diff --git a/src/Admin/AdminPostAction.php b/src/Admin/AdminPostAction.php
index 6d3358e..ae4fe1b 100644
--- a/src/Admin/AdminPostAction.php
+++ b/src/Admin/AdminPostAction.php
@@ -32,10 +32,14 @@ final class AdminPostAction
         }
     }
 
-    /** Redirects to settings tab $slug with "lit_mcp_notice" = $notice and ends the request. */
-    public function redirect(string $slug, string $notice): void
+    /**
+     * Redirects to settings tab $slug with "lit_mcp_notice" = $notice (and further query $args) and ends the request.
+     *
+     * @param array<string, string> $args
+     */
+    public function redirect(string $slug, string $notice, array $args = []): void
     {
-        wp_safe_redirect(SettingsPage::url($slug, ['lit_mcp_notice' => $notice]));
+        wp_safe_redirect(SettingsPage::url($slug, ['lit_mcp_notice' => $notice] + $args));
         ($this->terminate)();
     }
 }
diff --git a/src/Admin/CheckRoute.php b/src/Admin/CheckRoute.php
new file mode 100644
index 0000000..efc6e60
--- /dev/null
+++ b/src/Admin/CheckRoute.php
@@ -0,0 +1,184 @@
+<?php
+
+declare(strict_types=1);
+
+namespace LIT\MCP\Admin;
+
+use Closure;
+use LIT\MCP\Compatibility\CheckReport;
+use LIT\MCP\Compatibility\CheckReportStore;
+use LIT\MCP\Compatibility\Compatibility;
+use LIT\MCP\Compatibility\Profile;
+use LIT\MCP\Log;
+use Throwable;
+use WP_REST_Response;
+
+defined('ABSPATH') || exit;
+
+/**
+ * "Prüfung starten" of the tab "Compatibility" (spec §6.1): POST /wp-json/lit-mcp/v1/<profile>-check, one route per
+ * profile. A REST request on purpose – not admin-post – so the check runs in the same context as MCP calls (Divi
+ * renders its blocks in REST requests, lit-page-render-summary). The form sends the wp_rest nonce as _wpnonce
+ * (cookie authentication); only manage_options. The profile comes from the route, which exists only for the
+ * profiles of Compatibility; handle() looks the ID up again, so an ID never reaches an option name unchecked.
+ * One check per profile at a time: an atomic "INSERT IGNORE" on the options table (lit_mcp_<id>_check_lock) is the
+ * lock – add_option() reads then writes (wp-includes/option.php) and is not atomic, so two simultaneous requests
+ * could both "acquire" it. The value is "<time>:<token>". A lock older than LOCK_TTL is a dead
+ * check's, taken over with a conditional UPDATE (compare-and-swap on the value just read) so only one of several
+ * concurrent takers wins; the end of a check deletes the row only while it still holds its own token, so a check
+ * that outlived its lock does not free the taker's. A check that throws still releases the lock (finally) and
+ * redirects with compat_check_failed (logged, not an unhandled 500).
+ * Always answers 303 back to the tab "Compatibility" – every check, whatever the profile, lands there – and
+ * announces a stored report with the action lit_mcp_compat_changed($id); a listener that throws is logged and does
+ * not change the answer.
+ */
+final class CheckRoute
+{
+    public const NAMESPACE = 'lit-mcp/v1';
+    public const CHANGED_ACTION = 'lit_mcp_compat_changed';
+
+    private const LOCK_TTL = 600;
+
+    /** @var Closure(Profile, int): CheckReport */
+    private Closure $check;
+    /** @var Closure(Profile): CheckReportStore */
+    private Closure $reports;
+
+    /**
+     * @param (Closure(Profile, int): CheckReport)|null $check   Default: Compatibility::check().
+     * @param (Closure(Profile): CheckReportStore)|null $reports Default: CheckReportStore::forProfile().
+     */
+    public function __construct(private Compatibility $compatibility, ?Closure $check = null, ?Closure $reports = null)
+    {
+        $this->check = $check ?? $compatibility->check(...);
+        $this->reports = $reports ?? CheckReportStore::forProfile(...);
+    }
+
+    public function register(): void
+    {
+        add_action('rest_api_init', [$this, 'registerRoutes']);
+    }
+
+    public function registerRoutes(): void
+    {
+        foreach ($this->compatibility->profiles() as $profile) {
+            register_rest_route(self::NAMESPACE, self::route($profile->id), [
+                'methods' => 'POST',
+                'callback' => fn (): WP_REST_Response => $this->handle($profile->id),
+                'permission_callback' => static fn (): bool => current_user_can('manage_options'),
+            ]);
+        }
+    }
+
+    /** The URL of the profile's route; the caller passes an ID of a known profile. */
+    public static function url(string $profileId): string
+    {
+        return rest_url(self::NAMESPACE . self::route($profileId));
+    }
+
+    public function handle(string $profileId): WP_REST_Response
+    {
+        $profile = $this->compatibility->profile($profileId);
+        if ($profile === null) {
+            return new WP_REST_Response(null, 404);
+        }
+
+        $notice = 'compat_check_running';
+        $token = self::lock($profile->id);
+        if ($token !== null) {
+            try {
+                ($this->reports)($profile)->save(($this->check)($profile, get_current_user_id()));
+                $notice = 'compat_checked';
+            } catch (Throwable $e) {
+                Log::failure($profile->id . ' check', $e);
+                $notice = 'compat_check_failed';
+            } finally {
+                self::release($profile->id, $token);
+            }
+            if ($notice === 'compat_checked') {
+                // The report is stored: a listener that throws is logged, it does not turn the success into a 500.
+                try {
+                    do_action(self::CHANGED_ACTION, $profile->id);
+                } catch (Throwable $e) {
+                    Log::failure($profile->id . ' ' . self::CHANGED_ACTION, $e);
+                }
+            }
+        }
+
+        return new WP_REST_Response(
+            null,
+            303,
+            ['Location' => SettingsPage::url(
+                CompatibilityTab::SLUG,
+                ['lit_mcp_notice' => $notice, 'lit_mcp_profile' => $profile->id]
+            )]
+        );
+    }
+
+    private static function route(string $profileId): string
+    {
+        return '/' . $profileId . '-check';
+    }
+
+    private static function lockOption(string $profileId): string
+    {
+        return 'lit_mcp_' . $profileId . '_check_lock';
+    }
+
+    /** @return string|null The lock value "<time>:<token>" now held by this request (its owner token), null = busy. */
+    private static function lock(string $profileId): ?string
+    {
+        global $wpdb;
+
+        $value = time() . ':' . bin2hex(random_bytes(4));
+        if (self::insertLock($wpdb, $profileId, $value)) {
+            return $value;
+        }
+
+        // get_var(), not get_option(): the row was written with raw SQL, bypassing the options cache.
+        $since = $wpdb->get_var($wpdb->prepare(
+            "SELECT option_value FROM {$wpdb->options} WHERE option_name = %s",
+            self::lockOption($profileId)
+        ));
+        if ($since === null) {
+            // The lock was released between our failed insert and this read; try once more.
+            return self::insertLock($wpdb, $profileId, $value) ? $value : null;
+        }
+        if (time() - (int) $since < self::LOCK_TTL) {
+            return null;
+        }
+
+        $taken = $wpdb->query($wpdb->prepare(
+            "UPDATE {$wpdb->options} SET option_value = %s WHERE option_name = %s AND option_value = %s",
+            $value,
+            self::lockOption($profileId),
+            $since
+        ));
+
+        return (int) $taken === 1 ? $value : null;
+    }
+
+    /** Compare-and-delete: a check that outlived its lock (taken over meanwhile) must not free the taker's. */
+    private static function release(string $profileId, string $token): void
+    {
+        global $wpdb;
+
+        $wpdb->query($wpdb->prepare(
+            "DELETE FROM {$wpdb->options} WHERE option_name = %s AND option_value = %s",
+            self::lockOption($profileId),
+            $token
+        ));
+    }
+
+    /** INSERT IGNORE: 1 row affected = the lock did not exist and is now ours; 0 = someone else holds it. */
+    private static function insertLock(\wpdb $wpdb, string $profileId, string $value): bool
+    {
+        $inserted = $wpdb->query($wpdb->prepare(
+            "INSERT IGNORE INTO {$wpdb->options} (option_name, option_value, autoload) VALUES (%s, %s, 'no')",
+            self::lockOption($profileId),
+            $value
+        ));
+
+        return (int) $inserted === 1;
+    }
+}
diff --git a/src/Admin/CompatibilityTab.php b/src/Admin/CompatibilityTab.php
new file mode 100644
index 0000000..f6ea644
--- /dev/null
+++ b/src/Admin/CompatibilityTab.php
@@ -0,0 +1,474 @@
+<?php
+
+declare(strict_types=1);
+
+namespace LIT\MCP\Admin;
+
+use Closure;
+use LIT\MCP\ChangeLog\ChangeLog;
+use LIT\MCP\Compatibility\CheckReport;
+use LIT\MCP\Compatibility\CheckReportStore;
+use LIT\MCP\Compatibility\Compatibility;
+use LIT\MCP\Compatibility\CompatibilityMatrix;
+use LIT\MCP\Compatibility\Profile;
+use LIT\MCP\Compatibility\ReleaseState;
+use LIT\MCP\Compatibility\ReleaseStore;
+use LIT\MCP\Compatibility\Tier;
+use LIT\MCP\Plugin;
+
+defined('ABSPATH') || exit;
+
+/**
+ * Tab "Compatibility": one section per third-party plugin of Compatibility::profiles() – its version, overall state
+ * (word and icon, never colour alone), what the tier means for a release, the capabilities, tested and released
+ * versions, the latest check report and "Prüfung starten" (Admin\CheckRoute). A profile that is not active is one
+ * line and never asks for its matrix. Everything that comes from a third-party plugin (version, problem texts, step
+ * labels) is escaped on output. The action lit_mcp_compat_profile_extra($id) closes a section: profiles add their
+ * own notes there; the action lit_mcp_compat_profile_load($id) (see loadProfiles()) runs before any output.
+ */
+final class CompatibilityTab implements AdminTab
+{
+    public const SLUG = 'compatibility';
+    public const EXTRA_ACTION = 'lit_mcp_compat_profile_extra';
+    public const LOAD_ACTION = 'lit_mcp_compat_profile_load';
+    /** admin-post actions; the nonce action of a request is the action plus "_<profile ID>". */
+    public const RELEASE_ACTION = 'lit_mcp_compat_release';
+    public const WITHDRAW_ACTION = 'lit_mcp_compat_withdraw';
+
+    /** @var Closure(Profile): CheckReportStore */
+    private Closure $reports;
+    /** @var Closure(Profile): ReleaseStore */
+    private Closure $releases;
+
+    /**
+     * @param (Closure(Profile): CheckReportStore)|null $reports  Default: CheckReportStore::forProfile().
+     * @param (Closure(Profile): ReleaseStore)|null     $releases Default: ReleaseStore::forProfile().
+     */
+    public function __construct(
+        private Compatibility $compatibility,
+        private ?ChangeLog $log = null,
+        private ?AdminPostAction $action = null,
+        ?Closure $reports = null,
+        ?Closure $releases = null
+    ) {
+        $this->reports = $reports ?? CheckReportStore::forProfile(...);
+        $this->releases = $releases ?? ReleaseStore::forProfile(...);
+    }
+
+    public function slug(): string
+    {
+        return self::SLUG;
+    }
+
+    public function label(): string
+    {
+        return __('Compatibility', 'wp-lit-mcp');
+    }
+
+    public function registerSettings(): void
+    {
+    }
+
+    public function registerActions(): void
+    {
+        add_action('admin_post_' . self::RELEASE_ACTION, [$this, 'release']);
+        add_action('admin_post_' . self::WITHDRAW_ACTION, [$this, 'withdraw']);
+        add_action('load-' . SettingsPage::SCREEN_HOOK, [$this, 'loadProfiles']);
+    }
+
+    /**
+     * load-<page> of the settings page, before any output: on this tab and for manage_options announces each profile
+     * with lit_mcp_compat_profile_load($id), so a profile can do its housekeeping (and prepare a notice for
+     * its extra section) before render(). Nothing else is needed from the AdminTab contract: a tab hooks load-<page>
+     * itself in registerActions(), which SettingsPage already calls for every tab.
+     */
+    public function loadProfiles(): void
+    {
+        // phpcs:ignore WordPress.Security.NonceVerification.Recommended -- read-only tab switch.
+        $tab = is_string($_GET['tab'] ?? null) ? sanitize_key(wp_unslash($_GET['tab'])) : '';
+        if ($tab !== self::SLUG || ! current_user_can('manage_options')) {
+            return;
+        }
+
+        foreach ($this->compatibility->profiles() as $profile) {
+            do_action(self::LOAD_ACTION, $profile->id);
+        }
+    }
+
+    /**
+     * Releases the installed version of the posted profile: only as offered by the tab (see releasable()) and only
+     * after a fresh green report. The profile ID is looked up in Compatibility first (nothing else reaches option
+     * names, ability names or the redirect); the nonce belongs to that profile.
+     */
+    public function release(): void
+    {
+        $action = $this->action ?? new AdminPostAction();
+        $action->guard();
+        $profile = $this->postedProfile();
+        check_admin_referer(self::RELEASE_ACTION . '_' . $profile->id);
+
+        $version = $this->compatibility->version($profile) ?? '';
+        $report = ($this->reports)($profile)->latest();
+        if (
+            $report === null
+            || ! $this->releasable($profile, $version)
+            || ! $report->freshFor($version, Plugin::VERSION, $this->stateKey($profile, $version))
+        ) {
+            $action->redirect(self::SLUG, 'compat_release_refused', ['lit_mcp_profile' => $profile->id]);
+
+            return;
+        }
+
+        ($this->releases)($profile)->add($version, Plugin::VERSION, get_current_user_id(), $report->id);
+        $this->log?->record(
+            'lit/' . $profile->id . '-release',
+            $profile->id,
+            $version,
+            sprintf(
+                '%s %s für LIT MCP %s freigegeben (Prüfbericht %s).',
+                $profile->label,
+                $version,
+                Plugin::VERSION,
+                $report->id
+            )
+        );
+        do_action(CheckRoute::CHANGED_ACTION, $profile->id);
+        $action->redirect(self::SLUG, 'compat_released', ['lit_mcp_profile' => $profile->id]);
+    }
+
+    public function withdraw(): void
+    {
+        $action = $this->action ?? new AdminPostAction();
+        $action->guard();
+        $profile = $this->postedProfile();
+        check_admin_referer(self::WITHDRAW_ACTION . '_' . $profile->id);
+
+        $version = $this->compatibility->version($profile) ?? '';
+        if (! ($this->releases)($profile)->withdraw($version, Plugin::VERSION)) {
+            $action->redirect(self::SLUG, 'compat_withdraw_failed', ['lit_mcp_profile' => $profile->id]);
+
+            return;
+        }
+
+        $this->log?->record(
+            'lit/' . $profile->id . '-release',
+            $profile->id,
+            $version,
+            sprintf('Freigabe von %s %s zurückgezogen.', $profile->label, $version)
+        );
+        do_action(CheckRoute::CHANGED_ACTION, $profile->id);
+        $action->redirect(self::SLUG, 'compat_withdrawn', ['lit_mcp_profile' => $profile->id]);
+    }
+
+    /** The profile named by the POST field "profile"; anything Compatibility does not know ends the request (400). */
+    private function postedProfile(): Profile
+    {
+        // phpcs:ignore WordPress.Security.NonceVerification.Missing -- only a lookup key; the nonce is checked with it.
+        $id = is_string($_POST['profile'] ?? null) ? sanitize_key(wp_unslash($_POST['profile'])) : '';
+        $profile = $this->compatibility->profile($id);
+        if ($profile === null) {
+            wp_die(esc_html__('Unbekanntes Profil.', 'wp-lit-mcp'), '', ['response' => 400]);
+        }
+
+        return $profile;
+    }
+
+    /**
+     * What the tab offers: an active, versioned profile that releases at all (not ReportOnly), whose version the
+     * plugin does not list as tested, that has no release yet and – ReleasePerVersion – is still untested.
+     */
+    private function releasable(Profile $profile, string $version): bool
+    {
+        return $version !== ''
+            && $profile->tier !== Tier::ReportOnly
+            && $this->compatibility->active($profile)
+            && ! in_array($version, $profile->testedVersions, true)
+            && ($this->releases)($profile)->find($version, Plugin::VERSION) === null
+            && ($profile->tier !== Tier::ReleasePerVersion
+                || $this->compatibility->matrix($profile)->state() === ReleaseState::Untested);
+    }
+
+    private function stateKey(Profile $profile, string $version): string
+    {
+        return $profile->stateKey === null ? '' : ($profile->stateKey)($version);
+    }
+
+    public function render(): void
+    {
+        foreach ($this->compatibility->profiles() as $profile) {
+            $this->renderProfile($profile);
+        }
+    }
+
+    private function renderProfile(Profile $profile): void
+    {
+        printf('<section class="lit-mcp-compat" id="lit-mcp-compat-%s">', esc_attr($profile->id));
+        printf('<h2>%s</h2>', esc_html($profile->label));
+        if (! $this->compatibility->active($profile)) {
+            echo '<p>' . esc_html__('nicht installiert oder nicht aktiv', 'wp-lit-mcp') . '</p></section>';
+
+            return;
+        }
+
+        $matrix = $this->compatibility->matrix($profile);
+        $problems = $this->compatibility->problems($profile);
+        $state = $matrix->state();
+
+        echo '<table class="form-table" role="presentation"><tbody>';
+        printf(
+            '<tr><th scope="row">%s</th><td>%s</td></tr>',
+            esc_html__('Version', 'wp-lit-mcp'),
+            esc_html($this->compatibility->version($profile) ?? __('nicht erkannt', 'wp-lit-mcp'))
+        );
+        printf(
+            '<tr><th scope="row">%s</th><td>%s – %s</td></tr>',
+            esc_html__('Gesamtzustand', 'wp-lit-mcp'),
+            // phpcs:ignore WordPress.Security.EscapeOutput.OutputNotEscaped -- escaped in stateBadge().
+            self::stateBadge($state),
+            esc_html(self::explanation($state))
+        );
+        if ($problems !== []) {
+            echo '<tr><th scope="row">' . esc_html__('Probleme', 'wp-lit-mcp') . '</th><td>';
+            self::renderList($problems);
+            echo '</td></tr>';
+        }
+        printf(
+            '<tr><th scope="row">%s</th><td>%s</td></tr>',
+            esc_html__('Freigabe', 'wp-lit-mcp'),
+            esc_html(self::tierHint($profile->tier))
+        );
+        printf(
+            '<tr><th scope="row">%s</th><td>%s</td></tr>',
+            esc_html__('Getestete Versionen', 'wp-lit-mcp'),
+            $profile->testedVersions === [] ? '–' : esc_html(implode(', ', $profile->testedVersions))
+        );
+        printf(
+            '<tr><th scope="row">%s</th><td>%s</td></tr>',
+            esc_html__('Freigegebene Versionen', 'wp-lit-mcp'),
+            esc_html($this->releasedVersions($profile)) ?: '–'
+        );
+        echo '</tbody></table>';
+
+        $this->renderCapabilities($profile, $matrix);
+        $report = ($this->reports)($profile)->latest();
+        $this->renderForms($profile, $report);
+        if ($report !== null) {
+            $this->renderReport($profile, $report);
+        }
+        do_action(self::EXTRA_ACTION, $profile->id);
+        echo '</section>';
+    }
+
+    private function renderCapabilities(Profile $profile, CompatibilityMatrix $matrix): void
+    {
+        $headings = [__('Fähigkeit', 'wp-lit-mcp'), __('Zustand', 'wp-lit-mcp')];
+        echo '<table class="widefat striped lit-mcp-divi-features"><caption class="screen-reader-text">'
+            . esc_html(sprintf(
+                /* translators: %s: plugin name */
+                __('Fähigkeiten von %s', 'wp-lit-mcp'),
+                $profile->label
+            ))
+            . '</caption><thead><tr>';
+        foreach ($headings as $heading) {
+            echo '<th scope="col">' . esc_html($heading) . '</th>';
+        }
+        echo '</tr></thead><tbody>';
+        foreach ($profile->capabilities as $capability) {
+            // data-label: on phones each row becomes a card and the cell names itself.
+            printf(
+                '<tr><td data-label="%s">%s</td><td data-label="%s">%s</td></tr>',
+                esc_attr($headings[0]),
+                esc_html($capability->label()),
+                esc_attr($headings[1]),
+                // phpcs:ignore WordPress.Security.EscapeOutput.OutputNotEscaped -- escaped in stateBadge().
+                self::stateBadge($matrix->of($capability)->state)
+            );
+        }
+        echo '</tbody></table>';
+    }
+
+    private function renderForms(Profile $profile, ?CheckReport $report): void
+    {
+        $version = $this->compatibility->version($profile) ?? '';
+        $fresh = $report !== null && $report->freshFor($version, Plugin::VERSION, $this->stateKey($profile, $version));
+        $releasable = $this->releasable($profile, $version);
+
+        printf('<form method="post" action="%s">', esc_url(CheckRoute::url($profile->id)));
+        printf('<input type="hidden" name="_wpnonce" value="%s">', esc_attr(wp_create_nonce('wp_rest')));
+        // The check is the one thing to do while a release is due without a usable report.
+        submit_button(
+            __('Prüfung starten', 'wp-lit-mcp'),
+            $releasable && ! $fresh ? 'primary' : 'secondary',
+            'lit-mcp-compat-check-' . $profile->id,
+            false,
+            ['aria-label' => self::namedFor($profile, __('Prüfung starten', 'wp-lit-mcp'))]
+        );
+        echo '<p class="description">' . esc_html__('Die Prüfung dauert einige Sekunden.', 'wp-lit-mcp') . '</p>';
+        echo '</form>';
+
+        if ($releasable && $fresh) {
+            $this->actionForm(
+                $profile,
+                self::RELEASE_ACTION,
+                'release',
+                /* translators: 1: plugin name, 2: version */
+                sprintf(__('%1$s %2$s freigeben', 'wp-lit-mcp'), $profile->label, $version),
+                'primary'
+            );
+        } elseif ($releasable) {
+            echo '<p>' . esc_html__(
+                'Freigeben geht erst nach einer vollständig grünen Prüfung dieser Version – Prüfung erneut ausführen.',
+                'wp-lit-mcp'
+            ) . '</p>';
+        }
+
+        // A release applies whatever the overall state: one incompatible capability must not hide the way back.
+        if ($version !== '' && ($this->releases)($profile)->find($version, Plugin::VERSION) !== null) {
+            $this->actionForm(
+                $profile,
+                self::WITHDRAW_ACTION,
+                'withdraw',
+                __('Freigabe zurückziehen', 'wp-lit-mcp'),
+                'secondary',
+                true
+            );
+        }
+    }
+
+    /** "<visible text>: <profile>" – the accessible name starts with the visible text (WCAG 2.5.3). */
+    private static function namedFor(Profile $profile, string $label): string
+    {
+        return $label . ': ' . $profile->label;
+    }
+
+    /**
+     * @param string $kind     Short name of the action; with the profile ID it makes the button's name/id unique
+     *                         on a page that shows several profiles.
+     * @param bool   $nameIt   The label does not name the profile: add it to the accessible name.
+     */
+    private function actionForm(
+        Profile $profile,
+        string $action,
+        string $kind,
+        string $label,
+        string $type,
+        bool $nameIt = false
+    ): void {
+        printf('<form method="post" action="%s">', esc_url(admin_url('admin-post.php')));
+        printf('<input type="hidden" name="action" value="%s">', esc_attr($action));
+        printf('<input type="hidden" name="profile" value="%s">', esc_attr($profile->id));
+        wp_nonce_field($action . '_' . $profile->id);
+        submit_button(
+            $label,
+            $type,
+            'lit-mcp-compat-' . $kind . '-' . $profile->id,
+            false,
+            $nameIt ? ['aria-label' => self::namedFor($profile, $label)] : []
+        );
+        echo '</form>';
+    }
+
+    private function renderReport(Profile $profile, CheckReport $report): void
+    {
+        printf(
+            '<h3>%s</h3><p>%s</p><ul class="lit-mcp-divi-report">',
+            esc_html__('Letzte Prüfung', 'wp-lit-mcp'),
+            esc_html(sprintf(
+                /* translators: 1: plugin version, 2: LIT MCP version, 3: date */
+                __('Version %1$s mit LIT MCP %2$s, %3$s', 'wp-lit-mcp'),
+                $report->version,
+                $report->pluginVersion,
+                date_i18n((string) get_option('date_format'), (int) strtotime($report->createdAt))
+            ))
+        );
+        foreach ($report->steps as $step) {
+            [$icon, $word] = match (true) {
+                $step->skipped => ['minus', __('übersprungen', 'wp-lit-mcp')],
+                $step->green() => ['yes-alt', __('bestanden', 'wp-lit-mcp')],
+                default => ['dismiss', __('fehlgeschlagen', 'wp-lit-mcp')],
+            };
+            printf(
+                '<li class="lit-mcp-state lit-mcp-status-%1$s"><span class="dashicons dashicons-%1$s"'
+                    . ' aria-hidden="true"></span> <strong>%2$s</strong>: %3$s',
+                esc_attr($icon),
+                esc_html($word),
+                esc_html($profile->stepLabel === null ? $step->label() : ($profile->stepLabel)($step))
+            );
+            if ($step->skipped) {
+                echo ' (' . esc_html__('nicht ausgeführt', 'wp-lit-mcp') . ')';
+            }
+            if ($step->problems !== []) {
+                self::renderList($step->problems);
+            }
+            echo '</li>';
+        }
+        echo '</ul>';
+    }
+
+    /** @param list<string> $items */
+    private static function renderList(array $items): void
+    {
+        echo '<ul>';
+        foreach ($items as $item) {
+            echo '<li>' . esc_html($item) . '</li>';
+        }
+        echo '</ul>';
+    }
+
+    private function releasedVersions(Profile $profile): string
+    {
+        return implode(', ', array_map(
+            static fn (array $entry): string => sprintf(
+                /* translators: 1: plugin version, 2: LIT MCP version */
+                __('%1$s (LIT MCP %2$s)', 'wp-lit-mcp'),
+                $entry[$profile->reportVersionKey],
+                $entry['plugin_version']
+            ),
+            ($this->releases)($profile)->entries()
+        ));
+    }
+
+    /** Same coloured icons as the status list on the tab "Verbindung"; the word stays, colour is never alone. */
+    private static function stateBadge(ReleaseState $state): string
+    {
+        [$icon, $word] = match ($state) {
+            ReleaseState::Released => ['yes-alt', __('freigegeben', 'wp-lit-mcp')],
+            ReleaseState::Untested => ['warning', __('ungetestet', 'wp-lit-mcp')],
+            ReleaseState::Incompatible => ['dismiss', __('inkompatibel', 'wp-lit-mcp')],
+        };
+
+        return sprintf(
+            '<span class="lit-mcp-state lit-mcp-status-%1$s"><span class="dashicons dashicons-%1$s"'
+                . ' aria-hidden="true"></span> <strong>%2$s</strong></span>',
+            $icon,
+            esc_html($word)
+        );
+    }
+
+    private static function explanation(ReleaseState $state): string
+    {
+        return match ($state) {
+            ReleaseState::Released => __('Alle Fähigkeiten sind nutzbar.', 'wp-lit-mcp'),
+            ReleaseState::Untested => __(
+                'Diese Version ist nicht geprüft. Die ungetesteten Fähigkeiten sind gesperrt, bis sie freigegeben ist.',
+                'wp-lit-mcp'
+            ),
+            ReleaseState::Incompatible => __(
+                'Die betroffenen Fähigkeiten bleiben gesperrt, bis die Ursache behoben ist; die anderen laufen weiter.',
+                'wp-lit-mcp'
+            ),
+        };
+    }
+
+    private static function tierHint(Tier $tier): string
+    {
+        return match ($tier) {
+            Tier::ReleasePerVersion => __('Freigabe pro Version nötig', 'wp-lit-mcp'),
+            Tier::LockOnFailure => __(
+                'Freigabe wird dokumentiert, Nutzung automatisch, solange die Prüfung grün ist',
+                'wp-lit-mcp'
+            ),
+            Tier::ReportOnly => __('nur Anzeige', 'wp-lit-mcp'),
+        };
+    }
+}
diff --git a/src/Admin/SettingsPage.php b/src/Admin/SettingsPage.php
index e5d8e64..ef63b7d 100644
--- a/src/Admin/SettingsPage.php
+++ b/src/Admin/SettingsPage.php
@@ -4,6 +4,8 @@ declare(strict_types=1);
 
 namespace LIT\MCP\Admin;
 
+use Closure;
+
 defined('ABSPATH') || exit;
 
 /**
@@ -30,12 +32,15 @@ final class SettingsPage
      * @param string         $logoUrl   Loosen-IT logo shown top right of the page ('' = none).
      * @param string         $assetsUrl URL of the plugin's assets/ directory ('' = no own CSS/JS).
      * @param string         $version   Asset version for cache busting.
+     * @param (Closure(string): ?string)|null $profileLabel Label of a compatibility profile by ID, null = unknown;
+     *                                                  names the profile in the compat_* notices.
      */
     public function __construct(
         private array $baseTabs,
         private string $logoUrl = '',
         private string $assetsUrl = '',
-        private string $version = ''
+        private string $version = '',
+        private ?Closure $profileLabel = null
     ) {
     }
 
@@ -74,6 +79,7 @@ final class SettingsPage
     public function removableQueryArgs(array $args): array
     {
         $args[] = 'lit_mcp_notice';
+        $args[] = 'lit_mcp_profile';
 
         return $args;
     }
@@ -107,6 +113,10 @@ final class SettingsPage
                 'Tab „Protokoll“: jede Änderung des Assistenten mit Benutzer, Ergebnis und Zeitpunkt.',
                 'wp-lit-mcp'
             ),
+            __('Passt es zu Divi, Pods & Co.?', 'wp-lit-mcp') => __(
+                'Tab „Compatibility“: Fremd-Plugins prüfen, Versionen freigeben und sehen, was gesperrt ist.',
+                'wp-lit-mcp'
+            ),
         ];
         $content = '';
         foreach ($items as $title => $text) {
@@ -163,7 +173,7 @@ final class SettingsPage
     public function currentTab(): string
     {
         // phpcs:ignore WordPress.Security.NonceVerification.Recommended -- read-only tab switch.
-        $requested = isset($_GET['tab']) ? sanitize_key(wp_unslash((string) $_GET['tab'])) : '';
+        $requested = is_string($_GET['tab'] ?? null) ? sanitize_key(wp_unslash($_GET['tab'])) : '';
 
         $tabs = $this->tabs();
 
@@ -236,23 +246,26 @@ final class SettingsPage
         );
     }
 
+    /** "<Label>: " for a compat_* notice naming a known profile; the ID from the address bar only looks the label up. */
+    private function noticeProfile(string $key): string
+    {
+        // phpcs:ignore WordPress.Security.NonceVerification.Recommended -- display only.
+        $id = is_string($_GET['lit_mcp_profile'] ?? null) ? sanitize_key(wp_unslash($_GET['lit_mcp_profile'])) : '';
+        $label = str_starts_with($key, 'compat_') && $id !== '' && $this->profileLabel !== null
+            ? ($this->profileLabel)($id)
+            : null;
+
+        return $label === null ? '' : $label . ': ';
+    }
+
     private function renderNotice(): void
     {
         // phpcs:ignore WordPress.Security.NonceVerification.Recommended -- display only.
-        $key = isset($_GET['lit_mcp_notice']) ? sanitize_key(wp_unslash((string) $_GET['lit_mcp_notice'])) : '';
+        $key = is_string($_GET['lit_mcp_notice'] ?? null) ? sanitize_key(wp_unslash($_GET['lit_mcp_notice'])) : '';
         $notice = match ($key) {
             'revoked' => ['success', __('Verbindung widerrufen.', 'wp-lit-mcp')],
             'revoke_failed' => ['error', __('Die Verbindung konnte nicht widerrufen werden.', 'wp-lit-mcp')],
             'cleared' => ['success', __('Protokoll geleert.', 'wp-lit-mcp')],
-            'divi_checked' => ['success', __('Divi-Prüfung abgeschlossen; das Ergebnis steht unten.', 'wp-lit-mcp')],
-            'divi_check_running' => [
-                'warning',
-                __('Es läuft bereits eine Divi-Prüfung; bitte in ein paar Minuten erneut versuchen.', 'wp-lit-mcp'),
-            ],
-            'divi_check_failed' => [
-                'error',
-                __('Die Divi-Prüfung ist abgebrochen; Details stehen im PHP-Error-Log.', 'wp-lit-mcp'),
-            ],
             'divi_released' => ['success', __('Die Divi-Version ist für LIT MCP freigegeben.', 'wp-lit-mcp')],
             'divi_release_refused' => [
                 'error',
@@ -270,6 +283,29 @@ final class SettingsPage
                 'error',
                 __('Für die installierte Divi-Version gibt es auf dieser Website keine Freigabe.', 'wp-lit-mcp'),
             ],
+            'compat_checked' => ['success', __('Prüfung abgeschlossen; das Ergebnis steht unten.', 'wp-lit-mcp')],
+            'compat_check_running' => [
+                'warning',
+                __('Es läuft bereits eine Prüfung; bitte in ein paar Minuten erneut versuchen.', 'wp-lit-mcp'),
+            ],
+            'compat_check_failed' => [
+                'error',
+                __('Die Prüfung ist abgebrochen; Details stehen im PHP-Error-Log.', 'wp-lit-mcp'),
+            ],
+            'compat_released' => ['success', __('Die Version ist für LIT MCP freigegeben.', 'wp-lit-mcp')],
+            'compat_release_refused' => [
+                'error',
+                __(
+                    // phpcs:ignore Generic.Files.LineLength.TooLong -- WordPress.WP.I18n forbids splitting the text argument.
+                    'Freigabe nicht möglich: Der letzte Prüfbericht ist nicht grün oder passt nicht mehr zur installierten Version oder zur Plugin-Version. Bitte die Prüfung erneut ausführen.',
+                    'wp-lit-mcp'
+                ),
+            ],
+            'compat_withdrawn' => ['success', __('Freigabe zurückgezogen.', 'wp-lit-mcp')],
+            'compat_withdraw_failed' => [
+                'error',
+                __('Für die installierte Version gibt es auf dieser Website keine Freigabe.', 'wp-lit-mcp'),
+            ],
             default => null,
         };
 
@@ -277,7 +313,7 @@ final class SettingsPage
             printf(
                 '<div class="notice notice-%s is-dismissible"><p>%s</p></div>',
                 esc_attr($notice[0]),
-                esc_html($notice[1])
+                esc_html($this->noticeProfile($key) . $notice[1])
             );
         }
     }
diff --git a/src/Compatibility/Profile.php b/src/Compatibility/Profile.php
index 7a7e14c..7c9834f 100644
--- a/src/Compatibility/Profile.php
+++ b/src/Compatibility/Profile.php
@@ -29,6 +29,8 @@ final class Profile
      *                                                          whether the manifest step was clean.
      * @param (Closure(): ManifestCheck)|null       $manifestCheck The check of this profile; null = its manifests
      *                                                          without signature checks.
+     * @param (Closure(CheckStep): string)|null $stepLabel  Label of a stored step that has none (reports from
+     *                                                          before labels were stored); null = the step's own.
      * @param string                            $reportVersionKey Array key of the version in stored reports and
      *                                                          release rows (Divi: 'divi_version').
      * @throws LogicException For a ReleasePerVersion profile without matrix or a capability ID given twice.
@@ -47,6 +49,7 @@ final class Profile
         public readonly ?Closure $stateKey = null,
         public readonly ?Closure $extraSteps = null,
         public readonly ?Closure $manifestCheck = null,
+        public readonly ?Closure $stepLabel = null,
         public readonly string $reportVersionKey = 'version'
     ) {
         if ($tier === Tier::ReleasePerVersion && $matrix === null) {
diff --git a/src/Integrations/Divi/Admin/DiviTab.php b/src/Integrations/Divi/Admin/DiviTab.php
index bf5c33b..170e070 100644
--- a/src/Integrations/Divi/Admin/DiviTab.php
+++ b/src/Integrations/Divi/Admin/DiviTab.php
@@ -7,12 +7,12 @@ namespace LIT\MCP\Integrations\Divi\Admin;
 use Closure;
 use LIT\MCP\Admin\AdminPostAction;
 use LIT\MCP\Admin\AdminTab;
+use LIT\MCP\Admin\CheckRoute;
 use LIT\MCP\Admin\SettingsPage;
 use LIT\MCP\ChangeLog\ChangeLog;
 use LIT\MCP\Compatibility\ReleaseState;
 use LIT\MCP\Compatibility\CheckReport;
 use LIT\MCP\Compatibility\CheckReportStore;
-use LIT\MCP\Integrations\Divi\Release\DiviCheckRoute;
 use LIT\MCP\Integrations\Divi\Release\DiviCheckSteps;
 use LIT\MCP\Integrations\Divi\Release\DiviProfile;
 use LIT\MCP\Integrations\Divi\Release\DiviEnvironment;
@@ -29,7 +29,7 @@ defined('ABSPATH') || exit;
 
 /**
  * Tab "Divi" (spec §6): release status of the installed Divi, the table of its features (state, source, problems,
- * affected tools – E3), the latest check report, "Prüfung starten" (REST, DiviCheckRoute), "Divi <Version>
+ * affected tools – E3), the latest check report, "Prüfung starten" (REST, Admin\CheckRoute), "Divi <Version>
  * freigeben" (only after a fresh green report) and "Freigabe zurückziehen" (whenever a database release applies,
  * whatever the overall state). Loading the tab removes check pages a dead check left behind – in the page's load
  * hook (removeOrphans()), not while rendering. renderNotice() is the admin notice on every admin page while a
@@ -460,7 +460,7 @@ final class DiviTab implements AdminTab
             && $report->freshFor($status->version, Plugin::VERSION, $this->stateKey($status->version));
         $untested = $status->state === ReleaseState::Untested && $status->version !== '';
 
-        printf('<form method="post" action="%s">', esc_url(DiviCheckRoute::url()));
+        printf('<form method="post" action="%s">', esc_url(CheckRoute::url(DiviProfile::ID)));
         printf('<input type="hidden" name="_wpnonce" value="%s">', esc_attr(wp_create_nonce('wp_rest')));
         // The check is the one thing to do while untested without a usable report; otherwise the release leads.
         submit_button(
diff --git a/src/Integrations/Divi/Design/DesignLock.php b/src/Integrations/Divi/Design/DesignLock.php
index fdf5ceb..46bf2e9 100644
--- a/src/Integrations/Divi/Design/DesignLock.php
+++ b/src/Integrations/Divi/Design/DesignLock.php
@@ -12,7 +12,7 @@ defined('ABSPATH') || exit;
  * One confirmed change per lock at a time (final review I-5). Colors and theme options share ONE lock (audit L5):
  * both rewrite the whole et_divi array through et_update_option(). The lock is a row lit_mcp_lock_<name> (never
  * autoloaded) in the options table holding "<time>:<token>" – taken with an atomic INSERT IGNORE like
- * DiviCheckRoute (add_option() reads first and writes after, so two requests could both win; audit L6). A lock
+ * Admin\CheckRoute (add_option() reads first and writes after, so two requests could both win; audit L6). A lock
  * older than STALE_AFTER seconds (a request that died) is taken over with a conditional UPDATE on the value just
  * read, so only one taker wins; release() deletes the row only while it still holds this instance's token, so a
  * holder that lost a stale lock cannot free the new holder's. A taken lock drops the options cache, so the
diff --git a/src/Integrations/Divi/DiviIntegration.php b/src/Integrations/Divi/DiviIntegration.php
index 9766880..20aa92d 100644
--- a/src/Integrations/Divi/DiviIntegration.php
+++ b/src/Integrations/Divi/DiviIntegration.php
@@ -7,6 +7,7 @@ namespace LIT\MCP\Integrations\Divi;
 use Closure;
 use LIT\MCP\Abilities\Ability;
 use LIT\MCP\Abilities\ToolAvailability;
+use LIT\MCP\Admin\CheckRoute;
 use LIT\MCP\Admin\SettingsPage;
 use LIT\MCP\ChangeLog\ChangeLog;
 use LIT\MCP\Compatibility\CompatibilityCheck;
@@ -75,7 +76,6 @@ use LIT\MCP\Integrations\Divi\Pages\DiviSaver;
 use LIT\MCP\Integrations\Divi\Pages\DiviUpdateAbility;
 use LIT\MCP\Integrations\Divi\Pages\DiviWriter;
 use LIT\MCP\Integrations\Divi\Pages\DynamicContentMap;
-use LIT\MCP\Integrations\Divi\Release\DiviCheckRoute;
 use LIT\MCP\Integrations\Divi\Release\FeatureOverview;
 use LIT\MCP\Integrations\Divi\Release\DiviProfile;
 use LIT\MCP\Integrations\Divi\Release\ReleaseGate;
@@ -260,12 +260,18 @@ final class DiviIntegration implements Integration, Bootable, ProvidesCompatibil
             ReleaseGate::invalidate(mirrors: true);
         });
 
-        // Spec §6: the admin check runs as a REST request (same context as MCP calls). Its short form has no
-        // Tools-tab gate: the check tests Divi, not this site's tool switches.
+        // The admin check runs as a generic REST route (Admin\CheckRoute, registered by Plugin); a stored check or a
+        // release changes the state, so the gate forgets its status of this request.
+        add_action(CheckRoute::CHANGED_ACTION, static function (string $profileId): void {
+            if ($profileId === DiviProfile::ID) {
+                ReleaseGate::invalidate();
+            }
+        });
+
+        // Spec §7: the same check as WP-CLI command. Its short form has no Tools-tab gate: the check tests Divi,
+        // not this site's tool switches.
         $profile = $this->profile();
-        $check = static fn (): CompatibilityCheck => CompatibilityCheck::forProfile($profile);
-        (new DiviCheckRoute($check))->register();
-        DiviCheckCommand::register($check);
+        DiviCheckCommand::register(static fn (): CompatibilityCheck => CompatibilityCheck::forProfile($profile));
 
         add_filter(
             SettingsPage::TABS_FILTER,
diff --git a/src/Integrations/Divi/Release/DiviCheckRoute.php b/src/Integrations/Divi/Release/DiviCheckRoute.php
deleted file mode 100644
index 3e90d6a..0000000
--- a/src/Integrations/Divi/Release/DiviCheckRoute.php
+++ /dev/null
@@ -1,128 +0,0 @@
-<?php
-
-declare(strict_types=1);
-
-namespace LIT\MCP\Integrations\Divi\Release;
-
-use Closure;
-use LIT\MCP\Admin\SettingsPage;
-use LIT\MCP\Compatibility\CheckReportStore;
-use LIT\MCP\Compatibility\CompatibilityCheck;
-use LIT\MCP\Integrations\Divi\Admin\DiviTab;
-use LIT\MCP\Log;
-use Throwable;
-use WP_REST_Response;
-
-defined('ABSPATH') || exit;
-
-/**
- * "Prüfung starten" of the Divi tab (spec §6.1): POST /wp-json/lit-mcp/v1/divi-check. A REST request on purpose –
- * not admin-post – so the check runs in the same context as MCP calls (Divi renders its blocks in REST requests,
- * lit-page-render-summary). The form sends the wp_rest nonce as _wpnonce (cookie authentication); only manage_options.
- * One check at a time: an atomic "INSERT IGNORE" on the options table (self::LOCK) is the lock – add_option() reads
- * then writes (wp-includes/option.php) and is not atomic, so two simultaneous requests could both "acquire" it. A
- * lock older than LOCK_TTL is a dead check's, taken over with a conditional UPDATE (compare-and-swap on the value
- * just read) so only one of several concurrent takers wins. A check that throws still releases the lock (finally)
- * and redirects with divi_check_failed (logged, never shown to the browser as an unhandled 500). Answers 303 back
- * to the tab.
- */
-final class DiviCheckRoute
-{
-    public const NAMESPACE = 'lit-mcp/v1';
-    public const ROUTE = '/divi-check';
-    public const LOCK = 'lit_mcp_divi_check_lock';
-
-    private const LOCK_TTL = 600;
-
-    /** @param Closure(): CompatibilityCheck $check */
-    public function __construct(private Closure $check, private ?CheckReportStore $reports = null)
-    {
-    }
-
-    public function register(): void
-    {
-        add_action('rest_api_init', [$this, 'registerRoute']);
-    }
-
-    public function registerRoute(): void
-    {
-        register_rest_route(self::NAMESPACE, self::ROUTE, [
-            'methods' => 'POST',
-            'callback' => [$this, 'handle'],
-            'permission_callback' => static fn (): bool => current_user_can('manage_options'),
-        ]);
-    }
-
-    public static function url(): string
-    {
-        return rest_url(self::NAMESPACE . self::ROUTE);
-    }
-
-    public function handle(): WP_REST_Response
-    {
-        $notice = 'divi_check_running';
-        if (self::lock()) {
-            try {
-                $report = ($this->check)()->run(get_current_user_id());
-                $reports = $this->reports ?? new CheckReportStore(DiviProfile::ID, DiviProfile::REPORT_VERSION_KEY);
-                $reports->save($report);
-                ReleaseGate::invalidate();
-                $notice = 'divi_checked';
-            } catch (Throwable $e) {
-                Log::failure('divi check', $e);
-                $notice = 'divi_check_failed';
-            } finally {
-                delete_option(self::LOCK);
-            }
-        }
-
-        return new WP_REST_Response(
-            null,
-            303,
-            ['Location' => SettingsPage::url(DiviTab::SLUG, ['lit_mcp_notice' => $notice])]
-        );
-    }
-
-    private static function lock(): bool
-    {
-        global $wpdb;
-
-        if (self::insertLock($wpdb, time())) {
-            return true;
-        }
-
-        // get_var(), not get_option(): the row was written with raw SQL, bypassing the options cache.
-        $since = $wpdb->get_var($wpdb->prepare(
-            "SELECT option_value FROM {$wpdb->options} WHERE option_name = %s",
-            self::LOCK
-        ));
-        if ($since === null) {
-            // The lock was released between our failed insert and this read; try once more.
-            return self::insertLock($wpdb, time());
-        }
-        if (time() - (int) $since < self::LOCK_TTL) {
-            return false;
-        }
-
-        $taken = $wpdb->query($wpdb->prepare(
-            "UPDATE {$wpdb->options} SET option_value = %s WHERE option_name = %s AND option_value = %s",
-            (string) time(),
-            self::LOCK,
-            $since
-        ));
-
-        return (int) $taken === 1;
-    }
-
-    /** INSERT IGNORE: 1 row affected = the lock did not exist and is now ours; 0 = someone else holds it. */
-    private static function insertLock(\wpdb $wpdb, int $now): bool
-    {
-        $inserted = $wpdb->query($wpdb->prepare(
-            "INSERT IGNORE INTO {$wpdb->options} (option_name, option_value, autoload) VALUES (%s, %s, 'no')",
-            self::LOCK,
-            (string) $now
-        ));
-
-        return (int) $inserted === 1;
-    }
-}
diff --git a/src/Integrations/Divi/Release/DiviProfile.php b/src/Integrations/Divi/Release/DiviProfile.php
index 7c9ef5c..8041392 100644
--- a/src/Integrations/Divi/Release/DiviProfile.php
+++ b/src/Integrations/Divi/Release/DiviProfile.php
@@ -46,6 +46,7 @@ final class DiviProfile
                 ))->run()
             ),
             manifestCheck: DiviManifestCheck::create(...),
+            stepLabel: DiviCheckSteps::label(...),
             reportVersionKey: self::REPORT_VERSION_KEY
         );
     }
diff --git a/src/Plugin.php b/src/Plugin.php
index 5e4985b..a985265 100644
--- a/src/Plugin.php
+++ b/src/Plugin.php
@@ -14,6 +14,8 @@ use LIT\MCP\Admin\ConnectionRepository;
 use LIT\MCP\Admin\ConnectionStatus;
 use LIT\MCP\Admin\ConnectionTab;
 use LIT\MCP\Admin\ConnectionUsage;
+use LIT\MCP\Admin\CheckRoute;
+use LIT\MCP\Admin\CompatibilityTab;
 use LIT\MCP\Admin\LimitsTab;
 use LIT\MCP\Admin\LogTab;
 use LIT\MCP\Admin\SettingsPage;
@@ -94,6 +96,8 @@ final class Plugin
         // Integration-owned hooks (Divi: upgrader hook, check route, CLI command, tab "Divi") – before the settings
         // page reads its tabs.
         $registry->boot();
+        // The admin check of every compatibility profile (POST lit-mcp/v1/<id>-check), REST like the MCP calls.
+        (new CheckRoute($registry->compatibility()))->register();
 
         (new AbilityRegistrar($registry, $policy, self::guards($registry, $changeLog)))->register();
         (new ServerRegistrar(
@@ -113,12 +117,14 @@ final class Plugin
             new ToolsTab($registry, $policy),
             new LogTab($changeLog, $limits, $registry),
             new LimitsTab(),
+            self::compatibilityTab($registry, $changeLog),
         ];
         self::$settingsPage = new SettingsPage(
             $tabs,
             plugins_url('assets/img/loosen-it-logo.svg', self::$pluginFile),
             plugins_url('assets', self::$pluginFile),
-            self::VERSION
+            self::VERSION,
+            static fn (string $id): ?string => $registry->compatibility()->profile($id)?->label
         );
         (new ConnectionUsage())->register();
         if (is_admin()) {
@@ -129,6 +135,16 @@ final class Plugin
         \WPMedia\MCP\OAuth\Bootstrap::instance();
     }
 
+    /**
+     * The tab "Compatibility" over the registry's profiles: check, release and withdraw for all of them.
+     *
+     * @internal Public for PluginTest only.
+     */
+    public static function compatibilityTab(IntegrationRegistry $registry, ChangeLog $changeLog): CompatibilityTab
+    {
+        return new CompatibilityTab($registry->compatibility(), $changeLog);
+    }
+
     /**
      * The guards of every tool call. DiviFeatureGate judges the Divi IDs; CapabilityGate the IDs of all other profiles
      * and locks the unknown ones – without it a tool with an unknown ID would run unlocked.
diff --git a/src/Uninstaller.php b/src/Uninstaller.php
index be49e0c..ad8a591 100644
--- a/src/Uninstaller.php
+++ b/src/Uninstaller.php
@@ -18,7 +18,7 @@ defined('ABSPATH') || exit;
  * names below are therefore duplicated from Access::OPTION, Abilities\ExposurePolicy::OPTION,
  * Limits::OPTION, ChangeLog\ChangeLogInstaller::VERSION_OPTION, Integrations\Divi\Release\
  * lit_mcp_<profile>_releases (Compatibility\ReleaseStore), lit_mcp_<profile>_check_report
- * (Compatibility\CheckReportStore) and lit_mcp_<profile>_check_lock (Divi\Release\DiviCheckRoute::LOCK) for the
+ * (Compatibility\CheckReportStore) and lit_mcp_<profile>_check_lock (Admin\CheckRoute) for the
  * profiles divi and pods (an explicit list: a LIKE pattern could hit foreign options),
  * Integrations\Divi\Design\DesignLock::option(), Admin\ConnectionStatus::ENDPOINT_TRANSIENT,
  * Integrations\Divi\Release\ReleaseResolver::CACHE,
diff --git a/tests/Unit/Admin/CheckRouteTest.php b/tests/Unit/Admin/CheckRouteTest.php
new file mode 100644
index 0000000..13c1992
--- /dev/null
+++ b/tests/Unit/Admin/CheckRouteTest.php
@@ -0,0 +1,310 @@
+<?php
+
+declare(strict_types=1);
+
+namespace LIT\MCP\Tests\Unit\Admin;
+
+use Brain\Monkey\Actions;
+use Brain\Monkey\Functions;
+use LIT\MCP\Admin\CheckRoute;
+use LIT\MCP\Compatibility\CheckReport;
+use LIT\MCP\Compatibility\CheckReportStore;
+use LIT\MCP\Compatibility\Compatibility;
+use LIT\MCP\Compatibility\Profile;
+use LIT\MCP\Compatibility\Tier;
+use LIT\MCP\Tests\Unit\TestCase;
+use Mockery;
+use RuntimeException;
+
+final class CheckRouteTest extends TestCase
+{
+    protected function setUp(): void
+    {
+        parent::setUp();
+        Functions\when('admin_url')->alias(static fn (string $path = ''): string => 'https://k.de/wp-admin/' . $path);
+        Functions\when('add_query_arg')->alias(
+            static fn (array $args, string $url): string => $url . '?' . http_build_query($args)
+        );
+        Functions\when('get_current_user_id')->justReturn(1);
+        Functions\when('rest_url')->alias(static fn (string $path): string => 'https://k.de/wp-json/' . $path);
+    }
+
+    protected function tearDown(): void
+    {
+        unset($GLOBALS['wpdb']);
+        parent::tearDown();
+    }
+
+    private static function profile(string $id): Profile
+    {
+        return new Profile(id: $id, label: ucfirst($id), tier: Tier::LockOnFailure, capabilities: []);
+    }
+
+    /** @param (callable(Profile, int): CheckReport)|null $check */
+    private static function route(?callable $check = null, ?CheckReportStore $reports = null): CheckRoute
+    {
+        return new CheckRoute(
+            new Compatibility([self::profile('divi'), self::profile('pods')]),
+            $check === null ? static fn () => self::fail('no check expected') : $check(...),
+            static fn (Profile $profile): CheckReportStore => $reports ?? self::fail('no store expected')
+        );
+    }
+
+    private static function report(): CheckReport
+    {
+        return new CheckReport('r1', 'd', 1, '3.3.9.2', '0.6.0', 'k', []);
+    }
+
+    /** The "<time>:<token>" lock value of the last INSERT or takeover UPDATE the route issued. */
+    private static ?string $lockValue = null;
+
+    /** Remembers the lock value written by $sql ("VALUES (name, 'value', 'no')" or "SET option_value = 'value'"). */
+    private static function captureLockValue(string $sql): void
+    {
+        if (preg_match("/VALUES \\('[^']+', '([^']+)', 'no'\\)|SET option_value = '([^']+)'/", $sql, $m) === 1) {
+            self::$lockValue = ($m[2] ?? '') !== '' ? $m[2] : $m[1];
+        }
+    }
+
+    /** Expects the compare-and-delete of the lock the route wrote last: only while the value is still its own. */
+    private static function expectOwnLockDeleted(\wpdb $db, string $id = 'pods'): void
+    {
+        $db->expects('query')->once()->with(Mockery::on(static fn (string $sql): bool => $sql === sprintf(
+            "DELETE FROM wp_options WHERE option_name = 'lit_mcp_%s_check_lock' AND option_value = '%s'",
+            $id,
+            self::$lockValue
+        )))->andReturn(1);
+    }
+
+    /** Mock of the global $wpdb, its INSERT IGNORE for the lock of $id returning $inserted rows affected. */
+    private static function wpdb(int $inserted, string $id = 'pods'): \wpdb
+    {
+        self::$lockValue = null;
+        $db = Mockery::mock(\wpdb::class)->makePartial();
+        $db->expects('query')->once()->with(Mockery::on(static function (string $sql) use ($id): bool {
+            $matches = str_starts_with(
+                $sql,
+                "INSERT IGNORE INTO wp_options (option_name, option_value, autoload) "
+                    . "VALUES ('lit_mcp_{$id}_check_lock', '"
+            ) && str_ends_with($sql, "', 'no')");
+            $matches && self::captureLockValue($sql);
+
+            return $matches;
+        }))->andReturn($inserted);
+        $GLOBALS['wpdb'] = $db;
+
+        return $db;
+    }
+
+    public function testRegistersOnePostRouteForAdministratorsOnlyPerProfile(): void
+    {
+        $registered = [];
+        Functions\expect('register_rest_route')->twice()->andReturnUsing(
+            static function (string $ns, string $route, array $args) use (&$registered): bool {
+                Functions\when('current_user_can')->alias(static fn (string $cap): bool => $cap === 'manage_options');
+                $allowed = ($args['permission_callback'])();
+                Functions\when('current_user_can')->justReturn(false);
+                $registered[$ns . $route] = $args['methods'] === 'POST' && $allowed === true
+                    && ($args['permission_callback'])() === false;
+
+                return true;
+            }
+        );
+
+        self::route()->registerRoutes();
+
+        self::assertSame(['lit-mcp/v1/divi-check' => true, 'lit-mcp/v1/pods-check' => true], $registered);
+    }
+
+    public function testTheUrlOfAProfile(): void
+    {
+        self::assertSame('https://k.de/wp-json/lit-mcp/v1/pods-check', CheckRoute::url('pods'));
+    }
+
+    public function testRunsTheCheckStoresTheReportRedirectsToTheTabAndAnnouncesTheChange(): void
+    {
+        $db = self::wpdb(1);
+        $report = self::report();
+        $reports = Mockery::mock(CheckReportStore::class);
+        $reports->expects('save')->with($report);
+        self::expectOwnLockDeleted($db);
+        Actions\expectDone('lit_mcp_compat_changed')->once()->with('pods');
+
+        $route = self::route(static function (Profile $profile, int $user) use ($report): CheckReport {
+            self::assertSame('pods', $profile->id);
+            self::assertSame(1, $user);
+
+            return $report;
+        }, $reports);
+        $response = $route->handle('pods');
+
+        $location = $response->get_headers()['Location'];
+        self::assertSame(303, $response->get_status());
+        self::assertStringContainsString('tab=compatibility', $location);
+        self::assertStringContainsString('lit_mcp_notice=compat_checked', $location);
+        self::assertStringContainsString('lit_mcp_profile=pods', $location);
+    }
+
+    public function testTheLockIsPerProfile(): void
+    {
+        $db = self::wpdb(1, 'divi');
+        $reports = Mockery::mock(CheckReportStore::class);
+        $reports->expects('save');
+        self::expectOwnLockDeleted($db, 'divi');
+        Actions\expectDone('lit_mcp_compat_changed')->once()->with('divi');
+
+        self::route(static fn (): CheckReport => self::report(), $reports)->handle('divi');
+    }
+
+    public function testASecondCheckWaitsForTheFirst(): void
+    {
+        $db = self::wpdb(0);
+        $db->expects('get_var')->once()->andReturn((string) time());
+        Actions\expectDone('lit_mcp_compat_changed')->never();
+
+        $response = self::route()->handle('pods');
+
+        $location = $response->get_headers()['Location'];
+        self::assertStringContainsString('lit_mcp_notice=compat_check_running', $location);
+        self::assertStringContainsString('lit_mcp_profile=pods', $location);
+    }
+
+    public function testAStaleLockIsTakenOver(): void
+    {
+        $db = self::wpdb(0);
+        $db->expects('get_var')->once()->andReturn('1');
+        $db->expects('query')->once()->with(Mockery::on(static function (string $sql): bool {
+            $matches = str_starts_with($sql, "UPDATE wp_options SET option_value = '")
+                && str_ends_with(
+                    $sql,
+                    "' WHERE option_name = 'lit_mcp_pods_check_lock' AND option_value = '1'"
+                );
+            $matches && self::captureLockValue($sql);
+
+            return $matches;
+        }))->andReturn(1);
+        self::expectOwnLockDeleted($db);
+        $reports = Mockery::mock(CheckReportStore::class);
+        $reports->expects('save');
+        Actions\expectDone('lit_mcp_compat_changed')->once();
+
+        $response = self::route(static fn (): CheckReport => self::report(), $reports)->handle('pods');
+
+        self::assertStringContainsString('lit_mcp_notice=compat_checked', $response->get_headers()['Location']);
+    }
+
+    public function testATakeoverLostToAnotherRequestWaitsForIt(): void
+    {
+        $db = self::wpdb(0);
+        $db->expects('get_var')->once()->andReturn('1');
+        $db->expects('query')->once()->with(Mockery::on(static fn (string $sql): bool => str_starts_with(
+            $sql,
+            "UPDATE wp_options SET option_value = '"
+        )))->andReturn(0);
+
+        $response = self::route()->handle('pods');
+
+        self::assertStringContainsString('lit_mcp_notice=compat_check_running', $response->get_headers()['Location']);
+    }
+
+    public function testTheLockIsReleasedAndTheCheckMarkedFailedWhenItThrows(): void
+    {
+        $db = self::wpdb(1);
+        self::expectOwnLockDeleted($db);
+        Actions\expectDone('lit_mcp_compat_changed')->never();
+        $reports = Mockery::mock(CheckReportStore::class);
+        $reports->expects('save')->never();
+        // error_log() is a PHP internal and cannot be stubbed; redirect it to a temp file instead.
+        $log = (string) tempnam(sys_get_temp_dir(), 'lit-mcp-log');
+        $previous = ini_set('error_log', $log);
+
+        try {
+            $response = self::route(static function (): never {
+                throw new RuntimeException('pods kaputt');
+            }, $reports)->handle('pods');
+        } finally {
+            ini_set('error_log', (string) $previous);
+        }
+
+        self::assertStringContainsString('lit_mcp_notice=compat_check_failed', $response->get_headers()['Location']);
+        self::assertStringContainsString(
+            'pods check failed: RuntimeException: pods kaputt',
+            (string) file_get_contents($log)
+        );
+        unlink($log);
+    }
+
+    public function testTheLockValueCarriesTimeAndAnOwnerToken(): void
+    {
+        $db = self::wpdb(1);
+        $reports = Mockery::mock(CheckReportStore::class);
+        $reports->expects('save');
+        self::expectOwnLockDeleted($db);
+        Actions\expectDone('lit_mcp_compat_changed');
+
+        self::route(static fn (): CheckReport => self::report(), $reports)->handle('pods');
+
+        self::assertMatchesRegularExpression('/^\d+:[0-9a-f]{8}$/', (string) self::$lockValue);
+    }
+
+    public function testACheckThatOutlivedItsLockDoesNotDeleteTheTakersLock(): void
+    {
+        $db = self::wpdb(1);
+        $reports = Mockery::mock(CheckReportStore::class);
+        $reports->expects('save');
+        Actions\expectDone('lit_mcp_compat_changed');
+        $deleted = [];
+        // Check A runs so long that B takes the row over: the row then holds B's value, not A's.
+        $db->expects('query')->once()->with(Mockery::on(
+            static function (string $sql) use (&$deleted): bool {
+                $deleted[] = $sql;
+
+                return str_starts_with($sql, 'DELETE');
+            }
+        ))->andReturn(0);
+
+        self::route(static fn (): CheckReport => self::report(), $reports)->handle('pods');
+
+        self::assertCount(1, $deleted);
+        self::assertStringEndsWith(
+            "AND option_value = '" . self::$lockValue . "'",
+            $deleted[0],
+            'the DELETE must name the owner token, so a taken-over row (other value) survives'
+        );
+    }
+
+    public function testAThrowingChangeListenerDoesNotTurnTheStoredReportIntoAnError(): void
+    {
+        $db = self::wpdb(1);
+        $reports = Mockery::mock(CheckReportStore::class);
+        $reports->expects('save');
+        self::expectOwnLockDeleted($db);
+        Actions\expectDone('lit_mcp_compat_changed')->once()->andThrow(new RuntimeException('listener kaputt'));
+        $log = (string) tempnam(sys_get_temp_dir(), 'lit-mcp-log');
+        $previous = ini_set('error_log', $log);
+
+        try {
+            $response = self::route(static fn (): CheckReport => self::report(), $reports)->handle('pods');
+        } finally {
+            ini_set('error_log', (string) $previous);
+        }
+
+        self::assertSame(303, $response->get_status());
+        self::assertStringContainsString('lit_mcp_notice=compat_checked', $response->get_headers()['Location']);
+        self::assertStringContainsString('listener kaputt', (string) file_get_contents($log));
+        unlink($log);
+    }
+
+    public function testAnUnknownProfileIsRefusedBeforeAnythingHappens(): void
+    {
+        $GLOBALS['wpdb'] = Mockery::mock(\wpdb::class)->makePartial();
+        Actions\expectDone('lit_mcp_compat_changed')->never();
+
+        foreach (['nope', '', 'pods_check_lock', "pods' OR 1=1 --"] as $id) {
+            $response = self::route()->handle($id);
+
+            self::assertSame(404, $response->get_status());
+            self::assertArrayNotHasKey('Location', $response->get_headers());
+        }
+    }
+}
diff --git a/tests/Unit/Admin/CompatibilityTabTest.php b/tests/Unit/Admin/CompatibilityTabTest.php
new file mode 100644
index 0000000..9b203a6
--- /dev/null
+++ b/tests/Unit/Admin/CompatibilityTabTest.php
@@ -0,0 +1,742 @@
+<?php
+
+declare(strict_types=1);
+
+namespace LIT\MCP\Tests\Unit\Admin;
+
+use Brain\Monkey\Actions;
+use Brain\Monkey\Functions;
+use Closure;
+use LIT\MCP\Admin\AdminPostAction;
+use LIT\MCP\Admin\AdminTab;
+use LIT\MCP\Admin\CompatibilityTab;
+use LIT\MCP\ChangeLog\ChangeLog;
+use LIT\MCP\Compatibility\CheckReport;
+use LIT\MCP\Compatibility\CheckReportStore;
+use LIT\MCP\Compatibility\CheckStep;
+use LIT\MCP\Compatibility\Compatibility;
+use LIT\MCP\Compatibility\CompatibilityMatrix;
+use LIT\MCP\Compatibility\Profile;
+use LIT\MCP\Compatibility\ReleaseState;
+use LIT\MCP\Compatibility\ReleaseStore;
+use LIT\MCP\Compatibility\Tier;
+use LIT\MCP\Plugin;
+use LIT\MCP\Tests\Support\FakeCapability;
+use LIT\MCP\Tests\Support\FakeChangeLog;
+use LIT\MCP\Tests\Unit\TestCase;
+use Mockery;
+
+final class CompatibilityTabTest extends TestCase
+{
+    private const CAPS = [FakeCapability::Read, FakeCapability::Write];
+
+    private ?string $redirect = null;
+    /** @var list<string> The nonce actions check_admin_referer() was asked for. */
+    private array $nonces = [];
+
+    protected function setUp(): void
+    {
+        parent::setUp();
+        $this->redirect = null;
+        $this->nonces = [];
+        Functions\stubEscapeFunctions();
+        Functions\stubTranslationFunctions();
+        Functions\when('current_user_can')->justReturn(true);
+        Functions\when('check_admin_referer')->alias(function (string $action): int {
+            $this->nonces[] = $action;
+
+            return 1;
+        });
+        Functions\when('get_current_user_id')->justReturn(1);
+        Functions\when('wp_safe_redirect')->alias(function (string $url): bool {
+            $this->redirect = $url;
+
+            return true;
+        });
+        Functions\when('admin_url')->alias(static fn (string $path = ''): string => 'https://k.de/wp-admin/' . $path);
+        Functions\when('add_query_arg')->alias(
+            static fn (array $args, string $url): string => $url . '?' . http_build_query($args)
+        );
+        Functions\when('rest_url')->alias(static fn (string $path): string => 'https://k.de/wp-json/' . $path);
+        Functions\when('wp_create_nonce')->alias(static fn (string $action): string => 'nonce-' . $action);
+        Functions\when('wp_nonce_field')->alias(static function (string $action): void {
+            echo '<input type="hidden" name="_wpnonce" value="nonce-' . $action . '">';
+        });
+        Functions\when('submit_button')->alias(
+            static function (
+                string $text,
+                string $type = 'primary',
+                string $name = 'submit',
+                bool $wrap = true,
+                array $attributes = []
+            ): void {
+                $extra = '';
+                foreach ($attributes as $key => $value) {
+                    $extra .= ' ' . $key . '="' . esc_attr($value) . '"'; // WordPress escapes the values itself
+                }
+                echo '<button class="button-' . $type . '" name="' . $name . '"' . $extra . '>' . $text . '</button>';
+            }
+        );
+        Functions\when('get_option')->alias(static fn (string $name): string => $name === 'date_format' ? 'Y-m-d' : '');
+        Functions\when('date_i18n')->alias(static fn (string $format, int $time): string => gmdate($format, $time));
+        Functions\when('get_userdata')->justReturn(false);
+        Functions\when('sanitize_key')->alias(
+            static fn (string $key): string => strtolower((string) preg_replace('/[^a-z0-9_\-]/i', '', $key))
+        );
+        Functions\when('wp_unslash')->returnArg();
+    }
+
+    protected function tearDown(): void
+    {
+        unset($_POST['profile'], $_GET['tab']);
+        parent::tearDown();
+    }
+
+    /** A profile of the invented plugin "fake"; $matrix only for ReleasePerVersion. */
+    private static function profile(
+        Tier $tier = Tier::LockOnFailure,
+        ?CompatibilityMatrix $matrix = null,
+        bool $active = true,
+        ?string $version = '1.2.0',
+        array $tested = [],
+        ?Closure $stepLabel = null
+    ): Profile {
+        return new Profile(
+            id: 'fake',
+            label: 'Fake <Plugin>',
+            tier: $tier,
+            capabilities: self::CAPS,
+            active: static fn (): bool => $active,
+            version: static fn (): ?string => $version,
+            matrix: $tier === Tier::ReleasePerVersion
+                ? static fn (): CompatibilityMatrix => $matrix ?? self::fail('no matrix expected')
+                : null,
+            testedVersions: $tested,
+            stateKey: static fn (string $v): string => 'key' . $v,
+            stepLabel: $stepLabel
+        );
+    }
+
+    private static function matrix(ReleaseState $state, array $problems = []): CompatibilityMatrix
+    {
+        return CompatibilityMatrix::uniform(self::CAPS, $state, $problems, null);
+    }
+
+    private static function report(bool $green = true, string $version = '1.2.0', string $key = 'key1.2.0'): CheckReport
+    {
+        $steps = [
+            new CheckStep(CheckStep::MANIFEST, $green ? [] : ['Funktion <i>x</i> fehlt'], false, 'Manifest <b>Label</b>'),
+            new CheckStep('old', [], false),
+        ];
+
+        return new CheckReport('r1', '2026-10-01T08:00:00+00:00', 1, $version, Plugin::VERSION, $key, $steps);
+    }
+
+    private function tab(
+        Profile $profile,
+        ?CheckReport $report = null,
+        ?ReleaseStore $releases = null,
+        ?FakeChangeLog $log = null
+    ): CompatibilityTab {
+        $reports = Mockery::mock(CheckReportStore::class);
+        $reports->allows('latest')->andReturn($report);
+        $store = $releases ?? Mockery::mock(ReleaseStore::class);
+        if ($releases === null) {
+            $store->allows('entries')->andReturn([]);
+            $store->allows('find')->andReturn(null);
+        }
+
+        return new CompatibilityTab(
+            new Compatibility([$profile]),
+            $log ?? FakeChangeLog::forbidden(),
+            new AdminPostAction(static function (): void {
+            }),
+            static fn (): CheckReportStore => $reports,
+            static fn (): ReleaseStore => $store
+        );
+    }
+
+    private static function html(CompatibilityTab $tab): string
+    {
+        ob_start();
+        $tab->render();
+
+        return (string) ob_get_clean();
+    }
+
+    public function testItIsTheTabCompatibility(): void
+    {
+        $tab = $this->tab(self::profile());
+
+        self::assertInstanceOf(AdminTab::class, $tab);
+        self::assertSame('compatibility', $tab->slug());
+        self::assertSame('Compatibility', $tab->label());
+    }
+
+    public function testAnInactiveProfileIsOneLineAndNeverAsksForTheMatrix(): void
+    {
+        Actions\expectDone('lit_mcp_compat_profile_extra')->never();
+        // ReleasePerVersion with a matrix closure that fails the test when called.
+        $html = self::html($this->tab(self::profile(Tier::ReleasePerVersion, null, active: false)));
+
+        self::assertStringContainsString('nicht installiert oder nicht aktiv', $html);
+        self::assertStringContainsString('Fake &lt;Plugin&gt;', $html);
+        self::assertStringNotContainsString('<form', $html);
+        self::assertStringNotContainsString('<table', $html);
+    }
+
+    /** @dataProvider states */
+    public function testTheOverallStateIsShownAsWordAndIcon(ReleaseState $state, string $word, string $icon): void
+    {
+        $html = self::html($this->tab(self::profile(Tier::ReleasePerVersion, self::matrix($state, ['Problem A']))));
+
+        self::assertStringContainsString('<strong>' . $word . '</strong>', $html);
+        self::assertStringContainsString('dashicons-' . $icon, $html);
+        self::assertStringContainsString('aria-hidden="true"', $html);
+    }
+
+    /** @return array<string, array{ReleaseState, string, string}> */
+    public static function states(): array
+    {
+        return [
+            'released' => [ReleaseState::Released, 'freigegeben', 'yes-alt'],
+            'untested' => [ReleaseState::Untested, 'ungetestet', 'warning'],
+            'incompatible' => [ReleaseState::Incompatible, 'inkompatibel', 'dismiss'],
+        ];
+    }
+
+    public function testItShowsTheVersionAndTheProblemsAndTheCapabilityTable(): void
+    {
+        $html = self::html($this->tab(
+            self::profile(Tier::ReleasePerVersion, self::matrix(ReleaseState::Incompatible, ['Problem A']))
+        ));
+
+        self::assertStringContainsString('1.2.0', $html);
+        self::assertStringContainsString('Problem A', $html);
+        self::assertStringContainsString('Fake fake-read', $html);
+        self::assertStringContainsString('Fake fake-write', $html);
+    }
+
+    /** @dataProvider tierTexts */
+    public function testTheTierHintSaysWhatTheReleaseMeans(Tier $tier, string $text): void
+    {
+        $matrix = $tier === Tier::ReleasePerVersion ? self::matrix(ReleaseState::Released) : null;
+
+        $html = self::html($this->tab(self::profile($tier, $matrix)));
+
+        self::assertStringContainsString($text, $html);
+    }
+
+    /** @return array<string, array{Tier, string}> */
+    public static function tierTexts(): array
+    {
+        return [
+            'release' => [Tier::ReleasePerVersion, 'Freigabe pro Version nötig'],
+            'lock' => [
+                Tier::LockOnFailure,
+                'Freigabe wird dokumentiert, Nutzung automatisch, solange die Prüfung grün ist',
+            ],
+            'report' => [Tier::ReportOnly, 'nur Anzeige'],
+        ];
+    }
+
+    public function testLockOnFailureIsLockedWhenTheProfileIsActiveButTooOld(): void
+    {
+        $profile = new Profile(
+            id: 'fake',
+            label: 'Fake',
+            tier: Tier::LockOnFailure,
+            capabilities: self::CAPS,
+            version: static fn (): string => '0.9',
+            minVersion: '1.0'
+        );
+        $tab = new CompatibilityTab(new Compatibility([$profile]), FakeChangeLog::forbidden());
+        Functions\when('get_option')->justReturn(false);
+
+        $html = self::html($tab);
+
+        self::assertStringContainsString('<strong>inkompatibel</strong>', $html);
+        self::assertStringContainsString('Mindestversion', $html);
+    }
+
+    public function testTestedAndReleasedVersionsAreListed(): void
+    {
+        $releases = Mockery::mock(ReleaseStore::class);
+        $releases->allows('entries')->andReturn([
+            ['version' => '1.1.0', 'plugin_version' => '0.7.0', 'user_id' => 1, 'released_at' => 'x', 'report_id' => 'r'],
+        ]);
+        $releases->allows('find')->andReturn(null);
+
+        $html = self::html($this->tab(self::profile(tested: ['1.0.0', '1.0.1']), null, $releases));
+
+        self::assertStringContainsString('1.0.0, 1.0.1', $html);
+        self::assertStringContainsString('1.1.0', $html);
+        self::assertStringContainsString('LIT MCP 0.7.0', $html);
+    }
+
+    public function testNoVersionListsShowADashWhenEmpty(): void
+    {
+        $html = self::html($this->tab(self::profile()));
+
+        self::assertStringContainsString('Getestete Versionen', $html);
+        self::assertStringContainsString('Freigegebene Versionen', $html);
+        self::assertSame(2, substr_count($html, '<td>–</td>'));
+    }
+
+    public function testTheLatestReportListsEveryStepWithIconAndLabel(): void
+    {
+        $profile = self::profile(stepLabel: static fn (CheckStep $s): string => $s->label ?? 'Alt:' . $s->key);
+
+        $html = self::html($this->tab($profile, self::report()));
+
+        self::assertStringContainsString('Letzte Prüfung', $html);
+        self::assertStringContainsString('Manifest &lt;b&gt;Label&lt;/b&gt;', $html);
+        self::assertStringContainsString('Alt:old', $html);
+        self::assertStringContainsString('<strong>bestanden</strong>', $html);
+    }
+
+    public function testAFailedStepSaysSoInVisibleText(): void
+    {
+        $html = self::html($this->tab(self::profile(), self::report(false)));
+
+        self::assertStringContainsString('<strong>fehlgeschlagen</strong>', $html);
+    }
+
+    public function testTheCapabilityTableHasACaptionNamingTheProfile(): void
+    {
+        $html = self::html($this->tab(self::profile()));
+
+        self::assertStringContainsString(
+            '<caption class="screen-reader-text">Fähigkeiten von Fake &lt;Plugin&gt;</caption>',
+            $html
+        );
+    }
+
+    public function testEveryButtonNamesItsProfileForAssistiveTechnology(): void
+    {
+        $profile = self::profile(Tier::ReleasePerVersion, self::matrix(ReleaseState::Untested));
+        $withdrawable = self::profile(Tier::ReleasePerVersion, self::matrix(ReleaseState::Released));
+
+        $html = self::html($this->tab($profile, self::report()))
+            . self::html($this->tab($withdrawable, self::report(), self::store(self::entry())));
+
+        self::assertStringContainsString('aria-label="Prüfung starten: Fake &lt;Plugin&gt;"', $html);
+        // The release label names the profile itself.
+        self::assertStringContainsString('>Fake <Plugin> 1.2.0 freigeben</button>', $html);
+        self::assertStringContainsString('aria-label="Freigabe zurückziehen: Fake &lt;Plugin&gt;"', $html);
+    }
+
+    public function testEachFormButtonHasAUniqueNameInsteadOfSubmit(): void
+    {
+        $profile = self::profile(Tier::ReleasePerVersion, self::matrix(ReleaseState::Untested));
+        $withdrawable = self::profile(Tier::ReleasePerVersion, self::matrix(ReleaseState::Released));
+
+        $html = self::html($this->tab($profile, self::report()))
+            . self::html($this->tab($withdrawable, self::report(), self::store(self::entry())));
+
+        self::assertStringNotContainsString('name="submit"', $html);
+        self::assertStringContainsString('name="lit-mcp-compat-release-fake"', $html);
+        self::assertStringContainsString('name="lit-mcp-compat-withdraw-fake"', $html);
+        self::assertStringContainsString('name="lit-mcp-compat-check-fake"', $html);
+    }
+
+    public function testTheLoadHookIsRegisteredOnTheSettingsPage(): void
+    {
+        $tab = $this->tab(self::profile());
+        Actions\expectAdded('load-settings_page_lit-mcp')->once()->with([$tab, 'loadProfiles']);
+
+        $tab->registerActions();
+    }
+
+    public function testTheLoadActionFiresPerProfileOnTheOwnTabOnly(): void
+    {
+        $_GET['tab'] = 'compatibility';
+        Actions\expectDone('lit_mcp_compat_profile_load')->once()->with('fake');
+
+        $this->tab(self::profile())->loadProfiles();
+    }
+
+    public function testTheLoadActionStaysQuietOnOtherTabsAndForOthersThanAdministrators(): void
+    {
+        Actions\expectDone('lit_mcp_compat_profile_load')->never();
+
+        foreach (['verbindung', '', ['compatibility']] as $tabParam) {
+            $_GET['tab'] = $tabParam;
+            $this->tab(self::profile())->loadProfiles();
+        }
+        unset($_GET['tab']);
+        $this->tab(self::profile())->loadProfiles();
+        $_GET['tab'] = 'compatibility';
+        Functions\when('current_user_can')->justReturn(false);
+        $this->tab(self::profile())->loadProfiles();
+    }
+
+    public function testRenderingDoesNotFireTheLoadAction(): void
+    {
+        $_GET['tab'] = 'compatibility';
+        Actions\expectDone('lit_mcp_compat_profile_load')->never();
+
+        self::html($this->tab(self::profile()));
+    }
+
+    public function testAnArrayAsProfileFieldIsRefusedWithoutAWarning(): void
+    {
+        $this->actionsDie();
+        $_POST['profile'] = ['fake'];
+
+        $this->expectException(\RuntimeException::class);
+
+        $this->tab(self::profile())->release();
+    }
+
+    public function testASkippedStepIsMarkedAsNotRun(): void
+    {
+        $report = new CheckReport('r1', '2026-10-01T08:00:00+00:00', 1, '1.2.0', Plugin::VERSION, 'k', [
+            new CheckStep('write', [], true, 'Schreibtest'),
+        ]);
+
+        $html = self::html($this->tab(self::profile(), $report));
+
+        self::assertStringContainsString('Schreibtest', $html);
+        self::assertStringContainsString('<strong>übersprungen</strong>', $html);
+        self::assertStringNotContainsString('screen-reader-text">übersprungen', $html);
+        self::assertStringContainsString('nicht ausgeführt', $html);
+    }
+
+    public function testAStepWithoutLabelAndWithoutLabelSourceShowsItsKey(): void
+    {
+        $html = self::html($this->tab(self::profile(), self::report()));
+
+        self::assertStringContainsString('</strong>: old', $html);
+    }
+
+    public function testAFailedStepListsItsProblems(): void
+    {
+        $html = self::html($this->tab(self::profile(), self::report(false)));
+
+        self::assertStringContainsString('fehlgeschlagen', $html);
+        self::assertStringContainsString('Funktion &lt;i&gt;x&lt;/i&gt; fehlt', $html);
+    }
+
+    public function testWithoutAReportNothingIsListed(): void
+    {
+        self::assertStringNotContainsString('Letzte Prüfung', self::html($this->tab(self::profile())));
+    }
+
+    public function testTheProfileExtraHookRunsLastWithTheProfileId(): void
+    {
+        Actions\expectDone('lit_mcp_compat_profile_extra')->once()->with('fake');
+
+        self::html($this->tab(self::profile(), self::report()));
+    }
+
+    public function testEverythingFromThirdPartiesIsEscaped(): void
+    {
+        $profile = self::profile(
+            Tier::ReleasePerVersion,
+            self::matrix(ReleaseState::Incompatible, ['<script>alert(1)</script>']),
+            version: '<b>x</b>',
+            tested: ['<i>t</i>']
+        );
+
+        $html = self::html($this->tab($profile, self::report(false, '<b>x</b>')));
+
+        self::assertStringNotContainsString('<script>', $html);
+        self::assertStringNotContainsString('<b>x</b>', $html);
+        self::assertStringNotContainsString('<i>t</i>', $html);
+        self::assertStringNotContainsString('<i>x</i>', $html);
+        self::assertStringNotContainsString('<b>Label</b>', $html);
+        self::assertStringContainsString('&lt;b&gt;x&lt;/b&gt;', $html);
+        self::assertStringContainsString('&lt;script&gt;alert(1)&lt;/script&gt;', $html);
+    }
+
+    // --- 1.21: forms and actions -------------------------------------------------------------------------------
+
+    private function actionsDie(): void
+    {
+        Functions\when('wp_die')->alias(static function (): never {
+            throw new \RuntimeException('died');
+        });
+    }
+
+    private static function entry(string $version = '1.2.0'): array
+    {
+        return [
+            'version' => $version,
+            'plugin_version' => Plugin::VERSION,
+            'user_id' => 1,
+            'released_at' => '2026-10-01T08:00:00+00:00',
+            'report_id' => 'r1',
+        ];
+    }
+
+    /** A store with the given entries for the installed state; add()/withdraw() expectations are the test's. */
+    private static function store(?array $entry = null): ReleaseStore
+    {
+        $releases = Mockery::mock(ReleaseStore::class);
+        $releases->allows('entries')->andReturn($entry === null ? [] : [$entry]);
+        $releases->allows('find')->andReturn($entry);
+
+        return $releases;
+    }
+
+    public function testRegistersTheAdminPostHandlers(): void
+    {
+        $tab = $this->tab(self::profile());
+        Actions\expectAdded('admin_post_lit_mcp_compat_release')->once()->with([$tab, 'release']);
+        Actions\expectAdded('admin_post_lit_mcp_compat_withdraw')->once()->with([$tab, 'withdraw']);
+
+        $tab->registerActions();
+    }
+
+    public function testTheCheckFormPostsToTheRestRouteWithTheRestNonce(): void
+    {
+        $html = self::html($this->tab(self::profile()));
+
+        self::assertStringContainsString('action="https://k.de/wp-json/lit-mcp/v1/fake-check"', $html);
+        self::assertStringContainsString('name="_wpnonce" value="nonce-wp_rest"', $html);
+        self::assertStringContainsString('Prüfung starten', $html);
+    }
+
+    public function testReleaseNeedsAFreshGreenReportForTheInstalledState(): void
+    {
+        $_POST['profile'] = 'fake';
+        $reports = [null, self::report(false), self::report(true, '1.1.0', 'key1.1.0'), self::report(true, '1.2.0', 'old')];
+        foreach ($reports as $report) {
+            $this->redirect = null;
+            $releases = self::store();
+            $releases->expects('add')->never();
+            Actions\expectDone('lit_mcp_compat_changed')->never();
+
+            $this->tab(self::profile(), $report, $releases)->release();
+
+            self::assertStringContainsString('lit_mcp_notice=compat_release_refused', (string) $this->redirect);
+            self::assertStringContainsString('lit_mcp_profile=fake', (string) $this->redirect);
+        }
+    }
+
+    public function testReleaseStoresTheEntryLogsItAndAnnouncesTheChange(): void
+    {
+        $_POST['profile'] = 'fake';
+        $releases = self::store();
+        $releases->expects('add')->once()->with('1.2.0', Plugin::VERSION, 1, 'r1');
+        $log = new FakeChangeLog();
+        Actions\expectDone('lit_mcp_compat_changed')->once()->with('fake');
+
+        $this->tab(self::profile(), self::report(), $releases, $log)->release();
+
+        self::assertSame(['lit_mcp_compat_release_fake'], $this->nonces);
+        self::assertStringContainsString('tab=compatibility', (string) $this->redirect);
+        self::assertStringContainsString('lit_mcp_notice=compat_released', (string) $this->redirect);
+        self::assertSame('lit/fake-release', $log->records[0]['ability']);
+        self::assertSame('fake', $log->records[0]['object_type']);
+        self::assertSame('1.2.0', $log->records[0]['object_id']);
+        self::assertStringContainsString('Fake <Plugin> 1.2.0', $log->records[0]['summary']);
+    }
+
+    /** @dataProvider refusedReleases */
+    public function testReleaseIsRefusedWhereTheTabOffersNone(Profile $profile, ?array $entry): void
+    {
+        $_POST['profile'] = 'fake';
+        $releases = self::store($entry);
+        $releases->expects('add')->never();
+        Actions\expectDone('lit_mcp_compat_changed')->never();
+
+        $this->tab($profile, self::report(), $releases)->release();
+
+        self::assertStringContainsString('lit_mcp_notice=compat_release_refused', (string) $this->redirect);
+    }
+
+    /** @return array<string, array{Profile, ?array}> */
+    public static function refusedReleases(): array
+    {
+        return [
+            'version tested in the plugin' => [self::profile(tested: ['1.2.0']), null],
+            'already released' => [self::profile(), self::entry()],
+            'report only' => [self::profile(Tier::ReportOnly), null],
+            'inactive' => [self::profile(active: false), null],
+            'version unknown' => [self::profile(version: null), null],
+            'per version, but already released' => [
+                self::profile(Tier::ReleasePerVersion, self::matrix(ReleaseState::Released)),
+                null,
+            ],
+            'per version, but incompatible' => [
+                self::profile(Tier::ReleasePerVersion, self::matrix(ReleaseState::Incompatible, ['x'])),
+                null,
+            ],
+        ];
+    }
+
+    public function testAReleasePerVersionProfileIsReleasedWhileUntested(): void
+    {
+        $_POST['profile'] = 'fake';
+        $releases = self::store();
+        $releases->expects('add')->once();
+        Actions\expectDone('lit_mcp_compat_changed')->once();
+
+        $profile = self::profile(Tier::ReleasePerVersion, self::matrix(ReleaseState::Untested));
+
+        $this->tab($profile, self::report(), $releases, new FakeChangeLog())->release();
+
+        self::assertStringContainsString('lit_mcp_notice=compat_released', (string) $this->redirect);
+    }
+
+    public function testAnUnknownProfileIsRefusedBeforeTheNonceOrAnyStore(): void
+    {
+        $this->actionsDie();
+        Actions\expectDone('lit_mcp_compat_changed')->never();
+        $releases = self::store();
+        $releases->expects('add')->never();
+        $releases->expects('withdraw')->never();
+
+        foreach (['nope', '', "fake' OR 1=1"] as $id) {
+            $_POST['profile'] = $id;
+            foreach (['release', 'withdraw'] as $method) {
+                try {
+                    $this->tab(self::profile(), self::report(), $releases)->$method();
+                    self::fail('expected the request to stop');
+                } catch (\RuntimeException $e) {
+                    self::assertSame('died', $e->getMessage());
+                }
+            }
+        }
+        self::assertNull($this->redirect);
+        self::assertSame([], $this->nonces);
+    }
+
+    public function testAMissingProfileFieldIsRefused(): void
+    {
+        $this->actionsDie();
+        unset($_POST['profile']);
+
+        $this->expectException(\RuntimeException::class);
+
+        $this->tab(self::profile())->release();
+    }
+
+    public function testActionsNeedManageOptionsAndTheNonceOfTheProfile(): void
+    {
+        $_POST['profile'] = 'fake';
+        $this->actionsDie();
+        Functions\when('current_user_can')->justReturn(false);
+        $releases = self::store();
+        $releases->expects('add')->never();
+        $releases->expects('withdraw')->never();
+        foreach (['release', 'withdraw'] as $method) {
+            try {
+                $this->tab(self::profile(), self::report(), $releases)->$method();
+                self::fail('expected 403');
+            } catch (\RuntimeException $e) {
+                self::assertSame('died', $e->getMessage());
+            }
+        }
+
+        // With the right but a failing nonce check (wrong nonce: WordPress dies) nothing is stored either.
+        Functions\when('current_user_can')->justReturn(true);
+        Functions\when('check_admin_referer')->alias(static function (): never {
+            throw new \RuntimeException('bad nonce');
+        });
+        foreach (['release', 'withdraw'] as $method) {
+            try {
+                $this->tab(self::profile(), self::report(), $releases)->$method();
+                self::fail('expected the nonce to stop');
+            } catch (\RuntimeException $e) {
+                self::assertSame('bad nonce', $e->getMessage());
+            }
+        }
+    }
+
+    public function testWithdrawRemovesTheEntryOfTheInstalledVersionLogsItAndAnnouncesTheChange(): void
+    {
+        $_POST['profile'] = 'fake';
+        $releases = self::store(self::entry());
+        $releases->expects('withdraw')->once()->with('1.2.0', Plugin::VERSION)->andReturn(true);
+        $log = new FakeChangeLog();
+        Actions\expectDone('lit_mcp_compat_changed')->once()->with('fake');
+
+        $this->tab(self::profile(), null, $releases, $log)->withdraw();
+
+        self::assertSame(['lit_mcp_compat_withdraw_fake'], $this->nonces);
+        self::assertStringContainsString('lit_mcp_notice=compat_withdrawn', (string) $this->redirect);
+        self::assertStringContainsString('lit_mcp_profile=fake', (string) $this->redirect);
+        self::assertSame('lit/fake-release', $log->records[0]['ability']);
+    }
+
+    public function testWithdrawWithoutAnEntryFails(): void
+    {
+        $_POST['profile'] = 'fake';
+        $releases = self::store();
+        $releases->expects('withdraw')->once()->andReturn(false);
+        Actions\expectDone('lit_mcp_compat_changed')->never();
+
+        $this->tab(self::profile(), null, $releases)->withdraw();
+
+        self::assertStringContainsString('lit_mcp_notice=compat_withdraw_failed', (string) $this->redirect);
+    }
+
+    public function testUntestedWithAFreshGreenReportOffersTheRelease(): void
+    {
+        $profile = self::profile(Tier::ReleasePerVersion, self::matrix(ReleaseState::Untested));
+
+        $html = self::html($this->tab($profile, self::report()));
+
+        self::assertStringContainsString('name="action" value="lit_mcp_compat_release"', $html);
+        self::assertStringContainsString('name="profile" value="fake"', $html);
+        self::assertStringContainsString('value="nonce-lit_mcp_compat_release_fake"', $html);
+        self::assertStringContainsString('1.2.0 freigeben', $html);
+        self::assertStringNotContainsString('lit_mcp_compat_withdraw', $html);
+    }
+
+    public function testUntestedWithoutAFreshReportAsksForACheckInsteadOfOfferingTheRelease(): void
+    {
+        $profile = self::profile(Tier::ReleasePerVersion, self::matrix(ReleaseState::Untested));
+
+        foreach ([null, self::report(false)] as $report) {
+            $html = self::html($this->tab($profile, $report));
+
+            self::assertStringNotContainsString('lit_mcp_compat_release', $html);
+            self::assertStringContainsString('Freigeben geht erst nach einer vollständig grünen Prüfung', $html);
+        }
+    }
+
+    public function testAReleasedPerVersionProfileOffersNeitherReleaseNorWithdrawal(): void
+    {
+        $profile = self::profile(Tier::ReleasePerVersion, self::matrix(ReleaseState::Released));
+
+        $html = self::html($this->tab($profile, self::report()));
+
+        self::assertStringNotContainsString('lit_mcp_compat_release', $html);
+        self::assertStringNotContainsString('lit_mcp_compat_withdraw', $html);
+    }
+
+    public function testLockOnFailureOffersTheReleaseForAVersionNotTestedInThePlugin(): void
+    {
+        $html = self::html($this->tab(self::profile(), self::report()));
+
+        self::assertStringContainsString('value="lit_mcp_compat_release"', $html);
+        self::assertStringNotContainsString('lit_mcp_compat_withdraw', $html);
+    }
+
+    public function testATestedVersionAndReportOnlyOfferNoRelease(): void
+    {
+        foreach ([self::profile(tested: ['1.2.0']), self::profile(Tier::ReportOnly)] as $profile) {
+            $html = self::html($this->tab($profile, self::report()));
+
+            self::assertStringNotContainsString('lit_mcp_compat_release', $html);
+            self::assertStringNotContainsString('Freigeben geht erst', $html);
+        }
+    }
+
+    public function testAnExistingReleaseCanBeWithdrawnWhateverTheState(): void
+    {
+        foreach ([ReleaseState::Released, ReleaseState::Incompatible] as $state) {
+            $profile = self::profile(Tier::ReleasePerVersion, self::matrix($state, $state === ReleaseState::Released ? [] : ['x']));
+
+            $html = self::html($this->tab($profile, self::report(), self::store(self::entry())));
+
+            self::assertStringContainsString('value="lit_mcp_compat_withdraw"', $html);
+            self::assertStringContainsString('value="nonce-lit_mcp_compat_withdraw_fake"', $html);
+            self::assertStringNotContainsString('value="lit_mcp_compat_release"', $html);
+        }
+    }
+}
diff --git a/tests/Unit/Admin/SettingsPageTest.php b/tests/Unit/Admin/SettingsPageTest.php
index bd78ba7..c8e3fae 100644
--- a/tests/Unit/Admin/SettingsPageTest.php
+++ b/tests/Unit/Admin/SettingsPageTest.php
@@ -25,7 +25,7 @@ final class SettingsPageTest extends TestCase
 
     protected function tearDown(): void
     {
-        unset($_GET['tab'], $_GET['lit_mcp_notice']);
+        unset($_GET['tab'], $_GET['lit_mcp_notice'], $_GET['lit_mcp_profile']);
         parent::tearDown();
     }
 
@@ -195,9 +195,6 @@ final class SettingsPageTest extends TestCase
     public static function diviNotices(): array
     {
         return [
-            ['divi_checked', 'success', 'Divi-Prüfung abgeschlossen'],
-            ['divi_check_running', 'warning', 'bereits eine Divi-Prüfung'],
-            ['divi_check_failed', 'error', 'PHP-Error-Log'],
             ['divi_released', 'success', 'für LIT MCP freigegeben'],
             ['divi_release_refused', 'error', 'Prüfung erneut ausführen'],
             ['divi_withdrawn', 'success', 'Freigabe zurückgezogen'],
@@ -205,11 +202,96 @@ final class SettingsPageTest extends TestCase
         ];
     }
 
-    public function testTheNoticeParameterIsRemovedFromTheAddressBarAfterwards(): void
+    /** @dataProvider compatNotices */
+    public function testCompatNoticesNameTheKnownProfile(string $key, string $class, string $text): void
+    {
+        Functions\when('current_user_can')->justReturn(true);
+        $_GET['lit_mcp_notice'] = $key;
+        $_GET['lit_mcp_profile'] = 'pods';
+
+        ob_start();
+        $this->pageWithProfiles()->render();
+        $html = (string) ob_get_clean();
+
+        self::assertStringContainsString('notice-' . $class, $html);
+        self::assertStringContainsString('Pods &lt;1&gt;: ', $html);
+        self::assertStringContainsString($text, $html);
+    }
+
+    /** @return list<list<string>> */
+    public static function compatNotices(): array
+    {
+        return [
+            ['compat_checked', 'success', 'Prüfung abgeschlossen'],
+            ['compat_check_running', 'warning', 'bereits eine Prüfung'],
+            ['compat_check_failed', 'error', 'PHP-Error-Log'],
+            ['compat_released', 'success', 'freigegeben'],
+            ['compat_release_refused', 'error', 'Prüfung erneut ausführen'],
+            ['compat_withdrawn', 'success', 'Freigabe zurückgezogen'],
+            ['compat_withdraw_failed', 'error', 'keine Freigabe'],
+        ];
+    }
+
+    public function testAnUnknownProfileInTheNoticeIsIgnored(): void
+    {
+        Functions\when('current_user_can')->justReturn(true);
+        $_GET['lit_mcp_notice'] = 'compat_checked';
+        $_GET['lit_mcp_profile'] = '<script>x</script>';
+
+        ob_start();
+        $this->pageWithProfiles()->render();
+        $html = (string) ob_get_clean();
+
+        self::assertStringContainsString('Prüfung abgeschlossen', $html);
+        self::assertStringNotContainsString('script', $html);
+        self::assertStringNotContainsString('Pods', $html);
+    }
+
+    /** The checks of all profiles end in compat_* notices; the old Divi-only check notices are gone. */
+    public function testTheRetiredDiviCheckNoticesShowNothing(): void
+    {
+        Functions\when('current_user_can')->justReturn(true);
+
+        foreach (['divi_checked', 'divi_check_running', 'divi_check_failed'] as $key) {
+            $_GET['lit_mcp_notice'] = $key;
+            ob_start();
+            $this->pageWithProfiles()->render();
+
+            self::assertStringNotContainsString('class="notice', (string) ob_get_clean(), $key);
+        }
+    }
+
+    public function testArrayValuesInTheQueryAreIgnoredWithoutAWarning(): void
+    {
+        Functions\when('current_user_can')->justReturn(true);
+        $_GET['tab'] = ['x'];
+        $_GET['lit_mcp_notice'] = ['compat_checked'];
+        $_GET['lit_mcp_profile'] = ['pods'];
+
+        ob_start();
+        $this->pageWithProfiles()->render();
+        $html = (string) ob_get_clean();
+
+        self::assertStringNotContainsString('class="notice', $html);
+        $_GET['lit_mcp_notice'] = 'compat_checked';
+        ob_start();
+        $this->pageWithProfiles()->render();
+        self::assertStringNotContainsString('Pods', (string) ob_get_clean());
+    }
+
+    private function pageWithProfiles(): SettingsPage
+    {
+        return new SettingsPage(
+            [$this->tab('verbindung', 'Verbindung')],
+            profileLabel: static fn (string $id): ?string => $id === 'pods' ? 'Pods <1>' : null
+        );
+    }
+
+    public function testTheNoticeParametersAreRemovedFromTheAddressBarAfterwards(): void
     {
         $page = new SettingsPage([$this->tab('verbindung', 'Verbindung')]);
 
-        self::assertSame(['a', 'lit_mcp_notice'], $page->removableQueryArgs(['a']));
+        self::assertSame(['a', 'lit_mcp_notice', 'lit_mcp_profile'], $page->removableQueryArgs(['a']));
     }
 
     public function testAddsAnOverviewHelpTab(): void
@@ -221,6 +303,7 @@ final class SettingsPageTest extends TestCase
             static fn (array $tab): bool => $tab['id'] === 'lit-mcp-overview'
                 && str_contains($tab['content'], 'Tab „Verbindung“')
                 && str_contains($tab['content'], 'Tab „Tools“')
+                && str_contains($tab['content'], 'Tab „Compatibility“')
         ));
 
         (new SettingsPage([$this->tab('verbindung', 'Verbindung')]))->helpTabFor($screen);
diff --git a/tests/Unit/Compatibility/ProfileTest.php b/tests/Unit/Compatibility/ProfileTest.php
index 56862bb..09ae58d 100644
--- a/tests/Unit/Compatibility/ProfileTest.php
+++ b/tests/Unit/Compatibility/ProfileTest.php
@@ -5,6 +5,7 @@ declare(strict_types=1);
 namespace LIT\MCP\Tests\Unit\Compatibility;
 
 use LIT\MCP\Compatibility\CompatibilityMatrix;
+use LIT\MCP\Compatibility\CheckStep;
 use LIT\MCP\Compatibility\ManifestCheck;
 use LIT\MCP\Compatibility\Profile;
 use LIT\MCP\Compatibility\Tier;
@@ -57,10 +58,12 @@ final class ProfileTest extends TestCase
         self::assertNull($bare->stateKey);
         self::assertNull($bare->extraSteps);
         self::assertNull($bare->manifestCheck);
+        self::assertNull($bare->stepLabel);
 
         $stateKey = static fn (string $version): string => 'k' . $version;
         $extraSteps = static fn (bool $manifestClean): array => [];
         $manifestCheck = static fn (): ManifestCheck => new ManifestCheck([], signatures: false);
+        $stepLabel = static fn (CheckStep $step): string => 'L' . $step->key;
         $full = new Profile(
             id: 'fake',
             label: 'Fake',
@@ -69,12 +72,14 @@ final class ProfileTest extends TestCase
             testedVersions: ['1.0'],
             stateKey: $stateKey,
             extraSteps: $extraSteps,
-            manifestCheck: $manifestCheck
+            manifestCheck: $manifestCheck,
+            stepLabel: $stepLabel
         );
         self::assertSame(['1.0'], $full->testedVersions);
         self::assertSame($stateKey, $full->stateKey);
         self::assertSame($extraSteps, $full->extraSteps);
         self::assertSame($manifestCheck, $full->manifestCheck);
+        self::assertSame($stepLabel, $full->stepLabel);
     }
 
     public function testAReleasePerVersionProfileWithoutMatrixIsAProgrammingError(): void
diff --git a/tests/Unit/Integrations/Divi/DiviIntegrationTest.php b/tests/Unit/Integrations/Divi/DiviIntegrationTest.php
index dc1f093..a2c2b1c 100644
--- a/tests/Unit/Integrations/Divi/DiviIntegrationTest.php
+++ b/tests/Unit/Integrations/Divi/DiviIntegrationTest.php
@@ -20,7 +20,6 @@ use LIT\MCP\Integrations\Divi\DiviEnvironmentComponent;
 use LIT\MCP\Integrations\Divi\DiviIntegration;
 use LIT\MCP\Integrations\Divi\DiviLogoUsage;
 use LIT\MCP\Integrations\Divi\Pages\DiviContentComposer;
-use LIT\MCP\Integrations\Divi\Release\DiviCheckRoute;
 use LIT\MCP\Integrations\Divi\Release\DiviFeature;
 use LIT\MCP\Integrations\Divi\Release\DiviProfile;
 use LIT\MCP\Integrations\Divi\Release\ReleaseResolver;
@@ -325,9 +324,12 @@ final class DiviIntegrationTest extends TestCase
                 $upgraded = $callback;
             }
         );
-        Actions\expectAdded('rest_api_init')->once()->with(Mockery::on(
-            static fn (array $callback): bool => $callback[0] instanceof DiviCheckRoute
-        ));
+        $changed = null;
+        Actions\expectAdded('lit_mcp_compat_changed')->once()->whenHappen(
+            static function (callable $callback) use (&$changed): void {
+                $changed = $callback;
+            }
+        );
         Filters\expectAdded(SettingsPage::TABS_FILTER)->once()->whenHappen(
             static function (callable $callback) use (&$tabs): void {
                 $tabs = $callback;
@@ -339,6 +341,10 @@ final class DiviIntegrationTest extends TestCase
         (new DiviIntegration(Mockery::mock(ContentSchema::class), FakeChangeLog::forbidden()))->boot();
         self::assertIsCallable($upgraded);
         $upgraded();
+        // The route announces a finished check; only Divi's own profile resets the release gate (once, no mirrors).
+        self::assertIsCallable($changed);
+        $changed('pods');
+        $changed('divi');
         self::assertIsCallable($tabs);
         $all = $tabs([$base]);
 
diff --git a/tests/Unit/Integrations/Divi/Release/DiviCheckRouteTest.php b/tests/Unit/Integrations/Divi/Release/DiviCheckRouteTest.php
deleted file mode 100644
index aa89c3a..0000000
--- a/tests/Unit/Integrations/Divi/Release/DiviCheckRouteTest.php
+++ /dev/null
@@ -1,161 +0,0 @@
-<?php
-
-declare(strict_types=1);
-
-namespace LIT\MCP\Tests\Unit\Integrations\Divi\Release;
-
-use Brain\Monkey\Functions;
-use LIT\MCP\Compatibility\CheckReport;
-use LIT\MCP\Compatibility\CheckReportStore;
-use LIT\MCP\Compatibility\CompatibilityCheck;
-use LIT\MCP\Integrations\Divi\Release\DiviCheckRoute;
-use LIT\MCP\Tests\Unit\TestCase;
-use Mockery;
-use RuntimeException;
-
-final class DiviCheckRouteTest extends TestCase
-{
-    protected function setUp(): void
-    {
-        parent::setUp();
-        Functions\when('admin_url')->alias(static fn (string $path = ''): string => 'https://k.de/wp-admin/' . $path);
-        Functions\when('add_query_arg')->alias(
-            static fn (array $args, string $url): string => $url . '?' . http_build_query($args)
-        );
-        Functions\when('get_current_user_id')->justReturn(1);
-    }
-
-    protected function tearDown(): void
-    {
-        unset($GLOBALS['wpdb']);
-        parent::tearDown();
-    }
-
-    /** Mock of the global $wpdb, its INSERT IGNORE returning $inserted rows affected. */
-    private static function wpdb(int $inserted): \wpdb
-    {
-        $db = Mockery::mock(\wpdb::class)->makePartial();
-        $db->expects('query')->once()->with(Mockery::on(static function (string $sql): bool {
-            return str_starts_with(
-                $sql,
-                "INSERT IGNORE INTO wp_options (option_name, option_value, autoload) "
-                    . "VALUES ('lit_mcp_divi_check_lock', '"
-            ) && str_ends_with($sql, "', 'no')");
-        }))->andReturn($inserted);
-        $GLOBALS['wpdb'] = $db;
-
-        return $db;
-    }
-
-    public function testRegistersAPostRouteForAdministratorsOnly(): void
-    {
-        Functions\expect('register_rest_route')->once()->with(
-            'lit-mcp/v1',
-            '/divi-check',
-            Mockery::on(static function (array $args): bool {
-                Functions\when('current_user_can')->alias(static fn (string $cap): bool => $cap === 'manage_options');
-                $allowed = ($args['permission_callback'])();
-                Functions\when('current_user_can')->justReturn(false);
-
-                return $args['methods'] === 'POST' && $allowed === true && ($args['permission_callback'])() === false;
-            })
-        );
-
-        (new DiviCheckRoute(static fn () => null))->registerRoute();
-    }
-
-    public function testRunsTheCheckStoresTheReportAndRedirectsToTheTab(): void
-    {
-        self::wpdb(1);
-        $report = new CheckReport('r1', 'd', 1, '5.3.0', '0.6.0', 'k', []);
-        $check = Mockery::mock(CompatibilityCheck::class);
-        $check->expects('run')->with(1)->andReturn($report);
-        $reports = Mockery::mock(CheckReportStore::class);
-        $reports->expects('save')->with($report);
-        Functions\expect('delete_option')->once()->with(DiviCheckRoute::LOCK);
-
-        $response = (new DiviCheckRoute(static fn () => $check, $reports))->handle();
-
-        self::assertSame(303, $response->get_status());
-        self::assertStringContainsString('tab=divi', $response->get_headers()['Location']);
-        self::assertStringContainsString('lit_mcp_notice=divi_checked', $response->get_headers()['Location']);
-    }
-
-    public function testASecondCheckWaitsForTheFirst(): void
-    {
-        $db = self::wpdb(0);
-        $db->expects('get_var')->once()->andReturn((string) time());
-        Functions\expect('delete_option')->never();
-        $reports = Mockery::mock(CheckReportStore::class);
-        $reports->expects('save')->never();
-
-        $response = (new DiviCheckRoute(static fn () => self::fail('no second check'), $reports))->handle();
-
-        self::assertStringContainsString('lit_mcp_notice=divi_check_running', $response->get_headers()['Location']);
-    }
-
-    public function testAStaleLockIsTakenOver(): void
-    {
-        $db = self::wpdb(0);
-        $db->expects('get_var')->once()->andReturn('1');
-        $db->expects('query')->once()->with(Mockery::on(static function (string $sql): bool {
-            return str_starts_with($sql, "UPDATE wp_options SET option_value = '")
-                && str_ends_with(
-                    $sql,
-                    "' WHERE option_name = 'lit_mcp_divi_check_lock' AND option_value = '1'"
-                );
-        }))->andReturn(1);
-        Functions\expect('delete_option')->once()->with(DiviCheckRoute::LOCK);
-        $check = Mockery::mock(CompatibilityCheck::class);
-        $check->expects('run')->andReturn(new CheckReport('r1', 'd', 1, '5.3.0', '0.6.0', 'k', []));
-        $reports = Mockery::mock(CheckReportStore::class);
-        $reports->expects('save');
-
-        $response = (new DiviCheckRoute(static fn () => $check, $reports))->handle();
-
-        self::assertStringContainsString('lit_mcp_notice=divi_checked', $response->get_headers()['Location']);
-    }
-
-    public function testATakeoverLostToAnotherRequestWaitsForIt(): void
-    {
-        $db = self::wpdb(0);
-        $db->expects('get_var')->once()->andReturn('1');
-        $db->expects('query')->once()->with(Mockery::on(static fn (string $sql): bool => str_starts_with(
-            $sql,
-            "UPDATE wp_options SET option_value = '"
-        )))->andReturn(0);
-        Functions\expect('delete_option')->never();
-        $reports = Mockery::mock(CheckReportStore::class);
-        $reports->expects('save')->never();
-
-        $response = (new DiviCheckRoute(static fn () => self::fail('no second check'), $reports))->handle();
-
-        self::assertStringContainsString('lit_mcp_notice=divi_check_running', $response->get_headers()['Location']);
-    }
-
-    public function testTheLockIsReleasedAndTheCheckMarkedFailedWhenItThrows(): void
-    {
-        self::wpdb(1);
-        Functions\expect('delete_option')->once()->with(DiviCheckRoute::LOCK);
-        $check = Mockery::mock(CompatibilityCheck::class);
-        $check->expects('run')->andThrow(new RuntimeException('divi kaputt'));
-        $reports = Mockery::mock(CheckReportStore::class);
-        $reports->expects('save')->never();
-        // error_log() is a PHP internal and cannot be stubbed; redirect it to a temp file instead.
-        $log = (string) tempnam(sys_get_temp_dir(), 'lit-mcp-log');
-        $previous = ini_set('error_log', $log);
-
-        try {
-            $response = (new DiviCheckRoute(static fn () => $check, $reports))->handle();
-        } finally {
-            ini_set('error_log', (string) $previous);
-        }
-
-        self::assertStringContainsString('lit_mcp_notice=divi_check_failed', $response->get_headers()['Location']);
-        self::assertStringContainsString(
-            'divi check failed: RuntimeException: divi kaputt',
-            (string) file_get_contents($log)
-        );
-        unlink($log);
-    }
-}
diff --git a/tests/Unit/Integrations/Divi/Release/DiviProfileTest.php b/tests/Unit/Integrations/Divi/Release/DiviProfileTest.php
index b1e87f8..f2747e7 100644
--- a/tests/Unit/Integrations/Divi/Release/DiviProfileTest.php
+++ b/tests/Unit/Integrations/Divi/Release/DiviProfileTest.php
@@ -5,10 +5,12 @@ declare(strict_types=1);
 namespace LIT\MCP\Tests\Unit\Integrations\Divi\Release;
 
 use Brain\Monkey\Functions;
+use LIT\MCP\Compatibility\CheckStep;
 use LIT\MCP\Compatibility\ManifestCheck;
 use LIT\MCP\Compatibility\ReleaseState;
 use LIT\MCP\Compatibility\Tier;
 use LIT\MCP\Integrations\Divi\Release\DiviAdapters;
+use LIT\MCP\Integrations\Divi\Release\DiviCheckSteps;
 use LIT\MCP\Integrations\Divi\Release\DiviFeature;
 use LIT\MCP\Integrations\Divi\Release\DiviProfile;
 use LIT\MCP\Integrations\Divi\Release\DiviReleases;
@@ -71,5 +73,9 @@ final class DiviProfileTest extends TestCase
         self::assertSame(DiviReleases::TESTED, $profile->testedVersions);
         self::assertSame(ReleaseResolver::stateKey('5.3.0'), ($profile->stateKey)('5.3.0'));
         self::assertInstanceOf(ManifestCheck::class, ($profile->manifestCheck)());
+        // Reports saved before step labels were stored still get their Divi labels.
+        $old = new CheckStep(DiviCheckSteps::WRITE, []);
+        self::assertSame(DiviCheckSteps::label($old), ($profile->stepLabel)($old));
+        self::assertNotSame(DiviCheckSteps::WRITE, ($profile->stepLabel)($old));
     }
 }
diff --git a/tests/Unit/PluginTest.php b/tests/Unit/PluginTest.php
index 0bcfa02..87e117d 100644
--- a/tests/Unit/PluginTest.php
+++ b/tests/Unit/PluginTest.php
@@ -9,6 +9,7 @@ use Brain\Monkey\Filters;
 use Brain\Monkey\Functions;
 use LIT\MCP\Abilities\ExposurePolicy;
 use LIT\MCP\Abilities\ToolAvailability;
+use LIT\MCP\Admin\CompatibilityTab;
 use LIT\MCP\Admin\SettingsPage;
 use LIT\MCP\Compatibility\CapabilityGate;
 use LIT\MCP\Compatibility\Compatibility;
@@ -52,11 +53,11 @@ final class PluginTest extends TestCase
         );
     }
 
-    /** Only the Divi integration has boot steps; a second boot registers nothing twice. */
+    /** Only the Divi integration has boot steps (upgrader hook, compat listener, tab); a second boot registers nothing twice. */
     public function testTheBootableIntegrationsBootExactlyOnce(): void
     {
         Actions\expectAdded('upgrader_process_complete')->once();
-        Actions\expectAdded('rest_api_init')->once();
+        Actions\expectAdded('lit_mcp_compat_changed')->once();
         Filters\expectAdded(SettingsPage::TABS_FILTER)->once();
         $registry = self::registry();
 
@@ -137,6 +138,26 @@ final class PluginTest extends TestCase
         self::assertInstanceOf(CapabilityGate::class, $guards[1]);
     }
 
+    /** The tab "Compatibility" gets the registry's Compatibility: one section per profile, Divi and Pods. */
+    public function testTheCompatibilityTabShowsEveryProfileOfTheRegistry(): void
+    {
+        Functions\stubEscapeFunctions();
+        Functions\stubTranslationFunctions();
+        $theme = Mockery::mock();
+        $theme->allows('get_template')->andReturn('twentytwentyfive');
+        Functions\when('wp_get_theme')->justReturn($theme);
+        $tab = Plugin::compatibilityTab(self::registry(), FakeChangeLog::forbidden());
+
+        ob_start();
+        $tab->render();
+        $html = (string) ob_get_clean();
+
+        self::assertInstanceOf(CompatibilityTab::class, $tab);
+        self::assertSame('compatibility', $tab->slug());
+        self::assertStringContainsString('id="lit-mcp-compat-divi"', $html);
+        self::assertStringContainsString('id="lit-mcp-compat-pods"', $html);
+    }
+
     private static function readOnly(object $source): bool
     {
         return (new ReflectionProperty($source, 'readOnly'))->getValue($source);
diff --git a/tests/Unit/UninstallTest.php b/tests/Unit/UninstallTest.php
index 49f09b1..7394880 100644
--- a/tests/Unit/UninstallTest.php
+++ b/tests/Unit/UninstallTest.php
@@ -11,7 +11,6 @@ use LIT\MCP\Access;
 use LIT\MCP\Admin\ConnectionStatus;
 use LIT\MCP\ChangeLog\ChangeLogCleanup;
 use LIT\MCP\ChangeLog\ChangeLogInstaller;
-use LIT\MCP\Integrations\Divi\Release\DiviCheckRoute;
 use LIT\MCP\Integrations\Divi\Release\ReleaseResolver;
 use LIT\MCP\Limits;
 use LIT\MCP\Updater\RecheckOnInstall;
@@ -54,7 +53,7 @@ final class UninstallTest extends TestCase
 
         $own = [
             Access::OPTION, ExposurePolicy::OPTION, Limits::OPTION, ChangeLogInstaller::VERSION_OPTION,
-            'lit_mcp_divi_releases', 'lit_mcp_divi_check_report', DiviCheckRoute::LOCK,
+            'lit_mcp_divi_releases', 'lit_mcp_divi_check_report', 'lit_mcp_divi_check_lock',
             'lit_mcp_pods_releases', 'lit_mcp_pods_check_report', 'lit_mcp_pods_check_lock',
             'lit_mcp_snapshots_colors', 'lit_mcp_snapshots_variables', 'lit_mcp_snapshots_presets',
             'lit_mcp_snapshots_theme_options', 'lit_mcp_snapshots_custom_css',
diff --git a/tests/Unit/UninstallerTest.php b/tests/Unit/UninstallerTest.php
index cbc2570..90d7cc8 100644
--- a/tests/Unit/UninstallerTest.php
+++ b/tests/Unit/UninstallerTest.php
@@ -12,7 +12,6 @@ use LIT\MCP\Admin\ConnectionStatus;
 use LIT\MCP\Admin\LogTab;
 use LIT\MCP\ChangeLog\ChangeLogCleanup;
 use LIT\MCP\ChangeLog\ChangeLogInstaller;
-use LIT\MCP\Integrations\Divi\Release\DiviCheckRoute;
 use LIT\MCP\Integrations\Divi\Release\ReleaseResolver;
 use LIT\MCP\Limits;
 use LIT\MCP\Uninstaller;
@@ -60,7 +59,7 @@ final class UninstallerTest extends TestCase
         self::assertSame(
             [
                 Access::OPTION, ExposurePolicy::OPTION, Limits::OPTION, ChangeLogInstaller::VERSION_OPTION,
-                'lit_mcp_divi_releases', 'lit_mcp_divi_check_report', DiviCheckRoute::LOCK,
+                'lit_mcp_divi_releases', 'lit_mcp_divi_check_report', 'lit_mcp_divi_check_lock',
             'lit_mcp_pods_releases', 'lit_mcp_pods_check_report', 'lit_mcp_pods_check_lock',
                 'lit_mcp_snapshots_colors', 'lit_mcp_snapshots_variables', 'lit_mcp_snapshots_presets',
                 'lit_mcp_snapshots_theme_options', 'lit_mcp_snapshots_custom_css',