirmation
+      description: Resends the customer completion confirmation email with the wash certificate for a completed order booking. Requires `complete_bookings` and access to the booking's department.
+      operationId: resendOrderBookingCompletionConfirmation
+      requestBody:
+        required: true
+        content:
+          application/json:
+            schema:
+              type: object
+              required: [id]
+              properties:
+                id: {type: integer}
+      responses:
+        '200':
+          description: Completion confirmation resent successfully
+          content:
+            application/json:
+              schema: {}
+        '400': { $ref: '#/components/responses/BadRequest' }
+        '401': { $ref: '#/components/responses/Unauthorized' }
+        '403': { $ref: '#/components/responses/Forbidden' }
+        '409': { $ref: '#/components/responses/Conflict' }
+
   /order-bookings/complete:
     post:
       tags:
@@ -11638,6 +11665,23 @@ paths:
               schema:
                 $ref: '#/components/schemas/ModuleConfigUpdateResponse'
 
+  /slack/config/test:
+    post:
+      tags: [Config]
+      summary: Test Slack customer registration webhook
+      operationId: testSlackCustomerRegistrationWebhook
+      responses:
+        '200':
+          description: Slack customer registration webhook test completed successfully
+          content:
+            application/json:
+              schema:
+                $ref: '#/components/schemas/SlackConfigTestResponse'
+        '400':
+          description: Slack customer registration webhook URL is not configured
+        '502':
+          description: Slack customer registration webhook test failed
+
   /backups/config:
     get:
       tags: [Config]
@@ -15163,6 +15207,14 @@ components:
           example: https://hooks.slack.com/services/...
       required: [module, variable, type, value]
 
+    SlackConfigTestResult:
+      type: object
+      properties:
+        configured: { type: boolean }
+        sent: { type: boolean }
+        message: { type: string }
+      required: [configured, sent, message]
+
     BackupsConfigEntry:
       type: object
       properties:
@@ -15439,6 +15491,14 @@ components:
             data: { type: array, items: { $ref: '#/components/schemas/SlackConfigEntry' } }
           required: [data]
 
+    SlackConfigTestResponse:
+      allOf:
+        - $ref: '#/components/schemas/ModuleConfigEnvelopeBase'
+        - type: object
+          properties:
+            data: { $ref: '#/components/schemas/SlackConfigTestResult' }
+          required: [data]
+
     BackupsConfigListResponse:
       allOf:
         - $ref: '#/components/schemas/ModuleConfigEnvelopeBase'
@@ -18414,10 +18474,10 @@ components:
         path_sample_limit:
           type: integer
           minimum: 1
-          maximum: 200
-          default: 200
+          maximum: 2048
+          default: 2048
           nullable: true
-          description: Optional cap for returned path rows. Omitted and larger values are capped at 200.
+          description: Optional cap for returned path rows. Omitted returns every projected terminal path within the state cap; larger values are capped at 2048.
 
     SelfserveStudioPathOutcomesResponse:
       type: object

services/nginx/app/routes/authRoute.php

@@ -409,15 +409,7 @@ class authRoute
              * Check if the cvr already exists
              */
             $economic = new economic();
-            $economic_response = ($economic->customers->customers->search([
-                'corporateIdentificationNumber' => (string)$cvr,
-            ], [
-                'skipPages' => 0,
-                'pageSize' => 1, // Since the limit is 1000, we need to set the page size to 1000.
-            ])->collection);
-            if (!is_array($economic_response)) {
-                $economic_response = [];
-            }
+            $economic_response = $this->searchEconomicCustomersByCvr($economic, (string)$cvr);
 
             $localUserExists = $this->localCustomerNumberExists($companyPhone);
             $matchingEconomicCustomer = $this->findEconomicCustomerByNumber($economic_response, $companyPhone);
@@ -448,22 +440,66 @@ class authRoute
                 );
             }
 
+            // Get the CVR company information used for the e-conomic customer payload.
+            $companyInformation = null;
+            try {
+                $companyInformation = (new virkdata())->getCompanyInformation((string)$cvr, '', []);
+            } catch (Exception $exception) {
+                $this->logRegisterCvrIssue('AUTH_REGISTER_CVR_LOOKUP_FAILED', [
+                    'phase' => 'cvr_lookup',
+                    'cvr' => (string)$cvr,
+                    'requestedCustomerNumber' => $companyPhone,
+                    'message' => $exception->getMessage(),
+                ]);
+                $response->error('CVR could not be verified. Please check the CVR number and try again.', 400);
+                return;
+            }
+
+            $name = trim((string)($companyInformation->name ?? ''));
+            if ($name === '') {
+                $this->logRegisterCvrIssue('AUTH_REGISTER_CVR_LOOKUP_INVALID_RESPONSE', [
+                    'phase' => 'cvr_lookup',
+                    'cvr' => (string)$cvr,
+                    'requestedCustomerNumber' => $companyPhone,
+                ]);
+                $response->error('CVR could not be verified. Please check the CVR number and try again.', 400);
+                return;
+            }
+
             if ($localUserExists) {
                 $response->error('Company phone number already registered', 400);
             }
 
-            // Get the CVR company information used for the e-conomic customer payload.
-            $companyInformation = (new virkdata())->getCompanyInformation($cvr, '', []);
-            $name = (string)($companyInformation->name ?? '');
-            $result = $economic->createCustomer(
-                (int)$companyPhone,
-                $name,
-                (int)$cvr,
-                (string)$invoiceEmail,
-                (int)$companyPhone,
-                (int)$contactPhone,
-                $companyInformation,
-            );
+            try {
+                $result = $economic->createCustomer(
+                    (int)$companyPhone,
+                    $name,
+                    (int)$cvr,
+                    (string)$invoiceEmail,
+                    (int)$companyPhone,
+                    (int)$contactPhone,
+                    $companyInformation,
+                );
+            } catch (Exception $exception) {
+                $recoveredCustomer = $this->recoverRegistrationAfterCreateFailure(
+                    $economic,
+                    (string)$cvr,
+                    $companyPhone,
+                    (string)$invoiceEmail
+                );
+
+                if ($recoveredCustomer !== null) {
+                    $response->success($recoveredCustomer, 200);
+                }
+
+                $this->logRegisterCvrIssue('AUTH_REGISTER_CVR_CREATE_FAILED', [
+                    'phase' => 'create',
+                    'cvr' => (string)$cvr,
+                    'requestedCustomerNumber' => $companyPhone,
+                    'message' => $exception->getMessage(),
+                ]);
+                $response->error('Failed to create customer in e-conomic.', 502);
+            }
 
             if (!isset($result->customerNumber) || !is_numeric($result->customerNumber)) {
                 $this->logRegisterCvrIssue('AUTH_REGISTER_CVR_INVALID_CREATE_RESPONSE', [
@@ -495,7 +531,7 @@ class authRoute
                 );
             }
 
-            $this->bootstrapLocalCustomerOrFail($companyPhone);
+            $this->bootstrapLocalCustomerOrFail($companyPhone, $result);
             $this->sendRegistrationWelcomeEmails($companyPhone, (string)$invoiceEmail);
             $response->success($result, 201);
         });
@@ -534,7 +570,8 @@ class authRoute
             $reset_link = "https://truckwash.io/auth/password-reset/" . $token;
 
             $subject = 'Adgangskode nulstilling';
-            $message = "Du har anmodet om at nulstille din adgangskode. Klik på linket herunder for at fortsætte:<br><br><a href='$reset_link'>$reset_link</a><br><br>Linket er gyldigt i 1 time.";
+            $valid_hours = (int)(customer_password_reset_keys_o::TOKEN_EXPIRY_SECONDS / 3600);
+            $message = "Du har anmodet om at nulstille din adgangskode. Klik på linket herunder for at fortsætte:<br><br><a href='$reset_link'>$reset_link</a><br><br>Linket er gyldigt i $valid_hours timer.";
 
             try {
                 $email->sendEmail($email_address, $user->display_name->value() ?? 'Kunde', $subject, $message, null);
@@ -758,6 +795,49 @@ class authRoute
         return count($rows) > 0;
     }
 
+    private function searchEconomicCustomersByCvr(economic $economic, string $cvr): array
+    {
+        $economic_response = ($economic->customers->customers->search([
+            'corporateIdentificationNumber' => $cvr,
+        ], [
+            'skipPages' => 0,
+            'pageSize' => 1,
+        ])->collection);
+
+        return is_array($economic_response) ? $economic_response : [];
+    }
+
+    private function recoverRegistrationAfterCreateFailure(
+        economic $economic,
+        string $cvr,
+        int $customerNumber,
+        string $invoiceEmail
+    ): ?object {
+        // The upstream POST can commit before the client receives a validation/transport error.
+        // Re-read by CVR and only recover when e-conomic confirms the requested customer number.
+        try {
+            $economic_response = $this->searchEconomicCustomersByCvr($economic, $cvr);
+        } catch (Exception $searchException) {
+            $this->logRegisterCvrIssue('AUTH_REGISTER_CVR_CREATE_RECOVERY_SEARCH_FAILED', [
+                'phase' => 'create_recovery',
+                'cvr' => $cvr,
+                'requestedCustomerNumber' => $customerNumber,
+                'message' => $searchException->getMessage(),
+            ]);
+            return null;
+        }
+
+        $matchingEconomicCustomer = $this->findEconomicCustomerByNumber($economic_response, $customerNumber);
+        if ($matchingEconomicCustomer === null || $this->localCustomerNumberExists($customerNumber)) {
+            return null;
+        }
+
+        $this->bootstrapLocalCustomerOrFail($customerNumber, $matchingEconomicCustomer);
+        $this->sendRegistrationWelcomeEmails($customerNumber, $invoiceEmail);
+
+        return $matchingEconomicCustomer;
+    }
+
     private function findEconomicCustomerByNumber(array $customers, int $customerNumber): ?object
     {
         foreach ($customers as $customer) {
@@ -785,19 +865,46 @@ class authRoute
     /**
      * @throws Exception
      */
-    private function bootstrapLocalCustomerOrFail(int $customerNumber): users_o
+    private function bootstrapLocalCustomerOrFail(int $customerNumber, ?object $economicCustomer = null): users_o
     {
         global $response;
 
-        $customer = (new users_o())->getUserByCustomerNumber($customerNumber);
-        if (method_exists($customer, 'exists') && $customer->exists()) {
-            return $customer;
+        $customer = new users_o();
+        try {
+            $customer = $customer->getUserByCustomerNumber($customerNumber);
+            if (method_exists($customer, 'exists') && $customer->exists()) {
+                return $customer;
+            }
+        } catch (Exception $exception) {
+            $this->logRegisterCvrIssue('AUTH_REGISTER_CVR_LOCAL_BOOTSTRAP_LOOKUP_FAILED', [
+                'customerNumber' => $customerNumber,
+                'message' => $exception->getMessage(),
+            ]);
+        }
+
+        if (
+            $economicCustomer !== null
+            && $this->extractEconomicCustomerNumber($economicCustomer) === $customerNumber
+            && method_exists($customer, 'importCustomerFromEconomicCustomerData')
+        ) {
+            try {
+                $importedCustomer = $customer->importCustomerFromEconomicCustomerData($economicCustomer);
+                if (is_object($importedCustomer) && method_exists($importedCustomer, 'exists') && $importedCustomer->exists()) {
+                    return $importedCustomer;
+                }
+            } catch (Exception $exception) {
+                $this->logRegisterCvrIssue('AUTH_REGISTER_CVR_LOCAL_SNAPSHOT_BOOTSTRAP_FAILED', [
+                    'customerNumber' => $customerNumber,
+                    'message' => $exception->getMessage(),
+                ]);
+            }
         }
 
         $this->logRegisterCvrIssue('AUTH_REGISTER_CVR_LOCAL_BOOTSTRAP_FAILED', [
             'customerNumber' => $customerNumber,
         ]);
         $response->error('Customer was created in e-conomic but could not be imported locally.', 500);
+        throw new Exception('Customer was created in e-conomic but could not be imported locally.');
     }
 
     /**

services/nginx/app/routes/moduleConfigRoute.php

@@ -221,6 +221,35 @@ class moduleConfigRoute
             ]
         );
 
+        /** Slack config > TEST */
+        $this->post('/slack/config/test', function () {
+            global $response;
+            $this->requirePermission('slack_config');
+            $user = (new authentication())->get_user();
+            if (!$user) {
+                (new logs_o())->add('slack_config', 'global', 1, 0, 'SLACK_CONFIG', 'No user found, or invalid session');
+                $response->error('Invalid session', 400);
+            }
+
+            $result = (new slack())->test_customer_registration_webhook();
+            if (($result['configured'] ?? false) !== true) {
+                (new logs_o())->add('slack_config', 'global', 0, $user->id, 'SLACK_CONFIG_TEST', 'Slack customer registration webhook URL is not configured');
+                $response->error($result['message'] ?? 'Slack customer registration webhook URL is not configured.', 400);
+            }
+
+            if (($result['sent'] ?? false) !== true) {
+                (new logs_o())->add('slack_config', 'global', 0, $user->id, 'SLACK_CONFIG_TEST', 'Slack customer registration test webhook failed');
+                $response->error($result['message'] ?? 'Slack test message failed.', 502);
+            }
+
+            (new logs_o())->add('slack_config', 'global', 1, $user->id, 'SLACK_CONFIG_TEST', 'Successfully tested Slack customer registration webhook');
+            $response->success($result);
+        },
+            [
+                'slack_config' => 'Test Slack config'
+            ]
+        );
+
         $this->get('/backups/config', function () {
             global $response;
             $this->requirePermission('backups_config');

services/nginx/app/routes/moduleSelfServeRoute.php

@@ -1670,9 +1670,13 @@ class moduleSelfServeRoute
         }
 
         if ($allow_customer_self_serve) {
-            $customer_allowed = $requires_active_wash
-                ? $this->canCustomerUseActiveOperationalSelfServeLane($lane, $customer_number, $allow_department_active_wash)
-                : $this->canCustomerUseSelfServeLane($lane, $customer_number);
+            if ($requires_active_wash && $allow_department_active_wash) {
+                $customer_allowed = $this->canCustomerUsePropertyGateForLane($lane, $customer_number);
+            } else {
+                $customer_allowed = $requires_active_wash
+                    ? $this->canCustomerUseActiveOperationalSelfServeLane($lane, $customer_number, false)
+                    : $this->canCustomerUseSelfServeLane($lane, $customer_number);
+            }
 
             if ($customer_allowed) {
                 return;
@@ -1827,7 +1831,17 @@ class moduleSelfServeRoute
 
     protected function canCustomerUsePropertyGateForLane(selfserve_lane $lane, int $customer_number): bool
     {
-        return $this->canCustomerUseActiveOperationalSelfServeLane($lane, $customer_number, true);
+        if ($this->canCustomerUseActiveOperationalSelfServeLane($lane, $customer_number, true)) {
+            return true;
+        }
+
+        if ($customer_number <= 0 || !$this->isOwnCustomerContext($customer_number)) {
+            return false;
+        }
+
+        $department_id = $this->departmentIdForLane($lane);
+        return $department_id > 0
+            && $this->customerHasActiveSelfServeWashInDepartment($department_id, $customer_number);
     }
 
     protected function canCustomerUseActiveOperationalSelfServeLane(

services/nginx/app/routes/orderBookingRoute.php

@@ -392,6 +392,37 @@ class orderBookingRoute
             ]
         );
 
+        $this->post('/order-bookings/completion-confirmation/resend', function () {
+            global $response;
+
+            $object = self::getTargetObject();
+            if (!$object || !$object->exists()) {
+                $response->error('Order booking does not exist.', 400);
+            }
+
+            self::requirePermission('complete_bookings');
+            self::requireDepartmentAccess((int)$object->department->value());
+
+            if (!$object->hasTransaction()) {
+                $response->error('Order booking has not been completed yet.', 409);
+            }
+
+            if (!$object->getOrder()->hasWashCertificateAttached()) {
+                $response->error('Order booking completion confirmation is not available yet.', 409);
+            }
+
+            (new email())->sendWashCertificateEmailToCustomer($object);
+
+            $response->success([
+                'message' => 'Completion confirmation resent successfully.',
+                'booking' => $object->asArray(),
+            ]);
+        },
+            [
+                'complete_bookings' => 'Permission for department admins to resend order booking completion confirmation emails.'
+            ]
+        );
+
         $this->post('/order-bookings/complete', function () {
             // Require the user to be logged in
             global $response;

services/nginx/app/tests/Api/OrderBookingConfirmationResendApiTest.php

@@ -2,6 +2,9 @@
 
 declare(strict_types=1);
 
+use classes\email;
+use classes\pdf_store;
+
 putenv('EMAIL_FAKE_MODE=1');
 
 usesApiSuite();
@@ -76,3 +79,97 @@ it('requires department access when resending order booking confirmations', func
         ->assertSuccess(false)
         ->assertMissingPermissions(['department_access_' . $department['id']]);
 });
+
+it('allows department admins to resend order booking completion confirmations', function (): void {
+    email::resetFakeDeliveries();
+
+    $customer = api_fixtures()->createUser([
+        'display_name' => 'Resend Completion Confirmation Customer',
+        'email' => 'resend-completion-confirmation@example.test',
+    ]);
+    $department = api_fixtures()->createDepartment([
+        'name' => 'Resend Completion Confirmation Department',
+    ]);
+    $cashier = api_fixtures()->createUser([
+        'display_name' => 'Resend Completion Confirmation Cashier',
+    ]);
+    $order = api_fixtures()->createOrder([
+        'customer_id' => $customer['customer_number'],
+        'cashier_id' => $cashier['id'],
+        'department_id' => $department['id'],
+    ]);
+    $booking = api_fixtures()->createOrderBooking([
+        'customer_number' => $customer['customer_number'],
+        'department' => $department['id'],
+        'reference' => 'RESEND-COMPLETION',
+        'reg_1' => 'DONE1',
+        'order_id' => $order['id'],
+    ]);
+    api_fixtures()->createOrderAttachment([
+        'order_id' => $order['id'],
+        'content' => json_encode([
+            'document' => 'completion-confirmation-test.pdf',
+            'other' => 'wash_certificate',
+        ], JSON_THROW_ON_ERROR),
+    ]);
+    (new pdf_store())->createObject('completion-confirmation-test.pdf', '%PDF-1.4 test completion confirmation');
+    $session = api_fixtures()->createUserSession([
+        'complete_bookings',
+        'department_access_' . $department['id'],
+    ]);
+
+    $response = api_client()->post('/order-bookings/completion-confirmation/resend', [
+        'id' => $booking['id'],
+    ], $session['headers']);
+
+    $response
+        ->assertStatus(200)
+        ->assertEnvelope()
+        ->assertSuccess();
+
+    expect($response->data())
+        ->toBeArray()
+        ->toHaveKey('message', 'Completion confirmation resent successfully.')
+        ->toHaveKey('booking')
+        ->and($response->data()['booking'])
+        ->toBeArray()
+        ->and($response->data()['booking']['id'] ?? null)
+        ->toBe($booking['id'])
+        ->and(email::$fake_deliveries)
+        ->toHaveCount(1)
+        ->and(email::$fake_deliveries[0]['to'] ?? null)
+        ->toBe('resend-completion-confirmation@example.test')
+        ->and(email::$fake_deliveries[0]['subject'] ?? '')
+        ->toContain('RESEND-COMPLETION');
+});
+
+it('requires department access when resending order booking completion confirmations', function (): void {
+    $customer = api_fixtures()->createUser([
+        'display_name' => 'Resend Completion Confirmation Foreign Customer',
+    ]);
+    $department = api_fixtures()->createDepartment([
+        'name' => 'Resend Completion Confirmation Foreign Department',
+    ]);
+    $order = api_fixtures()->createOrder([
+        'customer_id' => $customer['customer_number'],
+        'department_id' => $department['id'],
+    ]);
+    $booking = api_fixtures()->createOrderBooking([
+        'customer_number' => $customer['customer_number'],
+        'department' => $department['id'],
+        'order_id' => $order['id'],
+    ]);
+    $session = api_fixtures()->createUserSession([
+        'complete_bookings',
+    ]);
+
+    $response = api_client()->post('/order-bookings/completion-confirmation/resend', [
+        'id' => $booking['id'],
+    ], $session['headers']);
+
+    $response
+        ->assertStatus(403)
+        ->assertEnvelope()
+        ->assertSuccess(false)
+        ->assertMissingPermissions(['department_access_' . $department['id']]);
+});

services/nginx/app/tests/Support/Api/ApiClient.php

@@ -96,6 +96,10 @@ final class ApiClient
 
         $decoded = json_decode($body, true);
 
+        if (getenv('EMAIL_FAKE_MODE') === '1' && class_exists(\classes\email::class)) {
+            \classes\email::syncFakeDeliveries();
+        }
+
         return new ApiResponse($status, $responseHeaders, $decoded, (string)$body);
     }
 }

services/nginx/app/tests/Support/legacy_test_manifest.php

@@ -2,6 +2,7 @@
 
 return [
     ['path' => 'tests/auth/CreateTokenUserNotFoundTest.php', 'classification' => 'unit', 'type' => 'script'],
+    ['path' => 'tests/auth/NewCustomerEmailTemplateTest.php', 'classification' => 'unit', 'type' => 'script'],
     ['path' => 'tests/auth/PasskeyChallengeTest.php', 'classification' => 'unit', 'type' => 'script'],
     ['path' => 'tests/auth/PemToCoseConversionTest.php', 'classification' => 'unit', 'type' => 'script'],
     ['path' => 'tests/auth/RegisterCvrTest.php', 'classification' => 'unit', 'type' => 'script'],

services/nginx/app/tests/Unit/Auth/PasswordResetTokenExpiryTest.php

@@ -0,0 +1,105 @@
+<?php
+
+use objects\customer_password_reset_keys_o;
+
+app_require('objects/customer_password_reset_keys_o.php');
+
+if (!class_exists('PasswordResetTokenExpiryFakeResult')) {
+    class PasswordResetTokenExpiryFakeResult
+    {
+        public int $num_rows;
+
+        public function __construct(private readonly array $rows)
+        {
+            $this->num_rows = count($rows);
+        }
+
+        public function fetch_assoc(): ?array
+        {
+            return $this->rows[0] ?? null;
+        }
+    }
+}
+
+if (!class_exists('PasswordResetTokenExpiryFakeDb')) {
+    class PasswordResetTokenExpiryFakeDb
+    {
+        public array $queries = [];
+
+        public function __construct(private readonly array $results)
+        {
+        }
+
+        public function escape_string(string $string): string
+        {
+            return addslashes($string);
+        }
+
+        public function query(string $sql): PasswordResetTokenExpiryFakeResult
+        {
+            $this->queries[] = $sql;
+
+            return $this->results[count($this->queries) - 1] ?? new PasswordResetTokenExpiryFakeResult([]);
+        }
+    }
+}
+
+if (!class_exists('PasswordResetTokenExpiryProbe')) {
+    class PasswordResetTokenExpiryProbe extends customer_password_reset_keys_o
+    {
+        public function getObjectProperties(): void
+        {
+        }
+
+        public function forceSelectedId(int $id): void
+        {
+            $this->id = $id;
+        }
+    }
+}
+
+beforeEach(function (): void {
+    $this->previousDb = $GLOBALS['db'] ?? null;
+});
+
+afterEach(function (): void {
+    if ($this->previousDb !== null) {
+        $GLOBALS['db'] = $this->previousDb;
+        return;
+    }
+
+    unset($GLOBALS['db']);
+});
+
+it('keeps password reset tokens valid for 72 hours', function (): void {
+    expect(customer_password_reset_keys_o::TOKEN_EXPIRY_SECONDS)->toBe(72 * 60 * 60);
+});
+
+it('looks up reset tokens using the database 72 hour validity window', function (): void {
+    $GLOBALS['db'] = new PasswordResetTokenExpiryFakeDb([
+        new PasswordResetTokenExpiryFakeResult([['id' => 42]]),
+    ]);
+
+    $token = str_repeat('a', customer_password_reset_keys_o::TOKEN_LENGTH);
+    $probe = new PasswordResetTokenExpiryProbe();
+
+    $found = $probe->findValidByToken($token);
+
+    expect($found)->toBe($probe)
+        ->and($probe->id)->toBe(42)
+        ->and($GLOBALS['db']->queries[0])->toContain('created_at >= DATE_SUB(NOW(), INTERVAL 259200 SECOND)')
+        ->and($GLOBALS['db']->queries[0])->not->toContain("DATE_SUB('");
+});
+
+it('uses the same database 72 hour window for the selected token guard', function (): void {
+    $GLOBALS['db'] = new PasswordResetTokenExpiryFakeDb([
+        new PasswordResetTokenExpiryFakeResult([['id' => 42]]),
+    ]);
+
+    $probe = new PasswordResetTokenExpiryProbe();
+    $probe->forceSelectedId(42);
+
+    expect($probe->isValidToken())->toBeTrue()
+        ->and($GLOBALS['db']->queries[0])->toContain('id = 42')
+        ->and($GLOBALS['db']->queries[0])->toContain('created_at >= DATE_SUB(NOW(), INTERVAL 259200 SECOND)');
+});

services/nginx/app/tests/Unit/Bookings/OrderBookingCompletionConfirmationRouteTest.php

@@ -0,0 +1,16 @@
+<?php
+
+it('wires the order booking completion confirmation resend endpoint', function (): void {
+    $routeFile = app_path('routes/orderBookingRoute.php');
+
+    expect(is_file($routeFile))->toBeTrue();
+
+    $routeCode = preg_replace('/\s+/', ' ', (string)file_get_contents($routeFile));
+
+    expect($routeCode)
+        ->toContain("$" . "this->post('/order-bookings/completion-confirmation/resend', function () {")
+        ->toContain("self::requirePermission('complete_bookings');")
+        ->toContain('self::requireDepartmentAccess((int)$object->department->value());')
+        ->toContain('(new email())->sendWashCertificateEmailToCustomer($object);')
+        ->toContain("'Completion confirmation resent successfully.'");
+});

services/nginx/app/tests/Unit/Email/FakeEmailDeliveriesTest.php

@@ -0,0 +1,49 @@
+<?php
+
+app_require('classes/email.php');
+
+use classes\email;
+
+it('syncs fake email deliveries written by another process', function (): void {
+    $previousFakeMode = getenv('EMAIL_FAKE_MODE');
+    $previousFakePath = getenv('EMAIL_FAKE_DELIVERIES_PATH');
+    $path = sys_get_temp_dir() . DIRECTORY_SEPARATOR . 'truckwash-fake-email-sync-' . bin2hex(random_bytes(4)) . '.jsonl';
+
+    putenv('EMAIL_FAKE_MODE=1');
+    putenv('EMAIL_FAKE_DELIVERIES_PATH=' . $path);
+    email::resetFakeDeliveries();
+
+    try {
+        file_put_contents($path, json_encode([
+            'to' => 'customer@example.test',
+            'recipient_name' => 'Customer',
+            'subject' => 'Subject',
+            'message' => '',
+            'html' => '<p>Body</p>',
+        ], JSON_UNESCAPED_UNICODE | JSON_UNESCAPED_SLASHES) . PHP_EOL);
+
+        email::syncFakeDeliveries();
+
+        expect(email::$fake_deliveries)
+            ->toHaveCount(1)
+            ->and(email::$fake_deliveries[0]['to'] ?? null)
+            ->toBe('customer@example.test')
+            ->and(email::$fake_deliveries[0]['subject'] ?? null)
+            ->toBe('Subject');
+    } finally {
+        email::resetFakeDeliveries();
+        if (is_file($path)) {
+            unlink($path);
+        }
+        if ($previousFakeMode === false) {
+            putenv('EMAIL_FAKE_MODE');
+        } else {
+            putenv('EMAIL_FAKE_MODE=' . $previousFakeMode);
+        }
+        if ($previousFakePath === false) {
+            putenv('EMAIL_FAKE_DELIVERIES_PATH');
+        } else {
+            putenv('EMAIL_FAKE_DELIVERIES_PATH=' . $previousFakePath);
+        }
+    }
+});

services/nginx/app/tests/Unit/Email/NewCustomerEmailTemplateLegacyScriptTest.php

@@ -0,0 +1,7 @@
+<?php
+
+it('renders the new customer welcome template without unselected user access or leaked output', function (): void {
+    $result = run_legacy_script('tests/auth/NewCustomerEmailTemplateTest.php');
+
+    expect($result['exitCode'])->toBe(0, $result['output']);
+});

services/nginx/app/tests/Unit/Infrastructure/PhpFpmWorkerConfigTest.php

@@ -0,0 +1,55 @@
+<?php
+
+function phpFpmWorkerConfigRepoRoot(): string
+{
+    $configuredRoot = getenv('PLENO_REPO_ROOT_FOR_TESTS');
+    if (is_string($configuredRoot) && $configuredRoot !== '') {
+        return rtrim($configuredRoot, DIRECTORY_SEPARATOR);
+    }
+
+    $appRoot = defined('WD') ? WD : dirname(__DIR__, 3);
+
+    return dirname($appRoot, 3);
+}
+
+function phpFpmWorkerConfigRepoPath(string $relative): string
+{
+    return phpFpmWorkerConfigRepoRoot() . DIRECTORY_SEPARATOR . str_replace(['/', '\\'], DIRECTORY_SEPARATOR, $relative);
+}
+
+function phpFpmWorkerConfigValue(string $poolConfig, string $key): ?int
+{
+    if (!preg_match('/^' . preg_quote($key, '/') . '\s*=\s*(\d+)\s*$/m', $poolConfig, $matches)) {
+        return null;
+    }
+
+    return (int)$matches[1];
+}
+
+it('configures PHP-FPM with multiple warm request workers', function (): void {
+    $poolPath = phpFpmWorkerConfigRepoPath('services/php/php-fpm-pool.conf');
+    expect(is_file($poolPath))->toBeTrue();
+
+    $poolConfig = (string)file_get_contents($poolPath);
+
+    expect($poolConfig)->toContain('[www]')
+        ->and($poolConfig)->toContain('pm = dynamic')
+        ->and(phpFpmWorkerConfigValue($poolConfig, 'pm.max_children'))->toBeGreaterThanOrEqual(8)
+        ->and(phpFpmWorkerConfigValue($poolConfig, 'pm.start_servers'))->toBeGreaterThanOrEqual(4)
+        ->and(phpFpmWorkerConfigValue($poolConfig, 'pm.min_spare_servers'))->toBeGreaterThanOrEqual(4)
+        ->and(phpFpmWorkerConfigValue($poolConfig, 'pm.max_spare_servers'))->toBeGreaterThanOrEqual(8);
+});
+
+it('copies the worker pool config into every API PHP image', function (): void {
+    $copyInstruction = 'COPY services/php/php-fpm-pool.conf /usr/local/etc/php-fpm.d/zz-pleno-workers.conf';
+    $dockerfiles = [
+        phpFpmWorkerConfigRepoPath('Dockerfile'),
+        phpFpmWorkerConfigRepoPath('Dockerfile.coolify-api'),
+        phpFpmWorkerConfigRepoPath('services/php/Dockerfile'),
+    ];
+
+    foreach ($dockerfiles as $dockerfile) {
+        expect(is_file($dockerfile))->toBeTrue();
+        expect((string)file_get_contents($dockerfile))->toContain($copyInstruction);
+    }
+});

services/nginx/app/tests/Unit/Selfserve/SelfserveRouteWiringTest.php

@@ -295,6 +295,9 @@ it('wires self-serve property gate command permissions', function (): void {
     expect($moduleSelfServeRoute)->toContain('modules_selfserve_lane_command_execute_open_property_access_gate');
     expect($moduleSelfServeRoute)->toContain('modules_selfserve_lane_command_execute_open_property_exit_gate');
     expect($moduleSelfServeRoute)->toContain('Failed to execute self-serve property gate command');
+    expect($moduleSelfServeRoute)->toContain('$this->canCustomerUsePropertyGateForLane($lane, $customer_number)');
+    expect($moduleSelfServeRoute)->toContain('$this->isOwnCustomerContext($customer_number)');
+    expect($moduleSelfServeRoute)->toContain('$this->customerHasActiveSelfServeWashInDepartment($department_id, $customer_number)');
 
     expect($commandTrait)->not->toBeFalse();
     expect($commandTrait)->toContain('Failed to open property access gate.');

services/nginx/app/tests/Unit/Selfserve/SelfserveStudioGraphTest.php

@@ -26,6 +26,54 @@ function selfserve_virtual_hardware_without_constructor(): selfserve_virtual_har
     return $reflection->newInstanceWithoutConstructor();
 }
 
+function selfserve_question_tree_simulator(int $questionCount): callable
+{
+    return function (array $overrides) use ($questionCount): array {
+        $answers = [];
+        foreach ($overrides as $entry) {
+            $answers[(int)($entry['question_id'] ?? 0)] = $entry['value'] ?? null;
+        }
+
+        $questions = [];
+        foreach (range(1, $questionCount) as $questionId) {
+            $questions[] = [
+                'id' => $questionId,
+                'node_id' => 'question:' . $questionId,
+                'label' => 'Question ' . $questionId,
+                'visible' => true,
+                'answer' => $answers[$questionId] ?? null,
+            ];
+        }
+
+        $complete = count($answers) === $questionCount;
+        $allowed = $complete && !in_array(false, $answers, true);
+
+        return [
+            'allowed' => $allowed,
+            'questions' => [],
+            'tasks' => $allowed ? [
+                ['id' => 41, 'task' => 'Start machine', 'services' => ['MACHINE'], 'buttons' => ['start']],
+            ] : [],
+            'allowed_services' => $allowed ? ['MACHINE'] : [],
+            'debug' => [
+                'questions' => $questions,
+                'tasks' => [
+                    [
+                        'id' => 41,
+                        'node_id' => 'task:41',
+                        'label' => 'Start machine',
+                        'active' => $allowed,
+                        'services' => ['MACHINE'],
+                        'buttons' => ['start'],
+                        'order_priority' => 1,
+                    ],
+                ],
+                'signal_timeline' => [],
+            ],
+        ];
+    };
+}
+
 it('serializes questions, conditions, tasks, scopes, and gateways into one graph', function (): void {
     $service = selfserve_studio_graph_without_constructor();
 
@@ -1321,52 +1369,20 @@ it('truncates path outcome projection when the state cap is reached', function (
         ->and($projection['warnings'][0])->toContain('truncated at 2 explored state');
 });
 
-it('applies default caps for wide question trees and reports progress', function (): void {
+it('returns more than 200 projected path cases by default', function (): void {
     $service = selfserve_studio_graph_without_constructor();
-    $simulate = function (array $overrides): array {
-        $answers = [];
-        foreach ($overrides as $entry) {
-            $answers[(int)($entry['question_id'] ?? 0)] = $entry['value'] ?? null;
-        }
+    $projection = $service->projectPathOutcomesFromSimulator(selfserve_question_tree_simulator(8));
 
-        $questions = [];
-        foreach (range(1, 12) as $questionId) {
-            $questions[] = [
-                'id' => $questionId,
-                'node_id' => 'question:' . $questionId,
-                'label' => 'Question ' . $questionId,
-                'visible' => true,
-                'answer' => $answers[$questionId] ?? null,
-            ];
-        }
+    expect($projection['truncated'])->toBeFalse()
+        ->and($projection['summary']['state_count'])->toBe(511)
+        ->and($projection['summary']['terminal_path_count'])->toBe(256)
+        ->and($projection['summary']['path_sample_count'])->toBe(256)
+        ->and($projection['paths'])->toHaveCount(256);
+});
 
-        $complete = count($answers) === 12;
-        $allowed = $complete && !in_array(false, $answers, true);
-
-        return [
-            'allowed' => $allowed,
-            'questions' => [],
-            'tasks' => $allowed ? [
-                ['id' => 41, 'task' => 'Start machine', 'services' => ['MACHINE'], 'buttons' => ['start']],
-            ] : [],
-            'allowed_services' => $allowed ? ['MACHINE'] : [],
-            'debug' => [
-                'questions' => $questions,
-                'tasks' => [
-                    [
-                        'id' => 41,
-                        'node_id' => 'task:41',
-                        'label' => 'Start machine',
-                        'active' => $allowed,
-                        'services' => ['MACHINE'],
-                        'buttons' => ['start'],
-                        'order_priority' => 1,
-                    ],
-                ],
-                'signal_timeline' => [],
-            ],
-        ];
-    };
+it('applies the default state cap for wide question trees and reports progress', function (): void {
+    $service = selfserve_studio_graph_without_constructor();
+    $simulate = selfserve_question_tree_simulator(12);
 
     $progressEvents = [];
     $projection = $service->projectPathOutcomesFromSimulator($simulate, [
@@ -1385,10 +1401,10 @@ it('applies default caps for wide question trees and reports progress', function
         ->and($projection['summary']['question_count'])->toBe(12)
         ->and($projection['summary']['terminal_path_count'])->toBe(1023)
         ->and($projection['summary']['outcome_count'])->toBe(2)
-        ->and($projection['summary']['path_sample_count'])->toBe(200)
+        ->and($projection['summary']['path_sample_count'])->toBe(1023)
         ->and($projection['progress']['complete'])->toBeFalse()
         ->and($projection['progress']['percent'])->toBe(99)
-        ->and($projection['paths'])->toHaveCount(200)
+        ->and($projection['paths'])->toHaveCount(1023)
         ->and($projection['paths'][0]['answers'])->toHaveCount(12)
         ->and($projection['paths'][0]['result'])->toBe('Allowed')
         ->and($projection['warnings'][0])->toContain('truncated at 2048 explored state')

services/nginx/app/tests/Unit/Selfserve/SelfserveWashCompletionRelayWiringTest.php

@@ -79,6 +79,8 @@ it('forces machine and cleaner relays off when a self-serve wash session is comp
 
     expect($washFlow)->not->toBeFalse();
     expect($washFlow)->toContain('$this->disableMachineRelayForCompletedWash($laneId);');
+    expect($washFlow)->toContain('bool $disableRelays = true');
+    expect($washFlow)->toContain('if ($disableRelays) {');
 
     $methodOffset = strpos($washFlow, 'protected function disableMachineRelayForCompletedWash');
     expect($methodOffset)->not->toBeFalse();
@@ -108,3 +110,22 @@ it('always dispatches completion relay off for configured machine relays without
             [selfserve_lane_relay::MACHINE_CLEANER, false],
         ]);
 });
+
+it('normal STOP completion skips duplicate completion relay cleanup after STOP already disabled relays', function (): void {
+    $commandTrait = file_get_contents(app_path('modules/selfserve/traits/selfserve_lane_command_t.php'));
+
+    expect($commandTrait)->not->toBeFalse();
+    $methodOffset = strpos($commandTrait, 'protected function completeLatestSessionForStop(): void');
+    expect($methodOffset)->not->toBeFalse();
+
+    $methodBody = substr($commandTrait, (int)$methodOffset, 1500);
+    expect($methodBody)->toContain(<<<'PHP'
+(new \modules\selfserve\classes\selfserve_wash_flow())->completeLatestSessionForLane(
+                $this->id,
+                $this->getLicensePlate() ?: null,
+                $this->getCustomerNumber() ?: null,
+                method_exists($this, 'getLastInvoiceOrderId') ? $this->getLastInvoiceOrderId() : null,
+                false
+            );
+PHP);
+});

services/nginx/app/tests/Unit/Slack/SlackConfigRouteWiringTest.php

@@ -6,9 +6,11 @@ it('registers Slack module config endpoints and customer registration webhook co
 
     expect($routeContent)->not->toBeFalse()
         ->and($routeContent)->toContain('/slack/config')
+        ->and($routeContent)->toContain('/slack/config/test')
         ->and($routeContent)->toContain("requirePermission('slack_config')")
         ->and($routeContent)->toContain("(new slack())->getConfig()->getConfigRequest()")
-        ->and($routeContent)->toContain("(new slack())->getConfig()->postConfigRequest()");
+        ->and($routeContent)->toContain("(new slack())->getConfig()->postConfigRequest()")
+        ->and($routeContent)->toContain("(new slack())->test_customer_registration_webhook()");
 
     $moduleContent = file_get_contents(app_path('modules/slack/slack_c.php'));
     $variableContent = file_get_contents(app_path('modules/slack/config/slack_customer_registration_webhook_url_c.php'));
@@ -24,11 +26,15 @@ it('registers Slack module config endpoints and customer registration webhook co
         ->and($variableContent)->toContain('Slack webhook URL used for successful customer registration notifications')
         ->and($slackClassContent)->not->toBeFalse()
         ->and($slackClassContent)->toContain('send_customer_registration_notification')
+        ->and($slackClassContent)->toContain('test_customer_registration_webhook')
+        ->and($slackClassContent)->toContain('format_customer_registration_test')
         ->and($slackClassContent)->toContain('format_customer_registration')
         ->and($authRouteContent)->not->toBeFalse()
         ->and($authRouteContent)->toContain("AUTH_REGISTER_CVR_SLACK_NOTIFICATION_FAILED")
         ->and($openApiContent)->not->toBeFalse()
         ->and($openApiContent)->toContain('/slack/config')
+        ->and($openApiContent)->toContain('/slack/config/test')
         ->and($openApiContent)->toContain('SlackConfigListResponse')
+        ->and($openApiContent)->toContain('SlackConfigTestResponse')
         ->and($openApiContent)->toContain('SlackConfigEntry');
 });

services/nginx/app/tests/Unit/Slack/SlackCustomerRegistrationWebhookTest.php

@@ -0,0 +1,86 @@
+<?php
+
+app_require('classes/slack.php');
+
+use classes\slack;
+
+final class SlackCustomerRegistrationWebhookFake extends slack
+{
+    public array $messages = [];
+
+    public function __construct(
+        private readonly string $webhook,
+        private readonly string $sendResult = 'Message sent successfully. Response: ok'
+    ) {
+        // Skip parent config loading for unit isolation.
+    }
+
+    protected function get_customer_registration_webhook_url(): string
+    {
+        return $this->webhook;
+    }
+
+    public function send_webhook_message(string $message, string $webhook): string
+    {
+        $this->messages[] = [
+            'message' => $message,
+            'webhook' => $webhook,
+        ];
+
+        return $this->sendResult;
+    }
+}
+
+it('does not send customer registration test notifications without a saved webhook', function (): void {
+    $slack = new SlackCustomerRegistrationWebhookFake('');
+
+    $result = $slack->test_customer_registration_webhook();
+
+    expect($result)
+        ->toBe([
+            'configured' => false,
+            'sent' => false,
+            'message' => 'Slack customer registration webhook URL is not configured.',
+        ])
+        ->and($slack->messages)->toBe([])
+        ->and($slack->get_log())->toBe([]);
+});
+
+it('sends customer registration test notifications to the saved webhook', function (): void {
+    $slack = new SlackCustomerRegistrationWebhookFake('https://hooks.slack.test/services/secret-token');
+
+    $result = $slack->test_customer_registration_webhook();
+
+    expect($result)
+        ->toBe([
+            'configured' => true,
+            'sent' => true,
+            'message' => 'Slack test message sent successfully.',
+        ])
+        ->and($slack->messages)->toHaveCount(1)
+        ->and($slack->messages[0]['webhook'])->toBe('https://hooks.slack.test/services/secret-token')
+        ->and($slack->messages[0]['message'])->toContain('Truck Wash Slack test')
+        ->and($slack->messages[0]['message'])->toContain('Customer registration notifications are configured correctly.')
+        ->and(json_encode($slack->get_log(), JSON_UNESCAPED_SLASHES))->toContain('sent successfully')
+        ->and(json_encode($slack->get_log(), JSON_UNESCAPED_SLASHES))->not->toContain('secret-token');
+});
+
+it('reports customer registration test notification failures without exposing the webhook', function (): void {
+    $slack = new SlackCustomerRegistrationWebhookFake(
+        'https://hooks.slack.test/services/secret-token',
+        'Failed to send message: cURL error for https://hooks.slack.test/services/secret-token'
+    );
+
+    $result = $slack->test_customer_registration_webhook();
+
+    expect($result)
+        ->toBe([
+            'configured' => true,
+            'sent' => false,
+            'message' => 'Slack test message failed.',
+        ])
+        ->and($slack->messages)->toHaveCount(1)
+        ->and(json_encode($result, JSON_UNESCAPED_SLASHES))->not->toContain('secret-token')
+        ->and(json_encode($slack->get_log(), JSON_UNESCAPED_SLASHES))->toContain('failed')
+        ->and(json_encode($slack->get_log(), JSON_UNESCAPED_SLASHES))->not->toContain('secret-token');
+});

services/nginx/app/tests/Unit/Storage/MinioLocalTestStorageTest.php

@@ -0,0 +1,38 @@
+<?php
+
+use classes\pdf_store;
+
+it('falls back to local test storage when MinIO config values are empty', function (): void {
+    global $MINIO;
+
+    $previousRunApiTests = getenv('RUN_API_TESTS');
+    $previousMinio = $MINIO ?? null;
+    putenv('RUN_API_TESTS=1');
+    $MINIO = [
+        'endpoint' => null,
+        'access_key' => null,
+        'secret_key' => null,
+    ];
+
+    try {
+        $file = 'minio-local-test-' . bin2hex(random_bytes(4)) . '.pdf';
+        $store = new pdf_store();
+
+        expect($store->createObject($file, 'local-pdf-content'))->toBeTrue();
+
+        $path = $store->download($file);
+
+        expect(is_file($path))->toBeTrue()
+            ->and(file_get_contents($path))->toBe('local-pdf-content');
+    } finally {
+        if (isset($path) && is_file($path)) {
+            unlink($path);
+        }
+        if ($previousRunApiTests === false) {
+            putenv('RUN_API_TESTS');
+        } else {
+            putenv('RUN_API_TESTS=' . $previousRunApiTests);
+        }
+        $MINIO = $previousMinio;
+    }
+});

services/nginx/app/tests/auth/NewCustomerEmailTemplateTest.php

@@ -0,0 +1,99 @@
+<?php
+namespace {
+    if (!defined('WD')) {
+        define('WD', dirname(__DIR__, 2));
+    }
+}
+
+namespace objects {
+    class users_o
+    {
+        public static array $calls = [];
+        private bool $selected = false;
+        public object $economic_customer;
+
+        public function getUserByCustomerNumber(int $customer_number): self
+        {
+            self::$calls[] = 'select:' . $customer_number;
+            $this->selected = true;
+
+            return $this;
+        }
+
+        public function getCustomerName(int $customer_number): ?string
+        {
+            if (!$this->selected) {
+                throw new \RuntimeException('Customer name requested before local customer selection.');
+            }
+
+            self::$calls[] = 'name:' . $customer_number;
+
+            return 'KING FOOD DANMARK A/S';
+        }
+
+        public function getCustomerEcocomicData(?int $customer_number = null): self
+        {
+            if (!$this->selected) {
+                throw new \RuntimeException('Economic customer requested before local customer selection.');
+            }
+
+            self::$calls[] = 'economic:' . (int)$customer_number;
+            $this->economic_customer = (object)[
+                'corporateIdentificationNumber' => '12345678',
+            ];
+
+            return $this;
+        }
+    }
+}
+
+namespace {
+    require_once WD . '/modules/email/helpers/email_template.php';
+    require_once WD . '/modules/email/templates/email_template_new_customer.php';
+
+    function assert_true(bool $condition, string $message): void
+    {
+        if (!$condition) {
+            throw new \RuntimeException($message);
+        }
+    }
+
+    function cleanup_buffers_to(int $base_level): string
+    {
+        $output = '';
+        while (ob_get_level() > $base_level) {
+            $output .= (string)ob_get_clean();
+        }
+
+        return $output;
+    }
+
+    $base_level = ob_get_level();
+    ob_start();
+
+    try {
+        $html = (new \email\templates\email_template_new_customer(
+            12345678,
+            'https://truckwash.io/auth/password-reset/mock-token',
+        ))->generate_html();
+        $leaked_output = cleanup_buffers_to($base_level);
+
+        assert_true($leaked_output === '', 'Template generation must not leak buffered HTML output.');
+        assert_true(
+            str_contains($html, 'Tak for din registrering af KING FOOD DANMARK A/S (12345678) som kunde hos Truck Wash.'),
+            'Template must render the selected customer name and CVR in the welcome intro.'
+        );
+        assert_true(
+            \objects\users_o::$calls === ['select:12345678', 'name:12345678', 'economic:12345678'],
+            'Template must select the local customer before reading customer details.'
+        );
+    } catch (\Throwable $exception) {
+        $leaked_output = cleanup_buffers_to($base_level);
+        fwrite(STDERR, $leaked_output);
+        fwrite(STDERR, $exception->getMessage() . PHP_EOL);
+        exit(1);
+    }
+
+    echo "\033[32m[PASS]\033[0m New customer email template renders without leaked output.\n";
+    exit(0);
+}

services/nginx/app/tests/auth/RegisterCvrTest.php

@@ -69,6 +69,8 @@ namespace classes {
     {
         public static array $mock_collection = [];
         public static ?object $mock_create_response = null;
+        public static ?\RuntimeException $mock_create_exception = null;
+        public static array $mock_collection_after_create_exception = [];
         public static array $search_calls = [];
         public static array $create_calls = [];
 
@@ -78,6 +80,8 @@ namespace classes {
         {
             self::$mock_collection = [];
             self::$mock_create_response = null;
+            self::$mock_create_exception = null;
+            self::$mock_collection_after_create_exception = [];
             self::$search_calls = [];
             self::$create_calls = [];
         }
@@ -113,6 +117,11 @@ namespace classes {
                 'company_information' => $companyInformation,
             ];
 
+            if (self::$mock_create_exception !== null) {
+                self::$mock_collection = self::$mock_collection_after_create_exception;
+                throw self::$mock_create_exception;
+            }
+
             $response = self::$mock_create_response ?? (object)[
                 'customerNumber' => (int)$number,
             ];
@@ -133,9 +142,14 @@ namespace classes {
         public static int $mock_zipcode = 2630;
         public static string $mock_city = 'Taastrup';
         public static string $mock_website = 'https://demo.test';
+        public static ?\RuntimeException $mock_exception = null;
 
         public function getCompanyInformation($cvr, $endpoint, $data): object
         {
+            if (self::$mock_exception !== null) {
+                throw self::$mock_exception;
+            }
+
             $result = new \stdClass();
             $result->name = self::$mock_name;
             $result->address = self::$mock_address;
@@ -214,6 +228,7 @@ namespace objects {
     {
         public static array $mock_existing_customer_numbers = [];
         public static array $mock_importable_customer_numbers = [];
+        public static bool $mock_external_lookup_enabled = true;
         public static array $interaction_log = [];
 
         public int $id = 0;
@@ -223,6 +238,7 @@ namespace objects {
         {
             self::$mock_existing_customer_numbers = [];
             self::$mock_importable_customer_numbers = [];
+            self::$mock_external_lookup_enabled = true;
             self::$interaction_log = [];
         }
 
@@ -242,7 +258,8 @@ namespace objects {
             self::$interaction_log[] = 'bootstrap:' . $customerNumber;
 
             $existsLocally = in_array($customerNumber, self::$mock_existing_customer_numbers, true);
-            $canImport = in_array($customerNumber, self::$mock_importable_customer_numbers, true);
+            $canImport = self::$mock_external_lookup_enabled
+                && in_array($customerNumber, self::$mock_importable_customer_numbers, true);
 
             if ($existsLocally || $canImport) {
                 $this->id = $customerNumber;
@@ -257,6 +274,22 @@ namespace objects {
             return $this;
         }
 
+        public function importCustomerFromEconomicCustomerData(object $customerData): self|bool
+        {
+            $customerNumber = (int)($customerData->customerNumber ?? 0);
+            if ($customerNumber <= 0) {
+                return false;
+            }
+
+            self::$interaction_log[] = 'snapshot-import:' . $customerNumber;
+            $this->id = $customerNumber;
+            $this->exists = true;
+            self::$mock_existing_customer_numbers[] = $customerNumber;
+            self::$mock_existing_customer_numbers = array_values(array_unique(self::$mock_existing_customer_numbers));
+
+            return $this;
+        }
+
         public function exists(): bool
         {
             return $this->exists;
@@ -391,6 +424,58 @@ namespace {
             'expected_error' => 'Parameter cvr must be at least 8 characters long',
             'expected_status' => 400,
         ],
+        [
+            'name' => 'CVR lookup failure returns validation error without creating customer',
+            'params' => array_merge($baseParams, ['cvr' => '11111112']),
+            'setup' => static function (): void {
+                \classes\virkdata::$mock_exception = new \RuntimeException('An error occurred');
+            },
+            'expected_error' => 'CVR could not be verified. Please check the CVR number and try again.',
+            'expected_status' => 400,
+            'assert' => static function (): void {
+                assert_true(count(\classes\economic::$create_calls) === 0, 'CVR lookup failures must not create e-conomic customers.');
+                assert_true(count(\classes\email::$sent) === 0, 'CVR lookup failures must not send welcome emails.');
+                assert_true(count(\classes\email::$superuser_notifications) === 0, 'CVR lookup failures must not send superuser notifications.');
+                assert_true(count(\classes\slack::$customer_registration_notifications) === 0, 'CVR lookup failures must not send Slack customer registration notifications.');
+                assert_true(count(\objects\logs_o::$entries) === 1, 'CVR lookup failures should be logged for diagnostics.');
+                assert_true(\objects\logs_o::$entries[0]['event'] === 'AUTH_REGISTER_CVR_LOOKUP_FAILED', 'CVR lookup failure should use the lookup failure log event.');
+            },
+        ],
+        [
+            'name' => 'CVR lookup without company name returns validation error without creating customer',
+            'params' => array_merge($baseParams, ['cvr' => '11111112']),
+            'setup' => static function (): void {
+                \classes\virkdata::$mock_name = '';
+            },
+            'expected_error' => 'CVR could not be verified. Please check the CVR number and try again.',
+            'expected_status' => 400,
+            'assert' => static function (): void {
+                assert_true(count(\classes\economic::$create_calls) === 0, 'CVR lookup responses without a company name must not create e-conomic customers.');
+                assert_true(count(\classes\email::$sent) === 0, 'CVR lookup responses without a company name must not send welcome emails.');
+                assert_true(count(\classes\email::$superuser_notifications) === 0, 'CVR lookup responses without a company name must not send superuser notifications.');
+                assert_true(count(\classes\slack::$customer_registration_notifications) === 0, 'CVR lookup responses without a company name must not send Slack customer registration notifications.');
+                assert_true(count(\objects\logs_o::$entries) === 1, 'CVR lookup responses without a company name should be logged for diagnostics.');
+                assert_true(\objects\logs_o::$entries[0]['event'] === 'AUTH_REGISTER_CVR_LOOKUP_INVALID_RESPONSE', 'CVR lookup response without a company name should use the invalid response log event.');
+            },
+        ],
+        [
+            'name' => 'CVR lookup failure takes precedence over local customer number collision',
+            'params' => array_merge($baseParams, ['cvr' => '11111112']),
+            'setup' => static function (): void {
+                \classes\virkdata::$mock_exception = new \RuntimeException('An error occurred');
+                \objects\users_o::$mock_existing_customer_numbers = [12345678];
+            },
+            'expected_error' => 'CVR could not be verified. Please check the CVR number and try again.',
+            'expected_status' => 400,
+            'assert' => static function (): void {
+                assert_true(count(\classes\economic::$create_calls) === 0, 'CVR lookup failures with local collisions must not create e-conomic customers.');
+                assert_true(count(\classes\email::$sent) === 0, 'CVR lookup failures with local collisions must not send welcome emails.');
+                assert_true(count(\classes\email::$superuser_notifications) === 0, 'CVR lookup failures with local collisions must not send superuser notifications.');
+                assert_true(count(\classes\slack::$customer_registration_notifications) === 0, 'CVR lookup failures with local collisions must not send Slack customer registration notifications.');
+                assert_true(count(\objects\logs_o::$entries) === 1, 'CVR lookup failures with local collisions should be logged once.');
+                assert_true(\objects\logs_o::$entries[0]['event'] === 'AUTH_REGISTER_CVR_LOOKUP_FAILED', 'CVR lookup failure should not be masked by the local duplicate check.');
+            },
+        ],
         [
             'name' => 'Existing company phone with local customer stays blocked',
             'params' => $baseParams,
@@ -509,6 +594,88 @@ namespace {
                 assert_true(\classes\slack::$customer_registration_notifications[0]['customer_number'] === 12345678, 'Fresh registration Slack notification must use the created customer number.');
             },
         ],
+        [
+            'name' => 'Successful registration falls back to the create response when immediate import lookup misses',
+            'params' => array_merge($baseParams, ['contactPhone' => 87654320]),
+            'setup' => static function (): void {
+                \classes\economic::$mock_create_response = (object)[
+                    'customerNumber' => 12345678,
+                    'name' => 'Mock Company',
+                    'email' => 'test@test.com',
+                ];
+                \objects\users_o::$mock_external_lookup_enabled = false;
+            },
+            'expected_success' => (object)[
+                'customerNumber' => 12345678,
+                'name' => 'Mock Company',
+                'email' => 'test@test.com',
+            ],
+            'expected_status' => 201,
+            'assert' => static function (): void {
+                assert_true(count(\classes\economic::$create_calls) === 1, 'Fresh registration must call create exactly once.');
+                assert_true(\objects\users_o::$interaction_log[0] === 'bootstrap:12345678', 'Fresh registration must try the standard local bootstrap first.');
+                assert_true(\objects\users_o::$interaction_log[1] === 'snapshot-import:12345678', 'Fresh registration must import from the create response when the immediate lookup misses.');
+                assert_true(count(\classes\email::$sent) === 2, 'Snapshot fallback registration must send two welcome emails.');
+                assert_true(count(\classes\email::$superuser_notifications) === 1, 'Snapshot fallback registration must notify opted-in superusers once.');
+                assert_true(count(\classes\slack::$customer_registration_notifications) === 1, 'Snapshot fallback registration must notify Slack once.');
+            },
+        ],
+        [
+            'name' => 'Duplicate create response recovers a just-created e-conomic customer and sends notifications',
+            'params' => $baseParams,
+            'setup' => static function (): void {
+                \classes\economic::$mock_create_exception = new \RuntimeException('e-conomic request failed with HTTP 400: Customer already exists');
+                \classes\economic::$mock_collection_after_create_exception = [
+                    (object)[
+                        'customerNumber' => 12345678,
+                        'name' => 'Recovered After Create',
+                        'email' => 'test@test.com',
+                    ],
+                ];
+                \objects\users_o::$mock_importable_customer_numbers = [12345678];
+            },
+            'expected_success' => (object)[
+                'customerNumber' => 12345678,
+                'name' => 'Recovered After Create',
+                'email' => 'test@test.com',
+            ],
+            'expected_status' => 200,
+            'assert' => static function (): void {
+                assert_true(count(\classes\economic::$create_calls) === 1, 'Recovery must still record the attempted create call.');
+                assert_true(count(\classes\economic::$search_calls) === 2, 'Recovery must verify the duplicate by searching e-conomic again.');
+                assert_true(count(\classes\email::$sent) === 2, 'Duplicate create recovery must send two welcome emails.');
+                assert_true(count(\classes\email::$superuser_notifications) === 1, 'Duplicate create recovery must notify opted-in superusers once.');
+                assert_true(count(\classes\slack::$customer_registration_notifications) === 1, 'Duplicate create recovery must notify Slack once.');
+            },
+        ],
+        [
+            'name' => 'Generic create failure recovers a confirmed just-created e-conomic customer',
+            'params' => $baseParams,
+            'setup' => static function (): void {
+                \classes\economic::$mock_create_exception = new \RuntimeException('e-conomic request failed with HTTP 400: Validation failed. | details={"httpStatusCode":400}');
+                \classes\economic::$mock_collection_after_create_exception = [
+                    (object)[
+                        'customerNumber' => 12345678,
+                        'name' => 'Recovered After Generic Create Failure',
+                        'email' => 'test@test.com',
+                    ],
+                ];
+                \objects\users_o::$mock_importable_customer_numbers = [12345678];
+            },
+            'expected_success' => (object)[
+                'customerNumber' => 12345678,
+                'name' => 'Recovered After Generic Create Failure',
+                'email' => 'test@test.com',
+            ],
+            'expected_status' => 200,
+            'assert' => static function (): void {
+                assert_true(count(\classes\economic::$create_calls) === 1, 'Generic create recovery must still record the attempted create call.');
+                assert_true(count(\classes\economic::$search_calls) === 2, 'Generic create recovery must confirm the customer by searching e-conomic again.');
+                assert_true(count(\classes\email::$sent) === 2, 'Generic create recovery must send two welcome emails.');
+                assert_true(count(\classes\email::$superuser_notifications) === 1, 'Generic create recovery must notify opted-in superusers once.');
+                assert_true(count(\classes\slack::$customer_registration_notifications) === 1, 'Generic create recovery must notify Slack once.');
+            },
+        ],
         [
             'name' => 'Fresh create mismatch returns conflict without local bootstrap or email',
             'params' => $baseParams,
@@ -544,6 +711,7 @@ namespace {
         \classes\virkdata::$mock_zipcode = 2630;
         \classes\virkdata::$mock_city = 'Taastrup';
         \classes\virkdata::$mock_website = 'https://demo.test';
+        \classes\virkdata::$mock_exception = null;
         \objects\users_o::reset();
         \objects\logs_o::reset();
 

services/nginx/app/traits/minio_t.php

@@ -76,7 +76,7 @@ trait minio_t
     public function getEndpoint(): string
     {
         global $MINIO;
-        return $MINIO['endpoint'];
+        return is_array($MINIO ?? null) ? (string)($MINIO['endpoint'] ?? '') : '';
     }
 
     /**
@@ -86,7 +86,7 @@ trait minio_t
     public function getAccessKey(): string
     {
         global $MINIO;
-        return $MINIO['access_key'];
+        return is_array($MINIO ?? null) ? (string)($MINIO['access_key'] ?? '') : '';
     }
 
     /**
@@ -96,7 +96,7 @@ trait minio_t
     public function getSecretKey(): string
     {
         global $MINIO;
-        return $MINIO['secret_key'];
+        return is_array($MINIO ?? null) ? (string)($MINIO['secret_key'] ?? '') : '';
     }
 
     /**

services/php/Dockerfile

@@ -73,6 +73,7 @@ WORKDIR /var/www/html
 
 # Copy and enable entrypoint that installs Composer deps on first run
 COPY services/php/docker-entrypoint.sh /usr/local/bin/docker-entrypoint.sh
+COPY services/php/php-fpm-pool.conf /usr/local/etc/php-fpm.d/zz-pleno-workers.conf
 RUN sed -i 's/\r$//' /usr/local/bin/docker-entrypoint.sh \
     && chmod +x /usr/local/bin/docker-entrypoint.sh
 

services/php/php-fpm-pool.conf

@@ -0,0 +1,7 @@
+[www]
+pm = dynamic
+pm.max_children = 8
+pm.start_servers = 4
+pm.min_spare_servers = 4
+pm.max_spare_servers = 8
+pm.max_requests = 500