Committed vs realized. Committed = the estimate at mint (50% × 12 mo × $15 = $90/commitment). Realized = what a redeemed commitment actually cost — a subscription that cancels early stops its coupon with it, so realized lands under the estimate (realized_months / realized_cost, stamped on subscription.deleted).

Locked policy #1 — suspend, don't void. Cancel / leave-Loop parks the perk as a win-back offer; the daily sweep voids it (and revokes the Stripe coupon) after 180 days. Account deletion voids immediately. One active commitment per org — re-redeemed referrals and access codes return the existing grant, never a second one.

Guard rails shipped: at-most-one-active per org (A2) · expires_at written at mint, 365-day redemption window (A3) · daily commitment-lifecycle sweep expires + voids · void revokes the Stripe coupon so the discount can't outlive the grant (A5).

Locked policy #2 — discount applies at conversion. A Stripe-side trial flips trialing→active on the same subscription — no checkout. The webhook now applies the org's active commitment to the live subscription at that transition (apply_commitment_to_subscription). It previously evaporated, silently.

Locked policy #3 — auto true-up with a confirm. Adding a member pushes the Stripe quantity (prorated); the invite flow answers 402 seat_confirmation_required with a seat-impact preview until the admin confirms. Member removal trues down but never below the floor. The old drift — invite members, bill unchanged — is closed.

2 open decisions this view assumes. (1) What EAP grace lapses into isn't decided — today the daily eap-graduation sweep drops an expired-grace org straight to free (app.py); if grace should instead land on a discounted paid tier, that conversion + its discount don't exist yet — "EAP · Grace" and "Free" are genuinely different populations below, not two labels for one thing. (2) The graduation discount shown here is a 30% placeholder until the campaign terms lock — the segment shape doesn't change either way.

Maps to real code: tier / grace_expires_at — billing.py get_plan_status(). Seat sync (team only) — billing.sync_subscription_seats(). Contract discount — org_contracts.discount_pct. Cost attribution — finance/costs.py (planned, P4).

Why this panel is adapter-shaped. Every row above comes from the active provider's own adapter.health() and adapter.config_schema(), so a Launchpad product on a different processor inherits this screen by implementing the adapter, with no console changes. Provider-specific checks (Stripe Tax) arrive as adapter-declared rows rather than hardcoded ones. Contract: SPEC.payment-gateways.md (RCTX-1056).

The check that catches real outages is webhook freshness, and it needs no API call: the newest row in processor_events against the count of live subscriptions. Every other check catches misconfiguration; only this one catches the silence where money should be. Config writes are audited (RCTX-1054) and are the first natural candidate for approval quorum (RCTX-1053) — changing a price ID deserves a second pair of eyes.

Loop parity (decided): a grant_loop code now mints the same 50%/12mo commitment as a referral join — source loop_promo, so promo cost stays separable from referral cost in Commitments.