diff --git a/.github/scripts/scan.js b/.github/scripts/scan.js
index 7b1924b3f..2526dff2b 100644
--- a/.github/scripts/scan.js
+++ b/.github/scripts/scan.js
@@ -35,23 +35,50 @@ const CONFIG = {
     "tailwind.config.js",
     "tailwind.config.ts",
     "tailwind.config.cjs",
+    "tailwind.config.mjs",
     "tailwind.js",
     "postcss.config.js",
+    "postcss.config.ts",
     "postcss.config.mjs",
     "postcss.config.cjs",
     "babel.config.js",
+    "babel.config.ts",
+    "babel.config.mjs",
     "babel.config.cjs",
     "next.config.js",
+    "next.config.ts",
     "next.config.mjs",
     "next.config.cjs",
+    "eslint.config.js",
+    "eslint.config.ts",
+    "eslint.config.mjs",
+    "eslint.config.cjs",
     "astro.config.mjs",
     "astro.config.js",
     "vite.config.js",
     "vite.config.ts",
+    "vite.config.mjs",
+    "vite.config.cjs",
     "webpack.config.js",
     "webpack.mix.js",
+    "svelte.config.js",
+    "nuxt.config.ts",
   ],
 
+  // Font files — the campaign appends JS payloads to web fonts, which are
+  // never executed directly but are fetched by the build and used as a
+  // staging blob. Binary formats, so they are read as latin1.
+  fontExtensions: [".woff", ".woff2", ".ttf", ".otf", ".eot"],
+
+  // Minimum number of \uXXXX escape sequences in one file before it is
+  // treated as deliberately obfuscated. Legitimate source files use a
+  // handful at most; PolinRider samples carry 400–600.
+  maxLegitUnicodeEscapes: 20,
+
+  // Any single line longer than this inside a config file means code was
+  // appended past the real export block.
+  maxLegitConfigLineLength: 1000,
+
   // Files intentionally containing malware indicators for scanner logic/tests.
   // These filenames are skipped before malware rules are evaluated.
   ignoredFilenames: ["scan.js"],
@@ -187,14 +214,166 @@ const RULES = [
     },
   },
 
+  {
+    id: "POLINRIDER-018",
+    severity: "CRITICAL",
+    description:
+      "Unicode-escape string obfuscation — the payload writes plain ASCII literals such as require and https as \\u0068\\u0074\\u0074\\u0070 so that grep, code review, and GitHub diff search cannot see the API calls it makes",
+    test(content) {
+      // Only printable-ASCII escapes count. Minified vendor bundles legitimately
+      // carry hundreds of \uXXXX escapes, but those decode to emoji, diacritics
+      // and CJK ranges — escaping ASCII that could have been written literally
+      // has no purpose other than hiding it from a reader.
+      const asciiEscapes = (content.match(/\\u00[0-7][0-9a-fA-F]/g) || []).filter(
+        (e) => {
+          const code = parseInt(e.slice(2), 16);
+          return code >= 0x20 && code <= 0x7e;
+        },
+      );
+      return asciiEscapes.length >= CONFIG.maxLegitUnicodeEscapes
+        ? [
+            `${asciiEscapes.length} printable-ASCII \\uXXXX escapes (threshold: ${CONFIG.maxLegitUnicodeEscapes})`,
+          ]
+        : [];
+    },
+  },
+
+  {
+    id: "POLINRIDER-019",
+    severity: "CRITICAL",
+    description:
+      "Ethereum dead-drop C2 resolver — the attacker wallet's latest transaction encodes the C2 IP addresses in the 'to' field, so the C2 can be rotated without touching the implant",
+    test(_content, _filePath, _lines, decoded) {
+      const iocs = [
+        "0xa322e5f3d311d3080e6f0121063e9adc2490ef1a",
+        "eth.blockscout.com",
+        "eth_getBlockByNumber",
+        "eth_getTransactionCount",
+        "eth_blockNumber",
+        "ethereum-rpc.publicnode.com",
+        "eth-mainnet.public.blastapi.io",
+        "1rpc.io/eth",
+        "eth.drpc.org",
+      ];
+      const hay = decoded.toLowerCase();
+      return iocs.filter((i) => hay.includes(i));
+    },
+  },
+
+  {
+    id: "POLINRIDER-020",
+    severity: "CRITICAL",
+    description:
+      "Remote code execution stager — fetches a payload over HTTP, XOR-decrypts it, eval()s it in-process and re-launches it as a detached hidden node -e child process that survives the build exiting",
+    test(_content, _filePath, _lines, decoded) {
+      const hits = [];
+      if (/spawn\s*\(\s*["']node["']\s*,\s*\[\s*["']-e["']/.test(decoded))
+        hits.push('spawn("node", ["-e", <remote payload>])');
+      if (/detached\s*:\s*(!0|true)/.test(decoded))
+        hits.push("detached child process");
+      if (/stdio\s*:\s*["']ignore["']/.test(decoded))
+        hits.push('stdio:"ignore" (output suppressed)');
+      if (/\beval\s*\(\s*\w+\s*\+/.test(decoded))
+        hits.push("eval() of concatenated remote string");
+      if (/x-payload-b64/i.test(decoded))
+        hits.push("x-payload-b64 C2 response header");
+      // Only report when this is a genuine stager, not an isolated keyword.
+      return hits.length >= 2 ? hits : [];
+    },
+  },
+
+  {
+    id: "POLINRIDER-021",
+    severity: "CRITICAL",
+    description:
+      "Campaign marker + Node internals capture via dot notation — the implant stores its victim/campaign ID and re-exposes require/module on globalThis so later stages can load native modules from inside an ES module",
+    test(_content, _filePath, _lines, decoded) {
+      const hits = [];
+      const marker = decoded.match(
+        /global\s*\.\s*[a-zA-Z_$]\w*\s*=\s*["']([A-Z]{0,2}\d[\d-]{3,})["']/,
+      );
+      if (marker) hits.push(`campaign marker: "${marker[1]}"`);
+      if (/global\s*\.\s*\w+\s*=\s*require\b/.test(decoded))
+        hits.push("global.<x> = require");
+      if (/global\s*\.\s*\w+\s*=\s*module\b/.test(decoded))
+        hits.push("global.<x> = module");
+      return hits;
+    },
+  },
+
+  {
+    id: "POLINRIDER-022",
+    severity: "CRITICAL",
+    description:
+      "Web font file carrying an executable payload — .woff/.woff2 files are treated as opaque binary assets by reviewers and linters, so the campaign uses them to smuggle JavaScript past code review",
+    test(content, filePath) {
+      const ext = path.extname(filePath).toLowerCase();
+      if (!CONFIG.fontExtensions.includes(ext)) return [];
+
+      const hits = [];
+      const magic = content.slice(0, 4);
+      const expected = { ".woff": "wOFF", ".woff2": "wOF2", ".otf": "OTTO" };
+      if (expected[ext] && magic !== expected[ext]) {
+        hits.push(
+          `bad magic bytes: expected "${expected[ext]}", got "${magic.replace(/[^\x20-\x7e]/g, ".")}"`,
+        );
+      }
+      const codeMarkers = [
+        "require(",
+        "eval(",
+        "child_process",
+        "global.",
+        "createRequire",
+        "process.env",
+      ];
+      const found = codeMarkers.filter((m) => content.includes(m));
+      if (found.length > 0) {
+        hits.push(`embedded JS markers: ${found.join(", ")}`);
+      }
+      return hits;
+    },
+  },
+
+  {
+    id: "POLINRIDER-023",
+    severity: "CRITICAL",
+    description:
+      ".vscode/tasks.json configured to auto-execute on folder open — gives the campaign code execution the moment a developer opens the repo in VS Code, before any build or install command is run",
+    test(content, filePath) {
+      if (!/\.vscode[\\/]tasks\.json$/.test(filePath.replace(/\\/g, "/")))
+        return [];
+      const hits = [];
+      if (/"runOn"\s*:\s*"folderOpen"/.test(content))
+        hits.push('runOn: "folderOpen" (executes without user action)');
+      const cmd = content.match(/"command"\s*:\s*"([^"]{0,120})"/);
+      if (cmd && /node|curl|wget|powershell|bash|-e\b|eval/i.test(cmd[1]))
+        hits.push(`command: "${cmd[1]}"`);
+      return hits.length >= 1 ? hits : [];
+    },
+  },
+
+  {
+    id: "POLINRIDER-024",
+    severity: "HIGH",
+    description:
+      ".gitignore lists this campaign's persistence artifacts — the implant appends these entries so its own dropped files never appear in git status and the developer never sees them",
+    test(content, filePath) {
+      if (path.basename(filePath) !== ".gitignore") return [];
+      const lines = content.split("\n").map((l) => l.trim());
+      return CONFIG.persistenceArtifacts.filter((a) => lines.includes(a)).map(
+        (a) => `.gitignore hides "${a}"`,
+      );
+    },
+  },
+
   // ── Tier 2: Behavioral / structural indicators ─────────────────────────────
 
   {
     id: "POLINRIDER-009",
     severity: "HIGH",
     description:
-      "Blockchain RPC infrastructure contact — campaign uses TRON, Aptos, and BSC as dead-drop C2 resolvers",
-    test(content) {
+      "Blockchain RPC infrastructure contact — campaign uses TRON, Aptos, BSC and Ethereum as dead-drop C2 resolvers",
+    test(_content, _filePath, _lines, decoded) {
       const endpoints = [
         "trongrid.io",
         "aptoslabs.com",
@@ -202,7 +381,7 @@ const RULES = [
         "bsc-rpc.publicnode.com",
         "eth_getTransactionByHash",
       ];
-      return endpoints.filter((e) => content.includes(e));
+      return endpoints.filter((e) => decoded.includes(e));
     },
   },
 
@@ -210,11 +389,10 @@ const RULES = [
     id: "POLINRIDER-010",
     severity: "HIGH",
     description:
-      "Hidden process spawn with windowsHide:true — used by InvisibleFerret / BeaverTail stager to launch detached Node.js child processes invisibly",
-    test(content) {
-      return /windowsHide\s*:\s*true/.test(content)
-        ? ["windowsHide:true found"]
-        : [];
+      "Hidden process spawn with windowsHide — used by InvisibleFerret / BeaverTail stager to launch detached Node.js child processes invisibly. Matches both true and its minified form !0",
+    test(_content, _filePath, _lines, decoded) {
+      const m = decoded.match(/windowsHide\s*:\s*(true|!0)/);
+      return m ? [`windowsHide:${m[1]} found`] : [];
     },
   },
 
@@ -237,7 +415,10 @@ const RULES = [
     severity: "HIGH",
     description:
       "Payload hidden after large horizontal whitespace (>100 spaces on one line) — evasion technique to hide code off-screen in editors and GitHub diff views",
-    test(content, _filePath, lines) {
+    test(_content, filePath, lines) {
+      // Binary assets contain long runs of 0x20 as padding — not an indicator.
+      if (CONFIG.fontExtensions.includes(path.extname(filePath).toLowerCase()))
+        return [];
       const hits = [];
       lines.forEach((line, i) => {
         const spaceRun = line.match(/\s{100,}/);
@@ -269,6 +450,27 @@ const RULES = [
     },
   },
 
+  {
+    id: "POLINRIDER-025",
+    severity: "HIGH",
+    description:
+      "Minified code appended past the end of a config file — real config files are hand-written and line-wrapped; a single multi-thousand-character line means a payload was concatenated onto the original file",
+    test(_content, filePath, lines) {
+      const base = path.basename(filePath).toLowerCase();
+      if (!CONFIG.targetedFilenames.some((f) => f.toLowerCase() === base))
+        return [];
+      const hits = [];
+      lines.forEach((line, i) => {
+        if (line.length > CONFIG.maxLegitConfigLineLength) {
+          hits.push(
+            `line ${i + 1}: ${line.length} chars (threshold: ${CONFIG.maxLegitConfigLineLength})`,
+          );
+        }
+      });
+      return hits;
+    },
+  },
+
   {
     id: "POLINRIDER-014",
     severity: "HIGH",
@@ -330,25 +532,58 @@ const RULES = [
 
 // ─── Scanner Engine ────────────────────────────────────────────────────────────
 
+/**
+ * Resolve \uXXXX and \xXX escapes so string-matching rules see the real API
+ * calls. The campaign writes every literal as escapes specifically to defeat
+ * grep, so rules that match on plain text must run against this form.
+ * The decoded text is appended to the original rather than replacing it, so a
+ * rule can still match either representation with one pass.
+ */
+function deobfuscate(content) {
+  if (!/\\[ux]/.test(content)) return content;
+  const decoded = content
+    .replace(/\\u\{([0-9a-fA-F]{1,6})\}/g, (m, h) => {
+      try {
+        return String.fromCodePoint(parseInt(h, 16));
+      } catch {
+        return m;
+      }
+    })
+    .replace(/\\u([0-9a-fA-F]{4})/g, (_m, h) =>
+      String.fromCharCode(parseInt(h, 16)),
+    )
+    .replace(/\\x([0-9a-fA-F]{2})/g, (_m, h) =>
+      String.fromCharCode(parseInt(h, 16)),
+    );
+  return content + "\n/* --- deobfuscated --- */\n" + decoded;
+}
+
 function scanFile(filePath) {
   if (shouldIgnoreFile(filePath)) {
     return { filePath, findings: [], skipped: true };
   }
 
+  // Fonts are binary. latin1 maps bytes 1:1 to chars, so magic-byte checks and
+  // ASCII payload searches both work without mangling the content.
+  const isBinary = CONFIG.fontExtensions.includes(
+    path.extname(filePath).toLowerCase(),
+  );
+
   let content;
   try {
-    content = fs.readFileSync(filePath, "utf8");
+    content = fs.readFileSync(filePath, isBinary ? "latin1" : "utf8");
   } catch (err) {
     return { filePath, error: err.message, findings: [] };
   }
 
   const lines = content.split("\n");
+  const decoded = deobfuscate(content);
   const findings = [];
 
   for (const rule of RULES) {
     let matches;
     try {
-      matches = rule.test(content, filePath, lines);
+      matches = rule.test(content, filePath, lines, decoded);
     } catch (err) {
       matches = [`[rule error: ${err.message}]`];
     }
@@ -388,6 +623,7 @@ function walkDir(dir, results = []) {
     } else if (entry.isFile() && !shouldIgnoreFile(full)) {
       const ext = path.extname(entry.name).toLowerCase();
       const base = entry.name.toLowerCase();
+      const rel = full.replace(/\\/g, "/");
 
       // Scan all JS/TS config files + any file matching a targeted name
       const isTargetedName = CONFIG.targetedFilenames.some(
@@ -399,8 +635,18 @@ function walkDir(dir, results = []) {
       const isJsLike = [".js", ".mjs", ".cjs", ".ts", ".tsx", ".jsx"].includes(
         ext,
       );
+      const isFont = CONFIG.fontExtensions.includes(ext);
+      const isGitignore = base === ".gitignore";
+      const isVsCodeTask = /\.vscode\/tasks\.json$/.test(rel);
 
-      if (isTargetedName || isPersistenceArtifact || isJsLike) {
+      if (
+        isTargetedName ||
+        isPersistenceArtifact ||
+        isJsLike ||
+        isFont ||
+        isGitignore ||
+        isVsCodeTask
+      ) {
         results.push(full);
       }
     }
@@ -532,10 +778,141 @@ function printReport(allResults, { json = false, outputFile = null } = {}) {
   return infected.length > 0;
 }
 
+// ─── Self-test ─────────────────────────────────────────────────────────────────
+
+/**
+ * Runs the rule set against synthetic samples. Guards the two properties that
+ * matter: the live payload is still caught, and minified vendor bundles that
+ * legitimately contain \uXXXX escapes are still not flagged.
+ * Run with: node scan.js --self-test
+ */
+function selfTest() {
+  const os = require("os");
+  const tmp = fs.mkdtempSync(path.join(os.tmpdir(), "polinrider-selftest-"));
+  const write = (name, body) => {
+    const p = path.join(tmp, name);
+    fs.mkdirSync(path.dirname(p), { recursive: true });
+    fs.writeFileSync(p, body);
+    return p;
+  };
+
+  const esc = (s) =>
+    [...s].map((c) => "\\u" + c.charCodeAt(0).toString(16).padStart(4, "0")).join("");
+
+  const cases = [];
+
+  // 1. The live payload shape: ASCII-escaped strings + ETH dead drop + stager.
+  cases.push({
+    name: "infected postcss.config.js",
+    file: write(
+      "infected/postcss.config.js",
+      `export default { plugins: {} };` +
+        " ".repeat(300) +
+        `global.i="A8-4299";global.r=require;global.m=module;` +
+        `const http=require("${esc("http")}"),{spawn}=require("${esc("child_process")}");` +
+        `S="0xa322E5f3D311D3080e6f0121063e9aDC2490Ef1a".toLowerCase(),` +
+        `I="${esc("https://eth.blockscout.com/api")}";` +
+        `rc(t,"${esc("eth_getBlockByNumber")}");eval(r+o);` +
+        `spawn("node",["-e",r+o],{detached:!0,stdio:"${esc("ignore")}",windowsHide:!0});`,
+    ),
+    expect: true,
+  });
+
+  // 2. Clean config — must stay silent.
+  cases.push({
+    name: "clean postcss.config.js",
+    file: write(
+      "clean/postcss.config.js",
+      "export default {\n  plugins: {\n    tailwindcss: {},\n    autoprefixer: {},\n  },\n};\n",
+    ),
+    expect: false,
+  });
+
+  // 3. Minified vendor bundle with many non-ASCII escapes — must stay silent.
+  cases.push({
+    name: "minified vendor bundle",
+    file: write(
+      "vendor/emoji.min.js",
+      "var e=[" +
+        Array.from({ length: 400 }, (_, i) => `"\\ud83d\\ude${(i % 90) + 10}"`).join(",") +
+        "];",
+    ),
+    expect: false,
+  });
+
+  // 4. Font carrying an appended JS payload.
+  cases.push({
+    name: "trojanised .woff2",
+    file: write(
+      "fonts/bad.woff2",
+      "wOF2" + "".repeat(64) + 'require("child_process");global.x=1;eval(a+b);',
+    ),
+    expect: true,
+  });
+
+  // 5. Clean font — correct magic, no code markers.
+  cases.push({
+    name: "clean .woff2",
+    file: write("fonts/good.woff2", "wOF2" + "
".repeat(200)),
+    expect: false,
+  });
+
+  // 6. .gitignore hiding persistence artifacts.
+  cases.push({
+    name: ".gitignore with persistence artifacts",
+    file: write(
+      "ignore/.gitignore",
+      "node_modules/\ntemp_auto_push.bat\nbranch_structure.json\n",
+    ),
+    expect: true,
+  });
+
+  // 7. VS Code task auto-executing on folder open.
+  cases.push({
+    name: ".vscode/tasks.json auto-exec",
+    file: write(
+      "vscode/.vscode/tasks.json",
+      JSON.stringify({
+        version: "2.0.0",
+        tasks: [
+          {
+            label: "build",
+            command: "node -e require('http')",
+            runOptions: { runOn: "folderOpen" },
+          },
+        ],
+      }),
+    ),
+    expect: true,
+  });
+
+  let failed = 0;
+  for (const c of cases) {
+    const { findings } = scanFile(c.file);
+    const detected = findings.length > 0;
+    const ok = detected === c.expect;
+    if (!ok) failed++;
+    const ids = findings.map((f) => f.id).join(", ") || "none";
+    console.log(
+      `  ${ok ? `${ANSI.green}PASS${ANSI.reset}` : `${ANSI.red}FAIL${ANSI.reset}`}  ` +
+        `${c.name} — expected ${c.expect ? "detection" : "clean"}, got: ${ids}`,
+    );
+  }
+
+  fs.rmSync(tmp, { recursive: true, force: true });
+  console.log(
+    failed === 0
+      ? `\n${ANSI.green}${ANSI.bold}Self-test passed (${cases.length}/${cases.length}).${ANSI.reset}\n`
+      : `\n${ANSI.red}${ANSI.bold}Self-test FAILED: ${failed}/${cases.length} case(s).${ANSI.reset}\n`,
+  );
+  process.exit(failed === 0 ? 0 : 1);
+}
+
 // ─── CLI Entry Point ───────────────────────────────────────────────────────────
 
 function main() {
   const args = process.argv.slice(2);
+  if (args.includes("--self-test")) return selfTest();
   const jsonFlag = args.includes("--json");
   const outputFileIdx = args.indexOf("--output");
   const outputFile = outputFileIdx !== -1 ? args[outputFileIdx + 1] : null;
diff --git a/.github/workflows/deploy.yml b/.github/workflows/deploy.yml
index bdb4c5ff5..f8a1eb68e 100644
--- a/.github/workflows/deploy.yml
+++ b/.github/workflows/deploy.yml
@@ -10,8 +10,16 @@ permissions:
   contents: read
 
 jobs:
+  # Supply-chain gate. Every other job depends on this, so a malware detection
+  # blocks the entire deploy before any build, migration or container starts.
+  malware-scan:
+    name: Malware gate
+    uses: ./.github/workflows/malware-scan.yml
+    secrets: inherit
+
   detect-changes:
     name: Detect changed services
+    needs: malware-scan
     runs-on: ${{ fromJson(format('["self-hosted", "{0}"]', github.ref_name)) }}
     outputs:
       matrix: ${{ steps.filter.outputs.matrix }}
@@ -90,7 +98,7 @@ jobs:
 
   deploy:
     name: Deploy ${{ matrix.service }}
-    needs: detect-changes
+    needs: [malware-scan, detect-changes]
     if: ${{ needs.detect-changes.outputs.matrix != '[]' }}
     runs-on: ${{ fromJson(format('["self-hosted", "{0}"]', github.ref_name)) }}
     strategy:
diff --git a/.github/workflows/malware-scan.yml b/.github/workflows/malware-scan.yml
new file mode 100644
index 000000000..15ca4faeb
--- /dev/null
+++ b/.github/workflows/malware-scan.yml
@@ -0,0 +1,161 @@
+name: Malware Scan
+
+# Supply-chain malware gate for the PolinRider / Famous Chollima campaign.
+#
+# Runs standalone on every push and pull request, and is also called by
+# deploy.yml as a required first job — a detection fails this workflow, which
+# blocks every downstream deploy job from starting.
+
+on:
+  push:
+    # dev and staging are already gated through deploy.yml's required
+    # malware-scan job — no need to scan those pushes twice.
+    branches-ignore:
+      - dev
+      - staging
+  pull_request:
+  workflow_call:
+    secrets:
+      TELEGRAM_BOT_TOKEN:
+        required: false
+      TELEGRAM_CHAT_ID:
+        required: false
+
+permissions:
+  contents: read
+
+# A detection on a ref should not be raced by a newer run of the same ref.
+concurrency:
+  group: malware-scan-${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: true
+
+jobs:
+  scan:
+    name: Scan for PolinRider malware
+    # Plain `self-hosted` — GitHub applies this label to every self-hosted
+    # runner automatically. The scan is host-agnostic, unlike the deploy jobs
+    # which pin to a branch-specific runner.
+    runs-on: [self-hosted, dev]
+    outputs:
+      infected: ${{ steps.scan.outputs.infected }}
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v4
+
+      - name: Verify scanner rules still work
+        # Fails if someone weakens a detection rule or introduces a false
+        # positive against minified vendor bundles.
+        run: node .github/scripts/scan.js --self-test
+
+      - name: Scan repository
+        id: scan
+        run: |
+          set -uo pipefail
+
+          # Actions runs this with `bash -e`, so the non-zero exit must be
+          # caught with `||` rather than read back from $? afterwards.
+          STATUS=0
+          node .github/scripts/scan.js --json --output malware-report.json . || STATUS=$?
+
+          if [ "$STATUS" -eq 0 ]; then
+            echo "infected=false" >> "$GITHUB_OUTPUT"
+            echo "No malware detected."
+            exit 0
+          fi
+
+          echo "infected=true" >> "$GITHUB_OUTPUT"
+
+          # Human-readable run for the log, so the failure is legible in the UI.
+          node .github/scripts/scan.js . || true
+          exit 1
+
+      - name: Build alert message
+        id: message
+        if: failure() && steps.scan.outputs.infected == 'true'
+        run: |
+          set -euo pipefail
+
+          FILES=$(jq -r '.results[].filePath' malware-report.json | head -20)
+          COUNT=$(jq -r '.infectedFiles' malware-report.json)
+          RULES=$(jq -r '[.results[].findings[] | select(.severity=="CRITICAL") | .id] | unique | join(", ")' malware-report.json)
+
+          {
+            echo "message<<EOF"
+            echo "🚨 POLINRIDER MALWARE DETECTED — DEPLOY BLOCKED"
+            echo ""
+            echo "Repo:   ${GITHUB_REPOSITORY}"
+            echo "Branch: ${GITHUB_REF_NAME}"
+            echo "Commit: ${GITHUB_SHA}"
+            echo "Author: ${GITHUB_ACTOR}"
+            echo ""
+            echo "Infected files (${COUNT}):"
+            echo "${FILES}"
+            echo ""
+            echo "Critical rules: ${RULES:-none}"
+            echo ""
+            echo "Run: ${GITHUB_SERVER_URL}/${GITHUB_REPOSITORY}/actions/runs/${GITHUB_RUN_ID}"
+            echo ""
+            echo "Do NOT run pnpm install or any build on this checkout."
+            echo "Rotate every secret this repo's CI can reach."
+            echo "EOF"
+          } >> "$GITHUB_OUTPUT"
+
+      - name: Notify Telegram
+        if: failure() && steps.scan.outputs.infected == 'true'
+        env:
+          BOT_TOKEN: ${{ secrets.TELEGRAM_BOT_TOKEN }}
+          CHAT_ID: ${{ secrets.TELEGRAM_CHAT_ID }}
+          TEXT: ${{ steps.message.outputs.message }}
+        run: |
+          set -uo pipefail
+
+          if [ -z "${BOT_TOKEN:-}" ] || [ -z "${CHAT_ID:-}" ]; then
+            echo "::warning::TELEGRAM_BOT_TOKEN / TELEGRAM_CHAT_ID not set — skipping notification."
+            exit 0
+          fi
+
+          # No parse_mode: the payload contains characters Telegram's Markdown
+          # parser would reject, and a failed notification is worse than plain text.
+          HTTP=$(curl -sS -o /tmp/tg.out -w '%{http_code}' \
+            -X POST "https://api.telegram.org/bot${BOT_TOKEN}/sendMessage" \
+            --data-urlencode "chat_id=${CHAT_ID}" \
+            --data-urlencode "text=${TEXT}" \
+            --data-urlencode "disable_web_page_preview=true") || true
+
+          if [ "${HTTP:-000}" != "200" ]; then
+            echo "::warning::Telegram notification failed (HTTP ${HTTP:-000}): $(cat /tmp/tg.out 2>/dev/null | head -c 300)"
+          else
+            echo "Telegram alert sent."
+          fi
+          rm -f /tmp/tg.out
+
+      - name: Upload scan report
+        if: always() && hashFiles('malware-report.json') != ''
+        uses: actions/upload-artifact@v4
+        with:
+          name: malware-report-${{ github.run_id }}
+          path: malware-report.json
+          retention-days: 30
+
+      - name: Job summary
+        if: always()
+        run: |
+          set -uo pipefail
+          RESULT="${{ steps.scan.outputs.infected }}"
+
+          if [ "$RESULT" = "true" ]; then
+            {
+              echo "## 🚨 Malware detected — deployment blocked"
+              echo ""
+              echo '```'
+              jq -r '.results[] | .filePath, (.findings[] | "    [\(.id)] \(.severity) — \(.description)")' \
+                malware-report.json 2>/dev/null | head -100 || true
+              echo '```'
+            } >> "$GITHUB_STEP_SUMMARY"
+          elif [ "$RESULT" = "false" ]; then
+            echo "## ✅ No malware detected" >> "$GITHUB_STEP_SUMMARY"
+          else
+            # The scan step never produced a verdict — treat as inconclusive
+            # rather than clean, so a broken scanner is never read as a pass.
+            echo "## ⚠️ Scan did not complete — verdict unknown" >> "$GITHUB_STEP_SUMMARY"
+          fi
diff --git a/.gitignore b/.gitignore
index 18fdae9c2..63784b865 100644
--- a/.gitignore
+++ b/.gitignore
@@ -52,3 +52,4 @@ RUNNING_LOCALLY.md
 
 # Generated per-shard compose file for the integration suite (it.mjs).
 integration/.it-shards.yaml
+
diff --git a/apps/edr-freight-api/.env.example b/apps/edr-freight-api/.env.example
index 16ee9cd57..96af26034 100644
--- a/apps/edr-freight-api/.env.example
+++ b/apps/edr-freight-api/.env.example
@@ -122,3 +122,7 @@ FAYDA_SESSION_TTL_MINUTES=10
 EXPIRATION_TIME=15
 ALGORITHM=RS256
 EMAIL_QUEUE=email_queue
+
+# Shared secret for service-to-service calls (payment microservice <-> freight).
+# Required at boot; set ALLOW_UNAUTH_INTERNAL=true instead ONLY for local dev.
+SERVICE_AUTH_TOKEN=change-me
diff --git a/apps/edr-freight-api/src/app.module.ts b/apps/edr-freight-api/src/app.module.ts
index d41b77dce..c98990d25 100644
--- a/apps/edr-freight-api/src/app.module.ts
+++ b/apps/edr-freight-api/src/app.module.ts
@@ -53,7 +53,6 @@ import { OtpModule } from "./modules/otp/otp.module";
 import { HealthModule } from "./modules/health/health.module";
 import { RuleEngineModule } from "./modules/rule-engine/rule-engine.module";
 import { BackofficeModule } from "./modules/backoffice/backoffice.module";
-import { DemoPermissionsModule } from "./modules/demo-permissions/demo-permissions.module";
 import { FreightAuthModule } from "./modules/auth/freight-auth.module";
 import {
   EDR_FREIGHT_APPLICATION,
@@ -100,6 +99,7 @@ import { MaintenanceModule } from "./modules/maintenance/maintenance.module";
 import { ComplianceModule } from "./modules/compliance/compliance.module";
 import { IncidentsModule } from "./modules/incidents/incidents.module";
 import { ProcurementModule } from "./modules/procurement/procurement.module";
+import { FacilitiesModule } from "./modules/facilities/facilities.module";
 import { GpsTrackingModule } from "./modules/gps-tracking/gps-tracking.module";
 import { FirstMileModule } from "./modules/first-mile/first-mile.module";
 import { LastMileModule } from "./modules/last-mile/last-mile.module";
@@ -110,6 +110,7 @@ import { AiModule } from "./modules/ai/ai.module";
 import { AuditModule } from "./modules/audit/audit.module";
 import { LoggerMiddleware } from "./logger.middleware";
 import { LoginAudienceMiddleware } from "./modules/auth/login-audience.middleware";
+import { PositionTypePermissionsCache } from "./common/position-type-permissions.cache";
 
 if (!process.env.APPLICATION_NAME) {
   process.env.APPLICATION_NAME = "freight";
@@ -219,7 +220,6 @@ if (!process.env.APPLICATION_NAME) {
     HealthModule,
     RuleEngineModule,
     BackofficeModule,
-    DemoPermissionsModule,
     FreightAuthModule,
     PaymentModule,
     //New Modules
@@ -239,6 +239,7 @@ if (!process.env.APPLICATION_NAME) {
     ComplianceModule,
     IncidentsModule,
     ProcurementModule,
+    FacilitiesModule,
     GpsTrackingModule,
     FirstMileModule,
     LastMileModule,
@@ -273,6 +274,9 @@ if (!process.env.APPLICATION_NAME) {
     ApprovedFirstLastMileDemoBookingsSeeder,
     PaidImportExportMileDemoSeeder,
     LoginAudienceMiddleware,
+    // Feeds position-TYPE grants to the synchronous permission checks — without
+    // it, staff whose permissions live on their position type resolve to none.
+    PositionTypePermissionsCache,
   ],
 })
 export class AppModule implements OnApplicationBootstrap {
diff --git a/apps/edr-freight-api/src/common/booking-guards.ts b/apps/edr-freight-api/src/common/booking-guards.ts
index 854594ffc..49bd31c61 100644
--- a/apps/edr-freight-api/src/common/booking-guards.ts
+++ b/apps/edr-freight-api/src/common/booking-guards.ts
@@ -1,7 +1,11 @@
 import { applyDecorators, UseGuards } from '@nestjs/common';
 import { JwtGuard } from '@tria-plc/api-common/modules/auth/services/jwt.guard';
 
-import { FreightPermissionGuard } from './freight-permission.guard';
+import {
+  FreightPermissionGuard,
+  MixedAudienceGuard,
+  PortalCustomerGuard,
+} from './freight-permission.guard';
 import { FREIGHT_PERMS } from '../seed/freight-permissions.registry';
 
 export const BookingStaff = (permission: string | string[]) =>
@@ -18,8 +22,30 @@ export const BookingStaff = (permission: string | string[]) =>
  * Read-only reference data (yard dropdowns, search filters): any signed-in
  * staff. Menu/page visibility stays permission-gated in the frontend — this
  * only lets forms populate their lookups.
+ * Deprecated for new routes — it never checked the caller was staff. Prefer
+ * BookingStaff(<view key>) or MixedAudience(); kept for routes not yet swept.
  */
-export const StaffReference = () => applyDecorators(UseGuards(JwtGuard));
+export const StaffReference = () =>
+  applyDecorators(UseGuards(JwtGuard, FreightPermissionGuard([])));
+
+/** Portal routes: customer accounts only; ownership scoping stays in services. */
+export const PortalCustomer = () =>
+  applyDecorators(UseGuards(JwtGuard, PortalCustomerGuard));
+
+/**
+ * Routes both audiences call (sign, shared document reads, handover): staff
+ * need one of the given permissions, customers pass through to the service's
+ * ownership checks.
+ */
+export const MixedAudience = (permission: string | string[]) =>
+  applyDecorators(
+    UseGuards(
+      JwtGuard,
+      MixedAudienceGuard(
+        Array.isArray(permission) ? permission : [permission],
+      ),
+    ),
+  );
 
 export const BookingView = () => BookingStaff(FREIGHT_PERMS.bookings.view);
 
@@ -31,6 +57,18 @@ export const BookingView = () => BookingStaff(FREIGHT_PERMS.bookings.view);
 export const BookingDocReviewAlert = () =>
   BookingStaff(FREIGHT_PERMS.bookings.docReviewAlert);
 
+/** Staff wagon-cancellation history list (admin side). */
+export const WagonCancellationView = () =>
+  BookingStaff(FREIGHT_PERMS.bookings.wagonCancellationView);
+
+/** Staff void of a customer's pending (fee-unpaid) wagon cancellation. */
+export const WagonCancellationVoid = () =>
+  BookingStaff(FREIGHT_PERMS.bookings.wagonCancellationVoid);
+
+/** Staff rebook of a customer's wagon-cancellation credit on their behalf. */
+export const WagonCancellationRebook = () =>
+  BookingStaff(FREIGHT_PERMS.bookings.wagonCancellationRebook);
+
 export const TrainSchedulingView = () =>
   BookingStaff(FREIGHT_PERMS.trainScheduling.view);
 
diff --git a/apps/edr-freight-api/src/common/freight-permission.guard.ts b/apps/edr-freight-api/src/common/freight-permission.guard.ts
index 68def6440..db6275c07 100644
--- a/apps/edr-freight-api/src/common/freight-permission.guard.ts
+++ b/apps/edr-freight-api/src/common/freight-permission.guard.ts
@@ -8,7 +8,19 @@ import {
 } from '@nestjs/common';
 import type { TCurrentUser } from '@tria-plc/api-common/modules/auth/types/current-user.type';
 
-import { hasFreightPermission } from './freight-permission.util';
+import { hasFreightPermission, isSuperAdmin } from './freight-permission.util';
+
+// String literals on purpose (same reasoning as login-audience.middleware.ts):
+// the values are wire-format constants from iam.users.user_type, and importing
+// the vendored enum couples us to its package layout for no gain.
+const CUSTOMER_USER_TYPES = ['individual', 'external_organization'];
+
+const userTypeOf = (user: TCurrentUser): string | undefined =>
+  (user as { userType?: string }).userType;
+
+/** Staff routes are employee-only; a missing userType (stale session) also fails. */
+const isEmployee = (user: TCurrentUser): boolean =>
+  userTypeOf(user) === 'employee' || isSuperAdmin(user);
 
 export function FreightPermissionGuard(
   permissions: string[],
@@ -19,11 +31,14 @@ export function FreightPermissionGuard(
       const request = context.switchToHttp().getRequest<{ user?: TCurrentUser }>();
       const user = request.user;
 
-      if (!permissions?.length) return true;
       if (!user) {
         throw new UnauthorizedException('Authentication required');
       }
+      if (!isEmployee(user)) {
+        throw new ForbiddenException('Staff account required');
+      }
 
+      if (!permissions?.length) return true;
       if (permissions.some((p) => hasFreightPermission(user, p))) {
         return true;
       }
@@ -36,3 +51,57 @@ export function FreightPermissionGuard(
 
   return FreightPermissionsGuard;
 }
+
+/** Portal routes: customer accounts only (individual / external organization). */
+@Injectable()
+export class PortalCustomerGuard implements CanActivate {
+  canActivate(context: ExecutionContext): boolean {
+    const request = context.switchToHttp().getRequest<{ user?: TCurrentUser }>();
+    const user = request.user;
+
+    if (!user) {
+      throw new UnauthorizedException('Authentication required');
+    }
+    if (!CUSTOMER_USER_TYPES.includes(userTypeOf(user) ?? '')) {
+      throw new ForbiddenException('Customer account required');
+    }
+    return true;
+  }
+}
+
+/**
+ * Routes both audiences legitimately call (contract sign, shared document
+ * reads, warehouse handover). Staff callers must hold one of the given
+ * permissions; customer callers pass here and are scoped by the service's
+ * ownership checks.
+ */
+export function MixedAudienceGuard(permissions: string[]): Type<CanActivate> {
+  @Injectable()
+  class MixedAudiencesGuard implements CanActivate {
+    canActivate(context: ExecutionContext): boolean {
+      const request = context.switchToHttp().getRequest<{ user?: TCurrentUser }>();
+      const user = request.user;
+
+      if (!user) {
+        throw new UnauthorizedException('Authentication required');
+      }
+      if (CUSTOMER_USER_TYPES.includes(userTypeOf(user) ?? '')) {
+        return true;
+      }
+      if (!isEmployee(user)) {
+        throw new ForbiddenException('Unrecognized account type');
+      }
+      if (
+        !permissions?.length ||
+        permissions.some((p) => hasFreightPermission(user, p))
+      ) {
+        return true;
+      }
+      throw new ForbiddenException(
+        `Missing permission. Required one of: ${permissions.join(', ')}`,
+      );
+    }
+  }
+
+  return MixedAudiencesGuard;
+}
diff --git a/apps/edr-freight-api/src/common/freight-permission.util.spec.ts b/apps/edr-freight-api/src/common/freight-permission.util.spec.ts
index d0d01535a..f3931f78a 100644
--- a/apps/edr-freight-api/src/common/freight-permission.util.spec.ts
+++ b/apps/edr-freight-api/src/common/freight-permission.util.spec.ts
@@ -1,6 +1,9 @@
 import {
   assertCanApproveContractStep,
   canEditContractStep,
+  collectPermissionKeys,
+  hasFreightPermission,
+  setPositionTypePermissionResolver,
 } from './freight-permission.util';
 import { FREIGHT_PERMS } from '../seed/freight-permissions.registry';
 
@@ -49,3 +52,72 @@ describe('canEditContractStep (strict per-step edit gate)', () => {
     );
   });
 });
+
+/**
+ * The GL lockout regression: positions created through the admin UI keep their
+ * grants on the position TYPE, and the JWT only ever snapshots DIRECT position
+ * permissions. Without the type resolver those staff resolved to zero
+ * permissions, so every gated route rejected them — which is what kept GL
+ * officers out of their own clearance detail pages.
+ */
+describe('collectPermissionKeys — position-type grants', () => {
+  const CLEARANCE = FREIGHT_PERMS.contracts.clearanceReview;
+
+  afterEach(() => {
+    setPositionTypePermissionResolver(() => []);
+  });
+
+  const glOfficer = {
+    roles: [],
+    permissions: [],
+    employee: {
+      position: {
+        permissions: [], // admin-created position carries NO direct grants
+        positionType: { key: 'commercial-global-logistics-(et)-officer' },
+      },
+    },
+  };
+
+  it('resolves permissions carried by the position type', () => {
+    setPositionTypePermissionResolver((key) =>
+      key === 'commercial-global-logistics-(et)-officer' ? [CLEARANCE] : [],
+    );
+
+    expect(collectPermissionKeys(glOfficer)).toContain(CLEARANCE);
+    expect(hasFreightPermission(glOfficer, CLEARANCE)).toBe(true);
+  });
+
+  it('handles the array-shaped employee payload too', () => {
+    setPositionTypePermissionResolver(() => [CLEARANCE]);
+
+    const arrayShaped = {
+      roles: [],
+      permissions: [],
+      employee: [
+        {
+          positions: [
+            { permissions: [], positionType: { key: 'djibouti-gl-officer' } },
+          ],
+        },
+      ],
+    };
+
+    expect(hasFreightPermission(arrayShaped, CLEARANCE)).toBe(true);
+  });
+
+  it('still rejects when neither the position nor its type grants it', () => {
+    setPositionTypePermissionResolver(() => []);
+
+    expect(hasFreightPermission(glOfficer, CLEARANCE)).toBe(false);
+  });
+
+  it('keeps direct position permissions working with no resolver installed', () => {
+    const direct = {
+      roles: [],
+      permissions: [],
+      employee: { position: { permissions: [{ key: CLEARANCE }] } },
+    };
+
+    expect(hasFreightPermission(direct, CLEARANCE)).toBe(true);
+  });
+});
diff --git a/apps/edr-freight-api/src/common/freight-permission.util.ts b/apps/edr-freight-api/src/common/freight-permission.util.ts
index 56c0e77c2..bc98a6df4 100644
--- a/apps/edr-freight-api/src/common/freight-permission.util.ts
+++ b/apps/edr-freight-api/src/common/freight-permission.util.ts
@@ -42,12 +42,41 @@ export function isFreightApprovalAdmin(user: MeLikeUser | null | undefined): boo
   return isSuperAdmin(user) || isOrganizationAdmin(user);
 }
 
-/** Flat permission keys from JWT / session user (roles + position permissions). */
+/**
+ * Permissions carried by a position TYPE rather than the position itself.
+ *
+ * The JWT snapshots only DIRECT position permissions, so type-level grants —
+ * which is where admin-created positions keep theirs — are absent from the
+ * token entirely. This resolver is installed at startup
+ * (see `PositionTypePermissionsCache`) so the synchronous permission checks
+ * below can still see them. Left as a no-op resolver until then, which
+ * degrades to the old position-only behaviour rather than throwing.
+ */
+let positionTypePermissionResolver: (positionTypeKey: string) => string[] = () =>
+  [];
+
+export function setPositionTypePermissionResolver(
+  resolver: (positionTypeKey: string) => string[],
+): void {
+  positionTypePermissionResolver = resolver;
+}
+
+/**
+ * Flat permission keys from JWT / session user: roles, position permissions,
+ * and the grants held by each position's TYPE.
+ */
 export function collectPermissionKeys(user: MeLikeUser | null | undefined): string[] {
   if (!user) return [];
 
   const keys = new Set<string>();
 
+  const addTypePermissions = (positionType: PositionTypeLike | null | undefined) => {
+    if (!positionType?.key) return;
+    for (const key of positionTypePermissionResolver(positionType.key)) {
+      keys.add(key);
+    }
+  };
+
   for (const p of user.permissions ?? []) {
     if (p.key) keys.add(p.key);
   }
@@ -63,6 +92,7 @@ export function collectPermissionKeys(user: MeLikeUser | null | undefined): stri
         for (const p of pos.permissions ?? []) {
           if (p.key) keys.add(p.key);
         }
+        addTypePermissions(pos.positionType);
       }
     }
     return [...keys];
@@ -71,6 +101,7 @@ export function collectPermissionKeys(user: MeLikeUser | null | undefined): stri
   for (const p of employee.position?.permissions ?? []) {
     if (p.key) keys.add(p.key);
   }
+  addTypePermissions(employee.position?.positionType);
   for (const delegated of employee.delegatedPositions ?? []) {
     for (const p of delegated.permissions ?? []) {
       if (p.key) keys.add(p.key);
diff --git a/apps/edr-freight-api/src/common/guards/service-auth.guard.ts b/apps/edr-freight-api/src/common/guards/service-auth.guard.ts
index 9165e54d5..2d2863dd5 100644
--- a/apps/edr-freight-api/src/common/guards/service-auth.guard.ts
+++ b/apps/edr-freight-api/src/common/guards/service-auth.guard.ts
@@ -20,8 +20,12 @@ export class ServiceAuthGuard implements CanActivate {
     private warned = false;
 
     constructor() {
-        if (!this.token && process.env.NODE_ENV === "production") {
-            throw new Error("SERVICE_AUTH_TOKEN must be set in production");
+        // Fail closed everywhere: a missing secret must never silently open the
+        // internal payment surface. Local dev can opt out explicitly.
+        if (!this.token && process.env.ALLOW_UNAUTH_INTERNAL !== "true") {
+            throw new Error(
+                "SERVICE_AUTH_TOKEN must be set (or ALLOW_UNAUTH_INTERNAL=true for local dev)",
+            );
         }
     }
 
@@ -29,7 +33,7 @@ export class ServiceAuthGuard implements CanActivate {
         if (!this.token) {
             if (!this.warned) {
                 this.logger.warn(
-                    "SERVICE_AUTH_TOKEN unset — internal endpoints are UNGUARDED (dev only)",
+                    "ALLOW_UNAUTH_INTERNAL=true — internal endpoints are UNGUARDED (dev only)",
                 );
                 this.warned = true;
             }
diff --git a/apps/edr-freight-api/src/common/last-mile-charge.util.spec.ts b/apps/edr-freight-api/src/common/last-mile-charge.util.spec.ts
index e2ff1bfd9..e60bf4f4e 100644
--- a/apps/edr-freight-api/src/common/last-mile-charge.util.spec.ts
+++ b/apps/edr-freight-api/src/common/last-mile-charge.util.spec.ts
@@ -85,6 +85,48 @@ describe('computeLastMileCharge', () => {
     expect(charge).toMatchObject({ mode: 'BULK', total: 60 * 26 * 25, currency: 'ETB' });
   });
 
+  it('picks the bulk rate whose distance band holds the km (half-open boundary)', () => {
+    const bulkNear = rate({ rateUnit: 'PER_TON_KM', rateValue: 30, minKm: 0, maxKm: 30 });
+    const bulkFar = rate({ rateUnit: 'PER_TON_KM', rateValue: 22, minKm: 30, maxKm: null });
+    const near = computeLastMileCharge({
+      freightType: 'BULK',
+      tons: 10,
+      km: 12,
+      containers: [],
+      liveRates: [bulkNear, bulkFar],
+    });
+    expect(near).toMatchObject({ mode: 'BULK', total: 10 * 12 * 30 });
+    const boundary = computeLastMileCharge({
+      freightType: 'BULK',
+      tons: 10,
+      km: 30,
+      containers: [],
+      liveRates: [bulkNear, bulkFar],
+    });
+    expect(boundary).toMatchObject({ total: 10 * 30 * 22 });
+  });
+
+  it('bulk falls back to the legacy bandless rate when no band holds the km, null when nothing covers it', () => {
+    const bulkNear = rate({ rateUnit: 'PER_TON_KM', rateValue: 30, minKm: 0, maxKm: 30 });
+    const fallback = computeLastMileCharge({
+      freightType: 'BULK',
+      tons: 10,
+      km: 50,
+      containers: [],
+      liveRates: [bulkNear, bulkRate], // bulkRate has no band
+    });
+    expect(fallback).toMatchObject({ total: 10 * 50 * 25 });
+    expect(
+      computeLastMileCharge({
+        freightType: 'BULK',
+        tons: 10,
+        km: 50,
+        containers: [],
+        liveRates: [bulkNear],
+      }),
+    ).toBeNull();
+  });
+
   it('returns null on mixed currencies, unknown km, and uncovered freight types', () => {
     const usd40 = rate({ ...band40a, currency: 'USD' });
     expect(
diff --git a/apps/edr-freight-api/src/common/last-mile-charge.util.ts b/apps/edr-freight-api/src/common/last-mile-charge.util.ts
index 706e21238..055e8e5f9 100644
--- a/apps/edr-freight-api/src/common/last-mile-charge.util.ts
+++ b/apps/edr-freight-api/src/common/last-mile-charge.util.ts
@@ -30,10 +30,12 @@ const round2 = (n: number): number => Math.round(n * 100) / 100;
 /**
  * Price a last-mile leg off the LIVE rate rules. Pure — pass the live rates in.
  *
- * BULK: one PER_TON_KM rate → price = tons × km × rate.
+ * BULK: the PER_TON_KM rate whose distance band holds the km (a legacy
+ * bandless row — NULL minKm — is the fallback and prices every distance) →
+ * price = tons × km × rate.
  * CONTAINER: per container size, the PER_KM rate whose distance band holds the
- * km (bands are half-open [minKm, maxKm), NULL maxKm = open-ended) → price =
- * km × rate × quantity, summed across sizes.
+ * km → price = km × rate × quantity, summed across sizes.
+ * Bands are half-open [minKm, maxKm), NULL maxKm = open-ended.
  *
  * Returns null whenever the rules don't fully cover the shipment (no rate, a
  * container size without a matching band, mixed currencies, km/tons unknown) —
@@ -56,7 +58,15 @@ export function computeLastMileCharge(input: {
 
   if (freightType === 'BULK') {
     if (!tons || tons <= 0) return null;
-    const rate = candidates.find((r) => r.rateUnit === 'PER_TON_KM');
+    const bulkRates = candidates.filter((r) => r.rateUnit === 'PER_TON_KM');
+    const rate =
+      bulkRates.find(
+        (r) =>
+          r.minKm !== null &&
+          r.minKm !== undefined &&
+          Number(r.minKm) <= km &&
+          (r.maxKm === null || r.maxKm === undefined || km < Number(r.maxKm)),
+      ) ?? bulkRates.find((r) => r.minKm === null || r.minKm === undefined);
     if (!rate) return null;
     const unitRate = Number(rate.rateValue);
     const amount = round2(tons * km * unitRate);
diff --git a/apps/edr-freight-api/src/common/position-type-permissions.cache.ts b/apps/edr-freight-api/src/common/position-type-permissions.cache.ts
new file mode 100644
index 000000000..2848ed0b2
--- /dev/null
+++ b/apps/edr-freight-api/src/common/position-type-permissions.cache.ts
@@ -0,0 +1,83 @@
+import { Injectable, Logger, OnModuleInit } from '@nestjs/common';
+import { InjectDataSource } from '@nestjs/typeorm';
+import { DataSource } from 'typeorm';
+
+import { setPositionTypePermissionResolver } from './freight-permission.util';
+
+/**
+ * Permissions granted to a position TYPE (`iam.position_type_permissions`).
+ *
+ * A position type is the platform's notion of a role, and positions created
+ * through the admin UI carry their grants there rather than on the position
+ * itself. The JWT only ever snapshots DIRECT position permissions, so those
+ * grants are invisible to `collectPermissionKeys` — staff on such a position
+ * resolve to zero permissions and every permission-gated route rejects them.
+ *
+ * The permission checks (`hasFreightPermission`, `FreightPermissionGuard`) are
+ * synchronous and sit on the request path, so the mapping is held in memory and
+ * refreshed periodically rather than queried per request. The dataset is tiny
+ * (tens of types, a few hundred rows), so a full reload is cheaper than any
+ * incremental scheme.
+ */
+@Injectable()
+export class PositionTypePermissionsCache implements OnModuleInit {
+  private readonly logger = new Logger(PositionTypePermissionsCache.name);
+
+  /** position_type key → permission keys. Empty until the first load lands. */
+  private byPositionTypeKey = new Map<string, string[]>();
+
+  // ponytail: fixed 5-min refresh, no invalidation hook. A permission granted
+  // in the admin UI takes up to one interval to reach the guards. Wire the
+  // grant mutation to call `refresh()` if that lag ever matters.
+  private static readonly REFRESH_INTERVAL_MS = 5 * 60 * 1000;
+
+  constructor(@InjectDataSource() private readonly dataSource: DataSource) {}
+
+  async onModuleInit(): Promise<void> {
+    await this.refresh();
+    // Hand the lookup to the permission utils, whose checks are synchronous and
+    // therefore cannot query IAM themselves.
+    setPositionTypePermissionResolver((positionTypeKey) =>
+      this.get(positionTypeKey),
+    );
+    const timer = setInterval(() => {
+      void this.refresh();
+    }, PositionTypePermissionsCache.REFRESH_INTERVAL_MS);
+    // Never hold the process open for a cache refresh.
+    timer.unref?.();
+  }
+
+  /** Permission keys for a position-type key ([] when unknown/not loaded). */
+  get(positionTypeKey: string | undefined | null): string[] {
+    if (!positionTypeKey) return [];
+    return this.byPositionTypeKey.get(positionTypeKey) ?? [];
+  }
+
+  /** Reload the whole mapping. Failures keep the previous snapshot in place. */
+  async refresh(): Promise<void> {
+    try {
+      const rows: { position_type_key: string; permission_key: string }[] =
+        await this.dataSource.query(
+          `SELECT pt.key AS position_type_key, perm.key AS permission_key
+             FROM iam.position_type_permissions ptp
+             JOIN iam.position_types pt ON pt.id = ptp.position_type_id
+             JOIN iam.permissions perm ON perm.id = ptp.permission_id`,
+        );
+
+      const next = new Map<string, string[]>();
+      for (const row of rows) {
+        if (!row.position_type_key || !row.permission_key) continue;
+        const keys = next.get(row.position_type_key);
+        if (keys) keys.push(row.permission_key);
+        else next.set(row.position_type_key, [row.permission_key]);
+      }
+      this.byPositionTypeKey = next;
+    } catch (err) {
+      // iam schema unreachable — keep serving the previous snapshot rather than
+      // dropping every type-derived permission and locking staff out.
+      this.logger.warn(
+        `Position-type permission refresh failed: ${(err as Error).message}`,
+      );
+    }
+  }
+}
diff --git a/apps/edr-freight-api/src/migrations/3300000000000-BookingWagonCancellations.ts b/apps/edr-freight-api/src/migrations/3300000000000-BookingWagonCancellations.ts
new file mode 100644
index 000000000..0d506cff0
--- /dev/null
+++ b/apps/edr-freight-api/src/migrations/3300000000000-BookingWagonCancellations.ts
@@ -0,0 +1,65 @@
+import { MigrationInterface, QueryRunner } from 'typeorm';
+
+/**
+ * Partial wagon cancellation with rebooking credit.
+ *
+ * One row per cancellation cycle on a PAID booking: the customer asks to drop
+ * N wagons, pays a per-wagon cancellation fee (rates row
+ * rate_type = 'CANCELLATION_FEE', rate_unit = 'PER_WAGON'), and the dropped cargo becomes a
+ * rebookable credit. The credit is redeemed by creating a fresh booking
+ * through the normal under-contract create path (which re-checks contract
+ * validity and caps), immediately marked PAID — the freight was already paid
+ * on the original booking, only the fee is new money.
+ *
+ * cancelled_quantities carries what was cut, in the booking's own terms:
+ * `{ bulkTons }` for bulk, `{ bySize: { "20": 4, "40": 3 } }` for container.
+ * Container numbers are NOT stored here — they are recovered at rebook time
+ * from the unit rows the reduction soft-deleted (same hybrid pattern as
+ * RemainderPlacementService).
+ */
+export class BookingWagonCancellations3300000000000 implements MigrationInterface {
+  public async up(queryRunner: QueryRunner): Promise<void> {
+    await queryRunner.query(`
+      CREATE TABLE IF NOT EXISTS freight.booking_wagon_cancellations (
+        id uuid PRIMARY KEY DEFAULT gen_random_uuid(),
+        booking_id uuid NOT NULL REFERENCES freight.bookings(id),
+        rebooked_booking_id uuid REFERENCES freight.bookings(id),
+        wagons_cancelled numeric(6,2) NOT NULL CHECK (wagons_cancelled > 0),
+        weight_tons numeric(12,3) NOT NULL DEFAULT 0,
+        cancelled_quantities jsonb NOT NULL,
+        credit_amount numeric(14,2) NOT NULL DEFAULT 0,
+        fee_rate_id uuid REFERENCES freight.rates(id),
+        fee_amount numeric(14,2) NOT NULL CHECK (fee_amount >= 0),
+        fee_currency varchar(8) NOT NULL DEFAULT 'ETB',
+        fee_invoice_id uuid REFERENCES freight.invoices(id),
+        fee_paid_at timestamptz,
+        status varchar(30) NOT NULL DEFAULT 'FEE_PENDING',
+        reason text,
+        requested_by_user_id uuid,
+        rebooked_at timestamptz,
+        created_at timestamptz NOT NULL DEFAULT now(),
+        updated_at timestamptz NOT NULL DEFAULT now(),
+        deleted_at timestamptz
+      )
+    `);
+    // One open (fee-unpaid) cancellation per booking — closes the double-click
+    // race without app-level locking.
+    await queryRunner.query(`
+      CREATE UNIQUE INDEX IF NOT EXISTS uq_open_wagon_cancellation_per_booking
+        ON freight.booking_wagon_cancellations (booking_id)
+        WHERE status = 'FEE_PENDING' AND deleted_at IS NULL
+    `);
+    await queryRunner.query(`
+      CREATE INDEX IF NOT EXISTS idx_bwc_booking
+        ON freight.booking_wagon_cancellations (booking_id)
+    `);
+    await queryRunner.query(`
+      CREATE INDEX IF NOT EXISTS idx_bwc_status
+        ON freight.booking_wagon_cancellations (status)
+    `);
+  }
+
+  public async down(queryRunner: QueryRunner): Promise<void> {
+    await queryRunner.query(`DROP TABLE IF EXISTS freight.booking_wagon_cancellations`);
+  }
+}
diff --git a/apps/edr-freight-api/src/modules/ai/ai.controller.ts b/apps/edr-freight-api/src/modules/ai/ai.controller.ts
index eb87fe97d..d71795066 100644
--- a/apps/edr-freight-api/src/modules/ai/ai.controller.ts
+++ b/apps/edr-freight-api/src/modules/ai/ai.controller.ts
@@ -1,15 +1,13 @@
 import { Body, Controller, HttpCode, HttpStatus, Post } from '@nestjs/common';
 import { ApiOkResponse, ApiOperation, ApiTags } from '@nestjs/swagger';
-import { Public } from '@edr/api-common';
 
+import { BookingStaff } from '../../common/booking-guards';
 import { AiBookingRequestDto } from './dto/ai-booking-request.dto';
 import { AiBookingResult } from './types/ai-booking-result.type';
 import { MockAiService } from './mock-ai.service';
+import { FREIGHT_PERMS } from '../../seed/freight-permissions.registry';
 
-// @Public() — TODO: swap for real guard when this leaves dev/testing.
-// Safe while public: extracts + validates text only, never creates or
-// dispatches anything.
-@Public()
+@BookingStaff(FREIGHT_PERMS.bookings.view)
 @ApiTags('AI Assistant (mock)')
 @Controller('ai')
 export class AiController {
diff --git a/apps/edr-freight-api/src/modules/auth/freight-me.service.ts b/apps/edr-freight-api/src/modules/auth/freight-me.service.ts
index 006b482f4..6bcfd964d 100644
--- a/apps/edr-freight-api/src/modules/auth/freight-me.service.ts
+++ b/apps/edr-freight-api/src/modules/auth/freight-me.service.ts
@@ -35,10 +35,57 @@ export class FreightMeService {
     }
   }
 
+  /**
+   * Permissions granted to the position's TYPE (`iam.position_type_permissions`).
+   * A position type is the platform's notion of a role, and admin-created
+   * positions carry their grants there rather than on the position itself — but
+   * the JWT only ever snapshots direct position permissions. Without this, staff
+   * on such a position resolve to zero permissions and every permission-gated
+   * route rejects them (this is what locked GL officers out of their clearance
+   * detail pages). Resolved live from IAM, same as the position type above.
+   */
+  private async lookupPositionTypePermissions(
+    positionId: string | undefined,
+  ): Promise<string[]> {
+    if (!positionId) return [];
+    try {
+      const rows: { key: string }[] = await this.dataSource.query(
+        `SELECT DISTINCT perm.key
+           FROM iam.positions p
+           JOIN iam.position_type_permissions ptp
+             ON ptp.position_type_id = p.position_type_id
+           JOIN iam.permissions perm ON perm.id = ptp.permission_id
+          WHERE p.id = $1`,
+        [positionId],
+      );
+      return rows.map((r) => r.key).filter(Boolean);
+    } catch {
+      return []; // iam schema unreachable — degrade to position-only permissions
+    }
+  }
+
   async getEnrichedProfile(user: TCurrentUser) {
-    const positionType = await this.lookupPositionType(
-      user.employee?.position?.id,
+    const positionId = user.employee?.position?.id;
+    const [positionType, positionTypePermissionKeys] = await Promise.all([
+      this.lookupPositionType(positionId),
+      this.lookupPositionTypePermissions(positionId),
+    ]);
+
+    // Merge the type-level grants into the position's own permission list so
+    // BOTH consumers see them: `collectPermissionKeys` below, and the
+    // backoffice's `getPermissionKeys`, which walks this same nested array.
+    const positionPermissions = [
+      ...(user.employee?.position?.permissions ?? []),
+    ];
+    const seenPermissionKeys = new Set(
+      positionPermissions.map((p) => p?.key).filter(Boolean),
     );
+    for (const key of positionTypePermissionKeys) {
+      if (!seenPermissionKeys.has(key)) {
+        seenPermissionKeys.add(key);
+        positionPermissions.push({ key } as (typeof positionPermissions)[number]);
+      }
+    }
 
     const employee = user.employee
       ? [
@@ -56,7 +103,7 @@ export class FreightMeService {
                     name: user.employee.position.name,
                     isDelegate: user.employee.position.isDelegate,
                     parentPositionId: user.employee.position.parentPositionId,
-                    permissions: user.employee.position.permissions ?? [],
+                    permissions: positionPermissions,
                     positionType,
                   },
                 ]
@@ -65,7 +112,15 @@ export class FreightMeService {
         ]
       : [];
 
-    const permissionKeys = collectPermissionKeys(user);
+    // `collectPermissionKeys` reads the raw token (position-level only), so
+    // union the type-level grants in — the backoffice prefers this flat list
+    // over the nested array and would otherwise still see none of them.
+    const permissionKeys = [
+      ...new Set([
+        ...collectPermissionKeys(user),
+        ...positionTypePermissionKeys,
+      ]),
+    ];
 
     return {
       id: user.id,
diff --git a/apps/edr-freight-api/src/modules/auth/list-users.controller.ts b/apps/edr-freight-api/src/modules/auth/list-users.controller.ts
index e7fbfd771..e2f06f065 100644
--- a/apps/edr-freight-api/src/modules/auth/list-users.controller.ts
+++ b/apps/edr-freight-api/src/modules/auth/list-users.controller.ts
@@ -3,7 +3,8 @@ import { ApiBearerAuth, ApiOperation, ApiTags } from '@nestjs/swagger';
 
 import { ListUsersQueryDto } from './dto/list-users-query.dto';
 import { ListUsersService } from './list-users.service';
-import { StaffReference } from '../../common/booking-guards';
+import { BookingStaff } from '../../common/booking-guards';
+import { FREIGHT_PERMS } from '../../seed/freight-permissions.registry';
 
 @ApiTags('auth')
 @Controller('staff/users')
@@ -12,7 +13,7 @@ export class ListUsersController {
   constructor(private readonly service: ListUsersService) {}
 
   @Get()
-  @StaffReference()
+  @BookingStaff(FREIGHT_PERMS.staff.users.view)
   @ApiOperation({
     summary: 'List IAM users (paginated) for backoffice pickers',
   })
diff --git a/apps/edr-freight-api/src/modules/backoffice/backoffice.controller.ts b/apps/edr-freight-api/src/modules/backoffice/backoffice.controller.ts
index b3305ba68..d25fb74ba 100644
--- a/apps/edr-freight-api/src/modules/backoffice/backoffice.controller.ts
+++ b/apps/edr-freight-api/src/modules/backoffice/backoffice.controller.ts
@@ -10,18 +10,19 @@ import {
 } from "@nestjs/common";
 import { ApiOperation, ApiTags } from "@nestjs/swagger";
 
-import { FreightAdmin } from "../../common/booking-guards";
+import { BookingStaff } from "../../common/booking-guards";
+import { FREIGHT_PERMS } from "../../seed/freight-permissions.registry";
 import { BackofficeService } from "./backoffice.service";
 import { CreateOrganizationUserDto } from "./dto/create-organization-user.dto";
 import { UpdateEmployeeUserRolesDto } from "./dto/update-employee-user-roles.dto";
 
 @ApiTags("backoffice")
 @Controller("backoffice")
-@FreightAdmin()
 export class BackofficeController {
   constructor(private readonly backofficeService: BackofficeService) {}
 
   @Post("organizations/:orgId/users")
+  @BookingStaff([FREIGHT_PERMS.staff.employeeRegistration.create, FREIGHT_PERMS.admin])
   @ApiOperation({ summary: "Create an organization user without assigning positions" })
   createOrganizationUser(
     @Param("orgId", ParseUUIDPipe) organizationId: string,
@@ -31,6 +32,7 @@ export class BackofficeController {
   }
 
   @Get("organizations/:orgId/employees")
+  @BookingStaff([FREIGHT_PERMS.staff.roleAssignment.view, FREIGHT_PERMS.admin])
   @ApiOperation({ summary: "Get deduplicated organization employees for backoffice" })
   getOrganizationEmployees(
     @Param("orgId", ParseUUIDPipe) organizationId: string,
@@ -44,6 +46,7 @@ export class BackofficeController {
   }
 
   @Get("organizations/:orgId/employee-users/:userId/roles")
+  @BookingStaff([FREIGHT_PERMS.staff.roleAssignment.view, FREIGHT_PERMS.admin])
   @ApiOperation({ summary: "Get org-scoped roles assigned to an employee user" })
   getEmployeeUserRoles(
     @Param("orgId", ParseUUIDPipe) organizationId: string,
@@ -53,6 +56,7 @@ export class BackofficeController {
   }
 
   @Put("organizations/:orgId/employee-users/:userId/roles")
+  @BookingStaff([FREIGHT_PERMS.staff.roleAssignment.replace, FREIGHT_PERMS.admin])
   @ApiOperation({ summary: "Replace org-scoped roles assigned to an employee user" })
   replaceEmployeeUserRoles(
     @Param("orgId", ParseUUIDPipe) organizationId: string,
diff --git a/apps/edr-freight-api/src/modules/billing/billing.controller.ts b/apps/edr-freight-api/src/modules/billing/billing.controller.ts
index 49772316a..d72528310 100644
--- a/apps/edr-freight-api/src/modules/billing/billing.controller.ts
+++ b/apps/edr-freight-api/src/modules/billing/billing.controller.ts
@@ -12,14 +12,15 @@ import type { Response } from "express";
 import { CurrentUser } from "@edr/api-common";
 import type { TCurrentUser } from "@tria-plc/api-common/modules/auth/types/current-user.type";
 
-import { BookingView } from "../../common/booking-guards";
+import { BookingStaff } from "../../common/booking-guards";
+import { FREIGHT_PERMS } from "../../seed/freight-permissions.registry";
 import { UserTradeAccessService } from "../user-trade-access/user-trade-access.service";
 import { BillingService } from "./billing.service";
 import { FilterInvoiceDto } from "./dto/filter-invoice.dto";
 
 @ApiTags("billing")
 @Controller("billing")
-@BookingView()
+@BookingStaff(FREIGHT_PERMS.invoices.view)
 @ApiBearerAuth()
 export class BillingController {
   constructor(
@@ -51,6 +52,7 @@ export class BillingController {
   }
 
   @Get("invoices/:id/document")
+  @BookingStaff(FREIGHT_PERMS.invoices.export)
   @ApiOperation({ summary: "Download the sealed invoice PDF" })
   async document(@Param("id", ParseUUIDPipe) id: string, @Res() res: Response) {
     const { filename, buffer } = await this.billingService.document(id);
@@ -58,6 +60,7 @@ export class BillingController {
   }
 
   @Get("invoices/:id/receipt")
+  @BookingStaff(FREIGHT_PERMS.invoices.export)
   @ApiOperation({ summary: "Download the sealed payment receipt PDF" })
   async receipt(@Param("id", ParseUUIDPipe) id: string, @Res() res: Response) {
     const { filename, buffer } = await this.billingService.receipt(id);
diff --git a/apps/edr-freight-api/src/modules/billing/billing.service.spec.ts b/apps/edr-freight-api/src/modules/billing/billing.service.spec.ts
index 1356f8cfa..6e25c72aa 100644
--- a/apps/edr-freight-api/src/modules/billing/billing.service.spec.ts
+++ b/apps/edr-freight-api/src/modules/billing/billing.service.spec.ts
@@ -668,3 +668,66 @@ describe("BillingService — CAC Bank (OTP debit)", () => {
     expect(confirmOtp).toHaveBeenCalledWith("intent-1", "123456");
   });
 });
+
+describe("BillingService — CBE bill amounts round UP to whole birr", () => {
+  // CBE bills whole birr. Ceil, never Math.round: a .40 balance rounded down
+  // settles 0.40 short while markInvoiceAsPaid still writes paidAmount =
+  // totalAmount — money missing from the bank with the books saying paid.
+  // payInvoice and billQuery must agree, or /cbe/payment sees a mismatch.
+  const invoice = {
+    id: "inv-1",
+    status: Freight.InvoiceStatus.Pending,
+    source: Freight.InvoiceSource.Booking,
+    sourceId: "booking-1",
+    type: "PREPAID",
+    invoiceNumber: "INV-20260101-00001",
+    currency: "ETB",
+    // .40 — the case Math.round gets wrong (rounds down, underpays).
+    balanceAmount: 12345.4,
+    totalAmount: 12345.4,
+    company: { name: "Acme PLC" },
+    paymentId: null,
+    dueAt: null,
+  };
+
+  const build = (payment: Record<string, unknown> = {}) => {
+    const repo = {
+      findOne: jest.fn().mockResolvedValue(invoice),
+      update: jest.fn().mockResolvedValue(undefined),
+    };
+    const service = new BillingService(
+      { getRepository: () => repo } as never,
+      {} as never,
+      {} as never,
+      makeEvents() as never,
+      payment as never,
+      {} as never,
+      {} as never,
+    );
+    return { service, repo };
+  };
+
+  it("opens the intent for the ceiled balance, never below it", async () => {
+    const initiate = jest.fn().mockResolvedValue({
+      intentId: "intent-1",
+      immediateSuccess: false,
+      response: { intentId: "intent-1", status: "REQUIRES_ACTION" },
+    });
+    const { service } = build({ initiate });
+
+    await service.payInvoice("inv-1", { method: "CBE_BILL" });
+
+    expect(initiate).toHaveBeenCalledWith(
+      expect.objectContaining({ amountMinor: 12346 }),
+    );
+  });
+
+  it("quotes the same ceiled amount on bill-query as payInvoice opened", async () => {
+    const { service } = build();
+
+    await expect(service.billQuery("booking-1")).resolves.toMatchObject({
+      stillPayable: true,
+      currentAmountMinor: 12346,
+    });
+  });
+});
diff --git a/apps/edr-freight-api/src/modules/billing/billing.service.ts b/apps/edr-freight-api/src/modules/billing/billing.service.ts
index ea4413638..5051afd6e 100644
--- a/apps/edr-freight-api/src/modules/billing/billing.service.ts
+++ b/apps/edr-freight-api/src/modules/billing/billing.service.ts
@@ -1191,7 +1191,11 @@ export class BillingService {
       // service branches on a domain-specific reference type.
       referenceType: PaymentReferenceType.SHIPMENT,
       orderRef: invoice.invoiceNumber.replace(/-/g, "_"),
-      amountMinor: Math.round(Number(invoice.balanceAmount)),
+      // Whole birr, always UP. CBE bills this amount verbatim, so it must never
+      // land below the outstanding balance — Math.round would let a .40 balance
+      // settle 0.40 short. Ceil overcharges by <1 birr instead, and the same
+      // ceil in billQuery keeps the quoted and debited amounts identical.
+      amountMinor: Math.ceil(Number(invoice.balanceAmount)),
       currency: invoice.currency,
       reason: `Payment for invoice ${invoice.invoiceNumber}`,
       method: opts.method ?? "TELEBIRR",
@@ -1336,7 +1340,9 @@ export class BillingService {
     });
 
     if (open) {
-      const balance = Math.round(Number(open.balanceAmount ?? open.totalAmount));
+      // Ceil, matching payInvoice — the amount CBE quotes at the counter has to
+      // be the amount the intent was opened for, or /cbe/payment sees a mismatch.
+      const balance = Math.ceil(Number(open.balanceAmount ?? open.totalAmount));
       const expired = open.dueAt && open.dueAt.getTime() < Date.now();
       return {
         stillPayable: balance > 0 && !expired,
@@ -1371,7 +1377,7 @@ export class BillingService {
     return {
       stillPayable: false,
       payerName: latest.company?.name ?? null,
-      currentAmountMinor: Math.round(Number(latest.totalAmount)),
+      currentAmountMinor: Math.ceil(Number(latest.totalAmount)),
       currency: latest.currency,
       paymentReason: `Freight invoice ${latest.invoiceNumber}`,
       reason: closedInvoiceReason(latest.status),
diff --git a/apps/edr-freight-api/src/modules/billing/portal-billing.controller.ts b/apps/edr-freight-api/src/modules/billing/portal-billing.controller.ts
index 981233df0..90f6a32a4 100644
--- a/apps/edr-freight-api/src/modules/billing/portal-billing.controller.ts
+++ b/apps/edr-freight-api/src/modules/billing/portal-billing.controller.ts
@@ -12,6 +12,7 @@ import { ApiBearerAuth, ApiOperation, ApiTags } from "@nestjs/swagger";
 import type { Response } from "express";
 import { CurrentUser } from "@edr/api-common";
 
+import { PortalCustomer } from "../../common/booking-guards";
 import {
   type AuthUserPayload,
   resolveAuthUserId,
@@ -28,6 +29,7 @@ import { ConfirmOtpDto, PayInvoiceDto } from "./dto/pay-invoice.dto";
 @ApiTags("billing")
 @ApiBearerAuth()
 @Controller("billing")
+@PortalCustomer()
 export class PortalBillingController {
   constructor(private readonly billingService: BillingService) {}
 
diff --git a/apps/edr-freight-api/src/modules/bookings/booking-invoice.service.ts b/apps/edr-freight-api/src/modules/bookings/booking-invoice.service.ts
index cd803d719..91b8362e4 100644
--- a/apps/edr-freight-api/src/modules/bookings/booking-invoice.service.ts
+++ b/apps/edr-freight-api/src/modules/bookings/booking-invoice.service.ts
@@ -20,6 +20,10 @@ import { FirstMileService } from "../first-mile/first-mile.service";
 import { BookingBatchService } from "../train-scheduling/booking-batch.service";
 import { PriceLineItemDto } from "./dto/generate-price-response.dto";
 import { BookingsRepository } from "./bookings.repository";
+import {
+  BookingWagonCancellationService,
+  WAGON_CANCEL_FEE_INVOICE_TYPE,
+} from "./booking-wagon-cancellation.service";
 import { Booking } from "./entities/booking.entity";
 
 /** Snapshot written onto `booking.pricingBreakdown` by the pricing service. */
@@ -58,6 +62,8 @@ export class BookingInvoiceService {
     private readonly firstMile: FirstMileService,
     @Inject(forwardRef(() => BookingBatchService))
     private readonly bookingBatch: BookingBatchService,
+    @Inject(forwardRef(() => BookingWagonCancellationService))
+    private readonly wagonCancellations: BookingWagonCancellationService,
   ) { }
 
   /**
@@ -90,6 +96,21 @@ export class BookingInvoiceService {
     return this.billing.generateInvoice(input);
   }
 
+  /**
+   * Cancel the booking's open PREPAID invoice, if any — used when a
+   * changes-requested resubmit restates the cargo, so the re-priced booking can
+   * be re-invoiced. Throws when the invoice already has payments recorded
+   * (cargo must not change out from under recorded money).
+   */
+  async cancelUnpaidInvoiceForBooking(bookingId: string): Promise<void> {
+    const existing = await this.billing.findPayable(
+      Freight.InvoiceSource.Booking,
+      bookingId,
+      "PREPAID",
+    );
+    if (existing) await this.billing.cancelInvoice(existing.id);
+  }
+
   /**
    * React to a booking invoice being paid — the settlement branch point. Per-type
    * reactions live here (not in the payment process): each invoice type advances
@@ -108,6 +129,11 @@ export class BookingInvoiceService {
         await this.bookingBatch.reviveOfferForInvoice(payload.invoiceId);
         await this.advanceBookingOnPayment(payload.sourceId);
         break;
+      case WAGON_CANCEL_FEE_INVOICE_TYPE:
+        // Partial wagon cancellation: the fee settled — reduce the booking and
+        // release the cancelled wagons (T2 of the cancellation cycle).
+        await this.wagonCancellations.onFeePaid(payload.invoiceId);
+        break;
       default:
         this.logger.warn(
           `Unhandled booking invoice type "${payload.type}" paid (${payload.invoiceId})`,
diff --git a/apps/edr-freight-api/src/modules/bookings/booking-pricing.service.ts b/apps/edr-freight-api/src/modules/bookings/booking-pricing.service.ts
index df81fd5f6..ba6fece8c 100644
--- a/apps/edr-freight-api/src/modules/bookings/booking-pricing.service.ts
+++ b/apps/edr-freight-api/src/modules/bookings/booking-pricing.service.ts
@@ -279,7 +279,9 @@ export class BookingPricingService {
 
     return {
       lineItems,
-      totalAmount: total,
+      // Grand total is billed in whole currency units — fractional line sums
+      // (rate × tons can yield e.g. 260519.2) round to the nearest whole birr/USD.
+      totalAmount: Math.round(total),
       currency: booking.paymentCurrency,
       usedRates: [...usedRatesMap.values()],
       appliedModifiers: ruleResult.appliedModifiers,
diff --git a/apps/edr-freight-api/src/modules/bookings/booking-transition.service.ts b/apps/edr-freight-api/src/modules/bookings/booking-transition.service.ts
index 181c47b2d..7cc92be87 100644
--- a/apps/edr-freight-api/src/modules/bookings/booking-transition.service.ts
+++ b/apps/edr-freight-api/src/modules/bookings/booking-transition.service.ts
@@ -8,6 +8,9 @@ import {
   Optional,
 } from "@nestjs/common";
 import { EventEmitter2, OnEvent } from "@nestjs/event-emitter";
+import { DataSource } from "typeorm";
+
+import { TrainSchedule } from '../train-schedules/entities/train-schedule.entity';
 
 import {
   BookingBatchService,
@@ -56,11 +59,18 @@ export class BookingTransitionService {
     private readonly bookingClearanceService: BookingClearanceService,
     @Inject(forwardRef(() => ClearanceWorkflowService))
     private readonly workflowService: ClearanceWorkflowService,
-        private readonly invoiceService: BookingInvoiceService,
+    // forwardRef: booking-invoice.service now pulls in the wagon-cancellation
+    // service, whose cross-module imports close a require cycle through this
+    // file — without it the class is undefined at decorator time.
+    @Inject(forwardRef(() => BookingInvoiceService))
+    private readonly invoiceService: BookingInvoiceService,
     private readonly containerValidationService: ContainerValidationService,
     private readonly notifier: BookingLifecycleNotifierService,
     private readonly events: EventEmitter2,
     @Optional() private readonly milestoneService?: ClearanceMilestoneService,
+    // Optional + last so the hand-constructed service in *.spec.ts files keeps
+    // compiling; Nest injects it normally at runtime.
+    @Optional() private readonly dataSource?: DataSource,
   ) {}
 
   private isPhasedCustoms(booking: Booking): boolean {
@@ -429,6 +439,20 @@ export class BookingTransitionService {
     return fresh;
   }
 
+  /**
+   * Customer self-service cancel, allowed only before payment — no fee.
+   * SELECTED_FOR_BATCH releases the wagon hold immediately; earlier statuses
+   * take the plain cancel path (open invoices expired, nothing reserved yet).
+   * Anything past payment falls through to cancel()'s status assertion.
+   */
+  async customerCancel(bookingId: string, reason?: string): Promise<Booking> {
+    const booking = await this.bookingsService.findById(bookingId);
+    if (booking.status === "SELECTED_FOR_BATCH") {
+      return this.cancelHold(bookingId, reason);
+    }
+    return this.cancel(bookingId, reason ?? "Customer cancelled before payment");
+  }
+
   async cancel(bookingId: string, reason: string): Promise<Booking> {
     const booking = await this.bookingsService.findById(bookingId);
     assertBookingStatus(booking, [
@@ -978,6 +1002,15 @@ export class BookingTransitionService {
     // booking through the space checks below AND is persisted so the accept /
     // reserve path locks onto that train (pickExportSchedule honors it).
     const requestedId = isExportTrain ? (requestedTrainScheduleId ?? null) : null;
+    // Export rail rides the exact train the customer picked — never an
+    // auto-assigned one. Both portal flows (clearance + contract completion)
+    // surface a picker, so a missing id is an invalid submission, not a
+    // legitimate "let the system choose".
+    if (isExportTrain && !requestedId) {
+      throw new BadRequestException(
+        "Select a train for the chosen shipment day.",
+      );
+    }
     const scheduledBooking = {
       ...booking,
       scheduledDate: date,
@@ -1244,6 +1277,12 @@ export class BookingTransitionService {
       /** Flat list of physical container numbers on this booking (for the
        *  customer truck-assignment container picker). */
       containerNumbers: string[];
+      /** The allocated train, when the booking is placed on a schedule. */
+      trainSchedule?: {
+        trainNumber: string | null;
+        reference: string | null;
+        scheduledDepartureDate: Date | null;
+      } | null;
     }
   > {
     // This enrichment runs AFTER the transition has committed. A failure here
@@ -1296,6 +1335,32 @@ export class BookingTransitionService {
         `enrichBookingResponse: batch-offer lookup failed for ${booking.id}: ${(err as Error).message}`,
       );
     }
+    // Allocated train: number + schedule reference for the detail headers
+    // (portal and backoffice). Degrades to null like every fragile field here.
+    let trainSchedule: {
+      trainNumber: string | null;
+      reference: string | null;
+      scheduledDepartureDate: Date | null;
+    } | null = null;
+    if (booking.trainScheduleId && this.dataSource) {
+      try {
+        const s = await this.dataSource.getRepository(TrainSchedule).findOne({
+          where: { id: booking.trainScheduleId },
+        });
+        if (s) {
+          trainSchedule = {
+            trainNumber: s.trainNumber ?? null,
+            reference: s.reference ?? null,
+            scheduledDepartureDate: s.scheduledDepartureDate ?? null,
+          };
+        }
+      } catch (err) {
+        this.logger.warn(
+          `enrichBookingResponse: train-schedule lookup failed for ${booking.id}: ${(err as Error).message}`,
+        );
+      }
+    }
+
     // Physical container numbers entered at booking time (booking_container
     // units), flattened for the customer truck-assignment container picker.
     const containerNumbers = (booking.bookingContainers ?? [])
@@ -1310,6 +1375,7 @@ export class BookingTransitionService {
       nextStep,
       activeBatchOffer,
       containerNumbers,
+      trainSchedule,
     };
   }
 }
diff --git a/apps/edr-freight-api/src/modules/bookings/booking-wagon-cancellation.service.ts b/apps/edr-freight-api/src/modules/bookings/booking-wagon-cancellation.service.ts
new file mode 100644
index 000000000..c576f5a43
--- /dev/null
+++ b/apps/edr-freight-api/src/modules/bookings/booking-wagon-cancellation.service.ts
@@ -0,0 +1,1124 @@
+import {
+  BadRequestException,
+  ConflictException,
+  forwardRef,
+  Inject,
+  Injectable,
+  Logger,
+  NotFoundException,
+} from '@nestjs/common';
+import { Freight, NotificationAudience, NotificationType } from '@edr/types';
+import { DataSource, EntityManager, In } from 'typeorm';
+
+import { BillingService } from '../billing/billing.service';
+import { ContractBookingService } from '../contracts/contract-booking.service';
+import { ClearanceMilestoneService } from '../contracts/clearance-milestone.service';
+import { CreateBookingUnderContractDto } from '../contracts/dto/create-booking-under-contract.dto';
+import { ClearanceMilestone } from '../contracts/entities/clearance-milestone.entity';
+import { FirstMileService } from '../first-mile/first-mile.service';
+import { NotificationInboxService } from '../notification-inbox/notification-inbox.service';
+import { wagonsPerUnitForSize } from '../rule-engine/container-type.util';
+import { Rate } from '../rule-engine/entities/rate.entity';
+import { BookingBatchService } from '../train-scheduling/booking-batch.service';
+import { TrainSchedulingService } from '../train-scheduling/train-scheduling.service';
+import { WagonAllocationBulkLoad } from '../train-schedules/entities/wagon-allocation-bulk-load.entity';
+import { WagonAllocationContainerItem } from '../train-schedules/entities/wagon-allocation-container-item.entity';
+import { WagonBookingAllocation } from '../train-schedules/entities/wagon-booking-allocation.entity';
+import { FREIGHT_PERMS } from '../../seed/freight-permissions.registry';
+import {
+  BookingWagonCancellationsRepository,
+  WagonCancellationListFilter,
+} from './booking-wagon-cancellations.repository';
+import { BookingsRepository } from './bookings.repository';
+import {
+  RebookCancelledWagonsDto,
+  RequestWagonCancellationDto,
+} from './dto/wagon-cancellation.dto';
+import { Booking } from './entities/booking.entity';
+import { BookingContainer } from './entities/booking-container.entity';
+import { BookingContainerUnit } from './entities/booking-container-unit.entity';
+import {
+  BookingWagonCancellation,
+  CancelledQuantities,
+  CancelledUnitSnapshot,
+} from './entities/booking-wagon-cancellation.entity';
+
+/**
+ * rates.rate_type of the cancellation fee — an existing rate-engine type
+ * (trigger CANCELLATION, never auto-applied to booking pricing). Staff
+ * configure it in the normal rates UI; the wagon flow requires the PER_WAGON
+ * unit so the fee scales with the cancelled wagon count.
+ */
+export const WAGON_CANCELLATION_FEE_RATE_TYPE = 'CANCELLATION_FEE';
+/** invoices.type of the fee invoice — the settlement branch key in BookingInvoiceService. */
+export const WAGON_CANCEL_FEE_INVOICE_TYPE = 'WAGON_CANCEL_FEE';
+
+const round2 = (n: number): number => Math.round(n * 100) / 100;
+const round3 = (n: number): number => Math.round(n * 1000) / 1000;
+
+interface RequestedCut {
+  wagons: number;
+  weightTons: number;
+  quantities: CancelledQuantities;
+}
+
+/**
+ * Partial wagon cancellation on a PAID booking, with a rebooking credit.
+ *
+ * Lifecycle (one ledger row per cycle, see BookingWagonCancellation):
+ *  T1 request  — validate + price the fee, open the fee invoice. Nothing else
+ *                moves: the wagons stay allocated until the fee is money.
+ *  T2 fee paid — reduce the booking in place (applySplit mechanics: soft-delete
+ *                the cut units LIFO), release the surplus wagon allocations,
+ *                snapshot the cut units on the ledger row → CREDIT_AVAILABLE.
+ *  T3 rebook   — customer picks a day only. The credit becomes a REAL booking
+ *                via ContractBookingService.createUnderContract (which re-checks
+ *                contract validity + caps), immediately marked PAID — the
+ *                freight was paid on the original booking; only the fee was new
+ *                money. Clearance milestones are copied from the source booking
+ *                (the cargo is already cleared; clearance follows cargo, not
+ *                train date).
+ *
+ * The cycle is repeatable by construction: the rebooked booking is a normal
+ * PAID booking, so it can itself be partially cancelled again.
+ */
+@Injectable()
+export class BookingWagonCancellationService {
+  private readonly logger = new Logger(BookingWagonCancellationService.name);
+
+  constructor(
+    private readonly dataSource: DataSource,
+    private readonly repo: BookingWagonCancellationsRepository,
+    private readonly bookingsRepository: BookingsRepository,
+    private readonly billing: BillingService,
+    @Inject(forwardRef(() => ContractBookingService))
+    private readonly contractBooking: ContractBookingService,
+    @Inject(forwardRef(() => ClearanceMilestoneService))
+    private readonly clearanceMilestones: ClearanceMilestoneService,
+    @Inject(forwardRef(() => BookingBatchService))
+    private readonly bookingBatch: BookingBatchService,
+    @Inject(forwardRef(() => TrainSchedulingService))
+    private readonly trainScheduling: TrainSchedulingService,
+    @Inject(forwardRef(() => FirstMileService))
+    private readonly firstMile: FirstMileService,
+    private readonly inbox: NotificationInboxService,
+  ) {}
+
+  // ── T1: request ────────────────────────────────────────────────────────────
+
+  /** Fee/credit preview for the confirm dialog — same math as the request, no writes. */
+  async previewCancellation(
+    bookingId: string,
+    dto: RequestWagonCancellationDto,
+  ): Promise<{
+    wagons: number;
+    weightTons: number;
+    feePerWagon: number;
+    feeAmount: number;
+    feeCurrency: string;
+    creditAmount: number;
+  }> {
+    const booking = await this.loadCancellableBooking(bookingId);
+    const cut = await this.resolveRequestedCut(booking, dto);
+    const rate = await this.feeRate();
+    const feeAmount = round2(Number(rate.rateValue) * cut.wagons);
+    return {
+      wagons: cut.wagons,
+      weightTons: cut.weightTons,
+      feePerWagon: Number(rate.rateValue),
+      feeAmount,
+      feeCurrency: rate.currency,
+      creditAmount: this.creditFor(booking, cut.wagons),
+    };
+  }
+
+  async requestCancellation(
+    bookingId: string,
+    dto: RequestWagonCancellationDto,
+    userId?: string,
+  ): Promise<BookingWagonCancellation> {
+    const booking = await this.loadCancellableBooking(bookingId);
+    const open = await this.repo.findOpenForBooking(bookingId);
+    if (open) {
+      throw new ConflictException(
+        'This booking already has a cancellation awaiting its fee. Pay or withdraw it first.',
+      );
+    }
+
+    const cut = await this.resolveRequestedCut(booking, dto);
+    const rate = await this.feeRate();
+    const feeAmount = round2(Number(rate.rateValue) * cut.wagons);
+    const creditAmount = this.creditFor(booking, cut.wagons);
+
+    const row = await this.repo.create({
+      bookingId,
+      wagonsCancelled: cut.wagons,
+      weightTons: cut.weightTons,
+      cancelledQuantities: cut.quantities,
+      creditAmount,
+      feeRateId: rate.id,
+      feeAmount,
+      feeCurrency: rate.currency,
+      status: 'FEE_PENDING',
+      reason: dto.reason ?? null,
+      requestedByUserId: userId ?? null,
+    });
+
+    // The fee invoice rides the booking's own invoice list (source=booking), so
+    // the portal's existing invoice/pay stack picks it up with zero new payment
+    // code. Settlement branches on type in BookingInvoiceService.
+    const invoice = await this.billing.generateInvoice({
+      source: Freight.InvoiceSource.Booking,
+      sourceId: bookingId,
+      type: WAGON_CANCEL_FEE_INVOICE_TYPE,
+      companyId: booking.companyId,
+      companyProfileId: booking.companyProfileId,
+      currency: rate.currency,
+      lines: [
+        {
+          chargeType: 'CANCELLATION_FEE',
+          description: `Wagon cancellation fee — ${cut.wagons} wagon(s) of booking ${booking.reference}`,
+          quantity: cut.wagons,
+          unitRate: Number(rate.rateValue),
+          amount: feeAmount,
+          currency: rate.currency,
+          metadata: { wagonCancellationId: row.id },
+        },
+      ],
+      totalAmount: feeAmount,
+      status: Freight.InvoiceStatus.Issued,
+    });
+    let updated = await this.repo.update(row.id, { feeInvoiceId: invoice.id });
+
+    // Policy: the cancelled wagons leave the schedule NOW — capacity frees for
+    // other customers immediately; the fee is still owed before the credit can
+    // be rebooked. A withdraw/void re-allocates (or errors when the train has
+    // no room left). If this release fails, T2 releases instead (flag unset).
+    try {
+      const released = await this.releaseAtRequest(bookingId, cut);
+      if (released) {
+        updated = await this.repo.update(row.id, {
+          cancelledQuantities: { ...cut.quantities, releasedAtRequest: true },
+        });
+      }
+    } catch (err) {
+      this.logger.error(
+        `Request-time wagon release failed for cancellation ${row.id}: ${err instanceof Error ? err.message : String(err)}`,
+      );
+    }
+
+    this.notifyStaff(
+      booking,
+      'Wagon cancellation requested',
+      `${booking.reference}: customer asked to cancel ${cut.wagons} wagon(s); fee invoice ${invoice.invoiceNumber} issued.`,
+    );
+    return updated ?? row;
+  }
+
+  /**
+   * Void a FEE_PENDING request (customer withdraw or staff void). The wagons
+   * left the schedule at request time, so voiding must first put them back:
+   * the schedule's auto-allocation is re-run and the result verified — if the
+   * train has no room left, the void FAILS with a clear error and the request
+   * stays FEE_PENDING (pay the fee and rebook the credit instead).
+   */
+  async withdraw(cancellationId: string): Promise<BookingWagonCancellation> {
+    const row = await this.mustFind(cancellationId);
+    if (row.status !== 'FEE_PENDING') {
+      throw new BadRequestException(
+        `Only a fee-pending cancellation can be withdrawn (status is ${row.status}).`,
+      );
+    }
+
+    if (row.cancelledQuantities.releasedAtRequest) {
+      const booking = await this.bookingsRepository.findById(row.bookingId);
+      const scheduleId = booking?.trainScheduleId;
+      if (booking && scheduleId) {
+        try {
+          await this.trainScheduling.tryAutoWagonAllocation(scheduleId);
+        } catch (err) {
+          this.logger.warn(
+            `Re-allocation on withdraw failed for booking ${row.bookingId}: ${err instanceof Error ? err.message : String(err)}`,
+          );
+        }
+        // ponytail: allocation rows ≈ wagons (20ft pairs share one row/wagon);
+        // switch to a weight-based check if mixed loads ever make this lie.
+        const rows = await this.dataSource.getRepository(WagonBookingAllocation).count({
+          where: { bookingId: row.bookingId },
+        });
+        if (rows < Math.round(Number(booking.wagonsRequired ?? 0))) {
+          throw new ConflictException(
+            'The train has no free wagon space left to restore the cancelled wagons — the request cannot be withdrawn. Pay the cancellation fee and rebook the credit on another day instead.',
+          );
+        }
+      }
+    }
+
+    if (row.feeInvoiceId) await this.billing.cancelInvoice(row.feeInvoiceId);
+    return (await this.repo.update(row.id, { status: 'WITHDRAWN' }))!;
+  }
+
+  // ── T2: fee settled ─────────────────────────────────────────────────────────
+
+  /**
+   * The fee invoice settled — reduce the booking and free the wagons. Called
+   * from BookingInvoiceService's paid handler. Idempotent: a duplicate webhook
+   * finds the row already past FEE_PENDING and returns.
+   */
+  async onFeePaid(feeInvoiceId: string): Promise<void> {
+    const row = await this.repo.findByFeeInvoiceId(feeInvoiceId);
+    if (!row) {
+      this.logger.warn(`No wagon cancellation for paid fee invoice ${feeInvoiceId}.`);
+      return;
+    }
+    if (row.status !== 'FEE_PENDING') return;
+
+    // The fee can settle after loading started (slow payment). Never cut
+    // loaded cargo: leave the row FEE_PENDING and alert staff to resolve
+    // (reschedule the cut or refund the fee by hand). Skipped when the wagons
+    // already left the schedule at request time — loading of the KEPT wagons
+    // is then irrelevant to this cut.
+    const releasedEarly = !!row.cancelledQuantities.releasedAtRequest;
+    const bookingNow = await this.bookingsRepository.findById(row.bookingId);
+    const movingNow = releasedEarly
+      ? 0
+      : await this.dataSource.getRepository(WagonBookingAllocation).count({
+          where: { bookingId: row.bookingId, status: In(['LOADED', 'DEPARTED']) },
+        });
+    if (!releasedEarly && (bookingNow?.loadedAt || movingNow > 0)) {
+      this.logger.error(
+        `Wagon cancellation ${row.id}: fee paid but loading already started on booking ${row.bookingId} — left FEE_PENDING for manual resolution.`,
+      );
+      if (bookingNow) {
+        this.notifyStaff(
+          bookingNow,
+          'Wagon cancellation fee paid after loading started',
+          `${bookingNow.reference}: the customer paid the cancellation fee for ${row.wagonsCancelled} wagon(s), but loading has already started. Resolve manually (adjust the cut or refund the fee).`,
+        );
+      }
+      return;
+    }
+
+    await this.dataSource.transaction(async (manager) => {
+      const booking = await manager.getRepository(Booking).findOne({
+        where: { id: row.bookingId },
+        lock: { mode: 'pessimistic_write' },
+      });
+      if (!booking) throw new NotFoundException(`Booking ${row.bookingId} not found.`);
+
+      const quantities = { ...row.cancelledQuantities };
+      let droppedWeight = 0;
+
+      if (quantities.bySize && Object.keys(quantities.bySize).length) {
+        // Specific-wagon requests already carry the exact unit snapshots;
+        // quantity requests trim LIFO and snapshot here.
+        const units = quantities.units?.length
+          ? await this.reduceContainerUnitsExact(manager, booking, quantities.units)
+          : await this.reduceContainerLines(manager, booking, quantities.bySize);
+        quantities.units = units;
+        droppedWeight = round3(units.reduce((s, u) => s + Number(u.vgmTons || 0), 0));
+        if (!releasedEarly) {
+          await this.releaseContainerAllocations(
+            manager,
+            booking.id,
+            units.map((u) => u.containerNumber),
+          );
+        }
+      } else {
+        droppedWeight = Number(quantities.bulkTons ?? row.weightTons);
+        await this.reduceBulk(manager, booking, droppedWeight);
+        if (!releasedEarly) {
+          await this.releaseBulkAllocations(
+            manager,
+            booking.id,
+            Number(row.wagonsCancelled),
+            quantities.allocationIds,
+          );
+        }
+      }
+
+      // Mirror applySplit's bookkeeping: preSplitQuantities feeds the ONE_TIME
+      // exact-remainder assertion at rebook time; isSplit releases the
+      // single-active-booking slot so the rebooked booking may be created.
+      const preSplitQuantities =
+        booking.preSplitQuantities ?? (await this.currentQuantities(manager, booking, droppedWeight));
+
+      await manager.getRepository(Booking).update(booking.id, {
+        wagonsRequired: round2(Number(booking.wagonsRequired ?? 0) - Number(row.wagonsCancelled)),
+        cargoTotalWeightVgm: round3(Number(booking.cargoTotalWeightVgm) - droppedWeight),
+        totalAmount: round2(Number(booking.totalAmount) - Number(row.creditAmount)),
+        isSplit: true,
+        preSplitQuantities,
+      } as never);
+
+      await manager.getRepository(BookingWagonCancellation).update(row.id, {
+        status: 'CREDIT_AVAILABLE',
+        feePaidAt: new Date(),
+        weightTons: droppedWeight,
+        cancelledQuantities: quantities,
+      });
+    });
+
+    const booking = await this.bookingsRepository.findById(row.bookingId);
+    if (booking) {
+      this.notifyCustomer(
+        booking,
+        'Wagon cancellation confirmed',
+        `${row.wagonsCancelled} wagon(s) of ${booking.reference} are cancelled. Your paid freight is kept as credit — rebook any day while your contract is valid.`,
+      );
+    }
+    this.logger.log(
+      `Wagon cancellation ${row.id}: fee paid, booking ${row.bookingId} reduced by ${row.wagonsCancelled} wagon(s).`,
+    );
+  }
+
+  // ── T3: rebook ──────────────────────────────────────────────────────────────
+
+  async rebook(
+    cancellationId: string,
+    dto: RebookCancelledWagonsDto,
+    userId?: string,
+  ): Promise<{ cancellation: BookingWagonCancellation; bookingId: string }> {
+    const row = await this.mustFind(cancellationId);
+    if (row.status !== 'CREDIT_AVAILABLE') {
+      throw new BadRequestException(
+        `This credit cannot be rebooked (status is ${row.status}).`,
+      );
+    }
+    const source = await this.bookingsRepository.findById(row.bookingId);
+    if (!source) throw new NotFoundException(`Booking ${row.bookingId} not found.`);
+    if (!source.contractId) {
+      throw new BadRequestException('The original booking has no contract to rebook under.');
+    }
+    // Friendly pre-check; createUnderContract re-asserts inside its own guards.
+    if (
+      source.contractValidUntil &&
+      new Date(source.contractValidUntil).getTime() < Date.now()
+    ) {
+      throw new BadRequestException(
+        'Contract validity has expired — ask EDR staff to extend the contract before rebooking.',
+      );
+    }
+
+    const createDto = this.buildRebookDto(row, dto.scheduledDate);
+    const created = await this.contractBooking.createUnderContract(
+      source.contractId,
+      createDto,
+      { id: userId ?? source.createdByUserId ?? undefined },
+      // System actor: carries the create-booking key so the GL gate passes on
+      // Path B (customs-clearance) contracts; harmless on Path A.
+      { permissions: [{ key: FREIGHT_PERMS.contracts.createBooking }] },
+    );
+    const newBookingId = created.booking.id;
+
+    // The freight is already paid (credit) — mark PAID and let the existing
+    // paid-booking machinery place it. No invoice is generated for it.
+    await this.dataSource.getRepository(Booking).update(newBookingId, {
+      paymentStatus: 'PAID',
+      status: 'PAID',
+    });
+    await this.copyClearanceState(source, newBookingId);
+
+    try {
+      await this.firstMile.acceptBooking(newBookingId);
+    } catch (err) {
+      this.logger.error(
+        `First-mile accept failed for rebooked ${newBookingId}: ${err instanceof Error ? err.message : String(err)}`,
+      );
+    }
+    try {
+      await this.bookingBatch.ensurePaidBookingAllocated(newBookingId);
+    } catch (err) {
+      this.logger.error(
+        `Allocation failed for rebooked ${newBookingId}: ${err instanceof Error ? err.message : String(err)}`,
+      );
+    }
+
+    const updated = (await this.repo.update(row.id, {
+      status: 'REBOOKED',
+      rebookedBookingId: newBookingId,
+      rebookedAt: new Date(),
+    }))!;
+
+    this.notifyCustomer(
+      source,
+      'Cancelled wagons rebooked',
+      `Your ${row.wagonsCancelled} cancelled wagon(s) from ${source.reference} are rebooked for ${dto.scheduledDate}. No new freight charge — your credit covered it.`,
+      newBookingId,
+    );
+    return { cancellation: updated, bookingId: newBookingId };
+  }
+
+  // ── History ────────────────────────────────────────────────────────────────
+
+  list(filter: WagonCancellationListFilter) {
+    return this.repo.list(filter);
+  }
+
+  findById(id: string): Promise<BookingWagonCancellation> {
+    return this.mustFind(id);
+  }
+
+  // ── internals ──────────────────────────────────────────────────────────────
+
+  private async mustFind(id: string): Promise<BookingWagonCancellation> {
+    const row = await this.repo.findById(id);
+    if (!row) throw new NotFoundException(`Wagon cancellation ${id} not found.`);
+    return row;
+  }
+
+  /** PAID booking, not yet moving, with a contract to rebook under later. */
+  private async loadCancellableBooking(bookingId: string): Promise<Booking> {
+    const booking = await this.bookingsRepository.findById(bookingId);
+    if (!booking) throw new NotFoundException(`Booking ${bookingId} not found.`);
+    if (booking.paymentStatus !== 'PAID' || booking.status !== 'PAID') {
+      throw new BadRequestException(
+        'Only a paid booking can cancel wagons. Before payment, cancel the booking itself — no fee applies.',
+      );
+    }
+    if (!booking.contractId) {
+      throw new BadRequestException(
+        'Wagon cancellation needs a contract booking (the credit is rebooked under the contract).',
+      );
+    }
+    // Cancellation is allowed strictly BEFORE loading/dispatch: both signals
+    // checked — per-wagon allocation status and the booking-level loading stamp
+    // (some flows confirm loading on the booking without flipping allocations).
+    if (booking.loadedAt) {
+      throw new BadRequestException(
+        'Cargo loading is confirmed for this booking — wagons can no longer be cancelled.',
+      );
+    }
+    const moving = await this.dataSource.getRepository(WagonBookingAllocation).count({
+      where: { bookingId, status: In(['LOADED', 'DEPARTED']) },
+    });
+    if (moving > 0) {
+      throw new BadRequestException(
+        'Loading has started for this booking — wagons can no longer be cancelled.',
+      );
+    }
+    return booking;
+  }
+
+  /** Validate the requested cut against the live booking and size it in wagons/tons. */
+  private async resolveRequestedCut(
+    booking: Booking,
+    dto: RequestWagonCancellationDto,
+  ): Promise<RequestedCut> {
+    const totalWagons = Number(booking.wagonsRequired ?? 0);
+    if (totalWagons <= 0) {
+      throw new BadRequestException('This booking has no wagon requirement to cancel from.');
+    }
+
+    if (dto.wagonAllocationIds?.length) {
+      return this.resolveCutFromAllocations(booking, dto.wagonAllocationIds, totalWagons);
+    }
+
+    if (booking.freightType === 'CONTAINER') {
+      if (!dto.containers?.length) {
+        throw new BadRequestException('Specify the container units to cancel per size.');
+      }
+      const lines = await this.dataSource.getRepository(BookingContainer).find({
+        where: { bookingId: booking.id },
+      });
+      const liveBySize = new Map<string, number>();
+      for (const line of lines) {
+        const size = line.containerSize ?? '';
+        liveBySize.set(size, (liveBySize.get(size) ?? 0) + Number(line.quantity ?? 0));
+      }
+      const bySize: Record<string, number> = {};
+      let wagons = 0;
+      for (const cut of dto.containers) {
+        const live = liveBySize.get(cut.containerSize) ?? 0;
+        if (cut.quantity > live) {
+          throw new BadRequestException(
+            `Cannot cancel ${cut.quantity} × ${cut.containerSize}ft — the booking only has ${live}.`,
+          );
+        }
+        bySize[cut.containerSize] = cut.quantity;
+        wagons += cut.quantity * wagonsPerUnitForSize(Number(cut.containerSize));
+      }
+      wagons = round2(wagons);
+      if (wagons >= totalWagons) {
+        throw new BadRequestException(
+          'That would cancel the whole booking — use booking cancellation instead of a partial wagon cancel.',
+        );
+      }
+      // Snapshot the LIFO-picked physical units up front (read-only — cargo is
+      // cut only when the fee settles) so the wagons carrying them can be
+      // released from the schedule at request time and the portal can show
+      // which containers are leaving.
+      const unitRepo = this.dataSource.getRepository(BookingContainerUnit);
+      const units: CancelledUnitSnapshot[] = [];
+      let requested = 0;
+      for (const cut of dto.containers) {
+        requested += cut.quantity;
+        let need = cut.quantity;
+        const sizeLines = lines
+          .filter((l) => (l.containerSize ?? '') === cut.containerSize)
+          .sort((a, b) => +new Date(b.createdAt) - +new Date(a.createdAt));
+        for (const line of sizeLines) {
+          if (need <= 0) break;
+          const us = await unitRepo.find({
+            where: { bookingContainerId: line.id },
+            order: { sortOrder: 'DESC', createdAt: 'DESC' },
+            take: need,
+          });
+          for (const u of us) {
+            units.push({
+              containerSize: cut.containerSize,
+              containerNumber: u.containerNumber,
+              sealNumber: u.sealNumber ?? null,
+              vgmTons: Number(u.vgmTons),
+              isHazardous: u.isHazardous,
+              isReefer: u.isReefer,
+            });
+            need--;
+          }
+        }
+      }
+      const weightShare = round3(
+        Number(booking.cargoTotalWeightVgm) * (wagons / totalWagons),
+      );
+      return {
+        wagons,
+        weightTons: weightShare,
+        // Bookings without unit records fall back to the T2 LIFO trim.
+        quantities: { bySize, ...(units.length === requested ? { units } : {}) },
+      };
+    }
+
+    // BULK: the customer cancels wagons; tons follow the booking's own
+    // tons-per-wagon ratio.
+    const wagons = round2(Number(dto.wagons ?? 0));
+    if (!wagons || wagons <= 0) {
+      throw new BadRequestException('Specify how many wagons to cancel.');
+    }
+    if (wagons >= totalWagons) {
+      throw new BadRequestException(
+        'That would cancel the whole booking — use booking cancellation instead of a partial wagon cancel.',
+      );
+    }
+    // ponytail: proportional sizing (tons/wagon = total/wagons). PER_ITEM item
+    // rounding happens here too; switch to items_per_wagon_map sizing if bulk
+    // PER_ITEM cancels ever need to be exact per item.
+    let tons = Number(booking.cargoTotalWeightVgm) * (wagons / totalWagons);
+    const isPerItem = booking.bulkTotalWeightTons != null;
+    tons = isPerItem ? Math.floor(tons) : round3(tons);
+    if (tons <= 0) {
+      throw new BadRequestException('The requested cut is too small to release cargo.');
+    }
+    return { wagons, weightTons: tons, quantities: { bulkTons: tons } };
+  }
+
+  /**
+   * Specific-wagon cancellation: the customer picked wagons in the Wagons tab.
+   * Everything is derived from the selected allocations — container bookings
+   * get their exact unit snapshots up front (T2 then cuts precisely these,
+   * not a LIFO guess), bulk gets the wagons' actual allocated tonnage.
+   */
+  private async resolveCutFromAllocations(
+    booking: Booking,
+    allocationIds: string[],
+    totalWagons: number,
+  ): Promise<RequestedCut> {
+    const allocations = await this.dataSource.getRepository(WagonBookingAllocation).find({
+      where: { id: In(allocationIds), bookingId: booking.id },
+      relations: { containerItems: true },
+    });
+    if (allocations.length !== allocationIds.length) {
+      throw new BadRequestException(
+        'Some selected wagons no longer belong to this booking — refresh and pick again.',
+      );
+    }
+    const notCancellable = allocations.filter(
+      (a) => a.status !== 'PLANNED' && a.status !== 'RESERVED',
+    );
+    if (notCancellable.length) {
+      throw new BadRequestException(
+        'A selected wagon is already loaded or departed and cannot be cancelled.',
+      );
+    }
+
+    const wagons = allocations.length;
+    if (wagons >= totalWagons) {
+      throw new BadRequestException(
+        'That would cancel the whole booking — use booking cancellation instead of a partial wagon cancel.',
+      );
+    }
+
+    if (booking.freightType !== 'CONTAINER') {
+      const allocated = allocations.reduce(
+        (s, a) => s + Number(a.allocatedWeightTons || 0),
+        0,
+      );
+      const tons =
+        allocated > 0
+          ? round3(allocated)
+          : round3(Number(booking.cargoTotalWeightVgm) * (wagons / totalWagons));
+      return {
+        wagons,
+        weightTons: tons,
+        quantities: { bulkTons: tons, allocationIds },
+      };
+    }
+
+    // Container: the selected wagons' items name the exact physical boxes.
+    const numbers = allocations
+      .flatMap((a) => a.containerItems ?? [])
+      .map((i) => i.containerNumber)
+      .filter((n): n is string => !!n);
+    if (!numbers.length) {
+      throw new BadRequestException(
+        'The selected wagons carry no container records — cancel by quantity instead.',
+      );
+    }
+    const lines = await this.dataSource.getRepository(BookingContainer).find({
+      where: { bookingId: booking.id },
+    });
+    const unitRepo = this.dataSource.getRepository(BookingContainerUnit);
+    const units: CancelledUnitSnapshot[] = [];
+    const bySize: Record<string, number> = {};
+    for (const line of lines) {
+      const size = line.containerSize ?? '';
+      const lineUnits = await unitRepo.find({ where: { bookingContainerId: line.id } });
+      for (const u of lineUnits) {
+        if (!numbers.includes(u.containerNumber)) continue;
+        units.push({
+          containerSize: size,
+          containerNumber: u.containerNumber,
+          sealNumber: u.sealNumber ?? null,
+          vgmTons: Number(u.vgmTons),
+          isHazardous: u.isHazardous,
+          isReefer: u.isReefer,
+        });
+        bySize[size] = (bySize[size] ?? 0) + 1;
+      }
+    }
+    if (units.length !== numbers.length) {
+      throw new BadRequestException(
+        'Wagon container records are out of sync with the booking — contact EDR support.',
+      );
+    }
+    return {
+      wagons,
+      weightTons: round3(units.reduce((s, u) => s + Number(u.vgmTons || 0), 0)),
+      quantities: { bySize, units, allocationIds },
+    };
+  }
+
+  /** Credit = the cancelled share of the ORIGINAL price (old-price rebooking). */
+  private creditFor(booking: Booking, wagons: number): number {
+    const totalWagons = Number(booking.wagonsRequired ?? 0);
+    if (totalWagons <= 0) return 0;
+    return round2(Number(booking.totalAmount) * (wagons / totalWagons));
+  }
+
+  private async feeRate(): Promise<Rate> {
+    const rate = await this.dataSource.getRepository(Rate).findOne({
+      where: {
+        rateType: WAGON_CANCELLATION_FEE_RATE_TYPE,
+        rateUnit: 'PER_WAGON',
+        status: 'LIVE',
+      },
+      order: { createdAt: 'DESC' },
+    });
+    if (!rate) {
+      throw new BadRequestException(
+        'No LIVE per-wagon CANCELLATION_FEE rate is configured — ask EDR to set it in the rate engine (unit PER_WAGON).',
+      );
+    }
+    return rate;
+  }
+
+  /**
+   * Trim `bySize` units off the booking's container lines, newest line first,
+   * LIFO within a line — the exact applySplit mechanics. Returns snapshots of
+   * every physical unit soft-deleted, for later reconstruction.
+   */
+  private async reduceContainerLines(
+    manager: EntityManager,
+    booking: Booking,
+    bySize: Record<string, number>,
+  ): Promise<CancelledUnitSnapshot[]> {
+    const snapshots: CancelledUnitSnapshot[] = [];
+    for (const [size, toDrop] of Object.entries(bySize)) {
+      let remaining = toDrop;
+      const lines = await manager.getRepository(BookingContainer).find({
+        where: { bookingId: booking.id, containerSize: size },
+        order: { createdAt: 'DESC' },
+      });
+      const live = lines.reduce((s, l) => s + Number(l.quantity ?? 0), 0);
+      if (live < toDrop) {
+        throw new BadRequestException(
+          `Booking changed since the request: only ${live} × ${size}ft left, cannot cancel ${toDrop}.`,
+        );
+      }
+      for (const line of lines) {
+        if (remaining <= 0) break;
+        const qty = Number(line.quantity ?? 0);
+        const drop = Math.min(remaining, qty);
+        remaining -= drop;
+
+        const units = await manager.getRepository(BookingContainerUnit).find({
+          where: { bookingContainerId: line.id },
+          order: { sortOrder: 'DESC', createdAt: 'DESC' },
+          take: drop,
+        });
+        for (const u of units) {
+          snapshots.push({
+            containerSize: size,
+            containerNumber: u.containerNumber,
+            sealNumber: u.sealNumber ?? null,
+            vgmTons: Number(u.vgmTons),
+            isHazardous: u.isHazardous,
+            isReefer: u.isReefer,
+          });
+        }
+        if (units.length < drop) {
+          throw new BadRequestException(
+            `Booking line ${line.id} has ${units.length} physical unit record(s) but ${drop} must be cancelled — units out of sync.`,
+          );
+        }
+        const droppedVgm = round3(units.reduce((s, u) => s + Number(u.vgmTons || 0), 0));
+
+        if (drop === qty) {
+          await manager.getRepository(BookingContainer).softDelete(line.id);
+          await manager
+            .getRepository(BookingContainerUnit)
+            .softDelete(units.map((u) => u.id));
+          continue;
+        }
+        await manager.getRepository(BookingContainerUnit).softDelete(units.map((u) => u.id));
+        const keptUnits = await manager.getRepository(BookingContainerUnit).find({
+          where: { bookingContainerId: line.id },
+        });
+        await manager.getRepository(BookingContainer).update(line.id, {
+          quantity: qty - drop,
+          wagonsRequired: round2((qty - drop) * wagonsPerUnitForSize(Number(size))),
+          totalVgmTons: round3(Number(line.totalVgmTons) - droppedVgm),
+          hazardousQuantity: keptUnits.filter((u) => u.isHazardous).length,
+          reeferQuantity: keptUnits.filter((u) => u.isReefer).length,
+        });
+      }
+    }
+    return snapshots;
+  }
+
+  /**
+   * Release the cancelled wagons from the schedule at REQUEST time. Returns
+   * true when something was actually released (booking was on a train) — the
+   * caller then stamps `releasedAtRequest` so T2 skips its release step.
+   */
+  private async releaseAtRequest(bookingId: string, cut: RequestedCut): Promise<boolean> {
+    const had = await this.dataSource.getRepository(WagonBookingAllocation).count({
+      where: { bookingId },
+    });
+    if (had === 0) return false;
+
+    await this.dataSource.transaction(async (manager) => {
+      if (cut.quantities.units?.length) {
+        await this.releaseContainerAllocations(
+          manager,
+          bookingId,
+          cut.quantities.units.map((u) => u.containerNumber),
+        );
+      } else if (!cut.quantities.bySize) {
+        await this.releaseBulkAllocations(
+          manager,
+          bookingId,
+          cut.wagons,
+          cut.quantities.allocationIds,
+        );
+      }
+      // Container booking without unit records: nothing to match on — the
+      // wagons release at T2 via the LIFO trim instead.
+    });
+
+    const left = await this.dataSource.getRepository(WagonBookingAllocation).count({
+      where: { bookingId },
+    });
+    return left < had;
+  }
+
+  /**
+   * Cut EXACTLY the snapshotted units (specific-wagon cancellation): soft-delete
+   * them and rebalance each affected line. Returns the snapshots of the units
+   * actually cut, so drift since the request fails loudly instead of guessing.
+   */
+  private async reduceContainerUnitsExact(
+    manager: EntityManager,
+    booking: Booking,
+    wanted: CancelledUnitSnapshot[],
+  ): Promise<CancelledUnitSnapshot[]> {
+    const numbers = wanted.map((u) => u.containerNumber);
+    const lines = await manager.getRepository(BookingContainer).find({
+      where: { bookingId: booking.id },
+    });
+    const cut: CancelledUnitSnapshot[] = [];
+    for (const line of lines) {
+      const size = line.containerSize ?? '';
+      const lineUnits = await manager.getRepository(BookingContainerUnit).find({
+        where: { bookingContainerId: line.id },
+      });
+      const doomed = lineUnits.filter((u) => numbers.includes(u.containerNumber));
+      if (!doomed.length) continue;
+
+      await manager.getRepository(BookingContainerUnit).softDelete(doomed.map((u) => u.id));
+      for (const u of doomed) {
+        cut.push({
+          containerSize: size,
+          containerNumber: u.containerNumber,
+          sealNumber: u.sealNumber ?? null,
+          vgmTons: Number(u.vgmTons),
+          isHazardous: u.isHazardous,
+          isReefer: u.isReefer,
+        });
+      }
+      const kept = lineUnits.filter((u) => !numbers.includes(u.containerNumber));
+      if (!kept.length) {
+        await manager.getRepository(BookingContainer).softDelete(line.id);
+        continue;
+      }
+      const doomedVgm = round3(doomed.reduce((s, u) => s + Number(u.vgmTons || 0), 0));
+      await manager.getRepository(BookingContainer).update(line.id, {
+        quantity: kept.length,
+        wagonsRequired: round2(kept.length * wagonsPerUnitForSize(Number(size))),
+        totalVgmTons: round3(Number(line.totalVgmTons) - doomedVgm),
+        hazardousQuantity: kept.filter((u) => u.isHazardous).length,
+        reeferQuantity: kept.filter((u) => u.isReefer).length,
+      });
+    }
+    if (cut.length !== wanted.length) {
+      throw new BadRequestException(
+        `Booking changed since the request: ${cut.length}/${wanted.length} selected container(s) still on it.`,
+      );
+    }
+    return cut;
+  }
+
+  private async reduceBulk(
+    manager: EntityManager,
+    booking: Booking,
+    tons: number,
+  ): Promise<void> {
+    if (tons >= Number(booking.cargoTotalWeightVgm)) {
+      throw new BadRequestException(
+        'Booking changed since the request: the cut no longer leaves any cargo.',
+      );
+    }
+    if (booking.bulkTotalWeightTons != null) {
+      const share = tons / Number(booking.cargoTotalWeightVgm);
+      await manager.getRepository(Booking).update(booking.id, {
+        bulkTotalWeightTons: round3(Number(booking.bulkTotalWeightTons) * (1 - share)),
+      });
+    }
+  }
+
+  /**
+   * Free the wagon capacity of the cancelled container units. Items are matched
+   * by container number; an allocation left with no items is deleted whole
+   * (hard delete — the unassignBooking convention for allocation rows).
+   * A booking not yet placed on a train simply has nothing to release.
+   */
+  private async releaseContainerAllocations(
+    manager: EntityManager,
+    bookingId: string,
+    containerNumbers: string[],
+  ): Promise<void> {
+    if (!containerNumbers.length) return;
+    const allocations = await manager.getRepository(WagonBookingAllocation).find({
+      where: { bookingId },
+      relations: { containerItems: true },
+    });
+    for (const alloc of allocations) {
+      const items = alloc.containerItems ?? [];
+      const cut = items.filter(
+        (i) => i.containerNumber && containerNumbers.includes(i.containerNumber),
+      );
+      if (!cut.length) continue;
+      await manager
+        .getRepository(WagonAllocationContainerItem)
+        .delete(cut.map((i) => i.id));
+      if (cut.length === items.length) {
+        await manager.getRepository(WagonBookingAllocation).delete(alloc.id);
+      } else {
+        const cutWeight = cut.reduce((s, i) => s + Number(i.grossWeightTons ?? 0), 0);
+        await manager.getRepository(WagonBookingAllocation).update(alloc.id, {
+          allocatedWeightTons: round3(Number(alloc.allocatedWeightTons) - cutWeight),
+        });
+      }
+    }
+  }
+
+  /**
+   * Free whole bulk wagons — the customer-picked allocations when given
+   * (specific-wagon cancel), topping up newest-first for any picked id that no
+   * longer exists (re-batch between request and fee payment).
+   */
+  private async releaseBulkAllocations(
+    manager: EntityManager,
+    bookingId: string,
+    wagons: number,
+    pickedIds?: string[],
+  ): Promise<void> {
+    const toFree = Math.round(wagons);
+    if (toFree <= 0) return;
+    let allocations: WagonBookingAllocation[] = [];
+    if (pickedIds?.length) {
+      allocations = await manager.getRepository(WagonBookingAllocation).find({
+        where: { id: In(pickedIds), bookingId },
+      });
+    }
+    if (allocations.length < toFree) {
+      const have = new Set(allocations.map((a) => a.id));
+      const fill = await manager.getRepository(WagonBookingAllocation).find({
+        where: { bookingId },
+        order: { createdAt: 'DESC' },
+      });
+      for (const a of fill) {
+        if (allocations.length >= toFree) break;
+        if (!have.has(a.id)) allocations.push(a);
+      }
+    }
+    allocations = allocations.slice(0, toFree);
+    if (!allocations.length) return;
+    const ids = allocations.map((a) => a.id);
+    await manager
+      .getRepository(WagonAllocationBulkLoad)
+      .delete({ wagonBookingAllocationId: In(ids) });
+    await manager.getRepository(WagonBookingAllocation).delete(ids);
+  }
+
+  /** Pre-reduction quantities snapshot (only when the booking was never split before). */
+  private async currentQuantities(
+    manager: EntityManager,
+    booking: Booking,
+    _droppedWeight: number,
+  ): Promise<{ bulkTons?: number; bySize?: Record<string, number> }> {
+    if (booking.freightType !== 'CONTAINER') {
+      return { bulkTons: Number(booking.cargoTotalWeightVgm) };
+    }
+    // Lines were already reduced inside this transaction — read them with
+    // deleted rows included to reconstruct the pre-cut ledger.
+    const lines = await manager.getRepository(BookingContainer).find({
+      where: { bookingId: booking.id },
+      withDeleted: true,
+    });
+    const bySize: Record<string, number> = {};
+    for (const line of lines) {
+      const size = line.containerSize ?? '';
+      bySize[size] = (bySize[size] ?? 0) + Number(line.quantity ?? 0);
+    }
+    return { bySize };
+  }
+
+  /** The create-DTO that reconstructs the cancelled cargo on the chosen day. */
+  private buildRebookDto(
+    row: BookingWagonCancellation,
+    scheduledDate: string,
+  ): CreateBookingUnderContractDto {
+    const dto: CreateBookingUnderContractDto = { scheduledDate };
+    const q = row.cancelledQuantities;
+
+    if (q.bySize && Object.keys(q.bySize).length) {
+      const units = q.units ?? [];
+      dto.containers = Object.entries(q.bySize).map(([size, quantity]) => {
+        const sized = units.filter((u) => u.containerSize === size);
+        if (sized.length !== quantity) {
+          throw new BadRequestException(
+            `Credit is missing unit snapshots for size ${size} (${sized.length}/${quantity}) — contact EDR support.`,
+          );
+        }
+        return {
+          containerSize: size,
+          quantity,
+          units: sized.map((u) => ({
+            containerNumber: u.containerNumber,
+            sealNumber: u.sealNumber ?? undefined,
+            vgmTons: u.vgmTons,
+            isHazardous: u.isHazardous,
+            isReefer: u.isReefer,
+          })),
+          hazardousQuantity: sized.filter((u) => u.isHazardous).length,
+          reeferQuantity: sized.filter((u) => u.isReefer).length,
+        };
+      });
+      return dto;
+    }
+
+    dto.bulkLines = [{ cargoWeightTons: Number(q.bulkTons ?? row.weightTons) }];
+    return dto;
+  }
+
+  /**
+   * Carry the source booking's finished clearance onto the rebooked one: the
+   * cargo is already cleared; a new train date needs no new customs cycle.
+   * Seeds the standard milestone set idempotently, then mirrors every
+   * non-pending milestone status from the source by milestone code.
+   */
+  private async copyClearanceState(source: Booking, newBookingId: string): Promise<void> {
+    const repo = this.dataSource.getRepository(ClearanceMilestone);
+    const sourceMilestones = await repo.find({ where: { bookingId: source.id } });
+    if (!sourceMilestones.length) return;
+
+    try {
+      await this.clearanceMilestones.ensureBookingMilestones(
+        newBookingId,
+        source.tradeDirection,
+      );
+      const targets = await repo.find({ where: { bookingId: newBookingId } });
+      const byCode = new Map(targets.map((m) => [m.milestoneCode, m]));
+      for (const src of sourceMilestones) {
+        if (src.status === 'PENDING') continue;
+        const target = byCode.get(src.milestoneCode);
+        if (!target) continue;
+        await repo.update(target.id, {
+          status: src.status,
+          triggeredAt: src.triggeredAt,
+          triggeredByUserId: src.triggeredByUserId,
+          triggeredByDoc: src.triggeredByDoc,
+          note: src.note,
+          metadata: src.metadata,
+        });
+      }
+      if (source.clearanceCurrentPhase) {
+        await this.dataSource.getRepository(Booking).update(newBookingId, {
+          clearanceCurrentPhase: source.clearanceCurrentPhase,
+          preClearanceFinalizedAt: source.preClearanceFinalizedAt,
+          dutyRequired: source.dutyRequired,
+        });
+      }
+    } catch (err) {
+      // Clearance copy must never lose a paid rebooking — staff can re-complete
+      // milestones by hand if this ever fails.
+      this.logger.error(
+        `Clearance copy ${source.id} → ${newBookingId} failed: ${err instanceof Error ? err.message : String(err)}`,
+      );
+    }
+  }
+
+  private notifyCustomer(booking: Booking, title: string, body: string, linkBookingId?: string): void {
+    void this.inbox.notify({
+      recipients: { companyId: booking.companyId },
+      audience: NotificationAudience.PORTAL,
+      type: NotificationType.BOOKING_STATUS,
+      title,
+      body,
+      link: `/bookings/${linkBookingId ?? booking.id}`,
+      data: { bookingId: linkBookingId ?? booking.id, reference: booking.reference },
+    });
+  }
+
+  private notifyStaff(booking: Booking, title: string, body: string): void {
+    void this.inbox.notify({
+      recipients: { allBackoffice: true },
+      audience: NotificationAudience.BACKOFFICE,
+      type: NotificationType.BOOKING_STATUS,
+      title,
+      body,
+      link: `/bookings/${booking.id}`,
+      data: { bookingId: booking.id, reference: booking.reference },
+    });
+  }
+}
diff --git a/apps/edr-freight-api/src/modules/bookings/booking-wagon-cancellations.repository.ts b/apps/edr-freight-api/src/modules/bookings/booking-wagon-cancellations.repository.ts
new file mode 100644
index 000000000..64cde269f
--- /dev/null
+++ b/apps/edr-freight-api/src/modules/bookings/booking-wagon-cancellations.repository.ts
@@ -0,0 +1,85 @@
+import { BaseRepository } from '@edr/api-common';
+import { Injectable } from '@nestjs/common';
+import { InjectRepository } from '@nestjs/typeorm';
+import { Repository, SelectQueryBuilder } from 'typeorm';
+
+import { BookingWagonCancellation } from './entities/booking-wagon-cancellation.entity';
+
+export interface WagonCancellationListFilter {
+  status?: string[];
+  /** Booking reference / company name search (staff list). */
+  search?: string;
+  companyId?: string;
+  bookingId?: string;
+  from?: Date;
+  to?: Date;
+  page?: number;
+  pageSize?: number;
+}
+
+@Injectable()
+export class BookingWagonCancellationsRepository extends BaseRepository<BookingWagonCancellation> {
+  constructor(
+    @InjectRepository(BookingWagonCancellation)
+    repository: Repository<BookingWagonCancellation>,
+  ) {
+    super(repository);
+  }
+
+  /** The one open (fee-unpaid) cancellation of a booking, if any. */
+  findOpenForBooking(bookingId: string): Promise<BookingWagonCancellation | null> {
+    return this.repository.findOne({
+      where: { bookingId, status: 'FEE_PENDING' },
+    });
+  }
+
+  findByFeeInvoiceId(feeInvoiceId: string): Promise<BookingWagonCancellation | null> {
+    return this.repository.findOne({ where: { feeInvoiceId } });
+  }
+
+  /** Paged history — staff see everything, customers are scoped by companyId. */
+  async list(
+    filter: WagonCancellationListFilter,
+  ): Promise<{ items: BookingWagonCancellation[]; total: number }> {
+    const page = Math.max(1, filter.page ?? 1);
+    const pageSize = Math.min(100, Math.max(1, filter.pageSize ?? 10));
+
+    const qb = this.baseQuery();
+    if (filter.bookingId) {
+      qb.andWhere('(bwc.booking_id = :bookingId OR bwc.rebooked_booking_id = :bookingId)', {
+        bookingId: filter.bookingId,
+      });
+    }
+    if (filter.companyId) {
+      qb.andWhere('booking.company_id = :companyId', { companyId: filter.companyId });
+    }
+    if (filter.status?.length) {
+      qb.andWhere('bwc.status IN (:...statuses)', { statuses: filter.status });
+    }
+    if (filter.search) {
+      qb.andWhere('(booking.reference ILIKE :search OR company.name ILIKE :search)', {
+        search: `%${filter.search}%`,
+      });
+    }
+    if (filter.from) qb.andWhere('bwc.created_at >= :from', { from: filter.from });
+    if (filter.to) qb.andWhere('bwc.created_at <= :to', { to: filter.to });
+
+    // Property path (not raw column): skip/take builds a distinct-id subquery
+    // and the ORDER BY must resolve inside it.
+    const [items, total] = await qb
+      .orderBy('bwc.createdAt', 'DESC')
+      .skip((page - 1) * pageSize)
+      .take(pageSize)
+      .getManyAndCount();
+    return { items, total };
+  }
+
+  private baseQuery(): SelectQueryBuilder<BookingWagonCancellation> {
+    return this.repository
+      .createQueryBuilder('bwc')
+      .leftJoinAndSelect('bwc.booking', 'booking')
+      .leftJoinAndSelect('booking.company', 'company')
+      .leftJoinAndSelect('bwc.rebookedBooking', 'rebookedBooking')
+      .leftJoinAndSelect('bwc.feeInvoice', 'feeInvoice');
+  }
+}
diff --git a/apps/edr-freight-api/src/modules/bookings/bookings.controller.ts b/apps/edr-freight-api/src/modules/bookings/bookings.controller.ts
index 837d0d801..b7eb526a3 100644
--- a/apps/edr-freight-api/src/modules/bookings/bookings.controller.ts
+++ b/apps/edr-freight-api/src/modules/bookings/bookings.controller.ts
@@ -15,13 +15,17 @@ import {
   UnauthorizedException,
   UploadedFile,
   UploadedFiles,
-  UseGuards,
   UseInterceptors,
 } from '@nestjs/common';
 import { CurrentUser } from '@edr/api-common';
 import type { TCurrentUser } from '@tria-plc/api-common/modules/auth/types/current-user.type';
-import { JwtGuard } from '@tria-plc/api-common/modules/auth/services/jwt.guard';
-import { BookingStaff, BookingView } from '../../common/booking-guards';
+import {
+  BookingStaff,
+  BookingView,
+  MixedAudience,
+  PortalCustomer,
+  WagonCancellationView,
+} from '../../common/booking-guards';
 import { FREIGHT_PERMS } from '../../seed/freight-permissions.registry';
 import { AnyFilesInterceptor, FileInterceptor } from '@nestjs/platform-express';
 import {
@@ -74,6 +78,12 @@ import { GenerateGrnDto } from './dto/generate-grn.dto';
 import { ContainerReceiptService } from './container-receipt.service';
 import { SignContractDto } from './dto/sign-contract.dto';
 import { UpdateBookingDto } from './dto/update-booking.dto';
+import { BookingWagonCancellationService } from './booking-wagon-cancellation.service';
+import {
+  FilterWagonCancellationsDto,
+  RebookCancelledWagonsDto,
+  RequestWagonCancellationDto,
+} from './dto/wagon-cancellation.dto';
 import {
   type AuthUserPayload,
   resolveAuthUserId,
@@ -153,9 +163,11 @@ export class BookingsController {
     private readonly firstMileService: FirstMileService,
     private readonly lastMileService: LastMileService,
     private readonly userTradeAccessService: UserTradeAccessService,
+    private readonly wagonCancellationService: BookingWagonCancellationService,
   ) {}
 
   @Post()
+  @MixedAudience([])
   @UseInterceptors(AnyFilesInterceptor())
   @ApiConsumes("multipart/form-data")
   @ApiOperation({ summary: "Create a new freight booking (DRAFT)" })
@@ -196,6 +208,7 @@ export class BookingsController {
   }
 
   @Patch(":id")
+  @MixedAudience([])
   @UseInterceptors(AnyFilesInterceptor())
   @ApiConsumes("multipart/form-data")
   @ApiOperation({
@@ -212,6 +225,7 @@ export class BookingsController {
   }
 
   @Get()
+  @MixedAudience(FREIGHT_PERMS.bookings.view)
   @ApiOperation({ summary: "List freight bookings (paginated)" })
   async findAll(
     @Query() filter: FilterBookingDto,
@@ -287,6 +301,7 @@ export class BookingsController {
   }
 
   @Get("my")
+  @PortalCustomer()
   @ApiOperation({
     summary: "List the current customer's bookings ready for payment",
     description:
@@ -317,6 +332,7 @@ export class BookingsController {
   }
 
   @Get("reference-data")
+  @MixedAudience([])
   @ApiOperation({ summary: "Booking form catalog" })
   @ApiOkResponse({ type: BookingReferenceDataDto })
   getReferenceData(): Promise<BookingReferenceDataDto> {
@@ -324,6 +340,7 @@ export class BookingsController {
   }
 
   @Get("by-reference/:reference")
+  @MixedAudience(FREIGHT_PERMS.bookings.view)
   @ApiOperation({ summary: "Get booking by reference" })
   async findByReference(
     @Param("reference") reference: string,
@@ -341,6 +358,7 @@ export class BookingsController {
   }
 
   @Get(":id")
+  @MixedAudience(FREIGHT_PERMS.bookings.view)
   @ApiOperation({ summary: "Get booking by ID" })
   async findOne(
     @Param("id", ParseUUIDPipe) id: string,
@@ -362,6 +380,7 @@ export class BookingsController {
   }
 
   @Get(':id/available-days')
+  @MixedAudience([])
   @ApiOperation({
     summary:
       'Days bookable for THIS booking (cargo-aware wagon-TYPE gate; days only, no capacity counts)',
@@ -384,6 +403,7 @@ export class BookingsController {
   }
 
   @Get(':id/day-availability')
+  @MixedAudience([])
   @ApiOperation({
     summary:
       'Advisory free-wagon count for a shipment day (planning hint, not enforced). ' +
@@ -409,6 +429,7 @@ export class BookingsController {
   }
 
   @Get(':id/mile-summary')
+  @MixedAudience(FREIGHT_PERMS.bookings.view)
   @ApiOperation({
     summary: 'First/last-mile operational summary for a booking (customer-safe)',
   })
@@ -436,6 +457,7 @@ export class BookingsController {
   }
 
   @Post(':id/customer-truck-assignment')
+  @PortalCustomer()
   @ApiOperation({ summary: 'Customer assigns external truck and driver for terminal pickup' })
   async assignCustomerTruck(
     @Param('id', ParseUUIDPipe) id: string,
@@ -451,6 +473,7 @@ export class BookingsController {
   }
 
   @Get(':id/customer-truck-assignment/freight-order')
+  @MixedAudience(FREIGHT_PERMS.bookings.view)
   @ApiOperation({
     summary:
       'Download freight order copies. The 2 gate copies always print; ?copies=1,2,8 adds waybill-style copies (catalog indexes 1-8).',
@@ -477,6 +500,7 @@ export class BookingsController {
   }
 
   @Get(':id/carriage-acceptance-sheet')
+  @MixedAudience(FREIGHT_PERMS.bookings.view)
   @ApiOperation({
     summary:
       'Download the carriage acceptance sheet (one per booking, lists every allocated wagon)',
@@ -496,7 +520,156 @@ export class BookingsController {
     res.send(buffer);
   }
 
+  @Get(':id/wagons')
+  @ApiOperation({
+    summary:
+      'Allocated wagons for a booking (JSON) — empty until the paid booking is placed on a train',
+  })
+  async wagonAllocations(
+    @Param('id', ParseUUIDPipe) id: string,
+    @CurrentUser() user: TCurrentUser,
+  ) {
+    const booking = await this.bookingsService.findById(id);
+    if (!hasFreightPermission(user, FREIGHT_PERMS.bookings.view)) {
+      await this.bookingsService.assertCustomerCanAccessBooking(user?.id, booking);
+    }
+    return this.bookingsService.wagonAllocations(id);
+  }
+
+  // ── Partial wagon cancellation (paid bookings) ────────────────────────────
+  // Customer endpoints are ownership-scoped (no portal permission keys); the
+  // staff history/void/rebook variants are permission-gated below.
+
+  @Post(':id/wagon-cancellations/preview')
+  @ApiOperation({ summary: 'Preview the fee/credit of a partial wagon cancellation (no writes)' })
+  async previewWagonCancellation(
+    @Param('id', ParseUUIDPipe) id: string,
+    @Body() dto: RequestWagonCancellationDto,
+    @CurrentUser() user: TCurrentUser,
+  ) {
+    const booking = await this.bookingsService.findById(id);
+    if (!hasFreightPermission(user, FREIGHT_PERMS.bookings.view)) {
+      await this.bookingsService.assertCustomerCanAccessBooking(user?.id, booking);
+    }
+    return this.wagonCancellationService.previewCancellation(id, dto);
+  }
+
+  @Post(':id/wagon-cancellations')
+  @ApiOperation({
+    summary:
+      'Request a partial wagon cancellation on a PAID booking — opens the cancellation-fee invoice; wagons are released only once the fee settles',
+  })
+  async requestWagonCancellation(
+    @Param('id', ParseUUIDPipe) id: string,
+    @Body() dto: RequestWagonCancellationDto,
+    @CurrentUser() user: TCurrentUser,
+  ) {
+    const booking = await this.bookingsService.findById(id);
+    if (!hasFreightPermission(user, FREIGHT_PERMS.bookings.view)) {
+      await this.bookingsService.assertCustomerCanAccessBooking(user?.id, booking);
+    }
+    return this.wagonCancellationService.requestCancellation(id, dto, user?.id);
+  }
+
+  @Get(':id/wagon-cancellations')
+  @ApiOperation({ summary: 'Wagon-cancellation history of one booking (owner or staff)' })
+  async listBookingWagonCancellations(
+    @Param('id', ParseUUIDPipe) id: string,
+    @CurrentUser() user: TCurrentUser,
+  ) {
+    const booking = await this.bookingsService.findById(id);
+    const staff =
+      hasFreightPermission(user, FREIGHT_PERMS.bookings.view) ||
+      hasFreightPermission(user, FREIGHT_PERMS.bookings.wagonCancellationView);
+    if (!staff) {
+      await this.bookingsService.assertCustomerCanAccessBooking(user?.id, booking);
+    }
+    return this.wagonCancellationService.list({ bookingId: id, pageSize: 100 });
+  }
+
+  @Get('wagon-cancellations/my')
+  @ApiOperation({ summary: 'Wagon-cancellation history of the calling customer (paginated, filterable)' })
+  async listMyWagonCancellations(
+    @Query() filter: FilterWagonCancellationsDto,
+    @CurrentUser() user: TCurrentUser,
+  ) {
+    const companyId = await this.bookingsService.resolveCustomerCompanyId(user?.id ?? '');
+    if (!companyId) throw new ForbiddenException('No customer company for this user.');
+    return this.wagonCancellationService.list({
+      companyId,
+      status: filter.statuses,
+      search: filter.search,
+      from: filter.from ? new Date(filter.from) : undefined,
+      to: filter.to ? new Date(filter.to) : undefined,
+      page: filter.page,
+      pageSize: filter.pageSize,
+    });
+  }
+
+  @Get('wagon-cancellations/history')
+  @WagonCancellationView()
+  @ApiOperation({ summary: 'All wagon cancellations (staff, paginated, filterable)' })
+  async listAllWagonCancellations(@Query() filter: FilterWagonCancellationsDto) {
+    return this.wagonCancellationService.list({
+      status: filter.statuses,
+      search: filter.search,
+      from: filter.from ? new Date(filter.from) : undefined,
+      to: filter.to ? new Date(filter.to) : undefined,
+      page: filter.page,
+      pageSize: filter.pageSize,
+    });
+  }
+
+  @Post('wagon-cancellations/:cancellationId/withdraw')
+  @ApiOperation({ summary: 'Withdraw a fee-pending wagon cancellation (owner, or staff with the void permission)' })
+  async withdrawWagonCancellation(
+    @Param('cancellationId', ParseUUIDPipe) cancellationId: string,
+    @CurrentUser() user: TCurrentUser,
+  ) {
+    await this.assertWagonCancellationActor(
+      cancellationId,
+      user,
+      FREIGHT_PERMS.bookings.wagonCancellationVoid,
+    );
+    return this.wagonCancellationService.withdraw(cancellationId);
+  }
+
+  @Post('wagon-cancellations/:cancellationId/rebook')
+  @ApiOperation({
+    summary:
+      'Rebook a wagon-cancellation credit: pick a shipment day only — the new booking is created under the contract and marked PAID (freight already paid; contract must still be valid)',
+  })
+  async rebookWagonCancellation(
+    @Param('cancellationId', ParseUUIDPipe) cancellationId: string,
+    @Body() dto: RebookCancelledWagonsDto,
+    @CurrentUser() user: TCurrentUser,
+  ) {
+    await this.assertWagonCancellationActor(
+      cancellationId,
+      user,
+      FREIGHT_PERMS.bookings.wagonCancellationRebook,
+    );
+    return this.wagonCancellationService.rebook(cancellationId, dto, user?.id);
+  }
+
+  /** Owner-or-staff gate shared by the per-cancellation actions. */
+  private async assertWagonCancellationActor(
+    cancellationId: string,
+    user: TCurrentUser,
+    staffPermission: string,
+  ): Promise<void> {
+    if (hasFreightPermission(user, staffPermission)) return;
+    const row = await this.wagonCancellationService.findById(cancellationId);
+    const booking = await this.bookingsService.findById(row.bookingId);
+    await this.bookingsService.assertCustomerCanAccessBooking(user?.id, booking);
+  }
+
   @Get(':id/customer-trucks')
+  @MixedAudience([
+    FREIGHT_PERMS.bookings.view,
+    FREIGHT_PERMS.bookings.operations,
+    FREIGHT_PERMS.warehouseInventory.view,
+  ])
   @ApiOperation({ summary: 'List customer self-haul trucks (multi-truck) for a booking' })
   async listCustomerTrucks(
     @Param('id', ParseUUIDPipe) id: string,
@@ -510,6 +683,7 @@ export class BookingsController {
   }
 
   @Post(':id/customer-trucks')
+  @PortalCustomer()
   @ApiOperation({ summary: 'Add a customer self-haul truck carrying 1–2 of the booking containers' })
   async addCustomerTruck(
     @Param('id', ParseUUIDPipe) id: string,
@@ -524,6 +698,7 @@ export class BookingsController {
   }
 
   @Post(':id/customer-trucks/bulk')
+  @PortalCustomer()
   @ApiOperation({ summary: 'Bulk add customer trucks from array payload (Excel parsed)' })
   async bulkAddCustomerTrucks(
     @Param('id', ParseUUIDPipe) id: string,
@@ -538,6 +713,7 @@ export class BookingsController {
   }
 
   @Patch(':id/customer-trucks/:assignmentId')
+  @PortalCustomer()
   @ApiOperation({ summary: 'Edit a not-yet-arrived customer truck (plate/driver/type + containers)' })
   async updateCustomerTruck(
     @Param('id', ParseUUIDPipe) id: string,
@@ -553,6 +729,7 @@ export class BookingsController {
   }
 
   @Delete(':id/customer-trucks/:assignmentId')
+  @PortalCustomer()
   @ApiOperation({ summary: 'Remove a not-yet-arrived customer truck from a booking' })
   async removeCustomerTruck(
     @Param('id', ParseUUIDPipe) id: string,
@@ -567,6 +744,7 @@ export class BookingsController {
   }
 
   @Get(':id/customer-trucks/loadable-containers')
+  @MixedAudience(FREIGHT_PERMS.bookings.view)
   @ApiOperation({ summary: 'Booking containers not yet loaded onto a truck' })
   async loadableContainers(
     @Param('id', ParseUUIDPipe) id: string,
@@ -580,6 +758,7 @@ export class BookingsController {
   }
 
   @Post(':id/customer-trucks/:assignmentId/load')
+  @BookingStaff(FREIGHT_PERMS.bookings.operations)
   @ApiOperation({ summary: 'Truck_dispatch: load selected containers onto a truck (staff)' })
   async loadCustomerTruck(
     @Param('id', ParseUUIDPipe) id: string,
@@ -594,6 +773,7 @@ export class BookingsController {
   }
 
   @Post(':id/customer-trucks/:assignmentId/depart')
+  @BookingStaff(FREIGHT_PERMS.bookings.operations)
   @ApiOperation({
     summary: 'Register an import truck leaving: containers loaded + weighed gross (staff)',
   })
@@ -611,6 +791,7 @@ export class BookingsController {
   }
 
   @Get(':id/received-pending-grn')
+  @MixedAudience(FREIGHT_PERMS.bookings.view)
   @ApiOperation({ summary: 'Containers received into port but not yet on a GRN' })
   async receivedPendingGrn(
     @Param('id', ParseUUIDPipe) id: string,
@@ -624,6 +805,7 @@ export class BookingsController {
   }
 
   @Post(':id/generate-grn')
+  @BookingStaff(FREIGHT_PERMS.bookings.operations)
   @ApiOperation({
     summary:
       'Generate a GRN over the received containers (all received, or a subset) — one GRN per batch',
@@ -641,6 +823,7 @@ export class BookingsController {
   }
 
   @Get(':id/tracking')
+  @MixedAudience(FREIGHT_PERMS.bookings.view)
   @ApiOperation({
     summary: "Shipment tracking timeline for a booking",
     description:
@@ -663,6 +846,7 @@ export class BookingsController {
   }
 
   @Delete(":id")
+  @MixedAudience([])
   @HttpCode(204)
   @ApiOperation({ summary: "Soft-delete DRAFT booking" })
   remove(@Param("id", ParseUUIDPipe) id: string) {
@@ -670,6 +854,7 @@ export class BookingsController {
   }
 
   @Post(":id/documents")
+  @MixedAudience([])
   @UseInterceptors(AnyFilesInterceptor())
   @ApiConsumes("multipart/form-data")
   @ApiOperation({ summary: "Upload documents for a booking (DRAFT only)" })
@@ -682,6 +867,7 @@ export class BookingsController {
   }
 
   @Post(":id/generate-price")
+  @MixedAudience([])
   @ApiOperation({
     summary: "Generate price preview (DRAFT or CHANGES_REQUESTED)",
     description:
@@ -693,6 +879,7 @@ export class BookingsController {
   }
 
   @Post(":id/submit")
+  @MixedAudience([])
   @ApiOperation({
     summary: "Customer submit booking",
     description:
@@ -704,6 +891,7 @@ export class BookingsController {
   }
 
   @Post(":id/confirm-submit")
+  @MixedAudience([])
   @ApiOperation({
     summary: "Confirm submit after price change",
     description:
@@ -715,6 +903,7 @@ export class BookingsController {
   }
 
   @Post(":id/reject")
+  @PortalCustomer()
   @ApiOperation({
     summary: "Customer reject price estimate",
     description:
@@ -745,6 +934,7 @@ export class BookingsController {
   }
 
   @Get(':id/clearance')
+  @MixedAudience([FREIGHT_PERMS.bookings.clearanceView, FREIGHT_PERMS.bookings.reviewDocuments])
   @ApiOperation({
     summary:
       "Document-clearance grid (required docs + upload + GL review status)",
@@ -754,6 +944,7 @@ export class BookingsController {
   }
 
   @Post(":id/clearance/documents")
+  @PortalCustomer()
   @UseInterceptors(AnyFilesInterceptor())
   @ApiConsumes("multipart/form-data")
   @ApiOperation({
@@ -770,7 +961,10 @@ export class BookingsController {
     return this.transitionService.enrichBookingResponse(booking);
   }
 
+  // Customer requests the operation; GL ET also resubmits here on the
+  // customer's behalf after operations requests changes (BookingChangesRequestedAlert).
   @Post(":id/clearance/proceed")
+  @MixedAudience(FREIGHT_PERMS.contracts.createBooking)
   @ApiOperation({
     summary:
       "Customer requests operation with a schedule day " +
@@ -789,6 +983,7 @@ export class BookingsController {
   }
 
   @Get(":id/export-trains")
+  @MixedAudience([])
   @ApiOperation({
     summary:
       "Export train picker: the day's export trains on the booking's corridor " +
@@ -990,6 +1185,7 @@ export class BookingsController {
   }
 
   @Post(':id/clearance/draft-declaration/accept')
+  @PortalCustomer()
   @ApiOperation({
     summary:
       'Customer accepts the draft customs declaration — unlocks the real customs declaration step for GL Ethiopia',
@@ -1000,6 +1196,7 @@ export class BookingsController {
   }
 
   @Post(':id/clearance/draft-declaration/change')
+  @PortalCustomer()
   @ApiOperation({
     summary:
       'Customer requests a change to the draft customs declaration with a reason — GL Ethiopia sends a corrected draft (repeatable)',
@@ -1026,6 +1223,7 @@ export class BookingsController {
   }
 
   @Post(':id/clearance/duty-slip')
+  @PortalCustomer()
   @UseInterceptors(FileInterceptor('file'))
   @ApiConsumes('multipart/form-data')
   @ApiOperation({ summary: 'Customer uploads duty/tax payment slip on booking' })
@@ -1177,7 +1375,7 @@ export class BookingsController {
   }
 
   @Post(":id/government-expedite")
-  @BookingStaff(FREIGHT_PERMS.bookings.staffAccept)
+  @BookingStaff(FREIGHT_PERMS.bookings.governmentExpedite)
   @ApiOperation({
     summary: "Expedite government booking to PAID / ELIGIBLE for scheduling",
   })
@@ -1201,6 +1399,7 @@ export class BookingsController {
   }
 
   @Get(":id/contract/view")
+  @MixedAudience(FREIGHT_PERMS.bookings.view)
   @ApiOkResponse({ type: ContractViewDto })
   @ApiOperation({ summary: "Contract HTML view for portal and backoffice" })
   getContractView(
@@ -1212,6 +1411,7 @@ export class BookingsController {
   }
 
   @Get(":id/contract/document")
+  @MixedAudience(FREIGHT_PERMS.bookings.view)
   @ApiOperation({ summary: "Download contract PDF" })
   async downloadContractDocument(
     @Param("id", ParseUUIDPipe) id: string,
@@ -1227,6 +1427,7 @@ export class BookingsController {
   }
 
   @Get(":id/contract")
+  @MixedAudience(FREIGHT_PERMS.bookings.view)
   @ApiOperation({ summary: "Download contract file (alias)" })
   async downloadContract(
     @Param("id", ParseUUIDPipe) id: string,
@@ -1236,7 +1437,7 @@ export class BookingsController {
   }
 
   @Post(":id/contract/sign")
-  @UseGuards(JwtGuard)
+  @MixedAudience(FREIGHT_PERMS.bookings.signStaff)
   @ApiOperation({ summary: "Apply digital signature (customer or staff)" })
   async signContract(
     @Param("id", ParseUUIDPipe) id: string,
@@ -1257,18 +1458,21 @@ export class BookingsController {
   }
 
   @Get(":id/contract/signatures")
+  @MixedAudience(FREIGHT_PERMS.bookings.view)
   @ApiOperation({ summary: "List contract signatures" })
   getContractSignatures(@Param("id", ParseUUIDPipe) id: string) {
     return this.contractService.getSignatures(id);
   }
 
   @Get(":id/summary")
+  @MixedAudience(FREIGHT_PERMS.bookings.view)
   @ApiOperation({ summary: "Contract summary string for dashboard" })
   getSummary(@Param("id", ParseUUIDPipe) id: string) {
     return this.contractService.getSummary(id);
   }
 
   @Post(":id/customer/sign")
+  @PortalCustomer()
   @ApiOperation({
     summary: "Customer digital signature (deprecated — use POST contract/sign)",
   })
@@ -1335,7 +1539,21 @@ export class BookingsController {
     return this.transitionService.enrichBookingResponse(booking);
   }
 
+  @Post(":id/customer-cancel")
+  @ApiOperation({
+    summary:
+      "Customer cancels their own booking before payment — no cancellation fee",
+  })
+  async customerCancel(
+    @Param("id", ParseUUIDPipe) id: string,
+    @Body() dto: RejectBookingDto,
+  ) {
+    const booking = await this.transitionService.customerCancel(id, dto.reason);
+    return this.transitionService.enrichBookingResponse(booking);
+  }
+
   @Post(":id/cancel-hold")
+  @PortalCustomer()
   @ApiOperation({
     summary:
       "Customer cancels an unpaid hold (SELECTED_FOR_BATCH → CANCELLED); " +
@@ -1350,18 +1568,21 @@ export class BookingsController {
   }
 
   @Post(":id/consolidation")
+  @PortalCustomer()
   @ApiOperation({ summary: "Request freight consolidation" })
   requestConsolidation(@Param("id", ParseUUIDPipe) id: string) {
     return this.bookingsService.requestConsolidation(id);
   }
 
   @Delete(":id/consolidation")
+  @PortalCustomer()
   @ApiOperation({ summary: "Remove consolidation pairing" })
   removeConsolidation(@Param("id", ParseUUIDPipe) id: string) {
     return this.bookingsService.removeConsolidation(id);
   }
 
   @Get(":id/consolidation")
+  @MixedAudience(FREIGHT_PERMS.bookings.view)
   @ApiOperation({ summary: "Get consolidation details" })
   getConsolidationDetails(@Param("id", ParseUUIDPipe) id: string) {
     return this.bookingsService.getConsolidationDetails(id);
diff --git a/apps/edr-freight-api/src/modules/bookings/bookings.module.ts b/apps/edr-freight-api/src/modules/bookings/bookings.module.ts
index 84354d860..658629592 100644
--- a/apps/edr-freight-api/src/modules/bookings/bookings.module.ts
+++ b/apps/edr-freight-api/src/modules/bookings/bookings.module.ts
@@ -25,6 +25,7 @@ import { BookingLifecycleNotifierService } from './booking-lifecycle-notifier.se
 import { BookingTransitionService } from './booking-transition.service';
 import { NotificationsModule } from '../notifications/notifications.module';
 import { NotificationInboxModule } from '../notification-inbox/notification-inbox.module';
+import { BookingAllocationController } from './booking-allocation.controller';
 import { BookingsController } from './bookings.controller';
 // import { PayController } from './pay.controller';
 import { BookingsRepository } from './bookings.repository';
@@ -38,6 +39,9 @@ import { BookingRateSnapshot } from './entities/booking-rate-snapshot.entity';
 import { BookingContractSignature } from './entities/booking-contract-signature.entity';
 import { BookingReviewNote } from './entities/booking-review-note.entity';
 import { Booking } from './entities/booking.entity';
+import { BookingWagonCancellation } from './entities/booking-wagon-cancellation.entity';
+import { BookingWagonCancellationsRepository } from './booking-wagon-cancellations.repository';
+import { BookingWagonCancellationService } from './booking-wagon-cancellation.service';
 import { CustomerTruckAssignment } from './entities/customer-truck-assignment.entity';
 import { CustomerTruckContainer } from './entities/customer-truck-container.entity';
 import { CustomerTruckAssignmentsRepository } from './customer-truck-assignments.repository';
@@ -65,6 +69,7 @@ import { VehiclesModule } from "../vehicles/vehicles.module";
       BookingReviewNote,
       BookingContractSignature,
       BookingContainerAllocation,
+      BookingWagonCancellation,
       CustomerTruckAssignment,
       CustomerTruckContainer,
     ]),
@@ -88,7 +93,7 @@ import { VehiclesModule } from "../vehicles/vehicles.module";
     SignaturesModule,
     registerExchangeModule(),
   ],
-  controllers: [BookingsController],
+  controllers: [BookingsController, BookingAllocationController],
   providers: [
     BookingsService,
     BookingsRepository,
@@ -109,6 +114,8 @@ import { VehiclesModule } from "../vehicles/vehicles.module";
     CustomerTruckAssignmentsRepository,
     CustomerTruckService,
     ContainerReceiptService,
+    BookingWagonCancellationsRepository,
+    BookingWagonCancellationService,
   ],
   exports: [
     BookingsService,
@@ -120,6 +127,7 @@ import { VehiclesModule } from "../vehicles/vehicles.module";
     ConsolidationService,
     CustomerTruckService,
     ContainerReceiptService,
+    BookingWagonCancellationService,
   ],
 })
 export class BookingsModule { }
diff --git a/apps/edr-freight-api/src/modules/bookings/bookings.service.ts b/apps/edr-freight-api/src/modules/bookings/bookings.service.ts
index 12c56ac13..e4b902fe1 100644
--- a/apps/edr-freight-api/src/modules/bookings/bookings.service.ts
+++ b/apps/edr-freight-api/src/modules/bookings/bookings.service.ts
@@ -339,6 +339,64 @@ export class BookingsService {
     };
   }
 
+  /**
+   * Allocated wagons of a booking as JSON — the portal's "Wagons" tab. Same
+   * join chain as the carriage acceptance sheet, but structured (containers as
+   * an array per wagon, bulk load description when the wagon carries bulk).
+   * Empty array until the booking has been allocated onto a train.
+   */
+  async wagonAllocations(bookingId: string): Promise<unknown[]> {
+    return this.dataSource.query(
+      `SELECT a.id                             AS "allocationId",
+              tsw.sequence_no                  AS "sequenceNo",
+              w.wagon_number                   AS "wagonNumber",
+              COALESCE(wt.name, wt.code)       AS "wagonType",
+              wt.code                          AS "wagonTypeCode",
+              wt.tare_weight_tons              AS "tareWeightTons",
+              tsw.capacity_tons                AS "capacityTons",
+              tsw.length_meters                AS "lengthMeters",
+              a.allocated_weight_tons          AS "allocatedWeightTons",
+              a.load_type                      AS "loadType",
+              a.status                         AS "status",
+              s.train_number                   AS "trainNumber",
+              s.scheduled_departure_date       AS "departureAt",
+              so.label                         AS "originStation",
+              sd.label                         AS "destinationStation",
+              bl.cargo_description             AS "bulkCargoDescription",
+              bl.quantity                      AS "bulkQuantity",
+              COALESCE(
+                json_agg(
+                  json_build_object(
+                    'containerNumber', ci.container_number,
+                    'sealNumber', ci.seal_number,
+                    'positionOnWagon', ci.position_on_wagon,
+                    'grossWeightTons', ci.gross_weight_tons
+                  ) ORDER BY ci.position_on_wagon, ci.container_number
+                ) FILTER (WHERE ci.id IS NOT NULL),
+                '[]'
+              )                                AS "containers"
+         FROM freight.wagon_booking_allocations a
+         JOIN freight.train_set_wagons tsw
+           ON tsw.id = a.train_set_wagon_id AND tsw.deleted_at IS NULL
+         LEFT JOIN freight.wagon_types wt ON wt.id = tsw.wagon_type_id
+         LEFT JOIN freight.wagons w ON w.id = tsw.physical_wagon_id
+         LEFT JOIN freight.train_schedules s
+           ON s.train_set_id = tsw.train_set_id AND s.deleted_at IS NULL
+         LEFT JOIN freight.yards so ON so.id = s.origin_station_id
+         LEFT JOIN freight.yards sd ON sd.id = s.destination_station_id
+         LEFT JOIN freight.wagon_allocation_container_items ci
+           ON ci.wagon_booking_allocation_id = a.id AND ci.deleted_at IS NULL
+         LEFT JOIN freight.wagon_allocation_bulk_loads bl
+           ON bl.wagon_booking_allocation_id = a.id AND bl.deleted_at IS NULL
+        WHERE a.booking_id = $1 AND a.deleted_at IS NULL
+        GROUP BY tsw.id, a.id, w.wagon_number, wt.name, wt.code, wt.tare_weight_tons,
+                 s.train_number, s.scheduled_departure_date, so.label, sd.label,
+                 bl.cargo_description, bl.quantity
+        ORDER BY tsw.sequence_no`,
+      [bookingId],
+    );
+  }
+
   /**
    * Split the booking amount across its wagons, proportional to allocated weight
    * (equal shares when no weights are recorded). The last row absorbs the rounding
@@ -1425,7 +1483,46 @@ export class BookingsService {
           tradeDirection,
         );
     }
-    if (dto.scheduledDate) updates.scheduledDate = new Date(dto.scheduledDate);
+    // Re-pinning the departure day on an edit (e.g. fixing a CHANGES_REQUESTED
+    // booking) must obey the same gate as creation: the route needs an OPEN
+    // departure on that EAT day that can carry the cargo. Skipped when the day
+    // didn't change, for general contracts (period-based, no pinned day) and
+    // for intercity (staff assign a passing train later).
+    if (dto.scheduledDate) {
+      const day = eatDay(new Date(dto.scheduledDate));
+      const dayChanged =
+        !existing.scheduledDate || eatDay(existing.scheduledDate) !== day;
+      if (
+        dayChanged &&
+        existing.bookingType !== 'GENERAL_CONTRACT' &&
+        tradeDirection !== 'DOMESTIC'
+      ) {
+        const { hasDeparture, hasCompatible } =
+          await this.trainSchedulingService.checkDayCargoCompatibility(
+            originYardId,
+            destinationYardId,
+            day,
+            {
+              freightType: freightType as 'CONTAINER' | 'BULK',
+              cargoTypeId,
+              containerTypeIds: containers
+                .map((c) => c.containerTypeId)
+                .filter((cid): cid is string => Boolean(cid)),
+            },
+          );
+        if (!hasDeparture) {
+          throw new BadRequestException(
+            'No departures available on the selected day for this route',
+          );
+        }
+        if (!hasCompatible) {
+          throw new BadRequestException(
+            'No wagon on the selected day can carry this cargo type — please choose another day',
+          );
+        }
+      }
+      updates.scheduledDate = new Date(dto.scheduledDate);
+    }
     if (dto.estimatedShipmentDate)
       updates.estimatedShipmentDate = new Date(dto.estimatedShipmentDate);
     if (dto.startDate) updates.startDate = new Date(dto.startDate);
diff --git a/apps/edr-freight-api/src/modules/bookings/dto/wagon-cancellation.dto.ts b/apps/edr-freight-api/src/modules/bookings/dto/wagon-cancellation.dto.ts
new file mode 100644
index 000000000..6a5dfe112
--- /dev/null
+++ b/apps/edr-freight-api/src/modules/bookings/dto/wagon-cancellation.dto.ts
@@ -0,0 +1,112 @@
+import { ApiProperty, ApiPropertyOptional } from '@nestjs/swagger';
+import { Type } from 'class-transformer';
+import {
+  ArrayNotEmpty,
+  IsArray,
+  IsDateString,
+  IsIn,
+  IsInt,
+  IsNumber,
+  IsOptional,
+  IsString,
+  IsUUID,
+  MaxLength,
+  Min,
+  ValidateNested,
+} from 'class-validator';
+
+import { WAGON_CANCELLATION_STATUSES } from '../entities/booking-wagon-cancellation.entity';
+
+export class CancelContainerLineDto {
+  @ApiProperty({ description: 'Container size (ft) as stored on the booking line, e.g. "20", "40"' })
+  @IsString()
+  containerSize!: string;
+
+  @ApiProperty({ description: 'How many units of this size to cancel' })
+  @IsInt()
+  @Min(1)
+  quantity!: number;
+}
+
+export class RequestWagonCancellationDto {
+  @ApiPropertyOptional({
+    description:
+      'Cancel SPECIFIC allocated wagons: wagon_booking_allocation ids from GET /bookings/:id/wagons. ' +
+      'When set, wagons/containers are derived from the selected wagons and the other fields are ignored.',
+    type: [String],
+  })
+  @IsOptional()
+  @IsArray()
+  @ArrayNotEmpty()
+  @IsUUID('4', { each: true })
+  wagonAllocationIds?: string[];
+
+  @ApiPropertyOptional({
+    description: 'BULK bookings: number of wagons to cancel (tons derived proportionally)',
+  })
+  @IsOptional()
+  @IsNumber()
+  @Min(0.5)
+  wagons?: number;
+
+  @ApiPropertyOptional({
+    description: 'CONTAINER bookings: units to cancel per size (wagons derived per size)',
+    type: [CancelContainerLineDto],
+  })
+  @IsOptional()
+  @IsArray()
+  @ArrayNotEmpty()
+  @ValidateNested({ each: true })
+  @Type(() => CancelContainerLineDto)
+  containers?: CancelContainerLineDto[];
+
+  @ApiPropertyOptional({ description: 'Customer reason for the cancellation' })
+  @IsOptional()
+  @IsString()
+  @MaxLength(1000)
+  reason?: string;
+}
+
+export class RebookCancelledWagonsDto {
+  @ApiProperty({ description: 'Shipment day the credit is rebooked onto (ISO date)' })
+  @IsDateString()
+  scheduledDate!: string;
+}
+
+export class FilterWagonCancellationsDto {
+  @ApiPropertyOptional({ enum: WAGON_CANCELLATION_STATUSES, isArray: true })
+  @IsOptional()
+  @IsArray()
+  @IsIn(WAGON_CANCELLATION_STATUSES as readonly string[], { each: true })
+  statuses?: string[];
+
+  @ApiPropertyOptional({ description: 'Booking reference / company name search' })
+  @IsOptional()
+  @IsString()
+  @MaxLength(120)
+  search?: string;
+
+  @ApiPropertyOptional()
+  @IsOptional()
+  @IsDateString()
+  from?: string;
+
+  @ApiPropertyOptional()
+  @IsOptional()
+  @IsDateString()
+  to?: string;
+
+  @ApiPropertyOptional({ default: 1 })
+  @IsOptional()
+  @Type(() => Number)
+  @IsInt()
+  @Min(1)
+  page?: number;
+
+  @ApiPropertyOptional({ default: 10 })
+  @IsOptional()
+  @Type(() => Number)
+  @IsInt()
+  @Min(1)
+  pageSize?: number;
+}
diff --git a/apps/edr-freight-api/src/modules/bookings/entities/booking-wagon-cancellation.entity.ts b/apps/edr-freight-api/src/modules/bookings/entities/booking-wagon-cancellation.entity.ts
new file mode 100644
index 000000000..723ea5d1c
--- /dev/null
+++ b/apps/edr-freight-api/src/modules/bookings/entities/booking-wagon-cancellation.entity.ts
@@ -0,0 +1,137 @@
+import { BaseEntity } from '@edr/api-common';
+import { Column, Entity, Index, JoinColumn, ManyToOne } from 'typeorm';
+
+import { Invoice } from '../../billing/entities/invoice.entity';
+import { Rate } from '../../rule-engine/entities/rate.entity';
+import { Booking } from './booking.entity';
+
+export const WAGON_CANCELLATION_STATUSES = [
+  // Requested; fee invoice open; wagons still allocated to the customer.
+  'FEE_PENDING',
+  // Fee settled; booking reduced, wagons freed; credit waiting for a rebook.
+  'CREDIT_AVAILABLE',
+  // Credit redeemed into a new PAID booking (rebookedBookingId).
+  'REBOOKED',
+  // Customer/staff voided the request before paying the fee. Nothing changed.
+  'WITHDRAWN',
+  // Reserved for a future expiry policy; not set by code today.
+  'EXPIRED',
+] as const;
+
+export type WagonCancellationStatus = (typeof WAGON_CANCELLATION_STATUSES)[number];
+
+/** Snapshot of one physical container unit cut by the cancellation. */
+export interface CancelledUnitSnapshot {
+  containerSize: string;
+  containerNumber: string;
+  sealNumber?: string | null;
+  vgmTons: number;
+  isHazardous: boolean;
+  isReefer: boolean;
+}
+
+/** What the cancellation cut, in the booking's own quantity terms. */
+export interface CancelledQuantities {
+  /** Bulk bookings: tons cut (PER_ITEM cargo: item count, matching cargoTotalWeightVgm). */
+  bulkTons?: number;
+  /** Container bookings: units cut per container size. */
+  bySize?: Record<string, number>;
+  /**
+   * Container bookings: the exact physical units cut. Snapshotted at request
+   * time when the customer picked specific wagons, otherwise at fee settlement
+   * (LIFO trim). The rebook reconstructs the new booking from THESE — never
+   * from a soft-deleted-row scan, which could pick up units dropped by an
+   * unrelated batch split on the same booking.
+   */
+  units?: CancelledUnitSnapshot[];
+  /**
+   * Specific-wagon cancellation: the wagon_booking_allocation ids the customer
+   * picked in the Wagons tab. T2 releases exactly these (fallback to
+   * newest-first for any id that no longer exists, e.g. after a re-batch).
+   */
+  allocationIds?: string[];
+  /**
+   * The wagon allocations were already released from the schedule at REQUEST
+   * time (policy: wagons free up immediately; the fee is still owed before the
+   * credit can be rebooked). Tells T2 to skip its release step so it never
+   * deletes wagons the batch engine re-assigned in between.
+   */
+  releasedAtRequest?: boolean;
+}
+
+/**
+ * One partial-wagon-cancellation cycle on a PAID booking — the audit trail and
+ * the state machine. The credit itself is not a wallet balance: redeeming it
+ * creates a real booking through the under-contract create path and marks it
+ * PAID (see BookingWagonCancellationService).
+ */
+@Entity({ schema: 'freight', name: 'booking_wagon_cancellations' })
+@Index(['bookingId'])
+@Index(['status'])
+export class BookingWagonCancellation extends BaseEntity {
+  @Column({ name: 'booking_id', type: 'uuid' })
+  bookingId!: string;
+
+  @ManyToOne(() => Booking)
+  @JoinColumn({ name: 'booking_id' })
+  booking?: Booking;
+
+  @Column({ name: 'rebooked_booking_id', type: 'uuid', nullable: true })
+  rebookedBookingId?: string | null;
+
+  @ManyToOne(() => Booking, { nullable: true })
+  @JoinColumn({ name: 'rebooked_booking_id' })
+  rebookedBooking?: Booking | null;
+
+  @Column({ name: 'wagons_cancelled', type: 'numeric', precision: 6, scale: 2 })
+  wagonsCancelled!: number;
+
+  @Column({ name: 'weight_tons', type: 'numeric', precision: 12, scale: 3, default: 0 })
+  weightTons!: number;
+
+  @Column({ name: 'cancelled_quantities', type: 'jsonb' })
+  cancelledQuantities!: CancelledQuantities;
+
+  /**
+   * The freight value of the cancelled part at the ORIGINAL booking's price —
+   * informational (shown to the customer as "credit worth"); no refund is ever
+   * issued from it, the credit is redeemed by rebooking.
+   */
+  @Column({ name: 'credit_amount', type: 'numeric', precision: 14, scale: 2, default: 0 })
+  creditAmount!: number;
+
+  @Column({ name: 'fee_rate_id', type: 'uuid', nullable: true })
+  feeRateId?: string | null;
+
+  @ManyToOne(() => Rate, { nullable: true })
+  @JoinColumn({ name: 'fee_rate_id' })
+  feeRate?: Rate | null;
+
+  @Column({ name: 'fee_amount', type: 'numeric', precision: 14, scale: 2 })
+  feeAmount!: number;
+
+  @Column({ name: 'fee_currency', type: 'varchar', length: 8, default: 'ETB' })
+  feeCurrency!: string;
+
+  @Column({ name: 'fee_invoice_id', type: 'uuid', nullable: true })
+  feeInvoiceId?: string | null;
+
+  @ManyToOne(() => Invoice, { nullable: true })
+  @JoinColumn({ name: 'fee_invoice_id' })
+  feeInvoice?: Invoice | null;
+
+  @Column({ name: 'fee_paid_at', type: 'timestamptz', nullable: true })
+  feePaidAt?: Date | null;
+
+  @Column({ name: 'status', type: 'varchar', length: 30, default: 'FEE_PENDING' })
+  status!: string;
+
+  @Column({ name: 'reason', type: 'text', nullable: true })
+  reason?: string | null;
+
+  @Column({ name: 'requested_by_user_id', type: 'uuid', nullable: true })
+  requestedByUserId?: string | null;
+
+  @Column({ name: 'rebooked_at', type: 'timestamptz', nullable: true })
+  rebookedAt?: Date | null;
+}
diff --git a/apps/edr-freight-api/src/modules/companies/companies.controller.ts b/apps/edr-freight-api/src/modules/companies/companies.controller.ts
index 1c9d75487..810d4d46a 100644
--- a/apps/edr-freight-api/src/modules/companies/companies.controller.ts
+++ b/apps/edr-freight-api/src/modules/companies/companies.controller.ts
@@ -11,7 +11,6 @@ import {
   HttpCode,
   HttpStatus,
   UseInterceptors,
-  UseGuards,
   UploadedFiles,
   BadRequestException,
   NotFoundException,
@@ -20,8 +19,7 @@ import { AnyFilesInterceptor } from "@nestjs/platform-express";
 import { ApiOperation, ApiTags, ApiConsumes } from "@nestjs/swagger";
 import { CurrentUser } from "@edr/api-common";
 import type { TCurrentUser } from "@tria-plc/api-common/modules/auth/types/current-user.type";
-import { JwtGuard } from "@tria-plc/api-common/modules/auth/services/jwt.guard";
-import { BookingStaff } from "../../common/booking-guards";
+import { BookingStaff, MixedAudience, PortalCustomer } from "../../common/booking-guards";
 import {
   assertFreightPermission,
   hasFreightPermission,
@@ -118,6 +116,7 @@ export class CompaniesController {
   }
 
   @Get("getInfo")
+  @PortalCustomer()
   @ApiOperation({ summary: "Get company info for the current user" })
   async getInfo(
     @CurrentUser() user: CurrentIamUser,
@@ -131,6 +130,7 @@ export class CompaniesController {
   }
 
   @Get("profile")
+  @PortalCustomer()
   @ApiOperation({ summary: "Get flattened profile for the settings page" })
   async getProfile(
     @CurrentUser() user: CurrentIamUser,
@@ -146,6 +146,7 @@ export class CompaniesController {
   }
 
   @Get("profile/change-request")
+  @PortalCustomer()
   @ApiOperation({
     summary: "Current user's open profile change request (pending/rejected)",
   })
@@ -161,6 +162,7 @@ export class CompaniesController {
   }
 
   @Post("company-profiles/:profileId/reapply")
+  @PortalCustomer()
   @ApiOperation({
     summary: "Resubmit a rejected operational role for approval (→ pending)",
   })
@@ -176,6 +178,7 @@ export class CompaniesController {
   }
 
   @Get("dashboard")
+  @PortalCustomer()
   @ApiOperation({
     summary:
       "Get portal dashboard KPIs (delivered, spend, freight volume) for the current user",
@@ -191,6 +194,7 @@ export class CompaniesController {
   }
 
   @Post("fetch-etrade-info")
+  @PortalCustomer()
   @ApiOperation({ summary: "Fetch company info from eTrade by TIN" })
   async fetchETradeInfo(
     @CurrentUser() user: CurrentIamUser,
@@ -211,6 +215,7 @@ export class CompaniesController {
   }
 
   @Patch("profile")
+  @PortalCustomer()
   @ApiOperation({ summary: "Update profile (flattened settings page)" })
   async updateProfile(
     @CurrentUser() user: CurrentIamUser,
@@ -220,6 +225,7 @@ export class CompaniesController {
   }
 
   @Post("company-profiles")
+  @PortalCustomer()
   @ApiOperation({
     summary:
       "Add operational profile(s) (importer/exporter/forwarder) to the current user's company",
@@ -236,6 +242,7 @@ export class CompaniesController {
   }
 
   @Post("onboarding/start")
+  @PortalCustomer()
   @ApiOperation({
     summary:
       "Begin onboarding: create a draft company + profile + role(s) so later steps can save incrementally",
@@ -261,6 +268,7 @@ export class CompaniesController {
   }
 
   @Post("company-profile")
+  @PortalCustomer()
   @ApiOperation({
     summary:
       "Create a single operational profile for the current user's company. The role starts pending and does not become the active mode",
@@ -278,6 +286,7 @@ export class CompaniesController {
   }
 
   @Post("company-profiles/:profileId/license")
+  @PortalCustomer()
   @UseInterceptors(AnyFilesInterceptor())
   @ApiConsumes("multipart/form-data")
   @ApiOperation({
@@ -298,6 +307,7 @@ export class CompaniesController {
   }
 
   @Post("company-profiles/:profileId/license/:fileId/replace")
+  @PortalCustomer()
   @UseInterceptors(AnyFilesInterceptor())
   @ApiConsumes("multipart/form-data")
   @ApiOperation({
@@ -324,6 +334,7 @@ export class CompaniesController {
   }
 
   @Delete("company-profiles/:profileId/license/:fileId")
+  @PortalCustomer()
   @ApiOperation({
     summary:
       "Remove a business-license file (staged for review on an approved company).",
@@ -341,6 +352,7 @@ export class CompaniesController {
   }
 
   @Get("company-profiles/:profileId/license")
+  @PortalCustomer()
   @ApiOperation({
     summary: "List business-license documents (with review state) for a profile",
   })
@@ -352,6 +364,7 @@ export class CompaniesController {
   }
 
   @Get("poa-delegation")
+  @PortalCustomer()
   @ApiOperation({
     summary:
       "List the Power of Attorney delegation letter (with review state) for the current user's company",
@@ -363,6 +376,7 @@ export class CompaniesController {
   }
 
   @Post("poa-delegation")
+  @PortalCustomer()
   @UseInterceptors(AnyFilesInterceptor())
   @ApiConsumes("multipart/form-data")
   @ApiOperation({
@@ -383,6 +397,7 @@ export class CompaniesController {
   }
 
   @Delete("poa-delegation/:fileId")
+  @PortalCustomer()
   @ApiOperation({
     summary:
       "Remove the Power of Attorney delegation letter (staged for review on an approved company).",
@@ -395,6 +410,7 @@ export class CompaniesController {
   }
 
   @Post("identity/fayda/complete")
+  @PortalCustomer()
   @ApiOperation({
     summary:
       "Bind a completed Fayda verification to the company's owner or Power of Attorney. " +
@@ -409,6 +425,7 @@ export class CompaniesController {
   }
 
   @Post("identity/gm/same-as-owner")
+  @PortalCustomer()
   @ApiOperation({
     summary:
       "Declare the General Manager is the company's owner, copying the owner's verified identity across. " +
@@ -421,6 +438,7 @@ export class CompaniesController {
   }
 
   @Delete("identity/gm")
+  @PortalCustomer()
   @ApiOperation({
     summary:
       "Clear the General Manager's identity — the \"same as owner\" declaration or a verification, and the details either wrote. " +
@@ -433,6 +451,7 @@ export class CompaniesController {
   }
 
   @Delete("identity/fayda/poa")
+  @PortalCustomer()
   @ApiOperation({
     summary:
       "Remove the company's Power of Attorney — the verified identity, its details and the delegation paper together. " +
@@ -445,6 +464,7 @@ export class CompaniesController {
   }
 
   @Patch("onboarding-step")
+  @PortalCustomer()
   @ApiOperation({ summary: "Persist the user's current onboarding wizard step" })
   @HttpCode(HttpStatus.NO_CONTENT)
   async setOnboardingStep(
@@ -455,6 +475,7 @@ export class CompaniesController {
   }
 
   @Get("onboarding/requirements")
+  @PortalCustomer()
   @ApiOperation({
     summary:
       "What the current user's company still needs to finish onboarding (server-driven documents + outstanding items)",
@@ -466,6 +487,7 @@ export class CompaniesController {
   }
 
   @Post("onboarding/complete")
+  @PortalCustomer()
   @ApiOperation({ summary: "Mark the current user's onboarding as complete" })
   async completeOnboarding(
     @CurrentUser() user: CurrentIamUser,
@@ -477,6 +499,7 @@ export class CompaniesController {
 
   // Used by portal
   @Post("create")
+  @PortalCustomer()
   @ApiOperation({
     summary:
       "Create a company with its associated external profile (onboarding)",
@@ -591,7 +614,11 @@ export class CompaniesController {
    * permission still needs the applicant's documents.
    */
   @Get(":companyId/documents")
-  @UseGuards(JwtGuard)
+  @MixedAudience([
+    FREIGHT_PERMS.customers.view,
+    FREIGHT_PERMS.contracts.view,
+    FREIGHT_PERMS.bookings.view,
+  ])
   @ApiOperation({ summary: "List documents uploaded for a company" })
   async listDocuments(
     @Param("companyId", ParseUUIDPipe) companyId: string,
@@ -661,6 +688,7 @@ export class CompaniesController {
   }
 
   @Post(":companyId/documents")
+  @MixedAudience(FREIGHT_PERMS.customers.update)
   @UseInterceptors(AnyFilesInterceptor())
   @ApiConsumes("multipart/form-data")
   @ApiOperation({ summary: "Upload documents for a company (onboarding)" })
diff --git a/apps/edr-freight-api/src/modules/companies/companies.service.ts b/apps/edr-freight-api/src/modules/companies/companies.service.ts
index b5c953cac..eb6b28b44 100644
--- a/apps/edr-freight-api/src/modules/companies/companies.service.ts
+++ b/apps/edr-freight-api/src/modules/companies/companies.service.ts
@@ -2057,6 +2057,11 @@ export class CompaniesService {
     // replace it before the application counts as complete.
     const flaggedDelegation = delegationDue && delegation.flagged;
 
+    // Mirrors `poaProven` in buildCompanyIdentityState — see the note there.
+    const poaProven = identity.faydaRequired
+      ? identity.poa.verified
+      : identity.poa.verified || Boolean(identity.poa.name?.trim());
+
     const outstanding = [
       ...missingInfo.map((f) => `Add your ${f.label.toLowerCase()}`),
       ...missingDocs.map((d) => `Upload your ${d.fileLabel}`),
@@ -2074,8 +2079,19 @@ export class CompaniesService {
       ...(identity.faydaRequired && !identity.owner.verified
         ? ["Verify the company owner's identity with Fayda"]
         : []),
-      ...((poaRequired || poaProvided) && !identity.poa.verified
-        ? ["Verify your Power of Attorney's identity with Fayda"]
+      // Nationality-aware, exactly like `poaProven` in
+      // buildCompanyIdentityState and the check in `assertIdentityVerified`:
+      // Fayda is an Ethiopian national ID, so a foreign company's typed
+      // representative has to count. Demanding a verification here regardless
+      // made this list disagree with the rule actually enforced, and left a
+      // foreign freight forwarder unable to submit — asked for a Fayda
+      // verification its representative may have no way to obtain.
+      ...((poaRequired || poaProvided) && !poaProven
+        ? [
+            identity.faydaRequired
+              ? "Verify your Power of Attorney's identity with Fayda"
+              : "Name your Power of Attorney, or verify them with Fayda",
+          ]
         : []),
       ...(identity.passportRequired && !identity.owner.passportNumber
         ? ["Add the company owner's passport number"]
@@ -2089,7 +2105,10 @@ export class CompaniesService {
     const poaItemCount = delegationDue ? 1 : 0;
     // One item per identity credential the company has to prove: the owner
     // always (Fayda for Ethiopian, passport for foreign), plus the PoA once
-    // there is one — that one is Fayda whatever the nationality.
+    // there is one — Fayda for an Ethiopian company, a named representative
+    // for a foreign one, same rule as `poaProven` above. Counting a foreign
+    // company's typed PoA as unproven here left the progress bar permanently
+    // short of 100% on an item it had already satisfied.
     const ownerCredentialDue =
       identity.faydaRequired || identity.passportRequired;
     const ownerCredentialProven = identity.faydaRequired
@@ -2099,7 +2118,7 @@ export class CompaniesService {
       (ownerCredentialDue ? 1 : 0) + (delegationDue ? 1 : 0);
     const missingIdentityCount =
       (ownerCredentialDue && !ownerCredentialProven ? 1 : 0) +
-      (delegationDue && !identity.poa.verified ? 1 : 0);
+      (delegationDue && !poaProven ? 1 : 0);
     const total =
       requiredInfo.length +
       requiredDocCount +
@@ -2767,7 +2786,13 @@ export class CompaniesService {
       // The verified payload owns the person's details from here on.
       ...(result.fullName ? { [`${prefix}Name`]: result.fullName } : {}),
       ...(result.email ? { [`${prefix}Email`]: result.email } : {}),
-      ...(result.phoneNumber ? { [`${prefix}Phone`]: result.phoneNumber } : {}),
+      // Fayda returns whatever the national registry holds, which is routinely a
+      // local number ("0911223344"). Every typed phone in this service is stored
+      // E.164, and `@IsValidPhone()` rejects anything else — so a raw claim here
+      // becomes a value the portal reads back and cannot resubmit.
+      ...(result.phoneNumber
+        ? { [`${prefix}Phone`]: normalizeE164(result.phoneNumber) }
+        : {}),
       ...(result.address ? { [`${prefix}Address`]: result.address } : {}),
     };
 
diff --git a/apps/edr-freight-api/src/modules/companies/dto/update-profile.dto.ts b/apps/edr-freight-api/src/modules/companies/dto/update-profile.dto.ts
index 596644fab..dc7729479 100644
--- a/apps/edr-freight-api/src/modules/companies/dto/update-profile.dto.ts
+++ b/apps/edr-freight-api/src/modules/companies/dto/update-profile.dto.ts
@@ -1,4 +1,12 @@
-import { IsString, IsOptional, IsEmail, MaxLength, IsEnum, IsIn } from 'class-validator';
+import {
+  IsString,
+  IsOptional,
+  IsEmail,
+  MaxLength,
+  IsEnum,
+  IsIn,
+  Matches,
+} from 'class-validator';
 import { ETHIOPIAN_REGIONS, type EthiopianRegion } from '@edr/types';
 import { CompanyNationality } from '../entities/company.entity';
 import { IsValidPhone } from '../../../common/validators/is-phone-number.validator';
@@ -39,9 +47,13 @@ export class UpdateProfileDto {
   @IsTin({ message: 'TIN must be exactly 10 digits' })
   tin?: string;
 
+  // Ethiopian VAT registration numbers are 10 digits, the same shape as the
+  // TIN. Both portal forms enforce that; without it here the API happily stored
+  // whatever a stale client sent, and the two layers disagreed about what the
+  // column may hold.
   @IsOptional()
   @IsString()
-  @MaxLength(50)
+  @Matches(/^\d{10}$/, { message: 'VAT number must be exactly 10 digits' })
   vatNumber?: string;
 
   // `fanNumber` is deliberately absent: the FAN is the Fayda number of the
diff --git a/apps/edr-freight-api/src/modules/compliance/compliance.controller.ts b/apps/edr-freight-api/src/modules/compliance/compliance.controller.ts
index 2a5715647..0e5949300 100644
--- a/apps/edr-freight-api/src/modules/compliance/compliance.controller.ts
+++ b/apps/edr-freight-api/src/modules/compliance/compliance.controller.ts
@@ -1,5 +1,7 @@
 import { Controller, Post, Get, Patch, Delete, Body, Param, Query } from '@nestjs/common';
 import { ApiTags, ApiOperation } from '@nestjs/swagger';
+import { BookingStaff } from '../../common/booking-guards';
+import { FREIGHT_PERMS } from '../../seed/freight-permissions.registry';
 import { ComplianceService } from './compliance.service';
 import {
   CreateComplianceRecordDto,
@@ -9,10 +11,12 @@ import { ComplianceType } from './entities/compliance-record.entity';
 
 @ApiTags('Vehicle Compliance')
 @Controller('compliance')
+@BookingStaff(FREIGHT_PERMS.compliance.view)
 export class ComplianceController {
   constructor(private readonly complianceService: ComplianceService) {}
 
   @Post()
+  @BookingStaff(FREIGHT_PERMS.compliance.manage)
   @ApiOperation({ summary: 'Create a compliance record' })
   create(@Body() dto: CreateComplianceRecordDto) {
     return this.complianceService.create(dto);
@@ -40,12 +44,14 @@ export class ComplianceController {
   }
 
   @Patch(':id')
+  @BookingStaff(FREIGHT_PERMS.compliance.manage)
   @ApiOperation({ summary: 'Update a compliance record' })
   update(@Param('id') id: string, @Body() dto: UpdateComplianceRecordDto) {
     return this.complianceService.update(id, dto);
   }
 
   @Delete(':id')
+  @BookingStaff(FREIGHT_PERMS.compliance.manage)
   @ApiOperation({ summary: 'Soft-delete a compliance record' })
   remove(@Param('id') id: string) {
     return this.complianceService.remove(id);
diff --git a/apps/edr-freight-api/src/modules/contract-templates/contract-templates.controller.ts b/apps/edr-freight-api/src/modules/contract-templates/contract-templates.controller.ts
index 8cf1c5671..6cba17f61 100644
--- a/apps/edr-freight-api/src/modules/contract-templates/contract-templates.controller.ts
+++ b/apps/edr-freight-api/src/modules/contract-templates/contract-templates.controller.ts
@@ -10,7 +10,8 @@ import {
 } from "@nestjs/common";
 import { ApiOperation, ApiTags } from "@nestjs/swagger";
 
-import { FreightAdmin } from "../../common/booking-guards";
+import { BookingStaff } from "../../common/booking-guards";
+import { FREIGHT_PERMS } from "../../seed/freight-permissions.registry";
 import { ContractTemplatesService } from "./contract-templates.service";
 import {
   CreateArticleDto,
@@ -25,29 +26,44 @@ import {
 export class ContractTemplatesController {
   constructor(private readonly service: ContractTemplatesService) {}
 
-  // Reads stay open to authenticated staff (the backoffice Templates tab);
+  // Reads are staff-only (the backoffice Templates tab is the only consumer);
   // writes are admin-guarded like other freight configuration resources.
 
   @Get()
+  @BookingStaff([
+    FREIGHT_PERMS.settings.contractTemplates.view,
+    FREIGHT_PERMS.settings.contractTemplates.manage,
+    FREIGHT_PERMS.admin,
+  ])
   @ApiOperation({ summary: "List the six contract document templates" })
   list() {
     return this.service.list();
   }
 
   @Get(":code")
+  @BookingStaff([
+    FREIGHT_PERMS.settings.contractTemplates.view,
+    FREIGHT_PERMS.settings.contractTemplates.manage,
+    FREIGHT_PERMS.admin,
+  ])
   @ApiOperation({ summary: "Get one contract template by code" })
   getByCode(@Param("code") code: string) {
     return this.service.getByCode(code);
   }
 
   @Patch(":code")
-  @FreightAdmin()
+  @BookingStaff([FREIGHT_PERMS.settings.contractTemplates.manage, FREIGHT_PERMS.admin])
   @ApiOperation({ summary: "Update template metadata (name, title, recitals, active flag)" })
   update(@Param("code") code: string, @Body() dto: UpdateContractTemplateDto) {
     return this.service.update(code, dto);
   }
 
   @Post(":code/preview")
+  @BookingStaff([
+    FREIGHT_PERMS.settings.contractTemplates.view,
+    FREIGHT_PERMS.settings.contractTemplates.manage,
+    FREIGHT_PERMS.admin,
+  ])
   @ApiOperation({
     summary: "Render an HTML preview of the template against mock contract data",
   })
@@ -61,21 +77,21 @@ export class ContractTemplatesController {
   /* ------------------------- article routes ------------------------- */
 
   @Put(":code/articles")
-  @FreightAdmin()
+  @BookingStaff([FREIGHT_PERMS.settings.contractTemplates.manage, FREIGHT_PERMS.admin])
   @ApiOperation({ summary: "Replace the full ordered article list (used for reorder)" })
   replaceArticles(@Param("code") code: string, @Body() dto: ReplaceArticlesDto) {
     return this.service.replaceArticles(code, dto.articles);
   }
 
   @Post(":code/articles")
-  @FreightAdmin()
+  @BookingStaff([FREIGHT_PERMS.settings.contractTemplates.manage, FREIGHT_PERMS.admin])
   @ApiOperation({ summary: "Add an article to the template" })
   addArticle(@Param("code") code: string, @Body() dto: CreateArticleDto) {
     return this.service.addArticle(code, dto);
   }
 
   @Patch(":code/articles/:articleId")
-  @FreightAdmin()
+  @BookingStaff([FREIGHT_PERMS.settings.contractTemplates.manage, FREIGHT_PERMS.admin])
   @ApiOperation({ summary: "Update an article's title or body" })
   updateArticle(
     @Param("code") code: string,
@@ -86,7 +102,7 @@ export class ContractTemplatesController {
   }
 
   @Delete(":code/articles/:articleId")
-  @FreightAdmin()
+  @BookingStaff([FREIGHT_PERMS.settings.contractTemplates.manage, FREIGHT_PERMS.admin])
   @ApiOperation({ summary: "Remove an article from the template" })
   removeArticle(
     @Param("code") code: string,
diff --git a/apps/edr-freight-api/src/modules/contracts/contract-booking.resubmit-cargo.spec.ts b/apps/edr-freight-api/src/modules/contracts/contract-booking.resubmit-cargo.spec.ts
new file mode 100644
index 000000000..d5d15d73d
--- /dev/null
+++ b/apps/edr-freight-api/src/modules/contracts/contract-booking.resubmit-cargo.spec.ts
@@ -0,0 +1,115 @@
+import { ContractBookingService } from './contract-booking.service';
+
+/**
+ * OPERATION_CHANGES_REQUESTED resubmit with restated cargo. Operations can ask
+ * for the cargo itself to change, so a completion payload that restates
+ * containers must cancel the unpaid invoice, wipe the persisted cargo and
+ * re-run the fresh-completion path (re-persist, re-price, re-invoice). A
+ * payload without cargo keeps the day-only resubmit behavior.
+ */
+describe('ContractBookingService — changes-requested resubmit restating cargo', () => {
+  const CONTRACT = {
+    id: 'c-1',
+    reference: 'CTR-1',
+    contractKind: 'GENERAL',
+    freightType: 'CONTAINER',
+    tradeDirection: 'IMPORT',
+    customsClearingEnabled: false,
+    contractValidUntil: null,
+    cargoScope: [],
+  };
+
+  const bookingWithCargo = () => ({
+    id: 'b-1',
+    contractId: 'c-1',
+    reference: 'BKG-1',
+    status: 'OPERATION_CHANGES_REQUESTED',
+    bookingContainers: [{ containerSize: '20FT', quantity: 4 }],
+    cargoTotalWeightVgm: 80,
+    originYardId: 'y-o',
+    destinationYardId: 'y-d',
+  });
+
+  function makeService() {
+    const bookingsRepository = {
+      findByIdWithFiles: jest.fn().mockResolvedValue(bookingWithCargo()),
+      deleteContainers: jest.fn().mockResolvedValue(undefined),
+      update: jest.fn().mockResolvedValue(undefined),
+    };
+    const invoiceService = {
+      cancelUnpaidInvoiceForBooking: jest.fn().mockResolvedValue(undefined),
+    };
+    const trainSchedulingService = {
+      assertBookingWindowOpen: jest.fn().mockResolvedValue(undefined),
+    };
+    const contractsRepository = {
+      findByIdWithRelations: jest.fn().mockResolvedValue(CONTRACT),
+    };
+    const service = new ContractBookingService(
+      contractsRepository as never,
+      bookingsRepository as never,
+      {} as never, // bookingPricingService
+      {} as never, // consolidationService
+      {} as never, // containerTypesService
+      {} as never, // ruleEngineService
+      {} as never, // milestoneService
+      invoiceService as never,
+      {} as never, // bookingNotifier
+      {} as never, // dataSource
+      trainSchedulingService as never,
+      {} as never, // bookingBatchService
+      {} as never, // bookingTransitionService
+    );
+    return { service, bookingsRepository, invoiceService };
+  }
+
+  // Both paths dead-end into a downstream private assert we replace with a
+  // sentinel — which path threw tells us which branch the resubmit took.
+  const SENTINEL = new Error('reached-branch');
+
+  it('restated cargo cancels the invoice, wipes cargo and re-runs fresh completion', async () => {
+    const { service, bookingsRepository, invoiceService } = makeService();
+    // First gate inside the fresh-completion (!hasCargo) path.
+    jest
+      .spyOn(
+        service as never as { assertWithinQuantityCap: () => Promise<void> },
+        'assertWithinQuantityCap',
+      )
+      .mockRejectedValue(SENTINEL);
+
+    await expect(
+      service.completeUnderContract('c-1', 'b-1', {
+        scheduledDate: new Date().toISOString(),
+        containers: [{ containerSize: '20FT', quantity: 2 }],
+      } as never),
+    ).rejects.toBe(SENTINEL);
+
+    expect(invoiceService.cancelUnpaidInvoiceForBooking).toHaveBeenCalledWith('b-1');
+    expect(bookingsRepository.deleteContainers).toHaveBeenCalledWith('b-1');
+    expect(bookingsRepository.update).toHaveBeenCalledWith('b-1', {
+      cargoTotalWeightVgm: 0,
+    });
+  });
+
+  it('a day-only resubmit keeps the persisted cargo and invoice untouched', async () => {
+    const { service, bookingsRepository, invoiceService } = makeService();
+    // First call inside the day-only (hasCargo) resubmit path.
+    jest
+      .spyOn(
+        service as never as {
+          assertPersistedContainersAvailable: () => Promise<void>;
+        },
+        'assertPersistedContainersAvailable',
+      )
+      .mockRejectedValue(SENTINEL);
+
+    await expect(
+      service.completeUnderContract('c-1', 'b-1', {
+        scheduledDate: new Date().toISOString(),
+      } as never),
+    ).rejects.toBe(SENTINEL);
+
+    expect(invoiceService.cancelUnpaidInvoiceForBooking).not.toHaveBeenCalled();
+    expect(bookingsRepository.deleteContainers).not.toHaveBeenCalled();
+  });
+});
diff --git a/apps/edr-freight-api/src/modules/contracts/contract-booking.service.ts b/apps/edr-freight-api/src/modules/contracts/contract-booking.service.ts
index 7e0a23e3f..59afdb585 100644
--- a/apps/edr-freight-api/src/modules/contracts/contract-booking.service.ts
+++ b/apps/edr-freight-api/src/modules/contracts/contract-booking.service.ts
@@ -98,6 +98,9 @@ export class ContractBookingService {
     private readonly containerTypesService: ContainerTypesService,
     private readonly ruleEngineService: RuleEngineService,
     private readonly milestoneService: ClearanceMilestoneService,
+    // forwardRef: part of the booking-invoice ⇄ wagon-cancellation ⇄ contracts
+    // require cycle (see BookingTransitionService).
+    @Inject(forwardRef(() => BookingInvoiceService))
     private readonly invoiceService: BookingInvoiceService,
     private readonly bookingNotifier: BookingLifecycleNotifierService,
     private readonly dataSource: DataSource,
@@ -692,11 +695,30 @@ export class ContractBookingService {
     });
 
     const freightType = contract.freightType;
-    const hasCargo =
+    let hasCargo =
       (booking.bookingContainers?.length ?? 0) > 0 ||
       Number(booking.cargoTotalWeightVgm) > 0;
     const warnings: string[] = [];
 
+    // Operations may return a booking asking for the CARGO to change (fewer or
+    // more containers), not just the day. A resubmit whose payload restates the
+    // cargo therefore starts the completion over: cancel the unpaid invoice
+    // first (it throws if money is already recorded — cargo must not change
+    // under a paid invoice), then wipe the persisted cargo so the fresh-
+    // completion path below re-persists, re-prices and re-invoices from the
+    // payload. A resubmit without cargo keeps today's day-only behavior.
+    const restatesCargo = Boolean(
+      dto.containers?.length || dto.bulkLines?.length,
+    );
+    if (hasCargo && restatesCargo) {
+      await this.invoiceService.cancelUnpaidInvoiceForBooking(booking.id);
+      await this.bookingsRepository.deleteContainers(booking.id);
+      await this.bookingsRepository.update(booking.id, {
+        cargoTotalWeightVgm: 0,
+      } as never);
+      hasCargo = false;
+    }
+
     // EXPORT rides whole or not at all (no split concept): the chosen day must
     // have a single open train that carries the whole booking. First completion
     // sizes from the dto's cargo; a changes-requested resubmit (cargo already
@@ -1863,6 +1885,9 @@ export class ContractBookingService {
   async validateShipment(
     contractId: string,
     dto: CreateBookingUnderContractDto,
+    // Completion/resubmit preview: the booking being completed must not clash
+    // with its own persisted containers.
+    excludeBookingId?: string,
   ): Promise<{
     overweightLines: Array<{
       containerTypeCode: string;
@@ -2024,6 +2049,7 @@ export class ContractBookingService {
           originYardId: route?.originYardId,
           destinationYardId: route?.destinationYardId,
         },
+        excludeBookingId,
       );
       containerClashErrors = clashes.map(
         (c) =>
diff --git a/apps/edr-freight-api/src/modules/contracts/contracts.controller.ts b/apps/edr-freight-api/src/modules/contracts/contracts.controller.ts
index ec61fdd4a..6273be365 100644
--- a/apps/edr-freight-api/src/modules/contracts/contracts.controller.ts
+++ b/apps/edr-freight-api/src/modules/contracts/contracts.controller.ts
@@ -14,12 +14,10 @@ import {
   UnauthorizedException,
   UploadedFiles,
   UploadedFile,
-  UseGuards,
   UseInterceptors,
 } from '@nestjs/common';
 import { CurrentUser } from '@edr/api-common';
 import type { TCurrentUser } from '@tria-plc/api-common/modules/auth/types/current-user.type';
-import { JwtGuard } from '@tria-plc/api-common/modules/auth/services/jwt.guard';
 import { AnyFilesInterceptor, FileInterceptor } from '@nestjs/platform-express';
 import type { Response } from 'express';
 import {
@@ -32,7 +30,7 @@ import {
 } from '@nestjs/swagger';
 
 import { actorLabel } from '../warehouses/current-actor.util';
-import { BookingStaff } from '../../common/booking-guards';
+import { BookingStaff, MixedAudience, PortalCustomer } from '../../common/booking-guards';
 import { ContractDocumentHistoryService } from './contract-document-history.service';
 import {
   FREIGHT_PERMS,
@@ -127,6 +125,7 @@ export class ContractsController {
   }
 
   @Get('booking-requests/:reqId')
+  @MixedAudience(FREIGHT_PERMS.contracts.view)
   @ApiOperation({ summary: 'A single shipment request' })
   getBookingRequest(@Param('reqId', ParseUUIDPipe) reqId: string) {
     return this.bookingRequestService.findOne(reqId);
@@ -159,6 +158,7 @@ export class ContractsController {
   }
 
   @Post('booking-requests/:reqId/cancel')
+  @PortalCustomer()
   @ApiOperation({ summary: 'Customer cancels their own pending shipment request' })
   cancelBookingRequest(
     @Param('reqId', ParseUUIDPipe) reqId: string,
@@ -168,6 +168,7 @@ export class ContractsController {
   }
 
   @Post(':id/booking-requests')
+  @PortalCustomer()
   @ApiOperation({ summary: 'Customer submits a shipment request on a GENERAL customs contract' })
   submitBookingRequest(
     @Param('id', ParseUUIDPipe) id: string,
@@ -178,12 +179,14 @@ export class ContractsController {
   }
 
   @Get(':id/booking-requests')
+  @MixedAudience(FREIGHT_PERMS.contracts.view)
   @ApiOperation({ summary: 'List the shipment requests on a contract' })
   listBookingRequests(@Param('id', ParseUUIDPipe) id: string) {
     return this.bookingRequestService.listForContract(id);
   }
 
   @Post()
+  @MixedAudience([])
   @UseInterceptors(AnyFilesInterceptor())
   @ApiConsumes('multipart/form-data')
   @ApiOperation({ summary: 'Create a new contract (DRAFT) with routes + cargo scope' })
@@ -203,6 +206,7 @@ export class ContractsController {
   }
 
   @Get()
+  @MixedAudience([])
   @ApiOperation({ summary: 'List contracts (paginated)' })
   async findAll(
     @Query() filter: FilterContractDto,
@@ -247,6 +251,7 @@ export class ContractsController {
   }
 
   @Get('my')
+  @PortalCustomer()
   @ApiOperation({ summary: "List the current customer's contracts" })
   async findMy(
     @CurrentUser() user: AuthUserPayload,
@@ -301,6 +306,7 @@ export class ContractsController {
   }
 
   @Get(':id')
+  @MixedAudience(FREIGHT_PERMS.contracts.view)
   @ApiOperation({ summary: 'Get contract by ID (routes, cargo scope, unit rates)' })
   async findOne(
     @Param('id', ParseUUIDPipe) id: string,
@@ -319,6 +325,7 @@ export class ContractsController {
   }
 
   @Patch(':id')
+  @MixedAudience([])
   @UseInterceptors(AnyFilesInterceptor())
   @ApiConsumes('multipart/form-data')
   @ApiOperation({
@@ -337,6 +344,7 @@ export class ContractsController {
   }
 
   @Delete(':id')
+  @MixedAudience([])
   @HttpCode(204)
   @ApiOperation({ summary: 'Soft-delete DRAFT contract' })
   remove(@Param('id', ParseUUIDPipe) id: string) {
@@ -344,6 +352,7 @@ export class ContractsController {
   }
 
   @Post(':id/documents')
+  @MixedAudience([])
   @UseInterceptors(AnyFilesInterceptor())
   @ApiConsumes('multipart/form-data')
   @ApiOperation({ summary: 'Upload intake documents for a contract (DRAFT only)' })
@@ -355,18 +364,21 @@ export class ContractsController {
   }
 
   @Post(':id/generate-price')
+  @MixedAudience([])
   @ApiOperation({ summary: 'Generate unit-rate breakdown (no totals at contract phase)' })
   generatePrice(@Param('id', ParseUUIDPipe) id: string) {
     return this.pricingService.generatePrice(id);
   }
 
   @Post(':id/submit')
+  @MixedAudience([])
   @ApiOperation({ summary: 'Customer submit contract (freezes contract_rate_snapshots)' })
   submit(@Param('id', ParseUUIDPipe) id: string) {
     return this.transitionService.submit(id);
   }
 
   @Post(':id/confirm-submit')
+  @MixedAudience([])
   @ApiOperation({ summary: 'Confirm submit after a price change' })
   confirmSubmit(@Param('id', ParseUUIDPipe) id: string) {
     return this.transitionService.confirmSubmit(id);
@@ -427,10 +439,7 @@ export class ContractsController {
   // real boundary: it admits only the approver whose step is currently pending
   // (edit rights hand off down the chain on each approval).
   @Put(':id/document/articles')
-  @BookingStaff([
-    FREIGHT_PERMS.contracts.view,
-    ...bothFreightTypes(FREIGHT_PERMS.contracts.staffAccept),
-  ])
+  @BookingStaff(FREIGHT_PERMS.contracts.editDocument)
   @ApiOperation({
     summary:
       'Edit this contract\'s document articles only (per-contract; never touches the six shared templates)',
@@ -515,6 +524,7 @@ export class ContractsController {
   }
 
   @Post(':id/cancel')
+  @PortalCustomer()
   @ApiOperation({
     summary: 'Customer cancels their own contract (blocked while a booking is live)',
   })
@@ -591,6 +601,7 @@ export class ContractsController {
   }
 
   @Get(':id/contract/view')
+  @MixedAudience(FREIGHT_PERMS.contracts.view)
   @ApiOperation({ summary: 'Contract PDF view-model + rendered HTML for signing' })
   async getContractView(
     @Param('id', ParseUUIDPipe) id: string,
@@ -630,6 +641,7 @@ export class ContractsController {
   }
 
   @Get(':id/contract/document')
+  @MixedAudience(FREIGHT_PERMS.contracts.view)
   @ApiOperation({ summary: 'Download contract PDF' })
   async downloadContractDocument(
     @Param('id', ParseUUIDPipe) id: string,
@@ -653,7 +665,7 @@ export class ContractsController {
   }
 
   @Post(':id/contract/send-signing-otp')
-  @UseGuards(JwtGuard)
+  @MixedAudience(bothFreightTypes(FREIGHT_PERMS.contracts.signStaff))
   @ApiOperation({
     summary:
       "Send the sudo-mode signing OTP to the contract company's registered phone (server picks the number)",
@@ -666,7 +678,7 @@ export class ContractsController {
   }
 
   @Post(':id/contract/sign')
-  @UseGuards(JwtGuard)
+  @MixedAudience(bothFreightTypes(FREIGHT_PERMS.contracts.signStaff))
   @ApiOperation({ summary: 'Apply digital signature (customer or staff/director/ceo)' })
   async signContract(
     @Param('id', ParseUUIDPipe) id: string,
@@ -691,6 +703,7 @@ export class ContractsController {
   }
 
   @Post(':id/renew')
+  @PortalCustomer()
   @ApiOperation({ summary: 'Create a renewal draft linked via renewalOfId' })
   async renew(
     @Param('id', ParseUUIDPipe) id: string,
@@ -712,12 +725,14 @@ export class ContractsController {
   // ── Pre-booking clearance (Path B, doc §15.2.1) ────────────────────────────
 
   @Get(':id/clearance')
+  @MixedAudience(FREIGHT_PERMS.contracts.view)
   @ApiOperation({ summary: 'Pre-booking clearance document grid on the contract' })
   getClearance(@Param('id', ParseUUIDPipe) id: string) {
     return this.clearanceService.getClearanceView(id);
   }
 
   @Post(':id/clearance/documents')
+  @PortalCustomer()
   @UseInterceptors(AnyFilesInterceptor())
   @ApiConsumes('multipart/form-data')
   @ApiOperation({ summary: 'Customer uploads clearance documents (fieldname = document key)' })
@@ -901,6 +916,7 @@ export class ContractsController {
   }
 
   @Post(':id/clearance/duty/dispute')
+  @PortalCustomer()
   @ApiOperation({
     summary:
       'Customer disputes the advised duty/tax with a reason — reopens the step so GL Ethiopia can re-advise (repeatable)',
@@ -914,6 +930,7 @@ export class ContractsController {
   }
 
   @Post(':id/clearance/duty-slip')
+  @PortalCustomer()
   @UseInterceptors(FileInterceptor('file'))
   @ApiConsumes('multipart/form-data')
   @ApiOperation({ summary: 'Customer uploads duty/tax payment slip on contract' })
@@ -1057,6 +1074,7 @@ export class ContractsController {
   // ── Booking under contract (Path A customer / Path B GL ET) ────────────────
 
   @Post(':id/bookings')
+  @BookingStaff(FREIGHT_PERMS.contracts.createBooking)
   @ApiOperation({
     summary:
       'Create a shipment booking under a contract — Path A (customer) or Path B (GL Ethiopia).',
@@ -1078,6 +1096,7 @@ export class ContractsController {
   }
 
   @Post(':id/bookings/initiate')
+  @BookingStaff(FREIGHT_PERMS.contracts.createBooking)
   @ApiOperation({
     summary:
       'Initiate a bare booking instance under an import/export contract (ONE_TIME or GENERAL) — no cargo, no date; enters per-booking clearance (AWAITING_DOCUMENTS). ONE_TIME customs instances are opened by the customer (or GL); GENERAL customs comes from a shipment request.',
@@ -1096,6 +1115,7 @@ export class ContractsController {
   }
 
   @Post(':id/bookings/:bookingId/complete')
+  @BookingStaff(FREIGHT_PERMS.contracts.createBooking)
   @ApiOperation({
     summary:
       'Complete an initiated booking after Operations finalized its clearance — cargo + binding day, window and departure checks, pricing and invoicing.',
@@ -1117,6 +1137,7 @@ export class ContractsController {
   }
 
   @Post(':id/validate-shipment')
+  @MixedAudience([FREIGHT_PERMS.contracts.createBooking, FREIGHT_PERMS.contracts.view])
   @ApiOperation({
     summary:
       'Pre-create validation + authoritative price preview: full booking price breakdown (rail, first/last mile, surcharges), overweight lines and 20ft weight-pairing errors for a shipment payload (no booking created).',
@@ -1124,11 +1145,15 @@ export class ContractsController {
   validateShipment(
     @Param('id', ParseUUIDPipe) id: string,
     @Body() dto: CreateBookingUnderContractDto,
+    // Completion/resubmit preview: exclude this booking's own persisted
+    // containers from the same-train clash check.
+    @Query('bookingId') bookingId?: string,
   ) {
-    return this.contractBookingService.validateShipment(id, dto);
+    return this.contractBookingService.validateShipment(id, dto, bookingId);
   }
 
   @Get(':id/capacity')
+  @MixedAudience(FREIGHT_PERMS.contracts.view)
   @ApiOperation({
     summary:
       'Remaining bookable quantity per cargo line (GENERAL draw-down cap, or the outstanding remainder of a split ONE_TIME contract)',
@@ -1141,12 +1166,14 @@ export class ContractsController {
   // ── Clearance milestones (doc §11.3, §12.2) ────────────────────────────────
 
   @Get(':id/milestones')
+  @MixedAudience(FREIGHT_PERMS.contracts.view)
   @ApiOperation({ summary: 'Pre-booking clearance milestones for a contract cycle' })
   listContractMilestones(@Param('id', ParseUUIDPipe) id: string) {
     return this.milestoneService.listForContract(id);
   }
 
   @Get('bookings/:bookingId/milestones')
+  @MixedAudience(FREIGHT_PERMS.contracts.view)
   @ApiOperation({ summary: 'Post-booking clearance milestones for a shipment booking' })
   listBookingMilestones(@Param('bookingId', ParseUUIDPipe) bookingId: string) {
     return this.milestoneService.listForBooking(bookingId);
@@ -1280,7 +1307,7 @@ export class ContractsController {
   }
 
   @Post('bookings/:bookingId/final-invoice')
-  @BookingStaff(FREIGHT_PERMS.contracts.clearanceDjActions)
+  @BookingStaff(FREIGHT_PERMS.contracts.finalInvoiceRaise)
   @UseInterceptors(FileInterceptor('file'))
   @ApiConsumes('multipart/form-data')
   @ApiOperation({
@@ -1307,6 +1334,7 @@ export class ContractsController {
   }
 
   @Post('bookings/:bookingId/final-invoice/approve')
+  @PortalCustomer()
   @ApiOperation({
     summary: 'Customer approves the drafted final invoice — unlocks the payment slip',
   })
@@ -1321,6 +1349,7 @@ export class ContractsController {
   }
 
   @Post('bookings/:bookingId/final-invoice-slip')
+  @PortalCustomer()
   @UseInterceptors(FileInterceptor('file'))
   @ApiConsumes('multipart/form-data')
   @ApiOperation({ summary: 'Customer attaches the payment slip for the final invoice' })
@@ -1332,10 +1361,7 @@ export class ContractsController {
   }
 
   @Post('bookings/:bookingId/final-invoice/confirm')
-  @BookingStaff([
-    FREIGHT_PERMS.contracts.clearanceDjActions,
-    FREIGHT_PERMS.contracts.clearanceEtActions,
-  ])
+  @BookingStaff(FREIGHT_PERMS.contracts.finalInvoiceConfirm)
   @ApiOperation({ summary: 'GL (ET or DJ) confirms the payment slip — settles the final invoice' })
   confirmFinalInvoicePaid(
     @Param('bookingId', ParseUUIDPipe) bookingId: string,
@@ -1378,6 +1404,7 @@ export class ContractsController {
   }
 
   @Post('bookings/:bookingId/second-duty-slip')
+  @PortalCustomer()
   @UseInterceptors(FileInterceptor('file'))
   @ApiConsumes('multipart/form-data')
   @ApiOperation({ summary: 'Customer attaches the additional duty/tax payment slip' })
@@ -1403,6 +1430,7 @@ export class ContractsController {
   }
 
   @Post('bookings/:bookingId/duty-slip')
+  @PortalCustomer()
   @UseInterceptors(AnyFilesInterceptor())
   @ApiConsumes('multipart/form-data')
   @ApiOperation({ summary: 'Customer uploads the duty/tax payment slip' })
@@ -1419,6 +1447,7 @@ export class ContractsController {
   }
 
   @Get('bookings/:bookingId/incidents')
+  @MixedAudience(FREIGHT_PERMS.contracts.view)
   @ApiOperation({ summary: 'List cargo exception/damage reports for a shipment' })
   listIncidents(@Param('bookingId', ParseUUIDPipe) bookingId: string) {
     return this.glOperationsService.listIncidents(bookingId);
diff --git a/apps/edr-freight-api/src/modules/demo-permissions/demo-permissions.controller.ts b/apps/edr-freight-api/src/modules/demo-permissions/demo-permissions.controller.ts
deleted file mode 100644
index 6f425e1bb..000000000
--- a/apps/edr-freight-api/src/modules/demo-permissions/demo-permissions.controller.ts
+++ /dev/null
@@ -1,22 +0,0 @@
-import { Controller, Get, UseGuards } from "@nestjs/common";
-import { ApiOperation, ApiTags } from "@nestjs/swagger";
-
-import { PermissionGuard } from "@tria-plc/api-common/modules/auth/services/permission.guard";
-
-@ApiTags("demo-permissions")
-@Controller()
-export class DemoPermissionsController {
-  @Get("test_user1")
-  @ApiOperation({ summary: "Permission demo (can:demo:user1)" })
-  @UseGuards(PermissionGuard(["can:demo:user1"]))
-  testUser1() {
-    return { ok: true, permission: "can:demo:user1" };
-  }
-
-  @Get("test_user2")
-  @ApiOperation({ summary: "Permission demo (can:demo:user2)" })
-  @UseGuards(PermissionGuard(["can:demo:user2"]))
-  testUser2() {
-    return { ok: true, permission: "can:demo:user2" };
-  }
-}
diff --git a/apps/edr-freight-api/src/modules/demo-permissions/demo-permissions.module.ts b/apps/edr-freight-api/src/modules/demo-permissions/demo-permissions.module.ts
deleted file mode 100644
index db73ed728..000000000
--- a/apps/edr-freight-api/src/modules/demo-permissions/demo-permissions.module.ts
+++ /dev/null
@@ -1,8 +0,0 @@
-import { Module } from "@nestjs/common";
-
-import { DemoPermissionsController } from "./demo-permissions.controller";
-
-@Module({
-  controllers: [DemoPermissionsController],
-})
-export class DemoPermissionsModule {}
diff --git a/apps/edr-freight-api/src/modules/dropdown-settings/dropdown-settings.controller.ts b/apps/edr-freight-api/src/modules/dropdown-settings/dropdown-settings.controller.ts
index aad904557..aaf552f40 100644
--- a/apps/edr-freight-api/src/modules/dropdown-settings/dropdown-settings.controller.ts
+++ b/apps/edr-freight-api/src/modules/dropdown-settings/dropdown-settings.controller.ts
@@ -14,7 +14,8 @@ import {
 } from "@nestjs/common";
 import { ApiOperation, ApiTags } from "@nestjs/swagger";
 
-import { FreightAdmin } from "../../common/booking-guards";
+import { BookingStaff } from "../../common/booking-guards";
+import { FREIGHT_PERMS } from "../../seed/freight-permissions.registry";
 import { CreateDropdownOptionDto } from "./dto/create-dropdown-option.dto";
 import { CreateDropdownSettingDto } from "./dto/create-dropdown-setting.dto";
 import { ListDropdownSettingsQueryDto } from "./dto/list-dropdown-settings-query.dto";
@@ -58,14 +59,14 @@ export class DropdownSettingsController {
   }
 
   @Post()
-  @FreightAdmin()
+  @BookingStaff([FREIGHT_PERMS.settings.dropdown.manage, FREIGHT_PERMS.admin])
   @ApiOperation({ summary: "Create a new dropdown setting" })
   create(@Body() dto: CreateDropdownSettingDto) {
     return this.service.create(dto);
   }
 
   @Patch(":id")
-  @FreightAdmin()
+  @BookingStaff([FREIGHT_PERMS.settings.dropdown.manage, FREIGHT_PERMS.admin])
   @ApiOperation({ summary: "Update a dropdown setting's metadata" })
   update(
     @Param("id", ParseUUIDPipe) id: string,
@@ -75,7 +76,7 @@ export class DropdownSettingsController {
   }
 
   @Delete(":id")
-  @FreightAdmin()
+  @BookingStaff([FREIGHT_PERMS.settings.dropdown.manage, FREIGHT_PERMS.admin])
   @ApiOperation({ summary: "Soft-delete a dropdown setting" })
   @HttpCode(HttpStatus.NO_CONTENT)
   remove(@Param("id", ParseUUIDPipe) id: string) {
@@ -85,7 +86,7 @@ export class DropdownSettingsController {
   /* ------------------------- option routes ------------------------- */
 
   @Put(":id/options")
-  @FreightAdmin()
+  @BookingStaff([FREIGHT_PERMS.settings.dropdown.manage, FREIGHT_PERMS.admin])
   @ApiOperation({ summary: "Replace the full option list for a setting" })
   replaceOptions(
     @Param("id", ParseUUIDPipe) id: string,
@@ -95,7 +96,7 @@ export class DropdownSettingsController {
   }
 
   @Post(":id/options")
-  @FreightAdmin()
+  @BookingStaff([FREIGHT_PERMS.settings.dropdown.manage, FREIGHT_PERMS.admin])
   @ApiOperation({ summary: "Append a single option to a setting" })
   addOption(
     @Param("id", ParseUUIDPipe) id: string,
@@ -105,7 +106,7 @@ export class DropdownSettingsController {
   }
 
   @Patch("options/:optionId")
-  @FreightAdmin()
+  @BookingStaff([FREIGHT_PERMS.settings.dropdown.manage, FREIGHT_PERMS.admin])
   @ApiOperation({ summary: "Update a single option" })
   updateOption(
     @Param("optionId", ParseUUIDPipe) optionId: string,
@@ -115,7 +116,7 @@ export class DropdownSettingsController {
   }
 
   @Delete("options/:optionId")
-  @FreightAdmin()
+  @BookingStaff([FREIGHT_PERMS.settings.dropdown.manage, FREIGHT_PERMS.admin])
   @ApiOperation({ summary: "Soft-delete a single option" })
   @HttpCode(HttpStatus.NO_CONTENT)
   removeOption(@Param("optionId", ParseUUIDPipe) optionId: string) {
diff --git a/apps/edr-freight-api/src/modules/exchange-settings/exchange-settings.controller.ts b/apps/edr-freight-api/src/modules/exchange-settings/exchange-settings.controller.ts
index a6c08a317..001fc90d2 100644
--- a/apps/edr-freight-api/src/modules/exchange-settings/exchange-settings.controller.ts
+++ b/apps/edr-freight-api/src/modules/exchange-settings/exchange-settings.controller.ts
@@ -3,7 +3,8 @@ import { ApiBearerAuth, ApiOperation, ApiTags } from "@nestjs/swagger";
 import { CurrentUser } from "@edr/api-common";
 import type { TCurrentUser } from "@tria-plc/api-common/modules/auth/types/current-user.type";
 
-import { FreightAdmin } from "../../common/booking-guards";
+import { BookingStaff } from "../../common/booking-guards";
+import { FREIGHT_PERMS } from "../../seed/freight-permissions.registry";
 import { UpdateExchangeSettingDto } from "./dto/update-exchange-setting.dto";
 import { ExchangeSettingsService } from "./exchange-settings.service";
 
@@ -14,7 +15,7 @@ export class ExchangeSettingsController {
   constructor(private readonly service: ExchangeSettingsService) {}
 
   @Get()
-  @FreightAdmin()
+  @BookingStaff([FREIGHT_PERMS.settings.exchangeRate.view, FREIGHT_PERMS.admin])
   @ApiOperation({
     summary: "Current USD→ETB fallback rate and CBE feed health",
   })
@@ -32,7 +33,7 @@ export class ExchangeSettingsController {
   }
 
   @Patch()
-  @FreightAdmin()
+  @BookingStaff([FREIGHT_PERMS.settings.exchangeRate.manage, FREIGHT_PERMS.admin])
   @ApiOperation({
     summary:
       "Set the USD→ETB fallback by hand (used only while CBE is unreachable)",
diff --git a/apps/edr-freight-api/src/modules/facilities/facilities.controller.ts b/apps/edr-freight-api/src/modules/facilities/facilities.controller.ts
index 25fbbc365..451c4d03b 100644
--- a/apps/edr-freight-api/src/modules/facilities/facilities.controller.ts
+++ b/apps/edr-freight-api/src/modules/facilities/facilities.controller.ts
@@ -1,6 +1,8 @@
 import { Body, Controller, Delete, Get, HttpCode, Param, Patch, Post } from '@nestjs/common';
 import { ApiOperation, ApiTags } from '@nestjs/swagger';
 
+import { BookingStaff } from '../../common/booking-guards';
+import { FREIGHT_PERMS } from '../../seed/freight-permissions.registry';
 import { CreateFacilityDto } from './dto/create-facility.dto';
 import { UpdateFacilityDto } from './dto/update-facility.dto';
 import { Facility } from './entities/facility.entity';
@@ -8,10 +10,12 @@ import { FacilitiesService } from './facilities.service';
 
 @ApiTags('Facilities')
 @Controller('facilities')
+@BookingStaff(FREIGHT_PERMS.facilities.view)
 export class FacilitiesController {
   constructor(private readonly facilitiesService: FacilitiesService) {}
 
   @Post()
+  @BookingStaff(FREIGHT_PERMS.facilities.manage)
   @ApiOperation({ summary: 'Create a new facility' })
   async create(@Body() createFacilityDto: CreateFacilityDto): Promise<Facility> {
     return this.facilitiesService.create(createFacilityDto);
@@ -30,6 +34,7 @@ export class FacilitiesController {
   }
 
   @Patch(':id')
+  @BookingStaff(FREIGHT_PERMS.facilities.manage)
   @ApiOperation({ summary: 'Update a facility' })
   async update(@Param('id') id: string, @Body() updateFacilityDto: UpdateFacilityDto): Promise<Facility | null> {
     return this.facilitiesService.update(id, updateFacilityDto);
@@ -37,6 +42,7 @@ export class FacilitiesController {
 
   @Delete(':id')
   @HttpCode(204)
+  @BookingStaff(FREIGHT_PERMS.facilities.manage)
   @ApiOperation({ summary: 'Delete a facility (soft delete)' })
   async remove(@Param('id') id: string): Promise<void> {
     return this.facilitiesService.remove(id);
diff --git a/apps/edr-freight-api/src/modules/file-upload-settings/file-upload-settings.controller.ts b/apps/edr-freight-api/src/modules/file-upload-settings/file-upload-settings.controller.ts
index 661339902..ab4ae98f0 100644
--- a/apps/edr-freight-api/src/modules/file-upload-settings/file-upload-settings.controller.ts
+++ b/apps/edr-freight-api/src/modules/file-upload-settings/file-upload-settings.controller.ts
@@ -13,7 +13,8 @@ import {
 } from "@nestjs/common";
 import { ApiOperation, ApiTags } from "@nestjs/swagger";
 
-import { FreightAdmin } from "../../common/booking-guards";
+import { BookingStaff } from "../../common/booking-guards";
+import { FREIGHT_PERMS } from "../../seed/freight-permissions.registry";
 import { CreateFileUploadFieldDto } from "./dto/create-file-upload-field.dto";
 import { CreateFileUploadSettingDto } from "./dto/create-file-upload-setting.dto";
 import { UpdateFileUploadFieldDto } from "./dto/update-file-upload-field.dto";
@@ -53,14 +54,14 @@ export class FileUploadSettingsController {
   }
 
   @Post()
-  @FreightAdmin()
+  @BookingStaff([FREIGHT_PERMS.settings.fileUpload.manage, FREIGHT_PERMS.admin])
   @ApiOperation({ summary: "Create a new file upload setting" })
   create(@Body() dto: CreateFileUploadSettingDto) {
     return this.service.create(dto);
   }
 
   @Patch(":id")
-  @FreightAdmin()
+  @BookingStaff([FREIGHT_PERMS.settings.fileUpload.manage, FREIGHT_PERMS.admin])
   @ApiOperation({ summary: "Update a file upload setting's metadata" })
   update(
     @Param("id", ParseUUIDPipe) id: string,
@@ -70,7 +71,7 @@ export class FileUploadSettingsController {
   }
 
   @Delete(":id")
-  @FreightAdmin()
+  @BookingStaff([FREIGHT_PERMS.settings.fileUpload.manage, FREIGHT_PERMS.admin])
   @ApiOperation({ summary: "Soft-delete a file upload setting" })
   @HttpCode(HttpStatus.NO_CONTENT)
   remove(@Param("id", ParseUUIDPipe) id: string) {
@@ -80,7 +81,7 @@ export class FileUploadSettingsController {
   /* ------------------------- field routes ------------------------- */
 
   @Put(":id/fields")
-  @FreightAdmin()
+  @BookingStaff([FREIGHT_PERMS.settings.fileUpload.manage, FREIGHT_PERMS.admin])
   @ApiOperation({ summary: "Replace the full field list for a setting" })
   replaceFields(
     @Param("id", ParseUUIDPipe) id: string,
@@ -90,7 +91,7 @@ export class FileUploadSettingsController {
   }
 
   @Post(":id/fields")
-  @FreightAdmin()
+  @BookingStaff([FREIGHT_PERMS.settings.fileUpload.manage, FREIGHT_PERMS.admin])
   @ApiOperation({ summary: "Append a single field to a setting" })
   addField(
     @Param("id", ParseUUIDPipe) id: string,
@@ -100,7 +101,7 @@ export class FileUploadSettingsController {
   }
 
   @Patch("fields/:fieldId")
-  @FreightAdmin()
+  @BookingStaff([FREIGHT_PERMS.settings.fileUpload.manage, FREIGHT_PERMS.admin])
   @ApiOperation({ summary: "Update a single field" })
   updateField(
     @Param("fieldId", ParseUUIDPipe) fieldId: string,
@@ -110,7 +111,7 @@ export class FileUploadSettingsController {
   }
 
   @Delete("fields/:fieldId")
-  @FreightAdmin()
+  @BookingStaff([FREIGHT_PERMS.settings.fileUpload.manage, FREIGHT_PERMS.admin])
   @ApiOperation({ summary: "Soft-delete a single field" })
   @HttpCode(HttpStatus.NO_CONTENT)
   removeField(@Param("fieldId", ParseUUIDPipe) fieldId: string) {
diff --git a/apps/edr-freight-api/src/modules/files/files.controller.ts b/apps/edr-freight-api/src/modules/files/files.controller.ts
index fc58a731c..139da9fbd 100644
--- a/apps/edr-freight-api/src/modules/files/files.controller.ts
+++ b/apps/edr-freight-api/src/modules/files/files.controller.ts
@@ -16,6 +16,7 @@ import {
 } from "@nestjs/swagger";
 import { Response } from "express";
 
+import { MixedAudience } from "../../common/booking-guards";
 import { FilesService } from "./files.service";
 
 @ApiTags("files")
@@ -25,6 +26,7 @@ export class FilesController {
   constructor(private readonly filesService: FilesService) {}
 
   @Get(":fileId")
+  @MixedAudience([])
   // Authenticated: no @Public, so the global JwtGuard applies. Unguessable file
   // UUIDs are obscurity, not authorization — raw byte streams must require auth.
   // Browser inline previews (<img>/<iframe>/<a>) that can't carry the Bearer
diff --git a/apps/edr-freight-api/src/modules/first-mile/first-mile.controller.ts b/apps/edr-freight-api/src/modules/first-mile/first-mile.controller.ts
index 952f924d6..e6610a59d 100644
--- a/apps/edr-freight-api/src/modules/first-mile/first-mile.controller.ts
+++ b/apps/edr-freight-api/src/modules/first-mile/first-mile.controller.ts
@@ -28,7 +28,9 @@ import { FirstMileInvoiceService } from './first-mile-invoice.service';
 @ApiTags('first-mile')
 @ApiBearerAuth()
 @Controller('first-mile')
-@BookingStaff(FREIGHT_PERMS.firstMile.view)
+// No class-level key: Nest stacks class and method guards, so a class-level
+// `view` would AND with every action key below and lock out staff granted only
+// an action (e.g. assign_vehicles). Each route carries its own key instead.
 export class FirstMileController {
   constructor(
     private readonly firstMileService: FirstMileService,
@@ -36,6 +38,7 @@ export class FirstMileController {
   ) { }
 
   @Get()
+  @BookingStaff(FREIGHT_PERMS.firstMile.view)
   @ApiOperation({ summary: 'List first-mile legs' })
   findAll(
     @Query('status') status?: string,
@@ -58,6 +61,7 @@ export class FirstMileController {
   }
 
   @Get(':id')
+  @BookingStaff(FREIGHT_PERMS.firstMile.view)
   @ApiOperation({ summary: 'Get a first-mile leg by ID' })
   findOne(@Param('id', ParseUUIDPipe) id: string) {
     return this.firstMileService.findById(id);
diff --git a/apps/edr-freight-api/src/modules/last-mile-requests/last-mile-requests.controller.ts b/apps/edr-freight-api/src/modules/last-mile-requests/last-mile-requests.controller.ts
index 4c4ac88e5..10f82ad07 100644
--- a/apps/edr-freight-api/src/modules/last-mile-requests/last-mile-requests.controller.ts
+++ b/apps/edr-freight-api/src/modules/last-mile-requests/last-mile-requests.controller.ts
@@ -6,7 +6,7 @@ import { CurrentUser } from '@edr/api-common';
 import type { TCurrentUser } from '@tria-plc/api-common/modules/auth/types/current-user.type';
 import { LastMileRequestStatus } from '@edr/types';
 
-import { BookingStaff } from '../../common/booking-guards';
+import { BookingStaff, MixedAudience, PortalCustomer } from '../../common/booking-guards';
 import { FREIGHT_PERMS } from '../../seed/freight-permissions.registry';
 import { ApproveLastMileRequestDto } from './dto/approve-last-mile-request.dto';
 import { RejectLastMileRequestDto } from './dto/reject-last-mile-request.dto';
@@ -61,12 +61,14 @@ export class LastMileRequestsController {
   // Customer-facing like :id/submit — the service ownership-checks against the
   // resolved company; staff may also open it (read-only view).
   @Get(':id/contract/view')
+  @MixedAudience(FREIGHT_PERMS.lastMile.requestView)
   @ApiOperation({ summary: 'LM contract view model + rendered HTML + saved signature' })
   contractView(@Param('id', ParseUUIDPipe) id: string, @CurrentUser() user: TCurrentUser) {
     return this.contractService.getContractView(id, user?.id ?? null);
   }
 
   @Get(':id/contract/document')
+  @MixedAudience(FREIGHT_PERMS.lastMile.requestView)
   @ApiOperation({ summary: 'Download the LM contract PDF (LM_<CustomerName>.pdf)' })
   async contractDocument(
     @Param('id', ParseUUIDPipe) id: string,
@@ -79,6 +81,7 @@ export class LastMileRequestsController {
   }
 
   @Post(':id/contract/sign')
+  @PortalCustomer()
   @ApiOperation({ summary: 'Customer agrees and signs the LM contract — then the advance invoice is issued' })
   signContract(
     @Param('id', ParseUUIDPipe) id: string,
@@ -99,6 +102,7 @@ export class LastMileRequestsController {
   // TODO: integrate @edr/auth — @CurrentUser is a stub until then; the service
   // still cross-checks the request's booking against the resolved company.
   @Post(':id/submit')
+  @PortalCustomer()
   @ApiOperation({ summary: "Customer confirms which containers go via EDR last-mile" })
   submit(
     @Param('id', ParseUUIDPipe) id: string,
diff --git a/apps/edr-freight-api/src/modules/last-mile/last-mile.controller.ts b/apps/edr-freight-api/src/modules/last-mile/last-mile.controller.ts
index d7e2ba1ff..7a2765fd8 100644
--- a/apps/edr-freight-api/src/modules/last-mile/last-mile.controller.ts
+++ b/apps/edr-freight-api/src/modules/last-mile/last-mile.controller.ts
@@ -34,7 +34,9 @@ import { LastMileInvoiceService } from './last-mile-invoice.service';
 @ApiTags('last-mile')
 @ApiBearerAuth()
 @Controller('last-mile')
-@BookingStaff(FREIGHT_PERMS.lastMile.view)
+// No class-level key: Nest stacks class and method guards, so a class-level
+// `view` would AND with every action key below and lock out staff granted only
+// an action (e.g. assign_vehicles). Each route carries its own key instead.
 export class LastMileController {
   constructor(
     private readonly lastMileService: LastMileService,
@@ -42,6 +44,7 @@ export class LastMileController {
   ) {}
 
   @Get()
+  @BookingStaff(FREIGHT_PERMS.lastMile.view)
   @ApiOperation({ summary: 'List last-mile legs' })
   findAll(
     @Query('status') status?: string,
@@ -64,18 +67,21 @@ export class LastMileController {
   }
 
   @Get(':id')
+  @BookingStaff(FREIGHT_PERMS.lastMile.view)
   @ApiOperation({ summary: 'Get a last-mile leg by ID' })
   findOne(@Param('id', ParseUUIDPipe) id: string) {
     return this.lastMileService.findById(id);
   }
 
   @Get('booking/:bookingId/arrival-trucks')
+  @BookingStaff(FREIGHT_PERMS.lastMile.view)
   @ApiOperation({ summary: "Assigned EDR last-mile trucks for a booking (arrival/exit weighing prefill)" })
   arrivalTrucks(@Param('bookingId', ParseUUIDPipe) bookingId: string) {
     return this.lastMileService.arrivalTrucksForBooking(bookingId);
   }
 
   @Get('booking/:bookingId/remaining-tons')
+  @BookingStaff(FREIGHT_PERMS.lastMile.view)
   @ApiOperation({ summary: 'Bulk drawdown: tonnage still to be hauled (total − departed trucks)' })
   remainingTons(@Param('bookingId', ParseUUIDPipe) bookingId: string) {
     return this.lastMileService.remainingTonsForBooking(bookingId);
diff --git a/apps/edr-freight-api/src/modules/last-mile/last-mile.service.ts b/apps/edr-freight-api/src/modules/last-mile/last-mile.service.ts
index ec7d4ccf6..8ed5ae8aa 100644
--- a/apps/edr-freight-api/src/modules/last-mile/last-mile.service.ts
+++ b/apps/edr-freight-api/src/modules/last-mile/last-mile.service.ts
@@ -460,8 +460,21 @@ export class LastMileService {
   @OnEvent("last_mile.invoice.paid")
   async onBookingInvoicePaid(payload: InvoiceEventPayload): Promise<void> {
     try {
-      // Invoice paid → the delivery is complete. Route through update() so it
-      // also frees the trucks + records history (same as "Mark Delivered").
+      if (payload.type === 'LAST_MILE_ADVANCE') {
+        // Advance paid → the leg becomes dispatchable, not delivered.
+        await this.update(payload.sourceId, {
+          status: 'READY_TO_TRANSIT',
+          advancedPayment: payload.totalAmount,
+        } as unknown as UpdateLastMileDto);
+        this.logger.log(
+          `Last-mile ${payload.sourceId} READY_TO_TRANSIT on advance invoice ${payload.invoiceId} payment`,
+        );
+        return;
+      }
+      if (payload.type !== 'DELIVERY_FEE') return;
+      // Delivery-fee invoice paid → the delivery is complete. Route through
+      // update() so it also frees the trucks + records history (same as
+      // "Mark Delivered").
       await this.update(payload.sourceId, { status: 'DELIVERED', paid: true } as unknown as UpdateLastMileDto);
       this.logger.log(`Last-mile ${payload.sourceId} marked DELIVERED on invoice ${payload.invoiceId} payment`);
     } catch (err) {
diff --git a/apps/edr-freight-api/src/modules/notification-inbox/notification-inbox.controller.ts b/apps/edr-freight-api/src/modules/notification-inbox/notification-inbox.controller.ts
index 80fecf1bf..6fb82c3a0 100644
--- a/apps/edr-freight-api/src/modules/notification-inbox/notification-inbox.controller.ts
+++ b/apps/edr-freight-api/src/modules/notification-inbox/notification-inbox.controller.ts
@@ -1,11 +1,5 @@
 import { CurrentUser } from "@edr/api-common";
 import {
-  NotificationAudience,
-  NotificationPriority,
-  NotificationType,
-} from "@edr/types";
-import {
-  Body,
   Controller,
   Get,
   Param,
@@ -62,22 +56,4 @@ export class NotificationInboxController {
     return this.service.markAllRead(resolveAuthUserId(user));
   }
 
-  // TODO: remove before merge — dev/verification helper only.
-  @Post("test")
-  @ApiOperation({
-    summary: "[dev] Send a test notification to the current user",
-  })
-  sendTest(
-    @CurrentUser() user: AuthUserPayload,
-    @Body()
-    body: {
-      audience?: NotificationAudience;
-      type?: NotificationType;
-      priority?: NotificationPriority;
-      title?: string;
-      message?: string;
-    },
-  ) {
-    return this.service.sendTestToUser(resolveAuthUserId(user), body ?? {});
-  }
 }
diff --git a/apps/edr-freight-api/src/modules/notification-inbox/notification-inbox.service.ts b/apps/edr-freight-api/src/modules/notification-inbox/notification-inbox.service.ts
index 97ee0380e..7cfbf81df 100644
--- a/apps/edr-freight-api/src/modules/notification-inbox/notification-inbox.service.ts
+++ b/apps/edr-freight-api/src/modules/notification-inbox/notification-inbox.service.ts
@@ -1,11 +1,9 @@
 import {
-  NotificationAudience,
   NotificationChannels,
   NotificationChannelsSent,
   NotificationDto,
   NotificationListResult,
   NotificationPriority,
-  NotificationType,
   NotifyInput,
 } from "@edr/types";
 import { Injectable, Logger } from "@nestjs/common";
@@ -106,31 +104,6 @@ export class NotificationInboxService {
     return { updated, unreadCount };
   }
 
-  /** [dev/verification only] Send a canned notification straight to one user. */
-  async sendTestToUser(
-    userId: string,
-    body: {
-      audience?: NotificationAudience;
-      type?: NotificationType;
-      priority?: NotificationPriority;
-      title?: string;
-      message?: string;
-    },
-  ): Promise<NotificationDto> {
-    const entity = await this.repo.create({
-      recipientUserId: userId,
-      audience: body.audience ?? NotificationAudience.BACKOFFICE,
-      type: body.type ?? NotificationType.GENERIC,
-      title: body.title ?? "Test notification",
-      body: body.message ?? "This is a test in-app notification.",
-      priority: body.priority ?? NotificationPriority.NORMAL,
-      isRead: false,
-    });
-    const dto = this.toDto(entity);
-    this.gateway.emitNew(userId, dto, await this.repo.countUnread(userId));
-    return dto;
-  }
-
   private async deliverToUser(
     userId: string,
     input: NotifyInput,
diff --git a/apps/edr-freight-api/src/modules/overview/overview.controller.ts b/apps/edr-freight-api/src/modules/overview/overview.controller.ts
index 661350f49..45c5cbfed 100644
--- a/apps/edr-freight-api/src/modules/overview/overview.controller.ts
+++ b/apps/edr-freight-api/src/modules/overview/overview.controller.ts
@@ -8,7 +8,8 @@ import {
 import { CurrentUser } from '@edr/api-common';
 import type { TCurrentUser } from '@tria-plc/api-common/modules/auth/types/current-user.type';
 
-import { BookingView } from '../../common/booking-guards';
+import { BookingStaff } from '../../common/booking-guards';
+import { FREIGHT_PERMS } from '../../seed/freight-permissions.registry';
 import { OverviewQueryDto } from './dto/overview-query.dto';
 import { OverviewResponseDto } from './dto/overview-response.dto';
 import {
@@ -32,7 +33,7 @@ export class OverviewController {
   ) {}
 
   @Get()
-  @BookingView()
+  @BookingStaff(FREIGHT_PERMS.overview.view)
   @ApiOperation({ summary: 'Aggregated dashboard summary for backoffice overview' })
   @ApiOkResponse({ type: OverviewResponseDto })
   async getDashboard(
@@ -48,7 +49,7 @@ export class OverviewController {
   }
 
   @Get('bookings')
-  @BookingView()
+  @BookingStaff(FREIGHT_PERMS.overview.view)
   @ApiOperation({ summary: 'Bookings tab metrics and charts' })
   @ApiOkResponse({ type: OverviewBookingsTabDto })
   async getBookingsTab(
@@ -64,7 +65,7 @@ export class OverviewController {
   }
 
   @Get('contracts')
-  @BookingView()
+  @BookingStaff(FREIGHT_PERMS.overview.view)
   @ApiOperation({ summary: 'Contracts tab metrics and charts' })
   @ApiOkResponse({ type: OverviewContractsTabDto })
   async getContractsTab(
@@ -80,7 +81,7 @@ export class OverviewController {
   }
 
   @Get('billing')
-  @BookingView()
+  @BookingStaff(FREIGHT_PERMS.overview.view)
   @ApiOperation({ summary: 'Billing tab metrics and charts' })
   @ApiOkResponse({ type: OverviewBillingTabDto })
   async getBillingTab(
@@ -96,7 +97,7 @@ export class OverviewController {
   }
 
   @Get('operations')
-  @BookingView()
+  @BookingStaff(FREIGHT_PERMS.overview.view)
   @ApiOperation({ summary: 'Operations tab metrics and charts' })
   @ApiOkResponse({ type: OverviewOperationsTabDto })
   getOperationsTab(
@@ -106,7 +107,7 @@ export class OverviewController {
   }
 
   @Get('customers')
-  @BookingView()
+  @BookingStaff(FREIGHT_PERMS.overview.view)
   @ApiOperation({ summary: 'Customers tab metrics and charts' })
   @ApiOkResponse({ type: OverviewCustomersTabDto })
   async getCustomersTab(
@@ -122,7 +123,7 @@ export class OverviewController {
   }
 
   @Get('staff')
-  @BookingView()
+  @BookingStaff(FREIGHT_PERMS.overview.view)
   @ApiOperation({ summary: 'Staff tab metrics and charts' })
   @ApiOkResponse({ type: OverviewStaffTabDto })
   getStaffTab(@Query() query: OverviewQueryDto): Promise<OverviewStaffTabDto> {
diff --git a/apps/edr-freight-api/src/modules/payment/internal-payment.dto.ts b/apps/edr-freight-api/src/modules/payment/internal-payment.dto.ts
index e69a0e15a..f437000bd 100644
--- a/apps/edr-freight-api/src/modules/payment/internal-payment.dto.ts
+++ b/apps/edr-freight-api/src/modules/payment/internal-payment.dto.ts
@@ -1,8 +1,8 @@
 import {
     IsEnum,
     IsIn,
-    IsInt,
     IsISO8601,
+    IsNumber,
     IsOptional,
     IsPositive,
     IsString,
@@ -37,7 +37,9 @@ export class PaymentEventDto {
     @ApiProperty() @IsString() referenceId!: string;
     @ApiProperty() @IsString() merchantOrderId!: string;
     @ApiProperty({ enum: ProviderMethod }) @IsEnum(ProviderMethod) provider!: string;
-    @ApiProperty() @IsInt() @IsPositive() amountMinor!: number;
+    // Major units, fractional (payment-api stores it as double precision) — an
+    // invoice of 12345.67 must not be rejected by an integer-only validator.
+    @ApiProperty() @IsNumber() @IsPositive() amountMinor!: number;
     @ApiProperty() @IsString() currency!: string;
 
     @ApiPropertyOptional() @IsOptional() @IsString() providerTxnId?: string;
diff --git a/apps/edr-freight-api/src/modules/payment/payment.controller.ts b/apps/edr-freight-api/src/modules/payment/payment.controller.ts
index b1dafbc85..2a651962b 100644
--- a/apps/edr-freight-api/src/modules/payment/payment.controller.ts
+++ b/apps/edr-freight-api/src/modules/payment/payment.controller.ts
@@ -18,7 +18,7 @@ import {
 import { Response } from "express";
 import { CurrentUser, Public } from "@edr/api-common";
 import type { TCurrentUser } from "@tria-plc/api-common/modules/auth/types/current-user.type";
-import { BookingStaff, BookingView } from "../../common/booking-guards";
+import { BookingStaff, MixedAudience, PortalCustomer } from "../../common/booking-guards";
 import { UserTradeAccessService } from "../user-trade-access/user-trade-access.service";
 import { FREIGHT_PERMS } from "../../seed/freight-permissions.registry";
 import { PaymentService } from "./payment.service";
@@ -43,14 +43,14 @@ export class PaymentController {
     }
 
     @Get("summary")
-    @BookingView()
+    @BookingStaff(FREIGHT_PERMS.payments.view)
     @ApiOperation({ summary: "Payment count/amount summary for dashboard cards" })
     getSummary() {
         return this.paymentService.getSummary();
     }
 
     @Get("all")
-    @BookingView()
+    @BookingStaff(FREIGHT_PERMS.payments.view)
     @ApiOperation({ summary: "Get all payments with filters (view-only, any staff)" })
     @ApiQuery({ name: "search", required: false })
     @ApiQuery({ name: "status", required: false })
@@ -79,6 +79,7 @@ export class PaymentController {
     }
 
     @Get("intents/:bookingId")
+    @MixedAudience(FREIGHT_PERMS.payments.view)
     @ApiOperation({ summary: "Get payment intent status for a booking" })
     @ApiOkResponse({ type: IntentStatusDto })
     getIntent(@Param("bookingId") bookingId: string) {
@@ -86,6 +87,7 @@ export class PaymentController {
     }
 
     @Post("redirect-success/:bookingId")
+    @PortalCustomer()
     @ApiOperation({
         summary:
             "Success-redirect ack: mark payment processing + invoice PAYMENT_PROCESSING (webhook remains source of truth)",
diff --git a/apps/edr-freight-api/src/modules/procurement/procurement.controller.ts b/apps/edr-freight-api/src/modules/procurement/procurement.controller.ts
index e5c69f37c..374b2bd53 100644
--- a/apps/edr-freight-api/src/modules/procurement/procurement.controller.ts
+++ b/apps/edr-freight-api/src/modules/procurement/procurement.controller.ts
@@ -1,5 +1,7 @@
 import { Controller, Post, Get, Patch, Delete, Body, Param, Query } from '@nestjs/common';
 import { ApiTags, ApiOperation } from '@nestjs/swagger';
+import { BookingStaff } from '../../common/booking-guards';
+import { FREIGHT_PERMS } from '../../seed/freight-permissions.registry';
 import { ProcurementService } from './procurement.service';
 import {
   CreateVendorDto,
@@ -11,11 +13,13 @@ import {
 
 @ApiTags('Procurement & Asset Lifecycle')
 @Controller('procurement')
+@BookingStaff(FREIGHT_PERMS.procurement.view)
 export class ProcurementController {
   constructor(private readonly procurementService: ProcurementService) {}
 
   // ---- Vendors ----
   @Post('vendors')
+  @BookingStaff(FREIGHT_PERMS.procurement.vendorManage)
   @ApiOperation({ summary: 'Create a vendor' })
   async createVendor(@Body() dto: CreateVendorDto) {
     return this.procurementService.createVendor(dto);
@@ -28,12 +32,14 @@ export class ProcurementController {
   }
 
   @Patch('vendors/:id')
+  @BookingStaff(FREIGHT_PERMS.procurement.vendorManage)
   @ApiOperation({ summary: 'Update a vendor' })
   async updateVendor(@Param('id') id: string, @Body() dto: UpdateVendorDto) {
     return this.procurementService.updateVendor(id, dto);
   }
 
   @Delete('vendors/:id')
+  @BookingStaff(FREIGHT_PERMS.procurement.vendorManage)
   @ApiOperation({ summary: 'Delete a vendor' })
   async deleteVendor(@Param('id') id: string) {
     return this.procurementService.deleteVendor(id);
@@ -41,6 +47,7 @@ export class ProcurementController {
 
   // ---- Acquisitions ----
   @Post('acquisitions')
+  @BookingStaff(FREIGHT_PERMS.procurement.acquisitionManage)
   @ApiOperation({ summary: 'Create an asset acquisition' })
   async createAcquisition(@Body() dto: CreateAcquisitionDto) {
     return this.procurementService.createAcquisition(dto);
@@ -59,12 +66,14 @@ export class ProcurementController {
   }
 
   @Patch('acquisitions/:id')
+  @BookingStaff(FREIGHT_PERMS.procurement.acquisitionManage)
   @ApiOperation({ summary: 'Update an asset acquisition' })
   async updateAcquisition(@Param('id') id: string, @Body() dto: UpdateAcquisitionDto) {
     return this.procurementService.updateAcquisition(id, dto);
   }
 
   @Delete('acquisitions/:id')
+  @BookingStaff(FREIGHT_PERMS.procurement.acquisitionManage)
   @ApiOperation({ summary: 'Delete an asset acquisition' })
   async deleteAcquisition(@Param('id') id: string) {
     return this.procurementService.deleteAcquisition(id);
@@ -72,6 +81,7 @@ export class ProcurementController {
 
   // ---- Disposals ----
   @Post('disposals')
+  @BookingStaff(FREIGHT_PERMS.procurement.disposalManage)
   @ApiOperation({ summary: 'Create an asset disposal' })
   async createDisposal(@Body() dto: CreateDisposalDto) {
     return this.procurementService.createDisposal(dto);
@@ -84,6 +94,7 @@ export class ProcurementController {
   }
 
   @Delete('disposals/:id')
+  @BookingStaff(FREIGHT_PERMS.procurement.disposalManage)
   @ApiOperation({ summary: 'Delete an asset disposal' })
   async deleteDisposal(@Param('id') id: string) {
     return this.procurementService.deleteDisposal(id);
diff --git a/apps/edr-freight-api/src/modules/reports/reports.controller.ts b/apps/edr-freight-api/src/modules/reports/reports.controller.ts
index bc2671680..dc64773d8 100644
--- a/apps/edr-freight-api/src/modules/reports/reports.controller.ts
+++ b/apps/edr-freight-api/src/modules/reports/reports.controller.ts
@@ -3,7 +3,8 @@ import { ApiBearerAuth, ApiOkResponse, ApiOperation, ApiTags } from '@nestjs/swa
 import { CurrentUser } from '@edr/api-common';
 import type { TCurrentUser } from '@tria-plc/api-common/modules/auth/types/current-user.type';
 
-import { BookingView } from '../../common/booking-guards';
+import { BookingStaff } from '../../common/booking-guards';
+import { FREIGHT_PERMS } from '../../seed/freight-permissions.registry';
 import { UserTradeAccessService } from '../user-trade-access/user-trade-access.service';
 import { ReportQueryDto } from './dto/report-query.dto';
 import { ReportResultDto } from './dto/report-result.dto';
@@ -19,7 +20,7 @@ export class ReportsController {
   ) {}
 
   @Get(':key')
-  @BookingView()
+  @BookingStaff(FREIGHT_PERMS.reports.view)
   @ApiOperation({ summary: 'Run a canned report by key with optional filters' })
   @ApiOkResponse({ type: ReportResultDto })
   async run(
diff --git a/apps/edr-freight-api/src/modules/rule-engine/controllers/rates.controller.ts b/apps/edr-freight-api/src/modules/rule-engine/controllers/rates.controller.ts
index f10c0afab..7321ddf23 100644
--- a/apps/edr-freight-api/src/modules/rule-engine/controllers/rates.controller.ts
+++ b/apps/edr-freight-api/src/modules/rule-engine/controllers/rates.controller.ts
@@ -5,7 +5,7 @@ import {
 import { ApiBearerAuth, ApiOperation, ApiTags } from '@nestjs/swagger';
 import { CurrentUser } from '@edr/api-common';
 import type { TCurrentUser } from '@tria-plc/api-common/modules/auth/types/current-user.type';
-import { RuleEngineCreate, RuleEngineDelete, RuleEngineUpdate, RuleEngineView } from '../../../common/rule-engine-guards';
+import { RuleEngineApprove, RuleEngineCreate, RuleEngineDelete, RuleEngineUpdate, RuleEngineView } from '../../../common/rule-engine-guards';
 import { isSuperAdmin } from '../../../common/freight-permission.util';
 import { CreateRateDto } from '../dto/create-rate.dto';
 import { ListRatesQueryDto } from '../dto/list-rule-engine-query.dto';
@@ -68,7 +68,7 @@ export class RatesController {
   }
 
   @Post(':id/approve')
-  @RuleEngineUpdate('rates')
+  @RuleEngineApprove('rates')
   @ApiOperation({ summary: 'CEO approves a rate' })
   approve(
     @Param('id', ParseUUIDPipe) id: string,
diff --git a/apps/edr-freight-api/src/modules/rule-engine/repositories/yards.repository.ts b/apps/edr-freight-api/src/modules/rule-engine/repositories/yards.repository.ts
index 5db5b72ae..b99b33a29 100644
--- a/apps/edr-freight-api/src/modules/rule-engine/repositories/yards.repository.ts
+++ b/apps/edr-freight-api/src/modules/rule-engine/repositories/yards.repository.ts
@@ -43,6 +43,12 @@ export class YardsRepository implements IYardsRepository {
   findPaged(query: ListYardsQueryDto): Promise<PaginatedResponse<Yard>> {
     const qb = this.repo
       .createQueryBuilder('yard')
+      // createQueryBuilder does NOT auto-apply the soft-delete filter that
+      // repo.find()/findOne() get for free — without this, a renamed/replaced
+      // yard (e.g. an old "DMP" superseded by a new one) still shows up
+      // alongside the live one in every picker built off this endpoint, and a
+      // route picked against the dead yard id never matches any LIVE rate.
+      .where('yard.deleted_at IS NULL')
       .orderBy(`yard.${query.sortBy ?? 'displayOrder'}`, query.sortOrder ?? 'ASC')
       .addOrderBy('yard.label', 'ASC');
 
diff --git a/apps/edr-freight-api/src/modules/rule-engine/services/rates.service.ts b/apps/edr-freight-api/src/modules/rule-engine/services/rates.service.ts
index 5645334e5..971097377 100644
--- a/apps/edr-freight-api/src/modules/rule-engine/services/rates.service.ts
+++ b/apps/edr-freight-api/src/modules/rule-engine/services/rates.service.ts
@@ -7,7 +7,7 @@ import {
   NotFoundException,
 } from '@nestjs/common';
 import { PaginatedResponse, YardCountry } from '@edr/types';
-import { Not } from 'typeorm';
+import { IsNull, Not } from 'typeorm';
 import { CreateRateDto } from '../dto/create-rate.dto';
 import { ListRatesQueryDto } from '../dto/list-rule-engine-query.dto';
 import { UpdateRateDto } from '../dto/update-rate.dto';
@@ -344,11 +344,12 @@ export class RatesService {
   /**
    * Validate and normalise the last-mile band fields for a rate shape.
    *
-   * Last-mile rates come in two calculation modes: bulk (PER_TON_KM — price =
-   * tons × km × rate, one row, no scope) and container (PER_KM — one row per
-   * container type per distance band, price = km × rate × quantity). Every
-   * other rate shape has its band fields cleared, mirroring how yard scope is
-   * cleared for non-route rates.
+   * Last-mile rates come in two calculation modes: bulk (PER_TON_KM — one row
+   * per distance band, price = tons × km × rate) and container (PER_KM — one
+   * row per container type per distance band, price = km × rate × quantity).
+   * A bandless bulk row (NULL minKm) is the legacy pre-band shape and still
+   * prices every distance. Every other rate shape has its band fields cleared,
+   * mirroring how yard scope is cleared for non-route rates.
    */
   private resolveLastMileBand(input: {
     appliesTo: Rate['appliesTo'];
@@ -366,7 +367,21 @@ export class RatesService {
           'A bulk last-mile rate (per ton per km) cannot be scoped to a container type.',
         );
       }
-      return { minKm: null, maxKm: null };
+      const minKm = input.minKm ?? null;
+      const maxKm = input.maxKm ?? null;
+      if (minKm === null) {
+        if (maxKm !== null) {
+          throw new BadRequestException(
+            '"To km" needs a "From km" — set the band start (0 for the first tier).',
+          );
+        }
+        // Legacy bandless bulk rate — prices every distance.
+        return { minKm: null, maxKm: null };
+      }
+      if (maxKm !== null && maxKm <= minKm) {
+        throw new BadRequestException('"To km" must be greater than "From km".');
+      }
+      return { minKm, maxKm };
     }
 
     if (rateUnit === 'PER_KM') {
@@ -393,14 +408,16 @@ export class RatesService {
   }
 
   /**
-   * Reject a container last-mile band that overlaps an existing band for the
-   * same container type. Bands are half-open [minKm, maxKm) with NULL maxKm =
-   * open-ended, so 0–30 and 30–∞ tile cleanly. Checked across every
-   * non-superseded row (DRAFT included) — two drafts with colliding bands would
-   * only defer the conflict to approval.
+   * Reject a last-mile band that overlaps an existing band for the same scope —
+   * container bands collide per container type (PER_KM), bulk bands collide
+   * with each other (PER_TON_KM, no container scope). Bands are half-open
+   * [minKm, maxKm) with NULL maxKm = open-ended, so 0–30 and 30–∞ tile
+   * cleanly. Checked across every non-superseded row (DRAFT included) — two
+   * drafts with colliding bands would only defer the conflict to approval.
    */
   private async assertNoBandOverlap(input: {
-    containerTypeId: string;
+    rateUnit: 'PER_KM' | 'PER_TON_KM';
+    containerTypeId: string | null;
     minKm: number;
     maxKm: number | null;
     ignoreId?: string;
@@ -408,8 +425,8 @@ export class RatesService {
     const siblings = await this.repository.findAll({
       where: {
         rateType: 'LAST_MILE',
-        rateUnit: 'PER_KM',
-        containerTypeId: input.containerTypeId,
+        rateUnit: input.rateUnit,
+        containerTypeId: input.containerTypeId ?? IsNull(),
         status: Not('SUPERSEDED'),
       },
     });
@@ -425,7 +442,7 @@ export class RatesService {
       if (input.minKm < sibMax && sibMin < newMax) {
         const sibLabel = `${sibMin}–${sibMax === Number.POSITIVE_INFINITY ? 'open' : sibMax} km`;
         throw new ConflictException(
-          `This distance band overlaps the existing ${sibLabel} band for this container type. Adjust the ranges so each distance falls in exactly one band.`,
+          `This distance band overlaps the existing ${sibLabel} band for ${input.rateUnit === 'PER_TON_KM' ? 'bulk last-mile' : 'this container type'}. Adjust the ranges so each distance falls in exactly one band.`,
         );
       }
     }
@@ -538,8 +555,12 @@ export class RatesService {
       minKm: dto.minKm,
       maxKm: dto.maxKm,
     });
-    if (appliesTo === 'LAST_MILE' && rateUnit === 'PER_KM' && containerTypeId && minKm !== null) {
-      await this.assertNoBandOverlap({ containerTypeId, minKm, maxKm });
+    if (
+      appliesTo === 'LAST_MILE' &&
+      (rateUnit === 'PER_KM' || rateUnit === 'PER_TON_KM') &&
+      minKm !== null
+    ) {
+      await this.assertNoBandOverlap({ rateUnit, containerTypeId, minKm, maxKm });
     }
 
     await this.assertNoDuplicatePattern({
@@ -742,12 +763,12 @@ export class RatesService {
     updates.maxKm = maxKm;
     if (
       appliesTo === 'LAST_MILE' &&
-      rateUnit === 'PER_KM' &&
-      updates.containerTypeId &&
+      (rateUnit === 'PER_KM' || rateUnit === 'PER_TON_KM') &&
       minKm !== null
     ) {
       await this.assertNoBandOverlap({
-        containerTypeId: updates.containerTypeId,
+        rateUnit,
+        containerTypeId: updates.containerTypeId ?? null,
         minKm,
         maxKm,
         ignoreId: id,
diff --git a/apps/edr-freight-api/src/modules/support-chat/support-attachment.controller.ts b/apps/edr-freight-api/src/modules/support-chat/support-attachment.controller.ts
index be7c78fdc..91d4a8e2c 100644
--- a/apps/edr-freight-api/src/modules/support-chat/support-attachment.controller.ts
+++ b/apps/edr-freight-api/src/modules/support-chat/support-attachment.controller.ts
@@ -18,10 +18,12 @@ import {
 } from "@nestjs/swagger";
 import { Response } from "express";
 
+import { MixedAudience } from "../../common/booking-guards";
 import {
   AuthUserPayload,
   resolveAuthUserId,
 } from "../../common/resolve-auth-user-id";
+import { FREIGHT_PERMS } from "../../seed/freight-permissions.registry";
 import { FilesService } from "../files/files.service";
 import { SupportChatService } from "./support-chat.service";
 
@@ -48,6 +50,7 @@ export class SupportAttachmentController {
   ) {}
 
   @Get(":fileId")
+  @MixedAudience(FREIGHT_PERMS.support.agentView)
   @ApiOperation({
     summary: "Download a support chat attachment",
     description:
diff --git a/apps/edr-freight-api/src/modules/support-chat/support-chat-agent.controller.ts b/apps/edr-freight-api/src/modules/support-chat/support-chat-agent.controller.ts
index 06fe9b2a9..8b8dbee1b 100644
--- a/apps/edr-freight-api/src/modules/support-chat/support-chat-agent.controller.ts
+++ b/apps/edr-freight-api/src/modules/support-chat/support-chat-agent.controller.ts
@@ -17,10 +17,12 @@ import {
 import { FilesInterceptor } from "@nestjs/platform-express";
 import { ApiBody, ApiConsumes, ApiOperation, ApiTags } from "@nestjs/swagger";
 
+import { BookingStaff } from "../../common/booking-guards";
 import {
   AuthUserPayload,
   resolveAuthUserId,
 } from "../../common/resolve-auth-user-id";
+import { FREIGHT_PERMS } from "../../seed/freight-permissions.registry";
 import {
   SUPPORT_ATTACHMENT_FIELD,
   supportAttachmentMulterOptions,
@@ -38,12 +40,14 @@ export class SupportChatAgentController {
   constructor(private readonly service: SupportChatService) {}
 
   @Get("conversations")
+  @BookingStaff(FREIGHT_PERMS.support.agentView)
   @ApiOperation({ summary: "List all support threads (shared inbox)" })
   list(@Query() query: ListConversationsQueryDto) {
     return this.service.listForAgents(query);
   }
 
   @Post("conversations")
+  @BookingStaff(FREIGHT_PERMS.support.agentSend)
   @ApiOperation({
     summary: "Start chatting with a company (returns the thread if one exists)",
   })
@@ -52,6 +56,7 @@ export class SupportChatAgentController {
   }
 
   @Get("conversations/:id/messages")
+  @BookingStaff(FREIGHT_PERMS.support.agentView)
   @ApiOperation({
     summary: "List messages in a thread (newest page first)",
     description:
@@ -67,6 +72,7 @@ export class SupportChatAgentController {
   }
 
   @Post("conversations/:id/messages")
+  @BookingStaff(FREIGHT_PERMS.support.agentSend)
   @UseInterceptors(
     FilesInterceptor(
       SUPPORT_ATTACHMENT_FIELD,
@@ -106,6 +112,7 @@ export class SupportChatAgentController {
   }
 
   @Post("conversations/:id/read")
+  @BookingStaff(FREIGHT_PERMS.support.agentView)
   @ApiOperation({ summary: "Mark a thread read (agent side)" })
   read(
     @CurrentUser() user: AuthUserPayload,
@@ -115,6 +122,7 @@ export class SupportChatAgentController {
   }
 
   @Get("unread-count")
+  @BookingStaff(FREIGHT_PERMS.support.agentView)
   @ApiOperation({ summary: "Count unread threads (agent side)" })
   unread(@CurrentUser() user: AuthUserPayload) {
     return this.service.unreadCount(
diff --git a/apps/edr-freight-api/src/modules/support-chat/support-chat.controller.ts b/apps/edr-freight-api/src/modules/support-chat/support-chat.controller.ts
index 88686bfa8..9201cf450 100644
--- a/apps/edr-freight-api/src/modules/support-chat/support-chat.controller.ts
+++ b/apps/edr-freight-api/src/modules/support-chat/support-chat.controller.ts
@@ -23,6 +23,7 @@ import {
   SUPPORT_ATTACHMENT_FIELD,
   supportAttachmentMulterOptions,
 } from "./attachment-upload.options";
+import { PortalCustomer } from "../../common/booking-guards";
 import { ListMessagesQueryDto } from "./dto/list-messages-query.dto";
 import { SendMessageDto } from "./dto/send-message.dto";
 import { SupportChatService } from "./support-chat.service";
@@ -34,6 +35,7 @@ import { SupportChatService } from "./support-chat.service";
  */
 @ApiTags("support-chat")
 @Controller("support")
+@PortalCustomer()
 export class SupportChatController {
   constructor(private readonly service: SupportChatService) {}
 
diff --git a/apps/edr-freight-api/src/modules/train-scheduling/booking-batch.constants.ts b/apps/edr-freight-api/src/modules/train-scheduling/booking-batch.constants.ts
index 45370f546..b7b907e5b 100644
--- a/apps/edr-freight-api/src/modules/train-scheduling/booking-batch.constants.ts
+++ b/apps/edr-freight-api/src/modules/train-scheduling/booking-batch.constants.ts
@@ -31,6 +31,19 @@ export function paymentDrainMs(): number {
   );
 }
 
+/**
+ * ISO timestamp of the end of a pay window's drain tail, for client display
+ * (the "payment processing" countdown). Null in ⇒ null out.
+ */
+export function paymentDrainEndsAtIso(
+  deadline: Date | string | null | undefined,
+): string | null {
+  if (deadline == null) return null;
+  const ms = new Date(deadline).getTime();
+  if (!Number.isFinite(ms)) return null;
+  return new Date(ms + paymentDrainMs()).toISOString();
+}
+
 /**
  * A pay window AND its drain tail have closed.
  *
diff --git a/apps/edr-freight-api/src/modules/train-scheduling/booking-window.gateway.ts b/apps/edr-freight-api/src/modules/train-scheduling/booking-window.gateway.ts
index 69e60dd3a..dbf0cae96 100644
--- a/apps/edr-freight-api/src/modules/train-scheduling/booking-window.gateway.ts
+++ b/apps/edr-freight-api/src/modules/train-scheduling/booking-window.gateway.ts
@@ -14,6 +14,7 @@ import { Server, Socket } from 'socket.io';
 
 import { WsAuthService } from '../notification-inbox/ws-auth.service';
 import { TrainSchedule } from '../train-schedules/entities/train-schedule.entity';
+import { paymentDrainEndsAtIso } from './booking-batch.constants';
 
 /**
  * Server → client push for booking-window state changes. Same handshake model
@@ -61,6 +62,7 @@ export class BookingWindowGateway implements OnGatewayConnection {
       windowClosesAt: schedule.windowClosesAt?.toISOString() ?? null,
       docReviewEndsAt: schedule.docReviewEndsAt?.toISOString() ?? null,
       paymentPhaseEndsAt: schedule.paymentPhaseEndsAt?.toISOString() ?? null,
+      paymentDrainEndsAt: paymentDrainEndsAtIso(schedule.paymentPhaseEndsAt),
       scheduledDepartureDate: schedule.scheduledDepartureDate?.toISOString() ?? null,
     };
     this.server.emit(BOOKING_WINDOW_WS_EVENTS.PHASE, payload);
diff --git a/apps/edr-freight-api/src/modules/train-scheduling/pay-window-drain.spec.ts b/apps/edr-freight-api/src/modules/train-scheduling/pay-window-drain.spec.ts
index 6054f28b2..bde0e88ec 100644
--- a/apps/edr-freight-api/src/modules/train-scheduling/pay-window-drain.spec.ts
+++ b/apps/edr-freight-api/src/modules/train-scheduling/pay-window-drain.spec.ts
@@ -1,5 +1,6 @@
 import {
   DEFAULT_PAYMENT_DRAIN_MINUTES,
+  paymentDrainEndsAtIso,
   paymentDrainMs,
   payWindowLapsed,
 } from "./booking-batch.constants";
@@ -64,4 +65,16 @@ describe("payWindowLapsed — pay-window drain tail", () => {
       expect(paymentDrainMs()).toBe(DEFAULT_PAYMENT_DRAIN_MINUTES * MIN);
     }
   });
+
+  it("paymentDrainEndsAtIso reports deadline + drain, null/garbage-safe", () => {
+    expect(paymentDrainEndsAtIso(deadline)).toBe(
+      new Date(at(DEFAULT_PAYMENT_DRAIN_MINUTES * MIN)).toISOString(),
+    );
+    expect(paymentDrainEndsAtIso(deadline.toISOString())).toBe(
+      new Date(at(DEFAULT_PAYMENT_DRAIN_MINUTES * MIN)).toISOString(),
+    );
+    expect(paymentDrainEndsAtIso(null)).toBeNull();
+    expect(paymentDrainEndsAtIso(undefined)).toBeNull();
+    expect(paymentDrainEndsAtIso("not-a-date")).toBeNull();
+  });
 });
diff --git a/apps/edr-freight-api/src/modules/train-scheduling/train-scheduling.controller.ts b/apps/edr-freight-api/src/modules/train-scheduling/train-scheduling.controller.ts
index 742bd2837..2c92ba00d 100644
--- a/apps/edr-freight-api/src/modules/train-scheduling/train-scheduling.controller.ts
+++ b/apps/edr-freight-api/src/modules/train-scheduling/train-scheduling.controller.ts
@@ -10,6 +10,9 @@ import {
 import { CurrentUser } from "@edr/api-common";
 import {
   BookingDocReviewAlert,
+  BookingStaff,
+  MixedAudience,
+  PortalCustomer,
   TrainSchedulingCancel,
   TrainSchedulingCreate,
   TrainSchedulingReschedule,
@@ -17,6 +20,7 @@ import {
   TrainSchedulingUpdate,
   TrainSchedulingView,
 } from "../../common/booking-guards";
+import { FREIGHT_PERMS } from "../../seed/freight-permissions.registry";
 import { AcceptIntercityBookingsDto } from "./dto/accept-intercity-bookings.dto";
 import { AssignBookingsDto } from "./dto/assign-bookings.dto";
 import { AssignUnassignedBookingDto } from "./dto/assign-unassigned-booking.dto";
@@ -71,6 +75,7 @@ export class TrainSchedulingController {
   ) { }
 
   @Get("my-booking-windows")
+  @PortalCustomer()
   @ApiOperation({
     summary:
       "Upcoming/open booking windows announced to the signed-in customer (all window-engine schedules; their own contract lanes carry a Book-now target)",
@@ -85,6 +90,10 @@ export class TrainSchedulingController {
   }
 
   @Get("contracts/:contractId/booking-windows")
+  @MixedAudience([
+    FREIGHT_PERMS.trainScheduling.view,
+    FREIGHT_PERMS.contracts.createBooking,
+  ])
   @ApiOperation({
     summary:
       "Upcoming/open booking windows on a contract's routes — gates the booking form for customer + Ethiopian GL",
@@ -496,14 +505,14 @@ export class TrainSchedulingController {
   }
 
   @Post("schedules/:id/finalize")
-  @TrainSchedulingUpdate()
+  @BookingStaff(FREIGHT_PERMS.trainScheduling.dispatch)
   @ApiOperation({ summary: "Finalize a draft train schedule" })
   finalizeSchedule(@Param("id", ParseUUIDPipe) id: string) {
     return this.trainSchedulingService.finalizeSchedule(id);
   }
 
   @Post("schedules/:id/dispatch")
-  @TrainSchedulingUpdate()
+  @BookingStaff(FREIGHT_PERMS.trainScheduling.dispatch)
   @ApiOperation({ summary: "Dispatch a scheduled train" })
   dispatchSchedule(@Param("id", ParseUUIDPipe) id: string) {
     return this.trainSchedulingService.dispatchSchedule(id);
@@ -824,7 +833,7 @@ export class TrainSchedulingController {
   }
 
   @Post("bookings/:bookingId/mark-paid")
-  @TrainSchedulingUpdate()
+  @BookingStaff(FREIGHT_PERMS.trainScheduling.markPaid)
   @ApiOperation({
     summary: "Staff: mark a reserved booking paid and allocate it now",
   })
@@ -834,7 +843,7 @@ export class TrainSchedulingController {
   }
 
   @Post("bookings/:bookingId/expire")
-  @TrainSchedulingUpdate()
+  @BookingStaff(FREIGHT_PERMS.trainScheduling.expireBooking)
   @ApiOperation({
     summary: "Staff: expire a reservation and free its capacity",
   })
diff --git a/apps/edr-freight-api/src/modules/train-scheduling/train-scheduling.service.ts b/apps/edr-freight-api/src/modules/train-scheduling/train-scheduling.service.ts
index df5c44fde..9a03f665c 100644
--- a/apps/edr-freight-api/src/modules/train-scheduling/train-scheduling.service.ts
+++ b/apps/edr-freight-api/src/modules/train-scheduling/train-scheduling.service.ts
@@ -153,6 +153,7 @@ import {
   DEFAULT_CONTAINER_WAGON_CAPACITY_TONS,
   DEFAULT_CONTAINER_WAGON_LENGTH_METERS,
   DEFAULT_CONTAINER_WAGON_TARE_TONS,
+  paymentDrainEndsAtIso,
 } from './booking-batch.constants';
 import { orderConsistWagons } from './consist-order.util';
 import {
@@ -1546,23 +1547,10 @@ export class TrainSchedulingService {
           }
         : globalCfg;
 
-      // Staff cannot schedule inside the lead window — there must be room for a
-      // booking window before departure. IMPORT/DOMESTIC lead is in whole EAT
-      // days (lead 3, today 11th → first allowed departure is the 14th); EXPORT
-      // lead is in hours (24h = 1 day ahead). Checked against the schedule's OWN
-      // lead, so a custom lead is honoured rather than rejected by the global one.
-      const earliest = earliestSchedulableDeparture(direction, windowCfg, new Date());
-      if (departure.getTime() < earliest.getTime()) {
-        const detail =
-          direction === 'EXPORT'
-            ? `at least ${windowCfg.exportBookingLeadHours} hour(s) ahead`
-            : `at least ${windowCfg.importWindowLeadDays} day(s) ahead`;
-        throw new BadRequestException(
-          `Departure ${departure.toISOString()} is inside the booking lead window; ` +
-            `${direction === 'EXPORT' ? 'export' : 'import'} trains must be scheduled ${detail} ` +
-            `(earliest ${earliest.toISOString()})`,
-        );
-      }
+      // Short-notice trains are allowed: a departure inside the booking lead
+      // window is NOT rejected — the window just opens immediately (opensAt is
+      // clamped to `now` below) instead of waiting out a lead that has already
+      // passed. Only `updateScheduleDate` still enforces the lead floor.
 
       // Freeze the rule this schedule is born with. A later global-rules edit
       // only re-derives NOT-YET-OPEN schedules (see restampPendingWindows); an
@@ -1577,6 +1565,11 @@ export class TrainSchedulingService {
               ...ruleSnapshot,
               ...computeImportWindowTimes(departure, windowCfg, new Date()),
             };
+      // Inside-lead departure (e.g. a huge configured lead): the raw open lands
+      // in the past — clamp it to `now` so the window tick opens it immediately.
+      if (computedTimes.windowOpensAt.getTime() < Date.now()) {
+        computedTimes.windowOpensAt = new Date();
+      }
       if (
         computedTimes.windowOpensAt.getTime() >= computedTimes.windowClosesAt.getTime()
       ) {
@@ -6948,6 +6941,7 @@ export class TrainSchedulingService {
       windowClosesAt: r.window_closes_at,
       docReviewEndsAt: r.doc_review_ends_at,
       paymentPhaseEndsAt: r.payment_phase_ends_at,
+      paymentDrainEndsAt: paymentDrainEndsAtIso(r.payment_phase_ends_at),
       bookingWindowStatus: r.booking_window_status,
       bookingCycleNo: r.booking_cycle_no,
       departureDate: r.scheduled_departure_date,
diff --git a/apps/edr-freight-api/src/modules/user-trade-access/user-trade-access.controller.ts b/apps/edr-freight-api/src/modules/user-trade-access/user-trade-access.controller.ts
index 3c6255fd9..5c63b96f9 100644
--- a/apps/edr-freight-api/src/modules/user-trade-access/user-trade-access.controller.ts
+++ b/apps/edr-freight-api/src/modules/user-trade-access/user-trade-access.controller.ts
@@ -11,8 +11,9 @@ import { ApiBearerAuth, ApiOperation, ApiTags } from '@nestjs/swagger';
 import { CurrentUser } from '@edr/api-common';
 import type { TCurrentUser } from '@tria-plc/api-common/modules/auth/types/current-user.type';
 
-import { StaffReference } from '../../common/booking-guards';
+import { BookingStaff, StaffReference } from '../../common/booking-guards';
 import { isFreightApprovalAdmin } from '../../common/freight-permission.util';
+import { FREIGHT_PERMS } from '../../seed/freight-permissions.registry';
 import { UpsertUserTradeAccessDto } from './dto/upsert-user-trade-access.dto';
 import { UserTradeAccessService } from './user-trade-access.service';
 
@@ -24,6 +25,7 @@ export class UserTradeAccessController {
   constructor(private readonly service: UserTradeAccessService) {}
 
   @Get()
+  @BookingStaff(FREIGHT_PERMS.tradeAccess.view)
   @ApiOperation({ summary: 'List every configured user trade-direction scope' })
   list(@CurrentUser() user: TCurrentUser) {
     this.assertAdmin(user);
@@ -41,6 +43,7 @@ export class UserTradeAccessController {
   }
 
   @Put(':userId')
+  @BookingStaff(FREIGHT_PERMS.tradeAccess.manage)
   @ApiOperation({
     summary: 'Set the trade directions a backoffice user may see',
   })
diff --git a/apps/edr-freight-api/src/modules/wagons/wagon-transfer-requests.controller.ts b/apps/edr-freight-api/src/modules/wagons/wagon-transfer-requests.controller.ts
index 9e69c3bf6..5525132a3 100644
--- a/apps/edr-freight-api/src/modules/wagons/wagon-transfer-requests.controller.ts
+++ b/apps/edr-freight-api/src/modules/wagons/wagon-transfer-requests.controller.ts
@@ -41,7 +41,9 @@ const toInt = (value?: string): number | undefined => {
  */
 @ApiTags('wagon-transfer-requests')
 @Controller('wagon-transfer-requests')
-@WagonTransferView()
+// No class-level key: Nest stacks class and method guards, so a class-level
+// `transfer_view` would AND with every action key below and lock out the OCC
+// staff granted only `transfer_fulfill`. Reads carry the view key themselves.
 export class WagonTransferRequestsController {
   constructor(private readonly service: WagonTransferRequestsService) {}
 
@@ -56,6 +58,7 @@ export class WagonTransferRequestsController {
   }
 
   @Get()
+  @WagonTransferView()
   @ApiOperation({
     summary:
       'Transfer desk list — paginated, filterable by status (comma-separated), yards and wagon type',
@@ -84,6 +87,7 @@ export class WagonTransferRequestsController {
   // matches in declaration order, so `/history` would otherwise be captured by
   // the `:id` param route (and rejected by ParseUUIDPipe).
   @Get('history')
+  @WagonTransferView()
   @ApiQuery({ name: 'page', required: false })
   @ApiQuery({ name: 'pageSize', required: false })
   @ApiOperation({
@@ -129,6 +133,7 @@ export class WagonTransferRequestsController {
   }
 
   @Get(':id')
+  @WagonTransferView()
   @ApiOperation({ summary: 'Get one transfer request' })
   findOne(@Param('id', ParseUUIDPipe) id: string) {
     return this.service.findById(id);
diff --git a/apps/edr-freight-api/src/modules/wagons/wagons.controller.ts b/apps/edr-freight-api/src/modules/wagons/wagons.controller.ts
index f90e9ca32..19c0bda8f 100644
--- a/apps/edr-freight-api/src/modules/wagons/wagons.controller.ts
+++ b/apps/edr-freight-api/src/modules/wagons/wagons.controller.ts
@@ -17,7 +17,7 @@ import type { TCurrentUser } from '@tria-plc/api-common/modules/auth/types/curre
 import {
   BookingStaff,
   FleetManage,
-  StaffReference,
+  FleetView,
 } from '../../common/booking-guards';
 import { FREIGHT_PERMS } from '../../seed/freight-permissions.registry';
 import { CreateWagonDto } from './dto/create-wagon.dto';
@@ -44,7 +44,7 @@ export class WagonsController {
   }
 
   @Get()
-  @StaffReference()
+  @FleetView(FREIGHT_PERMS.wagons.view)
   @ApiOperation({
     summary: 'List wagons, paginated ({items, meta}) — 10 per page by default',
   })
@@ -53,14 +53,14 @@ export class WagonsController {
   }
 
   @Get(':id')
-  @StaffReference()
+  @FleetView(FREIGHT_PERMS.wagons.view)
   @ApiOperation({ summary: 'Get a wagon by ID' })
   findOne(@Param('id', ParseUUIDPipe) id: string) {
     return this.wagonsService.findById(id);
   }
 
   @Get(':id/movements')
-  @StaffReference()
+  @FleetView(FREIGHT_PERMS.wagons.view)
   @ApiOperation({
     summary: "Wagon movement ledger (loaded legs, empty repositions, manual moves), newest first",
   })
diff --git a/apps/edr-freight-api/src/modules/warehouses/warehouse-inventory.controller.ts b/apps/edr-freight-api/src/modules/warehouses/warehouse-inventory.controller.ts
index b78d6f6f9..459b5009e 100644
--- a/apps/edr-freight-api/src/modules/warehouses/warehouse-inventory.controller.ts
+++ b/apps/edr-freight-api/src/modules/warehouses/warehouse-inventory.controller.ts
@@ -5,7 +5,7 @@ import { CurrentUser } from '@edr/api-common';
 import type { TCurrentUser } from '@tria-plc/api-common/modules/auth/types/current-user.type';
 
 import { actorLabel } from './current-actor.util';
-import { BookingStaff, StaffReference } from '../../common/booking-guards';
+import { BookingStaff, MixedAudience } from '../../common/booking-guards';
 import { FREIGHT_PERMS } from '../../seed/freight-permissions.registry';
 import { BulkReceiveDto } from './dto/bulk-receive.dto';
 import { BulkInspectDto } from './dto/bulk-inspect.dto';
@@ -457,7 +457,7 @@ export class WarehouseInventoryController {
   }
 
   @Get(':id/handover-document')
-  @StaffReference()
+  @MixedAudience(FREIGHT_PERMS.warehouseInventory.view)
   @ApiOperation({ summary: 'View import goods handover document PDF' })
   async handoverDocument(@Param('id', ParseUUIDPipe) id: string, @Res() res: Response) {
     const { filename, buffer } = await this.inventoryService.handoverDocument(id);
@@ -468,7 +468,7 @@ export class WarehouseInventoryController {
   }
 
   @Post('bookings/:bookingId/approve-delivery')
-  @StaffReference()
+  @MixedAudience(FREIGHT_PERMS.warehouseInventory.deliver)
   @ApiOperation({ summary: "Approve delivery — customer records their full name (signature optional)" })
   approveDeliveryForBooking(
     @Param('bookingId', ParseUUIDPipe) bookingId: string,
@@ -484,14 +484,14 @@ export class WarehouseInventoryController {
   }
 
   @Get('bookings/:bookingId/handovers')
-  @StaffReference()
+  @MixedAudience(FREIGHT_PERMS.warehouseInventory.view)
   @ApiOperation({ summary: 'Handover records for a booking (per-booking or per-truck)' })
   bookingHandovers(@Param('bookingId', ParseUUIDPipe) bookingId: string) {
     return this.handoverService.list(bookingId);
   }
 
   @Post('handovers/:handoverId/sign')
-  @StaffReference()
+  @MixedAudience(FREIGHT_PERMS.warehouseInventory.deliver)
   @ApiOperation({ summary: 'Customer signs one handover (EDR last-mile: one signature per truck)' })
   signHandover(
     @Param('handoverId', ParseUUIDPipe) handoverId: string,
@@ -507,14 +507,14 @@ export class WarehouseInventoryController {
   }
 
   @Post('bookings/:bookingId/request-handover-signature')
-  @StaffReference()
+  @BookingStaff(FREIGHT_PERMS.warehouseInventory.deliver)
   @ApiOperation({ summary: 'Ask the customer to sign the handover (creates one if none, then notifies)' })
   requestHandoverSignature(@Param('bookingId', ParseUUIDPipe) bookingId: string) {
     return this.handoverService.requestSignature(bookingId);
   }
 
   @Get('bookings/:bookingId/grn-document')
-  @StaffReference()
+  @MixedAudience(FREIGHT_PERMS.warehouseInventory.view)
   @ApiOperation({ summary: 'View GRN PDF for a booking (customer portal)' })
   async bookingGrnDocument(@Param('bookingId', ParseUUIDPipe) bookingId: string, @Res() res: Response) {
     const { filename, buffer } = await this.inventoryService.grnDocumentForBooking(bookingId);
@@ -525,7 +525,7 @@ export class WarehouseInventoryController {
   }
 
   @Get('bookings/:bookingId/release-document')
-  @StaffReference()
+  @MixedAudience(FREIGHT_PERMS.warehouseInventory.view)
   @ApiOperation({ summary: 'View gate-clearance / release-order PDF for a booking (customer portal)' })
   async bookingReleaseDocument(@Param('bookingId', ParseUUIDPipe) bookingId: string, @Res() res: Response) {
     const { filename, buffer } = await this.inventoryService.releaseDocumentForBooking(bookingId);
@@ -536,7 +536,7 @@ export class WarehouseInventoryController {
   }
 
   @Get('bookings/:bookingId/handover-document')
-  @StaffReference()
+  @MixedAudience(FREIGHT_PERMS.warehouseInventory.view)
   @ApiOperation({ summary: 'View import goods handover document PDF (resolved by booking; ?handoverId= for the per-truck variant)' })
   async bookingHandoverDocument(
     @Param('bookingId', ParseUUIDPipe) bookingId: string,
@@ -571,21 +571,21 @@ export class WarehouseInventoryController {
   }
 
   @Get('bookings/:bookingId/container-items')
-  @StaffReference()
+  @MixedAudience(FREIGHT_PERMS.warehouseInventory.view)
   @ApiOperation({ summary: 'Per-container/bulk items of a booking with lifecycle stage + refs' })
   containerItems(@Param('bookingId', ParseUUIDPipe) bookingId: string) {
     return this.inventoryService.containerItems(bookingId);
   }
 
   @Get('bookings/:bookingId/container-weights')
-  @StaffReference()
+  @BookingStaff(FREIGHT_PERMS.warehouseInventory.view)
   @ApiOperation({ summary: "A booking's containers + VGM cargo weight (tonnes) for exit weighing" })
   containerWeights(@Param('bookingId', ParseUUIDPipe) bookingId: string) {
     return this.inventoryService.bookingContainerWeights(bookingId);
   }
 
   @Get('bookings/:bookingId/location')
-  @StaffReference()
+  @MixedAudience(FREIGHT_PERMS.warehouseInventory.view)
   @ApiOperation({ summary: "Warehouse location of a booking's inventory (customer portal)" })
   bookingLocation(@Param('bookingId', ParseUUIDPipe) bookingId: string) {
     return this.inventoryService.bookingLocation(bookingId);
diff --git a/apps/edr-freight-api/src/modules/warehouses/warehouse-invoice.controller.ts b/apps/edr-freight-api/src/modules/warehouses/warehouse-invoice.controller.ts
index c2f5cec9c..323e5c2d8 100644
--- a/apps/edr-freight-api/src/modules/warehouses/warehouse-invoice.controller.ts
+++ b/apps/edr-freight-api/src/modules/warehouses/warehouse-invoice.controller.ts
@@ -5,7 +5,7 @@ import { CurrentUser } from '@edr/api-common';
 import type { TCurrentUser } from '@tria-plc/api-common/modules/auth/types/current-user.type';
 
 import { actorLabel } from './current-actor.util';
-import { BookingStaff, StaffReference } from '../../common/booking-guards';
+import { BookingStaff, MixedAudience } from '../../common/booking-guards';
 import { FREIGHT_PERMS } from '../../seed/freight-permissions.registry';
 import { PayInvoiceDto as GatewayPayInvoiceDto } from '../billing/dto/pay-invoice.dto';
 import { GenerateInvoiceDto, PayInvoiceBodyDto } from './dto/invoice.dto';
@@ -43,7 +43,7 @@ export class WarehouseInvoiceController {
   }
 
   @Get('bookings/:id/warehouse-fee-invoices')
-  @StaffReference()
+  @MixedAudience(FREIGHT_PERMS.warehouseFeeInvoices.view)
   @ApiOperation({ summary: 'List warehouse fee invoices for a booking' })
   listForBooking(@Param('id', ParseUUIDPipe) id: string) {
     return this.invoiceService.listForBooking(id);
@@ -71,14 +71,14 @@ export class WarehouseInvoiceController {
   }
 
   @Get('warehouse-fee-invoices/:id')
-  @StaffReference()
+  @MixedAudience(FREIGHT_PERMS.warehouseFeeInvoices.view)
   @ApiOperation({ summary: 'Get a warehouse fee invoice with items + payment history' })
   findOne(@Param('id', ParseUUIDPipe) id: string) {
     return this.invoiceService.findById(id);
   }
 
   @Get('warehouse-fee-invoices/:id/document')
-  @StaffReference()
+  @MixedAudience(FREIGHT_PERMS.warehouseFeeInvoices.view)
   @ApiOperation({ summary: 'Download sealed warehouse fee invoice PDF' })
   async document(@Param('id', ParseUUIDPipe) id: string, @Res() res: Response) {
     const { filename, buffer } = await this.invoiceService.document(id);
@@ -89,7 +89,7 @@ export class WarehouseInvoiceController {
   }
 
   @Get('warehouse-fee-invoices/:id/receipt')
-  @StaffReference()
+  @MixedAudience(FREIGHT_PERMS.warehouseFeeInvoices.view)
   @ApiOperation({ summary: 'Download sealed warehouse fee payment receipt PDF' })
   async receipt(@Param('id', ParseUUIDPipe) id: string, @Res() res: Response) {
     const { filename, buffer } = await this.invoiceService.receipt(id);
@@ -114,7 +114,7 @@ export class WarehouseInvoiceController {
   }
 
   @Post('warehouse-fee-invoices/:id/pay-online')
-  @StaffReference()
+  @MixedAudience(FREIGHT_PERMS.warehouseFeeInvoices.pay)
   @ApiOperation({ summary: 'Initiate Telebirr/Waafi payment for a warehouse fee invoice' })
   payOnline(@Param('id', ParseUUIDPipe) id: string, @Body() dto: GatewayPayInvoiceDto) {
     return this.invoiceService.initiatePayment(id, dto);
diff --git a/apps/edr-freight-api/src/modules/warehouses/warehouses.controller.ts b/apps/edr-freight-api/src/modules/warehouses/warehouses.controller.ts
index 3ee381a8c..f3d894dfc 100644
--- a/apps/edr-freight-api/src/modules/warehouses/warehouses.controller.ts
+++ b/apps/edr-freight-api/src/modules/warehouses/warehouses.controller.ts
@@ -14,13 +14,19 @@ import { WarehousesService } from './warehouses.service';
 @ApiTags('warehouses')
 @ApiBearerAuth()
 // Baseline read: warehouse reference data is consumed by inventory/dashboard
-// flows too, so any of the three view permissions grants reads. Writes stack
-// their specific create/update permission per route on top.
+// flows too, so any of the view permissions grants reads. Writes stack their
+// specific create/update permission per route on top — which means every key
+// used by a route below must also appear here, or the class guard denies
+// before the route's own key is ever consulted (Nest ANDs the two).
 @Controller('warehouses')
 @BookingStaff([
   FREIGHT_PERMS.warehouses.view,
   FREIGHT_PERMS.warehouseInventory.view,
   FREIGHT_PERMS.warehouseDashboard.view,
+  FREIGHT_PERMS.warehouses.create,
+  FREIGHT_PERMS.warehouses.update,
+  FREIGHT_PERMS.warehouseYards.view,
+  FREIGHT_PERMS.warehouseYards.create,
 ])
 export class WarehousesController {
   constructor(
diff --git a/apps/edr-freight-api/src/seed/freight-permission-key-migration.seeder.ts b/apps/edr-freight-api/src/seed/freight-permission-key-migration.seeder.ts
index 0a0f86a64..bdc3f9139 100644
--- a/apps/edr-freight-api/src/seed/freight-permission-key-migration.seeder.ts
+++ b/apps/edr-freight-api/src/seed/freight-permission-key-migration.seeder.ts
@@ -1,5 +1,10 @@
 import { Injectable, Logger } from '@nestjs/common';
-import { Permission } from '@tria-plc/iamapi-common';
+import {
+  Permission,
+  PositionPermission,
+  PositionTypePermission,
+  RolePermission,
+} from '@tria-plc/iamapi-common';
 import { DataSource } from 'typeorm';
 
 /** Renamed rule-engine resources: old key -> new key (same permission id). */
@@ -14,6 +19,22 @@ const PERMISSION_KEY_RENAMES: ReadonlyArray<{ from: string; to: string }> = [
   },
 ];
 
+/**
+ * Keys retired by the permission-system redesign (docs/permission-system/01):
+ * seeded but never enforced anywhere, and no matching feature exists. Grants
+ * referencing them are revoked before the permission row is deleted.
+ */
+const RETIRED_PERMISSION_KEYS: ReadonlyArray<string> = [
+  'edr_freight_app:payments:verify',
+  'edr_freight_app:payments:refund',
+  'edr_freight_app:invoices:create',
+  'edr_freight_app:invoices:cancel',
+  'edr_freight_app:fuel:approve',
+  'edr_freight_app:maintenance:complete',
+  'edr_freight_app:bookings:payment_pnr',
+  'edr_freight_app:bookings:payment_verify',
+];
+
 @Injectable()
 export class FreightPermissionKeyMigrationSeeder {
   private readonly logger = new Logger(FreightPermissionKeyMigrationSeeder.name);
@@ -44,5 +65,29 @@ export class FreightPermissionKeyMigrationSeeder {
       await permissionRepository.update({ id: existing.id }, { key: to });
       this.logger.log(`Renamed permission key ${from} -> ${to}`);
     }
+
+    for (const key of RETIRED_PERMISSION_KEYS) {
+      const existing = await permissionRepository.findOne({
+        where: { key },
+        select: { id: true },
+      });
+      if (!existing) {
+        continue;
+      }
+
+      // Revoke every grant first, then drop the permission row itself.
+      const permissionId = existing.id as string;
+      await this.dataSource
+        .getRepository(RolePermission)
+        .delete({ permissionId });
+      await this.dataSource
+        .getRepository(PositionPermission)
+        .delete({ permissionId });
+      await this.dataSource
+        .getRepository(PositionTypePermission)
+        .delete({ permissionId });
+      await permissionRepository.delete({ id: permissionId });
+      this.logger.log(`Retired permission key ${key}`);
+    }
   }
 }
diff --git a/apps/edr-freight-api/src/seed/freight-permissions.registry.ts b/apps/edr-freight-api/src/seed/freight-permissions.registry.ts
index 11cccd782..11f0ee40c 100644
--- a/apps/edr-freight-api/src/seed/freight-permissions.registry.ts
+++ b/apps/edr-freight-api/src/seed/freight-permissions.registry.ts
@@ -1,4 +1,4 @@
-const EDR_FREIGHT_APP_KEY = 'edr_freight_app';
+const EDR_FREIGHT_APP_KEY = "edr_freight_app";
 
 export type FreightPermissionSeed = {
   id: string;
@@ -8,33 +8,30 @@ export type FreightPermissionSeed = {
 };
 
 export const RULE_ENGINE_RESOURCE_SLUGS = [
-  'cargo-types',
-  'container-types',
-  'wagon-types',
-  'service-types',
-  'yards',
-  'shipping-lines',
-  'weight-limit-rules',
-  'priority-configs',
-  'rates',
-  'approval-rules',
-  'yard-distances',
+  "cargo-types",
+  "container-types",
+  "wagon-types",
+  "service-types",
+  "yards",
+  "shipping-lines",
+  "weight-limit-rules",
+  "priority-configs",
+  "rates",
+  "approval-rules",
+  "yard-distances",
   // Keep new slugs at the END: ruleEngineCrudId derives ids from list index,
   // so a mid-list insert would shift ids already seeded for later slugs.
-  'truck-types',
-  'transit-agents',
+  "truck-types",
+  "transit-agents",
 ] as const;
 
-export type RuleEngineResourceSlug = (typeof RULE_ENGINE_RESOURCE_SLUGS)[number];
+export type RuleEngineResourceSlug =
+  (typeof RULE_ENGINE_RESOURCE_SLUGS)[number];
 
 const slugToResourceKey = (slug: RuleEngineResourceSlug): string =>
-  slug.replace(/-/g, '_');
+  slug.replace(/-/g, "_");
 
-const perm = (
-  id: string,
-  key: string,
-  en: string,
-): FreightPermissionSeed => ({
+const perm = (id: string, key: string, en: string): FreightPermissionSeed => ({
   id,
   key,
   name: { am: en, en },
@@ -42,32 +39,135 @@ const perm = (
 });
 
 export const BOOKING_PERMISSIONS: FreightPermissionSeed[] = [
-  perm('a1000001-0001-4000-8000-000000000001', 'edr_freight_app:bookings:view', 'View bookings'),
-  perm('a1000001-0001-4000-8000-000000000002', 'edr_freight_app:bookings:staff_accept', 'Accept booking intake'),
-  perm('a1000001-0001-4000-8000-000000000003', 'edr_freight_app:bookings:request_changes', 'Request booking changes'),
-  perm('a1000001-0001-4000-8000-000000000004', 'edr_freight_app:bookings:reject', 'Reject booking submission'),
-  perm('a1000001-0001-4000-8000-000000000005', 'edr_freight_app:bookings:approve_line_staff', 'Approve as line staff'),
-  perm('a1000001-0001-4000-8000-000000000006', 'edr_freight_app:bookings:approve_director', 'Approve as director'),
-  perm('a1000001-0001-4000-8000-000000000007', 'edr_freight_app:bookings:approve_ceo', 'Approve as CEO'),
-  perm('a1000001-0001-4000-8000-000000000008', 'edr_freight_app:bookings:reject_approval', 'Reject at approval step'),
-  perm('a1000001-0001-4000-8000-000000000009', 'edr_freight_app:bookings:generate_contract', 'Generate contract'),
-  perm('a1000001-0001-4000-8000-00000000000a', 'edr_freight_app:bookings:sign_staff', 'Staff contract signature'),
-  perm('a1000001-0001-4000-8000-00000000000b', 'edr_freight_app:bookings:payment_pnr', 'Generate PNR'),
-  perm('a1000001-0001-4000-8000-00000000000c', 'edr_freight_app:bookings:payment_verify', 'Verify payment'),
-  perm('a1000001-0001-4000-8000-00000000000d', 'edr_freight_app:bookings:operations', 'Booking operations'),
-  perm('a1000001-0001-4000-8000-00000000000e', 'edr_freight_app:bookings:cancel', 'Cancel booking'),
-  perm('a1000001-0001-4000-8000-000000000023', 'edr_freight_app:bookings:clearance_view', 'View customs-clearance queue'),
-  perm('a1000001-0001-4000-8000-000000000020', 'edr_freight_app:bookings:review_documents', 'Review clearance documents'),
-  perm('a1000001-0001-4000-8000-000000000021', 'edr_freight_app:bookings:upload_clearance_output', 'Upload customs output documents'),
-  perm('a1000001-0001-4000-8000-000000000022', 'edr_freight_app:bookings:finalize_clearance', 'Finalize document clearance'),
-  perm('a1000001-0001-4000-8000-00000000000f', 'edr_freight_app:train_scheduling:view', 'View train scheduling'),
-  perm('a1000001-0001-4000-8000-000000000011', 'edr_freight_app:fleet:view', 'View fleet'),
-  perm('a1000001-0001-4000-8000-000000000012', 'edr_freight_app:fleet:manage', 'Manage fleet'),
-  perm('a1000001-0001-4000-8000-000000000013', 'edr_freight_app:admin', 'Freight administration'),
-  perm('a1000001-0001-4000-8000-000000000024', 'edr_freight_app:bookings:create', 'Create booking'),
+  perm(
+    "a1000001-0001-4000-8000-000000000001",
+    "edr_freight_app:bookings:view",
+    "View bookings",
+  ),
+  perm(
+    "a1000001-0001-4000-8000-000000000002",
+    "edr_freight_app:bookings:staff_accept",
+    "Accept booking intake",
+  ),
+  perm(
+    "a1000001-0001-4000-8000-000000000003",
+    "edr_freight_app:bookings:request_changes",
+    "Request booking changes",
+  ),
+  perm(
+    "a1000001-0001-4000-8000-000000000004",
+    "edr_freight_app:bookings:reject",
+    "Reject booking submission",
+  ),
+  perm(
+    "a1000001-0001-4000-8000-000000000005",
+    "edr_freight_app:bookings:approve_line_staff",
+    "Approve as line staff",
+  ),
+  perm(
+    "a1000001-0001-4000-8000-000000000006",
+    "edr_freight_app:bookings:approve_director",
+    "Approve as director",
+  ),
+  perm(
+    "a1000001-0001-4000-8000-000000000007",
+    "edr_freight_app:bookings:approve_ceo",
+    "Approve as CEO",
+  ),
+  perm(
+    "a1000001-0001-4000-8000-000000000008",
+    "edr_freight_app:bookings:reject_approval",
+    "Reject at approval step",
+  ),
+  perm(
+    "a1000001-0001-4000-8000-000000000009",
+    "edr_freight_app:bookings:generate_contract",
+    "Generate contract",
+  ),
+  perm(
+    "a1000001-0001-4000-8000-00000000000a",
+    "edr_freight_app:bookings:sign_staff",
+    "Staff contract signature",
+  ),
+  perm(
+    "a1000001-0001-4000-8000-00000000000d",
+    "edr_freight_app:bookings:operations",
+    "Booking operations",
+  ),
+  perm(
+    "a1000001-0001-4000-8000-00000000000e",
+    "edr_freight_app:bookings:cancel",
+    "Cancel booking",
+  ),
+  perm(
+    "a1000001-0001-4000-8000-000000000023",
+    "edr_freight_app:bookings:clearance_view",
+    "View customs-clearance queue",
+  ),
+  perm(
+    "a1000001-0001-4000-8000-000000000020",
+    "edr_freight_app:bookings:review_documents",
+    "Review clearance documents",
+  ),
+  perm(
+    "a1000001-0001-4000-8000-000000000021",
+    "edr_freight_app:bookings:upload_clearance_output",
+    "Upload customs output documents",
+  ),
+  perm(
+    "a1000001-0001-4000-8000-000000000022",
+    "edr_freight_app:bookings:finalize_clearance",
+    "Finalize document clearance",
+  ),
+  perm(
+    "a1000001-0001-4000-8000-00000000000f",
+    "edr_freight_app:train_scheduling:view",
+    "View train scheduling",
+  ),
+  perm(
+    "a1000001-0001-4000-8000-000000000011",
+    "edr_freight_app:fleet:view",
+    "View fleet",
+  ),
+  perm(
+    "a1000001-0001-4000-8000-000000000012",
+    "edr_freight_app:fleet:manage",
+    "Manage fleet",
+  ),
+  perm(
+    "a1000001-0001-4000-8000-000000000013",
+    "edr_freight_app:admin",
+    "Freight administration",
+  ),
+  perm(
+    "a1000001-0001-4000-8000-000000000024",
+    "edr_freight_app:bookings:create",
+    "Create booking",
+  ),
   // Header alarm for the document-review deadline: its own key so only the
   // position types that actually decide operation requests are alerted.
-  perm('a1000001-0001-4000-8000-000000000025', 'edr_freight_app:bookings:doc_review_alert', 'See document-review deadline alarm'),
+  perm(
+    "a1000001-0001-4000-8000-000000000025",
+    "edr_freight_app:bookings:doc_review_alert",
+    "See document-review deadline alarm",
+  ),
+  // Partial wagon cancellation (paid bookings): staff-side keys. The customer
+  // portal needs none — customer actions are ownership-scoped on the API.
+  perm(
+    "a1000001-0001-4000-8000-000000000026",
+    "edr_freight_app:bookings:wagon_cancellation_view",
+    "View wagon cancellation history",
+  ),
+  perm(
+    "a1000001-0001-4000-8000-000000000027",
+    "edr_freight_app:bookings:wagon_cancellation_void",
+    "Void a pending wagon cancellation",
+  ),
+  perm(
+    "a1000001-0001-4000-8000-000000000028",
+    "edr_freight_app:bookings:wagon_cancellation_rebook",
+    "Rebook cancelled wagons for a customer",
+  ),
 ];
 
 /**
@@ -75,38 +175,130 @@ export const BOOKING_PERMISSIONS: FreightPermissionSeed[] = [
  * approval/sign/clearance permissions but scoped to the new contracts module.
  */
 export const CONTRACT_PERMISSIONS: FreightPermissionSeed[] = [
-  perm('a3000001-0001-4000-8000-000000000001', 'edr_freight_app:contracts:view', 'View contracts'),
+  perm(
+    "a3000001-0001-4000-8000-000000000001",
+    "edr_freight_app:contracts:view",
+    "View contracts",
+  ),
   // Intake actions are split per freight type (bulk vs container) — fresh ids
   // because the seeder upserts ON CONFLICT (key); reusing the old ids with new
   // keys would PK-collide with the legacy staff_accept/request_changes/reject rows.
-  perm('a3000001-0001-4000-8000-000000000011', 'edr_freight_app:contracts:staff_accept:bulk', 'Accept bulk contract intake'),
-  perm('a3000001-0001-4000-8000-000000000012', 'edr_freight_app:contracts:staff_accept:container', 'Accept container contract intake'),
-  perm('a3000001-0001-4000-8000-000000000013', 'edr_freight_app:contracts:request_changes:bulk', 'Request bulk contract changes'),
-  perm('a3000001-0001-4000-8000-000000000014', 'edr_freight_app:contracts:request_changes:container', 'Request container contract changes'),
-  perm('a3000001-0001-4000-8000-000000000015', 'edr_freight_app:contracts:reject:bulk', 'Reject bulk contract'),
-  perm('a3000001-0001-4000-8000-000000000016', 'edr_freight_app:contracts:reject:container', 'Reject container contract'),
-  perm('a3000001-0001-4000-8000-000000000005', 'edr_freight_app:contracts:approve_line_staff', 'Approve contract as line staff'),
-  perm('a3000001-0001-4000-8000-000000000006', 'edr_freight_app:contracts:approve_director', 'Approve contract as director'),
-  perm('a3000001-0001-4000-8000-000000000007', 'edr_freight_app:contracts:approve_ceo', 'Approve contract as CEO'),
-  perm('a3000001-0001-4000-8000-000000000008', 'edr_freight_app:contracts:generate_contract', 'Generate contract document'),
+  perm(
+    "a3000001-0001-4000-8000-000000000011",
+    "edr_freight_app:contracts:staff_accept:bulk",
+    "Accept bulk contract intake",
+  ),
+  perm(
+    "a3000001-0001-4000-8000-000000000012",
+    "edr_freight_app:contracts:staff_accept:container",
+    "Accept container contract intake",
+  ),
+  perm(
+    "a3000001-0001-4000-8000-000000000013",
+    "edr_freight_app:contracts:request_changes:bulk",
+    "Request bulk contract changes",
+  ),
+  perm(
+    "a3000001-0001-4000-8000-000000000014",
+    "edr_freight_app:contracts:request_changes:container",
+    "Request container contract changes",
+  ),
+  perm(
+    "a3000001-0001-4000-8000-000000000015",
+    "edr_freight_app:contracts:reject:bulk",
+    "Reject bulk contract",
+  ),
+  perm(
+    "a3000001-0001-4000-8000-000000000016",
+    "edr_freight_app:contracts:reject:container",
+    "Reject container contract",
+  ),
+  perm(
+    "a3000001-0001-4000-8000-000000000005",
+    "edr_freight_app:contracts:approve_line_staff",
+    "Approve contract as line staff",
+  ),
+  perm(
+    "a3000001-0001-4000-8000-000000000006",
+    "edr_freight_app:contracts:approve_director",
+    "Approve contract as director",
+  ),
+  perm(
+    "a3000001-0001-4000-8000-000000000007",
+    "edr_freight_app:contracts:approve_ceo",
+    "Approve contract as CEO",
+  ),
+  perm(
+    "a3000001-0001-4000-8000-000000000008",
+    "edr_freight_app:contracts:generate_contract",
+    "Generate contract document",
+  ),
   // Staff counter-signature is split per freight type too — fresh ids for the
   // same reason as the intake keys above.
-  perm('a3000001-0001-4000-8000-000000000017', 'edr_freight_app:contracts:sign_staff:bulk', 'Staff contract signature: bulk'),
-  perm('a3000001-0001-4000-8000-000000000018', 'edr_freight_app:contracts:sign_staff:container', 'Staff contract signature: container'),
-  perm('a3000001-0001-4000-8000-00000000000a', 'edr_freight_app:contracts:clearance_review', 'Review pre-booking clearance docs'),
-  perm('a3000001-0001-4000-8000-00000000000b', 'edr_freight_app:contracts:finalize_clearance', 'Finalize pre-booking clearance'),
-  perm('a3000001-0001-4000-8000-00000000000c', 'edr_freight_app:contracts:create_booking', 'GL ET create booking under contract'),
-  perm('a3000001-0001-4000-8000-00000000000d', 'edr_freight_app:contracts:ops_clearance_review', 'Operations review of self-clearance docs (Path A)'),
-  perm('a3000001-0001-4000-8000-00000000000e', 'edr_freight_app:contracts:clearance_et_actions', 'GL Ethiopia phased clearance actions'),
-  perm('a3000001-0001-4000-8000-00000000000f', 'edr_freight_app:contracts:clearance_dj_actions', 'GL Djibouti phased clearance actions'),
-  perm('a3000001-0001-4000-8000-000000000010', 'edr_freight_app:contracts:clearance_duty_advise', 'Advise contract duty/tax'),
+  perm(
+    "a3000001-0001-4000-8000-000000000017",
+    "edr_freight_app:contracts:sign_staff:bulk",
+    "Staff contract signature: bulk",
+  ),
+  perm(
+    "a3000001-0001-4000-8000-000000000018",
+    "edr_freight_app:contracts:sign_staff:container",
+    "Staff contract signature: container",
+  ),
+  perm(
+    "a3000001-0001-4000-8000-00000000000a",
+    "edr_freight_app:contracts:clearance_review",
+    "Review pre-booking clearance docs",
+  ),
+  perm(
+    "a3000001-0001-4000-8000-00000000000b",
+    "edr_freight_app:contracts:finalize_clearance",
+    "Finalize pre-booking clearance",
+  ),
+  perm(
+    "a3000001-0001-4000-8000-00000000000c",
+    "edr_freight_app:contracts:create_booking",
+    "GL ET create booking under contract",
+  ),
+  perm(
+    "a3000001-0001-4000-8000-00000000000d",
+    "edr_freight_app:contracts:ops_clearance_review",
+    "Operations review of self-clearance docs (Path A)",
+  ),
+  perm(
+    "a3000001-0001-4000-8000-00000000000e",
+    "edr_freight_app:contracts:clearance_et_actions",
+    "GL Ethiopia phased clearance actions",
+  ),
+  perm(
+    "a3000001-0001-4000-8000-00000000000f",
+    "edr_freight_app:contracts:clearance_dj_actions",
+    "GL Djibouti phased clearance actions",
+  ),
+  perm(
+    "a3000001-0001-4000-8000-000000000010",
+    "edr_freight_app:contracts:clearance_duty_advise",
+    "Advise contract duty/tax",
+  ),
   // Hazardous contracts get two extra approval steps ahead of the normal chain.
   // Each has its own permission so the two desks are genuinely separate people.
-  perm('a3000001-0001-4000-8000-000000000019', 'edr_freight_app:contracts:hazardous_approval_one', 'Hazardous approval — first review'),
-  perm('a3000001-0001-4000-8000-00000000001a', 'edr_freight_app:contracts:hazardous_approval_two', 'Hazardous approval — second review'),
+  perm(
+    "a3000001-0001-4000-8000-000000000019",
+    "edr_freight_app:contracts:hazardous_approval_one",
+    "Hazardous approval — first review",
+  ),
+  perm(
+    "a3000001-0001-4000-8000-00000000001a",
+    "edr_freight_app:contracts:hazardous_approval_two",
+    "Hazardous approval — second review",
+  ),
   // Freeze/unfreeze a signed contract. One key covers both directions — whoever
   // may suspend must be able to lift it again.
-  perm('a3000001-0001-4000-8000-00000000001b', 'edr_freight_app:contracts:suspend', 'Suspend / resume a signed contract'),
+  perm(
+    "a3000001-0001-4000-8000-00000000001b",
+    "edr_freight_app:contracts:suspend",
+    "Suspend / resume a signed contract",
+  ),
 ];
 
 // Historical ids. EdrOrgSeeder no longer sends them — it upserts on `key` and
@@ -116,25 +308,25 @@ export const CONTRACT_PERMISSIONS: FreightPermissionSeed[] = [
 // owned …001b, and reusing it for transit-agents crashed boot with a PK 23505
 // on every environment that still had the retired row.
 const RULE_ENGINE_VIEW_IDS: Record<RuleEngineResourceSlug, string> = {
-  'cargo-types': 'b2000001-0001-4000-8000-000000000001',
-  'container-types': 'b2000001-0001-4000-8000-000000000003',
-  'wagon-types': 'b2000001-0001-4000-8000-000000000015',
-  'truck-types': 'b2000001-0001-4000-8000-00000000001a',
-  'service-types': 'b2000001-0001-4000-8000-000000000005',
-  yards: 'b2000001-0001-4000-8000-000000000007',
-  'shipping-lines': 'b2000001-0001-4000-8000-000000000009',
-  'weight-limit-rules': 'b2000001-0001-4000-8000-00000000000b',
-  'priority-configs': 'b2000001-0001-4000-8000-00000000000f',
-  rates: 'b2000001-0001-4000-8000-000000000011',
-  'approval-rules': 'b2000001-0001-4000-8000-000000000013',
-  'yard-distances': 'b2000001-0001-4000-8000-000000000018',
-  'transit-agents': 'b2000003-0001-4000-8000-000000000001',
+  "cargo-types": "b2000001-0001-4000-8000-000000000001",
+  "container-types": "b2000001-0001-4000-8000-000000000003",
+  "wagon-types": "b2000001-0001-4000-8000-000000000015",
+  "truck-types": "b2000001-0001-4000-8000-00000000001a",
+  "service-types": "b2000001-0001-4000-8000-000000000005",
+  yards: "b2000001-0001-4000-8000-000000000007",
+  "shipping-lines": "b2000001-0001-4000-8000-000000000009",
+  "weight-limit-rules": "b2000001-0001-4000-8000-00000000000b",
+  "priority-configs": "b2000001-0001-4000-8000-00000000000f",
+  rates: "b2000001-0001-4000-8000-000000000011",
+  "approval-rules": "b2000001-0001-4000-8000-000000000013",
+  "yard-distances": "b2000001-0001-4000-8000-000000000018",
+  "transit-agents": "b2000003-0001-4000-8000-000000000001",
 };
 
 // CRUD replaces the retired coarse `:manage`. New ids live in a fresh block
 // (b2000002-…) so a stale `:manage` grant can never silently confer a CRUD
 // action — the migration re-grants create/update/delete explicitly.
-const RULE_ENGINE_CRUD_ACTIONS = ['create', 'update', 'delete'] as const;
+const RULE_ENGINE_CRUD_ACTIONS = ["create", "update", "delete"] as const;
 type RuleEngineCrudAction = (typeof RULE_ENGINE_CRUD_ACTIONS)[number];
 const ruleEngineCrudId = (
   slug: RuleEngineResourceSlug,
@@ -142,9 +334,9 @@ const ruleEngineCrudId = (
 ): string => {
   const n =
     RULE_ENGINE_RESOURCE_SLUGS.indexOf(slug) * 3 +
-    RULE_ENGINE_CRUD_ACTIONS.indexOf(action) +  
+    RULE_ENGINE_CRUD_ACTIONS.indexOf(action) +
     1; // 1..36
-  return `b2000002-0001-4000-8000-${n.toString(16).padStart(12, '0')}`;
+  return `b2000002-0001-4000-8000-${n.toString(16).padStart(12, "0")}`;
 };
 
 /**
@@ -152,34 +344,61 @@ const ruleEngineCrudId = (
  * propose a change; only `approve` lets someone put it into effect. Only listed
  * slugs get the permission.
  */
-const RULE_ENGINE_APPROVE_PERMISSION_IDS: Partial<Record<RuleEngineResourceSlug, string>> = {
-  rates: 'b2000001-0001-4000-8000-000000000017',
+const RULE_ENGINE_APPROVE_PERMISSION_IDS: Partial<
+  Record<RuleEngineResourceSlug, string>
+> = {
+  rates: "b2000001-0001-4000-8000-000000000017",
 };
 
-export type RuleEngineApprovableSlug = 'rates';
+export type RuleEngineApprovableSlug = "rates";
 
-export const RULE_ENGINE_PERMISSIONS: FreightPermissionSeed[] = RULE_ENGINE_RESOURCE_SLUGS.flatMap(
-  (slug) => {
+export const RULE_ENGINE_PERMISSIONS: FreightPermissionSeed[] =
+  RULE_ENGINE_RESOURCE_SLUGS.flatMap((slug) => {
     const resource = slugToResourceKey(slug);
     const approveId = RULE_ENGINE_APPROVE_PERMISSION_IDS[slug];
     return [
-      perm(RULE_ENGINE_VIEW_IDS[slug], `edr_freight_app:rule_engine:${resource}:view`, `View ${slug}`),
-      perm(ruleEngineCrudId(slug, 'create'), `edr_freight_app:rule_engine:${resource}:create`, `Create ${slug}`),
-      perm(ruleEngineCrudId(slug, 'update'), `edr_freight_app:rule_engine:${resource}:update`, `Update ${slug}`),
-      perm(ruleEngineCrudId(slug, 'delete'), `edr_freight_app:rule_engine:${resource}:delete`, `Delete ${slug}`),
+      perm(
+        RULE_ENGINE_VIEW_IDS[slug],
+        `edr_freight_app:rule_engine:${resource}:view`,
+        `View ${slug}`,
+      ),
+      perm(
+        ruleEngineCrudId(slug, "create"),
+        `edr_freight_app:rule_engine:${resource}:create`,
+        `Create ${slug}`,
+      ),
+      perm(
+        ruleEngineCrudId(slug, "update"),
+        `edr_freight_app:rule_engine:${resource}:update`,
+        `Update ${slug}`,
+      ),
+      perm(
+        ruleEngineCrudId(slug, "delete"),
+        `edr_freight_app:rule_engine:${resource}:delete`,
+        `Delete ${slug}`,
+      ),
       ...(approveId
-        ? [perm(approveId, `edr_freight_app:rule_engine:${resource}:approve`, `Approve ${slug} changes`)]
+        ? [
+          perm(
+            approveId,
+            `edr_freight_app:rule_engine:${resource}:approve`,
+            `Approve ${slug} changes`,
+          ),
+        ]
         : []),
     ];
-  },
-);
+  });
 
 /**
  * Container-allocation permission for the previously-unguarded
  * booking allocate-containers endpoint.
  */
 export const GAP_CONTROLLER_PERMISSIONS: FreightPermissionSeed[] = [
-  perm('c1000001-0001-4000-8000-000000000001', 'edr_freight_app:allocation:manage', 'Allocate containers to vehicles'),
+  perm(
+    "c1000001-0001-4000-8000-000000000001",
+    "edr_freight_app:allocation:manage",
+    "Allocate containers to vehicles",
+  ),
 ];
 
 /**
@@ -190,200 +409,921 @@ export const GAP_CONTROLLER_PERMISSIONS: FreightPermissionSeed[] = [
 
 // C. Customers
 export const CUSTOMER_PERMISSIONS: FreightPermissionSeed[] = [
-  perm('d1a00001-0001-4000-8000-000000000001', 'edr_freight_app:customers:view', 'View customers'),
-  perm('d1a00001-0001-4000-8000-000000000002', 'edr_freight_app:customers:create', 'Create customer'),
-  perm('d1a00001-0001-4000-8000-000000000003', 'edr_freight_app:customers:update', 'Update customer'),
-  perm('d1a00001-0001-4000-8000-000000000004', 'edr_freight_app:customers:deactivate', 'Deactivate customer'),
-  perm('d1a00001-0001-4000-8000-000000000005', 'edr_freight_app:customers:verify', 'Verify customer (KYC/Fayda)'),
-  perm('d1a00001-0001-4000-8000-000000000006', 'edr_freight_app:customers:reset-password', 'Trigger customer password reset'),
+  perm(
+    "d1a00001-0001-4000-8000-000000000001",
+    "edr_freight_app:customers:view",
+    "View customers",
+  ),
+  perm(
+    "d1a00001-0001-4000-8000-000000000002",
+    "edr_freight_app:customers:create",
+    "Create customer",
+  ),
+  perm(
+    "d1a00001-0001-4000-8000-000000000003",
+    "edr_freight_app:customers:update",
+    "Update customer",
+  ),
+  perm(
+    "d1a00001-0001-4000-8000-000000000004",
+    "edr_freight_app:customers:deactivate",
+    "Deactivate customer",
+  ),
+  perm(
+    "d1a00001-0001-4000-8000-000000000005",
+    "edr_freight_app:customers:verify",
+    "Verify customer (KYC/Fayda)",
+  ),
+  perm(
+    "d1a00001-0001-4000-8000-000000000006",
+    "edr_freight_app:customers:reset-password",
+    "Trigger customer password reset",
+  ),
 ];
 
 // D. Finance — payments + invoices
 export const FINANCE_PERMISSIONS: FreightPermissionSeed[] = [
-  perm('d2a00001-0001-4000-8000-000000000001', 'edr_freight_app:payments:view', 'View payments'),
-  perm('d2a00001-0001-4000-8000-000000000002', 'edr_freight_app:payments:verify', 'Verify/settle payment'),
-  perm('d2a00001-0001-4000-8000-000000000003', 'edr_freight_app:payments:refund', 'Refund payment'),
-  perm('d2b00001-0001-4000-8000-000000000001', 'edr_freight_app:invoices:view', 'View invoices'),
-  perm('d2b00001-0001-4000-8000-000000000002', 'edr_freight_app:invoices:create', 'Generate invoice'),
-  perm('d2b00001-0001-4000-8000-000000000003', 'edr_freight_app:invoices:cancel', 'Cancel invoice'),
-  perm('d2b00001-0001-4000-8000-000000000004', 'edr_freight_app:invoices:export', 'Download invoice document'),
+  perm(
+    "d2a00001-0001-4000-8000-000000000001",
+    "edr_freight_app:payments:view",
+    "View payments",
+  ),
+  perm(
+    "d2b00001-0001-4000-8000-000000000001",
+    "edr_freight_app:invoices:view",
+    "View invoices",
+  ),
+  perm(
+    "d2b00001-0001-4000-8000-000000000004",
+    "edr_freight_app:invoices:export",
+    "Download invoice document",
+  ),
 ];
 
 // E. First / last mile operations
 export const MILE_PERMISSIONS: FreightPermissionSeed[] = [
-  perm('d3a00001-0001-4000-8000-000000000001', 'edr_freight_app:first_mile:view', 'View first-mile'),
-  perm('d3a00001-0001-4000-8000-000000000002', 'edr_freight_app:first_mile:accept', 'Accept first-mile request'),
-  perm('d3a00001-0001-4000-8000-000000000003', 'edr_freight_app:first_mile:create', 'Create first-mile'),
-  perm('d3a00001-0001-4000-8000-000000000004', 'edr_freight_app:first_mile:update', 'Update first-mile'),
-  perm('d3a00001-0001-4000-8000-000000000005', 'edr_freight_app:first_mile:delete', 'Delete first-mile'),
-  perm('d3a00001-0001-4000-8000-000000000006', 'edr_freight_app:first_mile:assign_vehicles', 'Assign first-mile vehicles'),
-  perm('d3a00001-0001-4000-8000-000000000007', 'edr_freight_app:first_mile:set_distances', 'Set first-mile distances'),
-  perm('d3a00001-0001-4000-8000-000000000008', 'edr_freight_app:first_mile:generate_invoice', 'Generate first-mile invoice'),
-  perm('d3b00001-0001-4000-8000-000000000001', 'edr_freight_app:last_mile:view', 'View last-mile'),
-  perm('d3b00001-0001-4000-8000-000000000002', 'edr_freight_app:last_mile:accept', 'Accept last-mile request'),
-  perm('d3b00001-0001-4000-8000-000000000003', 'edr_freight_app:last_mile:create', 'Create last-mile'),
-  perm('d3b00001-0001-4000-8000-000000000004', 'edr_freight_app:last_mile:update', 'Update last-mile'),
-  perm('d3b00001-0001-4000-8000-000000000005', 'edr_freight_app:last_mile:delete', 'Delete last-mile'),
-  perm('d3b00001-0001-4000-8000-000000000006', 'edr_freight_app:last_mile:assign_vehicles', 'Assign last-mile vehicles'),
-  perm('d3b00001-0001-4000-8000-000000000007', 'edr_freight_app:last_mile:set_distances', 'Set last-mile distances'),
-  perm('d3b00001-0001-4000-8000-000000000008', 'edr_freight_app:last_mile:generate_invoice', 'Generate last-mile invoice'),
-  perm('d3b00001-0001-4000-8000-000000000009', 'edr_freight_app:last_mile:request_view', 'View last-mile confirmation requests'),
-  perm('d3b00001-0001-4000-8000-00000000000a', 'edr_freight_app:last_mile:request_review', 'Review last-mile confirmation requests (T&M dept)'),
-  perm('d3b00001-0001-4000-8000-00000000000b', 'edr_freight_app:last_mile:request_approve', 'Approve/reject last-mile confirmation requests'),
+  perm(
+    "d3a00001-0001-4000-8000-000000000001",
+    "edr_freight_app:first_mile:view",
+    "View first-mile",
+  ),
+  perm(
+    "d3a00001-0001-4000-8000-000000000002",
+    "edr_freight_app:first_mile:accept",
+    "Accept first-mile request",
+  ),
+  perm(
+    "d3a00001-0001-4000-8000-000000000003",
+    "edr_freight_app:first_mile:create",
+    "Create first-mile",
+  ),
+  perm(
+    "d3a00001-0001-4000-8000-000000000004",
+    "edr_freight_app:first_mile:update",
+    "Update first-mile",
+  ),
+  perm(
+    "d3a00001-0001-4000-8000-000000000005",
+    "edr_freight_app:first_mile:delete",
+    "Delete first-mile",
+  ),
+  perm(
+    "d3a00001-0001-4000-8000-000000000006",
+    "edr_freight_app:first_mile:assign_vehicles",
+    "Assign first-mile vehicles",
+  ),
+  perm(
+    "d3a00001-0001-4000-8000-000000000007",
+    "edr_freight_app:first_mile:set_distances",
+    "Set first-mile distances",
+  ),
+  perm(
+    "d3a00001-0001-4000-8000-000000000008",
+    "edr_freight_app:first_mile:generate_invoice",
+    "Generate first-mile invoice",
+  ),
+  perm(
+    "d3b00001-0001-4000-8000-000000000001",
+    "edr_freight_app:last_mile:view",
+    "View last-mile",
+  ),
+  perm(
+    "d3b00001-0001-4000-8000-000000000002",
+    "edr_freight_app:last_mile:accept",
+    "Accept last-mile request",
+  ),
+  perm(
+    "d3b00001-0001-4000-8000-000000000003",
+    "edr_freight_app:last_mile:create",
+    "Create last-mile",
+  ),
+  perm(
+    "d3b00001-0001-4000-8000-000000000004",
+    "edr_freight_app:last_mile:update",
+    "Update last-mile",
+  ),
+  perm(
+    "d3b00001-0001-4000-8000-000000000005",
+    "edr_freight_app:last_mile:delete",
+    "Delete last-mile",
+  ),
+  perm(
+    "d3b00001-0001-4000-8000-000000000006",
+    "edr_freight_app:last_mile:assign_vehicles",
+    "Assign last-mile vehicles",
+  ),
+  perm(
+    "d3b00001-0001-4000-8000-000000000007",
+    "edr_freight_app:last_mile:set_distances",
+    "Set last-mile distances",
+  ),
+  perm(
+    "d3b00001-0001-4000-8000-000000000008",
+    "edr_freight_app:last_mile:generate_invoice",
+    "Generate last-mile invoice",
+  ),
+  perm(
+    "d3b00001-0001-4000-8000-000000000009",
+    "edr_freight_app:last_mile:request_view",
+    "View last-mile confirmation requests",
+  ),
+  perm(
+    "d3b00001-0001-4000-8000-00000000000a",
+    "edr_freight_app:last_mile:request_review",
+    "Review last-mile confirmation requests (T&M dept)",
+  ),
+  perm(
+    "d3b00001-0001-4000-8000-00000000000b",
+    "edr_freight_app:last_mile:request_approve",
+    "Approve/reject last-mile confirmation requests",
+  ),
 ];
 
 // F. Fleet — rail assets (splits the flat fleet:view/manage)
 export const FLEET_RAIL_PERMISSIONS: FreightPermissionSeed[] = [
-  perm('e1a00001-0001-4000-8000-000000000001', 'edr_freight_app:locomotives:view', 'View locomotives'),
-  perm('e1a00001-0001-4000-8000-000000000002', 'edr_freight_app:locomotives:create', 'Create locomotive'),
-  perm('e1a00001-0001-4000-8000-000000000003', 'edr_freight_app:locomotives:update', 'Update locomotive'),
-  perm('e1a00001-0001-4000-8000-000000000004', 'edr_freight_app:locomotives:delete', 'Delete locomotive'),
-  perm('e1a00001-0001-4000-8000-000000000005', 'edr_freight_app:locomotives:hard_delete', 'Permanently delete locomotive'),
-  perm('e1b00001-0001-4000-8000-000000000001', 'edr_freight_app:wagons:view', 'View wagons'),
-  perm('e1b00001-0001-4000-8000-000000000002', 'edr_freight_app:wagons:create', 'Create wagon'),
-  perm('e1b00001-0001-4000-8000-000000000003', 'edr_freight_app:wagons:update', 'Update wagon'),
-  perm('e1b00001-0001-4000-8000-000000000004', 'edr_freight_app:wagons:delete', 'Delete wagon'),
-  perm('e1b00001-0001-4000-8000-000000000005', 'edr_freight_app:wagons:transfer_request', 'Request wagon transfer'),
-  perm('e1b00001-0001-4000-8000-000000000006', 'edr_freight_app:wagons:transfer_fulfill', 'Fulfil wagon transfer (OCC)'),
-  perm('e1b00001-0001-4000-8000-000000000007', 'edr_freight_app:wagons:transfer_history_all', "View all staff's transfer history"),
+  perm(
+    "e1a00001-0001-4000-8000-000000000001",
+    "edr_freight_app:locomotives:view",
+    "View locomotives",
+  ),
+  perm(
+    "e1a00001-0001-4000-8000-000000000002",
+    "edr_freight_app:locomotives:create",
+    "Create locomotive",
+  ),
+  perm(
+    "e1a00001-0001-4000-8000-000000000003",
+    "edr_freight_app:locomotives:update",
+    "Update locomotive",
+  ),
+  perm(
+    "e1a00001-0001-4000-8000-000000000004",
+    "edr_freight_app:locomotives:delete",
+    "Delete locomotive",
+  ),
+  perm(
+    "e1a00001-0001-4000-8000-000000000005",
+    "edr_freight_app:locomotives:hard_delete",
+    "Permanently delete locomotive",
+  ),
+  perm(
+    "e1b00001-0001-4000-8000-000000000001",
+    "edr_freight_app:wagons:view",
+    "View wagons",
+  ),
+  perm(
+    "e1b00001-0001-4000-8000-000000000002",
+    "edr_freight_app:wagons:create",
+    "Create wagon",
+  ),
+  perm(
+    "e1b00001-0001-4000-8000-000000000003",
+    "edr_freight_app:wagons:update",
+    "Update wagon",
+  ),
+  perm(
+    "e1b00001-0001-4000-8000-000000000004",
+    "edr_freight_app:wagons:delete",
+    "Delete wagon",
+  ),
+  perm(
+    "e1b00001-0001-4000-8000-000000000005",
+    "edr_freight_app:wagons:transfer_request",
+    "Request wagon transfer",
+  ),
+  perm(
+    "e1b00001-0001-4000-8000-000000000006",
+    "edr_freight_app:wagons:transfer_fulfill",
+    "Fulfil wagon transfer (OCC)",
+  ),
+  perm(
+    "e1b00001-0001-4000-8000-000000000007",
+    "edr_freight_app:wagons:transfer_history_all",
+    "View all staff's transfer history",
+  ),
   // The transfer desk is its own screen, so it carries its own per-action keys —
   // seeing the queue, withdrawing a request and short-closing one are separate
   // grants from filing or fulfilling.
-  perm('e1b00001-0001-4000-8000-000000000008', 'edr_freight_app:wagons:transfer_view', 'View wagon transfer requests'),
-  perm('e1b00001-0001-4000-8000-000000000009', 'edr_freight_app:wagons:transfer_cancel', 'Withdraw a wagon transfer request'),
-  perm('e1b00001-0001-4000-8000-00000000000a', 'edr_freight_app:wagons:transfer_close_short', 'Close a transfer request short of the requested count'),
-  perm('e1b00001-0001-4000-8000-00000000000b', 'edr_freight_app:wagons:hard_delete', 'Permanently delete wagon'),
-  perm('e1c00001-0001-4000-8000-000000000001', 'edr_freight_app:trains:view', 'View trains'),
-  perm('e1c00001-0001-4000-8000-000000000002', 'edr_freight_app:trains:create', 'Create train'),
-  perm('e1c00001-0001-4000-8000-000000000003', 'edr_freight_app:trains:update', 'Update train'),
-  perm('e1c00001-0001-4000-8000-000000000004', 'edr_freight_app:trains:delete', 'Delete train'),
-  perm('e1c00001-0001-4000-8000-000000000005', 'edr_freight_app:trains:assign_wagons', 'Assign wagons to train'),
-  perm('e1d00001-0001-4000-8000-000000000001', 'edr_freight_app:routes:view', 'View routes'),
-  perm('e1d00001-0001-4000-8000-000000000002', 'edr_freight_app:routes:create', 'Create route'),
-  perm('e1d00001-0001-4000-8000-000000000003', 'edr_freight_app:routes:update', 'Update route'),
-  perm('e1d00001-0001-4000-8000-000000000004', 'edr_freight_app:routes:delete', 'Delete route'),
-  perm('e1d00001-0001-4000-8000-000000000005', 'edr_freight_app:routes:hard_delete', 'Permanently delete route'),
-  perm('e1e00001-0001-4000-8000-000000000001', 'edr_freight_app:containers:view', 'View containers'),
-  perm('e1e00001-0001-4000-8000-000000000002', 'edr_freight_app:containers:create', 'Create container'),
-  perm('e1e00001-0001-4000-8000-000000000003', 'edr_freight_app:containers:update', 'Update container'),
-  perm('e1e00001-0001-4000-8000-000000000004', 'edr_freight_app:containers:delete', 'Delete container'),
-  perm('e1f00001-0001-4000-8000-000000000001', 'edr_freight_app:cargoes:view', 'View cargoes'),
-  perm('e1f00001-0001-4000-8000-000000000002', 'edr_freight_app:cargoes:create', 'Create cargo'),
-  perm('e1f00001-0001-4000-8000-000000000003', 'edr_freight_app:cargoes:update', 'Update cargo'),
-  perm('e1f00001-0001-4000-8000-000000000004', 'edr_freight_app:cargoes:delete', 'Delete cargo'),
+  perm(
+    "e1b00001-0001-4000-8000-000000000008",
+    "edr_freight_app:wagons:transfer_view",
+    "View wagon transfer requests",
+  ),
+  perm(
+    "e1b00001-0001-4000-8000-000000000009",
+    "edr_freight_app:wagons:transfer_cancel",
+    "Withdraw a wagon transfer request",
+  ),
+  perm(
+    "e1b00001-0001-4000-8000-00000000000a",
+    "edr_freight_app:wagons:transfer_close_short",
+    "Close a transfer request short of the requested count",
+  ),
+  perm(
+    "e1b00001-0001-4000-8000-00000000000b",
+    "edr_freight_app:wagons:hard_delete",
+    "Permanently delete wagon",
+  ),
+  perm(
+    "e1c00001-0001-4000-8000-000000000001",
+    "edr_freight_app:trains:view",
+    "View trains",
+  ),
+  perm(
+    "e1c00001-0001-4000-8000-000000000002",
+    "edr_freight_app:trains:create",
+    "Create train",
+  ),
+  perm(
+    "e1c00001-0001-4000-8000-000000000003",
+    "edr_freight_app:trains:update",
+    "Update train",
+  ),
+  perm(
+    "e1c00001-0001-4000-8000-000000000004",
+    "edr_freight_app:trains:delete",
+    "Delete train",
+  ),
+  perm(
+    "e1c00001-0001-4000-8000-000000000005",
+    "edr_freight_app:trains:assign_wagons",
+    "Assign wagons to train",
+  ),
+  perm(
+    "e1d00001-0001-4000-8000-000000000001",
+    "edr_freight_app:routes:view",
+    "View routes",
+  ),
+  perm(
+    "e1d00001-0001-4000-8000-000000000002",
+    "edr_freight_app:routes:create",
+    "Create route",
+  ),
+  perm(
+    "e1d00001-0001-4000-8000-000000000003",
+    "edr_freight_app:routes:update",
+    "Update route",
+  ),
+  perm(
+    "e1d00001-0001-4000-8000-000000000004",
+    "edr_freight_app:routes:delete",
+    "Delete route",
+  ),
+  perm(
+    "e1d00001-0001-4000-8000-000000000005",
+    "edr_freight_app:routes:hard_delete",
+    "Permanently delete route",
+  ),
+  perm(
+    "e1e00001-0001-4000-8000-000000000001",
+    "edr_freight_app:containers:view",
+    "View containers",
+  ),
+  perm(
+    "e1e00001-0001-4000-8000-000000000002",
+    "edr_freight_app:containers:create",
+    "Create container",
+  ),
+  perm(
+    "e1e00001-0001-4000-8000-000000000003",
+    "edr_freight_app:containers:update",
+    "Update container",
+  ),
+  perm(
+    "e1e00001-0001-4000-8000-000000000004",
+    "edr_freight_app:containers:delete",
+    "Delete container",
+  ),
+  perm(
+    "e1f00001-0001-4000-8000-000000000001",
+    "edr_freight_app:cargoes:view",
+    "View cargoes",
+  ),
+  perm(
+    "e1f00001-0001-4000-8000-000000000002",
+    "edr_freight_app:cargoes:create",
+    "Create cargo",
+  ),
+  perm(
+    "e1f00001-0001-4000-8000-000000000003",
+    "edr_freight_app:cargoes:update",
+    "Update cargo",
+  ),
+  perm(
+    "e1f00001-0001-4000-8000-000000000004",
+    "edr_freight_app:cargoes:delete",
+    "Delete cargo",
+  ),
   // NB: id prefixes must stay hex — 'e1g…' once crashed the boot seeder
   // (postgres: invalid input syntax for type uuid).
-  perm('e1900001-0001-4000-8000-000000000001', 'edr_freight_app:consignments:view', 'View consignments'),
-  perm('e1900001-0001-4000-8000-000000000002', 'edr_freight_app:consignments:create', 'Create consignment'),
+  perm(
+    "e1900001-0001-4000-8000-000000000001",
+    "edr_freight_app:consignments:view",
+    "View consignments",
+  ),
+  perm(
+    "e1900001-0001-4000-8000-000000000002",
+    "edr_freight_app:consignments:create",
+    "Create consignment",
+  ),
 ];
 
 // G. Fleet — road & telemetry
 export const FLEET_ROAD_PERMISSIONS: FreightPermissionSeed[] = [
-  perm('e2a00001-0001-4000-8000-000000000001', 'edr_freight_app:vehicles:view', 'View vehicles'),
-  perm('e2a00001-0001-4000-8000-000000000002', 'edr_freight_app:vehicles:create', 'Create vehicle'),
-  perm('e2a00001-0001-4000-8000-000000000003', 'edr_freight_app:vehicles:update', 'Update vehicle'),
-  perm('e2a00001-0001-4000-8000-000000000004', 'edr_freight_app:vehicles:delete', 'Delete vehicle'),
-  perm('e2b00001-0001-4000-8000-000000000001', 'edr_freight_app:drivers:view', 'View drivers'),
-  perm('e2b00001-0001-4000-8000-000000000002', 'edr_freight_app:drivers:create', 'Create driver'),
-  perm('e2b00001-0001-4000-8000-000000000003', 'edr_freight_app:drivers:update', 'Update driver'),
-  perm('e2b00001-0001-4000-8000-000000000004', 'edr_freight_app:drivers:delete', 'Delete driver'),
-  perm('e2c00001-0001-4000-8000-000000000001', 'edr_freight_app:tracking:view', 'Track vehicles'),
-  perm('e2c00001-0001-4000-8000-000000000002', 'edr_freight_app:tracking:manage', 'Manage GPS trackers'),
-  perm('e2d00001-0001-4000-8000-000000000001', 'edr_freight_app:fuel:view', 'View fuel purchases'),
-  perm('e2d00001-0001-4000-8000-000000000002', 'edr_freight_app:fuel:create', 'Create fuel purchase'),
-  perm('e2d00001-0001-4000-8000-000000000003', 'edr_freight_app:fuel:update', 'Update fuel purchase'),
-  perm('e2d00001-0001-4000-8000-000000000004', 'edr_freight_app:fuel:delete', 'Delete fuel purchase'),
-  perm('e2d00001-0001-4000-8000-000000000005', 'edr_freight_app:fuel:approve', 'Approve fuel purchase'),
-  perm('e2e00001-0001-4000-8000-000000000001', 'edr_freight_app:maintenance:view', 'View maintenance'),
-  perm('e2e00001-0001-4000-8000-000000000002', 'edr_freight_app:maintenance:create', 'Create maintenance'),
-  perm('e2e00001-0001-4000-8000-000000000003', 'edr_freight_app:maintenance:update', 'Update maintenance'),
-  perm('e2e00001-0001-4000-8000-000000000004', 'edr_freight_app:maintenance:delete', 'Delete maintenance'),
-  perm('e2e00001-0001-4000-8000-000000000005', 'edr_freight_app:maintenance:complete', 'Complete maintenance'),
-  perm('e2f00001-0001-4000-8000-000000000001', 'edr_freight_app:fleet_reports:view', 'View fleet financial reports'),
-  perm('e2f00001-0001-4000-8000-000000000002', 'edr_freight_app:fleet_reports:export', 'Export fleet financial reports'),
-  perm('e2000001-0001-4000-8000-000000000001', 'edr_freight_app:fleet_dashboard:view', 'View fleet dashboard'),
+  perm(
+    "e2a00001-0001-4000-8000-000000000001",
+    "edr_freight_app:vehicles:view",
+    "View vehicles",
+  ),
+  perm(
+    "e2a00001-0001-4000-8000-000000000002",
+    "edr_freight_app:vehicles:create",
+    "Create vehicle",
+  ),
+  perm(
+    "e2a00001-0001-4000-8000-000000000003",
+    "edr_freight_app:vehicles:update",
+    "Update vehicle",
+  ),
+  perm(
+    "e2a00001-0001-4000-8000-000000000004",
+    "edr_freight_app:vehicles:delete",
+    "Delete vehicle",
+  ),
+  perm(
+    "e2b00001-0001-4000-8000-000000000001",
+    "edr_freight_app:drivers:view",
+    "View drivers",
+  ),
+  perm(
+    "e2b00001-0001-4000-8000-000000000002",
+    "edr_freight_app:drivers:create",
+    "Create driver",
+  ),
+  perm(
+    "e2b00001-0001-4000-8000-000000000003",
+    "edr_freight_app:drivers:update",
+    "Update driver",
+  ),
+  perm(
+    "e2b00001-0001-4000-8000-000000000004",
+    "edr_freight_app:drivers:delete",
+    "Delete driver",
+  ),
+  perm(
+    "e2c00001-0001-4000-8000-000000000001",
+    "edr_freight_app:tracking:view",
+    "Track vehicles",
+  ),
+  perm(
+    "e2c00001-0001-4000-8000-000000000002",
+    "edr_freight_app:tracking:manage",
+    "Manage GPS trackers",
+  ),
+  perm(
+    "e2d00001-0001-4000-8000-000000000001",
+    "edr_freight_app:fuel:view",
+    "View fuel purchases",
+  ),
+  perm(
+    "e2d00001-0001-4000-8000-000000000002",
+    "edr_freight_app:fuel:create",
+    "Create fuel purchase",
+  ),
+  perm(
+    "e2d00001-0001-4000-8000-000000000003",
+    "edr_freight_app:fuel:update",
+    "Update fuel purchase",
+  ),
+  perm(
+    "e2d00001-0001-4000-8000-000000000004",
+    "edr_freight_app:fuel:delete",
+    "Delete fuel purchase",
+  ),
+  perm(
+    "e2e00001-0001-4000-8000-000000000001",
+    "edr_freight_app:maintenance:view",
+    "View maintenance",
+  ),
+  perm(
+    "e2e00001-0001-4000-8000-000000000002",
+    "edr_freight_app:maintenance:create",
+    "Create maintenance",
+  ),
+  perm(
+    "e2e00001-0001-4000-8000-000000000003",
+    "edr_freight_app:maintenance:update",
+    "Update maintenance",
+  ),
+  perm(
+    "e2e00001-0001-4000-8000-000000000004",
+    "edr_freight_app:maintenance:delete",
+    "Delete maintenance",
+  ),
+  perm(
+    "e2f00001-0001-4000-8000-000000000001",
+    "edr_freight_app:fleet_reports:view",
+    "View fleet financial reports",
+  ),
+  perm(
+    "e2f00001-0001-4000-8000-000000000002",
+    "edr_freight_app:fleet_reports:export",
+    "Export fleet financial reports",
+  ),
+  perm(
+    "e2000001-0001-4000-8000-000000000001",
+    "edr_freight_app:fleet_dashboard:view",
+    "View fleet dashboard",
+  ),
 ];
 
 // H. Warehouse management
 export const WAREHOUSE_PERMISSIONS: FreightPermissionSeed[] = [
-  perm('f1000001-0001-4000-8000-000000000001', 'edr_freight_app:warehouse_dashboard:view', 'View warehouse dashboard'),
-  perm('f1a00001-0001-4000-8000-000000000001', 'edr_freight_app:warehouses:view', 'View warehouses'),
-  perm('f1a00001-0001-4000-8000-000000000002', 'edr_freight_app:warehouses:create', 'Create warehouse'),
-  perm('f1a00001-0001-4000-8000-000000000003', 'edr_freight_app:warehouses:update', 'Update warehouse'),
-  perm('f1a00001-0001-4000-8000-000000000004', 'edr_freight_app:warehouses:delete', 'Delete warehouse'),
-  perm('f1b00001-0001-4000-8000-000000000001', 'edr_freight_app:warehouse_yards:view', 'View warehouse yards'),
-  perm('f1b00001-0001-4000-8000-000000000002', 'edr_freight_app:warehouse_yards:create', 'Create warehouse yard'),
-  perm('f1b00001-0001-4000-8000-000000000003', 'edr_freight_app:warehouse_yards:update', 'Update warehouse yard'),
-  perm('f1b00001-0001-4000-8000-000000000004', 'edr_freight_app:warehouse_yards:delete', 'Delete warehouse yard'),
-  perm('f1c00001-0001-4000-8000-000000000001', 'edr_freight_app:warehouse_zones:view', 'View warehouse zones'),
-  perm('f1c00001-0001-4000-8000-000000000002', 'edr_freight_app:warehouse_zones:create', 'Create warehouse zone'),
-  perm('f1c00001-0001-4000-8000-000000000003', 'edr_freight_app:warehouse_zones:update', 'Update warehouse zone'),
-  perm('f1d00001-0001-4000-8000-000000000001', 'edr_freight_app:warehouse_allocation_rules:view', 'View allocation rules'),
-  perm('f1d00001-0001-4000-8000-000000000002', 'edr_freight_app:warehouse_allocation_rules:create', 'Create allocation rule'),
-  perm('f1d00001-0001-4000-8000-000000000003', 'edr_freight_app:warehouse_allocation_rules:update', 'Update allocation rule'),
-  perm('f1d00001-0001-4000-8000-000000000004', 'edr_freight_app:warehouse_allocation_rules:delete', 'Delete allocation rule'),
-  perm('f1e00001-0001-4000-8000-000000000001', 'edr_freight_app:warehouse_fee_rules:view', 'View fee rules'),
-  perm('f1e00001-0001-4000-8000-000000000002', 'edr_freight_app:warehouse_fee_rules:create', 'Create fee rule'),
-  perm('f1e00001-0001-4000-8000-000000000003', 'edr_freight_app:warehouse_fee_rules:update', 'Update fee rule'),
-  perm('f1e00001-0001-4000-8000-000000000004', 'edr_freight_app:warehouse_fee_rules:delete', 'Delete fee rule'),
-  perm('f1f00001-0001-4000-8000-000000000001', 'edr_freight_app:warehouse_inspection_reports:view', 'View inspection reports'),
-  perm('f1f00001-0001-4000-8000-000000000002', 'edr_freight_app:warehouse_inspection_reports:create', 'Create inspection report'),
-  perm('f1f00001-0001-4000-8000-000000000003', 'edr_freight_app:warehouse_inspection_reports:update', 'Update inspection report'),
+  perm(
+    "f1000001-0001-4000-8000-000000000001",
+    "edr_freight_app:warehouse_dashboard:view",
+    "View warehouse dashboard",
+  ),
+  perm(
+    "f1a00001-0001-4000-8000-000000000001",
+    "edr_freight_app:warehouses:view",
+    "View warehouses",
+  ),
+  perm(
+    "f1a00001-0001-4000-8000-000000000002",
+    "edr_freight_app:warehouses:create",
+    "Create warehouse",
+  ),
+  perm(
+    "f1a00001-0001-4000-8000-000000000003",
+    "edr_freight_app:warehouses:update",
+    "Update warehouse",
+  ),
+  perm(
+    "f1a00001-0001-4000-8000-000000000004",
+    "edr_freight_app:warehouses:delete",
+    "Delete warehouse",
+  ),
+  perm(
+    "f1b00001-0001-4000-8000-000000000001",
+    "edr_freight_app:warehouse_yards:view",
+    "View warehouse yards",
+  ),
+  perm(
+    "f1b00001-0001-4000-8000-000000000002",
+    "edr_freight_app:warehouse_yards:create",
+    "Create warehouse yard",
+  ),
+  perm(
+    "f1b00001-0001-4000-8000-000000000003",
+    "edr_freight_app:warehouse_yards:update",
+    "Update warehouse yard",
+  ),
+  perm(
+    "f1b00001-0001-4000-8000-000000000004",
+    "edr_freight_app:warehouse_yards:delete",
+    "Delete warehouse yard",
+  ),
+  perm(
+    "f1c00001-0001-4000-8000-000000000001",
+    "edr_freight_app:warehouse_zones:view",
+    "View warehouse zones",
+  ),
+  perm(
+    "f1c00001-0001-4000-8000-000000000002",
+    "edr_freight_app:warehouse_zones:create",
+    "Create warehouse zone",
+  ),
+  perm(
+    "f1c00001-0001-4000-8000-000000000003",
+    "edr_freight_app:warehouse_zones:update",
+    "Update warehouse zone",
+  ),
+  perm(
+    "f1d00001-0001-4000-8000-000000000001",
+    "edr_freight_app:warehouse_allocation_rules:view",
+    "View allocation rules",
+  ),
+  perm(
+    "f1d00001-0001-4000-8000-000000000002",
+    "edr_freight_app:warehouse_allocation_rules:create",
+    "Create allocation rule",
+  ),
+  perm(
+    "f1d00001-0001-4000-8000-000000000003",
+    "edr_freight_app:warehouse_allocation_rules:update",
+    "Update allocation rule",
+  ),
+  perm(
+    "f1d00001-0001-4000-8000-000000000004",
+    "edr_freight_app:warehouse_allocation_rules:delete",
+    "Delete allocation rule",
+  ),
+  perm(
+    "f1e00001-0001-4000-8000-000000000001",
+    "edr_freight_app:warehouse_fee_rules:view",
+    "View fee rules",
+  ),
+  perm(
+    "f1e00001-0001-4000-8000-000000000002",
+    "edr_freight_app:warehouse_fee_rules:create",
+    "Create fee rule",
+  ),
+  perm(
+    "f1e00001-0001-4000-8000-000000000003",
+    "edr_freight_app:warehouse_fee_rules:update",
+    "Update fee rule",
+  ),
+  perm(
+    "f1e00001-0001-4000-8000-000000000004",
+    "edr_freight_app:warehouse_fee_rules:delete",
+    "Delete fee rule",
+  ),
+  perm(
+    "f1f00001-0001-4000-8000-000000000001",
+    "edr_freight_app:warehouse_inspection_reports:view",
+    "View inspection reports",
+  ),
+  perm(
+    "f1f00001-0001-4000-8000-000000000002",
+    "edr_freight_app:warehouse_inspection_reports:create",
+    "Create inspection report",
+  ),
+  perm(
+    "f1f00001-0001-4000-8000-000000000003",
+    "edr_freight_app:warehouse_inspection_reports:update",
+    "Update inspection report",
+  ),
 ];
 
 // I. Port & terminal — inventory movement + interchange + fee invoices
 export const PORT_TERMINAL_PERMISSIONS: FreightPermissionSeed[] = [
-  perm('f2a00001-0001-4000-8000-000000000001', 'edr_freight_app:warehouse_inventory:view', 'View terminal inventory'),
-  perm('f2a00001-0001-4000-8000-000000000002', 'edr_freight_app:warehouse_inventory:receive', 'Receive inventory'),
-  perm('f2a00001-0001-4000-8000-000000000003', 'edr_freight_app:warehouse_inventory:move', 'Move/store/reserve inventory'),
-  perm('f2a00001-0001-4000-8000-000000000004', 'edr_freight_app:warehouse_inventory:load', 'Load inventory'),
-  perm('f2a00001-0001-4000-8000-000000000005', 'edr_freight_app:warehouse_inventory:unload', 'Unload inventory'),
-  perm('f2a00001-0001-4000-8000-000000000006', 'edr_freight_app:warehouse_inventory:dispatch', 'Dispatch inventory'),
-  perm('f2a00001-0001-4000-8000-000000000007', 'edr_freight_app:warehouse_inventory:gate_pass', 'Gate-clearance inventory'),
-  perm('f2a00001-0001-4000-8000-000000000008', 'edr_freight_app:warehouse_inventory:release', 'Release inventory'),
-  perm('f2a00001-0001-4000-8000-000000000009', 'edr_freight_app:warehouse_inventory:deliver', 'Deliver inventory'),
-  perm('f2a00001-0001-4000-8000-00000000000a', 'edr_freight_app:warehouse_inventory:inspect', 'Inspect inventory'),
-  perm('f2b00001-0001-4000-8000-000000000001', 'edr_freight_app:interchange_documents:view', 'View interchange documents'),
-  perm('f2b00001-0001-4000-8000-000000000002', 'edr_freight_app:interchange_documents:generate', 'Generate interchange document'),
-  perm('f2b00001-0001-4000-8000-000000000003', 'edr_freight_app:interchange_documents:acknowledge', 'Acknowledge interchange document'),
-  perm('f2b00001-0001-4000-8000-000000000004', 'edr_freight_app:interchange_documents:dispute', 'Dispute interchange document'),
-  perm('f2b00001-0001-4000-8000-000000000005', 'edr_freight_app:interchange_documents:cancel', 'Cancel interchange document'),
-  perm('f2c00001-0001-4000-8000-000000000001', 'edr_freight_app:warehouse_fee_invoices:view', 'View warehouse fee invoices'),
-  perm('f2c00001-0001-4000-8000-000000000002', 'edr_freight_app:warehouse_fee_invoices:generate', 'Generate warehouse fee invoice'),
-  perm('f2c00001-0001-4000-8000-000000000003', 'edr_freight_app:warehouse_fee_invoices:cancel', 'Cancel warehouse fee invoice'),
-  perm('f2c00001-0001-4000-8000-000000000004', 'edr_freight_app:warehouse_fee_invoices:pay', 'Pay warehouse fee invoice'),
+  perm(
+    "f2a00001-0001-4000-8000-000000000001",
+    "edr_freight_app:warehouse_inventory:view",
+    "View terminal inventory",
+  ),
+  perm(
+    "f2a00001-0001-4000-8000-000000000002",
+    "edr_freight_app:warehouse_inventory:receive",
+    "Receive inventory",
+  ),
+  perm(
+    "f2a00001-0001-4000-8000-000000000003",
+    "edr_freight_app:warehouse_inventory:move",
+    "Move/store/reserve inventory",
+  ),
+  perm(
+    "f2a00001-0001-4000-8000-000000000004",
+    "edr_freight_app:warehouse_inventory:load",
+    "Load inventory",
+  ),
+  perm(
+    "f2a00001-0001-4000-8000-000000000005",
+    "edr_freight_app:warehouse_inventory:unload",
+    "Unload inventory",
+  ),
+  perm(
+    "f2a00001-0001-4000-8000-000000000006",
+    "edr_freight_app:warehouse_inventory:dispatch",
+    "Dispatch inventory",
+  ),
+  perm(
+    "f2a00001-0001-4000-8000-000000000007",
+    "edr_freight_app:warehouse_inventory:gate_pass",
+    "Gate-clearance inventory",
+  ),
+  perm(
+    "f2a00001-0001-4000-8000-000000000008",
+    "edr_freight_app:warehouse_inventory:release",
+    "Release inventory",
+  ),
+  perm(
+    "f2a00001-0001-4000-8000-000000000009",
+    "edr_freight_app:warehouse_inventory:deliver",
+    "Deliver inventory",
+  ),
+  perm(
+    "f2a00001-0001-4000-8000-00000000000a",
+    "edr_freight_app:warehouse_inventory:inspect",
+    "Inspect inventory",
+  ),
+  perm(
+    "f2b00001-0001-4000-8000-000000000001",
+    "edr_freight_app:interchange_documents:view",
+    "View interchange documents",
+  ),
+  perm(
+    "f2b00001-0001-4000-8000-000000000002",
+    "edr_freight_app:interchange_documents:generate",
+    "Generate interchange document",
+  ),
+  perm(
+    "f2b00001-0001-4000-8000-000000000003",
+    "edr_freight_app:interchange_documents:acknowledge",
+    "Acknowledge interchange document",
+  ),
+  perm(
+    "f2b00001-0001-4000-8000-000000000004",
+    "edr_freight_app:interchange_documents:dispute",
+    "Dispute interchange document",
+  ),
+  perm(
+    "f2b00001-0001-4000-8000-000000000005",
+    "edr_freight_app:interchange_documents:cancel",
+    "Cancel interchange document",
+  ),
+  perm(
+    "f2c00001-0001-4000-8000-000000000001",
+    "edr_freight_app:warehouse_fee_invoices:view",
+    "View warehouse fee invoices",
+  ),
+  perm(
+    "f2c00001-0001-4000-8000-000000000002",
+    "edr_freight_app:warehouse_fee_invoices:generate",
+    "Generate warehouse fee invoice",
+  ),
+  perm(
+    "f2c00001-0001-4000-8000-000000000003",
+    "edr_freight_app:warehouse_fee_invoices:cancel",
+    "Cancel warehouse fee invoice",
+  ),
+  perm(
+    "f2c00001-0001-4000-8000-000000000004",
+    "edr_freight_app:warehouse_fee_invoices:pay",
+    "Pay warehouse fee invoice",
+  ),
 ];
 
 // E'. Train-scheduling finer actions (augment existing view/manage)
 export const SCHEDULING_EXTRA_PERMISSIONS: FreightPermissionSeed[] = [
-  perm('a2a00001-0001-4000-8000-000000000001', 'edr_freight_app:train_scheduling:create', 'Create train schedule'),
-  perm('a2a00001-0001-4000-8000-000000000002', 'edr_freight_app:train_scheduling:update', 'Update train schedule'),
-  perm('a2a00001-0001-4000-8000-000000000003', 'edr_freight_app:train_scheduling:cancel', 'Cancel train schedule'),
-  perm('a2a00001-0001-4000-8000-000000000004', 'edr_freight_app:train_scheduling:reschedule', 'Reschedule train'),
-  perm('a2a00001-0001-4000-8000-000000000005', 'edr_freight_app:train_scheduling:rules_manage', 'Manage global scheduling rules'),
+  perm(
+    "a2a00001-0001-4000-8000-000000000001",
+    "edr_freight_app:train_scheduling:create",
+    "Create train schedule",
+  ),
+  perm(
+    "a2a00001-0001-4000-8000-000000000002",
+    "edr_freight_app:train_scheduling:update",
+    "Update train schedule",
+  ),
+  perm(
+    "a2a00001-0001-4000-8000-000000000003",
+    "edr_freight_app:train_scheduling:cancel",
+    "Cancel train schedule",
+  ),
+  perm(
+    "a2a00001-0001-4000-8000-000000000004",
+    "edr_freight_app:train_scheduling:reschedule",
+    "Reschedule train",
+  ),
+  perm(
+    "a2a00001-0001-4000-8000-000000000005",
+    "edr_freight_app:train_scheduling:rules_manage",
+    "Manage global scheduling rules",
+  ),
 ];
 
 // L. Administration & settings (split from the coarse admin umbrella)
 export const CONFIG_SETTINGS_PERMISSIONS: FreightPermissionSeed[] = [
-  perm('b4a00001-0001-4000-8000-000000000001', 'edr_freight_app:settings:file_upload:view', 'View file-upload settings'),
-  perm('b4a00001-0001-4000-8000-000000000002', 'edr_freight_app:settings:file_upload:manage', 'Manage file-upload settings'),
-  perm('b4b00001-0001-4000-8000-000000000001', 'edr_freight_app:settings:dropdown:view', 'View dropdown settings'),
-  perm('b4b00001-0001-4000-8000-000000000002', 'edr_freight_app:settings:dropdown:manage', 'Manage dropdown settings'),
-  perm('b4c00001-0001-4000-8000-000000000001', 'edr_freight_app:audit:view', 'View audit logs'),
+  perm(
+    "b4a00001-0001-4000-8000-000000000001",
+    "edr_freight_app:settings:file_upload:view",
+    "View file-upload settings",
+  ),
+  perm(
+    "b4a00001-0001-4000-8000-000000000002",
+    "edr_freight_app:settings:file_upload:manage",
+    "Manage file-upload settings",
+  ),
+  perm(
+    "b4b00001-0001-4000-8000-000000000001",
+    "edr_freight_app:settings:dropdown:view",
+    "View dropdown settings",
+  ),
+  perm(
+    "b4b00001-0001-4000-8000-000000000002",
+    "edr_freight_app:settings:dropdown:manage",
+    "Manage dropdown settings",
+  ),
+  perm(
+    "b4c00001-0001-4000-8000-000000000001",
+    "edr_freight_app:audit:view",
+    "View audit logs",
+  ),
 ];
 
 // M. Staff / IAM admin — NEW keys only. The employee_registration / role_assignment
 // / hierarchy_* / position_types:view keys are seeded separately in edr-freight.seed.ts.
 export const STAFF_IAM_PERMISSIONS: FreightPermissionSeed[] = [
-  perm('c2a00001-0001-4000-8000-000000000001', 'edr_freight_app:staff:roles:view', 'View roles'),
-  perm('c2a00001-0001-4000-8000-000000000002', 'edr_freight_app:staff:roles:create', 'Create role'),
-  perm('c2a00001-0001-4000-8000-000000000003', 'edr_freight_app:staff:roles:update', 'Update role'),
-  perm('c2a00001-0001-4000-8000-000000000004', 'edr_freight_app:staff:roles:delete', 'Delete role'),
-  perm('c2b00001-0001-4000-8000-000000000001', 'edr_freight_app:staff:permissions:view', 'View permission assignments'),
-  perm('c2b00001-0001-4000-8000-000000000002', 'edr_freight_app:staff:permissions:assign', 'Assign permissions'),
-  perm('c2c00001-0001-4000-8000-000000000001', 'edr_freight_app:position_types:create', 'Create position type'),
-  perm('c2c00001-0001-4000-8000-000000000002', 'edr_freight_app:position_types:update', 'Update position type'),
-  perm('c2c00001-0001-4000-8000-000000000003', 'edr_freight_app:position_types:delete', 'Delete position type'),
+  perm(
+    "c2a00001-0001-4000-8000-000000000001",
+    "edr_freight_app:staff:roles:view",
+    "View roles",
+  ),
+  perm(
+    "c2a00001-0001-4000-8000-000000000002",
+    "edr_freight_app:staff:roles:create",
+    "Create role",
+  ),
+  perm(
+    "c2a00001-0001-4000-8000-000000000003",
+    "edr_freight_app:staff:roles:update",
+    "Update role",
+  ),
+  perm(
+    "c2a00001-0001-4000-8000-000000000004",
+    "edr_freight_app:staff:roles:delete",
+    "Delete role",
+  ),
+  perm(
+    "c2b00001-0001-4000-8000-000000000001",
+    "edr_freight_app:staff:permissions:view",
+    "View permission assignments",
+  ),
+  perm(
+    "c2b00001-0001-4000-8000-000000000002",
+    "edr_freight_app:staff:permissions:assign",
+    "Assign permissions",
+  ),
+  perm(
+    "c2c00001-0001-4000-8000-000000000001",
+    "edr_freight_app:position_types:create",
+    "Create position type",
+  ),
+  perm(
+    "c2c00001-0001-4000-8000-000000000002",
+    "edr_freight_app:position_types:update",
+    "Update position type",
+  ),
+  perm(
+    "c2c00001-0001-4000-8000-000000000003",
+    "edr_freight_app:position_types:delete",
+    "Delete position type",
+  ),
+];
+
+// O. Granular splits of previously-shared keys: money/irreversible actions that
+// used to ride on a broader permission (staff_accept, train_scheduling:update,
+// the admin umbrella) get their own grant so departments can hold them apart.
+export const GRANULAR_SPLIT_PERMISSIONS: FreightPermissionSeed[] = [
+  perm(
+    "a5a00001-0001-4000-8000-000000000001",
+    "edr_freight_app:bookings:government_expedite",
+    "Expedite a government booking (bypass payment)",
+  ),
+  perm(
+    "a5b00001-0001-4000-8000-000000000001",
+    "edr_freight_app:contracts:edit_document",
+    "Edit contract document articles",
+  ),
+  perm(
+    "a5b00001-0001-4000-8000-000000000002",
+    "edr_freight_app:contracts:final_invoice_raise",
+    "Raise final invoice (GL DJ)",
+  ),
+  perm(
+    "a5b00001-0001-4000-8000-000000000003",
+    "edr_freight_app:contracts:final_invoice_confirm",
+    "Confirm final-invoice payment slip",
+  ),
+  perm(
+    "a5c00001-0001-4000-8000-000000000001",
+    "edr_freight_app:train_scheduling:dispatch",
+    "Finalize / dispatch a train schedule",
+  ),
+  perm(
+    "a5c00001-0001-4000-8000-000000000002",
+    "edr_freight_app:train_scheduling:mark_paid",
+    "Mark a reserved booking paid (staff)",
+  ),
+  perm(
+    "a5c00001-0001-4000-8000-000000000003",
+    "edr_freight_app:train_scheduling:expire_booking",
+    "Expire a reserved booking",
+  ),
+  perm(
+    "b4d00001-0001-4000-8000-000000000001",
+    "edr_freight_app:settings:exchange_rate:view",
+    "View exchange-rate settings",
+  ),
+  perm(
+    "b4d00001-0001-4000-8000-000000000002",
+    "edr_freight_app:settings:exchange_rate:manage",
+    "Set the USD-ETB fallback rate",
+  ),
+  perm(
+    "b4e00001-0001-4000-8000-000000000001",
+    "edr_freight_app:settings:contract_templates:view",
+    "View contract templates",
+  ),
+  perm(
+    "b4e00001-0001-4000-8000-000000000002",
+    "edr_freight_app:settings:contract_templates:manage",
+    "Edit contract templates & articles",
+  ),
+];
+
+// N. Previously-ungated staff surfaces (support inbox, procurement, compliance,
+// facilities) plus keys for routes that only had auth-no-permission gating
+// (staff directory, trade access) and the dashboard/report reads the frontend
+// already gated on but were never seeded (overview:view / reports:view).
+export const AUDIENCE_GAP_PERMISSIONS: FreightPermissionSeed[] = [
+  perm(
+    "a4a00001-0001-4000-8000-000000000001",
+    "edr_freight_app:support:agent_view",
+    "View support inbox (agent)",
+  ),
+  perm(
+    "a4a00001-0001-4000-8000-000000000002",
+    "edr_freight_app:support:agent_send",
+    "Reply / start support threads (agent)",
+  ),
+  perm(
+    "a4b00001-0001-4000-8000-000000000001",
+    "edr_freight_app:procurement:view",
+    "View procurement & asset lifecycle",
+  ),
+  perm(
+    "a4b00001-0001-4000-8000-000000000002",
+    "edr_freight_app:procurement:vendor_manage",
+    "Manage vendors",
+  ),
+  perm(
+    "a4b00001-0001-4000-8000-000000000003",
+    "edr_freight_app:procurement:acquisition_manage",
+    "Manage asset acquisitions",
+  ),
+  perm(
+    "a4b00001-0001-4000-8000-000000000004",
+    "edr_freight_app:procurement:disposal_manage",
+    "Manage asset disposals",
+  ),
+  perm(
+    "a4c00001-0001-4000-8000-000000000001",
+    "edr_freight_app:compliance:view",
+    "View vehicle compliance",
+  ),
+  perm(
+    "a4c00001-0001-4000-8000-000000000002",
+    "edr_freight_app:compliance:manage",
+    "Manage vehicle compliance",
+  ),
+  perm(
+    "a4d00001-0001-4000-8000-000000000001",
+    "edr_freight_app:facilities:view",
+    "View facilities",
+  ),
+  perm(
+    "a4d00001-0001-4000-8000-000000000002",
+    "edr_freight_app:facilities:manage",
+    "Manage facilities",
+  ),
+  perm(
+    "a4e00001-0001-4000-8000-000000000001",
+    "edr_freight_app:staff:users:view",
+    "List staff users (pickers)",
+  ),
+  perm(
+    "a4e00001-0001-4000-8000-000000000002",
+    "edr_freight_app:trade_access:view",
+    "View trade-direction access",
+  ),
+  perm(
+    "a4e00001-0001-4000-8000-000000000003",
+    "edr_freight_app:trade_access:manage",
+    "Manage trade-direction access",
+  ),
+  perm(
+    "a4f00001-0001-4000-8000-000000000001",
+    "edr_freight_app:overview:view",
+    "View backoffice overview dashboard",
+  ),
+  perm(
+    "a4f00001-0001-4000-8000-000000000002",
+    "edr_freight_app:reports:view",
+    "Run backoffice reports",
+  ),
 ];
 
 export const ADVANCED_BACKOFFICE_PERMISSIONS: FreightPermissionSeed[] = [
@@ -397,6 +1337,8 @@ export const ADVANCED_BACKOFFICE_PERMISSIONS: FreightPermissionSeed[] = [
   ...SCHEDULING_EXTRA_PERMISSIONS,
   ...CONFIG_SETTINGS_PERMISSIONS,
   ...STAFF_IAM_PERMISSIONS,
+  ...AUDIENCE_GAP_PERMISSIONS,
+  ...GRANULAR_SPLIT_PERMISSIONS,
 ];
 
 export const BOOKING_RULE_ENGINE_PERMISSIONS = [
@@ -407,77 +1349,87 @@ export const BOOKING_RULE_ENGINE_PERMISSIONS = [
   ...ADVANCED_BACKOFFICE_PERMISSIONS,
 ];
 
-export const BOOKING_RULE_ENGINE_PERMISSION_KEYS = BOOKING_RULE_ENGINE_PERMISSIONS.map(
-  (p) => p.key,
-);
+export const BOOKING_RULE_ENGINE_PERMISSION_KEYS =
+  BOOKING_RULE_ENGINE_PERMISSIONS.map((p) => p.key);
 
 export const FREIGHT_PERMS = {
   bookings: {
-    view: 'edr_freight_app:bookings:view',
-    create: 'edr_freight_app:bookings:create',
-    clearanceView: 'edr_freight_app:bookings:clearance_view',
-    staffAccept: 'edr_freight_app:bookings:staff_accept',
-    requestChanges: 'edr_freight_app:bookings:request_changes',
-    reject: 'edr_freight_app:bookings:reject',
-    approveLineStaff: 'edr_freight_app:bookings:approve_line_staff',
-    approveDirector: 'edr_freight_app:bookings:approve_director',
-    approveCeo: 'edr_freight_app:bookings:approve_ceo',
-    rejectApproval: 'edr_freight_app:bookings:reject_approval',
-    generateContract: 'edr_freight_app:bookings:generate_contract',
-    signStaff: 'edr_freight_app:bookings:sign_staff',
-    operations: 'edr_freight_app:bookings:operations',
-    cancel: 'edr_freight_app:bookings:cancel',
-    reviewDocuments: 'edr_freight_app:bookings:review_documents',
-    uploadClearanceOutput: 'edr_freight_app:bookings:upload_clearance_output',
-    finalizeClearance: 'edr_freight_app:bookings:finalize_clearance',
-    docReviewAlert: 'edr_freight_app:bookings:doc_review_alert',
+    view: "edr_freight_app:bookings:view",
+    create: "edr_freight_app:bookings:create",
+    clearanceView: "edr_freight_app:bookings:clearance_view",
+    staffAccept: "edr_freight_app:bookings:staff_accept",
+    requestChanges: "edr_freight_app:bookings:request_changes",
+    reject: "edr_freight_app:bookings:reject",
+    approveLineStaff: "edr_freight_app:bookings:approve_line_staff",
+    approveDirector: "edr_freight_app:bookings:approve_director",
+    approveCeo: "edr_freight_app:bookings:approve_ceo",
+    rejectApproval: "edr_freight_app:bookings:reject_approval",
+    generateContract: "edr_freight_app:bookings:generate_contract",
+    signStaff: "edr_freight_app:bookings:sign_staff",
+    operations: "edr_freight_app:bookings:operations",
+    cancel: "edr_freight_app:bookings:cancel",
+    reviewDocuments: "edr_freight_app:bookings:review_documents",
+    uploadClearanceOutput: "edr_freight_app:bookings:upload_clearance_output",
+    finalizeClearance: "edr_freight_app:bookings:finalize_clearance",
+    docReviewAlert: "edr_freight_app:bookings:doc_review_alert",
+    governmentExpedite: "edr_freight_app:bookings:government_expedite",
+    wagonCancellationView: "edr_freight_app:bookings:wagon_cancellation_view",
+    wagonCancellationVoid: "edr_freight_app:bookings:wagon_cancellation_void",
+    wagonCancellationRebook:
+      "edr_freight_app:bookings:wagon_cancellation_rebook",
   },
   contracts: {
-    view: 'edr_freight_app:contracts:view',
+    view: "edr_freight_app:contracts:view",
     staffAccept: {
-      bulk: 'edr_freight_app:contracts:staff_accept:bulk',
-      container: 'edr_freight_app:contracts:staff_accept:container',
+      bulk: "edr_freight_app:contracts:staff_accept:bulk",
+      container: "edr_freight_app:contracts:staff_accept:container",
     },
     requestChanges: {
-      bulk: 'edr_freight_app:contracts:request_changes:bulk',
-      container: 'edr_freight_app:contracts:request_changes:container',
+      bulk: "edr_freight_app:contracts:request_changes:bulk",
+      container: "edr_freight_app:contracts:request_changes:container",
     },
     reject: {
-      bulk: 'edr_freight_app:contracts:reject:bulk',
-      container: 'edr_freight_app:contracts:reject:container',
+      bulk: "edr_freight_app:contracts:reject:bulk",
+      container: "edr_freight_app:contracts:reject:container",
     },
-    approveLineStaff: 'edr_freight_app:contracts:approve_line_staff',
-    approveDirector: 'edr_freight_app:contracts:approve_director',
-    approveCeo: 'edr_freight_app:contracts:approve_ceo',
-    hazardousApprovalOne: 'edr_freight_app:contracts:hazardous_approval_one',
-    hazardousApprovalTwo: 'edr_freight_app:contracts:hazardous_approval_two',
-    generateContract: 'edr_freight_app:contracts:generate_contract',
+    approveLineStaff: "edr_freight_app:contracts:approve_line_staff",
+    approveDirector: "edr_freight_app:contracts:approve_director",
+    approveCeo: "edr_freight_app:contracts:approve_ceo",
+    hazardousApprovalOne: "edr_freight_app:contracts:hazardous_approval_one",
+    hazardousApprovalTwo: "edr_freight_app:contracts:hazardous_approval_two",
+    generateContract: "edr_freight_app:contracts:generate_contract",
     signStaff: {
-      bulk: 'edr_freight_app:contracts:sign_staff:bulk',
-      container: 'edr_freight_app:contracts:sign_staff:container',
+      bulk: "edr_freight_app:contracts:sign_staff:bulk",
+      container: "edr_freight_app:contracts:sign_staff:container",
     },
-    clearanceReview: 'edr_freight_app:contracts:clearance_review',
-    finalizeClearance: 'edr_freight_app:contracts:finalize_clearance',
-    createBooking: 'edr_freight_app:contracts:create_booking',
-    opsClearanceReview: 'edr_freight_app:contracts:ops_clearance_review',
-    clearanceEtActions: 'edr_freight_app:contracts:clearance_et_actions',
-    clearanceDjActions: 'edr_freight_app:contracts:clearance_dj_actions',
-    clearanceDutyAdvise: 'edr_freight_app:contracts:clearance_duty_advise',
-    suspend: 'edr_freight_app:contracts:suspend',
+    clearanceReview: "edr_freight_app:contracts:clearance_review",
+    finalizeClearance: "edr_freight_app:contracts:finalize_clearance",
+    createBooking: "edr_freight_app:contracts:create_booking",
+    opsClearanceReview: "edr_freight_app:contracts:ops_clearance_review",
+    clearanceEtActions: "edr_freight_app:contracts:clearance_et_actions",
+    clearanceDjActions: "edr_freight_app:contracts:clearance_dj_actions",
+    clearanceDutyAdvise: "edr_freight_app:contracts:clearance_duty_advise",
+    suspend: "edr_freight_app:contracts:suspend",
+    editDocument: "edr_freight_app:contracts:edit_document",
+    finalInvoiceRaise: "edr_freight_app:contracts:final_invoice_raise",
+    finalInvoiceConfirm: "edr_freight_app:contracts:final_invoice_confirm",
   },
   trainScheduling: {
-    view: 'edr_freight_app:train_scheduling:view',
-    create: 'edr_freight_app:train_scheduling:create',
-    update: 'edr_freight_app:train_scheduling:update',
-    cancel: 'edr_freight_app:train_scheduling:cancel',
-    reschedule: 'edr_freight_app:train_scheduling:reschedule',
-    rulesManage: 'edr_freight_app:train_scheduling:rules_manage',
+    view: "edr_freight_app:train_scheduling:view",
+    create: "edr_freight_app:train_scheduling:create",
+    update: "edr_freight_app:train_scheduling:update",
+    cancel: "edr_freight_app:train_scheduling:cancel",
+    reschedule: "edr_freight_app:train_scheduling:reschedule",
+    rulesManage: "edr_freight_app:train_scheduling:rules_manage",
+    dispatch: "edr_freight_app:train_scheduling:dispatch",
+    markPaid: "edr_freight_app:train_scheduling:mark_paid",
+    expireBooking: "edr_freight_app:train_scheduling:expire_booking",
   },
   fleet: {
-    view: 'edr_freight_app:fleet:view',
-    manage: 'edr_freight_app:fleet:manage',
+    view: "edr_freight_app:fleet:view",
+    manage: "edr_freight_app:fleet:manage",
   },
-  admin: 'edr_freight_app:admin',
+  admin: "edr_freight_app:admin",
   ruleEngine: {
     view: (slug: RuleEngineResourceSlug) =>
       `edr_freight_app:rule_engine:${slugToResourceKey(slug)}:view`,
@@ -491,289 +1443,322 @@ export const FREIGHT_PERMS = {
       `edr_freight_app:rule_engine:${slugToResourceKey(slug)}:approve`,
   },
   allocation: {
-    manage: 'edr_freight_app:allocation:manage',
+    manage: "edr_freight_app:allocation:manage",
   },
   customers: {
-    view: 'edr_freight_app:customers:view',
-    create: 'edr_freight_app:customers:create',
-    update: 'edr_freight_app:customers:update',
-    deactivate: 'edr_freight_app:customers:deactivate',
-    verify: 'edr_freight_app:customers:verify',
-    resetPassword: 'edr_freight_app:customers:reset-password',
+    view: "edr_freight_app:customers:view",
+    create: "edr_freight_app:customers:create",
+    update: "edr_freight_app:customers:update",
+    deactivate: "edr_freight_app:customers:deactivate",
+    verify: "edr_freight_app:customers:verify",
+    resetPassword: "edr_freight_app:customers:reset-password",
   },
   payments: {
-    view: 'edr_freight_app:payments:view',
-    verify: 'edr_freight_app:payments:verify',
-    refund: 'edr_freight_app:payments:refund',
+    view: "edr_freight_app:payments:view",
   },
   invoices: {
-    view: 'edr_freight_app:invoices:view',
-    create: 'edr_freight_app:invoices:create',
-    cancel: 'edr_freight_app:invoices:cancel',
-    export: 'edr_freight_app:invoices:export',
+    view: "edr_freight_app:invoices:view",
+    export: "edr_freight_app:invoices:export",
   },
   firstMile: {
-    view: 'edr_freight_app:first_mile:view',
-    accept: 'edr_freight_app:first_mile:accept',
-    create: 'edr_freight_app:first_mile:create',
-    update: 'edr_freight_app:first_mile:update',
-    delete: 'edr_freight_app:first_mile:delete',
-    assignVehicles: 'edr_freight_app:first_mile:assign_vehicles',
-    setDistances: 'edr_freight_app:first_mile:set_distances',
-    generateInvoice: 'edr_freight_app:first_mile:generate_invoice',
+    view: "edr_freight_app:first_mile:view",
+    accept: "edr_freight_app:first_mile:accept",
+    create: "edr_freight_app:first_mile:create",
+    update: "edr_freight_app:first_mile:update",
+    delete: "edr_freight_app:first_mile:delete",
+    assignVehicles: "edr_freight_app:first_mile:assign_vehicles",
+    setDistances: "edr_freight_app:first_mile:set_distances",
+    generateInvoice: "edr_freight_app:first_mile:generate_invoice",
   },
   lastMile: {
-    view: 'edr_freight_app:last_mile:view',
-    accept: 'edr_freight_app:last_mile:accept',
-    create: 'edr_freight_app:last_mile:create',
-    update: 'edr_freight_app:last_mile:update',
-    delete: 'edr_freight_app:last_mile:delete',
-    assignVehicles: 'edr_freight_app:last_mile:assign_vehicles',
-    setDistances: 'edr_freight_app:last_mile:set_distances',
-    generateInvoice: 'edr_freight_app:last_mile:generate_invoice',
+    view: "edr_freight_app:last_mile:view",
+    accept: "edr_freight_app:last_mile:accept",
+    create: "edr_freight_app:last_mile:create",
+    update: "edr_freight_app:last_mile:update",
+    delete: "edr_freight_app:last_mile:delete",
+    assignVehicles: "edr_freight_app:last_mile:assign_vehicles",
+    setDistances: "edr_freight_app:last_mile:set_distances",
+    generateInvoice: "edr_freight_app:last_mile:generate_invoice",
     // Pre-approval confirmation stage (Truck & Machinery department): view/review
     // a submitted request, approve/reject it.
-    requestView: 'edr_freight_app:last_mile:request_view',
-    requestReview: 'edr_freight_app:last_mile:request_review',
-    requestApprove: 'edr_freight_app:last_mile:request_approve',
+    requestView: "edr_freight_app:last_mile:request_view",
+    requestReview: "edr_freight_app:last_mile:request_review",
+    requestApprove: "edr_freight_app:last_mile:request_approve",
   },
   locomotives: {
-    view: 'edr_freight_app:locomotives:view',
-    create: 'edr_freight_app:locomotives:create',
-    update: 'edr_freight_app:locomotives:update',
-    delete: 'edr_freight_app:locomotives:delete',
+    view: "edr_freight_app:locomotives:view",
+    create: "edr_freight_app:locomotives:create",
+    update: "edr_freight_app:locomotives:update",
+    delete: "edr_freight_app:locomotives:delete",
     /**
      * Permanently purge the row — irreversible, and separate from `delete`
      * (which only decommissions) so it can be granted to far fewer people.
      */
-    hardDelete: 'edr_freight_app:locomotives:hard_delete',
+    hardDelete: "edr_freight_app:locomotives:hard_delete",
   },
   wagons: {
-    view: 'edr_freight_app:wagons:view',
-    create: 'edr_freight_app:wagons:create',
-    update: 'edr_freight_app:wagons:update',
-    delete: 'edr_freight_app:wagons:delete',
+    view: "edr_freight_app:wagons:view",
+    create: "edr_freight_app:wagons:create",
+    update: "edr_freight_app:wagons:update",
+    delete: "edr_freight_app:wagons:delete",
     /** Permanently purge the row — irreversible; see locomotives.hardDelete. */
-    hardDelete: 'edr_freight_app:wagons:hard_delete',
+    hardDelete: "edr_freight_app:wagons:hard_delete",
     // Requester creates a transfer request; OCC fulfils it (picks the wagons and
     // executes the move). Distinct keys so OCC can hold fulfil without request.
-    transferRequest: 'edr_freight_app:wagons:transfer_request',
-    transferFulfill: 'edr_freight_app:wagons:transfer_fulfill',
+    transferRequest: "edr_freight_app:wagons:transfer_request",
+    transferFulfill: "edr_freight_app:wagons:transfer_fulfill",
     /** Open the transfer-requests desk (list + detail). */
-    transferView: 'edr_freight_app:wagons:transfer_view',
+    transferView: "edr_freight_app:wagons:transfer_view",
     /** Withdraw a request that has not moved any wagon yet. */
-    transferCancel: 'edr_freight_app:wagons:transfer_cancel',
+    transferCancel: "edr_freight_app:wagons:transfer_cancel",
     /** End a request short — anyone who can fulfil may also do this. */
-    transferCloseShort: 'edr_freight_app:wagons:transfer_close_short',
+    transferCloseShort: "edr_freight_app:wagons:transfer_close_short",
     // Admin: read every staffer's transfer history. Without it, a user only sees
     // their own (the /history endpoint uses the caller id, backend-enforced).
-    transferHistoryAll: 'edr_freight_app:wagons:transfer_history_all',
+    transferHistoryAll: "edr_freight_app:wagons:transfer_history_all",
   },
   trains: {
-    view: 'edr_freight_app:trains:view',
-    create: 'edr_freight_app:trains:create',
-    update: 'edr_freight_app:trains:update',
-    delete: 'edr_freight_app:trains:delete',
-    assignWagons: 'edr_freight_app:trains:assign_wagons',
+    view: "edr_freight_app:trains:view",
+    create: "edr_freight_app:trains:create",
+    update: "edr_freight_app:trains:update",
+    delete: "edr_freight_app:trains:delete",
+    assignWagons: "edr_freight_app:trains:assign_wagons",
   },
   routes: {
-    view: 'edr_freight_app:routes:view',
-    create: 'edr_freight_app:routes:create',
-    update: 'edr_freight_app:routes:update',
-    delete: 'edr_freight_app:routes:delete',
+    view: "edr_freight_app:routes:view",
+    create: "edr_freight_app:routes:create",
+    update: "edr_freight_app:routes:update",
+    delete: "edr_freight_app:routes:delete",
     /** Permanently purge the row — irreversible; see locomotives.hardDelete. */
-    hardDelete: 'edr_freight_app:routes:hard_delete',
+    hardDelete: "edr_freight_app:routes:hard_delete",
   },
   containers: {
-    view: 'edr_freight_app:containers:view',
-    create: 'edr_freight_app:containers:create',
-    update: 'edr_freight_app:containers:update',
-    delete: 'edr_freight_app:containers:delete',
+    view: "edr_freight_app:containers:view",
+    create: "edr_freight_app:containers:create",
+    update: "edr_freight_app:containers:update",
+    delete: "edr_freight_app:containers:delete",
   },
   cargoes: {
-    view: 'edr_freight_app:cargoes:view',
-    create: 'edr_freight_app:cargoes:create',
-    update: 'edr_freight_app:cargoes:update',
-    delete: 'edr_freight_app:cargoes:delete',
+    view: "edr_freight_app:cargoes:view",
+    create: "edr_freight_app:cargoes:create",
+    update: "edr_freight_app:cargoes:update",
+    delete: "edr_freight_app:cargoes:delete",
   },
   consignments: {
-    view: 'edr_freight_app:consignments:view',
-    create: 'edr_freight_app:consignments:create',
+    view: "edr_freight_app:consignments:view",
+    create: "edr_freight_app:consignments:create",
   },
   vehicles: {
-    view: 'edr_freight_app:vehicles:view',
-    create: 'edr_freight_app:vehicles:create',
-    update: 'edr_freight_app:vehicles:update',
-    delete: 'edr_freight_app:vehicles:delete',
+    view: "edr_freight_app:vehicles:view",
+    create: "edr_freight_app:vehicles:create",
+    update: "edr_freight_app:vehicles:update",
+    delete: "edr_freight_app:vehicles:delete",
   },
   drivers: {
-    view: 'edr_freight_app:drivers:view',
-    create: 'edr_freight_app:drivers:create',
-    update: 'edr_freight_app:drivers:update',
-    delete: 'edr_freight_app:drivers:delete',
+    view: "edr_freight_app:drivers:view",
+    create: "edr_freight_app:drivers:create",
+    update: "edr_freight_app:drivers:update",
+    delete: "edr_freight_app:drivers:delete",
   },
   tracking: {
-    view: 'edr_freight_app:tracking:view',
-    manage: 'edr_freight_app:tracking:manage',
+    view: "edr_freight_app:tracking:view",
+    manage: "edr_freight_app:tracking:manage",
   },
   fuel: {
-    view: 'edr_freight_app:fuel:view',
-    create: 'edr_freight_app:fuel:create',
-    update: 'edr_freight_app:fuel:update',
-    delete: 'edr_freight_app:fuel:delete',
-    approve: 'edr_freight_app:fuel:approve',
+    view: "edr_freight_app:fuel:view",
+    create: "edr_freight_app:fuel:create",
+    update: "edr_freight_app:fuel:update",
+    delete: "edr_freight_app:fuel:delete",
   },
   maintenance: {
-    view: 'edr_freight_app:maintenance:view',
-    create: 'edr_freight_app:maintenance:create',
-    update: 'edr_freight_app:maintenance:update',
-    delete: 'edr_freight_app:maintenance:delete',
-    complete: 'edr_freight_app:maintenance:complete',
+    view: "edr_freight_app:maintenance:view",
+    create: "edr_freight_app:maintenance:create",
+    update: "edr_freight_app:maintenance:update",
+    delete: "edr_freight_app:maintenance:delete",
   },
   fleetReports: {
-    view: 'edr_freight_app:fleet_reports:view',
-    export: 'edr_freight_app:fleet_reports:export',
+    view: "edr_freight_app:fleet_reports:view",
+    export: "edr_freight_app:fleet_reports:export",
   },
   fleetDashboard: {
-    view: 'edr_freight_app:fleet_dashboard:view',
+    view: "edr_freight_app:fleet_dashboard:view",
   },
   warehouseDashboard: {
-    view: 'edr_freight_app:warehouse_dashboard:view',
+    view: "edr_freight_app:warehouse_dashboard:view",
   },
   warehouses: {
-    view: 'edr_freight_app:warehouses:view',
-    create: 'edr_freight_app:warehouses:create',
-    update: 'edr_freight_app:warehouses:update',
-    delete: 'edr_freight_app:warehouses:delete',
+    view: "edr_freight_app:warehouses:view",
+    create: "edr_freight_app:warehouses:create",
+    update: "edr_freight_app:warehouses:update",
+    delete: "edr_freight_app:warehouses:delete",
   },
   warehouseYards: {
-    view: 'edr_freight_app:warehouse_yards:view',
-    create: 'edr_freight_app:warehouse_yards:create',
-    update: 'edr_freight_app:warehouse_yards:update',
-    delete: 'edr_freight_app:warehouse_yards:delete',
+    view: "edr_freight_app:warehouse_yards:view",
+    create: "edr_freight_app:warehouse_yards:create",
+    update: "edr_freight_app:warehouse_yards:update",
+    delete: "edr_freight_app:warehouse_yards:delete",
   },
   warehouseZones: {
-    view: 'edr_freight_app:warehouse_zones:view',
-    create: 'edr_freight_app:warehouse_zones:create',
-    update: 'edr_freight_app:warehouse_zones:update',
+    view: "edr_freight_app:warehouse_zones:view",
+    create: "edr_freight_app:warehouse_zones:create",
+    update: "edr_freight_app:warehouse_zones:update",
   },
   warehouseAllocationRules: {
-    view: 'edr_freight_app:warehouse_allocation_rules:view',
-    create: 'edr_freight_app:warehouse_allocation_rules:create',
-    update: 'edr_freight_app:warehouse_allocation_rules:update',
-    delete: 'edr_freight_app:warehouse_allocation_rules:delete',
+    view: "edr_freight_app:warehouse_allocation_rules:view",
+    create: "edr_freight_app:warehouse_allocation_rules:create",
+    update: "edr_freight_app:warehouse_allocation_rules:update",
+    delete: "edr_freight_app:warehouse_allocation_rules:delete",
   },
   warehouseFeeRules: {
-    view: 'edr_freight_app:warehouse_fee_rules:view',
-    create: 'edr_freight_app:warehouse_fee_rules:create',
-    update: 'edr_freight_app:warehouse_fee_rules:update',
-    delete: 'edr_freight_app:warehouse_fee_rules:delete',
+    view: "edr_freight_app:warehouse_fee_rules:view",
+    create: "edr_freight_app:warehouse_fee_rules:create",
+    update: "edr_freight_app:warehouse_fee_rules:update",
+    delete: "edr_freight_app:warehouse_fee_rules:delete",
   },
   warehouseInspectionReports: {
-    view: 'edr_freight_app:warehouse_inspection_reports:view',
-    create: 'edr_freight_app:warehouse_inspection_reports:create',
-    update: 'edr_freight_app:warehouse_inspection_reports:update',
+    view: "edr_freight_app:warehouse_inspection_reports:view",
+    create: "edr_freight_app:warehouse_inspection_reports:create",
+    update: "edr_freight_app:warehouse_inspection_reports:update",
   },
   warehouseInventory: {
-    view: 'edr_freight_app:warehouse_inventory:view',
-    receive: 'edr_freight_app:warehouse_inventory:receive',
-    move: 'edr_freight_app:warehouse_inventory:move',
-    load: 'edr_freight_app:warehouse_inventory:load',
-    unload: 'edr_freight_app:warehouse_inventory:unload',
-    dispatch: 'edr_freight_app:warehouse_inventory:dispatch',
-    gatePass: 'edr_freight_app:warehouse_inventory:gate_pass',
-    release: 'edr_freight_app:warehouse_inventory:release',
-    deliver: 'edr_freight_app:warehouse_inventory:deliver',
-    inspect: 'edr_freight_app:warehouse_inventory:inspect',
+    view: "edr_freight_app:warehouse_inventory:view",
+    receive: "edr_freight_app:warehouse_inventory:receive",
+    move: "edr_freight_app:warehouse_inventory:move",
+    load: "edr_freight_app:warehouse_inventory:load",
+    unload: "edr_freight_app:warehouse_inventory:unload",
+    dispatch: "edr_freight_app:warehouse_inventory:dispatch",
+    gatePass: "edr_freight_app:warehouse_inventory:gate_pass",
+    release: "edr_freight_app:warehouse_inventory:release",
+    deliver: "edr_freight_app:warehouse_inventory:deliver",
+    inspect: "edr_freight_app:warehouse_inventory:inspect",
   },
   interchangeDocuments: {
-    view: 'edr_freight_app:interchange_documents:view',
-    generate: 'edr_freight_app:interchange_documents:generate',
-    acknowledge: 'edr_freight_app:interchange_documents:acknowledge',
-    dispute: 'edr_freight_app:interchange_documents:dispute',
-    cancel: 'edr_freight_app:interchange_documents:cancel',
+    view: "edr_freight_app:interchange_documents:view",
+    generate: "edr_freight_app:interchange_documents:generate",
+    acknowledge: "edr_freight_app:interchange_documents:acknowledge",
+    dispute: "edr_freight_app:interchange_documents:dispute",
+    cancel: "edr_freight_app:interchange_documents:cancel",
   },
   warehouseFeeInvoices: {
-    view: 'edr_freight_app:warehouse_fee_invoices:view',
-    generate: 'edr_freight_app:warehouse_fee_invoices:generate',
-    cancel: 'edr_freight_app:warehouse_fee_invoices:cancel',
-    pay: 'edr_freight_app:warehouse_fee_invoices:pay',
+    view: "edr_freight_app:warehouse_fee_invoices:view",
+    generate: "edr_freight_app:warehouse_fee_invoices:generate",
+    cancel: "edr_freight_app:warehouse_fee_invoices:cancel",
+    pay: "edr_freight_app:warehouse_fee_invoices:pay",
   },
   settings: {
     fileUpload: {
-      view: 'edr_freight_app:settings:file_upload:view',
-      manage: 'edr_freight_app:settings:file_upload:manage',
+      view: "edr_freight_app:settings:file_upload:view",
+      manage: "edr_freight_app:settings:file_upload:manage",
     },
     dropdown: {
-      view: 'edr_freight_app:settings:dropdown:view',
-      manage: 'edr_freight_app:settings:dropdown:manage',
+      view: "edr_freight_app:settings:dropdown:view",
+      manage: "edr_freight_app:settings:dropdown:manage",
+    },
+    exchangeRate: {
+      view: "edr_freight_app:settings:exchange_rate:view",
+      manage: "edr_freight_app:settings:exchange_rate:manage",
+    },
+    contractTemplates: {
+      view: "edr_freight_app:settings:contract_templates:view",
+      manage: "edr_freight_app:settings:contract_templates:manage",
     },
   },
   audit: {
-    view: 'edr_freight_app:audit:view',
+    view: "edr_freight_app:audit:view",
+  },
+  support: {
+    agentView: "edr_freight_app:support:agent_view",
+    agentSend: "edr_freight_app:support:agent_send",
+  },
+  procurement: {
+    view: "edr_freight_app:procurement:view",
+    vendorManage: "edr_freight_app:procurement:vendor_manage",
+    acquisitionManage: "edr_freight_app:procurement:acquisition_manage",
+    disposalManage: "edr_freight_app:procurement:disposal_manage",
+  },
+  compliance: {
+    view: "edr_freight_app:compliance:view",
+    manage: "edr_freight_app:compliance:manage",
+  },
+  facilities: {
+    view: "edr_freight_app:facilities:view",
+    manage: "edr_freight_app:facilities:manage",
+  },
+  tradeAccess: {
+    view: "edr_freight_app:trade_access:view",
+    manage: "edr_freight_app:trade_access:manage",
+  },
+  overview: {
+    view: "edr_freight_app:overview:view",
+  },
+  reports: {
+    view: "edr_freight_app:reports:view",
   },
   staff: {
+    users: {
+      view: "edr_freight_app:staff:users:view",
+    },
     roles: {
-      view: 'edr_freight_app:staff:roles:view',
-      create: 'edr_freight_app:staff:roles:create',
-      update: 'edr_freight_app:staff:roles:update',
-      delete: 'edr_freight_app:staff:roles:delete',
+      view: "edr_freight_app:staff:roles:view",
+      create: "edr_freight_app:staff:roles:create",
+      update: "edr_freight_app:staff:roles:update",
+      delete: "edr_freight_app:staff:roles:delete",
     },
     permissions: {
-      view: 'edr_freight_app:staff:permissions:view',
-      assign: 'edr_freight_app:staff:permissions:assign',
+      view: "edr_freight_app:staff:permissions:view",
+      assign: "edr_freight_app:staff:permissions:assign",
     },
     // Seeded in edr-freight.seed.ts (EDR_FREIGHT_PERMISSIONS) — surfaced here for gating.
     employeeRegistration: {
-      view: 'edr_freight_app:employee_registration:view',
-      create: 'edr_freight_app:employee_registration:create',
-      update: 'edr_freight_app:employee_registration:update',
-      activate: 'edr_freight_app:employee_registration:activate',
-      deactivate: 'edr_freight_app:employee_registration:deactivate',
+      view: "edr_freight_app:employee_registration:view",
+      create: "edr_freight_app:employee_registration:create",
+      update: "edr_freight_app:employee_registration:update",
+      activate: "edr_freight_app:employee_registration:activate",
+      deactivate: "edr_freight_app:employee_registration:deactivate",
     },
     roleAssignment: {
-      view: 'edr_freight_app:role_assignment:view',
-      assign: 'edr_freight_app:role_assignment:assign',
-      replace: 'edr_freight_app:role_assignment:replace',
+      view: "edr_freight_app:role_assignment:view",
+      assign: "edr_freight_app:role_assignment:assign",
+      replace: "edr_freight_app:role_assignment:replace",
     },
     hierarchyUnits: {
-      view: 'edr_freight_app:hierarchy_units:view',
-      create: 'edr_freight_app:hierarchy_units:create',
-      update: 'edr_freight_app:hierarchy_units:update',
-      delete: 'edr_freight_app:hierarchy_units:delete',
+      view: "edr_freight_app:hierarchy_units:view",
+      create: "edr_freight_app:hierarchy_units:create",
+      update: "edr_freight_app:hierarchy_units:update",
+      delete: "edr_freight_app:hierarchy_units:delete",
     },
     hierarchyPositions: {
-      view: 'edr_freight_app:hierarchy_positions:view',
-      create: 'edr_freight_app:hierarchy_positions:create',
-      update: 'edr_freight_app:hierarchy_positions:update',
-      delete: 'edr_freight_app:hierarchy_positions:delete',
-      changeParent: 'edr_freight_app:hierarchy_positions:change_parent',
+      view: "edr_freight_app:hierarchy_positions:view",
+      create: "edr_freight_app:hierarchy_positions:create",
+      update: "edr_freight_app:hierarchy_positions:update",
+      delete: "edr_freight_app:hierarchy_positions:delete",
+      changeParent: "edr_freight_app:hierarchy_positions:change_parent",
     },
     hierarchyEmployeeAssignment: {
-      view: 'edr_freight_app:hierarchy_employee_assignment:view',
-      invite: 'edr_freight_app:hierarchy_employee_assignment:invite',
-      assign: 'edr_freight_app:hierarchy_employee_assignment:assign',
+      view: "edr_freight_app:hierarchy_employee_assignment:view",
+      invite: "edr_freight_app:hierarchy_employee_assignment:invite",
+      assign: "edr_freight_app:hierarchy_employee_assignment:assign",
     },
     positionTypes: {
-      view: 'edr_freight_app:position_types:view',
-      create: 'edr_freight_app:position_types:create',
-      update: 'edr_freight_app:position_types:update',
-      delete: 'edr_freight_app:position_types:delete',
+      view: "edr_freight_app:position_types:view",
+      create: "edr_freight_app:position_types:create",
+      update: "edr_freight_app:position_types:update",
+      delete: "edr_freight_app:position_types:delete",
     },
   },
 } as const;
 
 /** Both arms of a freight-type-split permission (for one-of route guards). */
-export const bothFreightTypes = (p: { bulk: string; container: string }): string[] => [
-  p.bulk,
-  p.container,
-];
+export const bothFreightTypes = (p: {
+  bulk: string;
+  container: string;
+}): string[] => [p.bulk, p.container];
 
 /** The arm of a freight-type-split permission matching a contract's freightType. */
 export const forFreightType = (
   p: { bulk: string; container: string },
   freightType: string,
-): string => (freightType === 'BULK' ? p.bulk : p.container);
+): string => (freightType === "BULK" ? p.bulk : p.container);
 
 const allRuleEngineViewKeys = () =>
   RULE_ENGINE_RESOURCE_SLUGS.map((s) => FREIGHT_PERMS.ruleEngine.view(s));
@@ -813,11 +1798,19 @@ const FLEET_GRANULAR_KEYS: string[] = [
   FREIGHT_PERMS.consignments.create,
 ];
 
+// Everyone who works the booking desk also opens the overview dashboard and
+// the canned reports — granted alongside bookings:view in every preset below.
+const STAFF_DASHBOARD_KEYS: string[] = [
+  FREIGHT_PERMS.overview.view,
+  FREIGHT_PERMS.reports.view,
+];
+
 export const ROLE_PERMISSION_PRESETS = {
   // Marketing / line staff: drives a booking from intake through line-staff
   // approval and contract generation/signing — i.e. until the contract is ready
   // and signed. No director/CEO approval, no scheduling, no operations.
   lineStaff: [
+    ...STAFF_DASHBOARD_KEYS,
     FREIGHT_PERMS.bookings.view,
     FREIGHT_PERMS.bookings.staffAccept,
     FREIGHT_PERMS.bookings.requestChanges,
@@ -825,18 +1818,23 @@ export const ROLE_PERMISSION_PRESETS = {
     FREIGHT_PERMS.bookings.approveLineStaff,
     FREIGHT_PERMS.bookings.rejectApproval,
     FREIGHT_PERMS.bookings.cancel,
+    FREIGHT_PERMS.bookings.wagonCancellationView,
+    FREIGHT_PERMS.bookings.wagonCancellationVoid,
     FREIGHT_PERMS.contracts.view,
     ...bothFreightTypes(FREIGHT_PERMS.contracts.staffAccept),
     ...bothFreightTypes(FREIGHT_PERMS.contracts.requestChanges),
     ...bothFreightTypes(FREIGHT_PERMS.contracts.reject),
     FREIGHT_PERMS.contracts.approveLineStaff,
+    FREIGHT_PERMS.contracts.editDocument,
     ...allRuleEngineViewKeys(),
   ],
   // Operations Officer: train scheduling + wagon allocation + transit/complete
   // + fleet management (wagons, trains, locomotives, routes, containers, cargo).
   operationsOfficer: [
+    ...STAFF_DASHBOARD_KEYS,
     FREIGHT_PERMS.bookings.view,
     FREIGHT_PERMS.bookings.operations,
+    FREIGHT_PERMS.bookings.wagonCancellationView,
     // They are the ones who accept/reject operation requests, so they are the
     // ones the doc-review countdown is for.
     FREIGHT_PERMS.bookings.docReviewAlert,
@@ -846,6 +1844,9 @@ export const ROLE_PERMISSION_PRESETS = {
     FREIGHT_PERMS.trainScheduling.cancel,
     FREIGHT_PERMS.trainScheduling.reschedule,
     FREIGHT_PERMS.trainScheduling.rulesManage,
+    FREIGHT_PERMS.trainScheduling.dispatch,
+    FREIGHT_PERMS.trainScheduling.markPaid,
+    FREIGHT_PERMS.trainScheduling.expireBooking,
     FREIGHT_PERMS.fleet.view,
     FREIGHT_PERMS.fleet.manage,
     ...FLEET_GRANULAR_KEYS,
@@ -860,6 +1861,7 @@ export const ROLE_PERMISSION_PRESETS = {
     ...allRuleEngineViewKeys(),
   ],
   director: [
+    ...STAFF_DASHBOARD_KEYS,
     FREIGHT_PERMS.bookings.view,
     FREIGHT_PERMS.bookings.approveDirector,
     FREIGHT_PERMS.bookings.rejectApproval,
@@ -870,6 +1872,7 @@ export const ROLE_PERMISSION_PRESETS = {
     ...allRuleEngineViewKeys(),
   ],
   ceo: [
+    ...STAFF_DASHBOARD_KEYS,
     FREIGHT_PERMS.bookings.view,
     FREIGHT_PERMS.bookings.approveCeo,
     FREIGHT_PERMS.bookings.rejectApproval,
@@ -877,7 +1880,14 @@ export const ROLE_PERMISSION_PRESETS = {
     FREIGHT_PERMS.contracts.approveCeo,
     ...allRuleEngineViewKeys(),
   ],
-  finance: [FREIGHT_PERMS.bookings.view],
+  finance: [
+    ...STAFF_DASHBOARD_KEYS,
+    FREIGHT_PERMS.bookings.view,
+    FREIGHT_PERMS.invoices.view,
+    FREIGHT_PERMS.invoices.export,
+    FREIGHT_PERMS.payments.view,
+    FREIGHT_PERMS.bookings.wagonCancellationView,
+  ],
   // Global Logistics: manages ONLY the customs-clearance queue. Scoped out of
   // the general booking-request list (no bookings:view) — instead a dedicated
   // clearance:view permission lists the clearance bookings. Reviews customer
@@ -894,6 +1904,7 @@ export const ROLE_PERMISSION_PRESETS = {
     FREIGHT_PERMS.contracts.createBooking,
     FREIGHT_PERMS.contracts.clearanceEtActions,
     FREIGHT_PERMS.contracts.clearanceDutyAdvise,
+    FREIGHT_PERMS.contracts.finalInvoiceConfirm,
     FREIGHT_PERMS.bookings.clearanceView,
     FREIGHT_PERMS.bookings.reviewDocuments,
     FREIGHT_PERMS.bookings.uploadClearanceOutput,
@@ -905,6 +1916,8 @@ export const ROLE_PERMISSION_PRESETS = {
   glDjibouti: [
     FREIGHT_PERMS.contracts.view,
     FREIGHT_PERMS.contracts.clearanceDjActions,
+    FREIGHT_PERMS.contracts.finalInvoiceRaise,
+    FREIGHT_PERMS.contracts.finalInvoiceConfirm,
     FREIGHT_PERMS.bookings.clearanceView,
     FREIGHT_PERMS.bookings.uploadClearanceOutput,
     FREIGHT_PERMS.bookings.operations,
@@ -913,6 +1926,7 @@ export const ROLE_PERMISSION_PRESETS = {
   // for non-customs bookings, reviews/finalizes the customer's clearance
   // documents from the booking detail (customs bookings go to Global Logistics).
   marketing: [
+    ...STAFF_DASHBOARD_KEYS,
     FREIGHT_PERMS.bookings.view,
     FREIGHT_PERMS.bookings.staffAccept,
     FREIGHT_PERMS.bookings.requestChanges,
@@ -920,6 +1934,9 @@ export const ROLE_PERMISSION_PRESETS = {
     FREIGHT_PERMS.bookings.approveLineStaff,
     FREIGHT_PERMS.bookings.rejectApproval,
     FREIGHT_PERMS.bookings.cancel,
+    FREIGHT_PERMS.bookings.wagonCancellationView,
+    FREIGHT_PERMS.bookings.wagonCancellationVoid,
+    FREIGHT_PERMS.bookings.wagonCancellationRebook,
     FREIGHT_PERMS.bookings.generateContract,
     FREIGHT_PERMS.bookings.signStaff,
     FREIGHT_PERMS.bookings.reviewDocuments,
@@ -932,6 +1949,7 @@ export const ROLE_PERMISSION_PRESETS = {
     FREIGHT_PERMS.contracts.generateContract,
     ...bothFreightTypes(FREIGHT_PERMS.contracts.signStaff),
     FREIGHT_PERMS.contracts.suspend,
+    FREIGHT_PERMS.contracts.editDocument,
   ],
   orgManager: [...BOOKING_RULE_ENGINE_PERMISSION_KEYS],
 } as const;
@@ -958,8 +1976,29 @@ export const POSITION_PERMISSION_PRESETS = {
     FREIGHT_PERMS.customers.view,
     FREIGHT_PERMS.customers.verify,
     FREIGHT_PERMS.customers.deactivate,
+    // The chief also owns the customer-facing support inbox.
+    FREIGHT_PERMS.support.agentView,
+    FREIGHT_PERMS.support.agentSend,
+    // Senior commercial oversight: government expedite + the finance views.
+    FREIGHT_PERMS.bookings.governmentExpedite,
+    FREIGHT_PERMS.invoices.view,
+    FREIGHT_PERMS.invoices.export,
+    FREIGHT_PERMS.payments.view,
+  ]),
+  // Director additionally manages train scheduling + rail fleet (same block the
+  // operation officer/chief hold), on top of the approval-chain role preset.
+  director: dedupe([
+    ...ROLE_PERMISSION_PRESETS.director,
+    FREIGHT_PERMS.trainScheduling.view,
+    FREIGHT_PERMS.trainScheduling.create,
+    FREIGHT_PERMS.trainScheduling.update,
+    FREIGHT_PERMS.trainScheduling.cancel,
+    FREIGHT_PERMS.trainScheduling.reschedule,
+    FREIGHT_PERMS.trainScheduling.rulesManage,
+    FREIGHT_PERMS.fleet.view,
+    FREIGHT_PERMS.fleet.manage,
+    ...FLEET_GRANULAR_KEYS,
   ]),
-  director: dedupe([...ROLE_PERMISSION_PRESETS.director]),
   ceo: dedupe([...ROLE_PERMISSION_PRESETS.ceo]),
   ethiopianGl: dedupe([...ROLE_PERMISSION_PRESETS.glEthiopia]),
   djiboutiGl: dedupe([...ROLE_PERMISSION_PRESETS.glDjibouti]),
@@ -1009,6 +2048,10 @@ export const POSITION_PERMISSION_PRESETS = {
     ...Object.values(FREIGHT_PERMS.lastMile),
     FREIGHT_PERMS.trainScheduling.view,
     FREIGHT_PERMS.bookings.operations,
+    // Road-fleet back office: vendors, asset lifecycle, compliance, facilities.
+    ...Object.values(FREIGHT_PERMS.procurement),
+    ...Object.values(FREIGHT_PERMS.compliance),
+    ...Object.values(FREIGHT_PERMS.facilities),
   ]),
   // Truck & Machinery chief: reviews and approves/rejects last-mile
   // confirmation requests (the pre-approval gate ahead of vehicle assignment),
@@ -1024,7 +2067,7 @@ export const POSITION_PERMISSION_PRESETS = {
 } as const;
 
 /** Derive the module bucket from the resource segment of a permission key. */
-const moduleOf = (key: string): string => key.split(':')[1] ?? 'other';
+const moduleOf = (key: string): string => key.split(":")[1] ?? "other";
 
 export const PERMISSIONS_CATALOG = BOOKING_RULE_ENGINE_PERMISSIONS.map((p) => ({
   key: p.key,
diff --git a/apps/edr-freight-web/backoffice/src/App.tsx b/apps/edr-freight-web/backoffice/src/App.tsx
index 462414480..6fd666a8d 100644
--- a/apps/edr-freight-web/backoffice/src/App.tsx
+++ b/apps/edr-freight-web/backoffice/src/App.tsx
@@ -29,6 +29,7 @@ import {
   Wallet,
   LifeBuoy,
   TrainFront,
+  XCircle,
 } from "lucide-react";
 import { useEffect } from "react";
 import {
@@ -54,6 +55,7 @@ import BookingContractPage from "./pages/bookings/BookingContractPage";
 import BookingRequestDetailPage from "./pages/bookings/BookingRequestDetailPage";
 import BookingRequestsPage from "./pages/bookings/BookingRequestsPage";
 import NewBookingPage from "./pages/bookings/NewBookingPage";
+import WagonCancellationsPage from "./pages/bookings/WagonCancellationsPage";
 import ContractRequestsPage from "./pages/contracts/ContractRequestsPage";
 import ContractRequestDetailPage from "./pages/contracts/ContractRequestDetailPage";
 import ContractViewPage from "./pages/contracts/ContractViewPage";
@@ -164,7 +166,7 @@ const buildSidebarSections = (demoItems: SidebarItem[]): SidebarSection[] => [
         label: "Reports",
         href: "/dashboard/reports",
         icon: <BarChart3 />,
-        permission: FREIGHT_PERMS.bookings.view,
+        permission: FREIGHT_PERMS.reports.view,
       },
       {
         label: "Customers",
@@ -184,6 +186,12 @@ const buildSidebarSections = (demoItems: SidebarItem[]): SidebarSection[] => [
         icon: <FileText />,
         permission: FREIGHT_PERMS.bookings.view,
       },
+      {
+        label: "Wagon cancellations",
+        href: "/dashboard/wagon-cancellations",
+        icon: <XCircle />,
+        permission: FREIGHT_PERMS.bookings.wagonCancellationView,
+      },
       // Operations hub: per-shipment clearance-document review for services
       // WITHOUT customs clearing (self-clearance) — bookings only.
       {
@@ -196,19 +204,19 @@ const buildSidebarSections = (demoItems: SidebarItem[]): SidebarSection[] => [
         label: "Payments",
         href: "/dashboard/payments",
         icon: <Wallet />,
-        permission: FREIGHT_PERMS.bookings.view,
+        permission: FREIGHT_PERMS.payments.view,
       },
       {
         label: "Invoices",
         href: "/dashboard/invoices",
         icon: <Receipt />,
-        permission: FREIGHT_PERMS.bookings.view,
+        permission: FREIGHT_PERMS.invoices.view,
       },
       {
         label: "Support",
         href: "/dashboard/support",
         icon: <LifeBuoy />,
-        permission: FREIGHT_PERMS.support.view,
+        permission: FREIGHT_PERMS.support.agentView,
       },
       ...demoItems,
     ],
@@ -647,6 +655,8 @@ const DJ_CLEARANCE_HREF = "/dashboard/gl-djibouti/clearance";
 const GL_WORKFLOW_PATH_PATTERNS: RegExp[] = [
   /^\/dashboard\/contracts\/[^/]+\/create-booking(\/|$)/,
   /^\/dashboard\/bookings\/[^/]+\/clearance(\/|$)/,
+  // The ET hub's rows open the shipment clearance detail at this URL.
+  /^\/dashboard\/clearance\/[^/]+(\/|$)/,
 ];
 
 const isEtClearanceItem = (item: SidebarItem): boolean =>
@@ -842,26 +852,30 @@ const App = () => {
         element={<Navigate to="/dashboard/overview" replace />}
       />
       <Route path="/dashboard" element={<DashboardShell />}>
-        <Route path="overview" element={<OverviewPage />} />
-        <Route path="reports" element={<ReportsHubPage />} />
-        <Route path="reports/:reportKey" element={<ReportPage />} />
+        <Route path="overview" element={<RequirePermission permission={FREIGHT_PERMS.overview.view}><OverviewPage /></RequirePermission>} />
+        <Route path="reports" element={<RequirePermission permission={FREIGHT_PERMS.reports.view}><ReportsHubPage /></RequirePermission>} />
+        <Route path="reports/:reportKey" element={<RequirePermission permission={FREIGHT_PERMS.reports.view}><ReportPage /></RequirePermission>} />
         {/* Dev/testing page for the mock AI booking assistant. */}
         <Route
           path="ai-booking-mock-test"
-          element={<AiBookingMockTestPage />}
+          element={
+            <RequirePermission permission={FREIGHT_PERMS.bookings.view}>
+              <AiBookingMockTestPage />
+            </RequirePermission>
+          }
         />
         <Route path="profile" element={<MyProfilePage />} />
 
-        <Route path="booking-requests" element={<BookingRequestsPage />} />
+        <Route path="booking-requests" element={<RequirePermission permission={FREIGHT_PERMS.bookings.view}><BookingRequestsPage /></RequirePermission>} />
         <Route
           path="payments"
           element={
-            <RequirePermission permission={FREIGHT_PERMS.bookings.view}>
+            <RequirePermission permission={FREIGHT_PERMS.payments.view}>
               <PaymentsPage />
             </RequirePermission>
           }
         />
-        <Route path="support" element={<SupportInboxPage />} />
+        <Route path="support" element={<RequirePermission permission={FREIGHT_PERMS.support.agentView}><SupportInboxPage /></RequirePermission>} />
         <Route
           path="customers"
           element={
@@ -881,7 +895,7 @@ const App = () => {
         <Route
           path="invoices"
           element={
-            <RequirePermission permission={FREIGHT_PERMS.bookings.view}>
+            <RequirePermission permission={FREIGHT_PERMS.invoices.view}>
               <InvoicesPage />
             </RequirePermission>
           }
@@ -889,19 +903,37 @@ const App = () => {
         <Route
           path="invoices/:id"
           element={
-            <RequirePermission permission={FREIGHT_PERMS.bookings.view}>
+            <RequirePermission permission={FREIGHT_PERMS.invoices.view}>
               <InvoiceDetailPage />
             </RequirePermission>
           }
         />
-        <Route path="booking-requests/new" element={<NewBookingPage />} />
+        <Route path="booking-requests/new" element={<RequirePermission permission={FREIGHT_PERMS.bookings.view}><NewBookingPage /></RequirePermission>} />
+        <Route
+          path="wagon-cancellations"
+          element={
+            <RequirePermission
+              permission={FREIGHT_PERMS.bookings.wagonCancellationView}
+            >
+              <WagonCancellationsPage />
+            </RequirePermission>
+          }
+        />
         <Route
           path="booking-requests/:id"
-          element={<BookingRequestDetailPage />}
+          element={
+            <RequirePermission permission={FREIGHT_PERMS.bookings.view}>
+              <BookingRequestDetailPage />
+            </RequirePermission>
+          }
         />
         <Route
           path="booking-requests/:id/contract"
-          element={<BookingContractPage />}
+          element={
+            <RequirePermission permission={FREIGHT_PERMS.bookings.view}>
+              <BookingContractPage />
+            </RequirePermission>
+          }
         />
         {/* Legacy booking-based clearance URLs → the contract clearance hub. */}
         <Route
@@ -1089,44 +1121,26 @@ const App = () => {
           path="bookings/:id/milestones"
           element={<BookingMilestonesRedirect />}
         />
-        <Route path="warehouses" element={<WarehouseListPage />} />
-        <Route path="warehouses/:id" element={<WarehouseDetailPage />} />
-        <Route
-          path="warehouse-inventory"
-          element={<WarehouseInventoryPage />}
-        />
-        <Route path="import-warehouse" element={<ImportWarehouseFlowPage />} />
-        <Route path="export-warehouse" element={<ExportWarehouseFlowPage />} />
-        <Route path="arrival-queue" element={<ArrivalQueuePage />} />
-        <Route path="loading-queue" element={<LoadingQueuePage />} />
-        <Route path="intercity" element={<IntercityPage />} />
-        <Route path="trucks-on-site" element={<TrucksOnSitePage />} />
-        <Route path="import-trucks" element={<ImportTrucksPage />} />
-        <Route
-          path="edr-last-mile-returns"
-          element={<EDRLastMileReturnsPage />}
-        />
-        <Route path="container-returns" element={<ContainerReturnsPage />} />
-        <Route path="loaded-inventory" element={<LoadedInventoryPage />} />
-        <Route path="dispatch-queue" element={<DispatchQueuePage />} />
-        <Route
-          path="export-djibouti-unloading"
-          element={<ExportDjiboutiUnloadingQueuePage />}
-        />
-        <Route
-          path="interchange-documents"
-          element={<InterchangeDocumentsPage />}
-        />
-        <Route path="inventory-inquiry" element={<InventoryInquiryPage />} />
-        <Route path="warehouse-rules" element={<WarehouseRulesPage />} />
-        <Route
-          path="warehouse-fee-invoices"
-          element={<WarehouseInvoicesPage />}
-        />
-        <Route
-          path="warehouse-dashboard"
-          element={<WarehouseDashboardPage />}
-        />
+        <Route path="warehouses" element={<RequirePermission permission={FREIGHT_PERMS.warehouses.view}><WarehouseListPage /></RequirePermission>} />
+        <Route path="warehouses/:id" element={<RequirePermission permission={FREIGHT_PERMS.warehouses.view}><WarehouseDetailPage /></RequirePermission>} />
+        <Route path="warehouse-inventory" element={<RequirePermission permission={FREIGHT_PERMS.warehouseInventory.view}><WarehouseInventoryPage /></RequirePermission>} />
+        <Route path="import-warehouse" element={<RequirePermission permission={FREIGHT_PERMS.warehouseInventory.view}><ImportWarehouseFlowPage /></RequirePermission>} />
+        <Route path="export-warehouse" element={<RequirePermission permission={FREIGHT_PERMS.warehouseInventory.view}><ExportWarehouseFlowPage /></RequirePermission>} />
+        <Route path="arrival-queue" element={<RequirePermission permission={FREIGHT_PERMS.warehouseInventory.view}><ArrivalQueuePage /></RequirePermission>} />
+        <Route path="loading-queue" element={<RequirePermission permission={FREIGHT_PERMS.warehouseInventory.view}><LoadingQueuePage /></RequirePermission>} />
+        <Route path="intercity" element={<RequirePermission permission={FREIGHT_PERMS.warehouseInventory.view}><IntercityPage /></RequirePermission>} />
+        <Route path="trucks-on-site" element={<RequirePermission permission={FREIGHT_PERMS.warehouseInventory.view}><TrucksOnSitePage /></RequirePermission>} />
+        <Route path="import-trucks" element={<RequirePermission permission={FREIGHT_PERMS.warehouseInventory.view}><ImportTrucksPage /></RequirePermission>} />
+        <Route path="edr-last-mile-returns" element={<RequirePermission permission={FREIGHT_PERMS.warehouseInventory.view}><EDRLastMileReturnsPage /></RequirePermission>} />
+        <Route path="container-returns" element={<RequirePermission permission={FREIGHT_PERMS.warehouseInventory.view}><ContainerReturnsPage /></RequirePermission>} />
+        <Route path="loaded-inventory" element={<RequirePermission permission={FREIGHT_PERMS.warehouseInventory.view}><LoadedInventoryPage /></RequirePermission>} />
+        <Route path="dispatch-queue" element={<RequirePermission permission={FREIGHT_PERMS.warehouseInventory.view}><DispatchQueuePage /></RequirePermission>} />
+        <Route path="export-djibouti-unloading" element={<RequirePermission permission={FREIGHT_PERMS.warehouseInventory.view}><ExportDjiboutiUnloadingQueuePage /></RequirePermission>} />
+        <Route path="interchange-documents" element={<RequirePermission permission={FREIGHT_PERMS.interchangeDocuments.view}><InterchangeDocumentsPage /></RequirePermission>} />
+        <Route path="inventory-inquiry" element={<RequirePermission permission={FREIGHT_PERMS.warehouseInventory.view}><InventoryInquiryPage /></RequirePermission>} />
+        <Route path="warehouse-rules" element={<RequirePermission permission={[FREIGHT_PERMS.warehouseAllocationRules.view, FREIGHT_PERMS.warehouseFeeRules.view]}><WarehouseRulesPage /></RequirePermission>} />
+        <Route path="warehouse-fee-invoices" element={<RequirePermission permission={FREIGHT_PERMS.warehouseFeeInvoices.view}><WarehouseInvoicesPage /></RequirePermission>} />
+        <Route path="warehouse-dashboard" element={<RequirePermission permission={FREIGHT_PERMS.warehouseDashboard.view}><WarehouseDashboardPage /></RequirePermission>} />
 
         <Route
           path="operations/train-scheduling"
@@ -1334,62 +1348,6 @@ const App = () => {
             </RequirePermission>
           }
         />
-        <Route
-          path="operations/train-scheduling"
-          element={
-            <Navigate to="/dashboard/operations/train-scheduling-v2" replace />
-          }
-        />
-        <Route
-          path="operations/batch-board"
-          element={
-            <RequirePermission permission={FREIGHT_PERMS.trainScheduling.view}>
-              <BatchBoardPage />
-            </RequirePermission>
-          }
-        />
-        <Route
-          path="operations/batch-board/:scheduleId"
-          element={
-            <RequirePermission permission={FREIGHT_PERMS.trainScheduling.view}>
-              <BatchScheduleDetailPage />
-            </RequirePermission>
-          }
-        />
-        <Route
-          path="operations/train-scheduling-v2"
-          element={
-            <RequirePermission permission={FREIGHT_PERMS.trainScheduling.view}>
-              <TrainScheduleV2ListPage />
-            </RequirePermission>
-          }
-        />
-        <Route
-          path="operations/train-scheduling-v2/:scheduleId"
-          element={
-            <RequirePermission permission={FREIGHT_PERMS.trainScheduling.view}>
-              <TrainScheduleV2DetailPage />
-            </RequirePermission>
-          }
-        />
-        <Route
-          path="operations/train-scheduling-v2/:scheduleId/track"
-          element={
-            <RequirePermission permission={FREIGHT_PERMS.trainScheduling.view}>
-              <TrainScheduleTrackPage />
-            </RequirePermission>
-          }
-        />
-        <Route
-          path="routes"
-          element={
-            <RequirePermission
-              permission={[FREIGHT_PERMS.routes.view, FREIGHT_PERMS.fleet.view]}
-            >
-              <RoutesPage />
-            </RequirePermission>
-          }
-        />
         <Route
           path="fuel-purchases"
           element={
@@ -1470,108 +1428,6 @@ const App = () => {
             </RequirePermission>
           }
         />
-        <Route
-          path="locomotives"
-          element={
-            <RequirePermission
-              permission={[
-                FREIGHT_PERMS.locomotives.view,
-                FREIGHT_PERMS.fleet.view,
-              ]}
-            >
-              <FleetResourcePage />
-            </RequirePermission>
-          }
-        />
-        <Route
-          path="trains"
-          element={
-            <RequirePermission
-              permission={[FREIGHT_PERMS.trains.view, FREIGHT_PERMS.fleet.view]}
-            >
-              <FleetResourcePage />
-            </RequirePermission>
-          }
-        />
-        <Route
-          path="trains/:id"
-          element={
-            <RequirePermission
-              permission={[FREIGHT_PERMS.trains.view, FREIGHT_PERMS.fleet.view]}
-            >
-              <TrainDetailPage />
-            </RequirePermission>
-          }
-        />
-        <Route
-          path="train-builder"
-          element={
-            <RequirePermission
-              permission={[FREIGHT_PERMS.trains.view, FREIGHT_PERMS.fleet.view]}
-            >
-              <TrainBuilderListPage />
-            </RequirePermission>
-          }
-        />
-        <Route
-          path="train-builder/:id"
-          element={
-            <RequirePermission
-              permission={[FREIGHT_PERMS.trains.view, FREIGHT_PERMS.fleet.view]}
-            >
-              <TrainBuilderDetailPage />
-            </RequirePermission>
-          }
-        />
-        <Route
-          path="wagons"
-          element={
-            <RequirePermission
-              permission={[FREIGHT_PERMS.wagons.view, FREIGHT_PERMS.fleet.view]}
-            >
-              <FleetResourcePage />
-            </RequirePermission>
-          }
-        />
-        <Route
-          path="wagon-transfers"
-          element={
-            <RequirePermission
-              permission={[
-                FREIGHT_PERMS.wagons.transferView,
-                FREIGHT_PERMS.wagons.view,
-              ]}
-            >
-              <WagonTransfersPage />
-            </RequirePermission>
-          }
-        />
-        <Route
-          path="containers"
-          element={
-            <RequirePermission
-              permission={[
-                FREIGHT_PERMS.containers.view,
-                FREIGHT_PERMS.fleet.view,
-              ]}
-            >
-              <FleetResourcePage />
-            </RequirePermission>
-          }
-        />
-        <Route
-          path="cargoes"
-          element={
-            <RequirePermission
-              permission={[
-                FREIGHT_PERMS.cargoes.view,
-                FREIGHT_PERMS.fleet.view,
-              ]}
-            >
-              <FleetResourcePage />
-            </RequirePermission>
-          }
-        />
 
         {/* Legacy embedded user management routes */}
         {/* <Route path="user-management" element={<UserManagementPage />} />
diff --git a/apps/edr-freight-web/backoffice/src/auth/types.ts b/apps/edr-freight-web/backoffice/src/auth/types.ts
index a361c2abc..44fa4e595 100644
--- a/apps/edr-freight-web/backoffice/src/auth/types.ts
+++ b/apps/edr-freight-web/backoffice/src/auth/types.ts
@@ -23,7 +23,13 @@ interface AuthEmployeePosition {
   permissions?: AuthPermission[];
   /** Some IAM payloads nest the position record instead of flattening its key. */
   position?: { id?: string; key?: string; name?: LocaleText };
-  positionType?: { id?: string; key?: string; name?: LocaleText } | null;
+  positionType?: {
+    id?: string;
+    key?: string;
+    name?: LocaleText;
+    /** Grants held by the TYPE — where admin-created positions keep theirs. */
+    permissions?: AuthPermission[];
+  } | null;
 }
 
 interface AuthEmployeeRecord {
diff --git a/apps/edr-freight-web/backoffice/src/components/bookings/detail/BookingFactsCard.tsx b/apps/edr-freight-web/backoffice/src/components/bookings/detail/BookingFactsCard.tsx
index 15e81bd42..f9f8d1414 100644
--- a/apps/edr-freight-web/backoffice/src/components/bookings/detail/BookingFactsCard.tsx
+++ b/apps/edr-freight-web/backoffice/src/components/bookings/detail/BookingFactsCard.tsx
@@ -1,6 +1,6 @@
 import type { LucideIcon } from "lucide-react";
 import type { ReactNode } from "react";
-import { Hash, Package, Ship, Weight, Clock } from "lucide-react";
+import { Hash, Package, Ship, Weight, Clock, TrainFront } from "lucide-react";
 import { Group, Stack, Text, Divider } from "@mantine/core";
 
 import { cargoTonsAndItems } from "@/utils/cargoWeight";
@@ -50,6 +50,21 @@ export function BookingFactsCard({ booking }: BookingFactsCardProps) {
     },
     { icon: Clock, label: "Last Updated", value: formatDate(booking.updatedAt) },
   ];
+  // Allocated train facts — only once the booking rides a schedule.
+  if (booking.trainSchedule?.trainNumber || booking.trainSchedule?.reference) {
+    facts.splice(1, 0, {
+      icon: TrainFront,
+      label: "Allocated Train",
+      value: [
+        booking.trainSchedule.trainNumber
+          ? `Train ${booking.trainSchedule.trainNumber}`
+          : null,
+        booking.trainSchedule.reference ?? null,
+      ]
+        .filter(Boolean)
+        .join(" · "),
+    });
+  }
 
   return (
     <SectionCard icon={Hash} title="Booking Details" accent="cyan">
diff --git a/apps/edr-freight-web/backoffice/src/components/bookings/detail/booking-detail.styles.ts b/apps/edr-freight-web/backoffice/src/components/bookings/detail/booking-detail.styles.ts
index d3d3e3bc1..c32ab38b2 100644
--- a/apps/edr-freight-web/backoffice/src/components/bookings/detail/booking-detail.styles.ts
+++ b/apps/edr-freight-web/backoffice/src/components/bookings/detail/booking-detail.styles.ts
@@ -144,4 +144,10 @@ export interface BookingDetailView {
   bookingContainers?: BookingContainerView[];
   reviewNotes?: BookingReviewNoteView[];
   files?: BookingFileView[];
+  /** The allocated train, present once the booking is placed on a schedule. */
+  trainSchedule?: {
+    trainNumber: string | null;
+    reference: string | null;
+    scheduledDepartureDate: string | null;
+  } | null;
 }
diff --git a/apps/edr-freight-web/backoffice/src/components/contracts/BookingChangesRequestedAlert.tsx b/apps/edr-freight-web/backoffice/src/components/contracts/BookingChangesRequestedAlert.tsx
index 16b1ab602..f3b56a464 100644
--- a/apps/edr-freight-web/backoffice/src/components/contracts/BookingChangesRequestedAlert.tsx
+++ b/apps/edr-freight-web/backoffice/src/components/contracts/BookingChangesRequestedAlert.tsx
@@ -1,6 +1,6 @@
 import { Alert, Button, Group, Paper, Stack, Text } from "@mantine/core";
 import { DateInput } from "@mantine/dates";
-import { AlertTriangle, Send } from "lucide-react";
+import { AlertTriangle, Pencil, Send } from "lucide-react";
 import { useState } from "react";
 import { Link } from "react-router-dom";
 import toast from "react-hot-toast";
@@ -16,6 +16,9 @@ export interface BookingChangesRequestedAlertProps {
   scheduledDate?: string | null;
   /** GL Ethiopia owns customs bookings, so only they get the resubmit control. */
   canResubmit: boolean;
+  /** Completion-form route for editing the cargo before resubmitting —
+   *  rendered only for resubmit-capable users when provided. */
+  editHref?: string;
   onResubmitted?: () => void;
 }
 
@@ -33,6 +36,7 @@ export function BookingChangesRequestedAlert({
   note,
   scheduledDate,
   canResubmit,
+  editHref,
   onResubmitted,
 }: BookingChangesRequestedAlertProps) {
   const [day, setDay] = useState<Date | null>(
@@ -122,6 +126,18 @@ export function BookingChangesRequestedAlert({
             >
               Resubmit to Operations
             </Button>
+            {editHref ? (
+              <Button
+                component={Link}
+                to={editHref}
+                variant="default"
+                radius="md"
+                size="sm"
+                leftSection={<Pencil size={15} />}
+              >
+                Edit cargo & resubmit
+              </Button>
+            ) : null}
           </Group>
         ) : null}
       </Stack>
diff --git a/apps/edr-freight-web/backoffice/src/components/contracts/ClearanceOpsTabs.tsx b/apps/edr-freight-web/backoffice/src/components/contracts/ClearanceOpsTabs.tsx
index 610fb7e3d..a61646d6f 100644
--- a/apps/edr-freight-web/backoffice/src/components/contracts/ClearanceOpsTabs.tsx
+++ b/apps/edr-freight-web/backoffice/src/components/contracts/ClearanceOpsTabs.tsx
@@ -68,6 +68,8 @@ export function ClearanceOpsTabs({
     Boolean(exchangeEntityId) &&
     (hasPermission(user, FREIGHT_PERMS.contracts.clearanceEtActions) ||
       hasPermission(user, FREIGHT_PERMS.contracts.clearanceDjActions));
+  // Risk assignment + incident reporting hit bookings:operations endpoints.
+  const canOps = hasPermission(user, FREIGHT_PERMS.bookings.operations);
   const hasTabs = (showOpsTabs && hasOps) || showDocuments || showExchange;
 
   if (!hasTabs) {
@@ -98,12 +100,12 @@ export function ClearanceOpsTabs({
             Document exchange
           </Tabs.Tab>
         ) : null}
-        {showOpsTabs && riskMs ? (
+        {showOpsTabs && canOps && riskMs ? (
           <Tabs.Tab value="risk" leftSection={<ShieldAlert size={14} />}>
             Risk assignment
           </Tabs.Tab>
         ) : null}
-        {showOpsTabs && bookingId ? (
+        {showOpsTabs && canOps && bookingId ? (
           <Tabs.Tab value="incidents" leftSection={<AlertTriangle size={14} />}>
             Incidents
           </Tabs.Tab>
@@ -129,7 +131,7 @@ export function ClearanceOpsTabs({
         </Tabs.Panel>
       ) : null}
 
-      {showOpsTabs && riskMs && bookingId ? (
+      {showOpsTabs && canOps && riskMs && bookingId ? (
         <Tabs.Panel value="risk">
           <SectionCard icon={ShieldAlert} title="Customs risk" accent="edr-green">
             <AssignRiskCard bookingId={bookingId} milestone={riskMs} />
@@ -137,7 +139,7 @@ export function ClearanceOpsTabs({
         </Tabs.Panel>
       ) : null}
 
-      {showOpsTabs && bookingId ? (
+      {showOpsTabs && canOps && bookingId ? (
         <Tabs.Panel value="incidents">
           <SectionCard icon={AlertTriangle} title="Incident reports" accent="edr-green">
             <Stack gap="sm">
diff --git a/apps/edr-freight-web/backoffice/src/components/contracts/ContractClearanceReviewSection.tsx b/apps/edr-freight-web/backoffice/src/components/contracts/ContractClearanceReviewSection.tsx
index c773933ea..5e2ca9e83 100644
--- a/apps/edr-freight-web/backoffice/src/components/contracts/ContractClearanceReviewSection.tsx
+++ b/apps/edr-freight-web/backoffice/src/components/contracts/ContractClearanceReviewSection.tsx
@@ -41,6 +41,8 @@ import {
   fetchViewableFile,
 } from "@/services/files.service";
 import { useContractClearanceMutations } from "@/hooks/contracts/useContracts";
+import { useAuth } from "@/auth/useAuth";
+import { FREIGHT_PERMS, hasPermission } from "@/lib/permissions";
 import { useFileViewer } from "@/hooks/useFileViewer";
 
 export interface ContractClearanceReviewSectionProps {
@@ -123,6 +125,21 @@ export function ContractClearanceReviewSection({
   } | null>(null);
   const { view, viewer } = useFileViewer();
 
+  // Mirror the API guards: Path A (self-clearance) actions need
+  // ops_clearance_review; Path B (customs) review needs clearance_review or
+  // the ET phased key. Without the matching key every action would 403 — show
+  // the audit view instead of dead buttons.
+  const { user } = useAuth();
+  const canReviewHere = selfClear
+    ? hasPermission(user, FREIGHT_PERMS.contracts.opsClearanceReview)
+    : hasPermission(user, FREIGHT_PERMS.contracts.clearanceReview) ||
+      hasPermission(user, FREIGHT_PERMS.contracts.clearanceEtActions);
+  // Finalize has its own API key on the customs path (contracts:finalize_clearance).
+  const canFinalizeHere = selfClear
+    ? hasPermission(user, FREIGHT_PERMS.contracts.opsClearanceReview)
+    : hasPermission(user, FREIGHT_PERMS.contracts.finalizeClearance);
+  readOnly = readOnly || !canReviewHere;
+
   const reviewerTeam = selfClear ? "Operations" : "Global Logistics";
 
   const { data: clearance, isLoading } = useQuery({
@@ -484,7 +501,7 @@ export function ContractClearanceReviewSection({
               color="edr-green"
               radius="md"
               leftSection={<CheckCircle2 size={16} />}
-              disabled={!clearance.allApproved}
+              disabled={!clearance.allApproved || !canFinalizeHere}
               loading={finalizeClearance.isPending}
               onClick={() =>
                 finalizeClearance.mutate(undefined, {
diff --git a/apps/edr-freight-web/backoffice/src/components/contracts/ExportClearanceStepper.tsx b/apps/edr-freight-web/backoffice/src/components/contracts/ExportClearanceStepper.tsx
index 61f8251c9..f665f388b 100644
--- a/apps/edr-freight-web/backoffice/src/components/contracts/ExportClearanceStepper.tsx
+++ b/apps/edr-freight-web/backoffice/src/components/contracts/ExportClearanceStepper.tsx
@@ -225,7 +225,13 @@ export function ExportClearanceStepper({
 
           <Stepper.Step
             label="Request transit assignee"
-            description="Ask GL Djibouti to name the officer handling this shipment"
+            // Description is the only part of a passed step that stays visible,
+            // so it carries the assigned officer's name for GL Ethiopia.
+            description={
+              clearance.transitAssignee?.name
+                ? `Transit assignee: ${clearance.transitAssignee.name}`
+                : "Ask GL Djibouti to name the officer handling this shipment"
+            }
             icon={
               clearance.transitAssignee?.name ? (
                 <CheckCircle2 size={14} />
diff --git a/apps/edr-freight-web/backoffice/src/components/contracts/GlCreateBookingForm.tsx b/apps/edr-freight-web/backoffice/src/components/contracts/GlCreateBookingForm.tsx
index 52f7ee40d..42ecbce61 100644
--- a/apps/edr-freight-web/backoffice/src/components/contracts/GlCreateBookingForm.tsx
+++ b/apps/edr-freight-web/backoffice/src/components/contracts/GlCreateBookingForm.tsx
@@ -961,7 +961,7 @@ export default function GlCreateBookingForm() {
   // modal falls back to the contract unit-rate estimate while it loads.
   const validateShipmentMutation = useMutation({
     mutationFn: (dto: Freight.CreateBookingUnderContractDto) =>
-      contractsService.validateShipment(id ?? "", dto),
+      contractsService.validateShipment(id ?? "", dto, completeBookingId),
   });
   const validation = validateShipmentMutation.data ?? null;
 
diff --git a/apps/edr-freight-web/backoffice/src/components/contracts/GlUpcomingWindowsSection.tsx b/apps/edr-freight-web/backoffice/src/components/contracts/GlUpcomingWindowsSection.tsx
index ba9e01402..df1a66330 100644
--- a/apps/edr-freight-web/backoffice/src/components/contracts/GlUpcomingWindowsSection.tsx
+++ b/apps/edr-freight-web/backoffice/src/components/contracts/GlUpcomingWindowsSection.tsx
@@ -39,6 +39,8 @@ interface WindowRow {
   windowClosesAt: string | null;
   docReviewEndsAt: string | null;
   paymentPhaseEndsAt: string | null;
+  /** End of the payment drain tail — pending payments may settle until then. */
+  paymentDrainEndsAt?: string | null;
   bookingWindowStatus: string;
   bookingCycleNo: number;
   departureDate: string;
@@ -94,16 +96,29 @@ const COUNTDOWN_TEXT: Partial<
   PRE_WINDOW: { label: "Opens in", expiredText: "Opening now…" },
   OPEN: { label: "Closes in", expiredText: "Review starting…" },
   DOC_REVIEW: { label: "Doc review ends in", expiredText: "Payment starting…" },
-  PAYMENT: { label: "Payment ends in", expiredText: "Closing…" },
+  PAYMENT: { label: "Payment ends in", expiredText: "Finalizing…" },
 };
 
-function phaseCountdown(
-  w: WindowRow,
-): { label: string; deadline: string; expiredText: string } | null {
+function phaseCountdown(w: WindowRow): {
+  label: string;
+  deadline: string;
+  expiredText: string;
+  graceDeadline?: string | null;
+  graceLabel?: string;
+} | null {
   const state = bookingWindowUiState(w);
   const text = COUNTDOWN_TEXT[state.kind];
   if (!state.countdownTo || !text) return null;
-  return { ...text, deadline: state.countdownTo };
+  // Once the pay deadline lapses, pending payments still settle during the
+  // drain tail — count it down as "processing" instead of a stale "closing".
+  const grace =
+    state.kind === "PAYMENT" && w.paymentDrainEndsAt
+      ? {
+          graceDeadline: w.paymentDrainEndsAt,
+          graceLabel: "Processing payments — closes in",
+        }
+      : undefined;
+  return { ...text, deadline: state.countdownTo, ...grace };
 }
 
 /** Badge label + Mantine color per UI state — same state the countdown uses. */
@@ -225,6 +240,8 @@ function WindowCard({ w }: { w: WindowRow }) {
               deadline={cd.deadline}
               label={cd.label}
               expiredText={cd.expiredText}
+              graceDeadline={cd.graceDeadline}
+              graceLabel={cd.graceLabel}
               size="xs"
             />
           </Box>
diff --git a/apps/edr-freight-web/backoffice/src/components/contracts/PhasedClearanceActionPanel.tsx b/apps/edr-freight-web/backoffice/src/components/contracts/PhasedClearanceActionPanel.tsx
index 88074735b..926637db2 100644
--- a/apps/edr-freight-web/backoffice/src/components/contracts/PhasedClearanceActionPanel.tsx
+++ b/apps/edr-freight-web/backoffice/src/components/contracts/PhasedClearanceActionPanel.tsx
@@ -357,7 +357,14 @@ export function PhasedClearanceActionPanel({
 
             <Stepper.Step
               label="Request transit assignee"
-              description="Ask GL Djibouti to name the officer handling this shipment"
+              // Once the flow moves past this step its content collapses — the
+              // description is the only slot that stays visible, so it carries
+              // the assigned officer's name for GL Ethiopia.
+              description={
+                clearance.transitAssignee?.name
+                  ? `Transit assignee: ${clearance.transitAssignee.name}`
+                  : "Ask GL Djibouti to name the officer handling this shipment"
+              }
               icon={
                 clearance.transitAssignee?.name ? (
                   <CheckCircle2 size={14} />
diff --git a/apps/edr-freight-web/backoffice/src/components/ruleEngine/RuleEngineCardGrid.tsx b/apps/edr-freight-web/backoffice/src/components/ruleEngine/RuleEngineCardGrid.tsx
index 392bf6dfb..762f5bc84 100644
--- a/apps/edr-freight-web/backoffice/src/components/ruleEngine/RuleEngineCardGrid.tsx
+++ b/apps/edr-freight-web/backoffice/src/components/ruleEngine/RuleEngineCardGrid.tsx
@@ -234,7 +234,7 @@ const RuleEngineCardGrid = ({
                           {col.header}:
                         </Text>
                         <div style={{ textAlign: "right", flex: 1 }}>
-                          {formatCell(displayValue, col.format)}
+                          {formatCell(displayValue, col.format, record)}
                         </div>
                       </Group>
                     );
diff --git a/apps/edr-freight-web/backoffice/src/components/ruleEngine/RuleEngineFormDialog.tsx b/apps/edr-freight-web/backoffice/src/components/ruleEngine/RuleEngineFormDialog.tsx
index d205aae26..4684a3ad1 100644
--- a/apps/edr-freight-web/backoffice/src/components/ruleEngine/RuleEngineFormDialog.tsx
+++ b/apps/edr-freight-web/backoffice/src/components/ruleEngine/RuleEngineFormDialog.tsx
@@ -127,6 +127,8 @@ const buildInitialValues = (
       } else {
         values[field.name] = raw;
       }
+    } else if (field.defaultValue !== undefined) {
+      values[field.name] = field.defaultValue;
     } else if (field.type === "boolean") {
       values[field.name] = false;
     } else if (field.type === "number") {
diff --git a/apps/edr-freight-web/backoffice/src/components/ruleEngine/ruleEngineFormat.tsx b/apps/edr-freight-web/backoffice/src/components/ruleEngine/ruleEngineFormat.tsx
index 173c75b5f..529f53a43 100644
--- a/apps/edr-freight-web/backoffice/src/components/ruleEngine/ruleEngineFormat.tsx
+++ b/apps/edr-freight-web/backoffice/src/components/ruleEngine/ruleEngineFormat.tsx
@@ -17,7 +17,13 @@ const extractLabel = (value: unknown): string | null => {
   );
 };
 
-export const formatCell = (value: unknown, format?: ColumnFormat): ReactNode => {
+export const formatCell = (
+  value: unknown,
+  format?: ColumnFormat,
+  // The row the cell came from — currency amounts read their code off it so a
+  // last-mile rate priced in birr does not render as USD.
+  row?: Record<string, unknown>,
+): ReactNode => {
   if (value === null || value === undefined || value === "") {
     return <Text size="sm" c="dimmed">—</Text>;
   }
@@ -109,9 +115,10 @@ export const formatCell = (value: unknown, format?: ColumnFormat): ReactNode =>
 
   if (format === "currency") {
     const num = Number(value);
+    const code = typeof row?.currency === "string" ? row.currency : "USD";
     return (
       <Text size="sm" fw={500}>
-        {Number.isNaN(num) ? String(value) : `USD ${num.toLocaleString()}`}
+        {Number.isNaN(num) ? String(value) : `${code} ${num.toLocaleString()}`}
       </Text>
     );
   }
diff --git a/apps/edr-freight-web/backoffice/src/components/trainScheduling/ScheduleBatchPanel.tsx b/apps/edr-freight-web/backoffice/src/components/trainScheduling/ScheduleBatchPanel.tsx
index d44ef4540..9b410ce88 100644
--- a/apps/edr-freight-web/backoffice/src/components/trainScheduling/ScheduleBatchPanel.tsx
+++ b/apps/edr-freight-web/backoffice/src/components/trainScheduling/ScheduleBatchPanel.tsx
@@ -19,6 +19,8 @@ import { BookingStatusBadge } from "@/components/bookings/BookingStatusBadge";
 import { api } from "@/services/api";
 import { useToast } from "@/hooks/use-toast";
 import type { TrainScheduleDetail } from "@/types/trainScheduling";
+import { useAuth } from "@/auth/useAuth";
+import { FREIGHT_PERMS, hasPermission } from "@/lib/permissions";
 
 interface ScheduleBatchPanelProps {
   schedule: TrainScheduleDetail;
@@ -31,6 +33,8 @@ const windowColor: Record<string, string> = {
 };
 
 export function ScheduleBatchPanel({ schedule }: ScheduleBatchPanelProps) {
+  const { user } = useAuth();
+  const canMarkPaid = hasPermission(user, FREIGHT_PERMS.trainScheduling.markPaid);
   const { toast } = useToast();
   const actions = {
     runBatch: useMutation(api.trainScheduling.runBatch.mutationOptions()),
@@ -179,7 +183,7 @@ export function ScheduleBatchPanel({ schedule }: ScheduleBatchPanelProps) {
                 <Table.Td>
                   {!locked && (
                     <Group gap={6} justify="flex-end" wrap="nowrap">
-                      {b.status !== "PAID" && (
+                      {canMarkPaid && b.status !== "PAID" && (
                         <Button
                           size="compact-xs"
                           variant="light"
diff --git a/apps/edr-freight-web/backoffice/src/features/bookingWindows/useBookingWindowSocket.ts b/apps/edr-freight-web/backoffice/src/features/bookingWindows/useBookingWindowSocket.ts
index b9195b1ff..59318f703 100644
--- a/apps/edr-freight-web/backoffice/src/features/bookingWindows/useBookingWindowSocket.ts
+++ b/apps/edr-freight-web/backoffice/src/features/bookingWindows/useBookingWindowSocket.ts
@@ -30,6 +30,7 @@ interface WindowRow {
   windowClosesAt: string | null;
   docReviewEndsAt: string | null;
   paymentPhaseEndsAt: string | null;
+  paymentDrainEndsAt?: string | null;
   bookingWindowStatus: string;
   bookingCycleNo: number;
   departureDate: string;
@@ -55,6 +56,7 @@ function applyEvent<T extends WindowRow>(row: T, event: BookingWindowPhaseEvent)
     windowClosesAt: event.windowClosesAt,
     docReviewEndsAt: event.docReviewEndsAt,
     paymentPhaseEndsAt: event.paymentPhaseEndsAt,
+    paymentDrainEndsAt: event.paymentDrainEndsAt,
     departureDate: event.scheduledDepartureDate ?? row.departureDate,
   };
 }
diff --git a/apps/edr-freight-web/backoffice/src/lib/permissions.ts b/apps/edr-freight-web/backoffice/src/lib/permissions.ts
index 8dbb61a7c..48c78af40 100644
--- a/apps/edr-freight-web/backoffice/src/lib/permissions.ts
+++ b/apps/edr-freight-web/backoffice/src/lib/permissions.ts
@@ -6,7 +6,32 @@ export const FREIGHT_PERMS = {
     view: "edr_freight_app:overview:view",
   },
   support: {
-    view: "edr_freight_app:support:view",
+    agentView: "edr_freight_app:support:agent_view",
+    agentSend: "edr_freight_app:support:agent_send",
+  },
+  reports: {
+    view: "edr_freight_app:reports:view",
+  },
+  procurement: {
+    view: "edr_freight_app:procurement:view",
+    vendorManage: "edr_freight_app:procurement:vendor_manage",
+    acquisitionManage: "edr_freight_app:procurement:acquisition_manage",
+    disposalManage: "edr_freight_app:procurement:disposal_manage",
+  },
+  compliance: {
+    view: "edr_freight_app:compliance:view",
+    manage: "edr_freight_app:compliance:manage",
+  },
+  facilities: {
+    view: "edr_freight_app:facilities:view",
+    manage: "edr_freight_app:facilities:manage",
+  },
+  tradeAccess: {
+    view: "edr_freight_app:trade_access:view",
+    manage: "edr_freight_app:trade_access:manage",
+  },
+  staffUsers: {
+    view: "edr_freight_app:staff:users:view",
   },
   bookings: {
     view: "edr_freight_app:bookings:view",
@@ -27,6 +52,11 @@ export const FREIGHT_PERMS = {
     uploadClearanceOutput: "edr_freight_app:bookings:upload_clearance_output",
     finalizeClearance: "edr_freight_app:bookings:finalize_clearance",
     docReviewAlert: "edr_freight_app:bookings:doc_review_alert",
+    governmentExpedite: "edr_freight_app:bookings:government_expedite",
+    wagonCancellationView: "edr_freight_app:bookings:wagon_cancellation_view",
+    wagonCancellationVoid: "edr_freight_app:bookings:wagon_cancellation_void",
+    wagonCancellationRebook:
+      "edr_freight_app:bookings:wagon_cancellation_rebook",
   },
   contracts: {
     view: "edr_freight_app:contracts:view",
@@ -61,6 +91,9 @@ export const FREIGHT_PERMS = {
     clearanceEtActions: "edr_freight_app:contracts:clearance_et_actions",
     clearanceDjActions: "edr_freight_app:contracts:clearance_dj_actions",
     suspend: "edr_freight_app:contracts:suspend",
+    editDocument: "edr_freight_app:contracts:edit_document",
+    finalInvoiceRaise: "edr_freight_app:contracts:final_invoice_raise",
+    finalInvoiceConfirm: "edr_freight_app:contracts:final_invoice_confirm",
   },
   trainScheduling: {
     view: "edr_freight_app:train_scheduling:view",
@@ -69,6 +102,9 @@ export const FREIGHT_PERMS = {
     cancel: "edr_freight_app:train_scheduling:cancel",
     reschedule: "edr_freight_app:train_scheduling:reschedule",
     rulesManage: "edr_freight_app:train_scheduling:rules_manage",
+    dispatch: "edr_freight_app:train_scheduling:dispatch",
+    markPaid: "edr_freight_app:train_scheduling:mark_paid",
+    expireBooking: "edr_freight_app:train_scheduling:expire_booking",
   },
   fleet: {
     view: "edr_freight_app:fleet:view",
@@ -88,13 +124,9 @@ export const FREIGHT_PERMS = {
   },
   payments: {
     view: "edr_freight_app:payments:view",
-    verify: "edr_freight_app:payments:verify",
-    refund: "edr_freight_app:payments:refund",
   },
   invoices: {
     view: "edr_freight_app:invoices:view",
-    create: "edr_freight_app:invoices:create",
-    cancel: "edr_freight_app:invoices:cancel",
     export: "edr_freight_app:invoices:export",
   },
   firstMile: {
@@ -191,14 +223,12 @@ export const FREIGHT_PERMS = {
     create: "edr_freight_app:fuel:create",
     update: "edr_freight_app:fuel:update",
     delete: "edr_freight_app:fuel:delete",
-    approve: "edr_freight_app:fuel:approve",
   },
   maintenance: {
     view: "edr_freight_app:maintenance:view",
     create: "edr_freight_app:maintenance:create",
     update: "edr_freight_app:maintenance:update",
     delete: "edr_freight_app:maintenance:delete",
-    complete: "edr_freight_app:maintenance:complete",
   },
   fleetReports: {
     view: "edr_freight_app:fleet_reports:view",
@@ -278,6 +308,14 @@ export const FREIGHT_PERMS = {
       view: "edr_freight_app:settings:dropdown:view",
       manage: "edr_freight_app:settings:dropdown:manage",
     },
+    exchangeRate: {
+      view: "edr_freight_app:settings:exchange_rate:view",
+      manage: "edr_freight_app:settings:exchange_rate:manage",
+    },
+    contractTemplates: {
+      view: "edr_freight_app:settings:contract_templates:view",
+      manage: "edr_freight_app:settings:contract_templates:manage",
+    },
   },
   audit: {
     view: "edr_freight_app:audit:view",
@@ -348,6 +386,14 @@ export function getPermissionKeys(user: AuthUser | null | undefined): string[] {
       for (const p of pos.permissions ?? []) {
         if (p.key) keys.add(p.key);
       }
+      // Positions created through the admin UI keep their grants on the
+      // position TYPE, not the position — miss these and such staff resolve to
+      // zero permissions and every gated route rejects them. `/api/me` folds
+      // them into the position's permission list, but older payloads may still
+      // carry them separately.
+      for (const p of pos.positionType?.permissions ?? []) {
+        if (p.key) keys.add(p.key);
+      }
     }
   }
   return [...keys];
@@ -563,7 +609,9 @@ export function canViewScheduling(user: AuthUser | null | undefined): boolean {
 }
 
 /** Any train-scheduling write action (create / update / cancel / reschedule). */
-export function canManageScheduling(user: AuthUser | null | undefined): boolean {
+export function canManageScheduling(
+  user: AuthUser | null | undefined,
+): boolean {
   return (
     hasPermission(user, FREIGHT_PERMS.trainScheduling.create) ||
     hasPermission(user, FREIGHT_PERMS.trainScheduling.update) ||
diff --git a/apps/edr-freight-web/backoffice/src/pages/bookings/WagonCancellationsPage.tsx b/apps/edr-freight-web/backoffice/src/pages/bookings/WagonCancellationsPage.tsx
new file mode 100644
index 000000000..fff83d479
--- /dev/null
+++ b/apps/edr-freight-web/backoffice/src/pages/bookings/WagonCancellationsPage.tsx
@@ -0,0 +1,420 @@
+import {
+  Anchor,
+  Badge,
+  Box,
+  Button,
+  Card,
+  Group,
+  Modal,
+  Select,
+  Stack,
+  Text,
+  TextInput,
+} from "@mantine/core";
+import { DateInput } from "@mantine/dates";
+import { useDebouncedValue } from "@mantine/hooks";
+import { useMutation, useQuery } from "@tanstack/react-query";
+import { Search, XCircle } from "lucide-react";
+import { useMemo, useState } from "react";
+import toast from "react-hot-toast";
+import { Link } from "react-router-dom";
+
+import { api } from "@/auth/http";
+import { useAuth } from "@/auth/useAuth";
+import { PageContainer, PageHeader } from "@/components/page";
+import { toDayString } from "@/hooks/useListControls";
+import { FREIGHT_PERMS, hasPermission } from "@/lib/permissions";
+import {
+  DataTable,
+  DataTableFooter,
+  usePagination,
+  type ColumnDef,
+} from "@edr/ui-common";
+
+type WagonCancellationStatus =
+  | "FEE_PENDING"
+  | "CREDIT_AVAILABLE"
+  | "REBOOKED"
+  | "WITHDRAWN"
+  | "EXPIRED";
+
+interface WagonCancellation {
+  id: string;
+  bookingId: string;
+  rebookedBookingId?: string | null;
+  wagonsCancelled: number;
+  weightTons: number;
+  creditAmount: number;
+  feeAmount: number;
+  feeCurrency: string;
+  feeInvoiceId?: string | null;
+  feePaidAt?: string | null;
+  status: WagonCancellationStatus;
+  reason?: string | null;
+  rebookedAt?: string | null;
+  createdAt: string;
+  booking?: { id: string; reference: string; company?: { name: string } };
+  rebookedBooking?: { id: string; reference: string };
+  feeInvoice?: { invoiceNumber: string; status: string };
+}
+
+interface WagonCancellationListResponse {
+  items: WagonCancellation[];
+  total: number;
+}
+
+const STATUS_CHIP: Record<
+  WagonCancellationStatus,
+  { label: string; color: string }
+> = {
+  FEE_PENDING: { label: "Fee pending", color: "yellow" },
+  CREDIT_AVAILABLE: { label: "Credit available", color: "edr-green" },
+  REBOOKED: { label: "Rebooked", color: "indigo" },
+  WITHDRAWN: { label: "Withdrawn", color: "gray" },
+  EXPIRED: { label: "Expired", color: "red" },
+};
+
+const STATUS_FILTER_OPTIONS = (
+  Object.keys(STATUS_CHIP) as WagonCancellationStatus[]
+).map((s) => ({ value: s, label: STATUS_CHIP[s].label }));
+
+function StatusChip({ status }: { status: WagonCancellationStatus }) {
+  const chip = STATUS_CHIP[status] ?? { label: status, color: "gray" };
+  return (
+    <Badge
+      color={chip.color}
+      variant="light"
+      size="sm"
+      radius="md"
+      tt="uppercase"
+      fw={600}
+      style={{ fontSize: "0.7rem", letterSpacing: "0.05em" }}
+    >
+      {chip.label}
+    </Badge>
+  );
+}
+
+function formatDate(iso: string | null | undefined): string {
+  if (!iso) return "—";
+  const d = new Date(iso);
+  return Number.isNaN(d.getTime())
+    ? "—"
+    : d.toLocaleDateString(undefined, {
+        year: "numeric",
+        month: "short",
+        day: "numeric",
+      });
+}
+
+function formatAmount(amount: number, currency: string): string {
+  return `${currency} ${Number(amount).toLocaleString(undefined, {
+    minimumFractionDigits: 2,
+  })}`;
+}
+
+/**
+ * Staff view of partial wagon cancellations: every slice of capacity a
+ * customer gave back, its cancellation fee, and where the credit went
+ * (rebooked, still available, expired, or the request was voided).
+ */
+export default function WagonCancellationsPage() {
+  const { user } = useAuth();
+  const canVoid = hasPermission(
+    user,
+    FREIGHT_PERMS.bookings.wagonCancellationVoid,
+  );
+
+  const { pagination, setPagination } = usePagination({ pageSize: 10 });
+  const [status, setStatus] = useState<string | null>(null);
+  const [search, setSearch] = useState("");
+  const [debouncedSearch] = useDebouncedValue(search, 300);
+  const [from, setFrom] = useState<Date | null>(null);
+  const [to, setTo] = useState<Date | null>(null);
+  const [voiding, setVoiding] = useState<WagonCancellation | null>(null);
+
+  const resetPage = () =>
+    setPagination({ pageIndex: 0, pageSize: pagination.pageSize });
+
+  const filter = useMemo(
+    () => ({
+      page: pagination.pageIndex + 1,
+      pageSize: pagination.pageSize,
+      ...(status ? { statuses: status } : {}),
+      ...(debouncedSearch.trim() ? { search: debouncedSearch.trim() } : {}),
+      ...(from ? { from: toDayString(from) } : {}),
+      ...(to ? { to: toDayString(to) } : {}),
+    }),
+    [pagination.pageIndex, pagination.pageSize, status, debouncedSearch, from, to],
+  );
+
+  const { data, isLoading, isError, refetch } = useQuery({
+    queryKey: ["bookings", "wagon-cancellations", filter],
+    queryFn: async () => {
+      const res = await api.get<WagonCancellationListResponse>(
+        "/bookings/wagon-cancellations/history",
+        { params: filter },
+      );
+      return res.data;
+    },
+  });
+  const rows = data?.items ?? [];
+  const total = data?.total ?? 0;
+  const pageCount = Math.max(1, Math.ceil(total / pagination.pageSize));
+
+  const withdraw = useMutation({
+    mutationFn: (id: string) =>
+      api.post(`/bookings/wagon-cancellations/${id}/withdraw`),
+  });
+
+  const columns: ColumnDef<WagonCancellation>[] = [
+    {
+      id: "requested",
+      header: () => <span>Requested</span>,
+      cell: ({ row }) => (
+        <Text size="xs" c="dimmed">
+          {formatDate(row.original.createdAt)}
+        </Text>
+      ),
+    },
+    {
+      id: "booking",
+      header: () => <span>Booking</span>,
+      cell: ({ row }) => (
+        <Anchor
+          component={Link}
+          to={`/dashboard/booking-requests/${row.original.bookingId}`}
+          size="sm"
+          fw={600}
+        >
+          {row.original.booking?.reference ?? row.original.bookingId}
+        </Anchor>
+      ),
+    },
+    {
+      id: "company",
+      header: () => <span>Company</span>,
+      cell: ({ row }) => (
+        <Text size="sm">{row.original.booking?.company?.name ?? "—"}</Text>
+      ),
+    },
+    {
+      id: "wagons",
+      header: () => <span>Wagons</span>,
+      cell: ({ row }) => <Text size="sm">{row.original.wagonsCancelled}</Text>,
+    },
+    {
+      id: "fee",
+      header: () => <span>Fee</span>,
+      cell: ({ row }) => (
+        <Text size="sm" style={{ fontVariantNumeric: "tabular-nums" }}>
+          {formatAmount(row.original.feeAmount, row.original.feeCurrency)}
+        </Text>
+      ),
+    },
+    {
+      id: "credit",
+      header: () => <span>Credit</span>,
+      cell: ({ row }) => (
+        <Text size="sm" style={{ fontVariantNumeric: "tabular-nums" }}>
+          {formatAmount(row.original.creditAmount, row.original.feeCurrency)}
+        </Text>
+      ),
+    },
+    {
+      id: "status",
+      header: () => <span>Status</span>,
+      cell: ({ row }) => <StatusChip status={row.original.status} />,
+    },
+    {
+      id: "rebookedAs",
+      header: () => <span>Rebooked as</span>,
+      cell: ({ row }) => {
+        const r = row.original;
+        if (!r.rebookedBookingId) return <Text size="sm">—</Text>;
+        return (
+          <Anchor
+            component={Link}
+            to={`/dashboard/booking-requests/${r.rebookedBookingId}`}
+            size="sm"
+          >
+            {r.rebookedBooking?.reference ?? r.rebookedBookingId}
+          </Anchor>
+        );
+      },
+    },
+    {
+      id: "actions",
+      header: () => <span />,
+      cell: ({ row }) => {
+        const r = row.original;
+        if (r.status !== "FEE_PENDING" || !canVoid) return null;
+        return (
+          <Group justify="flex-end" wrap="nowrap">
+            <Button
+              size="xs"
+              radius="md"
+              variant="subtle"
+              color="red"
+              onClick={() => setVoiding(r)}
+            >
+              Void
+            </Button>
+          </Group>
+        );
+      },
+    },
+  ];
+
+  return (
+    <PageContainer>
+      <Stack gap="lg">
+        <PageHeader
+          title="Wagon cancellations"
+          subtitle="Partial wagon cancellations — fees charged, credits held, and where each credit was rebooked"
+          breadcrumbs={[
+            { label: "Bookings", href: "/dashboard/booking-requests" },
+            { label: "Wagon cancellations" },
+          ]}
+        />
+
+        <Card withBorder radius="md" p="md">
+          <Stack gap="md">
+            <Group gap="sm" wrap="wrap">
+              <TextInput
+                placeholder="Search booking ref or company…"
+                leftSection={<Search size={15} />}
+                value={search}
+                onChange={(e) => {
+                  setSearch(e.currentTarget.value);
+                  resetPage();
+                }}
+                w={260}
+                radius="md"
+              />
+              <Select
+                placeholder="Status"
+                data={STATUS_FILTER_OPTIONS}
+                value={status}
+                onChange={(v) => {
+                  setStatus(v);
+                  resetPage();
+                }}
+                clearable
+                w={190}
+                radius="md"
+              />
+              <DateInput
+                placeholder="From"
+                value={from}
+                onChange={(v) => {
+                  setFrom(v ? new Date(v) : null);
+                  resetPage();
+                }}
+                maxDate={to ?? undefined}
+                clearable
+                radius="md"
+                style={{ minWidth: 140 }}
+              />
+              <DateInput
+                placeholder="To"
+                value={to}
+                onChange={(v) => {
+                  setTo(v ? new Date(v) : null);
+                  resetPage();
+                }}
+                minDate={from ?? undefined}
+                clearable
+                radius="md"
+                style={{ minWidth: 140 }}
+              />
+              <Button
+                variant="subtle"
+                radius="md"
+                onClick={() => {
+                  setStatus(null);
+                  setSearch("");
+                  setFrom(null);
+                  setTo(null);
+                  resetPage();
+                }}
+              >
+                Clear
+              </Button>
+            </Group>
+
+            <Box style={{ overflowX: "auto" }} w="100%">
+              <DataTable
+                columns={columns}
+                data={rows}
+                status={isLoading ? "loading" : isError ? "error" : "success"}
+                pagination={{
+                  pageIndex: pagination.pageIndex,
+                  pageSize: pagination.pageSize,
+                  pageCount,
+                  totalCount: total,
+                }}
+                tableOptions={{
+                  state: { pagination },
+                  onPaginationChange: setPagination,
+                  manualPagination: true,
+                  pageCount,
+                }}
+                containerClassName="border-0 shadow-none bg-transparent"
+                footer={DataTableFooter}
+              />
+            </Box>
+          </Stack>
+        </Card>
+      </Stack>
+
+      <Modal
+        opened={Boolean(voiding)}
+        onClose={() => setVoiding(null)}
+        radius="md"
+        title="Void this cancellation?"
+      >
+        {!voiding ? null : (
+          <Stack gap="sm">
+            <Text size="sm">
+              {voiding.booking?.reference ?? voiding.bookingId} ·{" "}
+              {voiding.wagonsCancelled} wagon(s) · fee{" "}
+              {formatAmount(voiding.feeAmount, voiding.feeCurrency)}
+            </Text>
+            <Text size="sm" c="dimmed">
+              The pending fee is dropped and the wagons stay on the booking.
+              Voiding can't be undone.
+            </Text>
+            <Group justify="flex-end" gap="sm">
+              <Button
+                variant="default"
+                radius="md"
+                onClick={() => setVoiding(null)}
+              >
+                Keep it
+              </Button>
+              <Button
+                color="red"
+                radius="md"
+                leftSection={<XCircle size={15} />}
+                loading={withdraw.isPending}
+                onClick={async () => {
+                  try {
+                    await withdraw.mutateAsync(voiding.id);
+                    toast.success("Cancellation voided");
+                    setVoiding(null);
+                    void refetch();
+                  } catch {
+                    // interceptor surfaces the reason
+                  }
+                }}
+              >
+                Void
+              </Button>
+            </Group>
+          </Stack>
+        )}
+      </Modal>
+    </PageContainer>
+  );
+}
diff --git a/apps/edr-freight-web/backoffice/src/pages/contracts/ClearanceDocumentsPage.tsx b/apps/edr-freight-web/backoffice/src/pages/contracts/ClearanceDocumentsPage.tsx
index 8a7949410..ca4ed18ce 100644
--- a/apps/edr-freight-web/backoffice/src/pages/contracts/ClearanceDocumentsPage.tsx
+++ b/apps/edr-freight-web/backoffice/src/pages/contracts/ClearanceDocumentsPage.tsx
@@ -161,10 +161,10 @@ export default function ClearanceDocumentsPage() {
                 <User className="size-4" strokeWidth={1.75} />
               </div>
               <div className="min-w-0">
-                <p className="truncate font-medium text-foreground">
+                <p className="font-medium text-foreground">
                   {customer}
                 </p>
-                <p className="mt-0.5 flex items-center gap-1 truncate text-xs text-muted-foreground">
+                <p className="mt-0.5 flex items-center gap-1 text-xs text-muted-foreground">
                   <FileText className="size-3 shrink-0 opacity-70" />
                   {b.reference}
                 </p>
@@ -182,7 +182,7 @@ export default function ClearanceDocumentsPage() {
             <ContractReferenceLink
               contractId={b.contractId}
               contractReference={b.contractReference}
-              className="block truncate text-sm text-foreground underline underline-offset-2 hover:text-muted-foreground"
+              className="block text-sm text-foreground underline underline-offset-2 hover:text-muted-foreground"
             />
           ) : (
             <Text size="sm">—</Text>
@@ -409,7 +409,7 @@ export default function ClearanceDocumentsPage() {
                     manualPagination: true,
                     pageCount,
                   }}
-                  containerClassName="border-0 shadow-none bg-transparent"
+                  containerClassName="border-0 shadow-none bg-transparent [&_th]:max-w-[100px] [&_td]:max-w-[100px] [&_td]:break-words"
                   footer={DataTableFooter}
                 />
               </Box>
diff --git a/apps/edr-freight-web/backoffice/src/pages/contracts/ContractClearanceDetailPage.tsx b/apps/edr-freight-web/backoffice/src/pages/contracts/ContractClearanceDetailPage.tsx
index 3b4d2edd9..b49eb419c 100644
--- a/apps/edr-freight-web/backoffice/src/pages/contracts/ContractClearanceDetailPage.tsx
+++ b/apps/edr-freight-web/backoffice/src/pages/contracts/ContractClearanceDetailPage.tsx
@@ -311,6 +311,7 @@ export default function ContractClearanceDetailPage() {
             note={clearance.linkedBookingReviewNote}
             scheduledDate={clearance.linkedBookingScheduledDate}
             canResubmit={canResubmitBooking}
+            editHref={`/dashboard/contracts/${id}/bookings/${linkedBookingId}/complete?copyFrom=${linkedBookingId}`}
             onResubmitted={() => {
               void refetch();
               void refetchContract();
diff --git a/apps/edr-freight-web/backoffice/src/pages/contracts/ContractClearanceListPage.tsx b/apps/edr-freight-web/backoffice/src/pages/contracts/ContractClearanceListPage.tsx
index 3d1e20bb6..8719f644a 100644
--- a/apps/edr-freight-web/backoffice/src/pages/contracts/ContractClearanceListPage.tsx
+++ b/apps/edr-freight-web/backoffice/src/pages/contracts/ContractClearanceListPage.tsx
@@ -393,10 +393,10 @@ function ShipmentBookingsTable({
               <PackageCheck className="size-4" strokeWidth={1.75} />
             </div>
             <div className="min-w-0">
-              <p className="truncate font-medium text-foreground">
+              <p className="font-medium text-foreground">
                 {row.original.reference}
               </p>
-              <p className="mt-0.5 flex items-center gap-1 truncate text-xs text-muted-foreground">
+              <p className="mt-0.5 flex items-center gap-1 text-xs text-muted-foreground">
                 <User className="size-3 shrink-0 opacity-70" />
                 {row.original.customerLabel}
               </p>
@@ -413,7 +413,7 @@ function ShipmentBookingsTable({
             <Stack gap={4} py={2}>
               <Group gap={6} wrap="nowrap">
                 <FileText size={13} className="shrink-0 text-muted-foreground" />
-                <Text size="sm" fw={500} truncate maw={150}>
+                <Text size="sm" fw={500}>
                   {r.contractReference ?? "—"}
                 </Text>
               </Group>
@@ -431,13 +431,9 @@ function ShipmentBookingsTable({
         header: () => <span className={bookingTable.headerCell}>Route</span>,
         cell: ({ row }) => (
           <Group gap={6} wrap="nowrap">
-            <Text size="sm" className="truncate">
-              {row.original.originLabel}
-            </Text>
+            <Text size="sm">{row.original.originLabel}</Text>
             <ArrowRight size={13} className="shrink-0 text-muted-foreground" />
-            <Text size="sm" className="truncate">
-              {row.original.destinationLabel}
-            </Text>
+            <Text size="sm">{row.original.destinationLabel}</Text>
           </Group>
         ),
       },
@@ -610,7 +606,7 @@ function ShipmentBookingsTable({
         data={rows}
         status={loading ? "loading" : error ? "error" : "success"}
         onRowClick={(row) => onOpen(row.id)}
-        containerClassName="border-0 shadow-none bg-transparent"
+        containerClassName="border-0 shadow-none bg-transparent [&_th]:max-w-[100px] [&_td]:max-w-[100px] [&_td]:break-words"
       />
     </Box>
   );
diff --git a/apps/edr-freight-web/backoffice/src/pages/contracts/ContractRequestDetailPage.tsx b/apps/edr-freight-web/backoffice/src/pages/contracts/ContractRequestDetailPage.tsx
index 0caea8df5..8c0ef7b5c 100644
--- a/apps/edr-freight-web/backoffice/src/pages/contracts/ContractRequestDetailPage.tsx
+++ b/apps/edr-freight-web/backoffice/src/pages/contracts/ContractRequestDetailPage.tsx
@@ -450,6 +450,35 @@ export default function ContractRequestDetailPage() {
           description={statusMeta.description}
         />
 
+        {/* A contract resting in APPROVED means the automatic PDF generation on
+            final approval failed — on success it moves straight to
+            CONTRACT_READY. Offer the manual retry. */}
+        {contract.status === "APPROVED" ? (
+          <Alert
+            color="orange"
+            radius="md"
+            icon={<AlertTriangle size={18} />}
+            title="Contract document was not generated"
+          >
+            <Stack gap="sm" align="flex-start">
+              <Text size="sm">
+                All approvals are complete, but generating the contract PDF
+                failed. Retry the generation below.
+              </Text>
+              <Button
+                color="edr-green"
+                size="compact-sm"
+                radius="lg"
+                leftSection={<RefreshCw size={15} />}
+                loading={mutations.generateContract.isPending}
+                onClick={() => mutations.generateContract.mutate()}
+              >
+                Regenerate contract
+              </Button>
+            </Stack>
+          </Alert>
+        ) : null}
+
         {contract.status === "REJECTED" && contract.latestRejectionNote ? (
           <Alert
             color="red"
diff --git a/apps/edr-freight-web/backoffice/src/pages/contracts/GlDjiboutiClearanceListPage.tsx b/apps/edr-freight-web/backoffice/src/pages/contracts/GlDjiboutiClearanceListPage.tsx
index c82cfd152..77ad33f56 100644
--- a/apps/edr-freight-web/backoffice/src/pages/contracts/GlDjiboutiClearanceListPage.tsx
+++ b/apps/edr-freight-web/backoffice/src/pages/contracts/GlDjiboutiClearanceListPage.tsx
@@ -226,11 +226,11 @@ function RouteCell({
   return (
     <Stack gap={4} py={2}>
       <Group gap={6} wrap="nowrap">
-        <Text size="sm" fw={500} truncate maw={120}>
+        <Text size="sm" fw={500}>
           {origin}
         </Text>
         <ArrowRight size={14} className="shrink-0 text-muted-foreground" />
-        <Text size="sm" fw={500} truncate maw={120}>
+        <Text size="sm" fw={500}>
           {destination}
         </Text>
       </Group>
@@ -385,10 +385,10 @@ export default function GlDjiboutiClearanceListPage() {
                 <PackageCheck className="size-4" strokeWidth={1.75} />
               </div>
               <div className="min-w-0">
-                <p className="truncate font-medium text-foreground">
+                <p className="font-medium text-foreground">
                   {r.reference}
                 </p>
-                <p className="mt-0.5 flex items-center gap-1 truncate text-xs text-muted-foreground">
+                <p className="mt-0.5 flex items-center gap-1 text-xs text-muted-foreground">
                   <User className="size-3 shrink-0 opacity-70" />
                   {r.customerLabel}
                 </p>
@@ -403,9 +403,7 @@ export default function GlDjiboutiClearanceListPage() {
         cell: ({ row }) => (
           <Group gap={6} wrap="nowrap">
             <FileText size={13} className="shrink-0 text-muted-foreground" />
-            <Text size="sm" truncate maw={140}>
-              {row.original.contractReference}
-            </Text>
+            <Text size="sm">{row.original.contractReference}</Text>
           </Group>
         ),
       },
@@ -710,7 +708,7 @@ export default function GlDjiboutiClearanceListPage() {
                     manualPagination: true,
                     pageCount,
                   }}
-                  containerClassName="border-0 shadow-none bg-transparent"
+                  containerClassName="border-0 shadow-none bg-transparent [&_th]:max-w-[100px] [&_td]:max-w-[100px] [&_td]:break-words"
                   footer={DataTableFooter}
                 />
               </Box>
diff --git a/apps/edr-freight-web/backoffice/src/pages/invoices/InvoiceDetailPage.tsx b/apps/edr-freight-web/backoffice/src/pages/invoices/InvoiceDetailPage.tsx
index 7bafc093e..629f8ec7c 100644
--- a/apps/edr-freight-web/backoffice/src/pages/invoices/InvoiceDetailPage.tsx
+++ b/apps/edr-freight-web/backoffice/src/pages/invoices/InvoiceDetailPage.tsx
@@ -13,6 +13,8 @@ import {
 } from "@mantine/core";
 import { useQuery } from "@tanstack/react-query";
 import { ArrowLeft, Download } from "lucide-react";
+import { useAuth } from "@/auth/useAuth";
+import { FREIGHT_PERMS, hasPermission } from "@/lib/permissions";
 import { useState } from "react";
 import { useNavigate, useParams } from "react-router-dom";
 
@@ -60,6 +62,8 @@ function InfoField({ label, value }: { label: string; value?: string | null }) {
 }
 
 export default function InvoiceDetailPage() {
+  const { user } = useAuth();
+  const canExport = hasPermission(user, FREIGHT_PERMS.invoices.export);
   const { id } = useParams<{ id: string }>();
   const navigate = useNavigate();
   const [downloading, setDownloading] = useState(false);
@@ -124,6 +128,7 @@ export default function InvoiceDetailPage() {
             size="lg"
             radius="md"
             aria-label="Download invoice"
+            disabled={!canExport}
             loading={downloading}
             onClick={() => void downloadDocument()}
           >
diff --git a/apps/edr-freight-web/backoffice/src/pages/ruleEngine/RuleEngineResourcePage.tsx b/apps/edr-freight-web/backoffice/src/pages/ruleEngine/RuleEngineResourcePage.tsx
index 3a0a36ce4..885fcb82b 100644
--- a/apps/edr-freight-web/backoffice/src/pages/ruleEngine/RuleEngineResourcePage.tsx
+++ b/apps/edr-freight-web/backoffice/src/pages/ruleEngine/RuleEngineResourcePage.tsx
@@ -306,34 +306,27 @@ const RuleEngineResourcePage = () => {
 
   const formFields = useMemo(() => {
     if (!config) return [];
-    // Last-mile container bands: creating uses the multi-row tier list (one
-    // rate per tier); editing an existing band row keeps the single
-    // From/To/value fields (a rate row IS one band).
+    // Last-mile bands (both modes): creating uses the multi-row tier list (one
+    // rate per tier, each tier carrying its own rate value); editing an
+    // existing band row keeps the single From/To/value fields (a rate row IS
+    // one band).
     const bandFields = config.formFields.filter((field) => {
       if (config.slug !== "rates") return true;
       if (field.type === "tierList") return !editing;
       if (editing) return true;
-      return field.name !== "minKm" && field.name !== "maxKm";
-    });
-    return bandFields.map((field) => {
-      // On create, the tier rows carry the per-band rate values — the single
-      // last-mile "Rate value" field then only applies to bulk mode.
+      // On create the tier rows carry From/To/value — drop the single fields,
+      // including the last-mile "Rate value" (the non-last-mile one keeps its
+      // own showIf).
       if (
-        config.slug === "rates" &&
-        !editing &&
         field.name === "rateValue" &&
         field.showWhen?.field === "appliesTo" &&
         field.showWhen.equals.includes("LAST_MILE")
       ) {
-        return {
-          ...field,
-          showWhen: undefined,
-          showIf: (values: Record<string, unknown>) =>
-            values.appliesTo === "LAST_MILE" && values.lastMileMode === "BULK",
-        };
+        return false;
       }
-      return field;
-    }).map((field) => {
+      return field.name !== "minKm" && field.name !== "maxKm";
+    });
+    return bandFields.map((field) => {
       if (isPriorityRules && field.name === "minWagonCount") {
         return {
           ...field,
@@ -501,7 +494,7 @@ const RuleEngineResourcePage = () => {
       header: col.header,
       meta: { headerClassName, cellClassName },
       cell: ({ row }) => {
-        const cell = formatCell(row.original[col.accessorKey], col.format);
+        const cell = formatCell(row.original[col.accessorKey], col.format, row.original);
         // On the rate column, show the proposed value under the live one — the
         // live value stays the headline because it is what still gets charged.
         if (!isRates || col.accessorKey !== "rateValue") return cell;
@@ -621,19 +614,15 @@ const RuleEngineResourcePage = () => {
         currency: isLastMile ? (values.currency ?? "ETB") : "USD",
         trigger: isSurcharge ? values.trigger : "ALWAYS",
         ...(isLastMile
-          ? lastMileMode === "BULK"
-            ? {
-                rateUnit: "PER_TON_KM",
-                containerTypeId: undefined,
-                minKm: undefined,
-                maxKm: undefined,
-              }
-            : {
-                rateUnit: "PER_KM",
-                // Empty "To km" means an open-ended band — send null so an
-                // edit can clear a previously-set ceiling.
-                maxKm: values.maxKm ?? null,
-              }
+          ? {
+              // Empty "To km" means an open-ended band — send null so an
+              // edit can clear a previously-set ceiling. On create the tier
+              // spread below overrides the band fields per tier.
+              maxKm: values.maxKm ?? null,
+              ...(lastMileMode === "BULK"
+                ? { rateUnit: "PER_TON_KM", containerTypeId: undefined }
+                : { rateUnit: "PER_KM" }),
+            }
           : {}),
       };
       // Editing a LIVE rate files a change request — the rate keeps charging
diff --git a/apps/edr-freight-web/backoffice/src/pages/ruleEngine/config/resources.ts b/apps/edr-freight-web/backoffice/src/pages/ruleEngine/config/resources.ts
index a51b542c2..d5998515e 100644
--- a/apps/edr-freight-web/backoffice/src/pages/ruleEngine/config/resources.ts
+++ b/apps/edr-freight-web/backoffice/src/pages/ruleEngine/config/resources.ts
@@ -70,6 +70,8 @@ export interface FormFieldDef {
    * relation list (`wagonTypeIds` read from `record.wagonTypes`).
    */
   getInitialValue?: (record: Record<string, unknown>) => unknown;
+  /** Pre-selected value on create (no record yet) — e.g. last-mile currency = ETB. */
+  defaultValue?: string;
   /**
    * Fully derived field: its value is computed from the live form values on
    * every render and the input is locked. Used for the priority-rule min
@@ -297,8 +299,8 @@ export const rateUnitOptions = (
 };
 
 const CURRENCIES = [
+  { label: "ETB (Birr)", value: "ETB" },
   { label: "USD", value: "USD" },
-  { label: "ETB", value: "ETB" },
 ];
 
 const PRIORITY_CONFIG_TYPES = [
@@ -1001,7 +1003,8 @@ export const RULE_ENGINE_RESOURCES: RuleEngineResourceConfig[] = [
         placeholder: "0",
         description: "Band start (inclusive). Use 0 for the first band.",
         showIf: (v) =>
-          v.appliesTo === "LAST_MILE" && v.lastMileMode === "CONTAINER",
+          v.appliesTo === "LAST_MILE" &&
+          (v.lastMileMode === "CONTAINER" || v.lastMileMode === "BULK"),
       },
       {
         name: "maxKm",
@@ -1011,7 +1014,8 @@ export const RULE_ENGINE_RESOURCES: RuleEngineResourceConfig[] = [
         placeholder: "Leave empty for no upper limit",
         description: "Band end (exclusive) — a 0–30 band covers up to but not including 30 km.",
         showIf: (v) =>
-          v.appliesTo === "LAST_MILE" && v.lastMileMode === "CONTAINER",
+          v.appliesTo === "LAST_MILE" &&
+          (v.lastMileMode === "CONTAINER" || v.lastMileMode === "BULK"),
       },
       {
         name: "currency",
@@ -1020,6 +1024,8 @@ export const RULE_ENGINE_RESOURCES: RuleEngineResourceConfig[] = [
         required: true,
         options: CURRENCIES,
         showWhen: { field: "appliesTo", equals: ["LAST_MILE"] },
+        // Birr is the norm for domestic trucking; USD stays selectable.
+        defaultValue: "ETB",
         getInitialValue: (record) => String(record.currency ?? "ETB"),
       },
       // ── Distance tiers (create only — the page swaps this for the single
@@ -1031,9 +1037,10 @@ export const RULE_ENGINE_RESOURCES: RuleEngineResourceConfig[] = [
         type: "tierList",
         required: true,
         description:
-          "One rate per distance range. To km is exclusive (0–30 then 30+); leave the last tier's To km empty for no upper limit.",
+          "One rate per distance range — the rate value is per km (container mode) or per ton per km (bulk mode). To km is exclusive (0–30 then 30+); leave the last tier's To km empty for no upper limit.",
         showIf: (v) =>
-          v.appliesTo === "LAST_MILE" && v.lastMileMode === "CONTAINER",
+          v.appliesTo === "LAST_MILE" &&
+          (v.lastMileMode === "CONTAINER" || v.lastMileMode === "BULK"),
       },
       // ── Container type — Container freight, container-kind intercity, and
       // the empty-container return surcharge (20ft vs 40ft price differently) ─
diff --git a/apps/edr-freight-web/backoffice/src/pages/support/SupportInboxPage.tsx b/apps/edr-freight-web/backoffice/src/pages/support/SupportInboxPage.tsx
index 6b2b5df2e..e3fc0cee2 100644
--- a/apps/edr-freight-web/backoffice/src/pages/support/SupportInboxPage.tsx
+++ b/apps/edr-freight-web/backoffice/src/pages/support/SupportInboxPage.tsx
@@ -51,6 +51,8 @@ import {
 } from "@/features/support/useSupport";
 import { useSupportSocket } from "@/features/support/useSupportSocket";
 import { customersService } from "@/services/customers.service";
+import { useAuth } from "@/auth/useAuth";
+import { FREIGHT_PERMS, hasPermission } from "@/lib/permissions";
 
 type ReadFilter = "ALL" | "UNREAD";
 
@@ -401,6 +403,8 @@ function ConversationThread({
     fetchNextPage,
   } = useMessages(conversation.id);
   const send = useSendMessage(conversation.id);
+  const { user: agentUser } = useAuth();
+  const canSend = hasPermission(agentUser, FREIGHT_PERMS.support.agentSend);
   const markRead = useMarkConversationRead();
   const [draft, setDraft] = useState("");
   const [dragging, setDragging] = useState(false);
@@ -656,7 +660,7 @@ function ConversationThread({
             color="edr-green"
             variant="filled"
             loading={send.isPending}
-            disabled={!draft.trim() && attach.attachments.length === 0}
+            disabled={!canSend || (!draft.trim() && attach.attachments.length === 0)}
             onClick={submit}
           >
             <Send size={18} />
diff --git a/apps/edr-freight-web/backoffice/src/pages/trainScheduling/TrainScheduleV2DetailPage.tsx b/apps/edr-freight-web/backoffice/src/pages/trainScheduling/TrainScheduleV2DetailPage.tsx
index ce6fe5353..9b32d19b6 100644
--- a/apps/edr-freight-web/backoffice/src/pages/trainScheduling/TrainScheduleV2DetailPage.tsx
+++ b/apps/edr-freight-web/backoffice/src/pages/trainScheduling/TrainScheduleV2DetailPage.tsx
@@ -42,6 +42,8 @@ import { useCallback, useEffect, useMemo, useRef, useState } from "react";
 import { Link, useParams } from "react-router-dom";
 
 import { KpiStrip, PageContainer } from "@/components/page";
+import { useAuth } from "@/auth/useAuth";
+import { FREIGHT_PERMS, hasPermission } from "@/lib/permissions";
 import {
   autoFillPlacements,
   mergePlacementsWithSaved,
@@ -102,6 +104,7 @@ const parseError = (error: unknown, fallback: string) => {
 };
 
 export default function TrainScheduleV2DetailPage() {
+  const { user: authUser } = useAuth();
   const { scheduleId } = useParams<{ scheduleId: string }>();
   const { toast } = useToast();
   const [activeStep, setActiveStep] = useState(0);
@@ -394,7 +397,9 @@ export default function TrainScheduleV2DetailPage() {
         : [];
 
   const canEditBookings = ["DRAFT", "SCHEDULED"].includes(schedule.status);
-  const canDispatch = schedule.status === "SCHEDULED";
+  const canDispatch =
+    schedule.status === "SCHEDULED" &&
+    hasPermission(authUser, FREIGHT_PERMS.trainScheduling.dispatch);
 
   // Dispatch readiness: bookings with no wagon, and wagon-loaded bookings whose
   // cargo staff never marked loaded. Both are warnings, not blockers — staff can
@@ -916,10 +921,10 @@ export default function TrainScheduleV2DetailPage() {
                   <Title order={2} fw={700} style={{ color: "#0f172a" }}>
                     {schedule.route?.name ?? "Train schedule"}
                   </Title>
-                  {schedule.trainNumber ? (
-                    <Badge variant="light" color="#F2A516" radius="sm" style={{ fontWeight: 600 }}>
-                      {schedule.trainNumber}
-                    </Badge>
+                  {schedule.train?.trainName ? (
+                    <Text fw={700} style={{ color: "#0f172a" }}>
+                      {schedule.train.trainName}
+                    </Text>
                   ) : null}
                   {schedule.train ? (
                     <Text size="xs" c="dimmed" ff="monospace">
@@ -927,6 +932,51 @@ export default function TrainScheduleV2DetailPage() {
                     </Text>
                   ) : null}
                 </Group>
+
+                {/* Voyage (train) number and trade direction — the two things
+                    operations identify a run by, so they read at a glance
+                    rather than as small badges among the rest. */}
+                <Group gap="lg" align="center" wrap="wrap">
+                  {schedule.trainNumber ? (
+                    <Box>
+                      <Text size="xs" c="dimmed" fw={600} tt="uppercase" lh={1.2}>
+                        Voyage No.
+                      </Text>
+                      <Text
+                        ff="monospace"
+                        fw={800}
+                        lh={1.1}
+                        style={{ fontSize: 32, color: "#0f172a" }}
+                      >
+                        {schedule.trainNumber}
+                      </Text>
+                    </Box>
+                  ) : null}
+                  {schedule.direction ? (
+                    <Box>
+                      <Text size="xs" c="dimmed" fw={600} tt="uppercase" lh={1.2}>
+                        Direction
+                      </Text>
+                      <Text
+                        fw={800}
+                        lh={1.1}
+                        tt="uppercase"
+                        style={{
+                          fontSize: 32,
+                          letterSpacing: 0.5,
+                          color:
+                            schedule.direction === "IMPORT"
+                              ? "#2E5B96"
+                              : schedule.direction === "EXPORT"
+                                ? "#0A6F4D"
+                                : "#0f172a",
+                        }}
+                      >
+                        {schedule.direction}
+                      </Text>
+                    </Box>
+                  ) : null}
+                </Group>
                 {(schedule.stops?.length ?? 0) >= 3 ||
                 (schedule.bookings ?? []).some(
                   (b) => b.tradeDirection === "DOMESTIC",
diff --git a/apps/edr-freight-web/backoffice/src/pages/trainScheduling/TrainScheduleV2ListPage.tsx b/apps/edr-freight-web/backoffice/src/pages/trainScheduling/TrainScheduleV2ListPage.tsx
index 3c2244f68..c132c2534 100644
--- a/apps/edr-freight-web/backoffice/src/pages/trainScheduling/TrainScheduleV2ListPage.tsx
+++ b/apps/edr-freight-web/backoffice/src/pages/trainScheduling/TrainScheduleV2ListPage.tsx
@@ -63,7 +63,7 @@ import { api } from "@/services/api";
 import { formatRouteLabel } from "@/services/routes.service";
 import { useToast } from "@/hooks/use-toast";
 import { useAuth } from "@/auth/useAuth";
-import { canCreateSchedule, canUpdateSchedule } from "@/lib/permissions";
+import { FREIGHT_PERMS, canCreateSchedule, hasPermission } from "@/lib/permissions";
 import type {
   CreateScheduleWindowRulePayload,
   FreightType,
@@ -111,7 +111,7 @@ export default function TrainScheduleV2ListPage() {
   const { toast } = useToast();
   const { user } = useAuth();
   const canCreate = canCreateSchedule(user);
-  const canUpdate = canUpdateSchedule(user);
+  const canDispatch = hasPermission(user, FREIGHT_PERMS.trainScheduling.dispatch);
   const { viewMode, setViewMode } = useFleetViewMode("train-scheduling-v2");
   const { pagination, setPagination } = usePagination({ pageSize: 10 });
   const [search, setSearch] = useState("");
@@ -491,7 +491,7 @@ export default function TrainScheduleV2ListPage() {
                   {/* Start the run. Same transition as the detail page's
                       Dispatch button — that page also shows unassigned-wagon
                       and not-loaded warnings, so it stays the fuller surface. */}
-                  {canUpdate && schedule.status === "SCHEDULED" ? (
+                  {canDispatch && schedule.status === "SCHEDULED" ? (
                     <Menu.Item
                       leftSection={<Play size={15} />}
                       onClick={() => setDispatchTarget(schedule)}
diff --git a/apps/edr-freight-web/backoffice/src/pages/warehouses/WarehouseInvoicesPage.tsx b/apps/edr-freight-web/backoffice/src/pages/warehouses/WarehouseInvoicesPage.tsx
index c8e3d111d..dc4ae4f86 100644
--- a/apps/edr-freight-web/backoffice/src/pages/warehouses/WarehouseInvoicesPage.tsx
+++ b/apps/edr-freight-web/backoffice/src/pages/warehouses/WarehouseInvoicesPage.tsx
@@ -38,6 +38,8 @@ import {
 import { openPdfBlob } from '@/components/warehouses/pdf';
 import { buildWarehouseExitPaperPdf } from '@/components/warehouses/warehousePdf';
 import { extractErrorMessage } from '@/components/warehouses/options';
+import { useAuth } from '@/auth/useAuth';
+import { FREIGHT_PERMS, hasPermission } from '@/lib/permissions';
 
 const STATUS_COLOR: Record<WarehouseInvoiceStatus, string> = {
   DRAFT: 'gray',
@@ -171,6 +173,9 @@ export default function WarehouseInvoicesPage() {
 }
 
 function InvoiceDetailModal({ id, onClose }: { id: string | null; onClose: () => void }) {
+  const { user } = useAuth();
+  const mayRecordPayment = hasPermission(user, FREIGHT_PERMS.warehouseFeeInvoices.pay);
+  const canCancelInvoice = hasPermission(user, FREIGHT_PERMS.warehouseFeeInvoices.cancel);
   const { toast } = useToast();
   const navigate = useNavigate();
   const { data: inv, isLoading } = useQuery(
@@ -430,9 +435,11 @@ function InvoiceDetailModal({ id, onClose }: { id: string | null; onClose: () =>
                   placeholder="Optional"
                   style={{ flex: 1 }}
                 />
-                <Button leftSection={<CreditCard size={16} />} loading={payOnline.isPending} onClick={handleOnlinePay}>
-                  Pay with {gatewayMethod === 'WAAFI' ? 'Waafi' : 'Telebirr'}
-                </Button>
+                {mayRecordPayment && (
+                  <Button leftSection={<CreditCard size={16} />} loading={payOnline.isPending} onClick={handleOnlinePay}>
+                    Pay with {gatewayMethod === 'WAAFI' ? 'Waafi' : 'Telebirr'}
+                  </Button>
+                )}
               </Group>
 
               <Divider label="Record manual payment" labelPosition="left" />
@@ -456,9 +463,11 @@ function InvoiceDetailModal({ id, onClose }: { id: string | null; onClose: () =>
                   onChange={(e) => setDriverPhone(e.currentTarget.value)}
                   style={{ flex: 1 }}
                 />
-                <Button leftSection={<CreditCard size={16} />} loading={pay.isPending} onClick={handlePay}>
-                  Pay
-                </Button>
+                {mayRecordPayment && (
+                  <Button leftSection={<CreditCard size={16} />} loading={pay.isPending} onClick={handlePay}>
+                    Pay
+                  </Button>
+                )}
               </Group>
             </>
           )}
@@ -506,7 +515,7 @@ function InvoiceDetailModal({ id, onClose }: { id: string | null; onClose: () =>
                 Gate clearance & exit paper
               </Button>
             )}
-            {inv.status !== 'PAID' && inv.status !== 'CANCELLED' && (
+            {inv.status !== 'PAID' && inv.status !== 'CANCELLED' && canCancelInvoice && (
               <Button variant="light" color="red" leftSection={<Ban size={16} />} loading={cancel.isPending} onClick={handleCancel}>
                 Cancel invoice
               </Button>
diff --git a/apps/edr-freight-web/backoffice/src/services/contracts.service.ts b/apps/edr-freight-web/backoffice/src/services/contracts.service.ts
index c0a397d7f..37971cb96 100644
--- a/apps/edr-freight-web/backoffice/src/services/contracts.service.ts
+++ b/apps/edr-freight-web/backoffice/src/services/contracts.service.ts
@@ -673,8 +673,16 @@ export const contractsService = {
   validateShipment: (
     id: string,
     payload: Freight.CreateBookingUnderContractDto,
+    // Completion/resubmit preview: exclude this booking's own containers from
+    // the same-train clash check.
+    excludeBookingId?: string,
   ) =>
-    postContract<ShipmentValidation>(C.VALIDATE_SHIPMENT(id), payload),
+    postContract<ShipmentValidation>(
+      excludeBookingId
+        ? `${C.VALIDATE_SHIPMENT(id)}?bookingId=${excludeBookingId}`
+        : C.VALIDATE_SHIPMENT(id),
+      payload,
+    ),
 
   /** Remaining bookable quantity per cargo line (GENERAL draw-down cap). */
   getCapacity: async (id: string): Promise<Freight.ContractCapacityLine[]> => {
diff --git a/apps/edr-freight-web/portal/public/assets/edr-portal-guide.webm b/apps/edr-freight-web/portal/public/assets/edr-portal-guide.webm
new file mode 100644
index 000000000..b28ffcdf5
Binary files /dev/null and b/apps/edr-freight-web/portal/public/assets/edr-portal-guide.webm differ
diff --git a/apps/edr-freight-web/portal/src/App.tsx b/apps/edr-freight-web/portal/src/App.tsx
index aefb94594..e14714334 100644
--- a/apps/edr-freight-web/portal/src/App.tsx
+++ b/apps/edr-freight-web/portal/src/App.tsx
@@ -3,6 +3,7 @@ import { useDisclosure } from "@mantine/hooks";
 import {
   Home,
   Layers,
+  LifeBuoy,
   Loader2,
   // MapPin,
   Package,
@@ -58,6 +59,10 @@ import CheckPaymentPage from "./pages/payments/CheckPaymentPage";
 import PaymentFailurePage from "./pages/payments/PaymentFailurePage";
 import FaydaCallbackPage from "./pages/FaydaCallbackPage";
 import PaymentSuccessPage from "./pages/payments/PaymentSuccessPage";
+import FaqPage from "./pages/support/FaqPage";
+import HelpPage from "./pages/support/HelpPage";
+import PrivacyPolicyPage from "./pages/support/PrivacyPolicyPage";
+import TermsPage from "./pages/support/TermsPage";
 import TrackingPage from "./pages/tracking/TrackingPage";
 
 function FullScreenSpinner() {
@@ -217,6 +222,12 @@ const sidebarItems: SidebarItem[] = [
     href: "/settings",
     icon: <Settings size={18} />,
   },
+  {
+    section: "Account",
+    label: "Help & Support",
+    href: "/help",
+    icon: <LifeBuoy size={18} />,
+  },
 ];
 
 const App = () => {
@@ -273,6 +284,14 @@ const App = () => {
         <Route path="/payment/success" element={<PaymentSuccessPage />} />
         <Route path="/payment/failure" element={<PaymentFailurePage />} />
 
+        {/* Help and legal pages. Public on purpose: the auth screens link to
+          them before a session exists, so they carry their own chrome rather
+          than sitting inside the authenticated app layout. */}
+        <Route path="/help" element={<HelpPage />} />
+        <Route path="/faq" element={<FaqPage />} />
+        <Route path="/privacy" element={<PrivacyPolicyPage />} />
+        <Route path="/terms" element={<TermsPage />} />
+
         {/* Auth pages — inaccessible once logged in */}
         <Route element={<RedirectIfAuthed />}>
           <Route path="/login" element={<LoginPage />} />
diff --git a/apps/edr-freight-web/portal/src/components/auth/AuthShell.tsx b/apps/edr-freight-web/portal/src/components/auth/AuthShell.tsx
index 439f41d19..801f60dd6 100644
--- a/apps/edr-freight-web/portal/src/components/auth/AuthShell.tsx
+++ b/apps/edr-freight-web/portal/src/components/auth/AuthShell.tsx
@@ -129,19 +129,19 @@ const FormFooter = () => (
     <span className="shrink-0">© 2026 EDR Freight</span>
     <div className="flex flex-wrap items-center justify-center gap-3 sm:justify-end sm:gap-6">
       <Link
-        to="#"
+        to="/terms"
         className="font-semibold text-gray-700 transition-colors hover:text-primary"
       >
         Terms &amp; Conditions
       </Link>
       <Link
-        to="#"
+        to="/privacy"
         className="font-semibold text-gray-700 transition-colors hover:text-primary"
       >
         Privacy Policy
       </Link>
       <Link
-        to="#"
+        to="/help"
         className="font-semibold text-gray-700 transition-colors hover:text-primary"
       >
         Help &amp; Support
diff --git a/apps/edr-freight-web/portal/src/components/onboarding/ETradeInfo.tsx b/apps/edr-freight-web/portal/src/components/onboarding/ETradeInfo.tsx
index e92b907e2..74e267a30 100644
--- a/apps/edr-freight-web/portal/src/components/onboarding/ETradeInfo.tsx
+++ b/apps/edr-freight-web/portal/src/components/onboarding/ETradeInfo.tsx
@@ -26,9 +26,22 @@ interface ETradeInfoProps {
   onStatusChange?: (status: ETradeStatus) => void;
   /** Called when the TIN changes away from the last fetched value — clear whatever it filled in. */
   onReset?: () => void;
+  /**
+   * This TIN already passed eTrade in an earlier session (the saved profile
+   * carries its registration details), so adopt it on arrival instead of
+   * re-querying. Rehydration lands the TIN after the first render, which used
+   * to look exactly like the customer typing a new one: every reopen fired a
+   * live lookup that could fail on an outage, and re-marked eTrade's fields as
+   * freshly verified so they were resubmitted on the next save. "Get Data"
+   * stays available for a deliberate re-verify.
+   */
+  alreadyVerified?: boolean;
 }
 
-const isValidTin = (tin: string) => tin.length === 10;
+// Digits, not just length: a 10-character non-numeric TIN used to fire a lookup
+// that could only fail, and the failure was then reported as "this TIN isn't
+// registered with eTrade" instead of "that isn't a TIN".
+const isValidTin = (tin: string) => /^\d{10}$/.test(tin);
 
 export default function ETradeInfo({
   tin,
@@ -37,6 +50,7 @@ export default function ETradeInfo({
   onDataLoaded,
   onStatusChange,
   onReset,
+  alreadyVerified,
 }: ETradeInfoProps) {
   const mutation = useETradeData();
   const isLoading = mutation.isPending;
@@ -63,6 +77,13 @@ export default function ETradeInfo({
   // doesn't refire the lookup the moment this mounts.
   const lastFetchedTin = useRef<string | null>(tin || null);
   useEffect(() => {
+    // A rehydrated TIN that eTrade already accepted: adopt it silently. Doing
+    // this before the change-detection below also keeps `onReset` from firing,
+    // which would wipe the very registration details that prove it passed.
+    if (alreadyVerified && lastFetchedTin.current === null && isValidTin(tin)) {
+      lastFetchedTin.current = tin;
+      return;
+    }
     if (tin !== lastFetchedTin.current) {
       // TIN moved away from whatever we last fetched — that result (verified
       // data, "taken", or an error) no longer describes this TIN. Drop it so
@@ -82,12 +103,17 @@ export default function ETradeInfo({
 
   const apiError =
     mutation.isError && mutation.error ? extractApiError(mutation.error) : null;
-  // A 400 here means eTrade simply has no record for this TIN.
-  const notFound = apiError?.statusCode === 400;
+  // A 400 here usually means eTrade has no record for this TIN — but the API
+  // also wraps its own transport failures as a 400 ("Failed to fetch company
+  // info from eTrade: …"), and reporting an outage as "this TIN isn't
+  // registered" sends the customer off to re-check a number that was fine.
+  const unreachable = /failed to fetch/i.test(apiError?.message ?? "");
+  const notFound = apiError?.statusCode === 400 && !unreachable;
   const errorMessage =
     apiError && !notFound
-      ? apiError.message ||
-      "We couldn't reach eTrade to fetch your company information. Please try again."
+      ? unreachable || !apiError.message
+        ? "We couldn't reach eTrade to fetch your company information. Please try again in a moment."
+        : apiError.message
       : null;
 
   const status: ETradeStatus = isLoading
diff --git a/apps/edr-freight-web/portal/src/features/bookingWindows/useBookingWindowSocket.ts b/apps/edr-freight-web/portal/src/features/bookingWindows/useBookingWindowSocket.ts
index 6df836357..7c33f5849 100644
--- a/apps/edr-freight-web/portal/src/features/bookingWindows/useBookingWindowSocket.ts
+++ b/apps/edr-freight-web/portal/src/features/bookingWindows/useBookingWindowSocket.ts
@@ -47,6 +47,7 @@ function applyEvent(
     windowClosesAt: event.windowClosesAt,
     docReviewEndsAt: event.docReviewEndsAt,
     paymentPhaseEndsAt: event.paymentPhaseEndsAt,
+    paymentDrainEndsAt: event.paymentDrainEndsAt,
     departureDate: event.scheduledDepartureDate ?? row.departureDate,
   };
 }
diff --git a/apps/edr-freight-web/portal/src/pages/EDRFreightLandingPage.tsx b/apps/edr-freight-web/portal/src/pages/EDRFreightLandingPage.tsx
index 54bffc47b..b6f4787d6 100644
--- a/apps/edr-freight-web/portal/src/pages/EDRFreightLandingPage.tsx
+++ b/apps/edr-freight-web/portal/src/pages/EDRFreightLandingPage.tsx
@@ -584,7 +584,35 @@ export default function EDRFreightLandingPage() {
             </div>
           </div>
 
-          <div>© 2026 EDR Freight. All rights reserved.</div>
+          <div className="flex flex-col items-center gap-4 md:items-end">
+            <nav className="flex flex-wrap items-center justify-center gap-x-6 gap-y-2">
+              <Link
+                to="/help"
+                className="font-semibold text-foreground transition-colors hover:text-primary"
+              >
+                Help &amp; Support
+              </Link>
+              <Link
+                to="/faq"
+                className="font-semibold text-foreground transition-colors hover:text-primary"
+              >
+                FAQ
+              </Link>
+              <Link
+                to="/privacy"
+                className="font-semibold text-foreground transition-colors hover:text-primary"
+              >
+                Privacy Policy
+              </Link>
+              <Link
+                to="/terms"
+                className="font-semibold text-foreground transition-colors hover:text-primary"
+              >
+                Terms of Service
+              </Link>
+            </nav>
+            <div>© 2026 EDR Freight. All rights reserved.</div>
+          </div>
         </div>
       </footer>
     </div>
diff --git a/apps/edr-freight-web/portal/src/pages/MyPortalPage/components/UpcomingWindowsSection.tsx b/apps/edr-freight-web/portal/src/pages/MyPortalPage/components/UpcomingWindowsSection.tsx
index 50e142708..c4bb03ed6 100644
--- a/apps/edr-freight-web/portal/src/pages/MyPortalPage/components/UpcomingWindowsSection.tsx
+++ b/apps/edr-freight-web/portal/src/pages/MyPortalPage/components/UpcomingWindowsSection.tsx
@@ -68,16 +68,29 @@ const COUNTDOWN_TEXT: Partial<
   PRE_WINDOW: { label: "Booking opens in", expiredText: "Booking opening now…" },
   OPEN: { label: "Window closes in", expiredText: "Document review starting…" },
   DOC_REVIEW: { label: "Document review ends in", expiredText: "Payment starting…" },
-  PAYMENT: { label: "Payment due in", expiredText: "Payment window closing…" },
+  PAYMENT: { label: "Payment due in", expiredText: "Finalizing payments…" },
 };
 
-function phaseCountdown(
-  w: MyBookingWindow,
-): { label: string; deadline: string; expiredText: string } | null {
+function phaseCountdown(w: MyBookingWindow): {
+  label: string;
+  deadline: string;
+  expiredText: string;
+  graceDeadline?: string | null;
+  graceLabel?: string;
+} | null {
   const state = bookingWindowUiState(w);
   const text = COUNTDOWN_TEXT[state.kind];
   if (!state.countdownTo || !text) return null;
-  return { ...text, deadline: state.countdownTo };
+  // Once the pay deadline lapses, pending payments still settle during the
+  // drain tail — count it down as "processing" instead of a stale "closing".
+  const grace =
+    state.kind === "PAYMENT" && w.paymentDrainEndsAt
+      ? {
+          graceDeadline: w.paymentDrainEndsAt,
+          graceLabel: "Payment processing — closes in",
+        }
+      : undefined;
+  return { ...text, deadline: state.countdownTo, ...grace };
 }
 
 function Pill({
@@ -336,6 +349,8 @@ export const UpcomingWindowsSection = memo(function UpcomingWindowsSection({
                         deadline={cd.deadline}
                         label={cd.label}
                         expiredText={cd.expiredText}
+                        graceDeadline={cd.graceDeadline}
+                        graceLabel={cd.graceLabel}
                         size="xs"
                       />
                     </Box>
diff --git a/apps/edr-freight-web/portal/src/pages/accounts/CompanyProfileForm.tsx b/apps/edr-freight-web/portal/src/pages/accounts/CompanyProfileForm.tsx
index 17c88d792..15354cfd3 100644
--- a/apps/edr-freight-web/portal/src/pages/accounts/CompanyProfileForm.tsx
+++ b/apps/edr-freight-web/portal/src/pages/accounts/CompanyProfileForm.tsx
@@ -38,6 +38,10 @@ import {
 } from "./companyProfileForm/schema";
 import {
   buildPayload,
+  firstPresent,
+  firstValidEmail,
+  firstValidPhone,
+  normalizeIdentityPhones,
   stepPayload,
   toFormValues,
 } from "./companyProfileForm/helpers";
@@ -45,6 +49,7 @@ import FaydaVerifyPanel from "@/components/FaydaVerifyPanel";
 import { verifaydaService } from "@/services/verifayda.service";
 import type { CompanyIdentityState } from "@/services/verifayda.service";
 import { LinkCheckboxCard } from "./companyProfileForm/LinkCheckboxCard";
+import { ReadOnlyField } from "./companyProfileForm/ReadOnlyField";
 import ETradeCompanyCard from "./companyProfileForm/ETradeCompanyCard";
 import StepSection from "./companyProfileForm/StepSection";
 
@@ -67,7 +72,7 @@ export default function CompanyProfileForm({
   submitError,
   uploadedDocumentKeys,
   onUploadDocuments,
-  identity,
+  identity: rawIdentity,
   onIdentityChange,
 }: {
   documentSettingCode: string;
@@ -115,6 +120,15 @@ export default function CompanyProfileForm({
    */
   onIdentityChange?: () => void;
 }) {
+  // A Fayda claim carries the phone as the national registry holds it, which is
+  // often a local number the form's E.164 validation (and the API's
+  // `@IsValidPhone()`) would reject — for a value the customer never typed and
+  // has no field to correct. Normalize once, here, so every read below is safe.
+  const identity = useMemo(
+    () => normalizeIdentityPhones(rawIdentity),
+    [rawIdentity],
+  );
+
   const [step, setStep] = useState<CompanyStep>(initialStep ?? "company");
   const [saving, setSaving] = useState(false);
   const [saveError, setSaveError] = useState<string | null>(null);
@@ -188,15 +202,20 @@ export default function CompanyProfileForm({
   const {
     register,
     control,
-    handleSubmit,
     trigger,
     watch,
     setValue,
-    formState: { errors },
+    getValues,
+    formState: { errors, dirtyFields },
   } = useForm<FormData>({
     resolver: zodResolver(
       buildOnboardingSchema(identity?.passportRequired === true),
     ),
+    // `values` below re-seeds the form whenever the profile is refetched — and
+    // an in-page identity action (ticking "same as owner") refetches it. Without
+    // this, that reset silently throws away whatever the customer was part-way
+    // through typing on the current step.
+    resetOptions: { keepDirtyValues: true, keepErrors: true },
     defaultValues: {
       companyName: "",
       companyEmail: "",
@@ -266,21 +285,28 @@ export default function CompanyProfileForm({
     phone: string;
   } | null>(null);
 
+  // `shouldDirty` is what marks the eTrade bundle as "re-verified this session";
+  // `stepPayload` sends those keys only when dirty, so an unchanged record is
+  // never echoed back to the API (which would make it re-query eTrade).
   const handleETradeDataLoaded = (data: CompanyRegistrationData) => {
+    const dirty = { shouldDirty: true } as const;
     if (data.companyName) {
-      setValue("companyName", data.companyName, { shouldValidate: true });
+      setValue("companyName", data.companyName, {
+        shouldValidate: true,
+        ...dirty,
+      });
     }
-    setValue("licenceNumber", data.licenceNumber);
-    setValue("statusDescription", data.statusDescription);
-    setValue("dateRegistered", data.dateRegistered);
-    setValue("renewedFrom", data.renewedFrom);
-    setValue("renewalDate", data.renewalDate);
-    setValue("renewedTo", data.renewedTo);
-    setValue("region", data.region);
-    setValue("zone", data.zone);
-    setValue("woreda", data.woreda);
-    setValue("kebele", data.kebele);
-    setValue("houseNo", data.houseNo);
+    setValue("licenceNumber", data.licenceNumber, dirty);
+    setValue("statusDescription", data.statusDescription, dirty);
+    setValue("dateRegistered", data.dateRegistered, dirty);
+    setValue("renewedFrom", data.renewedFrom, dirty);
+    setValue("renewalDate", data.renewalDate, dirty);
+    setValue("renewedTo", data.renewedTo, dirty);
+    setValue("region", data.region, dirty);
+    setValue("zone", data.zone, dirty);
+    setValue("woreda", data.woreda, dirty);
+    setValue("kebele", data.kebele, dirty);
+    setValue("houseNo", data.houseNo, dirty);
     // companyAddress is composed reactively from the address fields below, so
     // setting region/zone/woreda/kebele/houseNo above is enough — no need to
     // compose it here. companyPhone is derived below (identity → eTrade →
@@ -292,6 +318,7 @@ export default function CompanyProfileForm({
     setValue(
       "etradePhone",
       data.managerPhone || data.regularPhone || data.mobilePhone,
+      dirty,
     );
 
     setEtradeOwner({
@@ -321,28 +348,37 @@ export default function CompanyProfileForm({
     setEtradeOwner(null);
   };
 
-  // companyEmail/companyPhone are no longer typed — the Fayda-verified owner
+  // companyEmail/companyPhone are derived, not typed — the Fayda-verified owner
   // is the highest-trust source (that's the whole point of verifying), eTrade's
   // registered number and the account email/phone are the fallbacks used
   // before verification happens.
+  //
+  // `firstValid*`, not `??`: these sources are optional AND unreliable. Fayda's
+  // email/phone claims can come back empty, and eTrade's registered phone is
+  // free text that arrives as things like "09        " (→ "+2519"). `??` stops
+  // at the first non-null, so a junk value became a field with no input and a
+  // 400 from the API on a value the customer never typed. Skip anything that
+  // isn't usable and fall through.
+  //
+  // When every source really is unusable the fields become editable below
+  // rather than blocking — the API requires a company email and phone at
+  // submit (REQUIRED_COMPANY_INFO), so leaving no way to supply them is a dead
+  // end.
+  const derivedEmail = firstValidEmail(identity?.owner.email, user.email);
+  const derivedPhone = firstValidPhone(
+    identity?.owner.phone,
+    etradeOwner?.phone,
+    user.phoneNumber,
+  );
   useEffect(() => {
-    setValue("companyEmail", identity?.owner.email ?? user.email ?? "", {
-      shouldValidate: true,
-    });
+    if (derivedEmail) setValue("companyEmail", derivedEmail);
     // eslint-disable-next-line react-hooks/exhaustive-deps
-  }, [identity?.owner.email, user.email, rehydrate]);
+  }, [derivedEmail, rehydrate]);
 
   useEffect(() => {
-    setValue(
-      "companyPhone",
-      identity?.owner.phone ??
-      etradeOwner?.phone ??
-      toEthiopianE164(user.phoneNumber) ??
-      "",
-      { shouldValidate: true },
-    );
+    if (derivedPhone) setValue("companyPhone", derivedPhone);
     // eslint-disable-next-line react-hooks/exhaustive-deps
-  }, [identity?.owner.phone, etradeOwner?.phone, user.phoneNumber, rehydrate]);
+  }, [derivedPhone, rehydrate]);
 
   // "Same as …" links. A checked card prefills the target step's fields from the
   // source step and disables them (kept mirrored while linked); unchecking clears
@@ -352,6 +388,16 @@ export default function CompanyProfileForm({
   const [gmSameAsOwner, setGmSameAsOwner] = useState(
     identity?.gmSameAsOwner ?? false,
   );
+  // `identity` is undefined on the first render (the requirements query is still
+  // in flight), so the initial state above freezes at `false` — adopt the
+  // server's declaration the moment it lands, or a resumed draft shows an
+  // unticked box over a GM that is linked server-side.
+  const identityLoaded = useRef(false);
+  useEffect(() => {
+    if (!identity || identityLoaded.current) return;
+    identityLoaded.current = true;
+    setGmSameAsOwner(identity.gmSameAsOwner);
+  }, [identity]);
   const [contactSameAsGm, setContactSameAsGm] = useState(false);
 
   // General Manager source. The company step's email/phone are seeded from
@@ -365,16 +411,26 @@ export default function CompanyProfileForm({
   // A Fayda-verified owner outranks eTrade's registered owner — it's the
   // higher-trust source, and the whole point of proving identity is to stop
   // trusting typed/looked-up data for this.
-  const gmSourceName =
-    identity?.owner.name ?? etradeOwner?.name ?? user.name?.en ?? "";
-  const gmSourceEmail =
-    identity?.owner.email ?? (companyEmail || user.email || "");
-  const gmSourcePhone =
-    identity?.owner.phone ??
-    companyPhone ??
-    etradeOwner?.phone ??
-    toEthiopianE164(user.phoneNumber) ??
-    "";
+  const gmSourceName = firstPresent(
+    identity?.owner.name,
+    etradeOwner?.name,
+    user.name?.en,
+  );
+
+  const gmSourceEmail = firstValidEmail(
+    identity?.owner.email,
+    companyEmail,
+    user.email,
+  );
+  // Same reason as `derivedPhone`: this value is written into
+  // `generalManagerPhone`, which the API validates with `@IsValidPhone()`, so an
+  // unusable eTrade number here 400s the personnel step instead.
+  const gmSourcePhone = firstValidPhone(
+    identity?.owner.phone,
+    companyPhone,
+    etradeOwner?.phone,
+    user.phoneNumber,
+  );
 
   useEffect(() => {
     if (!gmSameAsOwner) return;
@@ -458,10 +514,24 @@ export default function CompanyProfileForm({
   const gmEstablished =
     gmVerified || (identity ? !identity.faydaRequired && gmTyped : gmTyped);
 
-  /** Same rule for the representative: verified, or typed where Fayda is optional. */
+  /**
+   * Same rule for the representative: verified, or entered where Fayda is
+   * optional.
+   *
+   * Matches the API's own rule (`REQUIRED_POA_FIELDS`): a typed representative
+   * counts once they have a name, an email and a phone. The step now renders
+   * inputs for all three, so this is something the customer can actually
+   * satisfy — previously it gated on `poaName`, for which no input existed
+   * anywhere, leaving a foreign freight forwarder permanently stuck.
+   */
+  const poaTyped = Boolean(
+    watch("poaName")?.trim() &&
+      watch("poaEmail")?.trim() &&
+      watch("poaPhone")?.trim(),
+  );
   const poaEstablished =
     (identity?.poa.verified ?? false) ||
-    (identity ? !identity.faydaRequired && Boolean(watch("poaName")?.trim()) : false);
+    (identity ? !identity.faydaRequired && poaTyped : false);
 
   // While linked, mirror the source values into the (disabled) target fields so
   // the copy stays current even if the user goes back and edits the source.
@@ -616,8 +686,12 @@ export default function CompanyProfileForm({
   // Until then the upload is hidden: there is no representative for the paper
   // to authorise, and a freight forwarder is held on the verification gate
   // below rather than on a file field it cannot yet fill.
-  const poaProvided = identity?.poa.verified ?? false;
-  const delegationRequired = poaProvided;
+  const poaProvided = (identity?.poa.verified ?? false) || poaTyped;
+  // A freight forwarder owes the paper whether or not its representative could
+  // verify with Fayda — the API demands it at completion either way. Keying
+  // this on the verification alone hid the upload from a foreign forwarder and
+  // then failed them on submit for a file they were never shown.
+  const delegationRequired = poaProvided || requirePoa;
   const delegationPresent =
     (uploadedDocumentKeys ?? []).includes(POA_DELEGATION_FILE_KEY) ||
     (() => {
@@ -625,15 +699,63 @@ export default function CompanyProfileForm({
       return Array.isArray(v) ? v.length > 0 : v != null;
     })();
 
+  /**
+   * Collect the messages for a set of fields into one sentence.
+   *
+   * A failed `trigger()` used to return silently, so Continue simply did
+   * nothing — and every field whose input is conditionally rendered (or derived
+   * and never rendered at all) turned into an invisible dead end. Naming the
+   * failures is the whole point: the ones worth reporting are exactly the ones
+   * with no error text on screen to read.
+   */
+  const describeErrors = (fields: (keyof FormData)[]): string => {
+    // Re-parse rather than read `errors`: that's the render-time snapshot, and
+    // this runs immediately after an `await trigger()` that has not re-rendered
+    // yet, so the closure would still be holding the previous attempt's state.
+    const parsed = buildOnboardingSchema(
+      identity?.passportRequired === true,
+    ).safeParse(getValues());
+    const wanted = new Set<string>(fields as string[]);
+    const messages = parsed.success
+      ? []
+      : parsed.error.issues
+          .filter((i) => wanted.has(String(i.path[0])))
+          .map((i) => i.message);
+    return messages.length > 0
+      ? `Please fix: ${[...new Set(messages)].join(", ")}.`
+      : "Some details on this step are incomplete. Please review the fields above.";
+  };
+
+  /**
+   * The fields this step actually validates. `stepFields` covers what the step
+   * always renders; the company step additionally exposes company email/phone
+   * as inputs when nothing could be derived for them, and a field is validated
+   * exactly when the customer can see and fix it.
+   */
+  const fieldsForStep = (s: CompanyStep): (keyof FormData)[] => {
+    if (s !== "company" || !identity) return stepFields[s];
+    return [
+      ...stepFields.company,
+      ...(derivedEmail ? [] : (["companyEmail"] as const)),
+      ...(derivedPhone ? [] : (["companyPhone"] as const)),
+    ];
+  };
+
   /** Validate + persist the current step, returning whether we may advance. */
   const saveCurrentStep = async (): Promise<boolean> => {
     setSaveError(null);
-    const isValid = await trigger(stepFields[step]);
-    if (!isValid) return false;
+    const fields = fieldsForStep(step);
+    const isValid = await trigger(fields);
+    if (!isValid) {
+      setSaveError(describeErrors(fields));
+      return false;
+    }
     if (!onSaveStep) return true;
     setSaving(true);
     try {
-      const res = await onSaveStep(stepPayload(step, watch()));
+      const res = await onSaveStep(
+        stepPayload(step, getValues(), dirtyFields),
+      );
       if (!res.ok) {
         setSaveError(res.error);
         return false;
@@ -676,7 +798,14 @@ export default function CompanyProfileForm({
       }
 
       setSaveError(null);
-      handleSubmit((data) => onSubmit(buildPayload(data, user)))();
+      // Deliberately NOT `handleSubmit`: that re-validated all 34 schema fields
+      // — including every field belonging to a step that isn't on screen — and
+      // on failure did nothing at all, no alert and no navigation, which is the
+      // "Submit for review" button that appears dead. Each step has already
+      // validated and saved its own fields, and the API's `markOnboardingComplete`
+      // is the authority on what is still outstanding; its message reaches the
+      // customer through `submitError`.
+      onSubmit(buildPayload(getValues(), user));
       return;
     }
     // The TIN must resolve to a real eTrade record before anything else on
@@ -728,15 +857,40 @@ export default function CompanyProfileForm({
       setDocumentFieldErrors({
         [POA_DELEGATION_FILE_KEY]: "DARS delegation paper is required",
       });
+      // Validate the text fields too, so every problem shows at once.
+      const fieldsOk = await trigger(stepFields.poa);
       setSaveError(
-        requirePoa
-          ? "Freight forwarders must provide Power of Attorney details and the DARS delegation paper."
-          : "Upload the DARS delegation paper for the Power of Attorney you entered, or clear the PoA details to skip.",
+        [
+          requirePoa
+            ? "Freight forwarders must provide Power of Attorney details and the DARS delegation paper."
+            : "Upload the DARS delegation paper for the Power of Attorney you entered, or clear the PoA details to skip.",
+          fieldsOk ? null : describeErrors(stepFields.poa),
+        ]
+          .filter(Boolean)
+          .join(" "),
       );
-      // Fall through to validate the text fields too, so every problem shows at once.
-      await trigger(stepFields.poa);
       return;
     }
+    // The API will not accept the PoA's details until the paper evidencing the
+    // delegation is actually on file, so the selection made on this step has to
+    // be uploaded before the save — not held back until the documents step,
+    // which is unreachable while this save keeps failing.
+    if (step === "poa" && delegationRequired && onUploadDocuments) {
+      const pending = documentFiles[POA_DELEGATION_FILE_KEY];
+      const hasPending = Array.isArray(pending) ? pending.length > 0 : pending != null;
+      if (hasPending) {
+        setSaving(true);
+        try {
+          const res = await onUploadDocuments();
+          if (!res.ok) {
+            setSaveError(res.error);
+            return;
+          }
+        } finally {
+          setSaving(false);
+        }
+      }
+    }
     // Field steps validate + save before advancing.
     const ok = await saveCurrentStep();
     if (!ok) return;
@@ -812,6 +966,42 @@ export default function CompanyProfileForm({
                         {...register("ownerPassportNumber")}
                       />
                     )}
+                    {/* Normally derived from the verified owner (falling back
+                        to eTrade and the account), and shown read-only. Fayda's
+                        email and phone claims are optional though, so when
+                        every source comes up empty these become typeable —
+                        the API requires both at submit, and having no input
+                        for them is otherwise an unrecoverable dead end. */}
+                    <SimpleGrid cols={2} spacing="md">
+                      {derivedEmail ? (
+                        <ReadOnlyField
+                          label="Company email"
+                          value={derivedEmail}
+                        />
+                      ) : (
+                        <TextInput
+                          label="Company Email"
+                          type="email"
+                          description="We couldn't find one on your verified identity or account — please enter it."
+                          placeholder="company@example.com"
+                          error={errors.companyEmail?.message}
+                          {...register("companyEmail")}
+                        />
+                      )}
+                      {derivedPhone ? (
+                        <ReadOnlyField
+                          label="Company phone"
+                          value={derivedPhone}
+                        />
+                      ) : (
+                        <ControlledPhoneField
+                          control={control}
+                          name="companyPhone"
+                          label="Company Phone"
+                          required
+                        />
+                      )}
+                    </SimpleGrid>
                   </>
                 )}
               </StepSection>
@@ -835,6 +1025,7 @@ export default function CompanyProfileForm({
                   onDataLoaded={handleETradeDataLoaded}
                   onStatusChange={setTinStatus}
                   onReset={handleETradeReset}
+                  alreadyVerified={hasRegistrationDetails}
                 />
                 {tinVerified && (
                   <ETradeCompanyCard
@@ -924,7 +1115,10 @@ export default function CompanyProfileForm({
               <Text fw={600} size="sm" c="edr-text">
                 Contact Person
               </Text>
-              {watch("generalManagerName") && (
+              {/* `gmName`, not the raw form field: a Fayda-verified GM never
+                  fills `generalManagerName`, so gating on it hid this card from
+                  every Ethiopian company — the majority case. */}
+              {gmName && (
                 <LinkCheckboxCard
                   checked={contactSameAsGm}
                   onToggle={toggleContactSameAsGm}
@@ -983,21 +1177,51 @@ export default function CompanyProfileForm({
                   required={requirePoa}
                 />
               )}
-              {/* The address comes from the Fayda claim along with the name,
-                  so it is shown on the panel rather than typed. Only a company
-                  whose representative may hold no Fayda ID still types it. */}
+              {/* A verified representative's details come from the Fayda claim
+                  and are shown on the panel above. Where Fayda cannot be
+                  required — a foreign company whose representative may hold no
+                  Fayda ID — they are typed here instead. They have to be: the
+                  API refuses to save a freight forwarder's PoA without a name,
+                  email and phone (`REQUIRED_POA_FIELDS`), and before this the
+                  step rendered no input for any of them, so the customer was
+                  told to "add the poa name, poa email, poa phone" with nowhere
+                  to add them. */}
               {!identity?.poa.verified && !identity?.faydaRequired && (
-                <TextInput
-                  label="PoA Location"
-                  placeholder="City, Country"
-                  error={errors.poaLocation?.message}
-                  {...register("poaLocation")}
-                />
+                <>
+                  <TextInput
+                    label="Representative's Name"
+                    placeholder="Abebe Bikila"
+                    error={errors.poaName?.message}
+                    {...register("poaName")}
+                  />
+                  <SimpleGrid cols={2} spacing="md">
+                    <TextInput
+                      label="Representative's Email"
+                      type="email"
+                      placeholder="poa@company.com"
+                      error={errors.poaEmail?.message}
+                      {...register("poaEmail")}
+                    />
+                    <ControlledPhoneField
+                      control={control}
+                      name="poaPhone"
+                      label="Representative's Phone"
+                    />
+                  </SimpleGrid>
+                  <TextInput
+                    label="PoA Location"
+                    placeholder="City, Country"
+                    error={errors.poaLocation?.message}
+                    {...register("poaLocation")}
+                  />
+                </>
               )}
 
-              {/* The paper authorises the representative the verification
-                  named, so it only has meaning once one exists. */}
-              {poaProvided && poaDocumentSetting && (
+              {/* The paper authorises the representative, so it shows once one
+                  exists — or straight away for a freight forwarder, who owes it
+                  either way and must not be failed on submit for a file the
+                  step never offered. */}
+              {delegationRequired && poaDocumentSetting && (
                 <>
                   <Divider my="sm" />
                   <SmartFileInput
diff --git a/apps/edr-freight-web/portal/src/pages/accounts/companyProfileForm/ETradeCompanyCard.tsx b/apps/edr-freight-web/portal/src/pages/accounts/companyProfileForm/ETradeCompanyCard.tsx
index 1127a205d..2634fed0d 100644
--- a/apps/edr-freight-web/portal/src/pages/accounts/companyProfileForm/ETradeCompanyCard.tsx
+++ b/apps/edr-freight-web/portal/src/pages/accounts/companyProfileForm/ETradeCompanyCard.tsx
@@ -17,6 +17,11 @@ import { ReadOnlyField } from "./ReadOnlyField";
  * supplied a value, but falls back to an editable input when eTrade left it
  * blank — otherwise a gap in eTrade's own data would leave the field
  * permanently empty and the user stuck (zod requires all of these).
+ *
+ * A value that fails validation unlocks the same way. eTrade (or a row saved
+ * before the current rules) can supply something the schema rejects, and a
+ * rejected value rendered read-only is a step that can never be completed and
+ * never says why.
  */
 function LockedField({
   label,
@@ -32,7 +37,7 @@ function LockedField({
   errors: FieldErrors<FormData>;
 }) {
   const value = watch(name) as string | undefined;
-  if (value && value.trim()) {
+  if (value && value.trim() && !errors[name]) {
     return <ReadOnlyField label={label} value={value} />;
   }
   return (
@@ -96,7 +101,12 @@ export default function ETradeCompanyCard({
         <ReadOnlyField label="Renewal Date" value={watch("renewalDate")} />
         <ReadOnlyField label="Renewed From" value={watch("renewedFrom")} />
         <ReadOnlyField label="Renewed To" value={watch("renewedTo")} />
-        {region && region.trim() ? (
+        {/* Membership of the catalog, not mere presence: eTrade's normalizer
+            returns null for a region it doesn't recognise, and older rows can
+            hold a spelling that isn't in the list. Showing such a value
+            read-only left the customer with a required field they could not
+            correct. */}
+        {(ETHIOPIAN_REGIONS as readonly string[]).includes(region ?? "") ? (
           <ReadOnlyField label="Region" value={region} />
         ) : (
           <Controller
diff --git a/apps/edr-freight-web/portal/src/pages/accounts/companyProfileForm/helpers.ts b/apps/edr-freight-web/portal/src/pages/accounts/companyProfileForm/helpers.ts
index a3aad0ee2..a1dd1fa7a 100644
--- a/apps/edr-freight-web/portal/src/pages/accounts/companyProfileForm/helpers.ts
+++ b/apps/edr-freight-web/portal/src/pages/accounts/companyProfileForm/helpers.ts
@@ -1,8 +1,72 @@
 import type { AuthUser } from "@/types/auth";
 import type { CreateCompanyPayload } from "@/services/companies.service";
 import type { ProfileResponse, UpdateProfilePayload } from "@/types/profile";
+import type { CompanyIdentityState } from "@/services/verifayda.service";
+import { isValidPhone, toEthiopianE164 } from "@/components/PhoneField";
 
-import type { CompanyStep, FormData } from "./schema";
+import { ETRADE_BUNDLE_FIELDS, type CompanyStep, type FormData } from "./schema";
+
+/**
+ * First value that is actually present.
+ *
+ * `??` is wrong for these: an identity claim Fayda returned as an empty string
+ * is not a value, but it isn't null either, so `??` would stop there and hand
+ * the form a blank it has no input to fix.
+ */
+export const firstPresent = (...values: (string | null | undefined)[]): string =>
+  values.find((v) => v && v.trim())?.trim() ?? "";
+
+/**
+ * First candidate that is actually a usable phone number, normalized to E.164.
+ *
+ * Presence is not enough here. eTrade's registered phone is free text and comes
+ * back as things like `"09        "`, which normalizes to `+2519` — non-empty,
+ * so a "first present" pick would take it, hand it to a field with no input,
+ * and have the API reject the whole save with
+ * "companyPhone must be a valid international phone number" for something the
+ * customer never typed. Skip a source that cannot produce a valid number and
+ * fall through to the next one.
+ */
+export const firstValidPhone = (
+  ...values: (string | null | undefined)[]
+): string => {
+  for (const raw of values) {
+    if (!raw || !raw.trim()) continue;
+    const e164 = toEthiopianE164(raw);
+    if (e164 && isValidPhone(e164)) return e164;
+  }
+  return "";
+};
+
+/** Same idea for email: a malformed claim must not become an unfixable field. */
+export const firstValidEmail = (
+  ...values: (string | null | undefined)[]
+): string => {
+  const ok = /^[^\s@]+@[^\s@]+\.[^\s@]+$/;
+  return values.find((v) => v && ok.test(v.trim()))?.trim() ?? "";
+};
+
+/**
+ * Fayda reports a person's phone as the national registry holds it, which is
+ * routinely a local number ("0911223344"). Every phone the forms validate and
+ * submit is E.164, so normalize on the way in — the API now stores new
+ * verifications normalized, but rows verified before that still hold raw claims.
+ */
+export function normalizeIdentityPhones(
+  identity?: CompanyIdentityState,
+): CompanyIdentityState | undefined {
+  if (!identity) return identity;
+  const fix = <T extends { phone: string | null }>(person: T): T => ({
+    ...person,
+    phone: person.phone ? toEthiopianE164(person.phone) : person.phone,
+  });
+  return {
+    ...identity,
+    owner: fix(identity.owner),
+    poa: fix(identity.poa),
+    gm: fix(identity.gm),
+  };
+}
 
 /** Last 9 digits (Ethiopian national significant number) for tolerant compare. */
 export const phoneDigits = (p?: string | null) =>
@@ -44,34 +108,35 @@ export function buildPayload(
   };
 }
 
-/** Map one wizard step's form values to the profile-update payload it saves. */
+/**
+ * Map one wizard step's form values to the profile-update payload it saves.
+ *
+ * `dirty` is react-hook-form's `dirtyFields`. The eTrade-owned keys (and the
+ * TIN) ride along only when the customer actually changed them this session —
+ * see `ETRADE_BUNDLE_FIELDS`. Everything else is unconditional: the API treats
+ * an absent key as "untouched", so omitting a field never clears it.
+ */
 export function stepPayload(
   step: CompanyStep,
   d: FormData,
+  dirty: Partial<Record<keyof FormData, unknown>> = {},
 ): Partial<UpdateProfilePayload> {
   switch (step) {
-    case "company":
+    case "company": {
+      const etrade: Partial<UpdateProfilePayload> = {};
+      for (const key of ETRADE_BUNDLE_FIELDS) {
+        if (dirty[key]) (etrade as Record<string, unknown>)[key] = d[key];
+      }
+      if (dirty.tinNumber) etrade.tin = d.tinNumber;
       return {
-        companyName: d.companyName,
         companyEmail: d.companyEmail,
         companyPhone: d.companyPhone,
         companyAddress: d.companyAddress,
-        tin: d.tinNumber,
         vatNumber: d.vatNumber,
         ownerPassportNumber: d.ownerPassportNumber || undefined,
-        licenceNumber: d.licenceNumber,
-        statusDescription: d.statusDescription,
-        dateRegistered: d.dateRegistered,
-        renewedFrom: d.renewedFrom,
-        renewalDate: d.renewalDate,
-        renewedTo: d.renewedTo,
-        region: d.region,
-        zone: d.zone,
-        woreda: d.woreda,
-        kebele: d.kebele,
-        houseNo: d.houseNo,
-        etradePhone: d.etradePhone,
+        ...etrade,
       };
+    }
     case "personnel":
       return {
         generalManagerName: d.generalManagerName,
@@ -86,7 +151,12 @@ export function stepPayload(
         contactPersonPhone: d.contactPersonPhone,
       };
     case "poa":
-      return { poaLocation: d.poaLocation || undefined };
+      return {
+        poaName: d.poaName || undefined,
+        poaEmail: d.poaEmail || undefined,
+        poaPhone: d.poaPhone || undefined,
+        poaLocation: d.poaLocation || undefined,
+      };
     default:
       return {};
   }
diff --git a/apps/edr-freight-web/portal/src/pages/accounts/companyProfileForm/schema.test.ts b/apps/edr-freight-web/portal/src/pages/accounts/companyProfileForm/schema.test.ts
new file mode 100644
index 000000000..a6f9862c8
--- /dev/null
+++ b/apps/edr-freight-web/portal/src/pages/accounts/companyProfileForm/schema.test.ts
@@ -0,0 +1,180 @@
+import { describe, expect, it } from "vitest";
+
+import { onboardingSchema, stepFields } from "./schema";
+import {
+  firstPresent,
+  firstValidEmail,
+  firstValidPhone,
+  normalizeIdentityPhones,
+  stepPayload,
+} from "./helpers";
+import type { FormData } from "./schema";
+import type { CompanyIdentityState } from "@/services/verifayda.service";
+
+/** A minimally-valid form, so each case can vary one field at a time. */
+const values = (over: Partial<FormData> = {}): FormData =>
+  ({
+    companyName: "Acme PLC",
+    companyEmail: "acme@example.com",
+    companyPhone: "+251911223344",
+    companyAddress: "1, Bole, Bole, Addis Ababa",
+    etradePhone: "+251911223344",
+    tinNumber: "0012345678",
+    vatNumber: "0012345678",
+    ownerPassportNumber: "",
+    licenceNumber: "LIC-1",
+    statusDescription: "Active",
+    dateRegistered: "2020-01-01",
+    renewedFrom: "",
+    renewalDate: "",
+    renewedTo: "",
+    region: "Addis Ababa",
+    zone: "Bole",
+    woreda: "03",
+    kebele: "07",
+    houseNo: "1",
+    contactPersonName: "Jane Smith",
+    contactPersonPosition: "",
+    contactPersonEmail: "",
+    contactPersonPhone: "+251911223344",
+    generalManagerName: "",
+    generalManagerEmail: "",
+    generalManagerPhone: "",
+    poaName: "",
+    poaPhone: "",
+    poaAddress: "",
+    poaEmail: "",
+    poaLocation: "",
+    ...over,
+  }) as FormData;
+
+const errorFor = (data: FormData, field: keyof FormData) => {
+  const parsed = onboardingSchema.safeParse(data);
+  if (parsed.success) return undefined;
+  return parsed.error.issues.find((i) => i.path[0] === field)?.message;
+};
+
+describe("VAT number", () => {
+  it("accepts exactly ten digits", () => {
+    expect(errorFor(values({ vatNumber: "0012345678" }), "vatNumber")).toBeUndefined();
+  });
+
+  // `.length(10)` used to pass this, so a ten-letter string reached the API.
+  it("rejects ten non-digits", () => {
+    expect(errorFor(values({ vatNumber: "ABCDEFGHIJ" }), "vatNumber")).toBe(
+      "VAT number must be exactly 10 digits",
+    );
+  });
+
+  it("rejects blank", () => {
+    expect(errorFor(values({ vatNumber: "" }), "vatNumber")).toBe(
+      "VAT number is required",
+    );
+  });
+});
+
+describe("region", () => {
+  it("rejects a spelling outside the catalog", () => {
+    expect(errorFor(values({ region: "Addis Abeba City" }), "region")).toBe(
+      "Region is required",
+    );
+  });
+});
+
+describe("stepFields", () => {
+  // The regression this whole change exists to prevent: a step must not gate on
+  // a field it renders no input for, or Continue fails with the error attached
+  // to nothing on screen.
+  it("never gates the company step on a derived or read-only field", () => {
+    const unreachable = [
+      "companyEmail",
+      "companyPhone",
+      "companyAddress",
+      "etradePhone",
+      "licenceNumber",
+      "statusDescription",
+      "dateRegistered",
+      "renewedFrom",
+      "renewalDate",
+      "renewedTo",
+    ];
+    expect(
+      stepFields.company.filter((f) => unreachable.includes(f)),
+    ).toEqual([]);
+  });
+});
+
+describe("stepPayload (company)", () => {
+  it("omits the eTrade bundle when nothing was re-verified", () => {
+    const payload = stepPayload("company", values(), {});
+    expect(payload.tin).toBeUndefined();
+    expect(payload.region).toBeUndefined();
+    expect(payload.licenceNumber).toBeUndefined();
+    // The customer's own fields still save.
+    expect(payload.vatNumber).toBe("0012345678");
+  });
+
+  it("includes the bundle and the TIN once they are dirty", () => {
+    const payload = stepPayload("company", values(), {
+      tinNumber: true,
+      region: true,
+    });
+    expect(payload.tin).toBe("0012345678");
+    expect(payload.region).toBe("Addis Ababa");
+    // Still only the dirty ones.
+    expect(payload.licenceNumber).toBeUndefined();
+  });
+});
+
+describe("firstPresent", () => {
+  it("skips empty strings rather than stopping at them", () => {
+    expect(firstPresent("", "  ", "second@example.com")).toBe(
+      "second@example.com",
+    );
+    expect(firstPresent(null, undefined, "")).toBe("");
+  });
+});
+
+describe("firstValidPhone", () => {
+  // Observed live: eTrade returned "09        " for a real TIN. It normalizes to
+  // "+2519", which is non-empty — so a presence check took it, put it in a field
+  // with no input, and the API rejected the whole step.
+  it("skips an eTrade number that cannot make a valid E.164", () => {
+    expect(firstValidPhone("09        ", "+251911223344")).toBe("+251911223344");
+  });
+
+  it("normalizes a local number it can use", () => {
+    expect(firstValidPhone("0911223344")).toBe("+251911223344");
+  });
+
+  it("returns empty when no source is usable, so the field falls back to an input", () => {
+    expect(firstValidPhone("09        ", "", null)).toBe("");
+  });
+});
+
+describe("firstValidEmail", () => {
+  it("skips a malformed claim", () => {
+    expect(firstValidEmail("not-an-email", "real@example.com")).toBe(
+      "real@example.com",
+    );
+  });
+});
+
+describe("normalizeIdentityPhones", () => {
+  it("converts a local Fayda phone claim to E.164", () => {
+    const identity = {
+      faydaRequired: true,
+      passportRequired: false,
+      owner: { verified: true, name: "A", phone: "0911223344", email: null, address: null, verifiedAt: null, passportNumber: null },
+      poa: { verified: false, name: null, phone: null, email: null, address: null, verifiedAt: null },
+      gm: { verified: false, name: null, phone: "251911223344", email: null, address: null, verifiedAt: null },
+      gmSameAsOwner: false,
+      complete: false,
+    } as CompanyIdentityState;
+
+    const fixed = normalizeIdentityPhones(identity)!;
+    expect(fixed.owner.phone).toBe("+251911223344");
+    expect(fixed.gm.phone).toBe("+251911223344");
+    expect(fixed.poa.phone).toBeNull();
+  });
+});
diff --git a/apps/edr-freight-web/portal/src/pages/accounts/companyProfileForm/schema.ts b/apps/edr-freight-web/portal/src/pages/accounts/companyProfileForm/schema.ts
index ff404ebe3..3133ddef0 100644
--- a/apps/edr-freight-web/portal/src/pages/accounts/companyProfileForm/schema.ts
+++ b/apps/edr-freight-web/portal/src/pages/accounts/companyProfileForm/schema.ts
@@ -26,10 +26,11 @@ export const onboardingSchema = z.object({
   // can diverge without the backend's eTrade-authenticity check misfiring.
   etradePhone: z.string().optional(),
   tinNumber: z.string().regex(/^\d{10}$/, "TIN must be exactly 10 digits"),
+  // `.length(10)` alone accepted "ABCDEFGHIJ" — the check has to be on digits.
   vatNumber: z
     .string()
     .min(1, "VAT number is required")
-    .length(10, "VAT number must be exactly 10 digits"),
+    .regex(/^\d{10}$/, "VAT number must be exactly 10 digits"),
   // The owner's passport number — the foreign-company identity credential
   // (Fayda is an Ethiopian national ID). Required only for a foreign company;
   // enforced in buildOnboardingSchema since that depends on `nationality`.
@@ -134,22 +135,47 @@ export function buildOnboardingSchema(
   });
 }
 
+/**
+ * The keys eTrade owns. They are only resent when the customer actually
+ * re-verified the TIN this session: the API reacts to *any* of them by issuing
+ * a live eTrade lookup (`applyEtradeSourcedFields`) whose transport failures
+ * come back as a 400, so echoing unchanged values back would let an eTrade
+ * outage block a save the customer never made.
+ */
+export const ETRADE_BUNDLE_FIELDS = [
+  "companyName",
+  "licenceNumber",
+  "statusDescription",
+  "dateRegistered",
+  "renewedFrom",
+  "renewalDate",
+  "renewedTo",
+  "region",
+  "zone",
+  "woreda",
+  "kebele",
+  "houseNo",
+  "etradePhone",
+] as const satisfies readonly (keyof FormData)[];
+
+/**
+ * What each step validates before it may advance.
+ *
+ * Hard rule: a key belongs here only if that step renders an input the customer
+ * can actually correct it in. `companyEmail`/`companyPhone` are derived from the
+ * Fayda identity / eTrade / the account and have no input of their own, and the
+ * read-only eTrade fields cannot be edited at all — listing them meant a value
+ * the customer never typed could fail zod with its error message attached to
+ * nothing on screen, which reads as a Continue button that silently does
+ * nothing. The server still enforces its own required-field list at submit
+ * (`REQUIRED_COMPANY_INFO`), and reports it with a message.
+ */
 export const stepFields: Record<CompanyStep, (keyof FormData)[]> = {
   company: [
     "companyName",
-    "companyEmail",
-    "companyPhone",
-    "companyAddress",
-    "etradePhone",
     "tinNumber",
     "vatNumber",
     "ownerPassportNumber",
-    "licenceNumber",
-    "statusDescription",
-    "dateRegistered",
-    "renewedFrom",
-    "renewalDate",
-    "renewedTo",
     "region",
     "zone",
     "woreda",
@@ -167,7 +193,11 @@ export const stepFields: Record<CompanyStep, (keyof FormData)[]> = {
     "contactPersonEmail",
     "contactPersonPhone",
   ],
-  poa: ["poaLocation"],
+  // The API requires poaName/poaEmail/poaPhone from a freight forwarder
+  // (`REQUIRED_POA_FIELDS`), so the step has to offer them wherever the
+  // representative isn't proven by Fayda — otherwise the save is rejected
+  // naming fields the form never rendered.
+  poa: ["poaName", "poaEmail", "poaPhone", "poaLocation"],
   documents: [],
   additional: [],
 };
diff --git a/apps/edr-freight-web/portal/src/pages/bookings/BookingDetailPage/ChangesRequestedView.tsx b/apps/edr-freight-web/portal/src/pages/bookings/BookingDetailPage/ChangesRequestedView.tsx
index 6b4c8927d..6ae046f1d 100644
--- a/apps/edr-freight-web/portal/src/pages/bookings/BookingDetailPage/ChangesRequestedView.tsx
+++ b/apps/edr-freight-web/portal/src/pages/bookings/BookingDetailPage/ChangesRequestedView.tsx
@@ -1,18 +1,30 @@
 import {
   Alert,
+  Box,
   Button,
   Group,
   Modal,
   Stack,
   Text,
   TextInput,
+  UnstyledButton,
 } from "@mantine/core";
 import { useMutation, useQuery } from "@tanstack/react-query";
-import { AlertCircle, Send, XCircle } from "lucide-react";
+import {
+  AlertCircle,
+  CalendarDays,
+  ChevronRight,
+  Package,
+  Pencil,
+  Send,
+  XCircle,
+} from "lucide-react";
+import type { ReactNode } from "react";
 import { useState } from "react";
 import { useNavigate } from "react-router-dom";
 
 import { api } from "@/services/api";
+import { bookingsService } from "@/services/bookings.service";
 import type { Freight } from "@edr/types";
 
 import { PriceChangeModal } from "@/pages/bookings/resubmit/PriceChangeModal";
@@ -25,13 +37,55 @@ import { CompanyInfoCard } from "./components/CompanyInfoCard";
 import { ContainersCard } from "./components/ContainersCard";
 import { ContractInfoCard } from "./components/ContractInfoCard";
 import { ActionRequiredBanner, MutationErrors } from "./components/Notices";
-import { PageHeader } from "./components/PageHeader";
+import { HeaderButton, PageHeader } from "./components/PageHeader";
 import { EstimateCard } from "./components/pricing";
 import { ScheduleCard } from "./components/ScheduleCard";
 import { ShipmentDetailsCard } from "./components/ShipmentDetailsCard";
 import { StatusHero } from "./components/StatusHero";
 import { SupportCard } from "./components/SupportCard";
 
+/** Row linking straight to one section of the edit-booking form. */
+function EditLink({
+  icon,
+  title,
+  description,
+  onClick,
+}: {
+  icon: ReactNode;
+  title: string;
+  description: string;
+  onClick: () => void;
+}) {
+  return (
+    <UnstyledButton
+      onClick={onClick}
+      p="sm"
+      style={{
+        border: "1px solid #E6ECF2",
+        borderRadius: 12,
+        width: "100%",
+      }}
+    >
+      <Group gap="sm" wrap="nowrap" align="flex-start">
+        <Box mt={2} c="#0A6F4D">
+          {icon}
+        </Box>
+        <Box style={{ flex: 1, minWidth: 0 }}>
+          <Text fz={13.5} fw={700} c="#10202F">
+            {title}
+          </Text>
+          <Text fz={12} c="#6B7C8E" mt={2}>
+            {description}
+          </Text>
+        </Box>
+        <Box mt={2} c="#9AA8B5">
+          <ChevronRight size={16} />
+        </Box>
+      </Group>
+    </UnstyledButton>
+  );
+}
+
 /**
  * Detail-page view for a booking staff returned with CHANGES_REQUESTED.
  *
@@ -64,8 +118,9 @@ export function ChangesRequestedView({
     null) as Freight.PricingBreakdown | null;
 
   const cancelMutation = useMutation({
+    // Customer-facing cancel endpoint — the plain /cancel route is staff-only.
     mutationFn: (reason: string) =>
-      api.bookings.cancel.call({ id: booking.id, reason }),
+      bookingsService.customerCancel(booking.id, reason),
     onSuccess: () => {
       setCancelDialogOpen(false);
       onBookingUpdated();
@@ -76,17 +131,21 @@ export function ChangesRequestedView({
     <PageShell>
       <PageHeader
         booking={booking}
-        menuActions={{
-          onCancel: () => setCancelDialogOpen(true),
-          onSupport: () => navigate("/support"),
-        }}
+        actions={
+          <HeaderButton
+            red
+            icon={<XCircle size={16} />}
+            label="Cancel booking"
+            onClick={() => setCancelDialogOpen(true)}
+          />
+        }
       />
 
       <MutationErrors mutations={[...flow.mutations, cancelMutation]} />
 
       <StatusHero booking={booking}>
         {booking.latestChangeRequestNote ? (
-          <ActionRequiredBanner title="Review the requested changes, then resubmit.">
+          <ActionRequiredBanner title="Review the requested changes, update the booking if needed, then resubmit.">
             {booking.latestChangeRequestNote}
           </ActionRequiredBanner>
         ) : undefined}
@@ -101,6 +160,41 @@ export function ChangesRequestedView({
 
             <ContractInfoCard booking={booking} />
 
+            <SectionCard>
+              <CardTitle>Fix your booking</CardTitle>
+              <Text fz="12.5px" c="#6B7C8E" mt={4} mb="md">
+                Staff asked for changes on this booking. Update whatever needs
+                fixing below, then resubmit for review — the booking stays in
+                place, no need to start over.
+              </Text>
+              <Stack gap={8}>
+                <EditLink
+                  icon={<Package size={16} />}
+                  title="Cargo & containers"
+                  description="Add or remove containers, change container type, quantity or VGM — or for bulk cargo, change the commodity and tonnage."
+                  onClick={() =>
+                    navigate(`/bookings/${booking.id}/edit?section=cargo`)
+                  }
+                />
+                <EditLink
+                  icon={<CalendarDays size={16} />}
+                  title="Schedule date"
+                  description="Pick a different departure day — only days with an open schedule on your route can be selected."
+                  onClick={() =>
+                    navigate(`/bookings/${booking.id}/edit?section=schedule`)
+                  }
+                />
+                <EditLink
+                  icon={<Pencil size={16} />}
+                  title="Route, service & other details"
+                  description="Change the origin or destination yard, service type, trucking options or notes."
+                  onClick={() =>
+                    navigate(`/bookings/${booking.id}/edit?section=service`)
+                  }
+                />
+              </Stack>
+            </SectionCard>
+
             <SectionCard>
               <Group justify="space-between" align="center" mb="md">
                 <CardTitle>Your documents</CardTitle>
diff --git a/apps/edr-freight-web/portal/src/pages/bookings/BookingDetailPage/DraftBookingView.tsx b/apps/edr-freight-web/portal/src/pages/bookings/BookingDetailPage/DraftBookingView.tsx
index 277bd1a24..65af9f45d 100644
--- a/apps/edr-freight-web/portal/src/pages/bookings/BookingDetailPage/DraftBookingView.tsx
+++ b/apps/edr-freight-web/portal/src/pages/bookings/BookingDetailPage/DraftBookingView.tsx
@@ -24,7 +24,10 @@ import { useNavigate } from "react-router-dom";
 
 import { api } from "@/services/api";
 import { downloadStoredFile } from "@/services/files.service";
-import type { SubmitBookingResponse } from "@/services/bookings.service";
+import {
+  bookingsService,
+  type SubmitBookingResponse,
+} from "@/services/bookings.service";
 import type { Freight } from "@edr/types";
 
 import { REQUIRED_DOC_FIELDS } from "./constants";
@@ -116,8 +119,9 @@ export function DraftBookingView({
   });
 
   const cancelMutation = useMutation({
+    // Customer-facing cancel endpoint — the plain /cancel route is staff-only.
     mutationFn: (reason: string) =>
-      api.bookings.cancel.call({ id: booking.id, reason }),
+      bookingsService.customerCancel(booking.id, reason),
     onSuccess: () => {
       setCancelDialogOpen(false);
       onBookingUpdated();
@@ -157,17 +161,21 @@ export function DraftBookingView({
       <PageHeader
         booking={booking}
         actions={
-          <HeaderButton
-            dark
-            icon={<Pencil size={16} />}
-            label="Continue editing"
-            onClick={() => navigate(`/bookings/${booking.id}/edit`)}
-          />
+          <Group gap={8} wrap="nowrap">
+            <HeaderButton
+              dark
+              icon={<Pencil size={16} />}
+              label="Continue editing"
+              onClick={() => navigate(`/bookings/${booking.id}/edit`)}
+            />
+            <HeaderButton
+              red
+              icon={<XCircle size={16} />}
+              label="Cancel"
+              onClick={() => setCancelDialogOpen(true)}
+            />
+          </Group>
         }
-        menuActions={{
-          onCancel: () => setCancelDialogOpen(true),
-          onSupport: () => navigate("/support"),
-        }}
       />
 
       <MutationErrors
diff --git a/apps/edr-freight-web/portal/src/pages/bookings/BookingDetailPage/ReadonlyBookingView.tsx b/apps/edr-freight-web/portal/src/pages/bookings/BookingDetailPage/ReadonlyBookingView.tsx
index b26a6562a..3b7218313 100644
--- a/apps/edr-freight-web/portal/src/pages/bookings/BookingDetailPage/ReadonlyBookingView.tsx
+++ b/apps/edr-freight-web/portal/src/pages/bookings/BookingDetailPage/ReadonlyBookingView.tsx
@@ -1,15 +1,21 @@
-import { Group, Tabs } from "@mantine/core";
+import { Button, Group, Modal, Stack, Tabs, Text } from "@mantine/core";
+import { useMutation } from "@tanstack/react-query";
 import {
   Clock,
   CreditCard,
   FileText,
   LayoutGrid,
   Package,
+  TrainFront,
   Truck,
+  XCircle,
 } from "lucide-react";
+import { useState } from "react";
+import toast from "react-hot-toast";
 import { useNavigate } from "react-router-dom";
 
 import { useFileViewer } from "@/hooks/useFileViewer";
+import { bookingsService } from "@/services/bookings.service";
 import type { Freight } from "@edr/types";
 
 import { ApproveDeliveryButton } from "../delivery/ApproveDeliveryButton";
@@ -28,6 +34,7 @@ import { MileSummaryCard } from "./components/MileSummaryCard";
 import { BodyGrid, PageShell } from "./components/layout";
 import {
   CancelledBanner,
+  ActionRequiredBanner,
   ConsolidationPairedNotice,
   ConsolidationWaitingBanner,
 } from "./components/Notices";
@@ -41,10 +48,33 @@ import { ShipmentDetailsCard } from "./components/ShipmentDetailsCard";
 import { ShipmentTrackingCard } from "./components/ShipmentTrackingCard";
 import { StatusHero } from "./components/StatusHero";
 import { SupportCard } from "./components/SupportCard";
+import { WagonCancellationCard } from "./components/WagonCancellationCard";
+import { WagonsTab } from "./components/WagonsTab";
 import { fmtDate, isNegative, priceTotal } from "./utils";
 import { useScrollToHash } from "@/hooks/useScrollToHash";
 import { useBookingPayment } from "@/pages/bookings/payments/useBookingPayment";
 
+// Pre-payment statuses the customer may self-cancel from this view (free of
+// charge). DRAFT / CHANGES_REQUESTED render their own views and drafts can
+// simply be deleted; anything at or past payment must go through support.
+const CUSTOMER_CANCELLABLE_STATUSES = [
+  "SUBMITTED",
+  "PRICE_CHANGED_PENDING_CONFIRM",
+  "PENDING_APPROVAL",
+  "CONTRACT_READY",
+  "OPERATION_REQUEST_PENDING",
+  "SELECTED_FOR_BATCH",
+];
+
+const cancelErrorMessage = (error: unknown) => {
+  const data = (
+    error as { response?: { data?: { message?: string | string[] } } }
+  )?.response?.data;
+  if (Array.isArray(data?.message)) return data.message.join(", ");
+  if (data?.message) return data.message;
+  return "Could not cancel the booking. Please try again.";
+};
+
 export function ReadonlyBookingView({
   booking,
   onBookingUpdated,
@@ -71,6 +101,23 @@ export function ReadonlyBookingView({
   // and handles redirect vs CAC Bank OTP.
   const pay = useBookingPayment(booking.id);
 
+  const [cancelOpen, setCancelOpen] = useState(false);
+  const cancelMutation = useMutation({
+    mutationFn: () => bookingsService.customerCancel(booking.id),
+    onSuccess: () => {
+      setCancelOpen(false);
+      toast.success(
+        "Your booking has been cancelled — no cancellation fee was charged.",
+        { duration: 6000 },
+      );
+      onBookingUpdated?.();
+    },
+    onError: (e) => toast.error(cancelErrorMessage(e)),
+  });
+  const canCancel =
+    booking.paymentStatus !== "PAID" &&
+    CUSTOMER_CANCELLABLE_STATUSES.includes(status);
+
   const pricing = booking.pricingBreakdown;
   // A general contract is paid once it's FULLY_EXECUTED (signed) — it never
   // enters batch selection. A one-time booking can only pay once it's been
@@ -117,6 +164,9 @@ export function ReadonlyBookingView({
     "DOCUMENTS_UNDER_REVIEW",
     "CLEARANCE_READY",
     "OPERATION_REQUESTED",
+    // Operations returned the order — same card hosts the pick-a-new-day +
+    // resubmit flow.
+    "OPERATION_CHANGES_REQUESTED",
   ].includes(status);
   // Paired: a consolidation partner was found and the booking resumed the normal
   // flow. Surface the "partner found" reassurance only in the early stages,
@@ -124,13 +174,16 @@ export function ReadonlyBookingView({
   const showPairedNotice =
     !!booking.consolidationPartnerId &&
     ["SUBMITTED", "PENDING_APPROVAL", "CHANGES_REQUESTED"].includes(status);
+  // Wagons exist only after payment puts the booking on a train; before that
+  // the tab would always be an empty state, so it stays hidden.
+  const showWagonsTab = booking.paymentStatus === "PAID" && !isNegative(status);
 
   return (
     <PageShell>
       <PageHeader
         booking={booking}
         actions={
-          (canApproveDelivery || (canPay && !showCountdown)) && (
+          (canApproveDelivery || (canPay && !showCountdown) || canCancel) && (
             <Group gap={8} wrap="nowrap">
               {canApproveDelivery && (
                 <ApproveDeliveryButton bookingId={booking.id} />
@@ -143,13 +196,17 @@ export function ReadonlyBookingView({
                   onClick={pay.open}
                 />
               )}
+              {canCancel && (
+                <HeaderButton
+                  red
+                  icon={<XCircle size={16} />}
+                  label="Cancel booking"
+                  onClick={() => setCancelOpen(true)}
+                />
+              )}
             </Group>
           )
         }
-        menuActions={{
-          onRebook: canSelfRebook ? onRebook : undefined,
-          onSupport: () => navigate("/support"),
-        }}
       />
 
       {isNegative(status) ? (
@@ -182,7 +239,14 @@ export function ReadonlyBookingView({
           priceLabel={pricing ? priceTotal(pricing) : undefined}
         />
       ) : (
-        <StatusHero booking={booking} />
+        <StatusHero booking={booking}>
+          {status === "OPERATION_CHANGES_REQUESTED" &&
+          booking.latestChangeRequestNote ? (
+            <ActionRequiredBanner title="Operations requested changes — pick a new shipment day and resubmit.">
+              {booking.latestChangeRequestNote}
+            </ActionRequiredBanner>
+          ) : undefined}
+        </StatusHero>
       )}
 
       {showPairedNotice && <ConsolidationPairedNotice />}
@@ -210,6 +274,11 @@ export function ReadonlyBookingView({
           <Tabs.Tab value="cargo" leftSection={<Package size={15} />}>
             Cargo
           </Tabs.Tab>
+          {showWagonsTab && (
+            <Tabs.Tab value="wagons" leftSection={<TrainFront size={15} />}>
+              Wagons
+            </Tabs.Tab>
+          )}
           <Tabs.Tab value="logistics" leftSection={<Truck size={15} />}>
             Logistics
           </Tabs.Tab>
@@ -257,6 +326,11 @@ export function ReadonlyBookingView({
                     title="Consignment & Schedule"
                     consignment
                   />
+                  {/* Renders only on PAID + paid + contract-backed bookings. */}
+                  <WagonCancellationCard
+                    booking={booking}
+                    onBookingUpdated={onBookingUpdated}
+                  />
                   <CompanyInfoCard booking={booking} />
                   <SupportCard />
                 </>
@@ -269,6 +343,20 @@ export function ReadonlyBookingView({
           <CargoTab booking={booking} />
         </Tabs.Panel>
 
+        {showWagonsTab && (
+          <Tabs.Panel value="wagons">
+            <WagonsTab
+              bookingId={booking.id}
+              cancellable={
+                booking.status === "PAID" &&
+                booking.paymentStatus === "PAID" &&
+                Boolean(booking.contractId)
+              }
+              onCancellationRequested={onBookingUpdated}
+            />
+          </Tabs.Panel>
+        )}
+
         <Tabs.Panel value="logistics">
           <div className="flex flex-col gap-6">
             <BodyGrid
@@ -313,6 +401,52 @@ export function ReadonlyBookingView({
         bill={pay.bill}
         onConfirm={pay.confirm}
       />
+      <Modal
+        opened={cancelOpen}
+        onClose={() => setCancelOpen(false)}
+        title={
+          <Text fw={800} fz={18} c="#10202F">
+            Cancel this booking?
+          </Text>
+        }
+        centered
+        radius={16}
+      >
+        <Stack gap="md">
+          <Text size="sm" c="#475569">
+            You&apos;re about to cancel booking{" "}
+            <Text span fw={700} c="#10202F">
+              {booking.reference}
+            </Text>
+            . Since you haven&apos;t paid yet,{" "}
+            <Text span fw={700}>
+              no cancellation fee
+            </Text>{" "}
+            will be charged
+            {status === "SELECTED_FOR_BATCH"
+              ? ", and your reserved wagon space will be released immediately"
+              : ""}
+            . This cannot be undone.
+          </Text>
+          <Group justify="flex-end" gap={8}>
+            <Button
+              variant="default"
+              radius={10}
+              onClick={() => setCancelOpen(false)}
+            >
+              Keep booking
+            </Button>
+            <Button
+              color="red"
+              radius={10}
+              loading={cancelMutation.isPending}
+              onClick={() => cancelMutation.mutate()}
+            >
+              Cancel booking
+            </Button>
+          </Group>
+        </Stack>
+      </Modal>
       {viewer}
     </PageShell>
   );
diff --git a/apps/edr-freight-web/portal/src/pages/bookings/BookingDetailPage/booking-detail-types.ts b/apps/edr-freight-web/portal/src/pages/bookings/BookingDetailPage/booking-detail-types.ts
index 7479e758d..95bc57640 100644
--- a/apps/edr-freight-web/portal/src/pages/bookings/BookingDetailPage/booking-detail-types.ts
+++ b/apps/edr-freight-web/portal/src/pages/bookings/BookingDetailPage/booking-detail-types.ts
@@ -35,6 +35,8 @@ export interface BookingContainerLineDetail {
   isOverweight?: boolean;
   overweightExcessTons?: number | string | null;
   containerNumber?: string | null;
+  /** Size (ft) as stored on the line ("20"/"40") — the wagon-cancellation key. */
+  containerSize?: string | null;
   containerType?: {
     code: string;
     label?: string | null;
@@ -75,6 +77,12 @@ export type BookingDetail = Freight.IBooking & {
     reference: string;
     status: string;
   } | null;
+  /** The allocated train, present once the booking is placed on a schedule. */
+  trainSchedule?: {
+    trainNumber: string | null;
+    reference: string | null;
+    scheduledDepartureDate: string | null;
+  } | null;
 };
 
 /**
diff --git a/apps/edr-freight-web/portal/src/pages/bookings/BookingDetailPage/components/ClearanceCard.tsx b/apps/edr-freight-web/portal/src/pages/bookings/BookingDetailPage/components/ClearanceCard.tsx
index e5ea8d3a9..3002356f7 100644
--- a/apps/edr-freight-web/portal/src/pages/bookings/BookingDetailPage/components/ClearanceCard.tsx
+++ b/apps/edr-freight-web/portal/src/pages/bookings/BookingDetailPage/components/ClearanceCard.tsx
@@ -51,7 +51,12 @@ export function ClearanceCard({ booking }: { booking: Freight.IBooking }) {
   }
 
   const summary =
-    status === "CLEARANCE_READY" ? (
+    status === "OPERATION_CHANGES_REQUESTED" ? (
+      <Alert color="yellow" radius="md" icon={<Clock size={18} />}>
+        Operations returned this order for changes. Update the booking details,
+        pick a new shipment day and resubmit.
+      </Alert>
+    ) : status === "CLEARANCE_READY" ? (
       <Alert color="teal" radius="md" icon={<CheckCircle2 size={18} />}>
         {`${
           booking.customsClearingEnabled
@@ -103,9 +108,11 @@ export function ClearanceCard({ booking }: { booking: Freight.IBooking }) {
       {summary}
 
       <Text fz="12.5px" c="dimmed" mt="sm">
-        {isBookAction
-          ? "Use “Book” to enter the cargo details and schedule your shipment."
-          : `Use “${action?.label ?? "the action button"}” to manage your ${docNoun}.`}
+        {status === "OPERATION_CHANGES_REQUESTED"
+          ? "Use “Change booking” to update the details and pick a new shipment day."
+          : isBookAction
+            ? "Use “Book” to enter the cargo details and schedule your shipment."
+            : `Use “${action?.label ?? "the action button"}” to manage your ${docNoun}.`}
       </Text>
 
       {!isBookAction && (
diff --git a/apps/edr-freight-web/portal/src/pages/bookings/BookingDetailPage/components/PageHeader.tsx b/apps/edr-freight-web/portal/src/pages/bookings/BookingDetailPage/components/PageHeader.tsx
index 455b71a69..95cfeab11 100644
--- a/apps/edr-freight-web/portal/src/pages/bookings/BookingDetailPage/components/PageHeader.tsx
+++ b/apps/edr-freight-web/portal/src/pages/bookings/BookingDetailPage/components/PageHeader.tsx
@@ -1,14 +1,5 @@
-import { ActionIcon, Button, Group, Menu, Stack, Text } from "@mantine/core";
-import {
-  ArrowDownLeft,
-  ArrowUpRight,
-  Edit2,
-  FileText,
-  HelpCircle,
-  MoreHorizontal,
-  RefreshCw,
-  XCircle,
-} from "lucide-react";
+import { Button, Group, Stack, Text } from "@mantine/core";
+import { ArrowDownLeft, ArrowUpRight } from "lucide-react";
 import type { ReactNode } from "react";
 
 import type { Freight } from "@edr/types";
@@ -20,22 +11,12 @@ import {
 
 import { bookingSubtitle, isDraftLike, isNegative } from "../utils";
 
-export interface PageHeaderMenuActions {
-  onViewContract?: () => void;
-  onCancel?: () => void;
-  onEdit?: () => void;
-  onSupport?: () => void;
-  onRebook?: () => void;
-}
-
 export function PageHeader({
   booking,
   actions,
-  menuActions,
 }: {
   booking: Freight.IBooking;
   actions?: ReactNode;
-  menuActions?: PageHeaderMenuActions;
 }) {
   const status = booking.status as string;
   const negative = isNegative(status);
@@ -47,8 +28,6 @@ export function PageHeader({
   const pillText = negative ? "#A93226" : draft ? "#475569" : "#0A6F4D";
   const isExport = booking.tradeDirection === "EXPORT";
 
-  const hasMenu = menuActions && Object.values(menuActions).some(Boolean);
-
   return (
     <Group justify="space-between" align="flex-start" wrap="wrap" gap="md">
       <Stack gap={8} miw={0}>
@@ -83,66 +62,6 @@ export function PageHeader({
 
       <Group gap={8} wrap="nowrap" align="center">
         {actions}
-        {hasMenu && (
-          <Menu shadow="md" radius={12} position="bottom-end">
-            <Menu.Target>
-              <ActionIcon
-                variant="default"
-                size={42}
-                radius={10}
-                aria-label="More options"
-              >
-                <MoreHorizontal size={18} />
-              </ActionIcon>
-            </Menu.Target>
-            <Menu.Dropdown miw={210}>
-              {menuActions!.onViewContract && (
-                <Menu.Item
-                  leftSection={<FileText size={15} />}
-                  onClick={menuActions!.onViewContract}
-                >
-                  View contract
-                </Menu.Item>
-              )}
-              {menuActions!.onEdit && (
-                <Menu.Item
-                  leftSection={<Edit2 size={15} />}
-                  onClick={menuActions!.onEdit}
-                >
-                  Edit
-                </Menu.Item>
-              )}
-              {menuActions!.onSupport && (
-                <Menu.Item
-                  leftSection={<HelpCircle size={15} />}
-                  onClick={menuActions!.onSupport}
-                >
-                  Contact customer support
-                </Menu.Item>
-              )}
-              {menuActions!.onRebook && (
-                <Menu.Item
-                  leftSection={<RefreshCw size={15} />}
-                  onClick={menuActions!.onRebook}
-                >
-                  Rebook similar schedule
-                </Menu.Item>
-              )}
-              {menuActions!.onCancel && (
-                <>
-                  <Menu.Divider />
-                  <Menu.Item
-                    color="red"
-                    leftSection={<XCircle size={15} />}
-                    onClick={menuActions!.onCancel}
-                  >
-                    Cancel booking
-                  </Menu.Item>
-                </>
-              )}
-            </Menu.Dropdown>
-          </Menu>
-        )}
       </Group>
     </Group>
   );
@@ -154,6 +73,7 @@ export function HeaderButton({
   onClick,
   dark,
   green,
+  red,
   disabled,
 }: {
   label: string;
@@ -161,6 +81,7 @@ export function HeaderButton({
   onClick?: () => void;
   dark?: boolean;
   green?: boolean;
+  red?: boolean;
   disabled?: boolean;
 }) {
   return (
@@ -169,14 +90,14 @@ export function HeaderButton({
       disabled={disabled}
       leftSection={icon}
       radius={10}
-      variant={green || dark ? "filled" : "default"}
-      color={green ? "edr-green" : dark ? "#0C1A2B" : undefined}
+      variant={green || dark ? "filled" : red ? "outline" : "default"}
+      color={green ? "edr-green" : dark ? "#0C1A2B" : red ? "red" : undefined}
       styles={{
         root: { height: 42, paddingInline: 16 },
         label: {
           fontSize: 13,
           fontWeight: 700,
-          color: green || dark ? "#fff" : "#10202F",
+          color: green || dark ? "#fff" : red ? undefined : "#10202F",
         },
       }}
     >
diff --git a/apps/edr-freight-web/portal/src/pages/bookings/BookingDetailPage/components/ScheduleCard.tsx b/apps/edr-freight-web/portal/src/pages/bookings/BookingDetailPage/components/ScheduleCard.tsx
index ab11da3a0..0d8df5cee 100644
--- a/apps/edr-freight-web/portal/src/pages/bookings/BookingDetailPage/components/ScheduleCard.tsx
+++ b/apps/edr-freight-web/portal/src/pages/bookings/BookingDetailPage/components/ScheduleCard.tsx
@@ -65,6 +65,12 @@ export function ScheduleCard({
   const service = serviceTypeLabel(booking);
   const equipmentReturn =
     booking.equipmentReturn === "WITH_RETURN" ? "With return" : "Without return";
+  const schedule = booking.trainSchedule;
+  const trainLabel = schedule?.trainNumber
+    ? `Train ${schedule.trainNumber}${schedule.reference ? ` · ${schedule.reference}` : ""}`
+    : schedule?.reference
+      ? `Schedule ${schedule.reference}`
+      : "Track shipment";
   const assignedTrain: Row = booking.trainScheduleId
     ? {
         label: "Assigned train",
@@ -85,7 +91,7 @@ export function ScheduleCard({
               fontSize: 13,
             }}
           >
-            <MapPin size={13} /> Track shipment
+            <MapPin size={13} /> {trainLabel}
           </button>
         ),
       }
diff --git a/apps/edr-freight-web/portal/src/pages/bookings/BookingDetailPage/components/WagonCancellationCard.tsx b/apps/edr-freight-web/portal/src/pages/bookings/BookingDetailPage/components/WagonCancellationCard.tsx
new file mode 100644
index 000000000..00b3195a2
--- /dev/null
+++ b/apps/edr-freight-web/portal/src/pages/bookings/BookingDetailPage/components/WagonCancellationCard.tsx
@@ -0,0 +1,496 @@
+import {
+  Alert,
+  Box,
+  Button,
+  Group,
+  Modal,
+  NumberInput,
+  Stack,
+  Table,
+  Text,
+  Textarea,
+} from "@mantine/core";
+import { useMutation, useQuery } from "@tanstack/react-query";
+import { CheckCircle2, Clock, CreditCard, TrainTrack } from "lucide-react";
+import { useMemo, useState } from "react";
+import toast from "react-hot-toast";
+import { Link, useNavigate } from "react-router-dom";
+
+import type { Freight } from "@edr/types";
+
+import { api } from "@/services/api";
+import {
+  bookingsService,
+  type RequestWagonCancellationPayload,
+  type WagonCancellation,
+  type WagonCancellationPreview,
+} from "@/services/bookings.service";
+import { OperationDatePicker } from "@/pages/bookings/clearance";
+import { useFeeInvoicePayment } from "@/pages/bookings/payments/useBookingPayment";
+
+import type { BookingDetail } from "../booking-detail-types";
+import { fmtDate } from "../utils";
+import { CardTitle, SectionCard } from "./layout";
+import { PaymentMethodModal } from "./PaymentMethodModal";
+
+// Same pill treatment as WagonsTab's STATUS_TONES so the page reads as one.
+const STATUS_TONES: Record<
+  WagonCancellation["status"],
+  { bg: string; color: string; label: string }
+> = {
+  FEE_PENDING: { bg: "#FFFBEB", color: "#92400E", label: "Fee pending" },
+  CREDIT_AVAILABLE: { bg: "#EAF1FE", color: "#1E40AF", label: "Credit available" },
+  REBOOKED: { bg: "#E8F5EF", color: "#0A6F4D", label: "Rebooked" },
+  WITHDRAWN: { bg: "#F1F4F7", color: "#475569", label: "Withdrawn" },
+  EXPIRED: { bg: "#FEF2F2", color: "#B91C1C", label: "Expired" },
+};
+
+function StatusPill({ status }: { status: WagonCancellation["status"] }) {
+  const tone = STATUS_TONES[status] ?? STATUS_TONES.WITHDRAWN;
+  return (
+    <Text
+      component="span"
+      fz={11}
+      fw={700}
+      px={9}
+      py={3}
+      style={{ borderRadius: 999, backgroundColor: tone.bg, color: tone.color }}
+    >
+      {tone.label}
+    </Text>
+  );
+}
+
+const fmtMoney = (amount: number | string, currency: string) =>
+  `${Number(amount).toLocaleString()} ${currency}`;
+
+const apiErrorMessage = (error: unknown, fallback: string) => {
+  const data = (
+    error as { response?: { data?: { message?: string | string[] } } }
+  )?.response?.data;
+  if (Array.isArray(data?.message)) return data.message.join(", ");
+  if (data?.message) return data.message;
+  return fallback;
+};
+
+const th = { color: "#9AA8B5", fontSize: 11 } as const;
+
+/**
+ * Partial wagon cancellation on a PAID contract booking: request a cut (fee
+ * previewed first), pay the cancellation fee, then rebook the freed credit
+ * onto another shipment day — plus the booking's cancellation history.
+ * Wagons leave the schedule at request time; the fee settles the credit.
+ */
+export function WagonCancellationCard({
+  booking,
+  onBookingUpdated,
+}: {
+  booking: Freight.IBooking;
+  onBookingUpdated?: () => void;
+}) {
+  const navigate = useNavigate();
+  const status = booking.status as string;
+  const eligible =
+    status === "PAID" &&
+    (booking.paymentStatus as string) === "PAID" &&
+    !!booking.contractId;
+
+  const isBulk = booking.freightType === "BULK";
+  const detail = booking as BookingDetail;
+  // The entity field the API serializes on the detail read; not on the DTO type.
+  const wagonsRequired = Number(
+    (booking as { wagonsRequired?: number | string | null }).wagonsRequired ?? 0,
+  );
+
+  // Live units per container size ("20"/"40"), summed across lines.
+  const containerLines = useMemo(() => {
+    const bySize = new Map<string, number>();
+    for (const line of detail.bookingContainers ?? []) {
+      const size =
+        line.containerSize ??
+        (line.containerType?.sizeFt != null
+          ? String(line.containerType.sizeFt)
+          : null);
+      if (!size) continue;
+      bySize.set(size, (bySize.get(size) ?? 0) + Number(line.quantity ?? 0));
+    }
+    return [...bySize.entries()].map(([containerSize, quantity]) => ({
+      containerSize,
+      quantity,
+    }));
+  }, [detail.bookingContainers]);
+
+  const { data, refetch } = useQuery({
+    ...api.bookings.listWagonCancellations.queryOptions({
+      input: { bookingId: booking.id },
+    }),
+    enabled: eligible,
+  });
+  // History includes rows where this booking is the rebooked TARGET — only
+  // rows this booking opened itself can be paid/withdrawn/rebooked from here.
+  const rows = data?.items ?? [];
+  const ownRows = rows.filter((r) => r.bookingId === booking.id);
+  const openRow = ownRows.find((r) => r.status === "FEE_PENDING");
+  const creditRow = ownRows.find((r) => r.status === "CREDIT_AVAILABLE");
+
+  const feePay = useFeeInvoicePayment(booking.id);
+
+  // ── Request modal state ──
+  const [modalOpen, setModalOpen] = useState(false);
+  const [wagons, setWagons] = useState<number | string>(1);
+  const [cancelBySize, setCancelBySize] = useState<Record<string, number>>({});
+  const [reason, setReason] = useState("");
+  const [preview, setPreview] = useState<WagonCancellationPreview | null>(null);
+
+  const closeModal = () => {
+    setModalOpen(false);
+    setWagons(1);
+    setCancelBySize({});
+    setReason("");
+    setPreview(null);
+  };
+
+  const requestPayload = (): RequestWagonCancellationPayload | null => {
+    const trimmedReason = reason.trim();
+    if (isBulk) {
+      const n = Number(wagons);
+      if (!n || n <= 0) return null;
+      return { wagons: n, ...(trimmedReason ? { reason: trimmedReason } : {}) };
+    }
+    const containers = containerLines
+      .map((l) => ({
+        containerSize: l.containerSize,
+        quantity: cancelBySize[l.containerSize] ?? 0,
+      }))
+      .filter((c) => c.quantity > 0);
+    if (!containers.length) return null;
+    return { containers, ...(trimmedReason ? { reason: trimmedReason } : {}) };
+  };
+  const payload = requestPayload();
+
+  const previewMutation = useMutation({
+    mutationFn: (body: RequestWagonCancellationPayload) =>
+      bookingsService.previewWagonCancellation(booking.id, body),
+    onSuccess: setPreview,
+    onError: (e) => {
+      setPreview(null);
+      toast.error(apiErrorMessage(e, "Could not calculate the fee. Please try again."));
+    },
+  });
+
+  const requestMutation = useMutation({
+    mutationFn: (body: RequestWagonCancellationPayload) =>
+      bookingsService.requestWagonCancellation(booking.id, body),
+    onSuccess: () => {
+      closeModal();
+      toast.success(
+        "Cancellation requested — pay the fee to release the wagons.",
+        { duration: 6000 },
+      );
+      void refetch();
+      onBookingUpdated?.();
+    },
+    onError: (e) =>
+      toast.error(
+        apiErrorMessage(e, "Could not request the cancellation. Please try again."),
+      ),
+  });
+
+  const withdrawMutation = useMutation({
+    mutationFn: () => bookingsService.withdrawWagonCancellation(openRow!.id),
+    onSuccess: () => {
+      toast.success("Cancellation withdrawn — the fee invoice was voided.");
+      void refetch();
+      onBookingUpdated?.();
+    },
+    onError: (e) =>
+      toast.error(
+        apiErrorMessage(e, "Could not withdraw the cancellation. Please try again."),
+      ),
+  });
+
+  const [rebookDate, setRebookDate] = useState("");
+  const rebookMutation = useMutation({
+    mutationFn: () =>
+      bookingsService.rebookWagonCancellation(creditRow!.id, {
+        scheduledDate: rebookDate,
+      }),
+    onSuccess: ({ bookingId }) => {
+      toast.success("Wagons rebooked — taking you to the new booking.", {
+        duration: 6000,
+      });
+      navigate(`/bookings/${bookingId}`);
+    },
+    onError: (e) =>
+      toast.error(apiErrorMessage(e, "Could not rebook the wagons. Please try again.")),
+  });
+
+  if (!eligible) return null;
+
+  return (
+    <SectionCard>
+      <Group justify="space-between" align="center" mb="sm">
+        <CardTitle>Wagon Cancellation</CardTitle>
+        {!openRow && !creditRow && (
+          <Button
+            variant="default"
+            radius="md"
+            leftSection={<TrainTrack size={16} />}
+            onClick={() => setModalOpen(true)}
+          >
+            Cancel wagons
+          </Button>
+        )}
+      </Group>
+
+      {openRow ? (
+        <Stack gap="sm">
+          <Alert color="yellow" radius="md" icon={<Clock size={18} />}>
+            A cancellation of {Number(openRow.wagonsCancelled)} wagon(s) is
+            awaiting its fee of{" "}
+            <Text span fw={700}>
+              {fmtMoney(openRow.feeAmount, openRow.feeCurrency)}
+            </Text>
+            . The cancelled wagons have left the train. Pay the fee to unlock
+            the rebooking credit, or withdraw the request to get the wagons
+            back — withdrawing works only while the train still has free space
+            for them.
+          </Alert>
+          <Group gap={8}>
+            <Button
+              color="edr-green"
+              radius="md"
+              leftSection={<CreditCard size={16} />}
+              onClick={feePay.open}
+            >
+              Pay cancellation fee
+            </Button>
+            <Button
+              variant="default"
+              radius="md"
+              loading={withdrawMutation.isPending}
+              onClick={() => withdrawMutation.mutate()}
+            >
+              Withdraw request
+            </Button>
+          </Group>
+        </Stack>
+      ) : creditRow ? (
+        <Stack gap="sm">
+          <Alert color="teal" radius="md" icon={<CheckCircle2 size={18} />}>
+            {Number(creditRow.wagonsCancelled)} wagon(s) were released — a
+            credit of{" "}
+            <Text span fw={700}>
+              {fmtMoney(creditRow.creditAmount, booking.paymentCurrency)}
+            </Text>{" "}
+            is available. Pick a shipment day to rebook them as a new paid
+            booking (no further payment needed).
+          </Alert>
+          <OperationDatePicker
+            bookingId={booking.id}
+            value={rebookDate}
+            onChange={setRebookDate}
+          />
+          <Group justify="flex-end">
+            <Button
+              color="edr-green"
+              radius="md"
+              disabled={!rebookDate}
+              loading={rebookMutation.isPending}
+              onClick={() => rebookMutation.mutate()}
+            >
+              Rebook wagons
+            </Button>
+          </Group>
+        </Stack>
+      ) : (
+        <Text fz={13} c="#475569">
+          Need fewer wagons than you paid for? Cancel part of this booking for
+          a per-wagon fee — the freed freight amount becomes a credit you can
+          rebook onto another shipment day.
+        </Text>
+      )}
+
+      {rows.length > 0 && (
+        <Box style={{ overflowX: "auto" }} mt="md">
+          <Table verticalSpacing={6} horizontalSpacing="sm">
+            <Table.Thead>
+              <Table.Tr>
+                <Table.Th style={th}>Date</Table.Th>
+                <Table.Th style={th}>Wagons</Table.Th>
+                <Table.Th style={th}>Fee</Table.Th>
+                <Table.Th style={th}>Status</Table.Th>
+                <Table.Th style={th}>Rebooked as</Table.Th>
+              </Table.Tr>
+            </Table.Thead>
+            <Table.Tbody>
+              {rows.map((r) => (
+                <Table.Tr key={r.id}>
+                  <Table.Td>
+                    <Text fz={12.5} c="#475569">
+                      {fmtDate(r.createdAt)}
+                    </Text>
+                  </Table.Td>
+                  <Table.Td>
+                    <Text fz={12.5} fw={700} c="#10202F">
+                      {Number(r.wagonsCancelled)}
+                    </Text>
+                  </Table.Td>
+                  <Table.Td>
+                    <Text fz={12.5} c="#475569">
+                      {fmtMoney(r.feeAmount, r.feeCurrency)}
+                    </Text>
+                  </Table.Td>
+                  <Table.Td>
+                    <StatusPill status={r.status} />
+                  </Table.Td>
+                  <Table.Td>
+                    {r.rebookedBookingId ? (
+                      <Text
+                        component={Link}
+                        to={`/bookings/${r.rebookedBookingId}`}
+                        fz={12.5}
+                        fw={700}
+                        c="#0A6F4D"
+                        style={{ textDecoration: "underline" }}
+                      >
+                        {r.rebookedBooking?.reference ?? "View booking"}
+                      </Text>
+                    ) : (
+                      <Text fz={12.5} c="#9AA8B5">
+                        —
+                      </Text>
+                    )}
+                  </Table.Td>
+                </Table.Tr>
+              ))}
+            </Table.Tbody>
+          </Table>
+        </Box>
+      )}
+
+      <PaymentMethodModal
+        opened={feePay.modalOpen}
+        onClose={feePay.close}
+        amountLabel={
+          openRow ? fmtMoney(openRow.feeAmount, openRow.feeCurrency) : undefined
+        }
+        currency={openRow?.feeCurrency}
+        processing={feePay.processing}
+        error={feePay.error}
+        otp={feePay.otp}
+        bill={feePay.bill}
+        onConfirm={feePay.confirm}
+      />
+
+      <Modal
+        opened={modalOpen}
+        onClose={closeModal}
+        title={
+          <Text fw={800} fz={18} c="#10202F">
+            Cancel wagons
+          </Text>
+        }
+        centered
+        radius={16}
+      >
+        <Stack gap="md">
+          <Text size="sm" c="#475569">
+            Choose how much of booking{" "}
+            <Text span fw={700} c="#10202F">
+              {booking.reference}
+            </Text>{" "}
+            to cancel. A per-wagon fee applies; once it&apos;s paid the wagons
+            are released and the freed amount becomes a rebooking credit. At
+            least one wagon must remain — to cancel everything, cancel the
+            whole booking instead.
+          </Text>
+
+          {isBulk ? (
+            <NumberInput
+              label="Wagons to cancel"
+              min={1}
+              max={wagonsRequired > 1 ? wagonsRequired - 1 : undefined}
+              allowDecimal={false}
+              value={wagons}
+              onChange={(v) => {
+                setWagons(v);
+                setPreview(null);
+              }}
+            />
+          ) : (
+            containerLines.map((line) => (
+              <NumberInput
+                key={line.containerSize}
+                label={`${line.containerSize}ft containers to cancel`}
+                description={`${line.quantity} on this booking`}
+                min={0}
+                max={line.quantity}
+                allowDecimal={false}
+                value={cancelBySize[line.containerSize] ?? 0}
+                onChange={(v) => {
+                  setCancelBySize((prev) => ({
+                    ...prev,
+                    [line.containerSize]: Number(v) || 0,
+                  }));
+                  setPreview(null);
+                }}
+              />
+            ))
+          )}
+
+          <Textarea
+            label="Reason (optional)"
+            placeholder="Why are these wagons no longer needed?"
+            autosize
+            minRows={2}
+            value={reason}
+            onChange={(e) => setReason(e.currentTarget.value)}
+          />
+
+          {preview && (
+            <Alert color="blue" radius="md">
+              <Text fz={13}>
+                Cancelling{" "}
+                <Text span fw={700}>
+                  {preview.wagons} wagon(s)
+                </Text>{" "}
+                (~{preview.weightTons} t) costs a fee of{" "}
+                <Text span fw={700}>
+                  {fmtMoney(preview.feeAmount, preview.feeCurrency)}
+                </Text>{" "}
+                ({fmtMoney(preview.feePerWagon, preview.feeCurrency)} per
+                wagon) and frees a rebooking credit of{" "}
+                <Text span fw={700}>
+                  {fmtMoney(preview.creditAmount, booking.paymentCurrency)}
+                </Text>
+                .
+              </Text>
+            </Alert>
+          )}
+
+          <Group justify="flex-end" gap={8}>
+            <Button
+              variant="default"
+              radius={10}
+              disabled={!payload}
+              loading={previewMutation.isPending}
+              onClick={() => payload && previewMutation.mutate(payload)}
+            >
+              Calculate fee
+            </Button>
+            <Button
+              color="red"
+              radius={10}
+              disabled={!payload}
+              loading={requestMutation.isPending}
+              onClick={() => payload && requestMutation.mutate(payload)}
+            >
+              Request cancellation
+            </Button>
+          </Group>
+        </Stack>
+      </Modal>
+    </SectionCard>
+  );
+}
diff --git a/apps/edr-freight-web/portal/src/pages/bookings/BookingDetailPage/components/WagonsTab.tsx b/apps/edr-freight-web/portal/src/pages/bookings/BookingDetailPage/components/WagonsTab.tsx
new file mode 100644
index 000000000..89df714d6
--- /dev/null
+++ b/apps/edr-freight-web/portal/src/pages/bookings/BookingDetailPage/components/WagonsTab.tsx
@@ -0,0 +1,792 @@
+import {
+  Alert,
+  Box,
+  Button,
+  Checkbox,
+  Group,
+  Modal,
+  SimpleGrid,
+  Skeleton,
+  Stack,
+  Table,
+  Text,
+  Textarea,
+  Tooltip,
+} from "@mantine/core";
+import { useMutation, useQuery, useQueryClient } from "@tanstack/react-query";
+import {
+  Container,
+  Gauge,
+  MapPin,
+  Package,
+  Route,
+  Scale,
+  TrainFront,
+  TrainTrack,
+} from "lucide-react";
+import { useState, type ReactNode } from "react";
+import toast from "react-hot-toast";
+
+import {
+  bookingsService,
+  type BookingWagonAllocation,
+  type WagonCancellation,
+  type WagonCancellationPreview,
+} from "@/services/bookings.service";
+import { api } from "@/services/api";
+
+import { fmtDate, fmtWeight } from "../utils";
+import { CardTitle, SectionCard } from "./layout";
+
+const CANCEL_TONES: Record<
+  string,
+  { bg: string; color: string; border: string; label: string; hint: string }
+> = {
+  FEE_PENDING: {
+    bg: "#FFFBEB",
+    color: "#92400E",
+    border: "#FDE68A",
+    label: "Cancelled — fee unpaid",
+    hint: "These wagons left the train. Pay the cancellation fee to turn them into a rebooking credit, or withdraw to get them back (needs free space).",
+  },
+  CREDIT_AVAILABLE: {
+    bg: "#E6F7F2",
+    color: "#0A6F4D",
+    border: "#B7E6D6",
+    label: "Cancelled — credit ready",
+    hint: "Fee paid. Pick a new shipment day in the wagon cancellation card to rebook these — no new freight charge.",
+  },
+  REBOOKED: {
+    bg: "#E8F5EF",
+    color: "#0A6F4D",
+    border: "#B7E6D6",
+    label: "Rebooked",
+    hint: "These wagons ride again on the rebooked shipment.",
+  },
+};
+
+/** Cancelled wagons + their cargo, categorized by cancellation state. */
+function CancelledWagonsSection({ rows }: { rows: WagonCancellation[] }) {
+  const visible = rows.filter((r) => CANCEL_TONES[r.status]);
+  if (!visible.length) return null;
+  return (
+    <SectionCard>
+      <CardTitle>Cancelled wagons</CardTitle>
+      <Stack gap="sm" mt="sm">
+        {visible.map((r) => {
+          const tone = CANCEL_TONES[r.status];
+          const units = r.cancelledQuantities.units ?? [];
+          return (
+            <Box
+              key={r.id}
+              p={12}
+              style={{
+                borderRadius: 10,
+                backgroundColor: tone.bg,
+                border: `1px solid ${tone.border}`,
+              }}
+            >
+              <Group justify="space-between" align="center" wrap="wrap" gap={6}>
+                <Text fz={13.5} fw={800} style={{ color: tone.color }}>
+                  {Number(r.wagonsCancelled)} wagon(s) — {tone.label}
+                </Text>
+                <Text fz={12} c="#6B7C8E">
+                  {fmtDate(r.createdAt)}
+                  {r.rebookedBooking
+                    ? ` · new booking ${r.rebookedBooking.reference}`
+                    : ""}
+                </Text>
+              </Group>
+              {units.length > 0 && (
+                <Group gap={6} mt={6} wrap="wrap">
+                  {units.map((u) => (
+                    <Text
+                      key={u.containerNumber}
+                      component="span"
+                      fz={11.5}
+                      fw={700}
+                      px={8}
+                      py={2}
+                      style={{
+                        borderRadius: 6,
+                        backgroundColor: "white",
+                        border: `1px solid ${tone.border}`,
+                        color: tone.color,
+                        fontFamily: "monospace",
+                      }}
+                    >
+                      {u.containerNumber} · {u.containerSize}ft
+                    </Text>
+                  ))}
+                </Group>
+              )}
+              {!units.length && r.cancelledQuantities.bulkTons != null && (
+                <Text fz={12.5} mt={4} style={{ color: tone.color }}>
+                  {Number(r.cancelledQuantities.bulkTons).toLocaleString()} tons of
+                  bulk cargo
+                </Text>
+              )}
+              <Text fz={12} c="#6B7C8E" mt={6}>
+                {tone.hint}
+              </Text>
+            </Box>
+          );
+        })}
+      </Stack>
+    </SectionCard>
+  );
+}
+
+const apiErrorMessage = (error: unknown, fallback: string) => {
+  const data = (
+    error as { response?: { data?: { message?: string | string[] } } }
+  )?.response?.data;
+  if (Array.isArray(data?.message)) return data.message.join(", ");
+  if (data?.message) return data.message;
+  return fallback;
+};
+
+// Mirrors CargoTab's local Flag/StatTile look so the two tabs read as one page.
+const STATUS_TONES: Record<
+  BookingWagonAllocation["status"],
+  { bg: string; color: string; label: string }
+> = {
+  PLANNED: { bg: "#F1F4F7", color: "#475569", label: "Planned" },
+  RESERVED: { bg: "#FFFBEB", color: "#92400E", label: "Reserved" },
+  LOADED: { bg: "#E8F5EF", color: "#0A6F4D", label: "Loaded" },
+  DEPARTED: { bg: "#EAF1FE", color: "#1E40AF", label: "Departed" },
+};
+
+function StatusPill({ status }: { status: BookingWagonAllocation["status"] }) {
+  const tone = STATUS_TONES[status] ?? STATUS_TONES.PLANNED;
+  return (
+    <Text
+      component="span"
+      fz={11}
+      fw={700}
+      px={9}
+      py={3}
+      style={{ borderRadius: 999, backgroundColor: tone.bg, color: tone.color }}
+    >
+      {tone.label}
+    </Text>
+  );
+}
+
+function StatTile({
+  icon,
+  label,
+  value,
+  sub,
+}: {
+  icon: ReactNode;
+  label: string;
+  value: string;
+  sub?: string;
+}) {
+  return (
+    <Box
+      p={14}
+      style={{
+        borderRadius: 12,
+        border: "1px solid #E6ECF2",
+        backgroundColor: "#FAFCFE",
+      }}
+    >
+      <Group gap={6} align="center" mb={6} c="#6B7C8E">
+        {icon}
+        <Text fz="11px" fw={700} tt="uppercase" style={{ letterSpacing: "0.05em" }}>
+          {label}
+        </Text>
+      </Group>
+      <Text fz={18} fw={800} c="#10202F" truncate>
+        {value}
+      </Text>
+      {sub && (
+        <Text fz={12} c="#9AA8B5" mt={2}>
+          {sub}
+        </Text>
+      )}
+    </Box>
+  );
+}
+
+/** Little consist strip: locomotive + one box per wagon, in marshalling order. */
+function ConsistStrip({ wagons }: { wagons: BookingWagonAllocation[] }) {
+  return (
+    <Box style={{ overflowX: "auto" }} pb={4}>
+      <Group gap={5} wrap="nowrap" align="flex-end">
+        <Box
+          px={10}
+          py={8}
+          style={{
+            borderRadius: "10px 4px 4px 10px",
+            backgroundColor: "#10202F",
+            color: "white",
+            display: "flex",
+            alignItems: "center",
+            gap: 6,
+            flexShrink: 0,
+          }}
+        >
+          <TrainFront size={16} />
+          <Text fz={11} fw={800}>
+            LOCO
+          </Text>
+        </Box>
+        {wagons.map((w) => (
+          <Tooltip
+            key={w.sequenceNo}
+            label={`${w.wagonNumber ?? "Unassigned"} · ${w.wagonType ?? "—"} · ${
+              STATUS_TONES[w.status]?.label ?? w.status
+            }`}
+            withArrow
+          >
+            <Box
+              px={10}
+              py={8}
+              ta="center"
+              style={{
+                borderRadius: 6,
+                border: "1.5px solid #C9D6E2",
+                backgroundColor: STATUS_TONES[w.status]?.bg ?? "#F1F4F7",
+                flexShrink: 0,
+                minWidth: 64,
+                cursor: "default",
+              }}
+            >
+              <Text fz={10} fw={700} c="#6B7C8E">
+                W{w.sequenceNo}
+              </Text>
+              <Text fz={11.5} fw={800} c="#10202F" style={{ fontFamily: "monospace" }}>
+                {w.wagonNumber ?? "—"}
+              </Text>
+            </Box>
+          </Tooltip>
+        ))}
+      </Group>
+    </Box>
+  );
+}
+
+function LoadBar({ allocated, capacity }: { allocated: number; capacity: number }) {
+  const pct = capacity > 0 ? Math.min(100, Math.round((allocated / capacity) * 100)) : 0;
+  return (
+    <Box>
+      <Group justify="space-between" mb={4}>
+        <Text fz={11.5} fw={700} c="#6B7C8E">
+          Load
+        </Text>
+        <Text fz={11.5} fw={800} c="#10202F">
+          {fmtWeight(allocated)}
+          {capacity > 0 ? ` / ${fmtWeight(capacity)} · ${pct}%` : ""}
+        </Text>
+      </Group>
+      <Box style={{ height: 6, borderRadius: 999, backgroundColor: "#EDF2F7" }}>
+        <Box
+          style={{
+            height: 6,
+            width: `${pct}%`,
+            borderRadius: 999,
+            backgroundColor: pct >= 95 ? "#B45309" : "#0A6F4D",
+            transition: "width 300ms ease",
+          }}
+        />
+      </Box>
+    </Box>
+  );
+}
+
+const th = { color: "#9AA8B5", fontSize: 11 } as const;
+
+function WagonCard({
+  wagon,
+  selectable,
+  selected,
+  onToggle,
+}: {
+  wagon: BookingWagonAllocation;
+  selectable?: boolean;
+  selected?: boolean;
+  onToggle?: () => void;
+}) {
+  const allocated = Number(wagon.allocatedWeightTons || 0);
+  const capacity = Number(wagon.capacityTons || 0);
+  const containers = wagon.containers ?? [];
+
+  return (
+    <SectionCard
+      style={
+        selected
+          ? { outline: "2px solid #B45309", outlineOffset: -2, borderRadius: 16 }
+          : undefined
+      }
+    >
+      <Group justify="space-between" align="flex-start" wrap="nowrap" mb="sm">
+        <Group gap={10} align="center" wrap="nowrap">
+          {selectable && (
+            <Checkbox
+              checked={!!selected}
+              onChange={onToggle}
+              color="orange"
+              aria-label={`Select wagon ${wagon.sequenceNo} for cancellation`}
+            />
+          )}
+          <Box
+            style={{
+              width: 40,
+              height: 40,
+              display: "flex",
+              flexDirection: "column",
+              alignItems: "center",
+              justifyContent: "center",
+              borderRadius: 10,
+              backgroundColor: "#10202F",
+              color: "white",
+              flexShrink: 0,
+            }}
+          >
+            <Text fz={9} fw={700} c="#9AA8B5" lh={1}>
+              WAGON
+            </Text>
+            <Text fz={15} fw={800} lh={1.2}>
+              {wagon.sequenceNo}
+            </Text>
+          </Box>
+          <Box>
+            <Text fz={16} fw={800} c="#10202F" style={{ fontFamily: "monospace" }}>
+              {wagon.wagonNumber ?? "Not yet assigned"}
+            </Text>
+            <Text fz={12} c="#9AA8B5">
+              {wagon.wagonType ?? "Wagon type pending"}
+              {wagon.wagonTypeCode && wagon.wagonType !== wagon.wagonTypeCode
+                ? ` · ${wagon.wagonTypeCode}`
+                : ""}
+            </Text>
+          </Box>
+        </Group>
+        <StatusPill status={wagon.status} />
+      </Group>
+
+      <LoadBar allocated={allocated} capacity={capacity} />
+
+      <Group gap={16} mt="sm" mb={containers.length || wagon.loadType === "BULK" ? "sm" : 0}>
+        {Number(wagon.tareWeightTons) > 0 && (
+          <Group gap={5}>
+            <Scale size={12} color="#9AA8B5" />
+            <Text fz={12} c="#475569">
+              Tare {fmtWeight(Number(wagon.tareWeightTons))}
+            </Text>
+          </Group>
+        )}
+        {Number(wagon.lengthMeters) > 0 && (
+          <Group gap={5}>
+            <Route size={12} color="#9AA8B5" />
+            <Text fz={12} c="#475569">
+              {Number(wagon.lengthMeters)} m
+            </Text>
+          </Group>
+        )}
+        <Group gap={5}>
+          {wagon.loadType === "BULK" ? (
+            <Package size={12} color="#9AA8B5" />
+          ) : (
+            <Container size={12} color="#9AA8B5" />
+          )}
+          <Text fz={12} c="#475569">
+            {wagon.loadType === "BULK" ? "Bulk load" : "Container load"}
+          </Text>
+        </Group>
+      </Group>
+
+      {wagon.loadType === "BULK" && (wagon.bulkCargoDescription || wagon.bulkQuantity) && (
+        <Box
+          p={10}
+          style={{ borderRadius: 10, backgroundColor: "#FAFCFE", border: "1px solid #EDF2F7" }}
+        >
+          <Text fz={12.5} fw={700} c="#10202F">
+            {wagon.bulkCargoDescription ?? "Bulk cargo"}
+          </Text>
+          {Number(wagon.bulkQuantity) > 0 && (
+            <Text fz={12} c="#9AA8B5">
+              Quantity: {Number(wagon.bulkQuantity).toLocaleString()}
+            </Text>
+          )}
+        </Box>
+      )}
+
+      {containers.length > 0 && (
+        <Box style={{ overflowX: "auto" }}>
+          <Table verticalSpacing={6} horizontalSpacing="sm">
+            <Table.Thead>
+              <Table.Tr>
+                <Table.Th style={th}>Container no.</Table.Th>
+                <Table.Th style={th}>Seal no.</Table.Th>
+                <Table.Th style={th}>Gross wt.</Table.Th>
+              </Table.Tr>
+            </Table.Thead>
+            <Table.Tbody>
+              {containers.map((c, i) => (
+                <Table.Tr key={c.containerNumber ?? i}>
+                  <Table.Td>
+                    <Text fz={12.5} fw={700} c="#10202F" style={{ fontFamily: "monospace" }}>
+                      {c.containerNumber ?? "—"}
+                    </Text>
+                  </Table.Td>
+                  <Table.Td>
+                    <Text fz={12.5} c="#475569">
+                      {c.sealNumber ?? "—"}
+                    </Text>
+                  </Table.Td>
+                  <Table.Td>
+                    <Text fz={12.5} c="#475569">
+                      {Number(c.grossWeightTons) > 0
+                        ? fmtWeight(Number(c.grossWeightTons))
+                        : "—"}
+                    </Text>
+                  </Table.Td>
+                </Table.Tr>
+              ))}
+            </Table.Tbody>
+          </Table>
+        </Box>
+      )}
+    </SectionCard>
+  );
+}
+
+/**
+ * "Wagons" tab: the customer's view of their allocated wagons once the paid
+ * booking has been placed on a train — consist strip in marshalling order,
+ * per-wagon load/containers, and the train's route summary.
+ */
+export function WagonsTab({
+  bookingId,
+  cancellable,
+  onCancellationRequested,
+}: {
+  bookingId: string;
+  /** PAID contract booking — specific wagons may be selected for cancellation. */
+  cancellable?: boolean;
+  onCancellationRequested?: () => void;
+}) {
+  const queryClient = useQueryClient();
+  const { data: wagons, isLoading } = useQuery({
+    queryKey: ["booking-wagons", bookingId],
+    queryFn: () => bookingsService.getWagons(bookingId),
+    enabled: !!bookingId,
+  });
+
+  // Cancellation history: feeds the "Cancelled wagons" section and blocks a
+  // second request while one is awaiting its fee.
+  const { data: history } = useQuery({
+    ...api.bookings.listWagonCancellations.queryOptions({ input: { bookingId } }),
+    enabled: !!bookingId,
+  });
+  const ownCancellations = (history?.items ?? []).filter(
+    (r) => r.bookingId === bookingId,
+  );
+  const hasOpenCancellation = ownCancellations.some(
+    (r) => r.status === "FEE_PENDING",
+  );
+
+  const [selected, setSelected] = useState<Set<string>>(new Set());
+  const [confirmOpen, setConfirmOpen] = useState(false);
+  const [reason, setReason] = useState("");
+  const [preview, setPreview] = useState<WagonCancellationPreview | null>(null);
+
+  const toggle = (allocationId: string) =>
+    setSelected((prev) => {
+      const next = new Set(prev);
+      if (next.has(allocationId)) next.delete(allocationId);
+      else next.add(allocationId);
+      return next;
+    });
+
+  const previewMutation = useMutation({
+    mutationFn: () =>
+      bookingsService.previewWagonCancellation(bookingId, {
+        wagonAllocationIds: [...selected],
+      }),
+    onSuccess: setPreview,
+    onError: (e) => {
+      setPreview(null);
+      toast.error(apiErrorMessage(e, "Could not calculate the fee. Please try again."));
+    },
+  });
+
+  const requestMutation = useMutation({
+    mutationFn: () =>
+      bookingsService.requestWagonCancellation(bookingId, {
+        wagonAllocationIds: [...selected],
+        ...(reason.trim() ? { reason: reason.trim() } : {}),
+      }),
+    onSuccess: () => {
+      setConfirmOpen(false);
+      setSelected(new Set());
+      setReason("");
+      setPreview(null);
+      toast.success(
+        "Cancellation requested — pay the fee in the wagon cancellation card to release these wagons.",
+        { duration: 7000 },
+      );
+      void queryClient.invalidateQueries({ queryKey: ["booking-wagons", bookingId] });
+      void queryClient.invalidateQueries({
+        queryKey: api.bookings.listWagonCancellations.queryKey({ bookingId }),
+      });
+      onCancellationRequested?.();
+    },
+    onError: (e) =>
+      toast.error(apiErrorMessage(e, "Could not request the cancellation. Please try again.")),
+  });
+
+  const openConfirm = () => {
+    setPreview(null);
+    setConfirmOpen(true);
+    previewMutation.mutate();
+  };
+
+  if (isLoading) {
+    return (
+      <div className="flex flex-col gap-6" style={{ maxWidth: 980 }}>
+        <Skeleton height={140} radius={16} />
+        <SimpleGrid cols={{ base: 1, md: 2 }} spacing={24}>
+          <Skeleton height={220} radius={16} />
+          <Skeleton height={220} radius={16} />
+        </SimpleGrid>
+      </div>
+    );
+  }
+
+  if (!wagons?.length) {
+    return (
+      <div className="flex flex-col gap-6" style={{ maxWidth: 980 }}>
+        <CancelledWagonsSection rows={ownCancellations} />
+      <SectionCard>
+        <Group gap={12} align="center">
+          <Box
+            style={{
+              width: 44,
+              height: 44,
+              display: "flex",
+              alignItems: "center",
+              justifyContent: "center",
+              borderRadius: 12,
+              backgroundColor: "#F1F4F7",
+              color: "#6B7C8E",
+            }}
+          >
+            <TrainTrack size={22} />
+          </Box>
+          <Box>
+            <Text fz={15} fw={800} c="#10202F">
+              No wagons allocated yet
+            </Text>
+            <Text fz={13} c="#9AA8B5">
+              Your wagons will appear here once the shipment is placed on a
+              train after payment.
+            </Text>
+          </Box>
+        </Group>
+      </SectionCard>
+      </div>
+    );
+  }
+
+  const canSelect = !!cancellable && !hasOpenCancellation;
+  const first = wagons[0];
+  const totalAllocated = wagons.reduce(
+    (s, w) => s + Number(w.allocatedWeightTons || 0),
+    0,
+  );
+  const totalCapacity = wagons.reduce((s, w) => s + Number(w.capacityTons || 0), 0);
+  const containerCount = wagons.reduce((s, w) => s + (w.containers?.length ?? 0), 0);
+  const utilization =
+    totalCapacity > 0 ? Math.round((totalAllocated / totalCapacity) * 100) : null;
+
+  return (
+    <div className="flex flex-col gap-6" style={{ maxWidth: 980 }}>
+      <SectionCard>
+        <Group justify="space-between" align="flex-start" mb="md" wrap="wrap">
+          <Group gap={10} align="center">
+            <Box
+              style={{
+                width: 36,
+                height: 36,
+                display: "flex",
+                alignItems: "center",
+                justifyContent: "center",
+                borderRadius: 10,
+                backgroundColor: "#E8F5EF",
+                color: "#0A6F4D",
+              }}
+            >
+              <TrainFront size={18} />
+            </Box>
+            <Box>
+              <Text fz={15} fw={800} c="#10202F">
+                {first.trainNumber ? `Train ${first.trainNumber}` : "Your train"}
+              </Text>
+              <Group gap={5} align="center">
+                <MapPin size={11} color="#9AA8B5" />
+                <Text fz={12} c="#9AA8B5">
+                  {first.originStation ?? "—"} → {first.destinationStation ?? "—"}
+                  {first.departureAt ? ` · departs ${fmtDate(first.departureAt)}` : ""}
+                </Text>
+              </Group>
+            </Box>
+          </Group>
+          <CardTitle>Your wagons on this train</CardTitle>
+        </Group>
+
+        <ConsistStrip wagons={wagons} />
+
+        <SimpleGrid cols={{ base: 2, sm: 4 }} spacing={10} mt="md">
+          <StatTile
+            icon={<TrainTrack size={13} />}
+            label="Wagons"
+            value={`${wagons.length}`}
+            sub="allocated to you"
+          />
+          <StatTile
+            icon={<Scale size={13} />}
+            label="Allocated weight"
+            value={fmtWeight(totalAllocated)}
+          />
+          <StatTile
+            icon={<Container size={13} />}
+            label="Containers"
+            value={containerCount ? `${containerCount}` : "—"}
+            sub={containerCount ? "loaded on wagons" : undefined}
+          />
+          <StatTile
+            icon={<Gauge size={13} />}
+            label="Utilization"
+            value={utilization != null ? `${utilization}%` : "—"}
+            sub="of wagon capacity"
+          />
+        </SimpleGrid>
+      </SectionCard>
+
+      {canSelect && (
+        <SectionCard>
+          <Group justify="space-between" align="center" wrap="wrap" gap="sm">
+            <Box>
+              <Text fz={14} fw={800} c="#10202F">
+                Cancel specific wagons
+              </Text>
+              <Text fz={12.5} c="#9AA8B5">
+                Tick the wagons you want to cancel. They leave this train
+                immediately; after you pay the per-wagon cancellation fee, the
+                freight you paid for them becomes a credit you can rebook on
+                another day.
+              </Text>
+            </Box>
+            <Button
+              color="orange"
+              disabled={selected.size === 0 || selected.size >= wagons.length}
+              onClick={openConfirm}
+            >
+              Cancel selected ({selected.size})
+            </Button>
+          </Group>
+          {selected.size >= wagons.length && selected.size > 0 && (
+            <Text fz={12} c="#B3362C" mt={6}>
+              You cannot cancel every wagon here — to cancel the whole booking,
+              use the booking cancellation instead.
+            </Text>
+          )}
+        </SectionCard>
+      )}
+      {cancellable && hasOpenCancellation && (
+        <Alert color="yellow" variant="light">
+          A wagon cancellation is already awaiting its fee — pay or withdraw it
+          in the wagon cancellation card before requesting another.
+        </Alert>
+      )}
+
+      <CancelledWagonsSection rows={ownCancellations} />
+
+      <SimpleGrid cols={{ base: 1, md: 2 }} spacing={24}>
+        {wagons.map((w) => (
+          <WagonCard
+            key={w.allocationId ?? w.sequenceNo}
+            wagon={w}
+            selectable={
+              canSelect &&
+              !!w.allocationId &&
+              (w.status === "PLANNED" || w.status === "RESERVED")
+            }
+            selected={!!w.allocationId && selected.has(w.allocationId)}
+            onToggle={() => w.allocationId && toggle(w.allocationId)}
+          />
+        ))}
+      </SimpleGrid>
+
+      <Modal
+        opened={confirmOpen}
+        onClose={() => setConfirmOpen(false)}
+        title="Cancel selected wagons"
+        centered
+      >
+        <Stack gap="sm">
+          <Text fz={13.5} c="#475569">
+            You are cancelling <b>{selected.size}</b> wagon(s). They stay
+            allocated to you until the cancellation fee is paid; after that the
+            paid freight for them becomes a credit you can rebook on another
+            day while your contract is valid.
+          </Text>
+          {previewMutation.isPending && <Skeleton height={64} radius={10} />}
+          {preview && (
+            <Box
+              p={12}
+              style={{
+                borderRadius: 10,
+                backgroundColor: "#FFFBEB",
+                border: "1px solid #FDE68A",
+              }}
+            >
+              <Group justify="space-between">
+                <Text fz={13} c="#92400E">
+                  Cancellation fee ({preview.wagons} × {Number(preview.feePerWagon).toLocaleString()})
+                </Text>
+                <Text fz={14} fw={800} c="#92400E">
+                  {Number(preview.feeAmount).toLocaleString()} {preview.feeCurrency}
+                </Text>
+              </Group>
+              <Group justify="space-between" mt={4}>
+                <Text fz={13} c="#0A6F4D">
+                  Rebooking credit kept
+                </Text>
+                <Text fz={14} fw={800} c="#0A6F4D">
+                  {Number(preview.creditAmount).toLocaleString()}
+                </Text>
+              </Group>
+            </Box>
+          )}
+          <Textarea
+            label="Reason (optional)"
+            placeholder="Why are you cancelling these wagons?"
+            value={reason}
+            onChange={(e) => setReason(e.currentTarget.value)}
+            autosize
+            minRows={2}
+          />
+          <Group justify="flex-end" gap="sm">
+            <Button variant="default" onClick={() => setConfirmOpen(false)}>
+              Keep wagons
+            </Button>
+            <Button
+              color="orange"
+              loading={requestMutation.isPending}
+              disabled={!preview}
+              onClick={() => requestMutation.mutate()}
+            >
+              Request cancellation
+            </Button>
+          </Group>
+        </Stack>
+      </Modal>
+    </div>
+  );
+}
diff --git a/apps/edr-freight-web/portal/src/pages/bookings/clearance/ClearanceFlow.tsx b/apps/edr-freight-web/portal/src/pages/bookings/clearance/ClearanceFlow.tsx
index a1d2cafd8..ee96799b3 100644
--- a/apps/edr-freight-web/portal/src/pages/bookings/clearance/ClearanceFlow.tsx
+++ b/apps/edr-freight-web/portal/src/pages/bookings/clearance/ClearanceFlow.tsx
@@ -85,7 +85,12 @@ export function ClearanceFlow({ booking, flow, footer }: ClearanceFlowProps) {
 
   return (
     <Stack gap={0}>
-      {isReady ? (
+      {status === "OPERATION_CHANGES_REQUESTED" ? (
+        <Alert color="yellow" radius="md" icon={<Clock size={18} />} mb="md">
+          Operations returned this order for changes. Review their note, pick a
+          new shipment day below and resubmit.
+        </Alert>
+      ) : isReady ? (
         <Alert color="teal" radius="md" icon={<CheckCircle2 size={18} />} mb="md">
           {needsCompletion
             ? "Clearance is finalized. Complete your booking now — enter the cargo details and pick a shipment day inside an open booking window."
diff --git a/apps/edr-freight-web/portal/src/pages/bookings/clearance/bookingNextAction.ts b/apps/edr-freight-web/portal/src/pages/bookings/clearance/bookingNextAction.ts
index d0256510a..297b0c152 100644
--- a/apps/edr-freight-web/portal/src/pages/bookings/clearance/bookingNextAction.ts
+++ b/apps/edr-freight-web/portal/src/pages/bookings/clearance/bookingNextAction.ts
@@ -89,6 +89,22 @@ function actionByStatus(booking: ActionBooking): BookingNextAction | null {
         label: "Schedule & proceed",
         title: "Schedule your shipment",
       };
+    case "OPERATION_CHANGES_REQUESTED":
+      // Contract bookings reopen the full completion form (cargo + shipment
+      // day, prefilled from the booking) — same page as the initial booking.
+      // Contract-less bookings keep the in-place day-picker modal.
+      return booking.contractId
+        ? {
+            kind: "BOOK",
+            label: "Change booking",
+            title: "Change your booking",
+            to: `/contracts/${booking.contractId}/bookings/${booking.id}/complete`,
+          }
+        : {
+            kind: "SCHEDULE_OPERATION",
+            label: "Choose day & resubmit",
+            title: "Resubmit your shipment",
+          };
     default:
       return null;
   }
diff --git a/apps/edr-freight-web/portal/src/pages/bookings/clearance/useClearanceFlow.ts b/apps/edr-freight-web/portal/src/pages/bookings/clearance/useClearanceFlow.ts
index 5d8143f79..c50a7c046 100644
--- a/apps/edr-freight-web/portal/src/pages/bookings/clearance/useClearanceFlow.ts
+++ b/apps/edr-freight-web/portal/src/pages/bookings/clearance/useClearanceFlow.ts
@@ -98,7 +98,10 @@ export function useClearanceFlow(booking: Freight.IBooking) {
     [clearance],
   );
 
-  const isReady = status === "CLEARANCE_READY";
+  // OPERATION_CHANGES_REQUESTED re-opens the same pick-a-day flow: the
+  // customer resubmits via the same clearance/proceed endpoint.
+  const isReady =
+    status === "CLEARANCE_READY" || status === "OPERATION_CHANGES_REQUESTED";
   // Bare initiated instance: created with no cargo and no price; completion
   // (cargo + shipment day + window check) happens on the full booking form.
   const isBareInstance =
diff --git a/apps/edr-freight-web/portal/src/pages/bookings/payments/useBookingPayment.ts b/apps/edr-freight-web/portal/src/pages/bookings/payments/useBookingPayment.ts
index eb6e170d1..eaaa77a9e 100644
--- a/apps/edr-freight-web/portal/src/pages/bookings/payments/useBookingPayment.ts
+++ b/apps/edr-freight-web/portal/src/pages/bookings/payments/useBookingPayment.ts
@@ -3,18 +3,22 @@ import { useState } from "react";
 
 import { useInvoicePayment } from "@/hooks/useInvoicePayment";
 import { type PaymentMethod } from "@/services/payments.service";
-import { invoicesService } from "@/services/invoices.service";
+import { invoicesService, type PortalInvoice } from "@/services/invoices.service";
 import { isPayable } from "@/pages/billing/invoice-ui";
 
+/** Fee invoice opened by a partial wagon cancellation (see WagonCancellationCard). */
+export const WAGON_CANCEL_FEE_INVOICE_TYPE = "WAGON_CANCEL_FEE";
+
 /**
- * Shared payment flow for a single booking: opens the method modal, fires
- * POST /billing/my-invoices/:id/pay for the booking's currently payable
- * invoice, and redirects the browser to the provider (or, for CAC Bank, an
- * OTP debit with no redirect, collects the SMS'd code in the modal). Reused by
- * the booking detail page, the booking list, and the home page so "Pay now"
- * behaves identically everywhere.
+ * Core of the booking payment flows: resolves the booking's invoices (shared
+ * query/key with BookingPaymentPanel, so they share that cache), picks the one
+ * matching `match`, and charges it through the ownership-checked portal route —
+ * redirect vs CAC Bank OTP handled by `useInvoicePayment`.
  */
-export function useBookingPayment(bookingId: string) {
+function useBookingInvoicePayment(
+  bookingId: string,
+  match: (invoice: PortalInvoice) => boolean,
+) {
   const [modalOpen, setModalOpen] = useState(false);
   const [noInvoice, setNoInvoice] = useState(false);
 
@@ -22,7 +26,7 @@ export function useBookingPayment(bookingId: string) {
     queryKey: ["booking-invoices", bookingId],
     queryFn: () => invoicesService.listForSource("booking", bookingId),
   });
-  const payableInvoiceId = invoices.find((inv) => isPayable(inv.status))?.id;
+  const payableInvoiceId = invoices.find(match)?.id;
 
   const flow = useInvoicePayment();
 
@@ -56,3 +60,28 @@ export function useBookingPayment(bookingId: string) {
     },
   };
 }
+
+/**
+ * Shared payment flow for a single booking: opens the method modal, fires
+ * POST /billing/my-invoices/:id/pay for the booking's currently payable
+ * invoice, and redirects the browser to the provider (or, for CAC Bank, an
+ * OTP debit with no redirect, collects the SMS'd code in the modal). Reused by
+ * the booking detail page, the booking list, and the home page so "Pay now"
+ * behaves identically everywhere.
+ */
+export function useBookingPayment(bookingId: string) {
+  return useBookingInvoicePayment(bookingId, (inv) => isPayable(inv.status));
+}
+
+/**
+ * Same flow, but targets the booking's payable wagon-cancellation FEE invoice
+ * (type WAGON_CANCEL_FEE) — the freight invoice is already paid on these
+ * bookings, so the generic "first payable" pick would work today, but pinning
+ * the type keeps the two buttons from ever racing over the same invoice.
+ */
+export function useFeeInvoicePayment(bookingId: string) {
+  return useBookingInvoicePayment(
+    bookingId,
+    (inv) => inv.type === WAGON_CANCEL_FEE_INVOICE_TYPE && isPayable(inv.status),
+  );
+}
diff --git a/apps/edr-freight-web/portal/src/pages/contracts/ContractBookingWindowsSection.tsx b/apps/edr-freight-web/portal/src/pages/contracts/ContractBookingWindowsSection.tsx
index a8d9d0830..c4fa72977 100644
--- a/apps/edr-freight-web/portal/src/pages/contracts/ContractBookingWindowsSection.tsx
+++ b/apps/edr-freight-web/portal/src/pages/contracts/ContractBookingWindowsSection.tsx
@@ -104,16 +104,29 @@ const COUNTDOWN_TEXT: Partial<
   PRE_WINDOW: { label: "Booking opens in", expiredText: "Booking opening now…" },
   OPEN: { label: "Window closes in", expiredText: "Document review starting…" },
   DOC_REVIEW: { label: "Document review ends in", expiredText: "Payment starting…" },
-  PAYMENT: { label: "Payment due in", expiredText: "Payment window closing…" },
+  PAYMENT: { label: "Payment due in", expiredText: "Finalizing payments…" },
 };
 
-function phaseCountdown(
-  w: MyBookingWindow,
-): { label: string; deadline: string; expiredText: string } | null {
+function phaseCountdown(w: MyBookingWindow): {
+  label: string;
+  deadline: string;
+  expiredText: string;
+  graceDeadline?: string | null;
+  graceLabel?: string;
+} | null {
   const state = bookingWindowUiState(w);
   const text = COUNTDOWN_TEXT[state.kind];
   if (!state.countdownTo || !text) return null;
-  return { ...text, deadline: state.countdownTo };
+  // Once the pay deadline lapses, pending payments still settle during the
+  // drain tail — count it down as "processing" instead of a stale "closing".
+  const grace =
+    state.kind === "PAYMENT" && w.paymentDrainEndsAt
+      ? {
+          graceDeadline: w.paymentDrainEndsAt,
+          graceLabel: "Payment processing — closes in",
+        }
+      : undefined;
+  return { ...text, deadline: state.countdownTo, ...grace };
 }
 
 /**
@@ -226,6 +239,8 @@ function WindowCard({ w }: { w: MyBookingWindow }) {
               deadline={cd.deadline}
               label={cd.label}
               expiredText={cd.expiredText}
+              graceDeadline={cd.graceDeadline}
+              graceLabel={cd.graceLabel}
               size="xs"
             />
           </Box>
diff --git a/apps/edr-freight-web/portal/src/pages/contracts/NewShipmentPage.tsx b/apps/edr-freight-web/portal/src/pages/contracts/NewShipmentPage.tsx
index 54f678049..63070003a 100644
--- a/apps/edr-freight-web/portal/src/pages/contracts/NewShipmentPage.tsx
+++ b/apps/edr-freight-web/portal/src/pages/contracts/NewShipmentPage.tsx
@@ -38,6 +38,7 @@ import {
   CheckCircle2,
   ChevronLeft,
   FileDown,
+  FileText,
   FileUp,
   Flame,
   MapPin,
@@ -59,6 +60,7 @@ import {
   contractsService,
   type ShipmentValidation,
 } from "@/services/contracts.service";
+import { downloadStoredFile } from "@/services/files.service";
 import {
   SelectField,
   StepCard,
@@ -245,6 +247,127 @@ function bulkUnitOfMeasure(
   return hasPerItem ? "PER_ITEM" : "PER_TON";
 }
 
+/**
+ * Prefill for a changes-requested resubmit: the booking's persisted cargo,
+ * currency and route become the form's starting values so the customer edits
+ * what exists instead of retyping it. The shipment day is deliberately left
+ * empty — a new day must be picked.
+ */
+function mapBookingToShipmentValues(
+  booking: Freight.IBooking,
+  contract: Freight.IContract,
+): Partial<ShipmentFormInputValues> {
+  const b = booking as unknown as {
+    cargoFreeText?: string | null;
+    contractRouteId?: string | null;
+    cargoTotalWeightVgm?: number | string | null;
+    bulkTotalWeightTons?: number | string | null;
+    bulkHazardousQuantity?: number | string | null;
+    bulkReeferQuantity?: number | string | null;
+    bookingContainers?: Array<{
+      quantity?: number;
+      hazardousQuantity?: number | string | null;
+      reeferQuantity?: number | string | null;
+      returnQuantity?: number | string | null;
+      containerType?: { sizeFt?: number | null } | null;
+      units?: Array<{
+        containerNumber?: string;
+        sealNumber?: string | null;
+        vgmTons?: number | string;
+        isHazardous?: boolean;
+        isReefer?: boolean;
+        isReturn?: boolean;
+      }>;
+    }>;
+  };
+  const values: Partial<ShipmentFormInputValues> = {
+    paymentCurrency: booking.paymentCurrency === "ETB" ? "ETB" : "USD",
+    withReturn: booking.equipmentReturn === "WITH_RETURN",
+    cargoDescription: b.cargoFreeText ?? "",
+    ...(b.contractRouteId ? { contractRouteId: b.contractRouteId } : {}),
+  };
+  if (contract.freightType === "CONTAINER") {
+    const rows = b.bookingContainers ?? [];
+    const lineFor = (size: "20ft" | "40ft") => {
+      const bc = rows.find(
+        (r) => (r.containerType?.sizeFt === 40 ? "40ft" : "20ft") === size,
+      );
+      return {
+        containerSize: size,
+        quantity: String(bc?.quantity ?? 0),
+        hazardousQuantity: String(Number(bc?.hazardousQuantity ?? 0)),
+        reeferQuantity: String(Number(bc?.reeferQuantity ?? 0)),
+        returnQuantity: String(Number(bc?.returnQuantity ?? 0)),
+        units: (bc?.units ?? []).map((u) => ({
+          containerNumber: u.containerNumber ?? "",
+          sealNumber: u.sealNumber ?? "",
+          vgmTons: String(Number(u.vgmTons ?? 0)),
+          isHazardous: Boolean(u.isHazardous),
+          isReefer: Boolean(u.isReefer),
+          isReturn: Boolean(u.isReturn),
+        })),
+      };
+    };
+    const sizes = (contract.cargoScope ?? [])
+      .map((s) => s.containerSize)
+      .filter((s): s is "20ft" | "40ft" => s === "20ft" || s === "40ft");
+    values.containers = (sizes.length ? sizes : (["20ft", "40ft"] as const)).map(lineFor);
+  } else {
+    const perItem = bulkUnitOfMeasure(contract) === "PER_ITEM";
+    const amount = Number(b.cargoTotalWeightVgm ?? 0);
+    if (perItem) {
+      values.itemCount = amount ? String(amount) : "";
+      values.cargoWeightTons =
+        b.bulkTotalWeightTons != null
+          ? String(Number(b.bulkTotalWeightTons))
+          : "";
+    } else {
+      values.cargoWeightTons = amount ? String(amount) : "";
+    }
+    values.bulkHazardousQuantity = String(Number(b.bulkHazardousQuantity ?? 0));
+    values.bulkReeferQuantity = String(Number(b.bulkReeferQuantity ?? 0));
+  }
+  return values;
+}
+
+/** Read-only list of the booking's already-uploaded documents (resubmit view). */
+function UploadedDocumentsCard({ booking }: { booking: Freight.IBooking }) {
+  const files =
+    (booking as unknown as { files?: Array<{ id: string; name: string }> })
+      .files ?? [];
+  if (!files.length) return null;
+  return (
+    <Paper withBorder radius="lg" p="lg">
+      <Group gap={8} mb={4}>
+        <FileText size={16} />
+        <Text fw={700} fz="sm">
+          Your uploaded documents
+        </Text>
+      </Group>
+      <Text fz={12.5} c="dimmed" mb="sm">
+        These stay attached to the booking — no need to upload them again.
+      </Text>
+      <Stack gap={6}>
+        {files.map((f) => (
+          <Group key={f.id} justify="space-between" wrap="nowrap">
+            <Text fz={13} truncate>
+              {f.name}
+            </Text>
+            <ActionIcon
+              variant="default"
+              radius="md"
+              onClick={() => void downloadStoredFile(f.id, f.name)}
+              aria-label={`Download ${f.name}`}
+            >
+              <FileDown size={15} />
+            </ActionIcon>
+          </Group>
+        ))}
+      </Stack>
+    </Paper>
+  );
+}
+
 function NewShipmentBookingForm({
   contract,
   contractId,
@@ -284,6 +407,10 @@ function NewShipmentBookingForm({
         unitOfMeasure: bulkUnitOfMeasure(contract),
         // Intercity rides a passing train staff pick later — no date to choose.
         requiresDate: contract.tradeDirection !== "DOMESTIC",
+        // Export completion locks onto a specific train — the pick is required
+        // (mirrors the ScheduleStep picker's visibility).
+        requiresTrain:
+          contract.tradeDirection === "EXPORT" && Boolean(completeBookingId),
       }),
     ),
     mode: "onChange",
@@ -302,6 +429,34 @@ function NewShipmentBookingForm({
       : 0;
   const hasOdd20ft = ft20Total % 2 === 1;
 
+  // COMPLETION mode: fetch the booking — a changes-requested resubmit prefills
+  // the form from it and shows the operations note + uploaded documents.
+  const { data: completeBooking } = useQuery(
+    api.bookings.get.queryOptions({
+      input: { id: completeBookingId! },
+      enabled: Boolean(completeBookingId),
+    }),
+  );
+  const isResubmit = Boolean(
+    completeBooking &&
+      ["OPERATION_CHANGES_REQUESTED", "EXPIRED"].includes(
+        completeBooking.status as string,
+      ) &&
+      (((completeBooking as unknown as { bookingContainers?: unknown[] })
+        .bookingContainers?.length ?? 0) > 0 ||
+        Number(completeBooking.cargoTotalWeightVgm ?? 0) > 0),
+  );
+  const prefilledRef = useRef(false);
+  useEffect(() => {
+    if (!isResubmit || prefilledRef.current || !completeBooking) return;
+    prefilledRef.current = true;
+    form.reset({
+      ...form.getValues(),
+      ...mapBookingToShipmentValues(completeBooking, contract),
+    });
+    // eslint-disable-next-line react-hooks/exhaustive-deps
+  }, [isResubmit]);
+
   const submitMutation = useMutation({
     mutationFn: (dto: Freight.CreateBookingUnderContractDto) =>
       completeBookingId
@@ -328,7 +483,12 @@ function NewShipmentBookingForm({
   // price modal opens so re-reviewing after an edit re-checks.
   const validateMutation = useMutation({
     mutationFn: (dto: Freight.CreateBookingUnderContractDto) =>
-      api.contracts.validateShipment.call({ id: contractId, dto }),
+      api.contracts.validateShipment.call({
+        id: contractId,
+        dto,
+        // Resubmit preview must not clash with this booking's own containers.
+        excludeBookingId: completeBookingId,
+      }),
   });
 
   function buildDto(
@@ -484,12 +644,16 @@ function NewShipmentBookingForm({
             style={{ letterSpacing: "-0.01em" }}
           >
             {completeBookingId
-              ? "Complete Your Booking"
+              ? isResubmit
+                ? "Change Your Booking"
+                : "Complete Your Booking"
               : "New Shipment Booking"}
           </Title>
           <Text size="sm" c="edr-muted" mt={4}>
             {completeBookingId
-              ? `Clearance is finalized — enter the cargo details and shipment day to complete your booking under contract ${contract.reference}.`
+              ? isResubmit
+                ? `Update the details below and pick a new shipment day, then resubmit your booking under contract ${contract.reference}.`
+                : `Clearance is finalized — enter the cargo details and shipment day to complete your booking under contract ${contract.reference}.`
               : `Book a shipment against contract ${contract.reference}.`}
           </Text>
         </Box>
@@ -531,6 +695,16 @@ function NewShipmentBookingForm({
 
           {/* Single-step form — all sections on one page. */}
           <Stack gap="lg" className="mx-auto max-w-4xl">
+            {isResubmit && completeBooking?.latestChangeRequestNote && (
+              <Alert
+                color="yellow"
+                icon={<AlertCircle size={16} />}
+                radius="md"
+                title="Operations requested changes"
+              >
+                <Text size="sm">{completeBooking.latestChangeRequestNote}</Text>
+              </Alert>
+            )}
             <RouteStep form={form} contract={contract} routes={routes} />
             <CargoStep form={form} contract={contract} />
             {/* Legacy contracts only — WITH_RETURN contracts capture per-line
@@ -543,6 +717,9 @@ function NewShipmentBookingForm({
               routes={routes}
               completeBookingId={completeBookingId ?? null}
             />
+            {isResubmit && completeBooking && (
+              <UploadedDocumentsCard booking={completeBooking} />
+            )}
             {/* Notes are captured when the booking is initiated — completing
                 a bare booking does not re-ask for them. */}
             {!completeBookingId && <NotesSection form={form} />}
@@ -590,7 +767,7 @@ function NewShipmentBookingForm({
                     onClick={handleReview}
                     disabled={hasOdd20ft}
                   >
-                    Review price &amp; book
+                    {isResubmit ? "Change booking" : "Review price & book"}
                   </Button>
                 </Box>
               </Tooltip>
@@ -1179,12 +1356,23 @@ function ScheduleStep({
               </Text>
             )}
             {isExportPick && scheduledDate ? (
-              <ExportTrainPicker
-                options={exportTrainsQuery.data ?? []}
-                loading={exportTrainsQuery.isLoading}
-                value={selectedTrainId ?? ""}
-                onChange={(id) => form.setValue("trainScheduleId", id)}
-              />
+              <>
+                <ExportTrainPicker
+                  options={exportTrainsQuery.data ?? []}
+                  loading={exportTrainsQuery.isLoading}
+                  value={selectedTrainId ?? ""}
+                  onChange={(id) =>
+                    form.setValue("trainScheduleId", id, {
+                      shouldValidate: true,
+                    })
+                  }
+                />
+                {form.formState.errors.trainScheduleId?.message && (
+                  <Text fz="xs" c="red" mt={6}>
+                    {String(form.formState.errors.trainScheduleId.message)}
+                  </Text>
+                )}
+              </>
             ) : null}
           </Box>
         )}
diff --git a/apps/edr-freight-web/portal/src/pages/contracts/new-shipment-form/schema.ts b/apps/edr-freight-web/portal/src/pages/contracts/new-shipment-form/schema.ts
index 825112980..a156a2174 100644
--- a/apps/edr-freight-web/portal/src/pages/contracts/new-shipment-form/schema.ts
+++ b/apps/edr-freight-web/portal/src/pages/contracts/new-shipment-form/schema.ts
@@ -30,6 +30,11 @@ export interface ShipmentValidationContext {
    * staff pick later, so no shipment day is chosen. Defaults to true.
    */
   requiresDate?: boolean;
+  /**
+   * EXPORT rail completion: the shipment must ride a specific train the
+   * customer picks for the chosen day. Defaults to false.
+   */
+  requiresTrain?: boolean;
 }
 
 // ISO 6346: 3-letter owner code + category id (U/J/Z) + 6-digit serial + check digit.
@@ -102,6 +107,20 @@ export function createShipmentFormSchema(ctx: ShipmentValidationContext) {
       });
     }
 
+    // Train is only pickable once a day is chosen — the day error covers the
+    // no-date case, so don't stack a second error on an invisible field.
+    if (
+      ctx.requiresTrain &&
+      data.scheduledDate.trim() &&
+      !data.trainScheduleId.trim()
+    ) {
+      refineCtx.addIssue({
+        code: "custom",
+        path: ["trainScheduleId"],
+        message: "Select a train for your shipment day.",
+      });
+    }
+
     // No default currency — the customer must pick one before submitting.
     if (!data.paymentCurrency) {
       refineCtx.addIssue({
diff --git a/apps/edr-freight-web/portal/src/pages/contracts/new-shipment-form/train-required.test.ts b/apps/edr-freight-web/portal/src/pages/contracts/new-shipment-form/train-required.test.ts
new file mode 100644
index 000000000..edf4ec284
--- /dev/null
+++ b/apps/edr-freight-web/portal/src/pages/contracts/new-shipment-form/train-required.test.ts
@@ -0,0 +1,52 @@
+import { describe, expect, it } from "vitest";
+
+import { createShipmentFormSchema, initialShipmentFormValues } from "./schema";
+
+const schema = createShipmentFormSchema({
+  isContainer: false,
+  isHazardous: false,
+  isReefer: false,
+  requiresTrain: true,
+});
+
+const values = (over: Record<string, unknown> = {}) => ({
+  ...initialShipmentFormValues,
+  cargoWeightTons: "10",
+  paymentCurrency: "USD",
+  scheduledDate: "2026-08-10",
+  ...over,
+});
+
+const trainIssue = (input: Record<string, unknown>) => {
+  const result = schema.safeParse(input);
+  return result.success
+    ? undefined
+    : result.error.issues.find((i) => i.path[0] === "trainScheduleId");
+};
+
+describe("requiresTrain", () => {
+  it("rejects a dated export completion without a train pick", () => {
+    expect(trainIssue(values())?.message).toMatch(/select a train/i);
+  });
+
+  it("passes once a train is picked", () => {
+    expect(trainIssue(values({ trainScheduleId: "sched-1" }))).toBeUndefined();
+  });
+
+  it("stays silent while no date is chosen (day error covers it)", () => {
+    expect(trainIssue(values({ scheduledDate: "" }))).toBeUndefined();
+  });
+
+  it("is off by default (non-completion flows)", () => {
+    const plain = createShipmentFormSchema({
+      isContainer: false,
+      isHazardous: false,
+      isReefer: false,
+    });
+    const result = plain.safeParse(values());
+    expect(
+      result.success ||
+        result.error.issues.every((i) => i.path[0] !== "trainScheduleId"),
+    ).toBe(true);
+  });
+});
diff --git a/apps/edr-freight-web/portal/src/pages/settings/TabCompanyProfile.tsx b/apps/edr-freight-web/portal/src/pages/settings/TabCompanyProfile.tsx
index e42283674..2ff16f445 100644
--- a/apps/edr-freight-web/portal/src/pages/settings/TabCompanyProfile.tsx
+++ b/apps/edr-freight-web/portal/src/pages/settings/TabCompanyProfile.tsx
@@ -1,4 +1,4 @@
-import { isValidPhone, toEthiopianE164 } from "@/components/PhoneField";
+import { ControlledPhoneField, isValidPhone } from "@/components/PhoneField";
 import { api } from "@/services/api";
 import type {
     CompanyProfileInput,
@@ -30,6 +30,12 @@ import FaydaVerifyPanel from "@/components/FaydaVerifyPanel";
 import ETradeInfo, { type ETradeStatus } from "@/components/onboarding/ETradeInfo";
 import { ReadOnlyField } from "@/pages/accounts/companyProfileForm/ReadOnlyField";
 import StepSection from "@/pages/accounts/companyProfileForm/StepSection";
+import { ETRADE_BUNDLE_FIELDS as SHARED_ETRADE_FIELDS } from "@/pages/accounts/companyProfileForm/schema";
+import {
+  firstValidEmail,
+  firstValidPhone,
+  normalizeIdentityPhones,
+} from "@/pages/accounts/companyProfileForm/helpers";
 
 export const COMPANY_PROFILE_SCHEMA = z.object({
   companyName: z.string().min(1, "Company name is required"),
@@ -43,12 +49,12 @@ export const COMPANY_PROFILE_SCHEMA = z.object({
   // no standalone input.
   companyAddress: z.string().optional(),
   tinNumber: z.string().regex(/^\d{10}$/, "TIN must be exactly 10 digits"),
+  // Same rule as onboarding — the two forms write the same column, so they must
+  // not disagree about what is acceptable in it.
   vatNumber: z
     .string()
-    .trim()
-    .max(20, "VAT number is too long")
-    .optional()
-    .or(z.literal("")),
+    .min(1, "VAT number is required")
+    .regex(/^\d{10}$/, "VAT number must be exactly 10 digits"),
   ownerPassportNumber: z.string().optional(),
   // Registration/address fields are eTrade-sourced — locked once eTrade
   // supplies a value, editable only as an escape hatch when it doesn't
@@ -72,21 +78,13 @@ export const COMPANY_PROFILE_SCHEMA = z.object({
 
 export type CompanyProfileFormData = z.infer<typeof COMPANY_PROFILE_SCHEMA>;
 
-/** UpdateProfilePayload keys eTrade owns — only resent when the customer re-verified them this session. */
-const ETRADE_BUNDLE_FIELDS = [
-  "companyName",
-  "licenceNumber",
-  "statusDescription",
-  "dateRegistered",
-  "renewedFrom",
-  "renewalDate",
-  "renewedTo",
-  "region",
-  "zone",
-  "woreda",
-  "kebele",
-  "houseNo",
-] as const satisfies readonly (keyof CompanyProfileFormData)[];
+/**
+ * `etradePhone` is not on this form, so the shared list is filtered down to the
+ * keys it actually holds. Source of truth: `companyProfileForm/schema.ts`.
+ */
+const ETRADE_FIELDS = SHARED_ETRADE_FIELDS.filter(
+  (k): k is Exclude<typeof k, "etradePhone"> => k !== "etradePhone",
+);
 
 interface TabCompanyProfileProps {
   profile?: ProfileResponse;
@@ -166,32 +164,39 @@ export default function TabCompanyProfile({
     values: defaultValues,
   });
 
-  const identity = profile?.identity;
+  // Fayda stores the phone as the national registry holds it (often a local
+  // number), which neither this form's E.164 validation nor the API's
+  // `@IsValidPhone()` accepts. Normalize on read — same as the wizard.
+  const identity = useMemo(
+    () => normalizeIdentityPhones(profile?.identity),
+    [profile?.identity],
+  );
   const verifiedIdentity = identity?.faydaRequired === true;
 
   // companyEmail/companyPhone are the owner's verified contact details, never
   // typed — same derivation as the onboarding wizard, just fed from the saved
-  // profile instead of an in-progress form.
-  useEffect(() => {
-    if (!user) return;
-    setValue("companyEmail", identity?.owner.email ?? user.email ?? "", {
-      shouldValidate: true,
-    });
-    // eslint-disable-next-line react-hooks/exhaustive-deps
-  }, [identity?.owner.email, user?.email]);
+  // profile instead of an in-progress form. `firstValid*` rather than `??`:
+  // these claims are optional AND unreliable — eTrade's registered phone is
+  // free text that arrives as things like "09        " — and `??` stops at the
+  // first non-null, so junk became a read-only field the customer could not
+  // fix and a 400 on save. When nothing usable can be derived the fields below
+  // become editable instead of blocking.
+  const derivedEmail = firstValidEmail(identity?.owner.email, user?.email);
+  const derivedPhone = firstValidPhone(
+    identity?.owner.phone,
+    profile?.etradePhone,
+    user?.phoneNumber,
+  );
 
   useEffect(() => {
-    if (!user) return;
-    setValue(
-      "companyPhone",
-      identity?.owner.phone ??
-        profile?.etradePhone ??
-        toEthiopianE164(user.phoneNumber) ??
-        "",
-      { shouldValidate: true },
-    );
+    if (derivedEmail) setValue("companyEmail", derivedEmail);
     // eslint-disable-next-line react-hooks/exhaustive-deps
-  }, [identity?.owner.phone, profile?.etradePhone, user?.phoneNumber]);
+  }, [derivedEmail]);
+
+  useEffect(() => {
+    if (derivedPhone) setValue("companyPhone", derivedPhone);
+    // eslint-disable-next-line react-hooks/exhaustive-deps
+  }, [derivedPhone]);
 
   // companyAddress is composed from the (locked) eTrade address parts, not
   // typed directly.
@@ -249,7 +254,7 @@ export default function TabCompanyProfile({
       // on every save would otherwise trigger the server's eTrade
       // authenticity re-check for no reason.
       const etradeBundle: Record<string, string | undefined> = {};
-      for (const key of ETRADE_BUNDLE_FIELDS) {
+      for (const key of ETRADE_FIELDS) {
         if (dirtyFields[key]) etradeBundle[key] = data[key];
       }
       if (dirtyFields.tinNumber) etradeBundle.tin = data.tinNumber;
@@ -296,13 +301,32 @@ export default function TabCompanyProfile({
   });
 
   const onSubmit = (data: CompanyProfileFormData) => {
+    setValidationError(null);
     if (isCreate && selectedRoles.length === 0) return;
     mutation.mutate(data);
   };
 
-  const saveErrorMessage = mutation.isError
-    ? extractApiError(mutation.error).message
-    : null;
+  /**
+   * Without this, a failed validation made "Save Changes" a no-op: the fields
+   * the schema requires are largely eTrade-sourced and rendered read-only, so
+   * their error messages had nowhere to appear and the button simply did
+   * nothing. Name them instead.
+   */
+  const [validationError, setValidationError] = useState<string | null>(null);
+  const onInvalid = (formErrors: typeof errors) => {
+    const messages = Object.values(formErrors)
+      .map((e) => e?.message)
+      .filter((m): m is string => Boolean(m));
+    setValidationError(
+      messages.length > 0
+        ? `Please fix: ${[...new Set(messages)].join(", ")}.`
+        : "Some details are incomplete. Please review the fields above.",
+    );
+  };
+
+  const saveErrorMessage =
+    validationError ??
+    (mutation.isError ? extractApiError(mutation.error).message : null);
 
   const pendingOwnerReview = Boolean(
     (profile?.pendingChanges as { faydaIdentity?: Record<string, unknown> } | null)
@@ -333,7 +357,7 @@ export default function TabCompanyProfile({
           : "Your registration and identity come from eTrade and Fayda — re-verify to refresh them."}
       </Text>
 
-      <form onSubmit={handleSubmit(onSubmit)}>
+      <form onSubmit={handleSubmit(onSubmit, onInvalid)}>
         <Stack gap="xl">
           <StepSection
             index={1}
@@ -341,9 +365,9 @@ export default function TabCompanyProfile({
             status={watch("vatNumber") ? "done" : "todo"}
           >
             <TextInput
-              label="VAT Number (optional)"
+              label="VAT Number"
               placeholder="e.g. 0012345678"
-              maxLength={20}
+              maxLength={10}
               error={errors.vatNumber?.message}
               {...register("vatNumber")}
             />
@@ -389,9 +413,33 @@ export default function TabCompanyProfile({
                   {...register("ownerPassportNumber")}
                 />
               )}
+              {/* Read-only while the verified owner (or eTrade, or the account)
+                  supplies them. Fayda's email/phone claims are optional, so
+                  when nothing can be derived these become typeable — the API
+                  requires both, and showing an empty read-only field is a save
+                  that can never succeed. */}
               <SimpleGrid cols={2} spacing="md">
-                <ReadOnlyField label="Company email" value={watch("companyEmail")} />
-                <ReadOnlyField label="Company phone" value={watch("companyPhone")} />
+                {derivedEmail ? (
+                  <ReadOnlyField label="Company email" value={derivedEmail} />
+                ) : (
+                  <TextInput
+                    label="Company Email"
+                    type="email"
+                    description="We couldn't find one on your verified identity or account — please enter it."
+                    error={errors.companyEmail?.message}
+                    {...register("companyEmail")}
+                  />
+                )}
+                {derivedPhone ? (
+                  <ReadOnlyField label="Company phone" value={derivedPhone} />
+                ) : (
+                  <ControlledPhoneField
+                    control={control}
+                    name="companyPhone"
+                    label="Company Phone"
+                    required
+                  />
+                )}
               </SimpleGrid>
             </StepSection>
           )}
@@ -410,6 +458,7 @@ export default function TabCompanyProfile({
               error={errors.tinNumber?.message}
               onDataLoaded={handleETradeDataLoaded}
               onStatusChange={setTinStatus}
+              alreadyVerified={hasRegistrationDetails}
             />
             {tinVerified && (
               <EtradeLockedCard
@@ -520,7 +569,9 @@ function EtradeLockedCard({
         <ReadOnlyField label="Renewal Date" value={watch("renewalDate")} />
         <ReadOnlyField label="Renewed From" value={watch("renewedFrom")} />
         <ReadOnlyField label="Renewed To" value={watch("renewedTo")} />
-        {region?.trim() ? (
+        {/* Membership of the catalog, not mere presence — a stored spelling
+            outside the list is otherwise uncorrectable. */}
+        {(ETHIOPIAN_REGIONS as readonly string[]).includes(region ?? "") ? (
           <ReadOnlyField label="Region" value={region} />
         ) : (
           <RegionSelect control={control} error={errors.region?.message} />
@@ -548,7 +599,9 @@ function LockedField({
   errors: ReturnType<typeof useForm<CompanyProfileFormData>>["formState"]["errors"];
 }) {
   const value = watch(name) as string | undefined;
-  if (value?.trim()) {
+  // A value that fails validation unlocks too — rendering a rejected value
+  // read-only is a save that can never succeed and never says why.
+  if (value?.trim() && !errors[name]) {
     return <ReadOnlyField label={label} value={value} />;
   }
   return (
diff --git a/apps/edr-freight-web/portal/src/pages/support/DocShell.tsx b/apps/edr-freight-web/portal/src/pages/support/DocShell.tsx
new file mode 100644
index 000000000..080189b3b
--- /dev/null
+++ b/apps/edr-freight-web/portal/src/pages/support/DocShell.tsx
@@ -0,0 +1,122 @@
+import { ArrowLeft, Train } from "lucide-react";
+import type { ReactNode } from "react";
+import { Link } from "react-router-dom";
+
+import type { Section } from "./content";
+
+/** Public pages reachable from every doc page's header and footer. */
+const DOC_LINKS = [
+  { to: "/help", label: "Help & Support" },
+  { to: "/faq", label: "FAQ" },
+  { to: "/privacy", label: "Privacy Policy" },
+  { to: "/terms", label: "Terms of Service" },
+];
+
+interface DocShellProps {
+  title: string;
+  subtitle: string;
+  /** Rendered under the title, e.g. "Last updated 6 August 2026". */
+  meta?: string;
+  /** Path of the current page, so it is not linked to itself. */
+  current: string;
+  children: ReactNode;
+}
+
+/**
+ * Chrome shared by the help, FAQ and legal pages. These routes are public —
+ * the auth screens link to them before a session exists — so the shell carries
+ * its own header instead of relying on the authenticated app layout.
+ */
+export function DocShell({
+  title,
+  subtitle,
+  meta,
+  current,
+  children,
+}: DocShellProps) {
+  return (
+    <div className="min-h-screen bg-background text-foreground">
+      <header className="sticky top-0 z-50 border-b border-border bg-background/80 backdrop-blur-xl">
+        <div className="mx-auto flex max-w-4xl items-center justify-between gap-4 px-6 py-4">
+          <Link to="/" className="flex items-center gap-3">
+            <div className="flex size-10 items-center justify-center rounded-2xl bg-primary text-primary-foreground">
+              <Train className="size-5" />
+            </div>
+            <span className="font-bold">EDR Freight</span>
+          </Link>
+
+          <Link
+            to="/portal"
+            className="inline-flex items-center gap-2 rounded-2xl border border-border px-4 py-2 text-sm font-semibold transition hover:bg-accent"
+          >
+            <ArrowLeft className="size-4" />
+            Back to portal
+          </Link>
+        </div>
+      </header>
+
+      <main className="mx-auto max-w-4xl px-6 py-12">
+        <h1 className="text-4xl font-black tracking-tight">{title}</h1>
+        <p className="mt-4 text-lg leading-8 text-muted-foreground">
+          {subtitle}
+        </p>
+        {meta && (
+          <p className="mt-2 text-sm text-muted-foreground">{meta}</p>
+        )}
+
+        <div className="mt-10">{children}</div>
+      </main>
+
+      <footer className="border-t border-border py-8">
+        <div className="mx-auto flex max-w-4xl flex-col items-center justify-between gap-4 px-6 text-sm text-muted-foreground md:flex-row">
+          <span>© 2026 EDR Freight. All rights reserved.</span>
+          <nav className="flex flex-wrap items-center justify-center gap-x-6 gap-y-2">
+            {DOC_LINKS.filter((l) => l.to !== current).map((link) => (
+              <Link
+                key={link.to}
+                to={link.to}
+                className="font-semibold text-foreground transition-colors hover:text-primary"
+              >
+                {link.label}
+              </Link>
+            ))}
+          </nav>
+        </div>
+      </footer>
+    </div>
+  );
+}
+
+/** Renders a legal document's numbered sections. */
+export function DocSections({ sections }: { sections: Section[] }) {
+  return (
+    <div className="space-y-10">
+      {sections.map((section) => (
+        <section key={section.heading}>
+          <h2 className="text-xl font-bold tracking-tight">
+            {section.heading}
+          </h2>
+
+          {section.body?.map((paragraph) => (
+            <p
+              key={paragraph}
+              className="mt-4 leading-7 text-muted-foreground"
+            >
+              {paragraph}
+            </p>
+          ))}
+
+          {section.bullets && (
+            <ul className="mt-4 list-disc space-y-2 pl-5 leading-7 text-muted-foreground">
+              {section.bullets.map((bullet) => (
+                <li key={bullet}>{bullet}</li>
+              ))}
+            </ul>
+          )}
+        </section>
+      ))}
+    </div>
+  );
+}
+
+export default DocShell;
diff --git a/apps/edr-freight-web/portal/src/pages/support/FaqPage.tsx b/apps/edr-freight-web/portal/src/pages/support/FaqPage.tsx
new file mode 100644
index 000000000..9704c8cf8
--- /dev/null
+++ b/apps/edr-freight-web/portal/src/pages/support/FaqPage.tsx
@@ -0,0 +1,59 @@
+import { ChevronDown } from "lucide-react";
+import { Link } from "react-router-dom";
+
+import { DocShell } from "./DocShell";
+import { FAQ_GROUPS, SUPPORT_CONTACT } from "./content";
+
+export default function FaqPage() {
+  return (
+    <DocShell
+      current="/faq"
+      title="Frequently Asked Questions"
+      subtitle="Answers to the questions customers ask most about registering, booking cargo and settling invoices on EDR Freight."
+    >
+      <div className="space-y-10">
+        {FAQ_GROUPS.map((group) => (
+          <section key={group.title}>
+            <h2 className="text-xl font-bold tracking-tight">{group.title}</h2>
+
+            <div className="mt-4 space-y-3">
+              {group.items.map((item) => (
+                // Native disclosure: keyboard- and screen-reader-accessible
+                // without any state of our own.
+                <details
+                  key={item.question}
+                  className="group rounded-2xl border border-border bg-card px-5 py-4 transition hover:border-primary/40"
+                >
+                  <summary className="flex cursor-pointer list-none items-center justify-between gap-4 font-semibold">
+                    {item.question}
+                    <ChevronDown className="size-5 shrink-0 text-muted-foreground transition-transform group-open:rotate-180" />
+                  </summary>
+
+                  <p className="mt-3 leading-7 text-muted-foreground">
+                    {item.answer}
+                  </p>
+                </details>
+              ))}
+            </div>
+          </section>
+        ))}
+      </div>
+
+      <div className="mt-12 rounded-[32px] border border-border bg-card p-8">
+        <h2 className="text-xl font-bold tracking-tight">
+          Still need a hand?
+        </h2>
+        <p className="mt-2 leading-7 text-muted-foreground">
+          Our team is on {SUPPORT_CONTACT.email} and {SUPPORT_CONTACT.phone}, or
+          you can start a chat from the support button inside the portal.
+        </p>
+        <Link
+          to="/help"
+          className="mt-6 inline-flex rounded-2xl bg-primary px-6 py-3 font-semibold text-primary-foreground transition hover:opacity-90"
+        >
+          Go to Help &amp; Support
+        </Link>
+      </div>
+    </DocShell>
+  );
+}
diff --git a/apps/edr-freight-web/portal/src/pages/support/HelpPage.tsx b/apps/edr-freight-web/portal/src/pages/support/HelpPage.tsx
new file mode 100644
index 000000000..b310dfa2c
--- /dev/null
+++ b/apps/edr-freight-web/portal/src/pages/support/HelpPage.tsx
@@ -0,0 +1,208 @@
+import {
+  Clock3,
+  FileText,
+  HelpCircle,
+  Mail,
+  MapPin,
+  MessageSquare,
+  Package,
+  Phone,
+  Receipt,
+  ShieldCheck,
+} from "lucide-react";
+import { Link } from "react-router-dom";
+
+import { DocShell } from "./DocShell";
+import { SUPPORT_CONTACT } from "./content";
+
+const channels = [
+  {
+    icon: Mail,
+    title: "Email",
+    value: SUPPORT_CONTACT.email,
+    href: `mailto:${SUPPORT_CONTACT.email}`,
+    note: "Best for document issues and anything needing an attachment.",
+  },
+  {
+    icon: Phone,
+    title: "Phone",
+    value: SUPPORT_CONTACT.phone,
+    href: `tel:${SUPPORT_CONTACT.phone.replace(/\s/g, "")}`,
+    note: "Best for urgent problems with cargo already in transit.",
+  },
+  {
+    icon: MapPin,
+    title: "Head office",
+    value: SUPPORT_CONTACT.office,
+    note: "Walk-in support during working hours.",
+  },
+  {
+    icon: Clock3,
+    title: "Support hours",
+    value: SUPPORT_CONTACT.hours,
+    note: "Outside these hours, email us and we reply the next working day.",
+  },
+];
+
+const topics = [
+  {
+    icon: ShieldCheck,
+    title: "Account & onboarding",
+    body: "Registering your company, uploading your trade licence and TIN, and getting an operational profile approved.",
+  },
+  {
+    icon: FileText,
+    title: "Contracts",
+    body: "Requesting a freight contract, reviewing its terms and signing it with your saved signature and stamp.",
+  },
+  {
+    icon: Package,
+    title: "Bookings & tracking",
+    body: "Raising a booking against a contract, adding last-mile transport and following the consignment along the corridor.",
+  },
+  {
+    icon: Receipt,
+    title: "Invoices & payments",
+    body: "Finding invoices, paying through the bank channels and confirming a payment that has not yet settled.",
+  },
+];
+
+export default function HelpPage() {
+  return (
+    <DocShell
+      current="/help"
+      title="Help & Support"
+      subtitle="Get answers fast — watch the walkthrough, browse the common topics, check the FAQ, or reach our team directly."
+    >
+      <section className="mb-12">
+        <h2 className="text-xl font-bold tracking-tight">
+          Portal walkthrough
+        </h2>
+        <p className="mt-2 leading-7 text-muted-foreground">
+          A guided tour of the portal — registering your company, raising a
+          booking against a contract, and settling an invoice.
+        </p>
+
+        {/* preload="metadata" so the 28 MB file is not pulled on every visit;
+            the browser fetches it only once playback starts. */}
+        <video
+          controls
+          preload="metadata"
+          className="mt-6 w-full rounded-[32px] border border-border bg-black"
+        >
+          <source src="/assets/edr-portal-guide.webm" type="video/webm" />
+          Your browser cannot play this video. Download it at{" "}
+          <a href="/assets/edr-portal-guide.webm">
+            /assets/edr-portal-guide.webm
+          </a>
+          .
+        </video>
+      </section>
+
+      {/* Live chat is the fastest route, so lead with it. */}
+      <div className="rounded-[32px] border border-border bg-card p-8">
+        <div className="flex items-start gap-4">
+          <div className="rounded-2xl bg-accent p-3 text-primary">
+            <MessageSquare className="size-5" />
+          </div>
+
+          <div>
+            <h2 className="text-xl font-bold tracking-tight">
+              Chat with our team
+            </h2>
+            <p className="mt-2 leading-7 text-muted-foreground">
+              Signed-in customers can open a support conversation from the
+              headset button at the bottom right of every portal page. You can
+              send screenshots and documents in the chat, and replies appear
+              there and as a notification.
+            </p>
+            <Link
+              to="/portal"
+              className="mt-6 inline-flex rounded-2xl bg-primary px-6 py-3 font-semibold text-primary-foreground transition hover:opacity-90"
+            >
+              Open the portal
+            </Link>
+          </div>
+        </div>
+      </div>
+
+      <section className="mt-12">
+        <h2 className="text-xl font-bold tracking-tight">Contact us</h2>
+
+        <div className="mt-4 grid gap-4 sm:grid-cols-2">
+          {channels.map((channel) => (
+            <div
+              key={channel.title}
+              className="flex items-start gap-4 rounded-2xl border border-border bg-background p-5"
+            >
+              <div className="rounded-2xl bg-accent p-3 text-primary">
+                <channel.icon className="size-5" />
+              </div>
+
+              <div>
+                <p className="font-semibold">{channel.title}</p>
+                {channel.href ? (
+                  <a
+                    href={channel.href}
+                    className="text-muted-foreground transition-colors hover:text-primary"
+                  >
+                    {channel.value}
+                  </a>
+                ) : (
+                  <p className="text-muted-foreground">{channel.value}</p>
+                )}
+                <p className="mt-1 text-sm text-muted-foreground">
+                  {channel.note}
+                </p>
+              </div>
+            </div>
+          ))}
+        </div>
+      </section>
+
+      <section className="mt-12">
+        <h2 className="text-xl font-bold tracking-tight">Common topics</h2>
+
+        <div className="mt-4 grid gap-4 sm:grid-cols-2">
+          {topics.map((topic) => (
+            <Link
+              key={topic.title}
+              to="/faq"
+              className="rounded-2xl border border-border bg-background p-5 transition hover:border-primary/40"
+            >
+              <div className="inline-flex rounded-2xl bg-accent p-3 text-primary">
+                <topic.icon className="size-5" />
+              </div>
+              <p className="mt-4 font-semibold">{topic.title}</p>
+              <p className="mt-1 leading-7 text-muted-foreground">
+                {topic.body}
+              </p>
+            </Link>
+          ))}
+        </div>
+      </section>
+
+      <section className="mt-12 rounded-[32px] border border-border bg-card p-8">
+        <div className="flex items-start gap-4">
+          <div className="rounded-2xl bg-accent p-3 text-primary">
+            <HelpCircle className="size-5" />
+          </div>
+
+          <div>
+            <h2 className="text-xl font-bold tracking-tight">
+              What to include when you contact us
+            </h2>
+            <ul className="mt-3 list-disc space-y-2 pl-5 leading-7 text-muted-foreground">
+              <li>Your company name and the email you sign in with.</li>
+              <li>
+                The reference of the contract, booking or invoice involved.
+              </li>
+              <li>What you expected to happen and what happened instead.</li>
+              <li>A screenshot of any error message the portal showed.</li>
+            </ul>
+          </div>
+        </div>
+      </section>
+    </DocShell>
+  );
+}
diff --git a/apps/edr-freight-web/portal/src/pages/support/PrivacyPolicyPage.tsx b/apps/edr-freight-web/portal/src/pages/support/PrivacyPolicyPage.tsx
new file mode 100644
index 000000000..76c2441ae
--- /dev/null
+++ b/apps/edr-freight-web/portal/src/pages/support/PrivacyPolicyPage.tsx
@@ -0,0 +1,15 @@
+import { DocSections, DocShell } from "./DocShell";
+import { LEGAL_LAST_UPDATED, PRIVACY_SECTIONS } from "./content";
+
+export default function PrivacyPolicyPage() {
+  return (
+    <DocShell
+      current="/privacy"
+      title="Privacy Policy"
+      subtitle="How EDR Freight collects, uses, shares and protects the information you provide when you use the platform."
+      meta={`Last updated ${LEGAL_LAST_UPDATED}`}
+    >
+      <DocSections sections={PRIVACY_SECTIONS} />
+    </DocShell>
+  );
+}
diff --git a/apps/edr-freight-web/portal/src/pages/support/TermsPage.tsx b/apps/edr-freight-web/portal/src/pages/support/TermsPage.tsx
new file mode 100644
index 000000000..b095acae0
--- /dev/null
+++ b/apps/edr-freight-web/portal/src/pages/support/TermsPage.tsx
@@ -0,0 +1,15 @@
+import { DocSections, DocShell } from "./DocShell";
+import { LEGAL_LAST_UPDATED, TERMS_SECTIONS } from "./content";
+
+export default function TermsPage() {
+  return (
+    <DocShell
+      current="/terms"
+      title="Terms of Service"
+      subtitle="The terms on which EDR provides the EDR Freight platform and the freight services you request through it."
+      meta={`Last updated ${LEGAL_LAST_UPDATED}`}
+    >
+      <DocSections sections={TERMS_SECTIONS} />
+    </DocShell>
+  );
+}
diff --git a/apps/edr-freight-web/portal/src/pages/support/content.ts b/apps/edr-freight-web/portal/src/pages/support/content.ts
new file mode 100644
index 000000000..d7b8e2d2c
--- /dev/null
+++ b/apps/edr-freight-web/portal/src/pages/support/content.ts
@@ -0,0 +1,358 @@
+/**
+ * Copy for the public help/FAQ/legal pages. Kept as data so the pages stay
+ * thin — the shell in `DocShell.tsx` renders any `Section[]` the same way.
+ *
+ * The privacy and terms text is the platform's working draft; legal counsel
+ * signs off on the final wording, and `LEGAL_LAST_UPDATED` is bumped with it.
+ */
+
+export const SUPPORT_CONTACT = {
+  email: "support@edrfreight.com",
+  phone: "+251 11 000 0000",
+  office: "Addis Ababa, Ethiopia",
+  hours: "Monday – Saturday, 8:30 AM – 5:30 PM (EAT)",
+};
+
+export const LEGAL_LAST_UPDATED = "6 August 2026";
+
+export interface Section {
+  heading: string;
+  /** Paragraphs, rendered in order. */
+  body?: string[];
+  /** Optional bullet list, rendered after the paragraphs. */
+  bullets?: string[];
+}
+
+export interface FaqItem {
+  question: string;
+  answer: string;
+}
+
+export interface FaqGroup {
+  title: string;
+  items: FaqItem[];
+}
+
+export const FAQ_GROUPS: FaqGroup[] = [
+  {
+    title: "Getting started",
+    items: [
+      {
+        question: "How do I open an account on EDR Freight?",
+        answer:
+          "Sign up with your work email and verify the one-time code we send you. After you set a password, the onboarding wizard collects your company details, trade licence, TIN certificate and the operational services you need (importer, exporter, freight forwarder or transporter). Submit the wizard and our team reviews the application.",
+      },
+      {
+        question: "How long does account approval take?",
+        answer:
+          "Most complete applications are reviewed within two working days. You will see the status on your dashboard, and we email you when a profile is approved or when a document needs to be re-uploaded.",
+      },
+      {
+        question: "My profile was rejected. What now?",
+        answer:
+          "The rejection notice states the reason. Open Settings, correct the details or replace the document that was flagged, and re-apply — you do not need to create a new account.",
+      },
+      {
+        question: "Can one company hold several operational services?",
+        answer:
+          "Yes. A company can hold importer, exporter, freight forwarder and transporter profiles at the same time. Each is approved separately, and the header lets you switch between the ones you hold.",
+      },
+    ],
+  },
+  {
+    title: "Contracts and bookings",
+    items: [
+      {
+        question: "What is the difference between a contract and a booking?",
+        answer:
+          "A contract is the commercial agreement covering a cargo movement — route, commodity, volume and rates. A booking is a single shipment executed under that contract. You create the contract once, then raise bookings against it for each consignment.",
+      },
+      {
+        question: "How do I create a booking?",
+        answer:
+          "Open the contract from the Contracts list and choose New Booking. Provide the consignment details, containers or tonnage, and the last-mile requirement if you need one. Bookings can also be started from the Bookings page, which routes you through contract selection first.",
+      },
+      {
+        question: "Why do I have to sign a contract before shipping?",
+        answer:
+          "The contract document is the binding agreement for the movement. You must scroll to the end, accept the terms, and sign it with your saved signature and stamp before EDR schedules any wagon against it.",
+      },
+      {
+        question: "Where do I set up my signature and stamp?",
+        answer:
+          "Under Signature & Stamp in the portal. It is saved once and reused for every contract you sign, so you do not have to upload it per document.",
+      },
+      {
+        question: "Can I change a booking after submitting it?",
+        answer:
+          "You can edit a booking while it is still pending review. Once EDR has confirmed it and allocated capacity, changes go through our operations team — contact support with the booking reference.",
+      },
+      {
+        question: "How do I track a consignment?",
+        answer:
+          "Open the booking and use the tracking panel, which shows the current milestone, the wagon or container assigned, and the timestamps recorded at each corridor point.",
+      },
+    ],
+  },
+  {
+    title: "Invoices and payments",
+    items: [
+      {
+        question: "Where do I find my invoices?",
+        answer:
+          "The Invoices page lists every invoice raised against your company, with its status, due date and outstanding balance. Open any invoice to see its line items and download a PDF copy.",
+      },
+      {
+        question: "Which payment methods are supported?",
+        answer:
+          "Payments are made through the integrated bank channels shown at checkout. After you complete the payment on the bank's page you are returned to the portal, and the invoice status updates once the bank confirms the transaction.",
+      },
+      {
+        question: "My payment was deducted but the invoice still shows unpaid.",
+        answer:
+          "Bank confirmations can lag by a few minutes. Use the Check Payment Status page linked from your receipt; if it still has not settled after an hour, email support with the invoice number and the bank reference and we will reconcile it.",
+      },
+      {
+        question: "Why is my invoice amount rounded?",
+        answer:
+          "Some bank channels only accept whole-birr amounts, so invoices routed through them are rounded up to the nearest birr. The rounding is shown on the invoice detail page.",
+      },
+    ],
+  },
+  {
+    title: "Account and security",
+    items: [
+      {
+        question: "How do I reset my password?",
+        answer:
+          "Use Forgot Password on the sign-in page. We email you a reset link that is valid for a limited time. If a member of our staff issued the link, it works the same way even if you are already signed in.",
+      },
+      {
+        question: "Can I add colleagues to my company account?",
+        answer:
+          "Yes. Company administrators can invite additional users from Settings. Each user signs in with their own credentials, and actions are recorded against the individual who performed them.",
+      },
+      {
+        question: "How do I update company details after approval?",
+        answer:
+          "Edit them in Settings. Changes to regulated fields — trade licence, TIN, legal name — are re-verified by our team before they take effect.",
+      },
+    ],
+  },
+];
+
+export const PRIVACY_SECTIONS: Section[] = [
+  {
+    heading: "1. Introduction",
+    body: [
+      "The Ethio-Djibouti Standard Gauge Rail Share Company (\"EDR\", \"we\", \"us\") operates the EDR Freight platform, which lets customers register their business, agree freight contracts, raise bookings, track consignments and settle invoices online.",
+      "This policy explains what personal and business information we collect through the platform, why we collect it, how long we keep it and what rights you have over it. It applies to the EDR Freight customer portal and the services reached through it.",
+    ],
+  },
+  {
+    heading: "2. Information we collect",
+    body: [
+      "We collect information you give us, information generated by your use of the platform, and information we receive from the regulators and financial institutions we work with.",
+    ],
+    bullets: [
+      "Account details — name, work email address, phone number and the credentials used to sign in.",
+      "Company and compliance records — legal name, trade licence, TIN certificate, VAT registration, ownership and manager details, and the operational services you apply for.",
+      "Identity verification data — where you verify through a national identity service, the verification result and the attributes that service returns to us.",
+      "Operational data — contracts, bookings, consignment and cargo details, container and wagon assignments, tracking events and delivery confirmations.",
+      "Financial data — invoices, payment references, transaction status and settlement confirmations received from banks. We do not store your card numbers or online banking credentials.",
+      "Support data — the messages and files you send us through the in-app support chat or by email.",
+      "Technical data — IP address, device and browser information, and event logs generated when you use the platform.",
+    ],
+  },
+  {
+    heading: "3. How we use your information",
+    bullets: [
+      "To create and administer your account and verify that your company is entitled to the services it applies for.",
+      "To perform the freight contracts and bookings you place, including allocating capacity and coordinating rail and last-mile movements.",
+      "To issue invoices, process payments and keep the accounting records the law requires us to keep.",
+      "To provide customer support and respond to the questions and complaints you raise.",
+      "To keep the platform secure, detect misuse and investigate incidents.",
+      "To meet our legal, tax, customs and regulatory obligations in Ethiopia and Djibouti.",
+      "To improve the platform — measuring which features are used and where users encounter errors, using aggregated and pseudonymised data wherever that is sufficient.",
+    ],
+  },
+  {
+    heading: "4. Legal basis for processing",
+    body: [
+      "We process your information because it is necessary to perform the contract between you and EDR, because we have a legal obligation to do so (customs, tax and transport regulation), or because we have a legitimate interest in operating and securing the platform. Where we rely on your consent — for example, optional marketing messages — you can withdraw it at any time.",
+    ],
+  },
+  {
+    heading: "5. Sharing your information",
+    body: [
+      "We do not sell your information. We share it only where it is necessary to deliver the service or where the law requires it.",
+    ],
+    bullets: [
+      "Government and regulatory bodies — customs, revenue and transport authorities in Ethiopia and Djibouti, to the extent required for the movement of your cargo.",
+      "Ports, terminals and last-mile transporters involved in executing your bookings.",
+      "Banks and payment providers, to initiate and reconcile the payments you make.",
+      "Technology suppliers who host and maintain the platform on our behalf, under contracts that restrict them to processing data on our instructions.",
+      "Courts, law enforcement and other authorities where we are legally compelled to disclose.",
+    ],
+  },
+  {
+    heading: "6. International transfers",
+    body: [
+      "Cross-border freight inherently involves parties in more than one country, so consignment and clearance information is shared with counterparties and authorities in Djibouti as well as Ethiopia. Where we transfer information outside Ethiopia, we do so only as far as the movement requires or the law permits, and we require recipients to protect it to a comparable standard.",
+    ],
+  },
+  {
+    heading: "7. Data retention",
+    body: [
+      "We keep account and company records for as long as your account is active. Contract, booking, customs and financial records are kept for the period required by Ethiopian commercial, tax and customs law after the relevant transaction, because we are obliged to be able to produce them. Support conversations and technical logs are kept for a shorter period, sufficient to resolve disputes and investigate security incidents.",
+    ],
+  },
+  {
+    heading: "8. Security",
+    body: [
+      "Access to the platform requires authentication, and staff access to customer records is limited to what each role needs. Data is transmitted over encrypted connections and stored on systems protected by access controls and logging. No system is perfectly secure, so please keep your credentials confidential and tell us immediately if you believe your account has been compromised.",
+    ],
+  },
+  {
+    heading: "9. Your rights",
+    body: [
+      "Subject to Ethiopian law, you may ask us to give you a copy of the personal information we hold about you, correct it if it is inaccurate, restrict or object to certain processing, or delete it where we are not required to keep it. Requests are handled through the contact details below; we may need to verify your identity before acting.",
+    ],
+  },
+  {
+    heading: "10. Cookies and similar technologies",
+    body: [
+      "The platform uses cookies and browser storage to keep you signed in, remember your interface preferences and measure how the product is used so we can fix problems. Essential cookies cannot be turned off without breaking sign-in. You can clear or block the rest through your browser settings.",
+    ],
+  },
+  {
+    heading: "11. Children",
+    body: [
+      "The platform is a business service and is not directed at children. We do not knowingly collect information from anyone under 18.",
+    ],
+  },
+  {
+    heading: "12. Changes to this policy",
+    body: [
+      "We may update this policy as the platform and the law change. Material changes are announced in the portal before they take effect, and the date at the top of this page always reflects the current version.",
+    ],
+  },
+  {
+    heading: "13. Contact us",
+    body: [
+      `Questions about this policy or about how we handle your information can be sent to ${SUPPORT_CONTACT.email}, called in on ${SUPPORT_CONTACT.phone}, or addressed to our head office in ${SUPPORT_CONTACT.office}.`,
+    ],
+  },
+];
+
+export const TERMS_SECTIONS: Section[] = [
+  {
+    heading: "1. These terms",
+    body: [
+      "These terms govern your use of the EDR Freight platform operated by the Ethio-Djibouti Standard Gauge Rail Share Company (\"EDR\"). By creating an account or using the platform, the company you represent agrees to them.",
+      "The platform is the channel through which you register, request and manage freight services. The commercial terms of each movement — routes, rates, volumes and payment terms — are set out in the freight contract you sign in the platform. Where a signed contract and these terms conflict, the signed contract governs that movement.",
+    ],
+  },
+  {
+    heading: "2. Eligibility and accounts",
+    bullets: [
+      "The platform is for registered businesses. You confirm that you are authorised to act for the company you register and to bind it to these terms.",
+      "The information and documents you submit — trade licence, TIN, VAT registration, ownership details — must be accurate, current and genuine.",
+      "Accounts and operational profiles are activated only after EDR has reviewed and approved them, and approval may be refused or withdrawn.",
+      "You are responsible for keeping credentials confidential and for everything done under your account. Tell us at once if you suspect unauthorised use.",
+    ],
+  },
+  {
+    heading: "3. Contracts and bookings",
+    bullets: [
+      "A freight contract takes effect when it is signed in the platform by you and countersigned by EDR.",
+      "A booking is a request for a specific movement under a contract. It becomes binding when EDR confirms it and allocates capacity — submission alone does not reserve a wagon or container.",
+      "You are responsible for the accuracy of consignment data: commodity description, weight, dimensions, container numbers, hazardous classification and consignee details.",
+      "Capacity is finite. EDR may decline, defer or reschedule a booking where capacity, safety, operating conditions or regulatory direction require it.",
+    ],
+  },
+  {
+    heading: "4. Cargo, documents and compliance",
+    bullets: [
+      "You must obtain and provide every permit, customs declaration and clearance document the movement requires, and you warrant that the cargo may lawfully be carried.",
+      "Prohibited and restricted goods may not be tendered without EDR's prior written agreement and any licence the law requires.",
+      "Cargo must be packed, secured and, where applicable, labelled to the standard the mode of carriage requires. EDR may inspect, refuse or offload cargo that is misdeclared or unsafe.",
+      "You are liable for fines, demurrage, storage charges and losses arising from misdeclared cargo, missing documents or delays attributable to you.",
+    ],
+  },
+  {
+    heading: "5. Rates, invoicing and payment",
+    bullets: [
+      "Charges are calculated from the rates in your contract, the tariffs published in the platform, and any accessorial services actually rendered.",
+      "Invoices are issued in the platform and are payable by the due date shown on them, through the payment channels the platform offers.",
+      "Payment is confirmed when the funds are confirmed by the bank, not when payment is initiated.",
+      "Overdue amounts may attract interest and may result in suspension of new bookings or of the account until the balance is cleared.",
+      "Taxes and statutory duties are your responsibility unless the contract expressly says otherwise.",
+    ],
+  },
+  {
+    heading: "6. Delivery, delay and liability",
+    body: [
+      "Transit times shown in the platform are estimates based on planned schedules. They are not guarantees, and EDR is not liable for indirect or consequential loss, loss of profit or loss of market arising from delay.",
+      "EDR's liability for loss of or damage to cargo is limited to the extent set out in the applicable freight contract and in the transport law governing the carriage. Claims must be notified in writing within the period the contract specifies; late claims may be rejected.",
+      "Neither party is liable for failure to perform caused by events beyond its reasonable control, including natural disasters, industrial action, civil unrest, infrastructure failure, or acts of government and regulatory authorities.",
+    ],
+  },
+  {
+    heading: "7. Acceptable use of the platform",
+    bullets: [
+      "Use the platform only for its intended purpose and in accordance with applicable law.",
+      "Do not attempt to gain unauthorised access, probe or disrupt the service, or interfere with other customers' data.",
+      "Do not scrape, resell or redistribute platform content, rates or data without written permission.",
+      "Do not upload malware or content that infringes the rights of others.",
+    ],
+  },
+  {
+    heading: "8. Electronic signatures and records",
+    body: [
+      "You agree that contracts signed in the platform using your stored signature and stamp are validly executed, that the records the platform keeps of those signatures are admissible evidence of them, and that they carry the same effect as signatures on paper.",
+    ],
+  },
+  {
+    heading: "9. Availability and changes to the service",
+    body: [
+      "We aim to keep the platform available, but it may be interrupted for maintenance, upgrades or reasons outside our control. We may add, change or withdraw features. Where a change materially affects how you use the platform, we will give reasonable notice in the portal.",
+    ],
+  },
+  {
+    heading: "10. Suspension and termination",
+    body: [
+      "We may suspend or terminate access where these terms are breached, where documents prove to be false, where amounts remain unpaid, or where the law or a regulator requires it. You may stop using the platform at any time. Termination does not affect obligations already incurred — cargo in transit, invoices outstanding, or records we are required to retain.",
+    ],
+  },
+  {
+    heading: "11. Intellectual property",
+    body: [
+      "The platform, its software, design and content belong to EDR or its licensors. You are granted a non-exclusive, non-transferable right to use it for your own freight operations. Your commercial and consignment data remains yours; you grant us the right to process it as needed to deliver the service and as described in the Privacy Policy.",
+    ],
+  },
+  {
+    heading: "12. Confidentiality and data protection",
+    body: [
+      "Each party will keep the other's non-public commercial information confidential and use it only for the purposes of the services. Our handling of personal information is described in the Privacy Policy, which forms part of these terms.",
+    ],
+  },
+  {
+    heading: "13. Governing law and disputes",
+    body: [
+      "These terms are governed by the laws of the Federal Democratic Republic of Ethiopia. The parties will first attempt to resolve any dispute amicably; failing that, the dispute is subject to the jurisdiction of the competent courts of Ethiopia, without prejudice to any arbitration clause agreed in a specific freight contract.",
+    ],
+  },
+  {
+    heading: "14. Changes to these terms",
+    body: [
+      "We may update these terms as the service and the law change. Updates are published here and announced in the portal. Continuing to use the platform after an update takes effect means you accept the revised terms.",
+    ],
+  },
+  {
+    heading: "15. Contact",
+    body: [
+      `For questions about these terms, write to ${SUPPORT_CONTACT.email} or call ${SUPPORT_CONTACT.phone}.`,
+    ],
+  },
+];
diff --git a/apps/edr-freight-web/portal/src/services/api.ts b/apps/edr-freight-web/portal/src/services/api.ts
index 7546fedbc..0d0035b87 100644
--- a/apps/edr-freight-web/portal/src/services/api.ts
+++ b/apps/edr-freight-web/portal/src/services/api.ts
@@ -15,6 +15,8 @@ import {
   GeneratePriceResponse,
   type MyBookingWindow,
   SubmitBookingResponse,
+  type WagonCancellationListFilter,
+  type WagonCancellationListResponse,
 } from "./bookings.service";
 import {
   contractsService,
@@ -483,6 +485,22 @@ export const api = {
       bookingsService.getExportTrains(bookingId, date, cargo),
     ),
 
+    listWagonCancellations: endpoint<
+      { bookingId: string },
+      WagonCancellationListResponse
+    >("bookings", "listWagonCancellations", ({ bookingId }) =>
+      bookingsService.listWagonCancellations(bookingId),
+    ),
+
+    listMyWagonCancellations: endpoint<
+      WagonCancellationListFilter | void,
+      WagonCancellationListResponse
+    >(
+      "bookings",
+      "listMyWagonCancellations",
+      bookingsService.listMyWagonCancellations,
+    ),
+
     getMyBookingWindows: endpoint<void, MyBookingWindow[]>(
       "train-scheduling",
       "myBookingWindows",
@@ -610,10 +628,14 @@ export const api = {
     ),
 
     validateShipment: endpoint<
-      { id: string; dto: Freight.CreateBookingUnderContractDto },
+      {
+        id: string;
+        dto: Freight.CreateBookingUnderContractDto;
+        excludeBookingId?: string;
+      },
       ShipmentValidation
-    >("contracts", "validateShipment", ({ id, dto }) =>
-      contractsService.validateShipment(id, dto),
+    >("contracts", "validateShipment", ({ id, dto, excludeBookingId }) =>
+      contractsService.validateShipment(id, dto, excludeBookingId),
     ),
 
     getContractMilestones: endpoint<
diff --git a/apps/edr-freight-web/portal/src/services/bookings.service.ts b/apps/edr-freight-web/portal/src/services/bookings.service.ts
index 44da51c05..cad07b0c6 100644
--- a/apps/edr-freight-web/portal/src/services/bookings.service.ts
+++ b/apps/edr-freight-web/portal/src/services/bookings.service.ts
@@ -91,6 +91,8 @@ export interface MyBookingWindow {
   windowClosesAt: string | null;
   docReviewEndsAt: string | null;
   paymentPhaseEndsAt: string | null;
+  /** End of the payment drain tail — pending payments may settle until then. */
+  paymentDrainEndsAt: string | null;
   bookingWindowStatus: string;
   bookingCycleNo: number;
   departureDate: string;
@@ -193,6 +195,116 @@ export interface BookingListFilter {
   sortOrder?: "ASC" | "DESC";
 }
 
+export interface BookingWagonContainer {
+  containerNumber: string | null;
+  sealNumber: string | null;
+  positionOnWagon: number | null;
+  grossWeightTons: string | null;
+}
+
+/** One allocated wagon of a booking, as returned by GET /bookings/:id/wagons. */
+export interface BookingWagonAllocation {
+  /** wagon_booking_allocations id — the handle for cancelling this specific wagon. */
+  allocationId: string;
+  sequenceNo: number;
+  wagonNumber: string | null;
+  wagonType: string | null;
+  wagonTypeCode: string | null;
+  tareWeightTons: string | null;
+  capacityTons: string | null;
+  lengthMeters: string | null;
+  allocatedWeightTons: string | null;
+  loadType: "CONTAINER" | "BULK";
+  status: "PLANNED" | "RESERVED" | "LOADED" | "DEPARTED";
+  trainNumber: string | null;
+  departureAt: string | null;
+  originStation: string | null;
+  destinationStation: string | null;
+  bulkCargoDescription: string | null;
+  bulkQuantity: string | null;
+  containers: BookingWagonContainer[];
+}
+
+// ── Partial wagon cancellation (paid bookings) ──────────────────────────────
+
+export type WagonCancellationStatus =
+  | "FEE_PENDING"
+  | "CREDIT_AVAILABLE"
+  | "REBOOKED"
+  | "WITHDRAWN"
+  | "EXPIRED";
+
+/** One partial-cancellation ledger row of a paid booking. */
+export interface WagonCancellation {
+  id: string;
+  bookingId: string;
+  rebookedBookingId?: string | null;
+  wagonsCancelled: number;
+  weightTons: number;
+  /** What was cut: bulk tons, or container units per size (ft). */
+  cancelledQuantities: {
+    bulkTons?: number;
+    bySize?: Record<string, number>;
+    /** Exact physical containers leaving with the cancelled wagons. */
+    units?: Array<{
+      containerSize: string;
+      containerNumber: string;
+      sealNumber?: string | null;
+      vgmTons: number;
+      isHazardous: boolean;
+      isReefer: boolean;
+    }>;
+    /** Wagons already left the schedule when the request was made. */
+    releasedAtRequest?: boolean;
+  };
+  /** Rebooking credit — the cancelled share of the original freight price. */
+  creditAmount: number;
+  feeAmount: number;
+  feeCurrency: string;
+  feeInvoiceId?: string | null;
+  feePaidAt?: string | null;
+  status: WagonCancellationStatus;
+  reason?: string | null;
+  rebookedAt?: string | null;
+  createdAt: string;
+  booking?: { id: string; reference: string } | null;
+  rebookedBooking?: { id: string; reference: string } | null;
+}
+
+/** Fee/credit preview of a partial wagon cancellation (no writes). */
+export interface WagonCancellationPreview {
+  wagons: number;
+  weightTons: number;
+  feePerWagon: number;
+  feeAmount: number;
+  feeCurrency: string;
+  creditAmount: number;
+}
+
+export interface RequestWagonCancellationPayload {
+  /** Cancel SPECIFIC wagons: allocationIds from getWagons. Overrides the fields below. */
+  wagonAllocationIds?: string[];
+  /** BULK bookings: number of wagons to cancel (tons derived proportionally). */
+  wagons?: number;
+  /** CONTAINER bookings: units to cancel per size ("20"/"40", as stored on the line). */
+  containers?: Array<{ containerSize: string; quantity: number }>;
+  reason?: string;
+}
+
+export interface WagonCancellationListFilter {
+  statuses?: string[];
+  search?: string;
+  from?: string;
+  to?: string;
+  page?: number;
+  pageSize?: number;
+}
+
+export interface WagonCancellationListResponse {
+  items: WagonCancellation[];
+  total: number;
+}
+
 export const bookingsService = {
   list: async (
     filter: BookingListFilter | void = {},
@@ -315,6 +427,16 @@ export const bookingsService = {
     return data.data;
   },
 
+  customerCancel: async (
+    id: string,
+    reason?: string,
+  ): Promise<Freight.IBooking> => {
+    const { data } = await client.post(`/api/bookings/${id}/customer-cancel`, {
+      reason,
+    });
+    return data.data;
+  },
+
   reject: async (id: string, reason?: string): Promise<Freight.IBooking> => {
     const { data } = await client.post(`/api/bookings/${id}/reject`, { reason });
     return data.data;
@@ -548,6 +670,82 @@ export const bookingsService = {
     return data.data as Freight.DayAvailabilityResponse;
   },
 
+  /**
+   * Allocated wagons for a paid booking (empty until placed on a train).
+   * One row per wagon with its containers / bulk load.
+   */
+  getWagons: async (bookingId: string): Promise<BookingWagonAllocation[]> => {
+    const { data } = await client.get(`/api/bookings/${bookingId}/wagons`);
+    return (data.data ?? data) as BookingWagonAllocation[];
+  },
+
+  // ── Partial wagon cancellation ──
+  /** Fee/credit preview for the confirm dialog — same math as the request, no writes. */
+  previewWagonCancellation: async (
+    id: string,
+    payload: RequestWagonCancellationPayload,
+  ): Promise<WagonCancellationPreview> => {
+    const { data } = await client.post(
+      `/api/bookings/${id}/wagon-cancellations/preview`,
+      payload,
+    );
+    return data.data ?? data;
+  },
+
+  /** Open a cancellation: issues the fee invoice; wagons release once the fee settles. */
+  requestWagonCancellation: async (
+    id: string,
+    payload: RequestWagonCancellationPayload,
+  ): Promise<WagonCancellation> => {
+    const { data } = await client.post(
+      `/api/bookings/${id}/wagon-cancellations`,
+      payload,
+    );
+    return data.data ?? data;
+  },
+
+  /** Cancellation history of one booking (as source and as rebooked target). */
+  listWagonCancellations: async (
+    bookingId: string,
+  ): Promise<WagonCancellationListResponse> => {
+    const { data } = await client.get(
+      `/api/bookings/${bookingId}/wagon-cancellations`,
+    );
+    return data.data ?? data;
+  },
+
+  /** The signed-in customer's wagon cancellations (paginated, filterable). */
+  listMyWagonCancellations: async (
+    filter: WagonCancellationListFilter | void = {},
+  ): Promise<WagonCancellationListResponse> => {
+    const { data } = await client.get("/api/bookings/wagon-cancellations/my", {
+      params: filter,
+    });
+    return data.data ?? data;
+  },
+
+  /** Void a FEE_PENDING request — the fee invoice is cancelled, nothing was released. */
+  withdrawWagonCancellation: async (
+    cancellationId: string,
+  ): Promise<WagonCancellation> => {
+    const { data } = await client.post(
+      `/api/bookings/wagon-cancellations/${cancellationId}/withdraw`,
+    );
+    return data.data ?? data;
+  },
+
+  /** Rebook a CREDIT_AVAILABLE cancellation onto a shipment day → new PAID booking. */
+  rebookWagonCancellation: async (
+    cancellationId: string,
+    payload: { scheduledDate: string },
+  ): Promise<{ cancellation: WagonCancellation; bookingId: string }> => {
+    const { data } = await client.post(
+      `/api/bookings/wagon-cancellations/${cancellationId}/rebook`,
+      payload,
+    );
+    return data.data ?? data;
+  },
+
   /**
    * Upcoming/open booking windows on the signed-in customer's active-contract
    * lanes (import booking-day windows + export 24h pre-departure windows).
diff --git a/apps/edr-freight-web/portal/src/services/contracts.service.ts b/apps/edr-freight-web/portal/src/services/contracts.service.ts
index 2ce09d4cc..3842296ef 100644
--- a/apps/edr-freight-web/portal/src/services/contracts.service.ts
+++ b/apps/edr-freight-web/portal/src/services/contracts.service.ts
@@ -400,8 +400,13 @@ export const contractsService = {
   validateShipment: async (
     id: string,
     dto: Freight.CreateBookingUnderContractDto,
+    // Completion/resubmit: exclude this booking's own containers from the
+    // same-train clash check.
+    excludeBookingId?: string,
   ): Promise<ShipmentValidation> => {
-    const { data } = await client.post(C.VALIDATE_SHIPMENT(id), dto);
+    const { data } = await client.post(C.VALIDATE_SHIPMENT(id), dto, {
+      params: excludeBookingId ? { bookingId: excludeBookingId } : undefined,
+    });
     return data.data ?? data;
   },
 
diff --git a/apps/edr-freight-web/portal/src/utils/result.ts b/apps/edr-freight-web/portal/src/utils/result.ts
index 54104442c..3c0bddf34 100644
--- a/apps/edr-freight-web/portal/src/utils/result.ts
+++ b/apps/edr-freight-web/portal/src/utils/result.ts
@@ -34,6 +34,16 @@ function humanizeApiMessage(raw: string): string {
   return raw;
 }
 
+/**
+ * NestJS's ValidationPipe reports every failed constraint at once, so `message`
+ * arrives as a string[] rather than a string. Flatten it — passing the array
+ * through left the UI rendering its entries run together with no separator.
+ */
+function asMessage(value: unknown): string {
+  if (Array.isArray(value)) return value.filter(Boolean).join(". ");
+  return typeof value === "string" ? value : "";
+}
+
 export function extractApiError(err: unknown): ApiError {
   if (err && typeof err === "object") {
     const obj = err as Record<string, unknown>;
@@ -41,13 +51,10 @@ export function extractApiError(err: unknown): ApiError {
     if (response) {
       const statusCode = response.status as number | undefined;
       const data = response.data as Record<string, unknown> | undefined;
+      const raw = asMessage(data?.message) || asMessage(data?.error);
       return {
-        code: (data?.message as string) || (data?.error as string) || "api_error",
-        message: humanizeApiMessage(
-          (data?.message as string) ||
-            (data?.error as string) ||
-            "An unexpected error occurred",
-        ),
+        code: raw || "api_error",
+        message: humanizeApiMessage(raw || "An unexpected error occurred"),
         statusCode,
       };
     }
diff --git a/apps/edr-passenger-api/src/modules/dashboard/dashboard.module.ts b/apps/edr-passenger-api/src/modules/dashboard/dashboard.module.ts
index 5a541452c..09b3717b4 100644
--- a/apps/edr-passenger-api/src/modules/dashboard/dashboard.module.ts
+++ b/apps/edr-passenger-api/src/modules/dashboard/dashboard.module.ts
@@ -1,13 +1,6 @@
 import { Module } from '@nestjs/common';
 import { DashboardController } from './dashboard.controller';
 import { DashboardService } from './dashboard.service';
-import { ReportsModule } from '../reports/reports.module';
 
-@Module({
-  // ReportsModule owns the blocked-seat revenue loss rule; the dashboard's roll-up
-  // reads it from there instead of keeping a second copy of the definition.
-  imports: [ReportsModule],
-  controllers: [DashboardController],
-  providers: [DashboardService],
-})
+@Module({ controllers: [DashboardController], providers: [DashboardService] })
 export class DashboardModule {}
diff --git a/apps/edr-passenger-api/src/modules/dashboard/dashboard.service.ts b/apps/edr-passenger-api/src/modules/dashboard/dashboard.service.ts
index 6a5d83b89..f7e015e11 100644
--- a/apps/edr-passenger-api/src/modules/dashboard/dashboard.service.ts
+++ b/apps/edr-passenger-api/src/modules/dashboard/dashboard.service.ts
@@ -1,31 +1,17 @@
-import { Injectable, Logger } from '@nestjs/common';
+import { Injectable } from '@nestjs/common';
 import { InjectDataSource } from '@nestjs/typeorm';
 import { DataSource } from 'typeorm';
-import { BlockedSeatRevenueLossStat } from '@edr/types';
 import { PrismaService } from '../../common/prisma.service';
-import { ReportsService } from '../reports/reports.service';
-
-/** Shown when nothing is blocked, or when the loss roll-up could not be computed. */
-const EMPTY_BLOCKED_SEAT_LOSS: BlockedSeatRevenueLossStat = {
-  periodDays: null,
-  lossByCurrency: [],
-  schedulesAffected: 0,
-  blockedSeatCount: 0,
-  topReasonCategory: null,
-};
 
 @Injectable()
 export class DashboardService {
-  private readonly logger = new Logger(DashboardService.name);
-
   constructor(
     private prisma: PrismaService,
     @InjectDataSource() private dataSource: DataSource,
-    private reports: ReportsService,
   ) {}
 
   async getBackofficeStats() {
-    const [totalBookings, totalPackageBookings, totalTickets, totalPassengers, blockedSeatsCount, revenueRows, packageRevenueRows, blockedSeatRevenueLoss] =
+    const [totalBookings, totalPackageBookings, totalTickets, totalPassengers, blockedSeatsCount, revenueRows, packageRevenueRows] =
       await Promise.all([
         this.prisma.booking.count({ where: { status: { in: ['CONFIRMED', 'BOARDED'] } } }),
         this.prisma.booking.count({ where: { status: { in: ['CONFIRMED', 'BOARDED'] }, packageId: { not: null } } }),
@@ -52,9 +38,6 @@ export class DashboardService {
             AND id IN (SELECT "bookingId" FROM passenger."PaymentIntent" WHERE status = 'SUCCEEDED')
           GROUP BY COALESCE("displayCurrency"::text, "currency"::text)
         `,
-        // Joined into this same call on purpose: the dashboard's request count stays
-        // exactly where it was, and the card renders from the payload it already fetches.
-        this.getBlockedSeatRevenueLossStat(),
       ]);
 
     const totalPackageTickets = await this.prisma.ticket.count({
@@ -75,43 +58,11 @@ export class DashboardService {
       totalNormalTickets: totalTickets - totalPackageTickets,
       totalPassengers,
       blockedSeatsCount,
-      blockedSeatRevenueLoss,
       revenueByCurrency: toMap(revenueRows),
       packageRevenueByCurrency: toMap(packageRevenueRows),
     };
   }
 
-  /**
-   * Compact roll-up of the Blocked Seat Revenue Loss report over its full history.
-   *
-   * Reuses the report service rather than re-deriving the rule — there is exactly one
-   * definition of what a blocked seat costs. A failure here degrades to zeroes instead of
-   * taking the whole dashboard down with it.
-   */
-  private async getBlockedSeatRevenueLossStat(): Promise<BlockedSeatRevenueLossStat> {
-    try {
-      // pageSize 1: only the summary is read, and paging does not change what it covers.
-      const report = await this.reports.getBlockedSeatsRevenueLoss({ page: 1, pageSize: 1 });
-      const { summary } = report;
-
-      return {
-        periodDays: null,
-        lossByCurrency: summary.lossByCurrency,
-        schedulesAffected: summary.schedulesAffected,
-        blockedSeatCount: summary.blockedSeatCount,
-        // topReasonCategories is already sorted by estimated loss, descending.
-        topReasonCategory: summary.topReasonCategories[0]?.reasonCategory ?? null,
-      };
-    } catch (err) {
-      this.logger.warn(
-        `Blocked-seat revenue loss roll-up unavailable — ${
-          err instanceof Error ? err.message : String(err)
-        }`,
-      );
-      return EMPTY_BLOCKED_SEAT_LOSS;
-    }
-  }
-
   async getHomeDashboard(passengerId: string) {
     const now = new Date();
     const [passenger, upcomingBooking, wallet, promos, weatherAlerts, stationSignals, savedRoutes] = await Promise.all([
diff --git a/apps/edr-passenger-api/src/modules/reports/blocked-seats-loss.calculator.ts b/apps/edr-passenger-api/src/modules/reports/blocked-seats-loss.calculator.ts
index 6ce581067..efee9a11c 100644
--- a/apps/edr-passenger-api/src/modules/reports/blocked-seats-loss.calculator.ts
+++ b/apps/edr-passenger-api/src/modules/reports/blocked-seats-loss.calculator.ts
@@ -193,7 +193,10 @@ function supersedes(candidate: CountedBlock, existing: CountedBlock): boolean {
   return candidate.block.blockedAt.getTime() > existing.block.blockedAt.getTime();
 }
 
-function isGlobalBlockInEffectAt(block: LossBlock, departureAt: Date): boolean {
+export function isGlobalBlockInEffectAt(
+  block: Pick<LossBlock, 'blockedAt' | 'unblockAt'>,
+  departureAt: Date,
+): boolean {
   if (block.blockedAt.getTime() > departureAt.getTime()) return false;
   if (block.unblockAt === null) return true;
   return block.unblockAt.getTime() >= departureAt.getTime();
@@ -210,9 +213,10 @@ export function isPlaceholderSeat(seat: Pick<LossSeat, 'seatNumber'>): boolean {
  * inflates the blocked-seat count. Match on a substring of type *or* name so both the
  * documented convention and the data as it actually exists are covered.
  */
-export function isDiningCoach(
-  coach: Pick<LossCoach, 'coachTypeType' | 'coachTypeName'>,
-): boolean {
+export function isDiningCoach(coach: {
+  coachTypeType?: string | null;
+  coachTypeName?: string | null;
+}): boolean {
   const haystack = `${coach.coachTypeType ?? ''} ${coach.coachTypeName ?? ''}`.toLowerCase();
   return haystack.includes('dining');
 }
diff --git a/apps/edr-passenger-api/src/modules/reports/reports.service.ts b/apps/edr-passenger-api/src/modules/reports/reports.service.ts
index 8811a3855..e899fdb4b 100644
--- a/apps/edr-passenger-api/src/modules/reports/reports.service.ts
+++ b/apps/edr-passenger-api/src/modules/reports/reports.service.ts
@@ -15,12 +15,16 @@ import {
 } from "./reports.dto";
 import {
   assembleReport,
+  isDiningCoach,
+  isGlobalBlockInEffectAt,
+  isPlaceholderSeat,
   LossCalculatorInput,
   LossCoach,
   LossFare,
   LossSeat,
   selectCountedBlocks,
   soldKey,
+  TICKETING_BLOCK_REASON_PREFIX,
 } from "./blocked-seats-loss.calculator";
 
 /** Fares are quoted at the local tariff unless the caller asks otherwise. */
@@ -528,7 +532,8 @@ export class ReportsService {
   }
 
   async getSeatStatusReport(scheduleId: string) {
-    // Confirmed/boarded seats — exclude dining coaches
+    // Confirmed/boarded seats. Dining coaches are dropped in JS below — `CoachType.type`
+    // holds display names in real data, so an exact match here would not catch them.
     const bookingSeats = await this.prisma.bookingSeat.findMany({
       where: {
         OR: [
@@ -536,7 +541,6 @@ export class ReportsService {
           { leg: 2, booking: { returnScheduleId: scheduleId, status: { in: ['CONFIRMED', 'BOARDED', 'PENDING_PAYMENT'] } } },
           { scheduleId: null, leg: 1, booking: { scheduleId, status: { in: ['CONFIRMED', 'BOARDED', 'PENDING_PAYMENT'] } } },
         ],
-        seat: { coach: { coachType: { type: { not: 'dining' } } } },
       },
       include: {
         booking: {
@@ -565,12 +569,6 @@ export class ReportsService {
       orderBy: [{ seat: { coach: { number: 'asc' } } }, { seat: { seatNumber: 'asc' } }],
     });
 
-    // Active seat holds for this schedule
-    const activeHolds = await this.prisma.seatHold.findMany({
-      where: { scheduleId },
-      orderBy: { createdAt: 'desc' },
-    });
-
     // Expired holds (last 24h) — held but never converted to a booking
     const since24h = new Date(Date.now() - 24 * 60 * 60 * 1000);
     const expiredHolds = await this.prisma.seatHold.findMany({
@@ -581,35 +579,89 @@ export class ReportsService {
       orderBy: { expiresAt: 'desc' },
     });
 
-    // Manually blocked seats — schedule-scoped blocks for this schedule OR global blocks (scheduleId null)
-    // Exclude MAINTENANCE and booking-system-created blocks
-    const blocks = await this.prisma.seatBlock.findMany({
-      where: {
-        OR: [
-          { scheduleId },
-          { scheduleId: null },
-        ],
-        NOT: [
-          { reason: { startsWith: 'MAINTENANCE:' } },
-          { reason: { startsWith: 'Booked in tickets' } },
-        ],
-      },
-      include: {
-        seat: {
-          select: {
-            seatNumber: true,
-            bedPosition: true,
-            coach: {
-              select: {
-                number: true,
-                coachType: { select: { name: true, type: true, seatClasses: { select: { name: true, bedPosition: true } } } },
+    // Manually blocked seats. Counted the same way the blocked-seat revenue loss report
+    // counts them (see `selectCountedBlocks`), so the two reports never disagree:
+    //   - a schedule-scoped block naming this schedule, or
+    //   - a global block (scheduleId null) that was in effect at departure AND sits on a
+    //     coach actually assigned to this train.
+    // A global block on a coach that never joined this consist is not a blocked seat here.
+    // Excluded: dining coaches, placeholder seats, ticket-issuance bookkeeping blocks, and
+    // MAINTENANCE (a seat out of service, not one withheld by hand).
+    const [schedule, assignments, blockRows] = await Promise.all([
+      this.prisma.trainSchedule.findUnique({
+        where: { id: scheduleId },
+        select: { departureAt: true },
+      }),
+      this.prisma.coachAssignment.findMany({
+        where: { scheduleId },
+        select: { coachId: true },
+      }),
+      this.prisma.seatBlock.findMany({
+        where: {
+          OR: [
+            { scheduleId },
+            { scheduleId: null },
+          ],
+          NOT: [
+            { reason: { startsWith: 'MAINTENANCE:' } },
+            { reason: { startsWith: TICKETING_BLOCK_REASON_PREFIX } },
+          ],
+        },
+        include: {
+          seat: {
+            select: {
+              id: true,
+              coachId: true,
+              seatNumber: true,
+              bedPosition: true,
+              coach: {
+                select: {
+                  number: true,
+                  coachType: { select: { name: true, type: true, seatClasses: { select: { name: true, bedPosition: true } } } },
+                },
               },
             },
           },
         },
-      },
-      orderBy: { blockedAt: 'desc' },
-    });
+        orderBy: { blockedAt: 'desc' },
+      }),
+    ]);
+
+    const assignedCoachIds = new Set(assignments.map((a) => a.coachId));
+    const departureAt = schedule?.departureAt ?? null;
+
+    // One counted block per seat: a schedule-scoped block beats a global one, and between
+    // two of the same kind the most recent wins — the rows arrive newest-first, so the
+    // first of a kind seen for a seat is already the most recent.
+    const countedBySeat = new Map<string, (typeof blockRows)[number]>();
+    for (const block of blockRows) {
+      const seat = block.seat;
+      if (!seat || isPlaceholderSeat(seat)) continue;
+
+      const coachType = seat.coach?.coachType;
+      if (
+        isDiningCoach({
+          coachTypeType: coachType?.type ?? null,
+          coachTypeName: coachType?.name ?? null,
+        })
+      ) {
+        continue;
+      }
+
+      if (block.scheduleId === null) {
+        if (!assignedCoachIds.has(seat.coachId)) continue;
+        if (!departureAt || !isGlobalBlockInEffectAt(block, departureAt)) continue;
+      }
+
+      const existing = countedBySeat.get(seat.id);
+      if (!existing || (existing.scheduleId === null && block.scheduleId !== null)) {
+        countedBySeat.set(seat.id, block);
+      }
+    }
+
+    const blocks = [...countedBySeat.values()].sort(
+      (a, b) => b.blockedAt.getTime() - a.blockedAt.getTime(),
+    );
 
     const resolveSeatClass = (seat: any): string | null => {
       const classes = seat?.coach?.coachType?.seatClasses ?? [];
@@ -619,10 +671,18 @@ export class ReportsService {
       return (matched ?? classes[0])?.name ?? seat?.coach?.coachType?.name ?? null;
     };
 
-    const paidSeats = bookingSeats.filter(bs =>
+    const passengerSeats = bookingSeats.filter(
+      bs =>
+        !isDiningCoach({
+          coachTypeType: bs.seat?.coach?.coachType?.type ?? null,
+          coachTypeName: bs.seat?.coach?.coachType?.name ?? null,
+        }),
+    );
+
+    const paidSeats = passengerSeats.filter(bs =>
       bs.booking.status === 'CONFIRMED' || bs.booking.status === 'BOARDED'
     );
-    const unpaidSeats = bookingSeats.filter(bs =>
+    const unpaidSeats = passengerSeats.filter(bs =>
       bs.booking.status === 'PENDING_PAYMENT'
     );
 
@@ -645,7 +705,7 @@ export class ReportsService {
         paidCount: paidSeats.length,
         unpaidCount: unpaidSeats.length,
         expiredHoldCount: expiredHolds.length,
-        blockedCount: blocks.filter(b => b.seat?.coach?.coachType?.type !== 'dining').length,
+        blockedCount: blocks.length,
       },
       paidSeats: paidSeats.map(mapSeat),
       unpaidSeats: unpaidSeats.map(mapSeat),
@@ -655,18 +715,16 @@ export class ReportsService {
         expiresAt: h.expiresAt,
         createdAt: h.createdAt,
       })),
-      blockedSeats: blocks
-        .filter(b => b.seat?.coach?.coachType?.type !== 'dining')
-        .map(b => ({
-          id: b.id,
-          coachNumber: b.seat?.coach?.number ?? null,
-          seatNumber: b.seat?.seatNumber ?? null,
-          seatClassName: resolveSeatClass(b.seat),
-          reason: b.reason,
-          blockedBy: b.blockedBy,
-          blockedAt: b.blockedAt,
-          unblockAt: b.unblockAt,
-        })),
+      blockedSeats: blocks.map(b => ({
+        id: b.id,
+        coachNumber: b.seat?.coach?.number ?? null,
+        seatNumber: b.seat?.seatNumber ?? null,
+        seatClassName: resolveSeatClass(b.seat),
+        reason: b.reason,
+        blockedBy: b.blockedBy,
+        blockedAt: b.blockedAt,
+        unblockAt: b.unblockAt,
+      })),
     };
   }
 
diff --git a/apps/edr-passenger-api/src/modules/reports/seat-status-blocked.spec.ts b/apps/edr-passenger-api/src/modules/reports/seat-status-blocked.spec.ts
new file mode 100644
index 000000000..044ebe868
--- /dev/null
+++ b/apps/edr-passenger-api/src/modules/reports/seat-status-blocked.spec.ts
@@ -0,0 +1,261 @@
+import { ReportsService } from './reports.service';
+
+/**
+ * Covers the blocked-seat half of the seat status report.
+ *
+ * The count used to be a raw `SeatBlock` row count with an exact `type === 'dining'`
+ * exclusion. Real EDR data stores display names in `CoachType.type` ('Dining Coach '),
+ * so dining seats slipped through, and every global block counted even when its coach
+ * never joined the train. These cases pin the corrected rule.
+ */
+
+const SCHEDULE_ID = 'sched-1';
+const DEPARTURE = new Date('2026-03-10T06:00:00.000Z');
+
+interface CoachSpec {
+  id: string;
+  number: string;
+  typeType?: string;
+  typeName?: string;
+}
+
+const passengerCoach: CoachSpec = { id: 'coach-1', number: 'C1' };
+const diningCoach: CoachSpec = {
+  id: 'coach-dining',
+  number: 'D1',
+  // As the data actually looks: display name in `type`, trailing space included.
+  typeType: 'Dining Coach ',
+  typeName: 'Dining Coach',
+};
+
+function seatRow(
+  id: string,
+  coach: CoachSpec,
+  seatNumber: string,
+  bedPosition: string | null = null,
+) {
+  return {
+    id,
+    coachId: coach.id,
+    seatNumber,
+    bedPosition,
+    coach: {
+      number: coach.number,
+      coachType: {
+        name: coach.typeName ?? 'Standard',
+        type: coach.typeType ?? 'passenger',
+        seatClasses: [{ name: 'Economy', bedPosition: null }],
+      },
+    },
+  };
+}
+
+function blockRow(
+  overrides: Partial<{
+    id: string;
+    scheduleId: string | null;
+    reason: string;
+    blockedAt: Date;
+    unblockAt: Date | null;
+    seat: ReturnType<typeof seatRow>;
+  }> = {},
+) {
+  return {
+    id: 'block-1',
+    scheduleId: SCHEDULE_ID as string | null,
+    reason: 'VIP hold',
+    blockedBy: 'user-1',
+    blockedAt: new Date('2026-03-01T00:00:00.000Z'),
+    unblockAt: null as Date | null,
+    seat: seatRow('seat-1', passengerCoach, '1'),
+    ...overrides,
+  };
+}
+
+function makeService(opts: {
+  blocks: ReturnType<typeof blockRow>[];
+  assignedCoachIds?: string[];
+  departureAt?: Date | null;
+  bookingSeats?: any[];
+}) {
+  const prisma = {
+    bookingSeat: { findMany: jest.fn().mockResolvedValue(opts.bookingSeats ?? []) },
+    seatHold: { findMany: jest.fn().mockResolvedValue([]) },
+    trainSchedule: {
+      findUnique: jest.fn().mockResolvedValue(
+        opts.departureAt === null ? null : { departureAt: opts.departureAt ?? DEPARTURE },
+      ),
+    },
+    coachAssignment: {
+      findMany: jest
+        .fn()
+        .mockResolvedValue(
+          (opts.assignedCoachIds ?? [passengerCoach.id, diningCoach.id]).map((coachId) => ({
+            coachId,
+          })),
+        ),
+    },
+    seatBlock: { findMany: jest.fn().mockResolvedValue(opts.blocks) },
+  };
+
+  return {
+    service: new ReportsService(prisma as any, {} as any, {} as any),
+    prisma,
+  };
+}
+
+describe('getSeatStatusReport — blocked seats', () => {
+  it('counts a schedule-scoped block on a passenger coach', async () => {
+    const { service } = makeService({ blocks: [blockRow()] });
+
+    const report = await service.getSeatStatusReport(SCHEDULE_ID);
+
+    expect(report.summary.blockedCount).toBe(1);
+    expect(report.blockedSeats).toHaveLength(1);
+    expect(report.blockedSeats[0]).toMatchObject({ coachNumber: 'C1', seatNumber: '1' });
+  });
+
+  it('leaves out a dining coach whose type carries a display name', async () => {
+    const { service } = makeService({
+      blocks: [blockRow({ seat: seatRow('seat-d', diningCoach, '1') })],
+    });
+
+    const report = await service.getSeatStatusReport(SCHEDULE_ID);
+
+    expect(report.summary.blockedCount).toBe(0);
+    expect(report.blockedSeats).toEqual([]);
+  });
+
+  it('leaves out placeholder seats', async () => {
+    const { service } = makeService({
+      blocks: [blockRow({ seat: seatRow('seat-p', passengerCoach, '-1') })],
+    });
+
+    expect((await service.getSeatStatusReport(SCHEDULE_ID)).summary.blockedCount).toBe(0);
+  });
+
+  it('counts a global block on a coach assigned to this train', async () => {
+    const { service } = makeService({
+      blocks: [blockRow({ scheduleId: null })],
+      assignedCoachIds: [passengerCoach.id],
+    });
+
+    expect((await service.getSeatStatusReport(SCHEDULE_ID)).summary.blockedCount).toBe(1);
+  });
+
+  it('ignores a global block whose coach never joined this train', async () => {
+    const { service } = makeService({
+      blocks: [blockRow({ scheduleId: null })],
+      assignedCoachIds: ['some-other-coach'],
+    });
+
+    expect((await service.getSeatStatusReport(SCHEDULE_ID)).summary.blockedCount).toBe(0);
+  });
+
+  it('ignores a global block that had already been lifted by departure', async () => {
+    const { service } = makeService({
+      blocks: [
+        blockRow({
+          scheduleId: null,
+          unblockAt: new Date('2026-03-05T00:00:00.000Z'),
+        }),
+      ],
+      assignedCoachIds: [passengerCoach.id],
+    });
+
+    expect((await service.getSeatStatusReport(SCHEDULE_ID)).summary.blockedCount).toBe(0);
+  });
+
+  it('ignores a global block created after departure', async () => {
+    const { service } = makeService({
+      blocks: [blockRow({ scheduleId: null, blockedAt: new Date('2026-03-20T00:00:00.000Z') })],
+      assignedCoachIds: [passengerCoach.id],
+    });
+
+    expect((await service.getSeatStatusReport(SCHEDULE_ID)).summary.blockedCount).toBe(0);
+  });
+
+  it('counts a seat blocked both globally and for this schedule once', async () => {
+    const seat = seatRow('seat-1', passengerCoach, '1');
+    const { service } = makeService({
+      blocks: [
+        blockRow({ id: 'block-schedule', seat, reason: 'Crew seat' }),
+        blockRow({ id: 'block-global', scheduleId: null, seat, reason: 'Broken armrest' }),
+      ],
+      assignedCoachIds: [passengerCoach.id],
+    });
+
+    const report = await service.getSeatStatusReport(SCHEDULE_ID);
+
+    expect(report.summary.blockedCount).toBe(1);
+    // The schedule-scoped block is the more specific statement, so it is the one shown.
+    expect(report.blockedSeats[0].reason).toBe('Crew seat');
+  });
+
+  it('reports nothing blocked when the schedule does not exist', async () => {
+    const { service } = makeService({
+      blocks: [blockRow({ scheduleId: null })],
+      departureAt: null,
+    });
+
+    expect((await service.getSeatStatusReport(SCHEDULE_ID)).summary.blockedCount).toBe(0);
+  });
+
+  it('asks the database only for non-maintenance, non-ticketing blocks', async () => {
+    const { service, prisma } = makeService({ blocks: [] });
+
+    await service.getSeatStatusReport(SCHEDULE_ID);
+
+    const where = prisma.seatBlock.findMany.mock.calls[0][0].where;
+    expect(where.NOT).toEqual([
+      { reason: { startsWith: 'MAINTENANCE:' } },
+      { reason: { startsWith: 'Booked in tickets' } },
+    ]);
+  });
+});
+
+describe('getSeatStatusReport — booked seats', () => {
+  const booking = {
+    bookingRef: 'BK-1',
+    status: 'CONFIRMED',
+    totalMinor: 20000,
+    currency: 'ETB',
+    createdAt: new Date('2026-03-01T00:00:00.000Z'),
+    paymentIntent: { status: 'SUCCEEDED' },
+  };
+
+  it('keeps dining-coach seats out of the paid and unpaid counts', async () => {
+    const { service } = makeService({
+      blocks: [],
+      bookingSeats: [
+        {
+          passengerName: 'Abebe',
+          passengerCategory: 'ADULT',
+          fareMinor: 20000,
+          booking,
+          seat: seatRow('seat-1', passengerCoach, '1'),
+        },
+        {
+          passengerName: 'Diner',
+          passengerCategory: 'ADULT',
+          fareMinor: 0,
+          booking,
+          seat: seatRow('seat-d', diningCoach, '1'),
+        },
+        {
+          passengerName: 'Kebede',
+          passengerCategory: 'ADULT',
+          fareMinor: 20000,
+          booking: { ...booking, status: 'PENDING_PAYMENT', paymentIntent: null },
+          seat: seatRow('seat-2', passengerCoach, '2'),
+        },
+      ],
+    });
+
+    const report = await service.getSeatStatusReport(SCHEDULE_ID);
+
+    expect(report.summary.paidCount).toBe(1);
+    expect(report.summary.unpaidCount).toBe(1);
+    expect(report.paidSeats.map((s) => s.passengerName)).toEqual(['Abebe']);
+  });
+});
diff --git a/apps/edr-passenger-web/backoffice/src/app/dashboard/page.tsx b/apps/edr-passenger-web/backoffice/src/app/dashboard/page.tsx
index 649796cc5..7eede0089 100644
--- a/apps/edr-passenger-web/backoffice/src/app/dashboard/page.tsx
+++ b/apps/edr-passenger-web/backoffice/src/app/dashboard/page.tsx
@@ -10,9 +10,7 @@ import {
   Banknote,
   ArrowRight,
   ScanLine,
-  Ban,
 } from "lucide-react";
-import { SEAT_BLOCK_REASON_CATEGORY_LABELS } from "@edr/types";
 import { dashboardApi } from "@/lib/api/dashboard";
 import { apiClient } from "@/lib/api-client";
 import { formatCurrency } from "@/lib/utils";
@@ -163,10 +161,6 @@ function DashboardPageContent() {
       return rate !== null ? sum + Math.round(totalMinor * rate) : sum;
     }, 0);
 
-  const blockedLoss = stats?.blockedSeatRevenueLoss;
-  // Never summed across currencies — each is shown on its own line, largest first.
-  const blockedLossRows = blockedLoss?.lossByCurrency ?? [];
-
   const normalRows = stats?.revenueByCurrency ?? [];
   const packageRows = stats?.packageRevenueByCurrency ?? [];
   const normalGrand = calcGrand(normalRows);
@@ -326,73 +320,6 @@ function DashboardPageContent() {
             </>
           )}
         </div>
-
-        {/* Blocked-seat revenue loss — rides the same backoffice-stats payload, so the
-            dashboard makes no extra request for it. */}
-        <div className="card flex flex-col gap-3 border-rose-200 bg-rose-50/60 dark:border-rose-900/50 dark:bg-rose-950/20">
-          <div className="flex items-center gap-2">
-            <div className="rounded-lg bg-rose-100 dark:bg-rose-900/40 p-1.5">
-              <Ban className="h-4 w-4 text-rose-600 dark:text-rose-400" />
-            </div>
-            <span className="text-xs font-semibold uppercase tracking-wider text-rose-700 dark:text-rose-400">
-              Blocked Seats / Revenue Not Collected
-            </span>
-            <span className="ml-auto text-[11px] text-muted-foreground">
-              {blockedLoss?.periodDays ? `Last ${blockedLoss.periodDays}d` : "All time"}
-            </span>
-          </div>
-          {statsLoading ? (
-            <p className="text-muted-foreground text-sm">Loading…</p>
-          ) : (
-            <>
-              {blockedLossRows.length === 0 ? (
-                <p className="text-3xl font-bold text-foreground tabular-nums">
-                  {formatCurrency(0, "ETB")}
-                </p>
-              ) : (
-                blockedLossRows.map((row, i) => (
-                  <p
-                    key={row.currency}
-                    className={
-                      i === 0
-                        ? "text-3xl font-bold text-rose-600 dark:text-rose-400 tabular-nums"
-                        : "text-lg font-semibold text-rose-600/80 dark:text-rose-400/80 tabular-nums"
-                    }
-                  >
-                    {formatCurrency(row.estimatedLossMinor, row.currency)}
-                  </p>
-                ))
-              )}
-              <p className="text-xs text-muted-foreground -mt-1">
-                Estimated potential revenue never earned
-              </p>
-              <div className="flex flex-col gap-2 border-t border-border pt-3">
-                <div className="flex items-center justify-between">
-                  <span className="text-xs text-muted-foreground">Seats blocked</span>
-                  <span className="text-sm font-semibold text-foreground tabular-nums">
-                    {(blockedLoss?.blockedSeatCount ?? 0).toLocaleString()} across{" "}
-                    {(blockedLoss?.schedulesAffected ?? 0).toLocaleString()} schedules
-                  </span>
-                </div>
-                <div className="flex items-center justify-between">
-                  <span className="text-xs text-muted-foreground">Top reason</span>
-                  <span className="text-sm font-semibold text-foreground">
-                    {blockedLoss?.topReasonCategory
-                      ? (SEAT_BLOCK_REASON_CATEGORY_LABELS[blockedLoss.topReasonCategory] ??
-                        blockedLoss.topReasonCategory)
-                      : "—"}
-                  </span>
-                </div>
-              </div>
-              <Link
-                href="/reports/blocked-seats"
-                className="flex items-center justify-center gap-1.5 rounded-md bg-rose-600 hover:bg-rose-700 dark:bg-rose-600 dark:hover:bg-rose-500 px-3 py-2 text-sm font-semibold text-white shadow-sm transition-colors mt-auto"
-              >
-                View full report <ArrowRight className="h-3.5 w-3.5" />
-              </Link>
-            </>
-          )}
-        </div>
       </div>
 
       {/* Revenue breakdown */}
diff --git a/apps/edr-passenger-web/backoffice/src/lib/api/dashboard.ts b/apps/edr-passenger-web/backoffice/src/lib/api/dashboard.ts
index 0a9737041..bff0eaf08 100644
--- a/apps/edr-passenger-web/backoffice/src/lib/api/dashboard.ts
+++ b/apps/edr-passenger-web/backoffice/src/lib/api/dashboard.ts
@@ -1,5 +1,4 @@
 import { apiClient } from '@/lib/api-client';
-import type { BlockedSeatRevenueLossStat } from '@edr/types';
 import { DashboardStats, RevenueData } from '@/types';
 
 export const dashboardApi = {
@@ -13,7 +12,6 @@ export const dashboardApi = {
       totalPackageTickets: number;
       totalPassengers: number;
       blockedSeatsCount: number;
-      blockedSeatRevenueLoss: BlockedSeatRevenueLossStat;
       revenueByCurrency: { currency: string; totalMinor: number }[];
       packageRevenueByCurrency: { currency: string; totalMinor: number }[];
     }>('/dashboard/backoffice-stats');
diff --git a/apps/edr-passenger-web/portal/tailwind.config.js b/apps/edr-passenger-web/portal/tailwind.config.js
index f9ae9f63d..651afb46f 100644
--- a/apps/edr-passenger-web/portal/tailwind.config.js
+++ b/apps/edr-passenger-web/portal/tailwind.config.js
@@ -86,3 +86,4 @@ export default {
   },
   plugins: [],
 };
+
diff --git a/apps/edr-payment-api/src/modules/cbe-bill/bill-resolver.service.ts b/apps/edr-payment-api/src/modules/cbe-bill/bill-resolver.service.ts
index f46571c6b..342fee04a 100644
--- a/apps/edr-payment-api/src/modules/cbe-bill/bill-resolver.service.ts
+++ b/apps/edr-payment-api/src/modules/cbe-bill/bill-resolver.service.ts
@@ -48,35 +48,23 @@ export function defaultPaymentReason(
     : "Freight invoice";
 }
 
-/**
- * CBE reads Response_Description back to the payer at the counter or in the USSD prompt, so it
- * has to name the thing they are actually holding — a passenger booking or a freight invoice —
- * rather than our internal "bill" abstraction (plan §6.6).
- */
-function subjectOf(referenceType: PaymentReferenceType): string {
-  return referenceType === PaymentReferenceType.BOOKING ? "booking" : "invoice";
-}
-
-export function reasonToDescription(
-  reason: string | null | undefined,
-  referenceType: PaymentReferenceType,
-): string {
-  const subject = subjectOf(referenceType);
+/** Short descriptions per CBE integration request — CBE's channel renders them as-is. */
+export function reasonToDescription(reason: string | null | undefined): string {
   switch (reason) {
     case "ALREADY_PAID":
-      return `This ${subject} has already been paid.`;
+      return "Already paid";
     case "CANCELLED":
-      return `This ${subject} has been cancelled.`;
+      return "Cancelled";
     case "REFUNDED":
-      return `This ${subject} has been refunded.`;
+      return "Refunded";
     case "EXPIRED":
-      return `This ${subject} has expired and can no longer be paid.`;
+      return "Expired";
     // A bill reference we issued whose order has since vanished from the domain app. Same
     // wording as an unknown Bill_Id — from the teller's side it is the same situation.
     case "NOT_FOUND":
-      return "Bill not found.";
+      return "Bill not found";
     default:
-      return `This ${subject} is no longer payable.`;
+      return "Not payable";
   }
 }
 
@@ -135,7 +123,7 @@ export class BillResolverService {
         }`,
       );
       // TRANSIENT so CBE may retry the same End_To_End_Txn_Id once we recover (plan R5).
-      throw new CbeBillError("Service temporarily unavailable.", "TRANSIENT");
+      throw new CbeBillError("Service unavailable", "TRANSIENT");
     }
   }
 }
diff --git a/apps/edr-payment-api/src/modules/cbe-bill/cbe-bill.amount.spec.ts b/apps/edr-payment-api/src/modules/cbe-bill/cbe-bill.amount.spec.ts
new file mode 100644
index 000000000..aabf4f416
--- /dev/null
+++ b/apps/edr-payment-api/src/modules/cbe-bill/cbe-bill.amount.spec.ts
@@ -0,0 +1,22 @@
+import { amountsMatchToTheCent } from "./cbe-bill.service";
+
+describe("amountsMatchToTheCent (CBE payment amount gate)", () => {
+  it("accepts the exact amount", () => {
+    expect(amountsMatchToTheCent(1234.34, 1234.34)).toBe(true);
+  });
+
+  it("rejects a cents-only difference (the 1234.89 vs 1234.34 bug)", () => {
+    expect(amountsMatchToTheCent(1234.89, 1234.34)).toBe(false);
+    expect(amountsMatchToTheCent(1234.35, 1234.34)).toBe(false);
+  });
+
+  it("rejects whole-unit differences", () => {
+    expect(amountsMatchToTheCent(1235.34, 1234.34)).toBe(false);
+  });
+
+  it("absorbs double-precision storage noise", () => {
+    expect(amountsMatchToTheCent(1234.34, 1234.3399999999999)).toBe(true);
+    // classic float artifact: 0.1 + 0.2 !== 0.3
+    expect(amountsMatchToTheCent(0.1 + 0.2, 0.3)).toBe(true);
+  });
+});
diff --git a/apps/edr-payment-api/src/modules/cbe-bill/cbe-bill.controller.ts b/apps/edr-payment-api/src/modules/cbe-bill/cbe-bill.controller.ts
index 46b8f9009..86f8f1475 100644
--- a/apps/edr-payment-api/src/modules/cbe-bill/cbe-bill.controller.ts
+++ b/apps/edr-payment-api/src/modules/cbe-bill/cbe-bill.controller.ts
@@ -22,7 +22,7 @@ import { CbePaymentResponseDto } from "./dto/cbe-payment-response.dto";
  * CBE Unified Bill Payment — the INBOUND surface CBE core banking calls (docs/cbe/). We are
  * the biller: CBE authenticates against /cbe/oauth/token with credentials we issued, then
  * presents the bearer token on /cbe/query and /cbe/payment. Business failures answer HTTP 200
- * with Response_Code "3"; only authentication answers 401 (plan D6/D7).
+ * with Response_Code "2"; only authentication answers 401 (plan D6/D7).
  */
 @ApiTags("CBE Unified Bill (inbound)")
 @Controller("cbe")
diff --git a/apps/edr-payment-api/src/modules/cbe-bill/cbe-bill.service.ts b/apps/edr-payment-api/src/modules/cbe-bill/cbe-bill.service.ts
index 478f60d0c..d7f9eb8d6 100644
--- a/apps/edr-payment-api/src/modules/cbe-bill/cbe-bill.service.ts
+++ b/apps/edr-payment-api/src/modules/cbe-bill/cbe-bill.service.ts
@@ -38,8 +38,15 @@ import {
 /** Postgres unique_violation — the DB-level idempotency backstop firing on a concurrent duplicate. */
 const PG_UNIQUE_VIOLATION = "23505";
 
-/** Mirrors the short-pay tolerance already applied in handlePaymentEvent. */
-const AMOUNT_TOLERANCE = 0.01;
+/**
+ * CBE must pay the bill to the exact cent — compare in integer cents so
+ * double-precision storage noise (1234.34 stored as 1234.33999…) can neither
+ * mask nor fabricate a difference. A relative tolerance is wrong here: 1% of a
+ * 1234.34 bill would wave through anything up to ±12.34.
+ */
+export function amountsMatchToTheCent(a: number, b: number): boolean {
+  return Math.round(a * 100) === Math.round(b * 100);
+}
 
 /**
  * Translate an intent's own terminal state into the same reason vocabulary the domain apps
@@ -59,7 +66,7 @@ function localReason(intent: PaymentIntent): BillNotPayableReason {
 
 /**
  * Orchestration for CBE's three inbound calls (docs/cbe/CBE_IMPLEMENTATION_PLAN.md Phase 3).
- * Business failures return HTTP 200 + Response_Code "3" envelopes (never throw past the
+ * Business failures return HTTP 200 + Response_Code "2" envelopes (never throw past the
  * controller); the exception filter only catches auth, validation, and the unexpected.
  */
 @Injectable()
@@ -130,7 +137,7 @@ export class CbeBillService {
       const billQuery = await this.billResolver.billQuery(intent);
       if (!billQuery.stillPayable) {
         throw new CbeBillError(
-          reasonToDescription(billQuery.reason, intent.referenceType),
+          reasonToDescription(billQuery.reason),
           "BUSINESS",
         );
       }
@@ -184,11 +191,15 @@ export class CbeBillService {
     );
     if (prior) {
       if (prior.tradeStatus === "SUCCESS") {
-        // Replay the stored body verbatim. Never re-settle.
-        return prior.responsePayload as unknown as CbePaymentResponseDto;
+        // Per CBE integration request: a settled End_To_End_Txn_Id never replays the stored
+        // success — every repeat answers "Already paid". Money moved exactly once (the first
+        // call); this only changes what a duplicate hears back. NOTE this diverges from the
+        // original §6.5 replay design: if CBE retries because our SUCCESS response was lost
+        // in transit, it now sees FAILED for a debit we kept — reconcile such cases manually.
+        return mapPaymentFailure(dto, "Already paid");
       }
       if (prior.tradeStatus === "PENDING") {
-        return mapPaymentFailure(dto, "Payment is being processed.");
+        return mapPaymentFailure(dto, "Payment in progress");
       }
       if (prior.failureClass === "BUSINESS") {
         // Final — retrying cannot change the answer. Same End_To_End_Txn_Id was already
@@ -196,7 +207,7 @@ export class CbeBillService {
         // echoing the original reason, which no longer describes this request.
         return mapPaymentFailure(
           dto,
-          `End_To_End_Txn_Id ${dto.End_To_End_Txn_Id} was already processed and failed: ${prior.responseDescription ?? "unknown reason"}.`,
+          `Already processed: ${prior.responseDescription ?? "failed"}`,
         );
       }
       // FAILED + TRANSIENT: allowed retry — fall through and re-run the settlement.
@@ -209,7 +220,7 @@ export class CbeBillService {
     if (settled) {
       return mapPaymentFailure(
         dto,
-        `Invalid transaction reference number ${dto.Cbe_Txn_Ref}.`,
+        "Duplicate transaction ref",
       );
     }
 
@@ -237,7 +248,7 @@ export class CbeBillService {
       } catch (err) {
         if ((err as { code?: string }).code === PG_UNIQUE_VIOLATION) {
           // Concurrent duplicate of the same attempt lost the insert race.
-          return mapPaymentFailure(dto, "Payment is being processed.");
+          return mapPaymentFailure(dto, "Payment in progress");
         }
         throw err;
       }
@@ -248,7 +259,7 @@ export class CbeBillService {
       intent = await this.resolveIntent(dto.Bill_Id);
 
       if (dto.Currency && dto.Currency !== intent.currency) {
-        throw new CbeBillError("Payment currency does not match.", "BUSINESS");
+        throw new CbeBillError("Currency mismatch", "BUSINESS");
       }
 
       // Re-run bill-query — fresh, never cached. Last legitimate point for a synchronous
@@ -256,18 +267,22 @@ export class CbeBillService {
       const billQuery = await this.billResolver.billQuery(intent);
       if (!billQuery.stillPayable) {
         throw new CbeBillError(
-          reasonToDescription(billQuery.reason, intent.referenceType),
+          reasonToDescription(billQuery.reason),
           "BUSINESS",
         );
       }
 
+      // Validate against the freshly-quoted amount — the same figure bill-query
+      // just showed the payer — not the intent's amount asserted at creation,
+      // which can go stale when the domain re-prices the invoice. Fallback to
+      // the intent amount only for domain builds that return no current amount.
+      const expectedAmount = billQuery.currentAmountMinor ?? intent.amountMinor;
       const amount = Number(dto.Amount);
       if (
         !Number.isFinite(amount) ||
-        Math.abs(amount - intent.amountMinor) >
-          intent.amountMinor * AMOUNT_TOLERANCE
+        !amountsMatchToTheCent(amount, expectedAmount)
       ) {
-        throw new CbeBillError("Payment amount does not match.", "BUSINESS");
+        throw new CbeBillError("Amount mismatch", "BUSINESS");
       }
 
       const paidAt = new Date(dto.Timestamp);
@@ -325,10 +340,10 @@ export class CbeBillService {
   private assertIntentPayable(intent: PaymentIntent): void {
     if (intent.status === ProviderPaymentStatus.REQUIRES_ACTION) return;
     if (intent.status === ProviderPaymentStatus.PROCESSING) {
-      throw new CbeBillError("Payment is being processed.", "BUSINESS");
+      throw new CbeBillError("Payment in progress", "BUSINESS");
     }
     throw new CbeBillError(
-      reasonToDescription(localReason(intent), intent.referenceType),
+      reasonToDescription(localReason(intent)),
       "BUSINESS",
     );
   }
@@ -336,11 +351,11 @@ export class CbeBillService {
   /** Check digit first (cheap reject), then the unique bill_reference lookup. */
   private async resolveIntent(billId: string): Promise<PaymentIntent> {
     if (!this.billReferenceService.isValid(billId)) {
-      throw new CbeBillError("Bill not found.", "BUSINESS");
+      throw new CbeBillError("Bill not found", "BUSINESS");
     }
     const intent = await this.intentsRepository.findByBillReference(billId);
     if (!intent || intent.provider !== ProviderMethod.CBE_BILL) {
-      throw new CbeBillError("Bill not found.", "BUSINESS");
+      throw new CbeBillError("Bill not found", "BUSINESS");
     }
     return intent;
   }
diff --git a/apps/edr-payment-api/src/modules/cbe-bill/cbe-exception.filter.ts b/apps/edr-payment-api/src/modules/cbe-bill/cbe-exception.filter.ts
index dcbb5d82a..5024c8cf3 100644
--- a/apps/edr-payment-api/src/modules/cbe-bill/cbe-exception.filter.ts
+++ b/apps/edr-payment-api/src/modules/cbe-bill/cbe-exception.filter.ts
@@ -40,7 +40,7 @@ export class CbeExceptionFilter implements ExceptionFilter {
       response.status(HttpStatus.SERVICE_UNAVAILABLE).json({
         Status: "FAILED",
         Response_Code: "9",
-        Response_Description: "Service temporarily unavailable.",
+        Response_Description: "Service unavailable",
       });
       return;
     }
@@ -54,7 +54,7 @@ export class CbeExceptionFilter implements ExceptionFilter {
           : exception.message;
       response.status(HttpStatus.OK).json({
         Status: "FAILED",
-        Response_Code: "3",
+        Response_Code: "2",
         Response_Description: message || "Invalid request",
       });
       return;
@@ -65,8 +65,8 @@ export class CbeExceptionFilter implements ExceptionFilter {
     );
     response.status(HttpStatus.OK).json({
       Status: "FAILED",
-      Response_Code: "3",
-      Response_Description: "Internal server error.",
+      Response_Code: "2",
+      Response_Description: "Internal error",
     });
   }
 }
diff --git a/apps/edr-payment-api/src/modules/cbe-bill/mappers/cbe-error.mapper.ts b/apps/edr-payment-api/src/modules/cbe-bill/mappers/cbe-error.mapper.ts
index 7cda33117..e2ec58114 100644
--- a/apps/edr-payment-api/src/modules/cbe-bill/mappers/cbe-error.mapper.ts
+++ b/apps/edr-payment-api/src/modules/cbe-bill/mappers/cbe-error.mapper.ts
@@ -16,8 +16,8 @@ export class CbeBillError extends Error {
 }
 
 /**
- * Every failure maps to Response_Code "3" — the AAFDA spec (§2.10, §3.10) defines only
- * 0 (success), 1 (auth), 3 (business); only the description is specific (plan §6.6).
+ * Every failure maps to Response_Code "2" (per current CBE integration requirement; the
+ * original AAFDA plan used 3); only the description is specific (plan §6.6).
  */
 export function toCbeFailure(err: unknown): {
   description: string;
@@ -26,5 +26,5 @@ export function toCbeFailure(err: unknown): {
   if (err instanceof CbeBillError) {
     return { description: err.message, failureClass: err.failureClass };
   }
-  return { description: "Internal server error.", failureClass: "TRANSIENT" };
+  return { description: "Internal error", failureClass: "TRANSIENT" };
 }
diff --git a/apps/edr-payment-api/src/modules/cbe-bill/mappers/cbe-payment.mapper.ts b/apps/edr-payment-api/src/modules/cbe-bill/mappers/cbe-payment.mapper.ts
index d90d94c91..8e6259930 100644
--- a/apps/edr-payment-api/src/modules/cbe-bill/mappers/cbe-payment.mapper.ts
+++ b/apps/edr-payment-api/src/modules/cbe-bill/mappers/cbe-payment.mapper.ts
@@ -27,7 +27,7 @@ export function mapPaymentFailure(
     Cbe_Txn_Ref: request.Cbe_Txn_Ref,
     Destination_Txn_Ref: "",
     Status: "FAILED",
-    Response_Code: "3",
+    Response_Code: "2",
     Response_Description: description,
     Additional_Fields: [],
   };
diff --git a/apps/edr-payment-api/src/modules/cbe-bill/mappers/cbe-query.mapper.ts b/apps/edr-payment-api/src/modules/cbe-bill/mappers/cbe-query.mapper.ts
index 95caadc75..d2153b6a5 100644
--- a/apps/edr-payment-api/src/modules/cbe-bill/mappers/cbe-query.mapper.ts
+++ b/apps/edr-payment-api/src/modules/cbe-bill/mappers/cbe-query.mapper.ts
@@ -48,7 +48,7 @@ export function mapQueryFailure(
     Transaction_Type: "",
     Timestamp: new Date().toISOString(),
     Status: "FAILED",
-    Response_Code: "3",
+    Response_Code: "2",
     Response_Description: description,
     Additional_Fields: [],
   };
diff --git a/deploy/position-type-grant-mapping.sql b/deploy/position-type-grant-mapping.sql
new file mode 100644
index 000000000..901191dd4
--- /dev/null
+++ b/deploy/position-type-grant-mapping.sql
@@ -0,0 +1,119 @@
+-- Position-type grant mapping for the granular permission system rollout.
+-- Grants the NEW granular keys to every hand-curated position type that holds
+-- the old broad key whose routes the new keys took over. Idempotent (unique
+-- constraint on (position_type_id, permission_id) + ON CONFLICT DO NOTHING).
+--
+-- PREREQUISITE: run the seeded API once first (SEED_EDR_ORG=true) so
+-- EdrOrgSeeder has created the new permission rows this script references.
+-- Running it too early is not destructive but silently under-applies: keys that
+-- do not exist yet simply match nothing (measured: 11 of 42 rows land pre-seed,
+-- because invoices:view/export and payments:view already exist on dev). Re-run
+-- after seeding — it is safe to run any number of times.
+--
+-- Verified 2026-08-07 on a virgin restore of the live dev DB: seeded boot, then
+-- this script → 42 rows inserted, second run → 0 rows, final per-key grant
+-- counts identical to the reference environment. Per-user API probes across 20
+-- departmental test accounts confirm the keys resolve through /me and gate
+-- routes correctly.
+
+BEGIN;
+
+-- Helper shape used throughout:
+--   holders of <old key>  =>  also grant <new keys>
+
+-- 1. bookings:view holders => dashboard/read keys that replaced blanket access
+INSERT INTO iam.position_type_permissions (position_type_id, permission_id)
+SELECT DISTINCT ptp.position_type_id, pnew.id
+FROM iam.position_type_permissions ptp
+JOIN iam.permissions pold ON pold.id = ptp.permission_id
+  AND pold.key = 'edr_freight_app:bookings:view'
+JOIN iam.permissions pnew ON pnew.key IN (
+  'edr_freight_app:overview:view',
+  'edr_freight_app:reports:view',
+  'edr_freight_app:invoices:view',
+  'edr_freight_app:invoices:export',
+  'edr_freight_app:payments:view'
+)
+ON CONFLICT (position_type_id, permission_id) DO NOTHING;
+
+-- 2. train_scheduling:update holders => the write actions split out of it
+INSERT INTO iam.position_type_permissions (position_type_id, permission_id)
+SELECT DISTINCT ptp.position_type_id, pnew.id
+FROM iam.position_type_permissions ptp
+JOIN iam.permissions pold ON pold.id = ptp.permission_id
+  AND pold.key = 'edr_freight_app:train_scheduling:update'
+JOIN iam.permissions pnew ON pnew.key IN (
+  'edr_freight_app:train_scheduling:dispatch',
+  'edr_freight_app:train_scheduling:mark_paid',
+  'edr_freight_app:train_scheduling:expire_booking'
+)
+ON CONFLICT (position_type_id, permission_id) DO NOTHING;
+
+-- 3. GL Djibouti clearance holders => final-invoice raise + confirm
+INSERT INTO iam.position_type_permissions (position_type_id, permission_id)
+SELECT DISTINCT ptp.position_type_id, pnew.id
+FROM iam.position_type_permissions ptp
+JOIN iam.permissions pold ON pold.id = ptp.permission_id
+  AND pold.key = 'edr_freight_app:contracts:clearance_dj_actions'
+JOIN iam.permissions pnew ON pnew.key IN (
+  'edr_freight_app:contracts:final_invoice_raise',
+  'edr_freight_app:contracts:final_invoice_confirm'
+)
+ON CONFLICT (position_type_id, permission_id) DO NOTHING;
+
+-- 4. GL Ethiopia clearance holders => final-invoice confirm
+INSERT INTO iam.position_type_permissions (position_type_id, permission_id)
+SELECT DISTINCT ptp.position_type_id, pnew.id
+FROM iam.position_type_permissions ptp
+JOIN iam.permissions pold ON pold.id = ptp.permission_id
+  AND pold.key = 'edr_freight_app:contracts:clearance_et_actions'
+JOIN iam.permissions pnew ON pnew.key = 'edr_freight_app:contracts:final_invoice_confirm'
+ON CONFLICT (position_type_id, permission_id) DO NOTHING;
+
+-- 5. Contract-intake holders (any staff_accept flavour) => edit_document
+INSERT INTO iam.position_type_permissions (position_type_id, permission_id)
+SELECT DISTINCT ptp.position_type_id, pnew.id
+FROM iam.position_type_permissions ptp
+JOIN iam.permissions pold ON pold.id = ptp.permission_id
+  AND pold.key IN (
+    'edr_freight_app:bookings:staff_accept',
+    'edr_freight_app:contracts:staff_accept:bulk',
+    'edr_freight_app:contracts:staff_accept:container'
+  )
+JOIN iam.permissions pnew ON pnew.key = 'edr_freight_app:contracts:edit_document'
+ON CONFLICT (position_type_id, permission_id) DO NOTHING;
+
+-- 6. Support inbox ownership (decision 2026-08-07): marketing department types
+INSERT INTO iam.position_type_permissions (position_type_id, permission_id)
+SELECT pt.id, p.id
+FROM iam.position_types pt
+CROSS JOIN iam.permissions p
+WHERE (pt.name::text ILIKE '%marketing%' OR pt.key ILIKE '%marketing%')
+  AND p.key IN (
+    'edr_freight_app:support:agent_view',
+    'edr_freight_app:support:agent_send'
+  )
+ON CONFLICT (position_type_id, permission_id) DO NOTHING;
+
+-- 7. Companion view keys.
+-- Most freight controllers carry a class-level `<module>:view` guard, and Nest
+-- runs class AND method guards — so a type holding only `<module>:<action>` is
+-- denied before the action key is ever checked. Grant the module's view key
+-- alongside every action key the type already holds. View-only, so it widens
+-- reads within a module the type already operates in, never across modules.
+INSERT INTO iam.position_type_permissions (position_type_id, permission_id)
+SELECT DISTINCT ptp.position_type_id, pview.id
+FROM iam.position_type_permissions ptp
+JOIN iam.permissions pact ON pact.id = ptp.permission_id
+  AND pact.key LIKE 'edr_freight_app:%'
+JOIN iam.permissions pview ON pview.key = regexp_replace(pact.key, ':[^:]+$', ':view')
+ON CONFLICT (position_type_id, permission_id) DO NOTHING;
+
+COMMIT;
+
+-- Verification: expected non-zero counts per new key after running.
+-- SELECT p.key, count(*) FROM iam.position_type_permissions ptp
+-- JOIN iam.permissions p ON p.id = ptp.permission_id
+-- WHERE p.key IN ('edr_freight_app:overview:view','edr_freight_app:support:agent_view',
+--                 'edr_freight_app:train_scheduling:dispatch','edr_freight_app:contracts:final_invoice_raise')
+-- GROUP BY p.key;
diff --git a/docker-compose.yaml b/docker-compose.yaml
index 3659e963f..e40d8b49e 100644
--- a/docker-compose.yaml
+++ b/docker-compose.yaml
@@ -4,6 +4,7 @@
 #
 # Build:  DOCKER_BUILDKIT=1 docker compose build
 # Run:    docker compose up -d
+
 services:
   freight-api:
     build:
diff --git a/integration/src/cbe-bill.it.ts b/integration/src/cbe-bill.it.ts
index 974d00b07..0d1fc7e0e 100644
--- a/integration/src/cbe-bill.it.ts
+++ b/integration/src/cbe-bill.it.ts
@@ -122,15 +122,17 @@ describe("CBE Unified Bill (payment service as biller)", () => {
       End_To_End_Txn_Id: txnId("q404"),
       Bill_Id: "000000000000",
     });
-    // Business failures are HTTP 200 + Response_Code "3" — CBE treats a non-200
+    // Business failures are HTTP 200 + Response_Code "2" — CBE treats a non-200
     // as a channel fault and retries.
     expect(res.status).toBe(200);
-    expect(res.body.Response_Code).toBe("3");
+    expect(res.body.Response_Code).toBe("2");
   });
 
+  let settleBody: Record<string, string>;
+
   it("settles the freight invoice when CBE reports the debit", async () => {
     const invoice = await currentInvoice(invoiceId);
-    const res = await cbe(token, "/cbe/payment", {
+    settleBody = {
       Destination_Api_Name: API_NAME,
       End_To_End_Txn_Id: txnId("p1"),
       Cbe_Txn_Ref: `CBE${Date.now()}`,
@@ -140,7 +142,8 @@ describe("CBE Unified Bill (payment service as biller)", () => {
       Currency: "ETB",
       Full_Name: "IT Payer",
       Phone_No: "+251911000001",
-    });
+    };
+    const res = await cbe(token, "/cbe/payment", settleBody);
     expect(res.status).toBe(200);
     expect(res.body.Response_Code).toBe("0");
 
@@ -154,6 +157,24 @@ describe("CBE Unified Bill (payment service as biller)", () => {
     expect(paid.status).toBe("PAID");
   });
 
+  it("answers 'Already paid' when the settled attempt is sent again verbatim", async () => {
+    const res = await cbe(token, "/cbe/payment", settleBody);
+    expect(res.status).toBe(200);
+    expect(res.body.Status).toBe("FAILED");
+    expect(res.body.Response_Code).toBe("2");
+    expect(res.body.Response_Description).toBe("Already paid");
+  });
+
+  it("answers 'Already paid' when the settled End_To_End_Txn_Id is reused with a different amount", async () => {
+    const res = await cbe(token, "/cbe/payment", {
+      ...settleBody,
+      Amount: "1.00",
+    });
+    expect(res.status).toBe(200);
+    expect(res.body.Response_Code).toBe("2");
+    expect(res.body.Response_Description).toBe("Already paid");
+  });
+
   it("rejects a second debit on the same bill", async () => {
     const res = await cbe(token, "/cbe/payment", {
       Destination_Api_Name: API_NAME,
@@ -165,7 +186,7 @@ describe("CBE Unified Bill (payment service as biller)", () => {
       Currency: "ETB",
     });
     expect(res.status).toBe(200);
-    expect(res.body.Response_Code).toBe("3");
+    expect(res.body.Response_Code).toBe("2");
   });
 
   it("reports an already-paid bill on a later query", async () => {
@@ -175,6 +196,6 @@ describe("CBE Unified Bill (payment service as biller)", () => {
       Bill_Id: billId,
     });
     expect(res.status).toBe(200);
-    expect(res.body.Response_Code).toBe("3");
+    expect(res.body.Response_Code).toBe("2");
   });
 });
diff --git a/packages/types/src/freight/booking-window-ws.ts b/packages/types/src/freight/booking-window-ws.ts
index 3fd3c4d7b..be0dc9c13 100644
--- a/packages/types/src/freight/booking-window-ws.ts
+++ b/packages/types/src/freight/booking-window-ws.ts
@@ -29,6 +29,11 @@ export interface BookingWindowPhaseEvent {
   windowClosesAt: string | null;
   docReviewEndsAt: string | null;
   paymentPhaseEndsAt: string | null;
+  /**
+   * When the payment drain tail ends (paymentPhaseEndsAt + server drain
+   * minutes) — pending payments may still settle until then. Display only.
+   */
+  paymentDrainEndsAt: string | null;
   scheduledDepartureDate: string | null;
 }
 
diff --git a/packages/ui-common/src/components/CountdownTimer/CountdownTimer.tsx b/packages/ui-common/src/components/CountdownTimer/CountdownTimer.tsx
index faadb0adf..1a906d96e 100644
--- a/packages/ui-common/src/components/CountdownTimer/CountdownTimer.tsx
+++ b/packages/ui-common/src/components/CountdownTimer/CountdownTimer.tsx
@@ -1,4 +1,4 @@
-import { Group, Text } from "@mantine/core";
+import { Group, Loader, Text } from "@mantine/core";
 import { Clock } from "lucide-react";
 import { useEffect, useState } from "react";
 
@@ -9,6 +9,14 @@ export interface CountdownTimerProps {
   label?: string;
   /** Text shown once the deadline has passed. */
   expiredText?: string;
+  /**
+   * Optional grace stage: once `deadline` passes, count down to this later
+   * ISO timestamp instead (e.g. the payment drain tail). `expiredText` then
+   * only shows after the grace deadline has also passed.
+   */
+  graceDeadline?: string | null;
+  /** Label shown while counting down the grace stage (e.g. "Payment processing — closes in"). */
+  graceLabel?: string;
   /** Visual size of the time text. */
   size?: "xs" | "sm" | "md" | "lg";
   /** Colour once under this many seconds remain (urgency). Default 300 (5 min). */
@@ -35,37 +43,56 @@ function formatRemaining(ms: number): string {
 /**
  * Live countdown to an ISO deadline. Ticks once a second, shows the remaining
  * time (d/h/m/s), turns red when under `urgentUnderSeconds`, and shows
- * `expiredText` once the deadline is in the past. Display only — enforcement
- * lives server-side.
+ * `expiredText` once the deadline is in the past. When `graceDeadline` is set,
+ * a lapsed main deadline rolls into a calm second-stage countdown (spinner,
+ * no urgency colours) toward it before `expiredText` takes over. Display only
+ * — enforcement lives server-side.
  */
 export function CountdownTimer({
   deadline,
   label,
   expiredText = "Expired",
+  graceDeadline,
+  graceLabel,
   size = "sm",
   urgentUnderSeconds = 300,
 }: CountdownTimerProps) {
-  const [remaining, setRemaining] = useState<number | null>(() =>
-    deadline ? new Date(deadline).getTime() - Date.now() : null,
-  );
+  const [now, setNow] = useState(() => Date.now());
 
   useEffect(() => {
-    if (!deadline) {
-      setRemaining(null);
-      return;
-    }
-    const target = new Date(deadline).getTime();
-    const tick = () => setRemaining(target - Date.now());
-    tick();
-    const id = setInterval(tick, 1000);
+    if (!deadline) return;
+    setNow(Date.now());
+    const id = setInterval(() => setNow(Date.now()), 1000);
     return () => clearInterval(id);
-  }, [deadline]);
+  }, [deadline, graceDeadline]);
 
-  if (!deadline || remaining == null || Number.isNaN(remaining)) {
-    return null;
+  if (!deadline) return null;
+  const target = new Date(deadline).getTime();
+  if (Number.isNaN(target)) return null;
+
+  const remaining = target - now;
+  const expired = remaining <= 0;
+
+  const graceTarget = graceDeadline ? new Date(graceDeadline).getTime() : NaN;
+  const graceRemaining = Number.isNaN(graceTarget) ? 0 : graceTarget - now;
+  const inGrace = expired && graceRemaining > 0;
+
+  if (inGrace) {
+    return (
+      <Group gap={6} align="center" wrap="nowrap">
+        <Loader size={size === "lg" ? 18 : 14} color="blue.7" />
+        {graceLabel && (
+          <Text size={size} c="dimmed">
+            {graceLabel}
+          </Text>
+        )}
+        <Text size={size} fw={600} c="blue.7">
+          {formatRemaining(graceRemaining)}
+        </Text>
+      </Group>
+    );
   }
 
-  const expired = remaining <= 0;
   const urgent = !expired && remaining <= urgentUnderSeconds * 1000;
   const color = expired ? "red.7" : urgent ? "orange.7" : "dimmed";