@@ -9,6 +9,7 @@ import {
   linkAwsMarketplaceLicenseAsAdmin,
   listUnlinkedAwsMarketplaceLicenses,
 } from '@/lib/billing/aws-marketplace/application/admin'
+import { getAwsMarketplaceProductCode } from '@/lib/billing/aws-marketplace/config'
 import { asOrchestrationError } from '@/lib/core/orchestration/types'
 import { withRouteHandler } from '@/lib/core/utils/with-route-handler'
 import { getAdminAuditActor } from '@/app/api/v1/admin/dashboard/actor'
@@ -28,6 +29,7 @@ const logger = createLogger('AdminAwsMarketplaceLicensesAPI')
 /** The Marketplace licenses no organization holds yet. */
 export const GET = withRouteHandler(
   withAdminAuth(async (request) => {
+    if (!getAwsMarketplaceProductCode()) return adminNotFoundResponse('AWS Marketplace')
     const parsed = await parseRequest(
       adminDashboardListAwsMarketplaceLicensesContract,
       request,
@@ -54,6 +56,7 @@ export const GET = withRouteHandler(
 /** Links a Marketplace license to an organization once the team has provisioned it. */
 export const POST = withRouteHandler(
   withAdminAuth(async (request) => {
+    if (!getAwsMarketplaceProductCode()) return adminNotFoundResponse('AWS Marketplace')
     const parsed = await parseRequest(
       adminDashboardLinkAwsMarketplaceLicenseContract,
       request,
 
@@ -18,12 +18,13 @@ import {
   AWS_MARKETPLACE_SETUP_TURNAROUND,
   type AwsMarketplaceOnboardingError,
 } from '@/lib/billing/aws-marketplace/onboarding'
-import { organizationRoutes, WORKSPACE_BILLING_PATH } from '@/lib/navigation/paths'
+import { organizationRoutes } from '@/lib/navigation/paths'
 import { buildAuthCrossLink } from '@/app/(auth)/auth-redirect'
 import { InviteLayout, InviteStatusCard } from '@/app/invite/components'
 import { useBrandConfig } from '@/ee/whitelabeling'
 import {
   useAwsMarketplaceClaim,
+  useAwsMarketplaceLicenses,
   useLinkAwsMarketplaceLicense,
   useRegisterAwsMarketplaceLicenseToAccount,
   useSaveAwsMarketplaceClaimContact,
@@ -59,6 +60,12 @@ const REGISTRATION_ERROR_COPY: Record<
 /** AWS's manual-setup guidance: being set up, wait to be contacted, turnaround, contact. */
 const BEING_SET_UP = `Your account is being set up. Please wait for us to contact you. We expect to finish ${AWS_MARKETPLACE_SETUP_TURNAROUND}.`
 
+const LICENSE_STATUS_LABELS = {
+  active: 'Active',
+  pending: 'Confirming with AWS',
+  inactive: 'Inactive',
+} as const
+
 function authLink(path: '/login' | '/signup'): string {
   return buildAuthCrossLink(path, {
     callbackUrl: AWS_MARKETPLACE_ONBOARDING_PATH,
@@ -80,6 +87,69 @@ function SupportContact({ supportEmail }: SupportContactProps) {
   )
 }
 
+/** Status for a buyer with no organization, who may not be able to open any billing page. */
+function AccountSubscriptionStatus() {
+  const { data: licenses } = useAwsMarketplaceLicenses(null)
+  if (!licenses?.length) return null
+  return (
+    <ul className='au:w-full au:space-y-1 au:text-center au:text-sm'>
+      {licenses.map((license) => (
+        <li key={license.id}>
+          {LICENSE_STATUS_LABELS[license.status]}
+          {license.expiresAt && `, expires ${formatDate(new Date(license.expiresAt))}`}
+        </li>
+      ))}
+    </ul>
+  )
+}
+
+interface NoSetupInProgressProps {
+  supportContact: ReactNode
+  actions: Array<{ label: string; onClick: () => void }>
+}
+
+/** A finished buyer who returns sees their account's status; anyone else, how to start. */
+function NoSetupInProgress({ supportContact, actions }: NoSetupInProgressProps) {
+  const { data: licenses, isPending } = useAwsMarketplaceLicenses(null)
+  if (isPending) {
+    return (
+      <InviteLayout>
+        <InviteStatusCard type='loading' title='' description='Loading your subscription...' />
+      </InviteLayout>
+    )
+  }
+  if (licenses?.length) {
+    const underway = licenses.some((license) => license.status !== 'inactive')
+    return (
+      <InviteLayout>
+        <InviteStatusCard
+          type={underway ? 'success' : 'warning'}
+          title='Your AWS Marketplace subscription'
+          description={underway ? BEING_SET_UP : 'This subscription is no longer active.'}
+          details={
+            <div className='au:w-full au:space-y-2'>
+              <AccountSubscriptionStatus />
+              {supportContact}
+            </div>
+          }
+          actions={actions}
+        />
+      </InviteLayout>
+    )
+  }
+  return (
+    <InviteLayout>
+      <InviteStatusCard
+        type='warning'
+        title='No setup in progress'
+        description={`${RESTART_FROM_AWS} If you already finished setup, we will contact you ${AWS_MARKETPLACE_SETUP_TURNAROUND}.`}
+        details={supportContact}
+        actions={actions}
+      />
+    </InviteLayout>
+  )
+}
+
 interface AwsMarketplaceOnboardingProps {
   registrationError: AwsMarketplaceOnboardingError | null
   registrationDisabled: boolean
@@ -134,7 +204,11 @@ export function AwsMarketplaceOnboarding({
         <InviteStatusCard
           type='login'
           title='Set up your AWS Marketplace subscription'
-          description='Sign in or create an account to set up this subscription.'
+          description={
+            registrationDisabled
+              ? 'Sign in to set up this subscription.'
+              : 'Sign in or create an account to set up this subscription.'
+          }
           details={supportContact}
           actions={[
             ...(registrationDisabled
@@ -157,17 +231,17 @@ export function AwsMarketplaceOnboarding({
           description={BEING_SET_UP}
           details={
             <div className='au:w-full au:space-y-2 au:text-center au:text-sm'>
-              <p>
-                <AuthTextLink
-                  href={
-                    organizationId
-                      ? organizationRoutes(organizationId).settingsSection('billing')
-                      : WORKSPACE_BILLING_PATH
-                  }
-                >
-                  View subscription status
-                </AuthTextLink>
-              </p>
+              {organizationId ? (
+                <p>
+                  <AuthTextLink
+                    href={organizationRoutes(organizationId).settingsSection('billing')}
+                  >
+                    View subscription status
+                  </AuthTextLink>
+                </p>
+              ) : (
+                <AccountSubscriptionStatus />
+              )}
               {supportContact}
             </div>
           }
@@ -200,17 +274,7 @@ export function AwsMarketplaceOnboarding({
 
   const claim = claimQuery.data
   if (claim.status === 'missing') {
-    return (
-      <InviteLayout>
-        <InviteStatusCard
-          type='warning'
-          title='No setup in progress'
-          description={`${RESTART_FROM_AWS} If you already finished setup, we will contact you ${AWS_MARKETPLACE_SETUP_TURNAROUND}.`}
-          details={supportContact}
-          actions={[returnHome]}
-        />
-      </InviteLayout>
-    )
+    return <NoSetupInProgress supportContact={supportContact} actions={[returnHome]} />
   }
 
   if (claim.status === 'linked') {
 
@@ -135,7 +135,8 @@ export function Billing({ scope, organizationId, creditUsageHref }: BillingProps
     enabled: !isOrganizationScope,
   })
   const billingOrganizationId = isOrganizationScope ? (organizationId ?? null) : null
-  const { billedThroughMarketplace } = useAwsMarketplaceBilling(billingOrganizationId)
+  const marketplaceBilling = useAwsMarketplaceBilling(billingOrganizationId)
+  const { billedThroughMarketplace } = marketplaceBilling
 
   const {
     data: organizationBillingData,
@@ -521,6 +522,7 @@ export function Billing({ scope, organizationId, creditUsageHref }: BillingProps
         </div>
         {!subscription.isEnterprise &&
           !billedThroughMarketplace &&
+          !marketplaceBilling.isPending &&
           (canExplorePlans && upgradeHref ? (
             <ChipLink
               href={upgradeHref}
 
@@ -9,6 +9,7 @@ import {
   registerAwsMarketplaceLicenseToAccountContract,
   saveAwsMarketplaceClaimContactContract,
 } from '@/lib/api/contracts/aws-marketplace'
+import { useSession } from '@/lib/auth/client'
 
 const AWS_MARKETPLACE_CLAIM_STALE_TIME = 30 * 1000
 const AWS_MARKETPLACE_LICENSES_STALE_TIME = 60 * 1000
@@ -19,9 +20,9 @@ const awsMarketplaceKeys = {
   /** The claim rides in an httpOnly cookie; the viewer scopes which organizations it lists. */
   claim: (viewerId: string) => [...awsMarketplaceKeys.claims(), viewerId] as const,
   licenses: () => [...awsMarketplaceKeys.all, 'licenses'] as const,
-  /** An organization's licenses, or with null the viewer's own account's. */
-  licenseList: (organizationId: string | null) =>
-    [...awsMarketplaceKeys.licenses(), organizationId ?? ''] as const,
+  /** An organization's licenses, or one viewer's own account's: the session scopes that read. */
+  licenseList: (scope: { organizationId: string } | { viewerId: string }) =>
+    [...awsMarketplaceKeys.licenses(), scope] as const,
 }
 
 export function useAwsMarketplaceClaim(viewerId: string | null) {
@@ -68,25 +69,25 @@ export function useSaveAwsMarketplaceClaimContact() {
 }
 
 /**
- * Whether AWS Marketplace bills this organization or the viewer's own account: a pending or active
- * license on either. Pending until both reads settle.
+ * Whether AWS Marketplace bills this scope: the organization, or with null the viewer's account.
+ * A failed read reports false, so a lookup error never blocks a customer who pays through Stripe.
  */
 export function useAwsMarketplaceBilling(organizationId: string | null) {
-  const organizationLicenses = useAwsMarketplaceLicenses(organizationId)
-  const accountLicenses = useAwsMarketplaceLicenses(null)
+  const licenses = useAwsMarketplaceLicenses(organizationId)
   return {
-    isPending: organizationLicenses.isPending || accountLicenses.isPending,
-    billedThroughMarketplace: [
-      ...(organizationLicenses.data ?? []),
-      ...(accountLicenses.data ?? []),
-    ].some((license) => license.status !== 'inactive'),
+    isPending: licenses.isPending,
+    billedThroughMarketplace:
+      licenses.data?.some((license) => license.status !== 'inactive') ?? false,
   }
 }
 
 /** The Marketplace subscriptions an organization holds, or with null the viewer's own account. */
 export function useAwsMarketplaceLicenses(organizationId: string | null) {
+  const { data: session } = useSession()
+  const viewerId = session?.user?.id ?? ''
   return useQuery({
-    queryKey: awsMarketplaceKeys.licenseList(organizationId),
+    queryKey: awsMarketplaceKeys.licenseList(organizationId ? { organizationId } : { viewerId }),
+    enabled: Boolean(organizationId || viewerId),
     queryFn: ({ signal }) =>
       organizationId
         ? requestJson(listOrganizationAwsMarketplaceLicensesContract, {
 
@@ -60,6 +60,15 @@ describe('verifyLicense', () => {
     expect((await read(entitlement({ ExpirationDate: NOW }))).active).toBe(false)
   })
 
+  it('reads the same lapsed dimension whichever order AWS returns ties in', async () => {
+    const expired = new Date('2026-01-01T00:00:00.000Z')
+    const alpha = entitlement({ Dimension: 'alpha', ExpirationDate: expired })
+    const zeta = entitlement({ Dimension: 'zeta', ExpirationDate: expired })
+
+    expect((await read(alpha, zeta)).dimension).toBe('alpha')
+    expect((await read(zeta, alpha)).dimension).toBe('alpha')
+  })
+
   it('describes the current entitlement when another one has lapsed', async () => {
     const summary = await read(
       entitlement({
 
@@ -38,7 +38,9 @@ function summarizeEntitlements(
     .filter((entitlement) => isCurrent(entitlement, now))
     .sort((left, right) => compareStrings(left.Dimension ?? '', right.Dimension ?? ''))
   const lapsed = [...entitlements].sort(
-    (left, right) => (right.ExpirationDate?.getTime() ?? 0) - (left.ExpirationDate?.getTime() ?? 0)
+    (left, right) =>
+      (right.ExpirationDate?.getTime() ?? 0) - (left.ExpirationDate?.getTime() ?? 0) ||
+      compareStrings(left.Dimension ?? '', right.Dimension ?? '')
   )
   const chosen = current[0] ?? lapsed[0]
   return {
 
@@ -1065,6 +1065,62 @@ describe('reconcileAwsMarketplaceLicenses', () => {
     )
   })
 
+  it('does not tell the team to cancel when a retried notice arrives after the license recovered', async () => {
+    const organizationId = await createOrganization([{ userId: await createUser(), role: 'owner' }])
+    const license = await insertLicense({ organizationId })
+    const event = {
+      'detail-type': 'License Updated - Manufacturer',
+      detail: { license: { arn: license.licenseArn }, product: { code: PRODUCT } },
+    }
+    entitlementsByLicense.set(license.licenseArn, [lapsedEntitlement()])
+    deliverOnce([event])
+    await reconcileAwsMarketplaceLicenses()
+    entitlementsByLicense.set(license.licenseArn, [currentEntitlement()])
+    deliverOnce([event])
+    await reconcileAwsMarketplaceLicenses()
+
+    const notices = await emailsTo(TEAM)
+
+    expect(notices.length).toBeGreaterThan(1)
+    for (const notice of notices) expect(notice.text).not.toMatch(CANCEL_CALL)
+  })
+
+  it('does not ask the team to provision a license that lapsed before setup', async () => {
+    const licenseArn = uniqueArn()
+    entitlementsByLicense.set(licenseArn, [lapsedEntitlement()])
+    deliverOnce([
+      {
+        'detail-type': 'License Updated - Manufacturer',
+        detail: {
+          license: { arn: licenseArn },
+          product: { code: PRODUCT },
+          acceptor: { accountId: ACCOUNT },
+        },
+      },
+    ])
+
+    await reconcileAwsMarketplaceLicenses()
+
+    const [notice] = await emailsTo(TEAM)
+    expect(notice.text).toMatch(/Do not provision this license/)
+    expect(notice.text).not.toMatch(/pausePaymentCollection/)
+  })
+
+  it('re-verifies only the configured product', async () => {
+    const longAgo = new Date(Date.now() - 3 * DAY_MS)
+    const other = await insertLicense({
+      productCode: 'another-product',
+      lastVerifiedAt: longAgo,
+      lastVerificationAttemptAt: longAgo,
+    })
+    entitlementsByLicense.set(other.licenseArn, [lapsedEntitlement()])
+    queueSend.mockResolvedValue({ Messages: [] })
+
+    await reconcileAwsMarketplaceLicenses()
+
+    expect((await readLicense(other.licenseArn))?.lastVerificationAttemptAt).toEqual(longAgo)
+  })
+
   it('sends the team nothing when a re-verify finds the same terms', async () => {
     const expiresAt = new Date(Date.now() + 30 * DAY_MS)
     const { licenseArn } = await insertLicense({