<?php
namespace Careback;

defined( 'ABSPATH' ) || exit;

/**
 * Owns the plugin's screen and renders its Settings tab. The screen is one
 * entry of the WooCommerce menu, WooCommerce → Careback, where a shop looks for
 * what runs its orders (HANDBOOK §8): one heading, "Careback", and tabs —
 * Requests (the entry itself, first), Setup, Settings, then the pages an
 * add-on registers. Every tab keeps the page address it always had
 * (admin.php?page=careback, -setup, -settings …), so a link from before, in an
 * email already sent, still opens its screen.
 */
class Admin {

	/** Filter: the tabs after Requests, slug => page ( array $pages ). */
	const PAGES_FILTER = 'careback_admin_pages';

	/** The menu the screen is an entry of. */
	const PARENT = 'woocommerce';

	/** Page slug of the entry and of its first tab, Requests. */
	const PAGE = 'careback';

	/** Filter: the groups ("tabs") of the settings screen, key => group ( array $tabs ). */
	const TABS_FILTER = 'careback_settings_tabs';

	/** Filter: the sections of the settings screen, key => section ( array $sections ). */
	const SECTIONS_FILTER = 'careback_settings_sections';

	/** Filter: the rows of one section's table ( array $fields, string $section ). */
	const FIELDS_FILTER = 'careback_settings_fields';

	/**
	 * Filter: the values a settings form stores ( array $values, string $screen,
	 * Settings $settings, array $posted ) — `$screen` is SCREEN or
	 * Track_Admin::SCREEN; `$posted` is the posted form (unslashed, not yet
	 * sanitised), read once by the form's handler after its capability and
	 * nonce checks (since 0.84.2): a section reads its fields from it, never
	 * from the request itself.
	 */
	const SAVE_FILTER = 'careback_save_settings';

	/**
	 * Filter: the fields of a settings form that are stored as HTML, as paths
	 * ("field", "field/key" or "field/key/key"); posted_form() reads each of
	 * them through wp_kses_post() instead of as plain text. An add-on lists the
	 * HTML fields of the sections it adds.
	 */
	const HTML_FIELDS_FILTER = 'careback_settings_html_fields';

	/**
	 * Id of this screen — the returns half of the settings screen — in the
	 * settings hooks: the section and row callables and `careback_save_settings`
	 * are handed it, the tracking half hands Track_Admin::SCREEN.
	 */
	const SCREEN = 'return';

	private $settings;
	private $requests;
	private $setup;

	private $events;
	private $requests_repository;

	/** Reason key => filed requests, read once per render of the settings screen. */
	private $reason_usage = null;

	/**
	 * Hook name of each tab's page (as WordPress names it) => its slug, filled by menu().
	 *
	 * @var array<string,string>
	 */
	private $page_hooks = array();

	/**
	 * @param Settings                 $settings            The shared settings.
	 * @param Admin_Requests           $requests            The Requests screen.
	 * @param Setup                    $setup               The Setup screen.
	 * @param Events_Repository|null   $events              The event log.
	 * @param mixed                    $unused              No longer read; kept so callers passing the request table sixth still reach it.
	 * @param Requests_Repository|null $requests_repository The requests table.
	 */
	public function __construct( Settings $settings, Admin_Requests $requests, Setup $setup, ?Events_Repository $events = null, $unused = null, ?Requests_Repository $requests_repository = null ) {
		unset( $unused );
		$this->events              = $events instanceof Events_Repository ? $events : new Events_Repository();
		$this->requests_repository = $requests_repository instanceof Requests_Repository ? $requests_repository : new Requests_Repository();
		$this->settings            = $settings;
		$this->requests            = $requests;
		$this->setup               = $setup;
	}

	public function init() {
		add_action( 'admin_menu', array( $this, 'menu' ) );
		add_action( 'admin_head', array( $this, 'hide_tab_entries' ) );
		add_filter( 'submenu_file', array( $this, 'menu_current' ), 10, 2 );
		add_action( 'admin_enqueue_scripts', array( $this, 'assets' ) );
		add_action( 'admin_post_careback_save_settings', array( $this, 'save' ) );
		add_action( 'admin_notices', array( $this, 'dependency_notice' ) );
		add_action( 'admin_notices', array( $this, 'index_gap_notice' ) );
		add_filter( 'plugin_action_links_' . plugin_basename( CAREBACK_FILE ), array( $this, 'action_links' ) );
	}

	/**
	 * The files of the screen, on its tabs only: the shared stylesheet and
	 * script (heading, tabs, help icons) on every tab, and each of Careback's
	 * tabs its own — the request list's, Setup's, and on Settings its
	 * stylesheet and the reason editor. Scripts run in the footer, after the
	 * markup they read has been printed.
	 *
	 * @param string $hook Hook name of the screen.
	 */
	public function assets( $hook ) {
		$tab = $this->tab_of( (string) $hook );

		if ( '' === $tab ) {
			return;
		}

		wp_enqueue_style( 'careback-admin', CAREBACK_URL . 'assets/css/admin.css', array( 'dashicons' ), CAREBACK_VERSION );
		wp_enqueue_script( 'careback-admin', CAREBACK_URL . 'assets/js/admin.js', array(), CAREBACK_VERSION, true );

		if ( self::PAGE === $tab ) {
			wp_enqueue_style( 'careback-admin-requests', CAREBACK_URL . 'assets/css/admin-requests.css', array( 'careback-admin' ), CAREBACK_VERSION );
			wp_enqueue_script( 'careback-admin-requests', CAREBACK_URL . 'assets/js/admin-requests.js', array(), CAREBACK_VERSION, true );
		} elseif ( 'careback-setup' === $tab ) {
			wp_enqueue_style( 'careback-admin-setup', CAREBACK_URL . 'assets/css/admin-setup.css', array( 'careback-admin' ), CAREBACK_VERSION );
			// The Copy buttons, and the box "I have added the link" saved as it is ticked.
			wp_enqueue_script( 'careback-admin-setup', CAREBACK_URL . 'assets/js/admin-setup.js', array(), CAREBACK_VERSION, true );
		} elseif ( 'careback-settings' === $tab ) {
			wp_enqueue_style( 'careback-admin-settings', CAREBACK_URL . 'assets/css/admin-settings.css', array( 'careback-admin' ), CAREBACK_VERSION );
			// The confirmation under the switch of statutory withdrawal, the example
			// of when the periods start, the warning of the box that deletes all data.
			wp_enqueue_script( 'careback-admin-settings', CAREBACK_URL . 'assets/js/admin-settings.js', array(), CAREBACK_VERSION, true );
			wp_enqueue_script(
				'careback-reasons',
				CAREBACK_URL . 'assets/js/admin-reasons.js',
				array( 'jquery', 'jquery-ui-sortable' ),
				CAREBACK_VERSION,
				true
			);
		}
	}

	/**
	 * The tab a screen is, by its hook name ("<menu>_page_<slug>"), or '' for a
	 * screen that is not one of Careback's. The menu part is not read: it is
	 * "woocommerce", and was the plugin's own menu before.
	 *
	 * @param string $hook Hook name or screen id.
	 * @return string Page slug of the tab.
	 */
	private function tab_of( $hook ) {
		if ( 1 !== preg_match( '/_page_([a-z0-9_-]+)$/', (string) $hook, $match ) ) {
			return '';
		}

		return in_array( $match[1], array_keys( $this->screen_tabs() ), true ) ? $match[1] : '';
	}

	/**
	 * A help icon with a plain-language tooltip. The audience is site builders,
	 * not developers, so every tip explains what the field is for in one line.
	 * Drawn by Admin_Tip::render(), the one implementation every screen and an
	 * add-on's section use.
	 *
	 * @param string $text The explanation.
	 */
	private static function tip( $text ) {
		Admin_Tip::render( $text );
	}

	/**
	 * Reason key => number of filed requests carrying it, for the rows currently
	 * on the list. Read once and kept for the rest of the render.
	 *
	 * @return array<string,int>
	 */
	private function reason_usage( array $rows ) {
		if ( null === $this->reason_usage ) {
			$this->reason_usage = Reasons::usage_of_rows(
				$rows,
				Reasons::usage( (array) $this->requests_repository->reason_counts() )
			);
		}

		return $this->reason_usage;
	}

	/**
	 * Warning printed above the reason editor, naming how many of the listed
	 * reasons filed requests already carry and how many requests that is.
	 * Printed only while at least one listed reason has been filed under.
	 */
	private function reason_usage_notice() {
		$usage = $this->reason_usage( Reasons::rows( $this->settings ) );

		if ( empty( $usage ) ) {
			return;
		}

		printf(
			'<div class="notice notice-warning inline careback-reason-notice"><p>%s</p></div>',
			esc_html(
				sprintf(
					/* translators: 1: how many reasons on the list are already in use, 2: how many filed requests carry them. */
					__( 'Filed requests already carry some of these reasons (reasons in use: %1$d; requests filed under them: %2$d). The count is shown against each row. Rewording a reason is safe — every request keeps the reason it was filed under. A reason with requests behind it cannot simply be deleted: tick "Retire", pick the reason its requests move onto, and save. Statistics for periods that have already closed keep the figures they were counted with.', 'careback' ),
					count( $usage ),
					array_sum( $usage )
				)
			)
		);
	}

	/**
	 * One posted reason mode, refused down to a value the plugin knows. Public
	 * so the section of a route an add-on registers saves its mode the same way.
	 *
	 * The statutory route is never read from here — `Reasons::mode()` fixes it —
	 * so there is no path by which a form could make a withdrawal require a
	 * reason.
	 *
	 * @param string     $route  Route the mode belongs to.
	 * @param array|null $posted The posted form (the fourth argument of
	 *                           `careback_save_settings`); null while the
	 *                           settings form is being saved reads the form
	 *                           that save was handed (an add-on built for 0.84.1).
	 * @return string 'off', 'optional' or 'required'.
	 */
	public static function reason_mode_input( $route, $posted = null ) {
		$posted = is_array( $posted ) ? $posted : self::$saving;
		$field  = 'reason_mode_' . $route;
		$value  = isset( $posted[ $field ] ) && is_scalar( $posted[ $field ] ) ? sanitize_key( $posted[ $field ] ) : '';

		return in_array( $value, array( 'off', 'optional', 'required' ), true ) ? $value : 'optional';
	}

	/**
	 * The form save() is storing, for the duration of that save (reason_mode_input()).
	 *
	 * @var array
	 */
	private static $saving = array();

	/**
	 * A settings form as posted, every value sanitised as it is read: the form
	 * a save handler hands to its sections and to `careback_save_settings`.
	 * The capability and the nonce are checked here as well (the handler has
	 * checked them already; a second check costs nothing and keeps the read
	 * next to its check).
	 *
	 * Every value is plain text (sanitize_textarea_field(): tags stripped, line
	 * breaks kept), except the fields stored as HTML, which are read on their
	 * own through wp_kses_post(): the fallback contact, the body of each status
	 * email, and what an add-on lists through `careback_settings_html_fields`.
	 * Readers still validate each value for what it holds (a number, a key, an
	 * allowed choice) before they store it; no raw request data leaves this
	 * method.
	 *
	 * @param string $action Nonce action of the form.
	 * @return array Field => sanitised value; empty without the capability.
	 */
	public static function posted_form( $action ) {
		if ( ! current_user_can( 'manage_woocommerce' ) ) {
			return array();
		}

		check_admin_referer( $action );

		$form = map_deep( wp_unslash( $_POST ), 'sanitize_textarea_field' );
		$form = is_array( $form ) ? $form : array();

		$paths = array( 'fallback_contact' );
		foreach ( Statuses::keys() as $status ) {
			$paths[] = 'status_emails/' . $status . '/body';
		}
		$paths = (array) apply_filters( self::HTML_FIELDS_FILTER, $paths ); // phpcs:ignore WordPress.NamingConventions.PrefixAllGlobals.DynamicHooknameFound -- careback_settings_html_fields, the final prefix.

		foreach ( $paths as $path ) {
			$k = array_values(
				array_filter(
					explode( '/', (string) $path ),
					static function ( $part ) {
						return '' !== $part;
					}
				)
			);

			if ( 1 === count( $k ) && isset( $_POST[ $k[0] ] ) && is_string( $_POST[ $k[0] ] ) ) {
				$form[ $k[0] ] = wp_kses_post( wp_unslash( $_POST[ $k[0] ] ) );
			} elseif ( 2 === count( $k ) && isset( $_POST[ $k[0] ][ $k[1] ] ) && is_string( $_POST[ $k[0] ][ $k[1] ] ) ) {
				$form[ $k[0] ][ $k[1] ] = wp_kses_post( wp_unslash( $_POST[ $k[0] ][ $k[1] ] ) );
			} elseif ( 3 === count( $k ) && isset( $_POST[ $k[0] ][ $k[1] ][ $k[2] ] ) && is_string( $_POST[ $k[0] ][ $k[1] ][ $k[2] ] ) ) {
				$form[ $k[0] ][ $k[1] ][ $k[2] ] = wp_kses_post( wp_unslash( $_POST[ $k[0] ][ $k[1] ][ $k[2] ] ) );
			}
		}

		return $form;
	}

	/**
	 * Writes the per-route ticks onto the reason rows.
	 *
	 * A key the route screen listed takes exactly what was ticked there, an empty
	 * selection included. A key it did not list — a row added in the same save —
	 * is left alone, so it keeps the "offered everywhere" default rather than
	 * silently arriving switched off on every route.
	 *
	 * Two things are kept that the screen cannot show, so a save never loses
	 * them. A row stored with routes nobody registers now — routes of an add-on
	 * that is switched off — keeps them. And a row never configured, which is
	 * offered everywhere, stays so while every route listed for it is ticked:
	 * writing out the routes on screen would take it off the ones that are not.
	 *
	 * Each key goes through Reasons::clean_key(), each route is checked
	 * against Routes::keys().
	 *
	 * @param array<int,array> $rows   Rows built by Reasons::from_posted().
	 * @param array            $posted The posted form (save()).
	 * @return array<int,array>
	 */
	private function apply_route_selection( array $rows, array $posted ) {
		$known    = isset( $posted['reason_routes_known'] ) && is_array( $posted['reason_routes_known'] ) ? $posted['reason_routes_known'] : array();
		$selected = isset( $posted['reason_routes'] ) && is_array( $posted['reason_routes'] ) ? $posted['reason_routes'] : array();

		if ( empty( $known ) ) {
			return $rows;
		}

		$routes = Routes::keys();
		$stored = Reasons::stored_routes( $this->settings );
		$listed = array();
		$ticked = array();

		foreach ( $routes as $route ) {
			foreach ( (array) ( isset( $known[ $route ] ) ? $known[ $route ] : array() ) as $key ) {
				$listed[ Reasons::clean_key( $key ) ][] = $route;
			}

			foreach ( (array) ( isset( $selected[ $route ] ) ? $selected[ $route ] : array() ) as $key ) {
				$ticked[ Reasons::clean_key( $key ) ][] = $route;
			}
		}

		foreach ( $rows as $index => $row ) {
			$key = $row['key'];

			if ( ! isset( $listed[ $key ] ) ) {
				continue;
			}

			$on     = isset( $ticked[ $key ] ) ? array_values( array_unique( $ticked[ $key ] ) ) : array();
			$before = array_key_exists( $key, $stored ) ? $stored[ $key ] : null;

			if ( null === $before && array() === array_diff( array_unique( $listed[ $key ] ), $on ) ) {
				$rows[ $index ]['routes'] = null;
				continue;
			}

			$kept = is_array( $before ) ? array_values( array_diff( $before, $routes ) ) : array();

			$rows[ $index ]['routes'] = array_values( array_unique( array_merge( $on, $kept ) ) );
		}

		return $rows;
	}

	/**
	 * The reason block of one route: whether a reason is asked for there, and
	 * which of the shared reasons the customer picks from. Public so the section
	 * of a route an add-on registers prints the same block.
	 *
	 * The reasons themselves are defined once, further down the screen. Here the
	 * merchant only ticks where each is offered — so a key keeps one meaning,
	 * one fault flag and one set of figures however many routes show it.
	 *
	 * @param string   $route    Route these settings belong to.
	 * @param array    $s        Stored settings.
	 * @param Settings $settings The settings the screen prints (the section callables are handed them).
	 */
	public static function render_route_reasons( $route, array $s, Settings $settings ) {
		$rows    = Reasons::rows( $settings );
		$statute = 'withdrawal' === $route;
		?>
		<table class="form-table" role="presentation">
			<tr>
				<th scope="row"><?php esc_html_e( 'Ask for a reason', 'careback' ); ?></th>
				<td>
					<?php if ( $statute ) : ?>
						<?php
						// Not offered, and not a limitation of this screen. A consumer
						// withdrawing from a distance sale does so without giving
						// reasons, so a shop cannot make the reason a condition of
						// filing one. The field may be shown and answered; it can
						// never be required.
						?>
						<p><em><?php esc_html_e( 'Optional, and fixed. A statutory withdrawal is made without giving reasons, so this route never requires one.', 'careback' ); ?></em></p>
					<?php else : ?>
						<?php $mode = Reasons::mode( $route, $settings ); ?>
						<select name="reason_mode_<?php echo esc_attr( $route ); ?>">
							<option value="off" <?php selected( 'off', $mode ); ?>><?php esc_html_e( 'Do not ask', 'careback' ); ?></option>
							<option value="optional" <?php selected( 'optional', $mode ); ?>><?php esc_html_e( 'Ask, answer optional', 'careback' ); ?></option>
							<option value="required" <?php selected( 'required', $mode ); ?>><?php esc_html_e( 'Ask, answer required', 'careback' ); ?></option>
						</select>
						<?php self::tip( __( 'Whether the reason dropdown is shown on this route and whether it has to be answered. Required means the request cannot be sent without it — right for a fault report, which cannot be looked into if it does not say what is wrong, and wrong for anything a customer is entitled to do without explaining themselves.', 'careback' ) ); ?>
					<?php endif; ?>
				</td>
			</tr>
			<tr>
				<th scope="row"><?php esc_html_e( 'Reasons offered here', 'careback' ); ?></th>
				<td>
					<?php if ( empty( $rows ) ) : ?>
						<p><em><?php esc_html_e( 'No reasons are configured yet.', 'careback' ); ?></em></p>
					<?php else : ?>
						<?php foreach ( $rows as $row ) : ?>
							<?php
							// Posted for every reason, ticked or not, so that clearing
							// them all means "offered nowhere" rather than "never
							// configured". Without it the two would be the same value.
							?>
							<input type="hidden" name="reason_routes_known[<?php echo esc_attr( $route ); ?>][]" value="<?php echo esc_attr( $row['key'] ); ?>" />
							<label class="careback-route-reason">
								<input type="checkbox" name="reason_routes[<?php echo esc_attr( $route ); ?>][]" value="<?php echo esc_attr( $row['key'] ); ?>" <?php checked( Reasons::offered_on( $row, $route ) ); ?> />
								<?php echo esc_html( $row['label'] ); ?>
								<code><?php echo esc_html( $row['key'] ); ?></code>
							</label><br />
						<?php endforeach; ?>
						<p class="description"><?php esc_html_e( 'A reason left unticked everywhere stops being offered but keeps its key, its history and its figures. Requests already filed under it are unaffected: this decides what is offered from now on, never what is already recorded.', 'careback' ); ?></p>
					<?php endif; ?>
				</td>
			</tr>
		</table>
		<?php
	}

	/**
	 * One row of the reason editor: the position field, the stored key, the label
	 * the customer reads, the fault box, the number of filed requests and the
	 * remove button.
	 *
	 * @param string $index Position in the posted array, or `__i__` for the row
	 *                      the add button clones.
	 * @param bool   $locked Renders the key read-only and posts it in a second,
	 *                       hidden field.
	 * @param string $position Value of the position field.
	 * @param int    $used Filed requests carrying this reason.
	 * @param array  $targets Reasons its requests may be moved onto, key => label.
	 */
	private function reason_row( $index, array $row, $locked, $position = '', $used = 0, array $targets = array() ) {
		$used = (int) $used;
		?>
		<tr class="careback-reason-row" <?php echo $used > 0 ? 'data-careback-used="' . esc_attr( (string) $used ) . '"' : ''; ?>>
			<td class="careback-reason-move">
				<span class="dashicons dashicons-menu careback-reason-handle" aria-hidden="true"></span>
				<input type="number" min="1" step="1" class="small-text careback-reason-position" name="reasons[<?php echo esc_attr( $index ); ?>][position]" value="<?php echo esc_attr( (string) $position ); ?>" aria-label="<?php esc_attr_e( 'Place in the list', 'careback' ); ?>" />
			</td>
			<td>
				<?php if ( $locked ) : ?>
					<input type="hidden" name="reasons[<?php echo esc_attr( $index ); ?>][stored]" value="<?php echo esc_attr( $row['key'] ); ?>" />
				<?php endif; ?>
				<input type="text" name="reasons[<?php echo esc_attr( $index ); ?>][key]" value="<?php echo esc_attr( $row['key'] ); ?>" class="code" <?php echo $locked ? 'readonly' : ''; ?> pattern="[a-z0-9_]+" />
			</td>
			<td><input type="text" name="reasons[<?php echo esc_attr( $index ); ?>][label]" value="<?php echo esc_attr( Reasons::display_label( isset( $row['key'] ) ? $row['key'] : '', $row['label'] ) ); ?>" class="large-text" /></td>
			<td class="careback-reason-fault"><input type="checkbox" name="reasons[<?php echo esc_attr( $index ); ?>][fault]" value="1" <?php checked( ! empty( $row['fault'] ) ); ?> /></td>
			<td class="careback-reason-used"><?php echo $used > 0 ? esc_html( (string) $used ) : '—'; ?></td>
			<td>
				<?php if ( $used > 0 ) : ?>
					<?php
					// A reason with filed requests behind it is retired, not deleted:
					// the requests are moved onto another reason in the same save. The
					// row stays put until a target is picked, because dropping the key
					// is what leaves a request with an unreadable reason.
					?>
					<label class="careback-reason-retire">
						<input type="checkbox" name="reasons[<?php echo esc_attr( $index ); ?>][remove]" value="1" />
						<?php esc_html_e( 'Retire', 'careback' ); ?>
					</label>
					<select name="reasons[<?php echo esc_attr( $index ); ?>][move_to]" aria-label="<?php esc_attr_e( 'Move its requests to', 'careback' ); ?>">
						<option value=""><?php esc_html_e( 'move its requests to…', 'careback' ); ?></option>
						<?php foreach ( $targets as $target_key => $target_label ) : ?>
							<?php if ( $target_key === $row['key'] ) : ?>
								<?php continue; ?>
							<?php endif; ?>
							<option value="<?php echo esc_attr( $target_key ); ?>"><?php echo esc_html( $target_label ); ?></option>
						<?php endforeach; ?>
					</select>
				<?php else : ?>
					<button type="button" class="button-link careback-reason-remove"><?php esc_html_e( 'Remove', 'careback' ); ?></button>
				<?php endif; ?>
			</td>
		</tr>
		<?php
	}

	/**
	 * The reason list as one row per reason: place in the list, key, customer
	 * text, fault box and how many filed requests carry it, with buttons to add
	 * and remove a row.
	 *
	 * Rows already in the list render their key read-only; a row added here gets
	 * an editable key until it is saved. The order of the rows is the order the
	 * customer reads in the dropdown, set by the number field or by dragging.
	 */
	private function render_reasons_editor() {
		$rows    = Reasons::rows( $this->settings );
		$usage   = $this->reason_usage( $rows );
		$targets = Reasons::all( $this->settings );
		?>
		<table class="widefat striped careback-reasons-editor" id="careback-reasons-editor" data-next="<?php echo esc_attr( (string) count( $rows ) ); ?>">
			<thead>
				<tr>
					<th class="careback-reason-col-place"><?php esc_html_e( 'Place', 'careback' ); ?></th>
					<th class="careback-reason-col-key"><?php esc_html_e( 'Key (stored on the request)', 'careback' ); ?></th>
					<th><?php esc_html_e( 'Text the customer reads', 'careback' ); ?></th>
					<th class="careback-reason-col-flag"><?php esc_html_e( 'Our fault', 'careback' ); ?></th>
					<th class="careback-reason-col-flag"><?php esc_html_e( 'Filed under it', 'careback' ); ?></th>
					<th class="careback-reason-col-action"></th>
				</tr>
			</thead>
			<tbody>
				<?php foreach ( $rows as $index => $row ) : ?>
					<?php
					$this->reason_row(
						(string) $index,
						$row,
						true,
						(string) ( (int) $index + 1 ),
						isset( $usage[ $row['key'] ] ) ? $usage[ $row['key'] ] : 0,
						$targets
					);
					?>
				<?php endforeach; ?>
			</tbody>
		</table>

		<template id="careback-reason-template">
			<?php $this->reason_row( '__i__', array( 'key' => '', 'label' => '', 'fault' => false ), false ); ?>
		</template>

		<p>
			<button type="button" class="button careback-reason-add"><?php esc_html_e( 'Add reason', 'careback' ); ?></button>
			<?php $this->tip( __( 'The choices the customer picks from in the "Reason" dropdown. The key is the value stored on every request and counted in the statistics — it can be set while a reason is new and is fixed afterwards, so changing the text keeps the figures together. Tick "Our fault" for a reason that blames you, such as a damaged or incorrect item: the tick is not shown to the customer, and a request filed with that reason is flagged in the request list so you can decide the return postage. "Filed under it" counts the requests already carrying the reason; such a row is retired rather than removed, by ticking "Retire" and naming the reason its requests move onto. Removing every row and saving restores the built-in list.', 'careback' ) ); ?>
		</p>
		<p class="description"><?php esc_html_e( 'The customer reads the list in the order shown here. Drag a row by its handle, or type the place you want it in and save.', 'careback' ); ?></p>
		<?php
	}

	/**
	 * The tabs after Requests, in order: slug => title, tab title (`menu_title`,
	 * the title when not given), capability, callback, position. Setup and
	 * Settings are this plugin's own; an add-on adds a tab of its own through
	 * `careback_admin_pages`. Requests is the menu entry itself and is not on the
	 * list.
	 *
	 * A tab's callback prints its body: render_page() prints the frame around it
	 * — the .wrap, the heading and the tabs.
	 *
	 * @return array<string,array{title:string,menu_title:string,capability:string,callback:callable,position:int}>
	 */
	public function pages() {
		$pages = array(
			'careback-setup'    => array(
				'title'    => __( 'Setup', 'careback' ),
				'callback' => array( $this->setup, 'render' ),
				'position' => 20,
			),
			'careback-settings' => array(
				'title'    => __( 'Settings', 'careback' ),
				'callback' => array( $this, 'render' ),
				'position' => 50,
			),
		);

		$pages = apply_filters( self::PAGES_FILTER, $pages ); // phpcs:ignore WordPress.NamingConventions.PrefixAllGlobals.DynamicHooknameFound -- careback_admin_pages, the final prefix.
		$out   = array();

		foreach ( (array) $pages as $slug => $page ) {
			$slug = sanitize_key( (string) $slug );

			if ( '' === $slug || 'careback' === $slug || ! is_array( $page ) || empty( $page['callback'] ) || ! is_callable( $page['callback'] ) ) {
				continue;
			}

			$title = isset( $page['title'] ) ? (string) $page['title'] : $slug;

			$out[ $slug ] = array(
				'title'      => $title,
				'menu_title' => isset( $page['menu_title'] ) ? (string) $page['menu_title'] : $title,
				'capability' => isset( $page['capability'] ) ? (string) $page['capability'] : 'manage_woocommerce',
				'callback'   => $page['callback'],
				'position'   => isset( $page['position'] ) ? (int) $page['position'] : 1000,
			);
		}

		return self::by_position( $out );
	}

	/**
	 * The tabs of the screen, in order: slug => label. Requests first — the
	 * menu entry opens it — then pages() (Setup, Settings, then an add-on's).
	 *
	 * @return array<string,string>
	 */
	public function screen_tabs() {
		$tabs = array( self::PAGE => __( 'Requests', 'careback' ) );

		foreach ( $this->pages() as $slug => $page ) {
			$tabs[ $slug ] = wp_strip_all_tags( $page['menu_title'] );
		}

		return $tabs;
	}

	/**
	 * WooCommerce → Careback, with the count of new requests beside it, opens
	 * Requests; every other tab is a page of the same menu, so its address opens
	 * as before, and leaves the menu on `admin_head` (hide_tab_entries()). The
	 * window title of every tab is the plugin's name.
	 */
	public function menu() {
		$badge = '';
		$new   = (int) $this->requests->new_count();
		if ( $new > 0 ) {
			$badge = ' <span class="awaiting-mod">' . $new . '</span>';
		}

		$this->page_hooks = array();

		$hook = add_submenu_page( self::PARENT, __( 'Careback', 'careback' ), __( 'Careback', 'careback' ) . $badge, 'manage_woocommerce', self::PAGE, array( $this, 'render_page' ) );

		if ( is_string( $hook ) ) {
			$this->page_hooks[ $hook ] = self::PAGE;
		}

		foreach ( $this->pages() as $slug => $page ) {
			$hook = add_submenu_page( self::PARENT, __( 'Careback', 'careback' ), $page['menu_title'], $page['capability'], $slug, array( $this, 'render_page' ) );

			if ( is_string( $hook ) ) {
				$this->page_hooks[ $hook ] = $slug;
			}
		}
	}

	/**
	 * Takes the tabs after Requests out of the menu, so WooCommerce → Careback
	 * is the plugin's one entry. Runs on `admin_head`: WordPress has checked
	 * access to the page by then (through the menu), and prints the menu after.
	 */
	public function hide_tab_entries() {
		foreach ( array_keys( $this->pages() ) as $slug ) {
			remove_submenu_page( self::PARENT, $slug );
		}
	}

	/**
	 * On any tab, WooCommerce → Careback is the current entry of the menu.
	 *
	 * @param string|null $submenu_file The entry WordPress would mark.
	 * @param string      $parent_file  The menu open.
	 * @return string|null
	 */
	public function menu_current( $submenu_file, $parent_file = '' ) {
		unset( $parent_file );

		$page = isset( $GLOBALS['plugin_page'] ) ? (string) $GLOBALS['plugin_page'] : '';

		return '' !== $page && isset( $this->screen_tabs()[ $page ] ) ? self::PAGE : $submenu_file;
	}

	/**
	 * Prints one tab of the screen: the frame — the heading, "Careback", and the
	 * tabs, the current one marked — and the tab's body below it. The callback
	 * of every tab's page; the tab is the page WordPress opened.
	 *
	 * @param string $slug Page slug of the tab; '' (what WordPress hands a page
	 *                     callback) for the page being shown.
	 */
	public function render_page( $slug = '' ) {
		$slug = is_string( $slug ) ? $slug : '';

		if ( '' === $slug ) {
			$slug = isset( $this->page_hooks[ current_filter() ] ) ? $this->page_hooks[ current_filter() ] : '';
		}

		if ( '' === $slug && isset( $GLOBALS['plugin_page'] ) ) {
			$slug = (string) $GLOBALS['plugin_page'];
		}

		$pages = $this->pages();
		$tabs  = $this->screen_tabs();
		$slug  = isset( $tabs[ $slug ] ) ? $slug : self::PAGE;
		$cap   = isset( $pages[ $slug ] ) ? $pages[ $slug ]['capability'] : 'manage_woocommerce';

		if ( ! current_user_can( $cap ) ) {
			return;
		}
		?>
		<div class="wrap careback-wrap">
			<h1 class="careback-title"><?php esc_html_e( 'Careback', 'careback' ); ?></h1>
			<nav class="nav-tab-wrapper careback-tabs" aria-label="<?php esc_attr_e( 'Careback tabs', 'careback' ); ?>">
				<?php foreach ( $tabs as $tab => $label ) : ?>
					<a href="<?php echo esc_url( admin_url( 'admin.php?page=' . $tab ) ); ?>" class="nav-tab<?php echo $tab === $slug ? ' nav-tab-active' : ''; ?>"<?php echo $tab === $slug ? ' aria-current="page"' : ''; ?>><?php echo esc_html( $label ); ?></a>
				<?php endforeach; ?>
			</nav>
			<hr class="wp-header-end" />
			<?php call_user_func( isset( $pages[ $slug ] ) ? $pages[ $slug ]['callback'] : array( $this->requests, 'render' ) ); ?>
		</div>
		<?php
	}

	/**
	 * Entries ordered by their `position`, lower first; equal positions keep the
	 * order they came in (Registry::by_position(), the registries' own order).
	 *
	 * @param array<string,array> $entries Key => entry carrying `position`.
	 * @return array<string,array>
	 */
	private static function by_position( array $entries ) {
		return Registry::by_position( $entries );
	}


	public function action_links( $links ) {
		$url = admin_url( 'admin.php?page=careback-settings' );
		array_unshift( $links, '<a href="' . esc_url( $url ) . '">' . esc_html__( 'Settings', 'careback' ) . '</a>' );
		return $links;
	}

	/**
	 * Whether a notice about something that keeps the plugin from working may
	 * show on the current screen: the plugin's own screens (its tabs) and the
	 * Plugins screen, nowhere else in wp-admin. Both such notices can be
	 * dismissed (WordPress.org guideline 11).
	 *
	 * @return bool
	 */
	private function notice_screen() {
		$screen = function_exists( 'get_current_screen' ) ? get_current_screen() : null;
		$id     = $screen ? (string) $screen->id : '';

		if ( in_array( $id, array( 'plugins', 'plugins-network' ), true ) ) {
			return true;
		}

		// A tab is "<menu>_page_<slug>": "woocommerce_page_careback-settings" under
		// WooCommerce. The menu part is not read (it was the plugin's own menu,
		// with the count of new requests in it, before step 6).
		return '' !== $this->tab_of( $id );
	}

	public function dependency_notice() {
		if ( Plugin::woocommerce_active() || ! $this->notice_screen() ) {
			return;
		}
		echo '<div class="notice notice-warning is-dismissible"><p>' . esc_html__( 'Careback requires WooCommerce to be active.', 'careback' ) . '</p></div>';
	}

	/**
	 * Admin warning for an index the last upgrade could not put in place, on
	 * the plugin's own screens and the Plugins screen (notice_screen()).
	 *
	 * Worth a notice of its own rather than a line in a log, because the guard
	 * that is missing is usually the unique one on ticket identifiers — the
	 * thing that stops one signed session filing two requests. A site can run
	 * for months without noticing it is not there, which is the whole problem:
	 * the upgrade said nothing and stamped the new version anyway.
	 */
	public function index_gap_notice() {
		if ( ! current_user_can( 'manage_woocommerce' ) || ! $this->notice_screen() ) {
			return;
		}

		$gaps = get_option( Database::GAPS_OPTION, array() );

		if ( ! is_array( $gaps ) || ! $gaps ) {
			return;
		}

		echo '<div class="notice notice-error is-dismissible"><p>' . esc_html__( 'Careback: the database upgrade finished, but one or more indexes could not be added. Until they are, the protection they provide is not in place.', 'careback' ) . '</p><ul style="list-style:disc;margin-left:2em">';

		foreach ( $gaps as $message ) {
			echo '<li>' . esc_html( (string) $message ) . '</li>';
		}

		echo '</ul></div>';
	}

	/**
	 * The groups of the settings screen — its "tabs" — key => label, intro
	 * line and position. This plugin's own; an add-on adds one through
	 * `careback_settings_tabs`.
	 *
	 * @return array<string,array{label:string,intro:string,position:int}>
	 */
	public function tabs() {
		$tabs = array(
			'routes'     => array(
				'label'    => __( 'The four routes', 'careback' ),
				'intro'    => __( 'Everything that belongs to one route is here: how long it stays open, whether it is offered at all, which reasons the customer picks from on it, and whether a reason is asked for. Wording, emails and the shared reason list are further down — a reason is defined once and offered where you tick it.', 'careback' ),
				'position' => 10,
			),
			'portal'     => array(
				'label'    => __( 'Portal and form', 'careback' ),
				'position' => 20,
			),
			'timing'     => array(
				'label'    => __( 'Deadlines and reminders', 'careback' ),
				'position' => 30,
			),
			'emails'     => array(
				'label'    => __( 'Emails', 'careback' ),
				'position' => 50,
			),
			'safeguards' => array(
				'label'    => __( 'Safeguards, retention and statistics', 'careback' ),
				'position' => 60,
			),
		);

		$tabs = apply_filters( self::TABS_FILTER, $tabs ); // phpcs:ignore WordPress.NamingConventions.PrefixAllGlobals.DynamicHooknameFound -- careback_settings_tabs, the final prefix.
		$out  = array();

		foreach ( (array) $tabs as $key => $tab ) {
			$key = sanitize_key( (string) $key );

			if ( '' === $key || ! is_array( $tab ) ) {
				continue;
			}

			$out[ $key ] = array(
				'label'    => isset( $tab['label'] ) ? (string) $tab['label'] : $key,
				'intro'    => isset( $tab['intro'] ) ? (string) $tab['intro'] : '',
				'position' => isset( $tab['position'] ) ? (int) $tab['position'] : 1000,
			);
		}

		return self::by_position( $out );
	}

	/**
	 * The sections of the settings screen, key => the group it stands in, its
	 * heading, its position within the group and the callable that prints it
	 * ( array $stored_settings, string $screen, Settings $settings ), handed
	 * SCREEN and the screen's settings. This plugin's own; an add-on
	 * adds one through `careback_settings_sections`. A section of a group nobody
	 * registers, or without a callable, is left out; so is a section of the
	 * tracking screen's group (Track_Admin::TAB), which that screen prints.
	 *
	 * @return array<string,array{tab:string,label:string,position:int,render:callable}>
	 */
	public function sections() {
		$sections = array(
			'route-withdrawal' => array(
				'tab'      => 'routes',
				'label'    => __( 'Statutory withdrawal', 'careback' ),
				'position' => 10,
				'render'   => array( $this, 'render_section_route_withdrawal' ),
			),
			'route-return'     => array(
				'tab'      => 'routes',
				'label'    => __( 'Voluntary return', 'careback' ),
				'position' => 20,
				'render'   => array( $this, 'render_section_route_return' ),
			),
			'portal'           => array(
				'tab'      => 'portal',
				'label'    => __( 'Portal', 'careback' ),
				'position' => 10,
				'render'   => array( $this, 'render_section_portal' ),
			),
			'fields'           => array(
				'tab'      => 'portal',
				'label'    => __( 'Optional fields', 'careback' ),
				'position' => 20,
				'render'   => array( $this, 'render_section_fields' ),
			),
			'reasons'          => array(
				'tab'      => 'portal',
				'label'    => __( 'Reasons', 'careback' ),
				'position' => 30,
				'render'   => array( $this, 'render_section_reasons' ),
			),
			'variation'        => array(
				'tab'      => 'portal',
				'label'    => __( 'Item variation details', 'careback' ),
				'position' => 40,
				'render'   => array( $this, 'render_section_variation' ),
			),
			'windows'          => array(
				'tab'      => 'timing',
				'label'    => __( 'Notifications', 'careback' ),
				'position' => 10,
				'render'   => array( $this, 'render_section_windows' ),
			),
			'emails'           => array(
				'tab'      => 'emails',
				'label'    => __( 'Email templates', 'careback' ),
				'position' => 10,
				'render'   => array( $this, 'render_section_emails' ),
			),
			'status-emails'    => array(
				'tab'      => 'emails',
				'label'    => __( 'Status update emails', 'careback' ),
				'position' => 30,
				'render'   => array( $this, 'render_section_status_emails' ),
			),
			'retention'        => array(
				'tab'      => 'safeguards',
				'label'    => __( 'Retention and security', 'careback' ),
				'position' => 20,
				'render'   => array( $this, 'render_section_retention' ),
			),
			'bots'             => array(
				'tab'      => 'safeguards',
				'label'    => __( 'Bot protection', 'careback' ),
				'position' => 40,
				'render'   => array( $this, 'render_section_bots' ),
			),
		);

		return array_filter(
			self::section_entries( $sections ),
			static function ( $section ) {
				return Track_Admin::TAB !== $section['tab'];
			}
		);
	}

	/**
	 * A screen's own sections passed through `careback_settings_sections`,
	 * checked and ordered by position: key => tab, label, position, render. An
	 * entry without a group or a callable is dropped. Each screen keeps the
	 * groups it prints.
	 *
	 * @param array $sections The screen's own sections.
	 * @return array<string,array{tab:string,label:string,position:int,render:callable}>
	 */
	public static function section_entries( array $sections ) {
		$sections = apply_filters( self::SECTIONS_FILTER, $sections ); // phpcs:ignore WordPress.NamingConventions.PrefixAllGlobals.DynamicHooknameFound -- careback_settings_sections, the final prefix.
		$out      = array();

		foreach ( (array) $sections as $key => $section ) {
			$key = sanitize_key( (string) $key );

			if ( '' === $key || ! is_array( $section ) || empty( $section['tab'] ) || empty( $section['render'] ) || ! is_callable( $section['render'] ) ) {
				continue;
			}

			$out[ $key ] = array(
				'tab'      => sanitize_key( (string) $section['tab'] ),
				'label'    => isset( $section['label'] ) ? (string) $section['label'] : $key,
				'position' => isset( $section['position'] ) ? (int) $section['position'] : 1000,
				'render'   => $section['render'],
			);
		}

		return self::by_position( $out );
	}

	/**
	 * Grouping of the settings screen: group key => its heading, its intro line
	 * and the sections it holds, section key => that section's heading. Built
	 * from tabs() and sections(); a group without a section is left out.
	 *
	 * This is the only place the order and the wording come together. The index
	 * at the top of the screen and the headings between the fields are both
	 * built from it, and the keys become the `careback-grp-*` and `careback-sec-*` anchors a
	 * link can target. Nothing here touches the stored option keys.
	 *
	 * @return array<string,array{label:string,intro:string,sections:array<string,string>}>
	 */
	private function settings_map() {
		$map = array();

		foreach ( $this->tabs() as $key => $tab ) {
			$map[ $key ] = array(
				'label'    => $tab['label'],
				'intro'    => $tab['intro'],
				'sections' => array(),
			);
		}

		foreach ( $this->sections() as $key => $section ) {
			if ( isset( $map[ $section['tab'] ] ) ) {
				$map[ $section['tab'] ]['sections'][ $key ] = $section['label'];
			}
		}

		return array_filter(
			$map,
			static function ( $group ) {
				return ! empty( $group['sections'] );
			}
		);
	}

	/**
	 * Prints the rows of one section's table in position order: the rows the
	 * section passes, and those an add-on registers for it through
	 * `careback_settings_fields`. Each row is key => position and the callable
	 * that prints it ( array $stored_settings, string $screen, Settings $settings ).
	 *
	 * @param string $section Section the table belongs to.
	 * @param array  $fields  The section's own rows.
	 * @param array  $s       Stored settings.
	 */
	public function render_fields( $section, array $fields, array $s ) {
		self::print_fields( $section, $fields, $s, self::SCREEN, $this->settings );
	}

	/**
	 * What render_fields() does, for any screen: the rows of one section's
	 * table, its own and those registered through `careback_settings_fields`,
	 * in position order, each printed by its callable ( array $stored_settings,
	 * string $screen, Settings $settings ).
	 *
	 * @param string   $section  Section the table belongs to.
	 * @param array    $fields   The section's own rows.
	 * @param array    $s        Stored settings.
	 * @param string   $screen   Id of the screen printing the table: SCREEN or Track_Admin::SCREEN.
	 * @param Settings $settings The settings that screen prints.
	 */
	public static function print_fields( $section, array $fields, array $s, $screen, Settings $settings ) {
		$fields = apply_filters( self::FIELDS_FILTER, $fields, (string) $section ); // phpcs:ignore WordPress.NamingConventions.PrefixAllGlobals.DynamicHooknameFound -- careback_settings_fields, the final prefix.
		$rows   = array();

		foreach ( (array) $fields as $key => $field ) {
			if ( ! is_array( $field ) || empty( $field['render'] ) || ! is_callable( $field['render'] ) ) {
				continue;
			}

			$rows[ (string) $key ] = array(
				'position' => isset( $field['position'] ) ? (int) $field['position'] : 1000,
				'render'   => $field['render'],
			);
		}

		foreach ( self::by_position( $rows ) as $row ) {
			call_user_func( $row['render'], $s, (string) $screen, $settings );
		}
	}


	/**
	 * Index of the whole screen, printed above the form: every group with the
	 * sections under it, each a link to that section's anchor.
	 *
	 * The links move within the page and never reload it, so an unsaved field is
	 * never lost by jumping about, and every field stays inside the one form.
	 */
	private function render_settings_index() {
		?>
		<nav id="careback-settings-index" class="careback-index" aria-label="<?php esc_attr_e( 'Settings sections', 'careback' ); ?>">
			<?php foreach ( $this->settings_map() as $group_key => $group ) : ?>
				<div class="careback-index-group">
					<a class="careback-index-title" href="#careback-grp-<?php echo esc_attr( $group_key ); ?>"><?php echo esc_html( $group['label'] ); ?></a>
					<?php foreach ( $group['sections'] as $section_key => $section_label ) : ?>
						<a class="careback-index-link" href="#careback-sec-<?php echo esc_attr( $section_key ); ?>"><?php echo esc_html( $section_label ); ?></a>
					<?php endforeach; ?>
				</div>
			<?php endforeach; ?>
		</nav>
		<?php
	}

	/** Heading of one group, carrying the anchor its index entry links to. */
	private function group_heading( $group_key ) {
		$map = $this->settings_map();

		if ( ! isset( $map[ $group_key ] ) ) {
			return;
		}

		printf(
			'<h2 class="careback-group" id="careback-grp-%1$s">%2$s <a class="careback-group-back" href="#careback-settings-index">%3$s</a></h2>',
			esc_attr( $group_key ),
			esc_html( $map[ $group_key ]['label'] ),
			esc_html__( 'Section index', 'careback' )
		);
	}

	/** Heading of one section, carrying the anchor its index entry links to. */
	private function section_heading( $group_key, $section_key ) {
		$map = $this->settings_map();

		if ( ! isset( $map[ $group_key ]['sections'][ $section_key ] ) ) {
			return;
		}

		printf(
			'<h3 class="careback-section" id="careback-sec-%1$s">%2$s</h3>',
			esc_attr( $section_key ),
			esc_html( $map[ $group_key ]['sections'][ $section_key ] )
		);
	}

	/**
	 * The body of the Settings tab (render_page() prints the frame): the
	 * returns desk, or the tracking desk when asked for.
	 */
	public function render() {
		if ( ! current_user_can( 'manage_woocommerce' ) ) {
			return;
		}

		// One tab, two desks. Settings is where somebody goes to change
		// something, so both live here rather than in a tab of their own — which
		// read as a separate, nested application. The tracking half posts to its
		// own handler and writes only its own keys: this screen's save() sends
		// every key it knows and reads each checkbox as present-or-zero, so a form
		// without the returns checkboxes would switch the portal off on first save.
		if ( Track_Admin::requested() ) {
			Track_Admin::render_screen( $this->settings );
			return;
		}

		$s        = $this->settings->all();
		$sections = $this->sections();
		?>
		<div class="careback-settings">
			<?php Withdrawal_Switch::saved_notice(); ?>
			<?php Track_Admin::switcher( 'return' ); ?>

			<?php $this->render_settings_index(); ?>

			<form method="post" action="<?php echo esc_url( admin_url( 'admin-post.php' ) ); ?>">
				<input type="hidden" name="action" value="careback_save_settings" />
				<?php wp_nonce_field( 'careback_save_settings' ); ?>

				<?php foreach ( $this->settings_map() as $group_key => $group ) : ?>
					<?php $this->group_heading( $group_key ); ?>
					<?php if ( '' !== $group['intro'] ) : ?>
						<p class="description"><?php echo esc_html( $group['intro'] ); ?></p>
					<?php endif; ?>

					<?php foreach ( array_keys( $group['sections'] ) as $section_key ) : ?>
						<?php $this->section_heading( $group_key, $section_key ); ?>
						<?php call_user_func( $sections[ $section_key ]['render'], $s, self::SCREEN, $this->settings ); ?>
					<?php endforeach; ?>
				<?php endforeach; ?>

				<?php submit_button(); ?>
			</form>
		</div>
		<?php
	}

	/**
	 * The statutory withdrawal: its window, and the reasons it may show.
	 *
	 * @param array $s Stored settings.
	 */
	public function render_section_route_withdrawal( array $s ) {
		$on = Routes::withdrawal_offered( $this->settings );
		?>
		<p class="description"><?php esc_html_e( 'The right to withdraw from an online purchase within a period and without giving a reason, as consumers have it in the EU, for example. No request is refused on a date: the period only decides whether a request is recorded as a withdrawal or as a voluntary return.', 'careback' ); ?></p>
		<table class="form-table" role="presentation">
			<?php Withdrawal_Switch::render_row( $this->settings, $this->requests_repository ); ?>
			<?php if ( $on ) : ?>
				<?php Official_Texts::render_settings_row(); ?>
			<?php endif; ?>
		</table>
		<?php if ( ! $on ) : ?>
			<?php
			// Switched off (N-80): the rest of the section — the window, the rows an
			// add-on adds, the reasons — serves the withdrawals filed before, and is
			// folded away, not removed: nothing a shop set is lost.
			?>
			<details class="careback-earlier">
				<summary><?php esc_html_e( 'Settings for withdrawals filed earlier', 'careback' ); ?></summary>
		<?php endif; ?>
		<table class="form-table" role="presentation">
			<?php
			$this->render_fields(
				'route-withdrawal',
				array(
					'statutory_window_days' => array(
						'position' => 10,
						'render'   => array( $this, 'render_field_statutory_window' ),
					),
				),
				$s
			);
			?>
		</table>
		<?php self::render_route_reasons( 'withdrawal', $s, $this->settings ); ?>
		<?php if ( ! $on ) : ?>
			</details>
		<?php endif; ?>
		<?php
	}

	/**
	 * The row of the statutory window.
	 *
	 * @param array $s Stored settings.
	 */
	public function render_field_statutory_window( array $s ) {
		?>
		<tr>
			<th scope="row"><label for="careback-statutory-window"><?php esc_html_e( 'Statutory withdrawal window (days)', 'careback' ); ?></label></th>
			<td>
				<?php
				// Read through the floor, so a figure below fourteen stored by
				// 0.79.0 or earlier shows as the fourteen it now counts as. The
				// floor holds while statutory withdrawal is on (N-80).
				$careback_statutory = (int) $this->settings->get( 'statutory_window_days', 14 );
				$careback_on        = Routes::withdrawal_offered( $this->settings );
				?>
				<input id="careback-statutory-window" type="number" min="<?php echo esc_attr( $careback_on ? Settings::FLOORS['statutory_window_days'] : 1 ); ?>" name="statutory_window_days" value="<?php echo esc_attr( $careback_statutory ); ?>" class="small-text" />
				<?php if ( $careback_on ) : ?>
					<p class="description"><?php esc_html_e( 'At least 14 days. Across the EU this period cannot be shortened; you may make it longer.', 'careback' ); ?></p>
				<?php endif; ?>
				<?php $this->tip( __( 'The statutory withdrawal period that applies to your store, commonly 14 days. Used only to tag a request as a withdrawal vs. a normal return — advisory, requests are never rejected automatically on time.', 'careback' ) ); ?>
			</td>
		</tr>
		<?php
	}

	/**
	 * The voluntary return: its window, and the reasons it may show.
	 *
	 * @param array $s Stored settings.
	 */
	public function render_section_route_return( array $s ) {
		?>
		<p class="description">
			<?php
			// With statutory withdrawal off (N-80) the return is open from delivery.
			if ( Routes::withdrawal_offered( $this->settings ) ) {
				esc_html_e( 'Your own goodwill offer, on your own terms, listed once the statutory window has closed.', 'careback' );
			} else {
				esc_html_e( 'Your own return offer, on your own terms, open from delivery until the end of the return window.', 'careback' );
			}
			?>
		</p>
		<table class="form-table" role="presentation">
			<tr>
				<th scope="row"><label for="careback-return-window"><?php esc_html_e( 'Return window (days)', 'careback' ); ?></label></th>
				<td>
					<input id="careback-return-window" type="number" min="0" name="return_window_days" value="<?php echo esc_attr( $s['return_window_days'] ); ?>" class="small-text" />
					<?php $this->tip( __( 'Your own goodwill return period, e.g. 30 days. Used for labelling only — a request is never auto-rejected for being late.', 'careback' ) ); ?>
				</td>
			</tr>
			<?php $this->render_fields( 'route-return', array(), $s ); ?>
		</table>
		<?php self::render_route_reasons( 'return', $s, $this->settings ); ?>
		<?php
	}

	/**
	 * The portal switch and the fallback contact line.
	 *
	 * @param array $s Stored settings.
	 */
	public function render_section_portal( array $s ) {
		?>
		<table class="form-table" role="presentation">
			<tr>
				<th scope="row"><?php esc_html_e( 'Customer portal', 'careback' ); ?><?php Admin_Tip::tag( 'required' ); ?></th>
				<td>
					<label><input type="checkbox" name="portal_enabled" value="1" <?php checked( ! empty( $s['portal_enabled'] ) ); ?> /> <?php esc_html_e( 'Render the return portal on the front end', 'careback' ); ?></label>
					<?php $this->tip( __( 'Master switch for the whole return portal. When off, the form appears nowhere and the endpoints reject requests. Disabled by default — turn it on only after the page, emails, reasons and contact line are configured.', 'careback' ) ); ?>
				</td>
			</tr>
			<tr>
				<th scope="row"><label for="careback-fallback"><?php esc_html_e( 'Fallback contact line', 'careback' ); ?></label><?php Admin_Tip::tag( 'recommended' ); ?></th>
				<td>
					<textarea id="careback-fallback" name="fallback_contact" rows="2" class="large-text"><?php echo esc_textarea( $s['fallback_contact'] ); ?></textarea>
					<?php $this->tip( __( 'Always shown under the form so a customer can still declare a return or withdrawal if the form fails — e.g. a link to your contact page. HTML is allowed (links, bold). Leave blank to show a default with your admin email.', 'careback' ) ); ?>
				</td>
			</tr>
			<?php $this->render_fields( 'portal', array(), $s ); ?>
		</table>
		<?php
	}

	/**
	 * The optional fields of the form.
	 *
	 * @param array $s Stored settings.
	 */
	public function render_section_fields( array $s ) {
		?>
		<p class="description"><?php esc_html_e( 'Order number, email, name and item selection are always required. The reason is required on a route set to "Ask, answer required", and the reason and the comment both on a voluntary return filed after the statutory withdrawal period; a field required there is shown even if it is hidden here. A statutory withdrawal never needs a reason.', 'careback' ); ?></p>
		<table class="form-table" role="presentation">
			<tr>
				<th scope="row"><?php esc_html_e( 'Show these fields', 'careback' ); ?></th>
				<td>
					<label><input type="checkbox" name="field_reason" value="1" <?php checked( ! empty( $s['field_reason'] ) ); ?> /> <?php echo esc_html_x( 'Reason', 'admin field label', 'careback' ); ?></label>
					<?php $this->tip( __( 'Show the "Reason" dropdown on the form. It is shown anyway where an answer is required: on a route set to "Ask, answer required", and on a voluntary return after the statutory withdrawal period. A statutory withdrawal never needs a reason.', 'careback' ) ); ?><br />
					<label><input type="checkbox" name="field_comment" value="1" <?php checked( ! empty( $s['field_comment'] ) ); ?> /> <?php echo esc_html_x( 'Comment', 'admin field label', 'careback' ); ?></label>
					<?php $this->tip( __( 'Show a free-text comment box so the customer can add a note. It is shown anyway where a comment is required: on a voluntary return after the statutory withdrawal period, and on a route that asks for a description together with the reason.', 'careback' ) ); ?><br />
					<label><input type="checkbox" name="field_quantity" value="1" <?php checked( ! empty( $s['field_quantity'] ) ); ?> /> <?php esc_html_e( 'Per-item quantity', 'careback' ); ?></label>
					<?php $this->tip( __( 'Let the customer choose how many of a line item to return when they bought more than one. Off = the whole line is returned.', 'careback' ) ); ?>
				</td>
			</tr>
		</table>
		<?php
	}

	/**
	 * The shared reason list.
	 *
	 * @param array $s Stored settings.
	 */
	public function render_section_reasons( array $s ) {
		?>
		<?php $this->reason_usage_notice(); ?>
		<table class="form-table" role="presentation">
			<tr>
				<th scope="row"><?php esc_html_e( 'Reason list', 'careback' ); ?></th>
				<td>
					<?php $this->render_reasons_editor(); ?>
				</td>
			</tr>
		</table>
		<?php
	}

	/**
	 * Whether each item shows the details of its variation, each on a line of
	 * its own (N-16), and the rows registered for the section through
	 * `careback_settings_fields`: the shop's extra item details (X-04,
	 * Item_Fields), which replaced the custom mode of earlier releases.
	 *
	 * @param array $s Stored settings.
	 */
	public function render_section_variation( array $s ) {
		?>
		<table class="form-table" role="presentation">
			<tr>
				<th scope="row"><?php esc_html_e( 'Item details', 'careback' ); ?></th>
				<td>
					<label><input type="checkbox" name="variation_display" value="1" aria-describedby="careback-variation-help" <?php checked( ! empty( $s['variation_display'] ) ); ?> /> <?php esc_html_e( 'Show the details of each item under its name', 'careback' ); ?></label>
					<div class="careback-item-example" aria-hidden="true">
						<span><?php esc_html_e( 'Linen shirt', 'careback' ); ?></span>
						<span class="careback-item-meta"><?php esc_html_e( 'Size: M', 'careback' ); ?></span>
						<span class="careback-item-meta"><?php esc_html_e( 'Color: Sand', 'careback' ); ?></span>
					</div>
					<p class="description" id="careback-variation-help"><?php esc_html_e( 'The details WooCommerce shows on the order, such as size and color, each on its own line. Used in the form, the receipt email and on the request.', 'careback' ); ?></p>
				</td>
			</tr>
			<?php $this->render_fields( 'variation', array(), $s ); ?>
		</table>
		<?php
	}

	/**
	 * Who the team emails go to.
	 *
	 * @param array $s Stored settings.
	 */
	public function render_section_windows( array $s ) {
		?>
		<table class="form-table" role="presentation">
			<tr>
				<th scope="row"><label for="careback-admin-recipients"><?php esc_html_e( 'Admin notification recipients', 'careback' ); ?></label><?php Admin_Tip::tag( 'recommended' ); ?></th>
				<td>
					<input id="careback-admin-recipients" type="text" name="admin_recipients" value="<?php echo esc_attr( $s['admin_recipients'] ); ?>" class="regular-text" />
					<?php $this->tip( __( 'Who gets an email when a new request comes in. Separate several addresses with commas.', 'careback' ) ); ?>
				</td>
			</tr>
		</table>
		<?php
	}

	/**
	 * The email templates: the acknowledgement and the team email.
	 *
	 * @param array $s Stored settings.
	 */
	public function render_section_emails( array $s ) {
		?>
		<p class="description"><?php /* translators: {order} {ref} {name}: placeholders, keep them exactly as written. */ esc_html_e( 'Leave blank to use the defaults. In the subjects and the admin body, {order} {ref} {name} are replaced. The acknowledgement always keeps the receipt time and the item list; only the intro and closing lines are editable.', 'careback' ); ?></p>
		<table class="form-table" role="presentation">
			<?php
			$this->render_fields(
				'emails',
				array(
					'ack'          => array(
						'position' => 10,
						'render'   => array( $this, 'render_field_ack_emails' ),
					),
					'defect_intro' => array(
						'position' => 70,
						'render'   => array( $this, 'render_field_defect_intro' ),
					),
					'admin'        => array(
						'position' => 90,
						'render'   => array( $this, 'render_field_admin_emails' ),
					),
				),
				$s
			);
			?>
		</table>
		<?php
	}

	/**
	 * Subject, intro and closing of the acknowledgement.
	 *
	 * @param array $s Stored settings.
	 */
	public function render_field_ack_emails( array $s ) {
		?>
		<tr><th scope="row"><?php esc_html_e( 'Acknowledgement subject', 'careback' ); ?></th><td><input type="text" name="email_ack_subject" value="<?php echo esc_attr( $s['email_ack_subject'] ); ?>" class="regular-text" /><?php $this->tip( __( 'Subject line of the receipt email the customer gets right after sending a request.', 'careback' ) ); ?></td></tr>
		<tr><th scope="row"><?php esc_html_e( 'Acknowledgement intro', 'careback' ); ?></th><td><textarea name="email_ack_intro" rows="2" class="large-text"><?php echo esc_textarea( $s['email_ack_intro'] ); ?></textarea><?php $this->tip( __( 'Opening line of that receipt email. The receipt time and item list are always added below it.', 'careback' ) ); ?></td></tr>
		<tr><th scope="row"><?php esc_html_e( 'Acknowledgement closing', 'careback' ); ?></th><td><textarea name="email_ack_closing" rows="2" class="large-text"><?php echo esc_textarea( $s['email_ack_closing'] ); ?></textarea><?php $this->tip( __( 'Sign-off line of the receipt email, e.g. your thanks and contact details.', 'careback' ) ); ?></td></tr>
		<?php
	}

	/**
	 * The intro of a fault report.
	 *
	 * @param array $s Stored settings.
	 */
	public function render_field_defect_intro( array $s ) {
		?>
		<tr><th scope="row"><?php esc_html_e( 'Fault report intro', 'careback' ); ?></th><td><textarea name="email_defect_intro" rows="2" class="large-text"><?php echo esc_textarea( $s['email_defect_intro'] ); ?></textarea><?php $this->tip( __( 'Opening line when the customer reported a faulty or incorrect item. Leave blank to use the acknowledgement intro.', 'careback' ) ); ?></td></tr>
		<?php
	}

	/**
	 * Subject and body of the team email.
	 *
	 * @param array $s Stored settings.
	 */
	public function render_field_admin_emails( array $s ) {
		?>
		<tr><th scope="row"><?php esc_html_e( 'Admin subject', 'careback' ); ?></th><td><input type="text" name="email_admin_subject" value="<?php echo esc_attr( $s['email_admin_subject'] ); ?>" class="regular-text" /><?php $this->tip( __( 'Subject of the internal email sent to your team for every new request.', 'careback' ) ); ?></td></tr>
		<tr><th scope="row"><?php esc_html_e( 'Admin body', 'careback' ); ?></th><td><textarea name="email_admin_body" rows="4" class="large-text"><?php echo esc_textarea( $s['email_admin_body'] ); ?></textarea><?php $this->tip( /* translators: {order} {ref} {name}: placeholders, keep them exactly as written. */ __( 'Text of that internal email. Tokens {order} {ref} {name} are replaced with the real values.', 'careback' ) ); ?></td></tr>
		<?php
	}

	/**
	 * One email per registered status, each off until switched on.
	 *
	 * @param array $s Stored settings.
	 */
	public function render_section_status_emails( array $s ) {
		?>
		<p class="description"><?php /* translators: {ref} {status} {order}: placeholders, keep them exactly as written. */ esc_html_e( 'Optionally email the customer when a request reaches a status. Every status is off by default — turn on only the ones you want. HTML is allowed. Tokens: {ref} {status} {order}.', 'careback' ); ?></p>
		<?php
		$status_emails = is_array( $s['status_emails'] ) ? $s['status_emails'] : array();
		$status_labels = Statuses::display_labels();
		?>
		<table class="form-table" role="presentation">
			<?php foreach ( Statuses::keys() as $st ) : ?>
				<?php
				$row     = isset( $status_emails[ $st ] ) && is_array( $status_emails[ $st ] ) ? $status_emails[ $st ] : array();
				$enabled = ! empty( $row['enabled'] );
				$subj    = isset( $row['subject'] ) ? (string) $row['subject'] : '';
				$body    = isset( $row['body'] ) ? (string) $row['body'] : '';
				$lbl     = isset( $status_labels[ $st ] ) ? $status_labels[ $st ] : $st;
				?>
				<tr>
					<th scope="row">
						<label><input type="checkbox" name="status_emails[<?php echo esc_attr( $st ); ?>][enabled]" value="1" <?php checked( $enabled ); ?> /> <?php echo esc_html( $st ); ?></label>
						<p class="description" style="font-weight:400;margin:4px 0 0"><?php echo esc_html( $lbl ); ?></p>
					</th>
					<td>
						<input type="text" name="status_emails[<?php echo esc_attr( $st ); ?>][subject]" value="<?php echo esc_attr( $subj ); ?>" class="regular-text" placeholder="<?php esc_attr_e( 'Subject', 'careback' ); ?>" />
						<?php $this->tip( /* translators: {ref} {status} {order}: placeholders, keep them exactly as written. */ __( 'Send the customer an email when a request reaches this status. Leave the box unchecked to send nothing. Subject and HTML body support {ref} {status} {order}.', 'careback' ) ); ?>
						<br />
						<textarea name="status_emails[<?php echo esc_attr( $st ); ?>][body]" rows="3" class="large-text" placeholder="<?php /* translators: {ref} {status}: placeholders, keep them exactly as written. */ esc_attr_e( 'HTML body — e.g. <p>Your request {ref} is now {status}.</p>', 'careback' ); ?>"><?php echo esc_textarea( $body ); ?></textarea>
					</td>
				</tr>
			<?php endforeach; ?>
		</table>
		<?php
	}

	/**
	 * How long records and logs are kept, and the lookup limits.
	 *
	 * @param array $s Stored settings.
	 */
	public function render_section_retention( array $s ) {
		?>
		<table class="form-table" role="presentation">
			<tr><th scope="row"><label for="careback-ret-extra"><?php esc_html_e( 'Personal-field retention (years)', 'careback' ); ?></label></th><td><input id="careback-ret-extra" type="number" min="1" name="retention_extra_years" value="<?php echo esc_attr( $s['retention_extra_years'] ); ?>" class="small-text" /><?php $this->tip( __( 'After this many years the personal fields (name, comment) are wiped while the commercial record is kept. Keeps you GDPR-lean.', 'careback' ) ); ?></td></tr>
			<tr><th scope="row"><label for="careback-ret-events"><?php esc_html_e( 'Security-log retention (days)', 'careback' ); ?></label></th><td><input id="careback-ret-events" type="number" min="1" name="retention_events_days" value="<?php echo esc_attr( $s['retention_events_days'] ); ?>" class="small-text" /><?php $this->tip( __( 'How long the anti-abuse log (failed lookups etc.) is kept before it is deleted. 90 days is a good balance; only hashed identifiers are stored, so keeping it lean is GDPR-friendly.', 'careback' ) ); ?></td></tr>
			<tr><th scope="row"><label for="careback-rl-count"><?php esc_html_e( 'Lookup attempts before throttling', 'careback' ); ?></label></th><td><input id="careback-rl-count" type="number" min="1" name="lookup_max_attempts" value="<?php echo esc_attr( $s['lookup_max_attempts'] ); ?>" class="small-text" /><?php $this->tip( __( 'How many wrong order/email tries are allowed before the form is temporarily blocked. Stops people guessing order numbers.', 'careback' ) ); ?></td></tr>
			<tr><th scope="row"><label for="careback-rl-window"><?php esc_html_e( 'Throttling window (minutes)', 'careback' ); ?></label></th><td><input id="careback-rl-window" type="number" min="1" name="lookup_window_minutes" value="<?php echo esc_attr( $s['lookup_window_minutes'] ); ?>" class="small-text" /><?php $this->tip( __( 'The time span the attempt count above is measured over, and how long the block lasts.', 'careback' ) ); ?></td></tr>
			<tr><th scope="row"><label for="careback-ttl"><?php esc_html_e( 'Ticket lifetime (minutes)', 'careback' ); ?></label></th><td><input id="careback-ttl" type="number" min="1" name="ticket_ttl_minutes" value="<?php echo esc_attr( $s['ticket_ttl_minutes'] ); ?>" class="small-text" /><?php $this->tip( __( 'How long a customer has to finish the form after their order is found, before they must look it up again.', 'careback' ) ); ?></td></tr>
		</table>
		<?php
	}

	/**
	 * The defences of the public form.
	 *
	 * @param array $s Stored settings.
	 */
	public function render_section_bots( array $s ) {
		?>
		<p class="description"><?php esc_html_e( 'Extra defences for the public return form. Real customers are never blocked; these target automated abuse.', 'careback' ); ?></p>
		<table class="form-table" role="presentation">
			<?php
			$this->render_fields(
				'bots',
				array(
					'timing' => array(
						'position' => 10,
						'render'   => array( $this, 'render_field_timing' ),
					),
					'ban'    => array(
						'position' => 30,
						'render'   => array( $this, 'render_field_ban' ),
					),
				),
				$s
			);
			?>
		</table>
		<?php
	}

	/**
	 * The timing check.
	 *
	 * @param array $s Stored settings.
	 */
	public function render_field_timing( array $s ) {
		?>
		<tr>
			<th scope="row"><?php esc_html_e( 'Timing check', 'careback' ); ?></th>
			<td>
				<label><input type="checkbox" name="enable_time_token" value="1" <?php checked( ! empty( $s['enable_time_token'] ) ); ?> /> <?php esc_html_e( 'Reject submissions that are too fast or too old', 'careback' ); ?></label>
				<?php $this->tip( __( 'A signed timestamp is added when the form loads. A submit that arrives within a second or two is almost certainly a bot; a very old one is a replayed page. The portal fetches a fresh timestamp every time it loads, so a page cache does not age the form out — and a submission that is only old is answered with "reload the page", never counted as a failed attempt.', 'careback' ) ); ?>
				<p class="careback-subfields">
					<label><?php esc_html_e( 'Min seconds', 'careback' ); ?> <input type="number" min="0" name="min_submit_seconds" value="<?php echo esc_attr( $s['min_submit_seconds'] ); ?>" class="small-text" /><?php $this->tip( __( 'How quickly a submission may arrive after the form loaded. Two seconds is enough: nobody reads and types faster than that, and scripts submit instantly.', 'careback' ) ); ?></label>
					<label><?php esc_html_e( 'Max seconds', 'careback' ); ?> <input type="number" min="0" name="max_submit_seconds" value="<?php echo esc_attr( $s['max_submit_seconds'] ); ?>" class="small-text" /><?php $this->tip( __( 'How long a loaded form stays valid. A day by default, which covers a tab left open overnight. Set to 0 to drop the ceiling entirely.', 'careback' ) ); ?></label>
				</p>
			</td>
		</tr>
		<?php
	}

	/**
	 * The automatic block after failed lookups, and how long it lasts.
	 *
	 * @param array $s Stored settings.
	 */
	public function render_field_ban( array $s ) {
		?>
		<tr>
			<th scope="row"><label for="careback-ban-threshold"><?php esc_html_e( 'Auto-block after failed lookups', 'careback' ); ?></label></th>
			<td>
				<input id="careback-ban-threshold" type="number" min="0" name="ban_threshold" value="<?php echo esc_attr( $s['ban_threshold'] ); ?>" class="small-text" />
				<?php $this->tip( __( 'When one source (hashed) gets this many wrong order/email attempts within the throttling window, it is temporarily blocked entirely. Set 0 to disable auto-blocking.', 'careback' ) ); ?>
			</td>
		</tr>
		<tr>
			<th scope="row"><label for="careback-ban-minutes"><?php esc_html_e( 'Block duration (minutes)', 'careback' ); ?></label></th>
			<td>
				<input id="careback-ban-minutes" type="number" min="1" name="ban_minutes" value="<?php echo esc_attr( $s['ban_minutes'] ); ?>" class="small-text" />
				<?php $this->tip( __( 'How long an auto-block lasts before the source may try again.', 'careback' ) ); ?>
			</td>
		</tr>
		<?php
	}

	public function save() {
		if ( ! current_user_can( 'manage_woocommerce' ) ) {
			wp_die( esc_html__( 'Permission denied.', 'careback' ) );
		}
		check_admin_referer( 'careback_save_settings' );

		// The form, read once after the capability and the nonce and sanitised as
		// it is read (posted_form()): handed to every section (and to
		// `careback_save_settings`) as a parameter; each reader then validates the
		// fields it stores.
		$form         = self::posted_form( 'careback_save_settings' );
		self::$saving = $form;

		// Statutory withdrawal (N-80): switched off only with the confirmation, on
		// again without one; the floor of its window holds while it is on.
		list( $switch, $switched ) = Withdrawal_Switch::from_post( $this->settings, $form );
		$withdrawal_on             = isset( $switch['withdrawal_enabled'] ) ? (bool) $switch['withdrawal_enabled'] : Routes::withdrawal_offered( $this->settings );

		// Per-status customer emails: enabled flag + subject + HTML body. A status
		// nobody registers now — one an add-on that is switched off brought —
		// keeps what it had: the screen did not show it, so it posted nothing
		// that could stand for a change.
		$status_emails = $this->settings->get( 'status_emails', array() );
		$status_emails = is_array( $status_emails ) ? array_diff_key( $status_emails, array_flip( Statuses::keys() ) ) : array();
		if ( isset( $form['status_emails'] ) && is_array( $form['status_emails'] ) ) {
			$posted = array();
			foreach ( Statuses::keys() as $st ) {
				$r = isset( $form['status_emails'][ $st ] ) && is_array( $form['status_emails'][ $st ] ) ? $form['status_emails'][ $st ] : array();
				$posted[ $st ] = array(
					'enabled' => empty( $r['enabled'] ) ? 0 : 1,
					'subject' => isset( $r['subject'] ) && is_string( $r['subject'] ) ? sanitize_text_field( $r['subject'] ) : '',
					'body'    => isset( $r['body'] ) && is_string( $r['body'] ) ? wp_kses_post( $r['body'] ) : '',
				);
			}
			$status_emails = array_merge( $posted, $status_emails );
		}

		// Reason rows: key, customer text and fault box. Sanitised and de-duplicated
		// by Reasons, which also keeps the key of a row that is already in the list.
		$reasons = array();
		if ( isset( $form['reasons'] ) && is_array( $form['reasons'] ) ) {
			$moves   = array();
			$reasons = Reasons::from_posted(
				$form['reasons'],
				$this->settings,
				$moves
			);

			// Carried out before the list is stored, so a request never sits for an
			// instant on a key the list no longer holds.
			foreach ( $moves as $from => $to ) {
				$this->requests_repository->move_reason( $from, $to );
			}

			$reasons = $this->apply_route_selection( $reasons, $form );
		}

		// Every key this screen owns is written here; a section an add-on
		// registers adds its own through `careback_save_settings`, which hands it
		// this screen's id (SCREEN) and its settings. A key nobody sends is not
		// touched: Settings::update() lays these over what is stored.
		$this->settings->update(
			(array) apply_filters(
				self::SAVE_FILTER, // phpcs:ignore WordPress.NamingConventions.PrefixAllGlobals.DynamicHooknameFound -- careback_save_settings, the final prefix.
				array(
					'portal_enabled'        => isset( $_POST['portal_enabled'] ) ? 1 : 0,
					'return_window_days'    => isset( $_POST['return_window_days'] ) ? absint( wp_unslash( $_POST['return_window_days'] ) ) : 30,
					// Floored at fourteen days, the legal minimum in the EU: a shop may
					// widen the window, never shorten it. See Settings::FLOORS.
					'statutory_window_days' => isset( $_POST['statutory_window_days'] ) ? max( $withdrawal_on ? Settings::FLOORS['statutory_window_days'] : 1, absint( wp_unslash( $_POST['statutory_window_days'] ) ) ) : 14,
					'admin_recipients'      => isset( $_POST['admin_recipients'] ) ? sanitize_text_field( wp_unslash( $_POST['admin_recipients'] ) ) : '',
					// Rendered as HTML on the portal, so allow safe markup (links, emphasis).
					'fallback_contact'      => isset( $_POST['fallback_contact'] ) ? wp_kses_post( wp_unslash( $_POST['fallback_contact'] ) ) : '',
					'reasons'               => $reasons,
					'reason_mode_return'    => self::reason_mode_input( 'return', $form ),
					'field_reason'          => isset( $_POST['field_reason'] ) ? 1 : 0,
					'field_comment'         => isset( $_POST['field_comment'] ) ? 1 : 0,
					'field_quantity'        => isset( $_POST['field_quantity'] ) ? 1 : 0,
					// The shop's extra item details are stored by Item_Fields (X-04).
					'variation_display'     => isset( $_POST['variation_display'] ) ? 1 : 0,
					'email_ack_subject'     => isset( $_POST['email_ack_subject'] ) ? sanitize_text_field( wp_unslash( $_POST['email_ack_subject'] ) ) : '',
					'email_ack_intro'       => isset( $_POST['email_ack_intro'] ) ? sanitize_textarea_field( wp_unslash( $_POST['email_ack_intro'] ) ) : '',
					'email_ack_closing'     => isset( $_POST['email_ack_closing'] ) ? sanitize_textarea_field( wp_unslash( $_POST['email_ack_closing'] ) ) : '',
					'email_defect_intro'    => isset( $_POST['email_defect_intro'] ) ? sanitize_textarea_field( wp_unslash( $_POST['email_defect_intro'] ) ) : '',
					'email_admin_subject'   => isset( $_POST['email_admin_subject'] ) ? sanitize_text_field( wp_unslash( $_POST['email_admin_subject'] ) ) : '',
					'email_admin_body'      => isset( $_POST['email_admin_body'] ) ? sanitize_textarea_field( wp_unslash( $_POST['email_admin_body'] ) ) : '',
					'status_emails'         => $status_emails,
					'retention_extra_years' => isset( $_POST['retention_extra_years'] ) ? max( 1, absint( wp_unslash( $_POST['retention_extra_years'] ) ) ) : 3,
					'retention_events_days' => isset( $_POST['retention_events_days'] ) ? max( 1, absint( wp_unslash( $_POST['retention_events_days'] ) ) ) : 90,
					'lookup_max_attempts'   => isset( $_POST['lookup_max_attempts'] ) ? max( 1, absint( wp_unslash( $_POST['lookup_max_attempts'] ) ) ) : 5,
					'lookup_window_minutes' => isset( $_POST['lookup_window_minutes'] ) ? max( 1, absint( wp_unslash( $_POST['lookup_window_minutes'] ) ) ) : 15,
					'ticket_ttl_minutes'    => isset( $_POST['ticket_ttl_minutes'] ) ? max( 1, absint( wp_unslash( $_POST['ticket_ttl_minutes'] ) ) ) : 30,
					'enable_time_token'     => isset( $_POST['enable_time_token'] ) ? 1 : 0,
					'min_submit_seconds'    => isset( $_POST['min_submit_seconds'] ) ? absint( wp_unslash( $_POST['min_submit_seconds'] ) ) : 2,
					// Zero is allowed here and means "no ceiling": see the field tooltip.
					'max_submit_seconds'    => isset( $_POST['max_submit_seconds'] ) ? absint( wp_unslash( $_POST['max_submit_seconds'] ) ) : 86400,
					'ban_threshold'         => isset( $_POST['ban_threshold'] ) ? absint( wp_unslash( $_POST['ban_threshold'] ) ) : 10,
					'ban_minutes'           => isset( $_POST['ban_minutes'] ) ? max( 1, absint( wp_unslash( $_POST['ban_minutes'] ) ) ) : 60,
				),
				self::SCREEN,
				$this->settings,
				$form
			)
		);
		self::$saving = array();

		if ( $switch ) {
			$this->settings->update( $switch );
		}

		$location = add_query_arg( 'updated', '1', admin_url( 'admin.php?page=careback-settings' ) );
		$invalid  = implode( ',', Admin_Sections::invalid_fields() );

		if ( '' !== $switched ) {
			$location = add_query_arg( Withdrawal_Switch::RESULT_ARG, $switched, $location );
		}

		// A field a section refused keeps its stored value and says why.
		if ( '' !== $invalid ) {
			$location = add_query_arg( Admin_Sections::INVALID_ARG, $invalid, $location );
		}

		wp_safe_redirect( $location );
		exit;
	}
}