diff --git a/components/SignupConfigurator.tsx b/components/SignupConfigurator.tsx
index d44751a..1877163 100644
--- a/components/SignupConfigurator.tsx
+++ b/components/SignupConfigurator.tsx
@@ -35,7 +35,7 @@ export default function SignupConfigurator() {
   const saving = quote.aLaCarteCents - quote.monthlyCents;
 
   const optionalModules = MODULES.filter(
-    (m) => m.id !== "core" && m.id !== "extra-languages",
+    (m) => m.id !== "core" && m.id !== "extra-languages" && m.sellable !== false,
   );
 
   return (
diff --git a/components/control/ProvisionPicker.tsx b/components/control/ProvisionPicker.tsx
index ee7fdef..48e8aa5 100644
--- a/components/control/ProvisionPicker.tsx
+++ b/components/control/ProvisionPicker.tsx
@@ -76,7 +76,7 @@ export default function ProvisionPicker({
           {labels.modulesCore} · {eur(MODULES.find((m) => m.id === "core")!.priceCents)}
         </p>
         <div className="grid gap-1 sm:grid-cols-2">
-          {MODULES.filter((m) => m.id !== "core" && m.id !== "extra-languages").map((m) => (
+          {MODULES.filter((m) => m.id !== "core" && m.id !== "extra-languages" && m.sellable !== false).map((m) => (
             <label key={m.id} className="flex items-start gap-2 font-label text-sm">
               <input
                 type="checkbox"
diff --git a/lib/module-catalog.ts b/lib/module-catalog.ts
index bfad348..1780e3f 100644
--- a/lib/module-catalog.ts
+++ b/lib/module-catalog.ts
@@ -20,6 +20,7 @@ export const MODULE_IDS = [
   "reservations",
   "loyalty",
   "printing",
+  "online-payments",
   "extra-languages",
 ] as const;
 
@@ -31,6 +32,16 @@ export interface CatalogModule {
   priceCents: number;
   /** The RUMI surface this unlocks — kept next to the price so the two never drift. */
   surface: string;
+  /**
+   * Absent = sellable. `false` means the id is a VALID part of the registry vocabulary — a
+   * tenant entry carrying it provisions, and the backend recognises it — but it must not be
+   * offered for purchase yet, because the surface it unlocks is not finished. Selling a module
+   * nothing enforces is charging for a product that does not vary.
+   *
+   * Both purchase surfaces filter on this: the public SignupConfigurator and the founder's
+   * ProvisionPicker. Flip it (delete the line) in the slice that makes the module real.
+   */
+  sellable?: boolean;
 }
 
 /**
@@ -46,6 +57,16 @@ export const MODULES: readonly CatalogModule[] = [
   { id: "reservations", priceCents: 900, surface: "/reservations + admin management" },
   { id: "loyalty", priceCents: 900, surface: "fidelity points, customer groups, discounts" },
   { id: "printing", priceCents: 900, surface: "printer-app companion + printer feed" },
+  {
+    id: "online-payments",
+    priceCents: 1900,
+    surface: "card/TWINT at checkout, paid to the restaurant's own Stripe account",
+    // NOT YET SELLABLE. The vocabulary lands first (S10) so provisioning accepts the id and the
+    // registry can record a stripe_account; the endpoint that would honour it arrives in S4 and
+    // the customer-facing choice in S8. Until then this must not appear on the signup page or in
+    // the founder's provision picker. Remove this line in S9, when the flow works end to end.
+    sellable: false,
+  },
   { id: "extra-languages", priceCents: 500, surface: "beyond Core's en + 1, up to 10 locales" },
 ] as const;
 
diff --git a/package-lock.json b/package-lock.json
index 500da44..1518788 100644
--- a/package-lock.json
+++ b/package-lock.json
@@ -5515,9 +5515,9 @@
       "license": "MIT"
     },
     "node_modules/brace-expansion": {
-      "version": "5.0.8",
-      "resolved": "https://registry.npmjs.org/brace-expansion/-/brace-expansion-5.0.8.tgz",
-      "integrity": "sha512-JZyDyq3D4AUifKTPOB7DELf6XsB3WdPuNxCtob1vFXPsSXhdAiHBWJ/tJ8HAc9aH84BK+5JFZLNkJKx3G9kzQg==",
+      "version": "5.0.9",
+      "resolved": "https://registry.npmjs.org/brace-expansion/-/brace-expansion-5.0.9.tgz",
+      "integrity": "sha512-ScQ4IuvIEF1TMlP7Zt+vjJ//9zlPb2SDcxWxM3bk8s6t6GGdJ7KO1dCcTidOPJKePW30LE/2cT7wCyPho9/Wxg==",
       "license": "MIT",
       "dependencies": {
         "balanced-match": "^4.0.2"
@@ -6877,9 +6877,9 @@
       "license": "MIT"
     },
     "node_modules/fast-uri": {
-      "version": "3.1.4",
-      "resolved": "https://registry.npmjs.org/fast-uri/-/fast-uri-3.1.4.tgz",
-      "integrity": "sha512-8JnbkQ4juDyvYs4mgFGQqg4yCYtFDtUtmp2QIQq11ZZe5CFQ5wcqm1rqDgAh/QdMySuBnPzMUiJUNZG5N/AiQw==",
+      "version": "3.1.5",
+      "resolved": "https://registry.npmjs.org/fast-uri/-/fast-uri-3.1.5.tgz",
+      "integrity": "sha512-gHwA1O9LDIcKunMKhObS/HimwtehO1nPUECKAu5TpKgaO19fcWEl4bliWe1jWxVFvIXztJjjQ4L8XQ1EU9f7Jw==",
       "funding": [
         {
           "type": "github",
@@ -7391,9 +7391,9 @@
       }
     },
     "node_modules/hono": {
-      "version": "4.12.27",
-      "resolved": "https://registry.npmjs.org/hono/-/hono-4.12.27.tgz",
-      "integrity": "sha512-1yrb/+w6HWQJrUCLkJ2IF5jNIPvvFkblV5RNOYl6bV+OA6p9GLcMpHFFGTosSvHvcAUibuUukRqhlYI4z32C7Q==",
+      "version": "4.13.1",
+      "resolved": "https://registry.npmjs.org/hono/-/hono-4.13.1.tgz",
+      "integrity": "sha512-kdJoFVv2xmayw6cY09H7AbMJMt8Jn5jdlEdXsP7AGBdF2DIptVlKlOLKXP41yPip4/a3yQPv9gVcJYI8YY04dw==",
       "devOptional": true,
       "license": "MIT",
       "engines": {
@@ -8094,9 +8094,9 @@
       "license": "MIT"
     },
     "node_modules/js-yaml": {
-      "version": "4.3.0",
-      "resolved": "https://registry.npmjs.org/js-yaml/-/js-yaml-4.3.0.tgz",
-      "integrity": "sha512-1td788aAnnZ5qs7V2QIRl1owjtYpbKt749Y3xauqQgwIIGF/xXWz1wMTEBx5O3LK3lXLVuqXPdPxj2BoFHaW9Q==",
+      "version": "4.3.1",
+      "resolved": "https://registry.npmjs.org/js-yaml/-/js-yaml-4.3.1.tgz",
+      "integrity": "sha512-CY6crGq313MX8GkwvB7tzgp99vjQxY1++5y10/BKN/GUfHqWaOGQMNZkBvqSzsZKWk/ijwHlWzzkLulsGHhjWQ==",
       "dev": true,
       "funding": [
         {
@@ -8813,9 +8813,9 @@
       }
     },
     "node_modules/nanoid": {
-      "version": "3.3.16",
-      "resolved": "https://registry.npmjs.org/nanoid/-/nanoid-3.3.16.tgz",
-      "integrity": "sha512-bzlKTyNJ7+LdGIIwy8ijFpIqEQIvafahV7eYykJ8Cvh42EdJeODoJ6gUJXpQJvej1BddH8OqTXZNE/KfbWAu8Q==",
+      "version": "3.3.18",
+      "resolved": "https://registry.npmjs.org/nanoid/-/nanoid-3.3.18.tgz",
+      "integrity": "sha512-DTg4MJbGMWkfi6VZFdNt2/caMbQy4Ou+Op/hJQvGEWcnVfoA1QA+xzRKAzw9jD6+GVOOeYr/mIcuDSdug6F6+w==",
       "funding": [
         {
           "type": "github",
diff --git a/tests/unit/module-catalog.test.ts b/tests/unit/module-catalog.test.ts
index 88b5330..b670ac8 100644
--- a/tests/unit/module-catalog.test.ts
+++ b/tests/unit/module-catalog.test.ts
@@ -19,6 +19,24 @@ describe("catalog shape", () => {
     }
   });
 
+  it("never bundles a module that is not sellable yet", () => {
+    // A bundle is a purchase, so it must not smuggle in a module the à-la-carte surfaces
+    // deliberately hide. online-payments is in the vocabulary from S10 but has no working
+    // surface until S9 — putting it inside "full-service" would sell it anyway.
+    const notSellable = new Set(MODULES.filter((m) => m.sellable === false).map((m) => m.id));
+    for (const b of BUNDLES) {
+      expect(b.modules.filter((m) => notSellable.has(m))).toEqual([]);
+    }
+  });
+
+  it("keeps an unfinished module out of the vocabulary's sellable set", () => {
+    // The vocabulary and the price list are the same array, so adding an id to make
+    // provisioning accept it also makes it purchasable unless it is flagged. This is the
+    // assertion that catches that: online-payments must be KNOWN and NOT sellable.
+    expect(isModuleId("online-payments")).toBe(true);
+    expect(MODULES.find((m) => m.id === "online-payments")?.sellable).toBe(false);
+  });
+
   it("only bundles modules that exist, and always includes core", () => {
     for (const b of BUNDLES) {
       expect(unknownModuleIds([...b.modules])).toEqual([]);