Merge branch 'alpha' of github.com:Tria-plc/edr-platform into alpha

2026-08-27 22:30:55 +00:00 · 2026-07-24 16:49:50 +03:00
parent 050a08f330 dfef97a718
commit e4b60f28b5
442 changed files with 33423 additions and 7485 deletions
--- a/apps/edr-passenger-api/src/modules/bookings/bookings.service.ts
+++ b/apps/edr-passenger-api/src/modules/bookings/bookings.service.ts
@@ -14,6 +14,7 @@ import { Currency, PassengerCategory, IdDocumentType } from '@prisma/client';
 import { resolveCurrencyFromNationality } from '../fare-engine/fare-engine.dto';
 import { DeleteOperationException } from '../../common/exceptions/delete-operation.exception';
 import { AuditService } from '../../common/audit.service';
+import { resolveBookingSegment } from '../../common/utils/segment-resolver.utils';

 function generateRef(): string {
  const chars = 'ABCDEFGHIJKLMNOPQRSTUVWXYZ';
@@ -140,7 +141,7 @@ export class BookingsService {
        take: pageSize,
        orderBy: { createdAt: 'desc' },
        include: {
-          schedule: { include: { originStation: true, destinationStation: true, train: true } },
+          schedule: { include: { originStation: true, destinationStation: true, train: true, stopTimes: { include: { station: true } } } },
          paymentIntent: true,
          seats: { include: { seat: true } },
          priceTier: { select: { priceMinor: true } },
@@ -148,31 +149,34 @@ export class BookingsService {
      }),
      this.prisma.booking.count({ where }),
    ]);
-    
+
    return {
-      items: items.map(booking => ({
-        id: booking.id,
-        bookingRef: booking.bookingRef,
-        status: booking.status,
-        totalMinor: booking.displayTotalMinor ?? resolvePackageRoundTripTotal(booking, (booking as any).priceTier?.priceMinor, booking.adultCount, booking.childCount),
-        currency: booking.displayCurrency,
-        displayCurrency: booking.displayCurrency,
-        displayTotalMinor: booking.displayTotalMinor,
-        adultCount: booking.adultCount,
-        childCount: booking.childCount,
-        bookingType: booking.bookingType,
-        returnLegStatus: (booking as any).returnLegStatus ?? null,
-        createdAt: booking.createdAt,
-        schedule: {
-          train: booking.schedule.train,
-          originStation: booking.schedule.originStation,
-          destinationStation: booking.schedule.destinationStation,
-          departureAt: booking.schedule.departureAt,
-          arrivalAt: booking.schedule.arrivalAt,
-        },
-        paymentIntent: booking.paymentIntent,
-        seatCount: booking.seats.length,
-      })),
+      items: items.map(booking => {
+        const segment = resolveBookingSegment((booking as any).schedule, (booking as any).originStationId, (booking as any).destinationStationId);
+        return {
+          id: booking.id,
+          bookingRef: booking.bookingRef,
+          status: booking.status,
+          totalMinor: booking.displayTotalMinor ?? resolvePackageRoundTripTotal(booking, (booking as any).priceTier?.priceMinor, booking.adultCount, booking.childCount),
+          currency: booking.displayCurrency,
+          displayCurrency: booking.displayCurrency,
+          displayTotalMinor: booking.displayTotalMinor,
+          adultCount: booking.adultCount,
+          childCount: booking.childCount,
+          bookingType: booking.bookingType,
+          returnLegStatus: (booking as any).returnLegStatus ?? null,
+          createdAt: booking.createdAt,
+          schedule: {
+            train: booking.schedule.train,
+            originStation: segment.origin,
+            destinationStation: segment.destination,
+            departureAt: segment.departureAt,
+            arrivalAt: segment.arrivalAt,
+          },
+          paymentIntent: booking.paymentIntent,
+          seatCount: booking.seats.length,
+        };
+      }),
      meta: {
        page,
        pageSize,
@@ -270,7 +274,7 @@ export class BookingsService {
        take: pageSize,
        orderBy: { createdAt: 'desc' },
        include: {
-          schedule: { include: { originStation: true, destinationStation: true, train: true } },
+          schedule: { include: { originStation: true, destinationStation: true, train: true, stopTimes: { include: { station: true } } } },
          paymentIntent: { select: { method: true, status: true, amountMinor: true, currency: true } },
          seats: { select: { id: true } },
          priceTier: { select: { priceMinor: true } },
@@ -294,7 +298,9 @@ export class BookingsService {
      this.prisma.packageBooking.count({ where: pkgWhere }),
    ]);

-    const mappedBookings = items.map(booking => ({
+    const mappedBookings = items.map(booking => {
+      const segment = resolveBookingSegment((booking as any).schedule, (booking as any).originStationId, (booking as any).destinationStationId);
+      return {
      id: booking.id,
      bookingRef: booking.bookingRef,
      status: booking.status,
@@ -309,14 +315,15 @@ export class BookingsService {
      createdAt: booking.createdAt,
      schedule: {
        train: booking.schedule.train,
-        originStation: booking.schedule.originStation,
-        destinationStation: booking.schedule.destinationStation,
-        departureAt: booking.schedule.departureAt,
-        arrivalAt: booking.schedule.arrivalAt,
+        originStation: segment.origin,
+        destinationStation: segment.destination,
+        departureAt: segment.departureAt,
+        arrivalAt: segment.arrivalAt,
      },
      payment: booking.paymentIntent ?? undefined,
      seatCount: booking.seats.length,
-    }));
+      };
+    });

    const mappedPkg = pkgItems.map((b: any) => ({
      id: b.id,
@@ -397,7 +404,7 @@ export class BookingsService {
        take: pageSize,
        orderBy: { createdAt: 'desc' },
        include: {
-          schedule: { include: { originStation: true, destinationStation: true, train: true } },
+          schedule: { include: { originStation: true, destinationStation: true, train: true, stopTimes: { include: { station: true } } } },
          paymentIntent: true,
          seats: { include: { seat: true } },
          priceTier: { select: { priceMinor: true } },
@@ -405,9 +412,11 @@ export class BookingsService {
      }),
      this.prisma.booking.count({ where }),
    ]);
-    
+
    return {
-      items: items.map(booking => ({
+      items: items.map(booking => {
+        const segment = resolveBookingSegment((booking as any).schedule, (booking as any).originStationId, (booking as any).destinationStationId);
+        return {
        id: booking.id,
        bookingRef: booking.bookingRef,
        status: booking.status,
@@ -422,14 +431,15 @@ export class BookingsService {
        createdAt: booking.createdAt,
        schedule: {
          train: booking.schedule.train,
-          originStation: booking.schedule.originStation,
-          destinationStation: booking.schedule.destinationStation,
-          departureAt: booking.schedule.departureAt,
-          arrivalAt: booking.schedule.arrivalAt,
+          originStation: segment.origin,
+          destinationStation: segment.destination,
+          departureAt: segment.departureAt,
+          arrivalAt: segment.arrivalAt,
        },
        paymentIntent: booking.paymentIntent,
        seatCount: booking.seats.length,
-      })),
+        };
+      }),
      meta: {
        page,
        pageSize,
@@ -532,7 +542,7 @@ export class BookingsService {
          orderBy: { createdAt: 'desc' },
          include: {
            passenger: { select: { id: true, iamUserId: true } },
-            schedule: { include: { originStation: true, destinationStation: true, train: true } },
+            schedule: { include: { originStation: true, destinationStation: true, train: true, stopTimes: { include: { station: true } } } },
            paymentIntent: true,
            seats: { include: { seat: true } },
            priceTier: { select: { priceMinor: true } },
@@ -554,9 +564,10 @@ export class BookingsService {
        const iam = booking.passenger?.iamUserId ? iamMap.get(booking.passenger.iamUserId) : undefined;
        const passengerDetails = booking.seats.map((s: any) => ({ name: s.passengerName, category: s.passengerCategory }));
        const uniquePassengers = Array.from(new Map(passengerDetails.map((p: any) => [p.name, p])).values());
+        const segment = booking.schedule ? resolveBookingSegment(booking.schedule, booking.originStationId, booking.destinationStationId) : null;
        return {
          id: booking.id, bookingRef: booking.bookingRef, status: booking.status,
-          totalMinor: booking.displayTotalMinor ?? resolvePackageRoundTripTotal(booking, booking.priceTier?.priceMinor, booking.adultCount, booking.childCount), 
+          totalMinor: booking.displayTotalMinor ?? resolvePackageRoundTripTotal(booking, booking.priceTier?.priceMinor, booking.adultCount, booking.childCount),
          currency: booking.displayCurrency,
          displayCurrency: booking.displayCurrency, displayTotalMinor: booking.displayTotalMinor,
          contactEmail: booking.contactEmail, contactPhone: booking.contactPhone,
@@ -567,11 +578,11 @@ export class BookingsService {
          passenger: iam ? { fullName: iam.name?.en ?? iam.name?.am ?? null, email: iam.email, phone: iam.phone_number } : null,
          passengerNames: [...new Set(booking.seats.map((s: any) => s.passengerName))],
          passengers: uniquePassengers,
-          schedule: booking.schedule ? {
+          schedule: segment ? {
            train: booking.schedule.train,
-            originStation: booking.schedule.originStation,
-            destinationStation: booking.schedule.destinationStation,
-            departureAt: booking.schedule.departureAt,
+            originStation: segment.origin,
+            destinationStation: segment.destination,
+            departureAt: segment.departureAt,
          } : null,
          paymentIntent: booking.paymentIntent,
          seatCount: booking.seats.length,
@@ -715,16 +726,15 @@ export class BookingsService {
          verifaydaVerified: s.verifaydaVerified,
          seat: s.seat ? { seatNumber: s.seat.seatNumber, coach: { number: s.seat.coach?.number ?? null } } : null,
        })),
-        schedule: {
-          train: booking.schedule.train,
-          originStation: (booking as any).originStationId
-            ? ((booking.schedule as any).stopTimes?.find((s: any) => s.stationId === (booking as any).originStationId)?.station ?? booking.schedule.originStation)
-            : booking.schedule.originStation,
-          destinationStation: (booking as any).destinationStationId
-            ? ((booking.schedule as any).stopTimes?.find((s: any) => s.stationId === (booking as any).destinationStationId)?.station ?? booking.schedule.destinationStation)
-            : booking.schedule.destinationStation,
-          departureAt: booking.schedule.departureAt,
-        },
+        schedule: (() => {
+          const segment = resolveBookingSegment(booking.schedule, (booking as any).originStationId, (booking as any).destinationStationId);
+          return {
+            train: booking.schedule.train,
+            originStation: segment.origin,
+            destinationStation: segment.destination,
+            departureAt: segment.departureAt,
+          };
+        })(),
        paymentIntent: booking.paymentIntent,
        seatCount: booking.seats.length,
      };
@@ -865,6 +875,9 @@ export class BookingsService {
    const allFaresProvided = seatedPassengers.length > 0 && seatedPassengers.every(p => p.seatFareMinor != null);
    let resolvedTotalMinor: number;
    let displayTotalMinor: number;
+    // True when the total came from a client-summed subtotal (per-seat sum or reviewedTotalMinor),
+    // which the portal computes UNDISCOUNTED — the promo must still be applied to it (H-13).
+    let usedClientSubtotal = false;

    if (allFaresProvided && !dto.packageId) {
      // Server has every passenger's berth fare — sum is the authoritative display total.
@@ -872,6 +885,7 @@ export class BookingsService {
      resolvedTotalMinor = displayCurrency !== Currency.ETB
        ? await this.currencyService.convertAmount(displayTotalMinor, displayCurrency, Currency.ETB)
        : displayTotalMinor;
+      usedClientSubtotal = true;
      if (dto.reviewedTotalMinor != null && dto.reviewedTotalMinor !== displayTotalMinor) {
        this.logger.warn(`createOneWayBooking: reviewedTotalMinor=${dto.reviewedTotalMinor} ignored — using server-computed sum=${displayTotalMinor}`);
      }
@@ -893,13 +907,35 @@ export class BookingsService {
      resolvedTotalMinor = displayCurrency !== Currency.ETB
        ? await this.currencyService.convertAmount(dto.reviewedTotalMinor, displayCurrency, Currency.ETB)
        : dto.reviewedTotalMinor;
+      usedClientSubtotal = true;
    } else {
      resolvedTotalMinor = fareCalculation.totalMinor;
      displayTotalMinor = displayCurrency !== Currency.ETB
        ? await this.currencyService.convertAmount(resolvedTotalMinor, Currency.ETB, displayCurrency)
        : resolvedTotalMinor;
    }
-    this.logger.log(`createOneWayBooking: resolvedTotalMinor=${resolvedTotalMinor} displayTotalMinor=${displayTotalMinor} displayCurrency=${displayCurrency} (reviewedTotalMinor=${dto.reviewedTotalMinor} allFaresProvided=${allFaresProvided} fareEngine=${fareCalculation.totalMinor})`);
+
+    // H-13 fix: the portal sums UNDISCOUNTED per-passenger fares into the total it sends, silently
+    // dropping the promo the fare engine recognized (the discount lives only in the fare-breakdown).
+    // When the total came from that client subtotal, apply the authoritative promo discount so the
+    // customer is charged the discounted price. No-op when no promo applies (discountMinor === 0).
+    // The fallback branch above already books fareCalculation.totalMinor (discount included), so it is
+    // excluded via usedClientSubtotal to avoid double-subtracting.
+    if (usedClientSubtotal && fareCalculation.discountMinor > 0) {
+      resolvedTotalMinor = Math.max(0, resolvedTotalMinor - fareCalculation.discountMinor);
+      const discountDisplayMinor = displayCurrency !== Currency.ETB
+        ? await this.currencyService.convertAmount(fareCalculation.discountMinor, Currency.ETB, displayCurrency)
+        : fareCalculation.discountMinor;
+      displayTotalMinor = Math.max(0, displayTotalMinor - discountDisplayMinor);
+    }
+    this.logger.log(`createOneWayBooking: resolvedTotalMinor=${resolvedTotalMinor} displayTotalMinor=${displayTotalMinor} displayCurrency=${displayCurrency} (reviewedTotalMinor=${dto.reviewedTotalMinor} allFaresProvided=${allFaresProvided} discountMinor=${fareCalculation.discountMinor} fareEngine=${fareCalculation.totalMinor})`);
+
+    // C-1 guard: never charge less than the server-recomputed authoritative fare. resolvedTotalMinor
+    // is the ETB charge basis; fareCalculation.totalMinor is the authoritative ETB fare (already net
+    // of promo/loyalty/free-child). A client that forges seatFareMinor / reviewedTotalMinor below it
+    // is rejected. Floor (not equality) so legitimate berth surcharges — which only raise the total —
+    // still pass; the tolerance absorbs FX-conversion rounding.
+    this.assertTotalNotUnderAuthoritative(resolvedTotalMinor, fareCalculation.totalMinor, 'createOneWayBooking');

    const booking = await this.prisma.booking.create({
      data: {
@@ -911,7 +947,9 @@ export class BookingsService {
        status: 'PENDING_PAYMENT',
        bookingType: 'ONE_WAY',
        totalMinor: resolvedTotalMinor,
-        currency: displayCurrency,
+        // Charge basis is ETB (resolvedTotalMinor). The passenger's currency and amount live in
+        // displayCurrency/displayTotalMinor — keep currency coherent with totalMinor's units.
+        currency: Currency.ETB,
        adultCount,
        childCount,
        displayCurrency,
@@ -1030,6 +1068,9 @@ export class BookingsService {
      loyaltyMinor = (dto.loyaltyRedemptionPoints ?? 0) * 10;
      totalMinor = Math.max(0, combinedBaseFareMinor - discountMinor - loyaltyMinor);
    }
+    // C-1 guard: authoritative ETB fare for both legs, captured before the client-driven branches
+    // below may overwrite totalMinor with a per-seat sum or reviewedTotalMinor.
+    const authoritativeTotalMinor = totalMinor;
    const taxesMinor = 0;

    const displayCurrency = dto.displayCurrency || resolveCurrencyFromNationality(passengersData[0]?.nationality);
@@ -1095,6 +1136,9 @@ export class BookingsService {
        : dto.reviewedTotalMinor;
    }

+    // C-1 guard: never charge less than the server-recomputed authoritative round-trip fare.
+    this.assertTotalNotUnderAuthoritative(totalMinor, authoritativeTotalMinor, 'createRoundTripBooking');
+
    const booking = await this.prisma.booking.create({
      data: {
        bookingRef: generateRef(),
@@ -1105,7 +1149,7 @@ export class BookingsService {
        status: 'PENDING_PAYMENT',
        bookingType: 'ROUND_TRIP',
        totalMinor,
-        currency: displayCurrency,
+        currency: Currency.ETB, // ETB charge basis; passenger currency in displayCurrency/displayTotalMinor
        adultCount,
        childCount,
        displayCurrency,
@@ -1298,7 +1342,7 @@ export class BookingsService {
        status: 'PENDING_PAYMENT',
        bookingType: 'TRANSIT',
        totalMinor,
-        currency: displayCurrency,
+        currency: Currency.ETB, // ETB charge basis; passenger currency in displayCurrency/displayTotalMinor
        adultCount,
        childCount,
        displayCurrency,
@@ -1508,7 +1552,7 @@ export class BookingsService {
        destinationStationId: dto.leg2DestinationStationId,
        status: 'PENDING_PAYMENT',
        bookingType: 'ROUND_TRIP_TRANSIT',
-        totalMinor, currency: displayCurrency, adultCount, childCount, displayCurrency, displayTotalMinor,
+        totalMinor, currency: Currency.ETB, adultCount, childCount, displayCurrency, displayTotalMinor, // ETB charge basis; passenger currency in displayCurrency/displayTotalMinor
        // Outbound transit leg-2
        leg2ScheduleId: dto.leg2ScheduleId,
        leg2OriginStationId: dto.transitStationId,
@@ -1677,6 +1721,21 @@ export class BookingsService {
    };
  }

+  /**
+   * C-1 protection: reject a booking whose ETB charge basis is below the server-recomputed
+   * authoritative fare. A floor (not equality) so legitimate berth surcharges — which only raise
+   * the total — still pass; a 1% tolerance absorbs FX-conversion rounding. A forged seatFareMinor /
+   * reviewedTotalMinor that lowers the charge (e.g. to 1 or 0) is refused with a 400 and nothing is
+   * persisted.
+   */
+  private assertTotalNotUnderAuthoritative(resolvedTotalMinor: number, authoritativeMinor: number, context: string): void {
+    const tolerance = Math.max(1, Math.round(authoritativeMinor * 0.01));
+    if (resolvedTotalMinor < authoritativeMinor - tolerance) {
+      this.logger.warn(`${context}: rejecting booking — resolvedTotalMinor=${resolvedTotalMinor} below authoritative fare=${authoritativeMinor}`);
+      throw new BadRequestException('Booking total does not match the authoritative fare');
+    }
+  }
+
  private async calculateFare(
    scheduleId: string,
    seatClassId: string,
@@ -1801,35 +1860,6 @@ export class BookingsService {
    );
  }

-  // Resolves the passenger's actual boarding/alighting stations AND times for one leg
-  // from originStationId/destinationStationId (set when the booking covers only part of
-  // a longer multi-stop schedule, e.g. train runs A→D but the passenger booked B→D) via
-  // the schedule's stopTimes, falling back to the schedule's own full-route endpoints/
-  // times when there's no segment override (older records, or a booking that covers the
-  // whole run). Station resolution mirrors notifications.service.ts's
-  // resolveSegmentStations (already applied to SMS/email); the departureAt/arrivalAt
-  // resolution mirrors search.service.ts's leg construction (originStop.plannedDepartureAt
-  // / destStop.plannedArrivalAt) — this brings the booking API (voucher, detail page,
-  // confirmation) to the same behavior search results already have, instead of always
-  // showing the train's full-route span.
-  private resolveSegmentStations(
-    schedule: any,
-    originStationId: string | null | undefined,
-    destinationStationId: string | null | undefined,
-  ): { origin: any; destination: any; departureAt: any; arrivalAt: any } {
-    const stopTimes: any[] = schedule?.stopTimes ?? [];
-    const findStop = (stationId: string | null | undefined) =>
-      stationId && stopTimes.length > 0 ? stopTimes.find((st: any) => st.stationId === stationId) : undefined;
-    const originStop = findStop(originStationId);
-    const destStop = findStop(destinationStationId);
-    return {
-      origin: originStop?.station ?? schedule?.originStation ?? null,
-      destination: destStop?.station ?? schedule?.destinationStation ?? null,
-      departureAt: originStop?.plannedDepartureAt ?? schedule?.departureAt ?? null,
-      arrivalAt: destStop?.plannedArrivalAt ?? schedule?.arrivalAt ?? null,
-    };
-  }
-
  async getByRef(bookingRefOrId: string) {
    const isUuid = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i.test(bookingRefOrId);
    const booking = await this.prisma.booking.findUnique({
@@ -1938,13 +1968,13 @@ export class BookingsService {
      if (refreshed) Object.assign(booking, refreshed);
    }

-    const outboundSegment = this.resolveSegmentStations(
+    const outboundSegment = resolveBookingSegment(
      (booking as any).schedule,
      (booking as any).originStationId,
      (booking as any).destinationStationId,
    );
    const returnSegment = (booking as any).returnSchedule
-      ? this.resolveSegmentStations(
+      ? resolveBookingSegment(
          (booking as any).returnSchedule,
          (booking as any).returnOriginStationId,
          (booking as any).returnDestinationStationId,
--- a/apps/edr-passenger-api/src/modules/bookings/guest-booking.service.ts
+++ b/apps/edr-passenger-api/src/modules/bookings/guest-booking.service.ts
@@ -1,4 +1,4 @@
-import { Injectable, BadRequestException, NotFoundException } from '@nestjs/common';
+import { Injectable, BadRequestException, NotFoundException, Logger } from '@nestjs/common';
 import { PrismaService } from '../../common/prisma.service';
 import { SeatsService } from '../seats/seats.service';
 import { VerifaydaService } from '../verifayda/verifayda.service';
@@ -8,9 +8,22 @@ import { FareEngineService } from '../fare-engine/fare-engine.service';
 import { EventEmitter2 } from '@nestjs/event-emitter';
 import { CreateGuestBookingDto, SavedPassengerProfileDto } from './guest-booking.dto';
 import { Currency, PassengerCategory, IdDocumentType } from '@prisma/client';
+import { resolveCheckinCutoff } from '../../common/utils/checkin-cutoff.utils';

-/** Booking cutoff: reject new bookings within this many ms of departure. */
-const BOOKING_CUTOFF_MS = 30 * 60 * 1000;
+/**
+ * Throws if the given boarding stop's own configurable check-in cutoff (route/stop
+ * checkinMinutesBefore, same mechanism the seat hold and search results already enforce) has
+ * passed. Must be checked against the actual boarding stop, not the schedule's origin — a
+ * downstream stop's cutoff is independent of how long ago the train left its origin.
+ */
+function assertWithinCheckinCutoff(schedule: any, stopTime: any, stationId: string | null | undefined): void {
+  const { cutoffAt, checkinMinutes } = resolveCheckinCutoff(schedule, stopTime, stationId);
+  if (Date.now() >= cutoffAt.getTime()) {
+    throw new BadRequestException(
+      `Bookings are not accepted within ${checkinMinutes} minute${checkinMinutes !== 1 ? 's' : ''} of departure`,
+    );
+  }
+}

 function generateRef(): string {
  const chars = 'ABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789';
@@ -42,6 +55,8 @@ function calculateAge(dateOfBirth: Date): number {

@Injectable()
 export class GuestBookingService {
+  private readonly logger = new Logger(GuestBookingService.name);
+
  constructor(
    private prisma: PrismaService,
    private seatsService: SeatsService,
@@ -52,6 +67,21 @@ export class GuestBookingService {
    private eventEmitter: EventEmitter2,
  ) { }

+  /**
+   * C-1 protection (guest path): reject a booking whose ETB charge basis is below the
+   * server-recomputed authoritative fare. A floor (not equality) so legitimate berth surcharges —
+   * which only raise the total — still pass; a 1% tolerance absorbs FX-conversion rounding. A forged
+   * seatFareMinor / reviewedTotalMinor that lowers the charge (e.g. to 0) is refused with a 400 and
+   * nothing is persisted.
+   */
+  private assertTotalNotUnderAuthoritative(resolvedTotalMinor: number, authoritativeMinor: number, context: string): void {
+    const tolerance = Math.max(1, Math.round(authoritativeMinor * 0.01));
+    if (resolvedTotalMinor < authoritativeMinor - tolerance) {
+      this.logger.warn(`${context}: rejecting booking — resolvedTotalMinor=${resolvedTotalMinor} below authoritative fare=${authoritativeMinor}`);
+      throw new BadRequestException('Booking total does not match the authoritative fare');
+    }
+  }
+
  async createGuestBooking(dto: CreateGuestBookingDto, req?: any) {
    // Enrich passengers with phone/email from SavedPassengerProfile when not supplied inline.
    // The portal calls /passengers/save-details before booking but doesn't re-send contact
@@ -90,20 +120,22 @@ export class GuestBookingService {
        originStation: true,
        destinationStation: true,
        stopTimes: { include: { station: true }, orderBy: { sequence: 'asc' } },
+        route: { include: { stops: true } },
      },
    });
    if (!schedule) throw new NotFoundException('Schedule not found');

-    if (Date.now() >= schedule.departureAt.getTime() - BOOKING_CUTOFF_MS) {
-      throw new BadRequestException('Bookings are not accepted within 30 minutes of departure');
-    }
-
    const originStop = schedule.stopTimes.find(s => s.stationId === dto.originStationId)
      ?? (schedule.stopTimes.length === 0 ? { stationId: schedule.originStationId, sequence: 0, station: schedule.originStation } : undefined);
    const destStop = schedule.stopTimes.find(s => s.stationId === dto.destinationStationId)
      ?? (schedule.stopTimes.length === 0 ? { stationId: schedule.destinationStationId, sequence: 1, station: schedule.destinationStation } : undefined);
    if (!originStop || !destStop) throw new NotFoundException('Origin or destination not found');

+    // Cut off relative to the passenger's actual boarding stop, using the same
+    // configurable per-stop/route checkinMinutesBefore that already gated the seat hold
+    // and the search result — not a separate, hardcoded 30 minutes off the train's origin.
+    assertWithinCheckinCutoff(schedule, originStop, dto.originStationId);
+
    const segmentRoute = `${originStop.station.code}-${destStop.station.code}`;
    const fullRoute = `${schedule.originStation.code}-${schedule.destinationStation.code}`;

@@ -250,6 +282,9 @@ export class GuestBookingService {
      ? await this.currencyService.convertAmount(displayTotalMinor, displayCurrency, Currency.ETB)
      : displayTotalMinor;

+    // C-1 guard: never charge less than the server-recomputed authoritative ETB fare (net of promo).
+    this.assertTotalNotUnderAuthoritative(resolvedTotalMinor, Math.max(0, totalBaseFareMinor - discountMinor), 'createGuestBooking');
+
    // Resolve or create the guest Passenger record
    const firstPassenger = passengersData[0];
    const { guestPassengerId, iamUserId, createdAccount } = await this.resolveGuestPassenger(dto, firstPassenger, req);
@@ -284,7 +319,9 @@ export class GuestBookingService {
        destinationStationId: dto.destinationStationId,
        status: 'PENDING_PAYMENT',
        totalMinor: resolvedTotalMinor,
-        currency: displayCurrency,
+        // Charge basis is ETB (resolvedTotalMinor). The passenger's currency and amount live in
+        // displayCurrency/displayTotalMinor — keep currency coherent with totalMinor's units.
+        currency: Currency.ETB,
        adultCount,
        childCount,
        displayCurrency,
@@ -369,7 +406,7 @@ export class GuestBookingService {
    const [outboundSchedule, returnSchedule] = await Promise.all([
      this.prisma.trainSchedule.findUnique({
        where: { id: dto.scheduleId },
-        include: { originStation: true, destinationStation: true, stopTimes: { include: { station: true }, orderBy: { sequence: 'asc' } } },
+        include: { originStation: true, destinationStation: true, stopTimes: { include: { station: true }, orderBy: { sequence: 'asc' } }, route: { include: { stops: true } } },
      }),
      this.prisma.trainSchedule.findUnique({
        where: { id: dto.returnScheduleId },
@@ -379,10 +416,6 @@ export class GuestBookingService {
    if (!outboundSchedule) throw new NotFoundException('Outbound schedule not found');
    if (!returnSchedule) throw new NotFoundException('Return schedule not found');

-    if (Date.now() >= outboundSchedule.departureAt.getTime() - BOOKING_CUTOFF_MS) {
-      throw new BadRequestException('Bookings are not accepted within 30 minutes of departure');
-    }
-
    const synth = (sched: any, stationId: string, seq: number) => {
      const station = sched.originStationId === stationId ? sched.originStation : sched.destinationStation;
      return { stationId, sequence: seq, station };
@@ -396,6 +429,10 @@ export class GuestBookingService {
    if (!outboundOriginStop || !outboundDestStop) throw new NotFoundException('Outbound origin or destination not found on schedule');
    if (!returnOriginStop || !returnDestStop) throw new NotFoundException('Return origin or destination not found on schedule');

+    // Cut off relative to the passenger's actual boarding stop, using the same configurable
+    // per-stop/route checkinMinutesBefore that already gated the seat hold and search result.
+    assertWithinCheckinCutoff(outboundSchedule, outboundOriginStop, dto.originStationId);
+
    const outboundSegmentRoute = `${outboundOriginStop.station.code}-${outboundDestStop.station.code}`;
    const outboundFullRoute = `${outboundSchedule.originStation.code}-${outboundSchedule.destinationStation.code}`;
    const returnSegmentRoute = `${returnOriginStop.station.code}-${returnDestStop.station.code}`;
@@ -485,6 +522,9 @@ export class GuestBookingService {

    const taxesMinor = 0;
    let totalMinor = Math.max(0, combinedBaseFareMinor - discountMinor);
+    // C-1 guard: authoritative ETB fare for both legs, captured before the client-driven branches
+    // below may overwrite totalMinor with a per-seat sum or reviewedTotalMinor.
+    const authoritativeTotalMinor = totalMinor;

    const displayCurrency = dto.displayCurrency || Currency.ETB;
    let displayTotalMinor = displayCurrency !== Currency.ETB
@@ -540,6 +580,9 @@ export class GuestBookingService {
        : displayTotalMinor;
    }

+    // C-1 guard: never charge less than the server-recomputed authoritative round-trip fare.
+    this.assertTotalNotUnderAuthoritative(totalMinor, authoritativeTotalMinor, 'createGuestRoundTripBooking');
+
    // Create or resolve guest passenger (same as one-way)
    const { guestPassengerId, iamUserId, createdAccount } = await this.resolveGuestPassenger(dto, passengersData[0], req);

@@ -557,7 +600,7 @@ export class GuestBookingService {
        status: 'PENDING_PAYMENT',
        bookingType: 'ROUND_TRIP',
        totalMinor,
-        currency: displayCurrency,
+        currency: Currency.ETB, // ETB charge basis; passenger currency in displayCurrency/displayTotalMinor
        adultCount,
        childCount,
        displayCurrency,
@@ -662,7 +705,7 @@ export class GuestBookingService {
    const [leg1Schedule, leg2Schedule] = await Promise.all([
      this.prisma.trainSchedule.findUnique({
        where: { id: dto.scheduleId },
-        include: { originStation: true, destinationStation: true, stopTimes: { include: { station: true }, orderBy: { sequence: 'asc' } } },
+        include: { originStation: true, destinationStation: true, stopTimes: { include: { station: true }, orderBy: { sequence: 'asc' } }, route: { include: { stops: true } } },
      }),
      this.prisma.trainSchedule.findUnique({
        where: { id: dto.leg2ScheduleId },
@@ -672,10 +715,6 @@ export class GuestBookingService {
    if (!leg1Schedule) throw new NotFoundException('Leg-1 schedule not found');
    if (!leg2Schedule) throw new NotFoundException('Leg-2 schedule not found');

-    if (Date.now() >= leg1Schedule.departureAt.getTime() - BOOKING_CUTOFF_MS) {
-      throw new BadRequestException('Bookings are not accepted within 30 minutes of departure');
-    }
-
    const leg1OriginStop = leg1Schedule.stopTimes.find(s => s.stationId === dto.originStationId);
    const leg1DestStop = leg1Schedule.stopTimes.find(s => s.stationId === dto.transitStationId);
    const leg2OriginStop = leg2Schedule.stopTimes.find(s => s.stationId === dto.transitStationId);
@@ -683,6 +722,10 @@ export class GuestBookingService {
    if (!leg1OriginStop || !leg1DestStop) throw new NotFoundException('Leg-1 origin or transit station not found on schedule');
    if (!leg2OriginStop || !leg2DestStop) throw new NotFoundException('Transit or leg-2 destination not found on leg-2 schedule');

+    // Cut off relative to the passenger's actual boarding stop, using the same configurable
+    // per-stop/route checkinMinutesBefore that already gated the seat hold and search result.
+    assertWithinCheckinCutoff(leg1Schedule, leg1OriginStop, dto.originStationId);
+
    // Process passengers (verify identity once)
    const passengersData: any[] = [];
    let adultCount = 0, childCount = 0;
@@ -761,7 +804,7 @@ export class GuestBookingService {
        status: 'PENDING_PAYMENT',
        bookingType: 'TRANSIT',
        totalMinor,
-        currency: displayCurrency,
+        currency: Currency.ETB, // ETB charge basis; passenger currency in displayCurrency/displayTotalMinor
        adultCount,
        childCount,
        displayCurrency,
@@ -866,7 +909,7 @@ export class GuestBookingService {
    if (!retL2Hold || retL2Hold.expiresAt < now) throw new BadRequestException('Return leg-2 hold expired');

    const [obL1Sched, obL2Sched, retL1Sched, retL2Sched] = await Promise.all([
-      this.prisma.trainSchedule.findUnique({ where: { id: dto.scheduleId }, include: { originStation: true, destinationStation: true, stopTimes: { include: { station: true }, orderBy: { sequence: 'asc' } } } }),
+      this.prisma.trainSchedule.findUnique({ where: { id: dto.scheduleId }, include: { originStation: true, destinationStation: true, stopTimes: { include: { station: true }, orderBy: { sequence: 'asc' } }, route: { include: { stops: true } } } }),
      this.prisma.trainSchedule.findUnique({ where: { id: dto.leg2ScheduleId }, include: { originStation: true, destinationStation: true, stopTimes: { include: { station: true }, orderBy: { sequence: 'asc' } } } }),
      this.prisma.trainSchedule.findUnique({ where: { id: dto.returnScheduleId }, include: { originStation: true, destinationStation: true, stopTimes: { include: { station: true }, orderBy: { sequence: 'asc' } } } }),
      this.prisma.trainSchedule.findUnique({ where: { id: dto.returnLeg2ScheduleId }, include: { originStation: true, destinationStation: true, stopTimes: { include: { station: true }, orderBy: { sequence: 'asc' } } } }),
@@ -876,10 +919,6 @@ export class GuestBookingService {
    if (!retL1Sched) throw new NotFoundException('Return leg-1 schedule not found');
    if (!retL2Sched) throw new NotFoundException('Return leg-2 schedule not found');

-    if (Date.now() >= obL1Sched.departureAt.getTime() - BOOKING_CUTOFF_MS) {
-      throw new BadRequestException('Bookings are not accepted within 30 minutes of departure');
-    }
-
    const obL1Origin = obL1Sched.stopTimes.find(s => s.stationId === dto.originStationId);
    const obL1Dest = obL1Sched.stopTimes.find(s => s.stationId === dto.transitStationId);
    const obL2Origin = obL2Sched.stopTimes.find(s => s.stationId === dto.transitStationId);
@@ -893,6 +932,10 @@ export class GuestBookingService {
    if (!retL1Origin || !retL1Dest) throw new NotFoundException('Return leg-1: origin or transit stop not found');
    if (!retL2Origin || !retL2Dest) throw new NotFoundException('Return leg-2: transit or destination stop not found');

+    // Cut off relative to the passenger's actual boarding stop, using the same configurable
+    // per-stop/route checkinMinutesBefore that already gated the seat hold and search result.
+    assertWithinCheckinCutoff(obL1Sched, obL1Origin, dto.originStationId);
+
    // Process passengers (verify once)
    const passengersData: any[] = [];
    let adultCount = 0, childCount = 0;
@@ -977,7 +1020,7 @@ export class GuestBookingService {
        destinationStationId: dto.returnLeg2DestinationStationId,
        status: 'PENDING_PAYMENT',
        bookingType: 'ROUND_TRIP_TRANSIT',
-        totalMinor, currency: displayCurrency, adultCount, childCount, displayCurrency, displayTotalMinor,
+        totalMinor, currency: Currency.ETB, adultCount, childCount, displayCurrency, displayTotalMinor, // ETB charge basis; passenger currency in displayCurrency/displayTotalMinor
        leg2ScheduleId: dto.leg2ScheduleId,
        leg2OriginStationId: dto.transitStationId,
        leg2DestinationStationId: dto.leg2DestinationStationId,
--- a/apps/edr-passenger-api/src/modules/currency/currency.service.ts
+++ b/apps/edr-passenger-api/src/modules/currency/currency.service.ts
@@ -140,10 +140,14 @@ export class CurrencyService {
    });

    if (!exchangeRate) {
-      this.logger.warn(
-        `No exchange rate found for ${fromCurrency} to ${toCurrency}, using 1.0`,
+      // H-2: fail closed. Never price at parity (1.0) when a required rate is absent — a silent 1.0
+      // substitution underprices international fares ~100×. Reject the quote/booking instead.
+      this.logger.error(
+        `No exchange rate configured for ${fromCurrency}->${toCurrency}; refusing to price at parity`,
+      );
+      throw new BadRequestException(
+        `No exchange rate configured for ${fromCurrency}->${toCurrency}`,
      );
-      return 1.0;
    }

    const ageMs = Date.now() - exchangeRate.effectiveDate.getTime();
--- a/apps/edr-passenger-api/src/modules/fare-engine/currency.controller.ts
+++ b/apps/edr-passenger-api/src/modules/fare-engine/currency.controller.ts
@@ -23,6 +23,8 @@ export class CurrencyController {
  }

  @Put()
+  @PassengerAdmin()
+  @ApiBearerAuth('IAM-auth')
  @ApiOperation({ summary: 'Upsert an exchange rate for today' })
  @ApiResponse({ status: 200, description: 'Rate created or updated for today\'s effective date' })
  upsert(@Body() dto: UpsertExchangeRateDto) {
@@ -30,6 +32,8 @@ export class CurrencyController {
  }

  @Patch(':id')
+  @PassengerAdmin()
+  @ApiBearerAuth('IAM-auth')
  @ApiOperation({ summary: 'Update an exchange rate by ID' })
  @ApiParam({ name: 'id', description: 'CurrencyExchangeRate UUID' })
  @ApiResponse({ status: 200, description: 'Rate updated' })
--- a/apps/edr-passenger-api/src/modules/fare-engine/fare-engine.service.ts
+++ b/apps/edr-passenger-api/src/modules/fare-engine/fare-engine.service.ts
@@ -23,8 +23,11 @@ export class FareEngineService {

    if (!originStop) throw new BadRequestException('Origin station not found on this route');
    if (!destStop)   throw new BadRequestException('Destination station not found on this route');
-    if (originStop.sequence >= destStop.sequence)
-      throw new BadRequestException('Origin must come before destination in the route sequence');
+    // Origin and destination must be distinct stops, but EITHER direction is valid: a round-trip
+    // return leg traverses the same route high→low (e.g. C→A), so we price the segment by its
+    // absolute distance rather than rejecting the reverse order.
+    if (originStop.sequence === destStop.sequence)
+      throw new BadRequestException('Origin and destination must be different stops on this route');

    const seatClass = await this.prisma.seatClass.findUnique({ where: { id: dto.seatClassId } });
    if (!seatClass) throw new NotFoundException('Seat class not found');
@@ -43,8 +46,8 @@ export class FareEngineService {
      },
    }) ?? seatClass;

-    const totalDistanceKm = destStop.distanceKm! - originStop.distanceKm!;
-    if (totalDistanceKm < 0 || isNaN(totalDistanceKm))
+    const totalDistanceKm = Math.abs(destStop.distanceKm! - originStop.distanceKm!);
+    if (totalDistanceKm <= 0 || isNaN(totalDistanceKm))
      throw new BadRequestException('Invalid distance calculation - check route stop distances');

    const now = new Date();
--- a/apps/edr-passenger-api/src/modules/notifications/notifications.service.ts
+++ b/apps/edr-passenger-api/src/modules/notifications/notifications.service.ts
@@ -7,6 +7,7 @@ import { PushAdapter, NotificationChannel } from './notification.adapters';
 import { EmailClientService } from './email-client.service';
 import { SmsClientService } from './sms-client.service';
 import { CreateTemplateDto, UpdateTemplateDto } from './notifications.dto';
+import { resolveBookingSegment } from '../../common/utils/segment-resolver.utils';

 export type NotificationChannelType = 'EMAIL' | 'SMS' | 'PUSH' | 'IN_APP';

@@ -353,27 +354,6 @@ export class NotificationsService {
    }
  }

-  /**
-   * Resolves the user's actual boarding/alighting stations from the booking's originStationId /
-   * destinationStationId via stopTimes, falling back to the schedule's full-route endpoints when
-   * the booking has no segment override (e.g. older records or packages).
-   */
-  private resolveSegmentStations(booking: any): { originStation: any; destinationStation: any } {
-    const s = booking?.schedule ?? {};
-    const stopTimes: any[] = s.stopTimes ?? [];
-    const findStation = (stationId: string | null | undefined, fallback: any) => {
-      if (stationId && stopTimes.length > 0) {
-        const stop = stopTimes.find((st: any) => st.stationId === stationId);
-        if (stop?.station) return stop.station;
-      }
-      return fallback ?? null;
-    };
-    return {
-      originStation: findStation(booking?.originStationId, s.originStation),
-      destinationStation: findStation(booking?.destinationStationId, s.destinationStation),
-    };
-  }
-
  /**
   * Builds the interpolation context for the `booking.created` template. `trainSeatLines` is a
   * pre-joined block of one "Train/Seat: …" line per booked seat (multi-passenger bookings get
@@ -400,17 +380,17 @@ export class NotificationsService {
    // Lead passenger (leg-1 seat). Booking has no contactName; the traveller name lives on the seat.
    const passengerName = seats[0]?.passengerName ?? 'Passenger';
    const payLink = `${process.env.PORTAL_URL ?? 'http://localhost:5174'}/booking/detail?ref=${ref}`;
-    const { originStation: originSt, destinationStation: destSt } = this.resolveSegmentStations(booking);
+    const segment = resolveBookingSegment(s, booking?.originStationId, booking?.destinationStationId);

    return {
      passengerName,
      bookingRef: ref,
-      origin: originSt?.name ?? '',
-      destination: destSt?.name ?? '',
+      origin: segment.origin?.name ?? '',
+      destination: segment.destination?.name ?? '',
      trainSeatLines,
-      travelDate: fmtDate(s.departureAt),
-      departureTime: fmtTime(s.departureAt),
-      arrivalTime: fmtTime(s.arrivalAt),
+      travelDate: fmtDate(segment.departureAt),
+      departureTime: fmtTime(segment.departureAt),
+      arrivalTime: fmtTime(segment.arrivalAt),
      payLink,
    };
  }
@@ -509,12 +489,12 @@ export class NotificationsService {

  private buildTicketEmailText(booking: any, amount: string, currency: string, url: string): string {
    const s = booking.schedule ?? {};
-    const dep = s.departureAt ? new Date(s.departureAt).toLocaleString('en-GB') : 'TBD';
+    const segment = resolveBookingSegment(s, booking?.originStationId, booking?.destinationStationId);
+    const dep = segment.departureAt ? new Date(segment.departureAt).toLocaleString('en-GB') : 'TBD';
    const passengers = (booking.seats ?? []).map((bs: any) => bs.passengerName).filter(Boolean).join(', ');
-    const { originStation: originSt, destinationStation: destSt } = this.resolveSegmentStations(booking);
    return [
      `Booking ${booking.bookingRef} confirmed.`,
-      `${originSt?.name ?? ''} -> ${destSt?.name ?? ''}`,
+      `${segment.origin?.name ?? ''} -> ${segment.destination?.name ?? ''}`,
      `Train: ${s.train?.name ?? s.train?.number ?? ''}`,
      `Departs: ${dep}`,
      passengers ? `Passengers: ${passengers}` : '',
@@ -527,7 +507,9 @@ export class NotificationsService {
    const s = booking.schedule ?? {};
    const fmt = (d: any) =>
      d ? new Date(d).toLocaleString('en-GB', { dateStyle: 'medium', timeStyle: 'short' }) : 'TBD';
-    const { originStation: originSt, destinationStation: destSt } = this.resolveSegmentStations(booking);
+    const segment = resolveBookingSegment(s, booking?.originStationId, booking?.destinationStationId);
+    const originSt = segment.origin;
+    const destSt = segment.destination;
    const seatRows = (booking.seats ?? [])
      .map((bs: any) => {
        const coach = bs.seat?.coach?.number ?? '-';
@@ -568,11 +550,11 @@ export class NotificationsService {
          </tr>
          <tr>
            <td style="padding:8px 0;color:#666;">Departs</td>
-            <td style="padding:8px 0;text-align:right;">${fmt(s.departureAt)}</td>
+            <td style="padding:8px 0;text-align:right;">${fmt(segment.departureAt)}</td>
          </tr>
          <tr>
            <td style="padding:8px 0;color:#666;">Arrives</td>
-            <td style="padding:8px 0;text-align:right;">${fmt(s.arrivalAt)}</td>
+            <td style="padding:8px 0;text-align:right;">${fmt(segment.arrivalAt)}</td>
          </tr>
        </table>

@@ -636,12 +618,12 @@ export class NotificationsService {
    const fmt = (d: any) =>
      d ? new Date(d).toLocaleString('en-GB', { dateStyle: 'medium', timeStyle: 'short' }) : 'TBD';
    const legLabel = leg ? ` (${leg.replace(/_/g, ' ')})` : '';
-    const { originStation: originSt, destinationStation: destSt } = this.resolveSegmentStations(booking);
-    const origin = originSt?.name ?? '';
-    const dest = destSt?.name ?? '';
+    const segment = resolveBookingSegment(s, booking?.originStationId, booking?.destinationStationId);
+    const origin = segment.origin?.name ?? '';
+    const dest = segment.destination?.name ?? '';
    const train = s.train?.name ?? s.train?.number ?? '';
-    const dep = fmt(s.departureAt);
-    const arr = fmt(s.arrivalAt);
+    const dep = fmt(segment.departureAt);
+    const arr = fmt(segment.arrivalAt);

    const seats: { name: string; coach: string; seat: string; cls: string }[] = (booking.seats ?? []).map((bs: any) => ({
      name:  bs.passengerName ?? '',
--- a/apps/edr-passenger-api/src/modules/payments/payment-client.service.ts
+++ b/apps/edr-passenger-api/src/modules/payments/payment-client.service.ts
@@ -1,6 +1,7 @@
 import {
  BadGatewayException,
  BadRequestException,
+  ConflictException,
  Injectable,
  Logger,
 } from "@nestjs/common";
@@ -154,11 +155,16 @@ export class PaymentClientService {
    } catch (err) {
      if (err instanceof AxiosError && err.response) {
        // 4xx/5xx from the payment service: propagate 404 to callers that handle it;
-        // everything else is a gateway-level failure from the client's perspective.
+        // 409 = a legitimate conflict (e.g. another provider's payment is already in
+        // flight for this booking) — surface its message as-is rather than masking it as
+        // a gateway failure; everything else is a genuine gateway-level failure.
        if (err.response.status === 404) throw err;
        const detail =
          (err.response.data as { message?: string | string[] })?.message ??
          err.message;
+        if (err.response.status === 409) {
+          throw new ConflictException(detail);
+        }
        this.logger.error(
          `payment service ${method} ${path} → ${err.response.status}: ${detail}`,
        );
--- a/apps/edr-passenger-api/src/modules/payments/payments.service.ts
+++ b/apps/edr-passenger-api/src/modules/payments/payments.service.ts
@@ -242,6 +242,61 @@ export class PaymentsService {
      return this.initiateWalletPayment(booking);
    }

+    // Double-charge guard for payment-method switches. Before opening a fresh charge over
+    // this booking, reconcile any still-open intent against the authoritative provider
+    // status — the booking-status check above only blocks once the booking is CONFIRMED,
+    // which leaves a window where the first attempt actually paid but the mark-paid
+    // webhook/poll hasn't landed yet.
+    const existingIntent = await this.prisma.paymentIntent.findUnique({
+      where: { bookingId: booking.id },
+    });
+    if (existingIntent && NON_TERMINAL_STATUSES.includes(existingIntent.status)) {
+      let snapshot: PaymentIntentSnapshot | null = null;
+      try {
+        snapshot = await this.paymentClient.getIntentByReference(
+          PaymentReferenceType.BOOKING,
+          booking.id,
+        );
+      } catch (err) {
+        const message = err instanceof Error ? err.message : String(err);
+        this.logger.warn(
+          `payment reconcile before initiate failed for booking ${booking.id}: ${message}; treating existing intent as still open`,
+        );
+      }
+
+      // The previous attempt actually paid (provider SUCCEEDED, event just late):
+      // converge the booking now and return it — never charge a second time.
+      if (snapshot?.status === ProviderPaymentStatus.SUCCEEDED) {
+        let intent = await this.syncIntentProjection(booking.id, snapshot);
+        await this.finalizePaymentSuccess({
+          intentId: intent.id,
+          providerTxnId: snapshot.providerTxnId,
+          paidAt: snapshot.paidAt ? new Date(snapshot.paidAt) : undefined,
+        });
+        intent = await this.prisma.paymentIntent.findUniqueOrThrow({
+          where: { id: intent.id },
+        });
+        return this.formatIntentResponse(intent);
+      }
+
+      // Still pending at the provider (REQUIRES_ACTION/PROCESSING) — or the payment
+      // service was unreachable and the local status is non-terminal. Block the switch:
+      // return the existing intent so the payer completes or waits out the open attempt
+      // rather than opening a second concurrent charge.
+      if (
+        !snapshot ||
+        snapshot.status === ProviderPaymentStatus.REQUIRES_ACTION ||
+        snapshot.status === ProviderPaymentStatus.PROCESSING
+      ) {
+        const intent = snapshot
+          ? await this.syncIntentProjection(booking.id, snapshot)
+          : existingIntent;
+        return this.formatIntentResponse(intent);
+      }
+      // Otherwise the provider reports FAILED/CANCELLED — fall through and initiate
+      // the newly selected method below.
+    }
+
    const { returnUrl, failureUrl } = this.resolveReturnUrls(
      method,
      requestOrigin,
@@ -1017,6 +1072,19 @@ export class PaymentsService {
      return { processed: false, reason: "booking-not-found" };
    }

+    // C-4 guard: a settlement must cover what the passenger was quoted. Compare the provider-settled
+    // amount against the booking's display-currency total (the amount the customer agreed to pay);
+    // a short payment must NOT confirm the booking. Amount-only — the display↔charge currency
+    // divergence is tracked separately under the USD/DJF findings. The 1% tolerance absorbs rounding.
+    const expectedMinor = booking.displayTotalMinor ?? booking.totalMinor;
+    const shortPayTolerance = Math.max(1, Math.round(expectedMinor * 0.01));
+    if (event.amountMinor < expectedMinor - shortPayTolerance) {
+      this.logger.error(
+        `mark-paid: short payment for booking ${booking.id} — settled ${event.amountMinor} ${event.currency} < expected ${expectedMinor} ${booking.displayCurrency}; not confirming`,
+      );
+      return { processed: false, reason: "amount-mismatch" };
+    }
+
    // Local intent row is a projection during the strangler migration: reuse it when the
    // legacy initiate path created one, otherwise materialize it from the event.
    let intent = await this.prisma.paymentIntent.findUnique({
--- a/apps/edr-passenger-api/src/modules/promos/promos.dto.ts
+++ b/apps/edr-passenger-api/src/modules/promos/promos.dto.ts
@@ -1,4 +1,4 @@
-import { IsString, IsOptional, IsInt, IsBoolean } from 'class-validator';
+import { IsString, IsOptional, IsInt, IsBoolean, Min, Max } from 'class-validator';
 import { ApiProperty, ApiPropertyOptional } from '@nestjs/swagger';

 export class CreatePromotionDto {
@@ -15,14 +15,17 @@ export class CreatePromotionDto {
  @IsString()
  subtitle?: string;

-  @ApiPropertyOptional({ example: 15 })
+  @ApiPropertyOptional({ example: 15, description: 'Percentage discount, bounded 0..100' })
  @IsOptional()
  @IsInt()
+  @Min(0)
+  @Max(100)
  percentOff?: number;

  @ApiPropertyOptional({ example: 5000 })
  @IsOptional()
  @IsInt()
+  @Min(0)
  amountOffMinor?: number;

  @ApiProperty({ example: '2026-12-31T23:59:59Z' })
--- a/apps/edr-passenger-api/src/modules/schedules/routes.controller.ts
+++ b/apps/edr-passenger-api/src/modules/schedules/routes.controller.ts
@@ -42,7 +42,7 @@ Route stops carry distanceKm for fare-by-distance calculations.`,

  @Patch(':id')
  @PassengerStaff([PASSENGER_PERMS.routes.manage, PASSENGER_PERMS.admin]) @ApiBearerAuth('IAM-auth')
-  @ApiOperation({ summary: 'Update route metadata (name, description, active flag, effectiveUntil)' })
+  @ApiOperation({ summary: 'Update route metadata (name, description, active flag, effectiveFrom, effectiveUntil)' })
  @ApiParam({ name: 'id', description: 'Route UUID' })
  @ApiResponse({ status: 200, description: 'Route updated' })
  @ApiResponse({ status: 404, description: 'Route not found' })
--- a/apps/edr-passenger-api/src/modules/schedules/routes.dto.ts
+++ b/apps/edr-passenger-api/src/modules/schedules/routes.dto.ts
@@ -5,8 +5,9 @@ import { Type } from 'class-transformer';
 export class RouteStopInputDto {
  @ApiProperty({ example: 'station-uuid', description: 'Station UUID' }) @IsString() stationId: string;
  @ApiProperty({ example: 1, description: 'Stop order (1 = origin, ascending)' }) @IsInt() @Min(1) sequence: number;
-  @ApiPropertyOptional({ example: 120.5, description: 'Distance in km from previous stop' }) @IsOptional() @IsNumber() distanceKm?: number;
+  @ApiPropertyOptional({ example: 120.5, description: 'Cumulative distance in km from the route origin (not from the previous stop)' }) @IsOptional() @IsNumber() distanceKm?: number;
  @ApiPropertyOptional({ example: 45, description: 'Override check-in cutoff (minutes) for this stop. Falls back to route-level checkinMinutesBefore if omitted.' }) @IsOptional() @IsInt() @Min(1) checkinMinutesBefore?: number;
+  @ApiPropertyOptional({ example: 40, description: 'Travel time in minutes from the previous stop, used to estimate this stop\'s arrival time. Ignored for sequence 1 (origin, no predecessor). Falls back to distance-proportional interpolation if omitted.' }) @IsOptional() @IsInt() @Min(1) travelMinutesToStop?: number;
 }

 export class CreateRouteDto {
@@ -14,8 +15,9 @@ export class CreateRouteDto {
  @ApiProperty({ example: 'Addis Ababa – Djibouti' }) @IsString() name: string;
  @ApiPropertyOptional({ example: 'Main corridor via Dire Dawa' }) @IsOptional() @IsString() description?: string;
  @ApiProperty({ example: '2026-01-01T00:00:00Z', description: 'Date from which this route is effective' }) @IsDateString() effectiveFrom: string;
-  @ApiPropertyOptional({ example: '2027-12-31T23:59:59Z' }) @IsOptional() @IsDateString() effectiveUntil?: string;
+  @ApiPropertyOptional({ example: '2027-12-31T23:59:59Z' }) @IsOptional() @IsDateString() effectiveUntil?: string | null;
  @ApiPropertyOptional({ example: true, description: 'Whether the route is active (defaults to true)' }) @IsOptional() @IsBoolean() active?: boolean;
+  @ApiPropertyOptional({ example: 30, description: 'Minutes before departure to close check-in for this route (defaults to 30 if omitted)' }) @IsOptional() @IsInt() @Min(1) checkinMinutesBefore?: number;
  @ApiProperty({
    type: [RouteStopInputDto],
    description: 'Ordered stops for this route. Sequence 1 = origin, last sequence = destination.',
@@ -35,15 +37,17 @@ export class CreateRouteDto {
 export class AddRouteStopDto {
  @ApiProperty({ example: 'station-uuid' }) @IsString() stationId: string;
  @ApiProperty({ example: 3 }) @IsInt() @Min(1) sequence: number;
-  @ApiPropertyOptional({ example: 75.5 }) @IsOptional() @IsNumber() distanceKm?: number;
+  @ApiPropertyOptional({ example: 75.5, description: 'Cumulative distance in km from the route origin (not from the previous stop)' }) @IsOptional() @IsNumber() distanceKm?: number;
  @ApiPropertyOptional({ example: 45, description: 'Override check-in cutoff (minutes) for this stop. Falls back to route-level checkinMinutesBefore if omitted.' }) @IsOptional() @IsInt() @Min(1) checkinMinutesBefore?: number;
+  @ApiPropertyOptional({ example: 40, description: 'Travel time in minutes from the previous stop, used to estimate this stop\'s arrival time. Falls back to distance-proportional interpolation if omitted.' }) @IsOptional() @IsInt() @Min(1) travelMinutesToStop?: number;
 }

 export class UpdateRouteDto {
  @ApiPropertyOptional({ example: 'Addis Ababa – Djibouti Express' }) @IsOptional() @IsString() name?: string;
  @ApiPropertyOptional() @IsOptional() @IsString() description?: string;
  @ApiPropertyOptional({ example: true }) @IsOptional() @IsBoolean() active?: boolean;
-  @ApiPropertyOptional({ example: '2027-12-31T23:59:59Z' }) @IsOptional() @IsDateString() effectiveUntil?: string;
+  @ApiPropertyOptional({ example: '2026-01-01T00:00:00Z', description: 'Date from which this route is effective' }) @IsOptional() @IsDateString() effectiveFrom?: string;
+  @ApiPropertyOptional({ example: '2027-12-31T23:59:59Z', description: 'Send null to clear (open-ended route)' }) @IsOptional() @IsDateString() effectiveUntil?: string | null;
  @ApiPropertyOptional({ example: 30, description: 'Minutes before departure to close check-in for this route' }) @IsOptional() @IsInt() @Min(1) checkinMinutesBefore?: number;
  @ApiPropertyOptional({ type: [RouteStopInputDto] }) @IsOptional() @IsArray() @ValidateNested({ each: true }) @Type(() => RouteStopInputDto) stops?: RouteStopInputDto[];
 }
--- a/apps/edr-passenger-api/src/modules/schedules/routes.service.ts
+++ b/apps/edr-passenger-api/src/modules/schedules/routes.service.ts
@@ -3,6 +3,8 @@ import { PrismaService } from '../../common/prisma.service';
 import { CreateRouteDto, AddRouteStopDto, UpdateRouteDto, SetRouteCoachTemplateDto } from './routes.dto';
 import { DeleteOperationException } from '../../common/exceptions/delete-operation.exception';
 import { AuditService } from '../../common/audit.service';
+import { parseEthiopianTime } from '../../common/utils/timezone.utils';
+import { computePlannedStopTimes } from '../../common/utils/schedule-times.utils';

@Injectable()
 export class RoutesService {
@@ -10,6 +12,33 @@ export class RoutesService {

  // ── Route CRUD ─────────────────────────────────────────────────────────────

+  /**
+   * distanceKm is CUMULATIVE distance from the route origin, not distance from the previous
+   * stop (that's what travelMinutesToStop is for) — fare pricing computes a segment's distance
+   * as destStop.distanceKm - originStop.distanceKm, so a route with equal or decreasing values
+   * across stops silently produces zero/negative segment distances, which the fare engine
+   * rejects (caught and swallowed by search into a bare "N/A" instead of a visible error). Catch
+   * the mistake here instead, with a message that names the exact stops involved.
+   */
+  private validateStopDistances(stops: { sequence: number; stationId: string; distanceKm?: number | null }[]): void {
+    const sorted = [...stops].sort((a, b) => a.sequence - b.sequence);
+    let prevDistance = sorted[0]?.distanceKm ?? 0;
+    for (let i = 1; i < sorted.length; i++) {
+      const stop = sorted[i];
+      if (stop.distanceKm == null) {
+        throw new BadRequestException(
+          `Stop ${stop.sequence} is missing distanceKm (cumulative distance in km from the route origin). This is required for fare pricing.`,
+        );
+      }
+      if (stop.distanceKm <= prevDistance) {
+        throw new BadRequestException(
+          `Stop ${stop.sequence}'s distanceKm (${stop.distanceKm}) must be greater than stop ${sorted[i - 1].sequence}'s distanceKm (${prevDistance}) — distanceKm is cumulative distance from the route origin, not distance from the previous stop. Equal or decreasing values make fare pricing between these stops fail silently.`,
+        );
+      }
+      prevDistance = stop.distanceKm;
+    }
+  }
+
  async createRoute(dto: CreateRouteDto) {
    const existing = await this.prisma.route.findUnique({ where: { code: dto.code } });
    if (existing) throw new ConflictException(`Route code "${dto.code}" already exists`);
@@ -19,6 +48,8 @@ export class RoutesService {
    const seqs = dto.stops.map(s => s.sequence);
    if (new Set(seqs).size !== seqs.length) throw new ConflictException('Duplicate sequence numbers in stop list');

+    this.validateStopDistances(dto.stops);
+
    const stationIds = [...new Set(dto.stops.map(s => s.stationId))];
    const stations = await this.prisma.station.findMany({ where: { id: { in: stationIds } } });
    if (stations.length !== stationIds.length) throw new BadRequestException('One or more station IDs not found');
@@ -29,14 +60,16 @@ export class RoutesService {
        name: dto.name,
        description: dto.description,
        active: dto.active ?? true,
-        effectiveFrom: new Date(dto.effectiveFrom),
-        effectiveUntil: dto.effectiveUntil ? new Date(dto.effectiveUntil) : null,
+        ...(dto.checkinMinutesBefore != null ? { checkinMinutesBefore: dto.checkinMinutesBefore } : {}),
+        effectiveFrom: parseEthiopianTime(dto.effectiveFrom),
+        effectiveUntil: dto.effectiveUntil ? parseEthiopianTime(dto.effectiveUntil) : null,
        stops: {
          create: dto.stops.map(s => ({
            stationId: s.stationId,
            sequence: s.sequence,
            distanceKm: s.distanceKm != null ? parseFloat(String(s.distanceKm)) : null,
            checkinMinutesBefore: s.checkinMinutesBefore ?? null,
+            travelMinutesToStop: s.travelMinutesToStop ?? null,
          })),
        },
      },
@@ -86,13 +119,20 @@ export class RoutesService {
    const route = await this.prisma.route.findUnique({ where: { id } });
    if (!route) throw new NotFoundException('Route not found');

+    if (dto.stops && dto.stops.length >= 2) this.validateStopDistances(dto.stops);
+
    await this.prisma.route.update({
      where: { id },
      data: {
        name: dto.name,
        description: dto.description,
        active: dto.active,
-        effectiveUntil: dto.effectiveUntil ? new Date(dto.effectiveUntil) : undefined,
+        ...(dto.effectiveFrom ? { effectiveFrom: parseEthiopianTime(dto.effectiveFrom) } : {}),
+        // effectiveUntil is nullable (open-ended route) — distinguish "field not sent" (leave
+        // untouched) from "explicitly cleared" (null → set to null), not just truthy/falsy.
+        ...(dto.effectiveUntil !== undefined
+          ? { effectiveUntil: dto.effectiveUntil ? parseEthiopianTime(dto.effectiveUntil) : null }
+          : {}),
        ...(dto.checkinMinutesBefore != null ? { checkinMinutesBefore: dto.checkinMinutesBefore } : {}),
      },
    });
@@ -106,8 +146,23 @@ export class RoutesService {
          sequence: s.sequence,
          distanceKm: s.distanceKm != null ? parseFloat(String(s.distanceKm)) : null,
          checkinMinutesBefore: s.checkinMinutesBefore ?? null,
+          travelMinutesToStop: s.travelMinutesToStop ?? null,
        })),
      });
+
+      // Propagate new stop timing to all future schedules on this route so that
+      // per-stop check-in cutoffs reflect the updated travelMinutesToStop values.
+      const futureSchedules = await this.prisma.trainSchedule.findMany({
+        where: { routeId: id, status: { in: ['SCHEDULED', 'BOARDING'] }, departureAt: { gt: new Date() } },
+        select: { id: true, departureAt: true, arrivalAt: true },
+      });
+      const stopsForTiming = dto.stops
+        .map(s => ({ sequence: s.sequence, distanceKm: s.distanceKm ?? null, travelMinutesToStop: s.travelMinutesToStop ?? null, checkinMinutesBefore: s.checkinMinutesBefore ?? null }))
+        .sort((a, b) => a.sequence - b.sequence);
+      for (const sched of futureSchedules) {
+        const times = computePlannedStopTimes({ id, stops: stopsForTiming }, new Date(sched.departureAt), new Date(sched.arrivalAt));
+        await this.applyRouteToSchedule(id, sched.id, Object.fromEntries(times.map(t => [t.sequence, t])));
+      }
    }

    await this.auditService.log({ action: 'UPDATE', entityType: 'Route', entityId: id, newData: { name: dto.name, active: dto.active } });
@@ -218,6 +273,9 @@ export class RoutesService {
    });
    if (existing) throw new ConflictException(`Sequence ${dto.sequence} already exists on this route`);

+    const otherStops = await this.prisma.routeStop.findMany({ where: { routeId } });
+    this.validateStopDistances([...otherStops, { sequence: dto.sequence, stationId: dto.stationId, distanceKm: dto.distanceKm }]);
+
    return this.prisma.routeStop.create({
      data: {
        routeId,
@@ -225,6 +283,7 @@ export class RoutesService {
        sequence: dto.sequence,
        distanceKm: dto.distanceKm != null ? parseFloat(String(dto.distanceKm)) : null,
        checkinMinutesBefore: dto.checkinMinutesBefore ?? null,
+        travelMinutesToStop: dto.travelMinutesToStop ?? null,
      },
    });
  }
--- a/apps/edr-passenger-api/src/modules/schedules/schedules.controller.ts
+++ b/apps/edr-passenger-api/src/modules/schedules/schedules.controller.ts
@@ -154,6 +154,12 @@ export class SchedulesController {
  @ApiQuery({ name: 'cascade', required: false, type: Boolean })
  deleteSchedule(@Param('id') id: string, @Query('cascade') cascade?: string) { return this.service.deleteSchedule(id, cascade === 'true'); }

+  @Post(':id/recalculate-stops')
+  @PassengerStaff([PASSENGER_PERMS.schedules.manage, PASSENGER_PERMS.admin]) @ApiBearerAuth('IAM-auth')
+  @ApiOperation({ summary: 'Recompute TripStopTime records from current route travelMinutesToStop values' })
+  @ApiParam({ name: 'id', description: 'TrainSchedule UUID' })
+  recalculateStops(@Param('id') id: string) { return this.service.recalculateStopTimes(id); }
+
  @Get(':id/stops')
  @IsPublic()
  @ApiOperation({ summary: 'List all stops for a schedule' })
--- a/apps/edr-passenger-api/src/modules/schedules/schedules.dto.ts
+++ b/apps/edr-passenger-api/src/modules/schedules/schedules.dto.ts
@@ -52,6 +52,10 @@ export class CreateScheduleDto {
  })
  @IsOptional() @IsArray() @ValidateNested({ each: true }) @Type(() => PlannedStopTimeDto)
  plannedTimes?: PlannedStopTimeDto[];
+
+  @ApiPropertyOptional({ type: [String], description: 'Coach UUIDs to assign, in consist order. Overrides the route coach template if provided. A schedule must end up with at least one coach.' })
+  @IsOptional() @IsArray() @IsString({ each: true })
+  coachIds?: string[];
 }

 export class UpdateScheduleDto {
--- a/apps/edr-passenger-api/src/modules/schedules/schedules.service.ts
+++ b/apps/edr-passenger-api/src/modules/schedules/schedules.service.ts
@@ -1,4 +1,4 @@
-import { Injectable, NotFoundException, BadRequestException } from '@nestjs/common';
+import { Injectable, Logger, NotFoundException, BadRequestException } from '@nestjs/common';
 import { PrismaService } from '../../common/prisma.service';
 import { RoutesService } from './routes.service';
 import { FareEngineService } from '../fare-engine/fare-engine.service';
@@ -6,9 +6,12 @@ import { CreateScheduleDto, UpdateScheduleDto, CreateFareRuleDto, UpdateSchedule
 import { DeleteOperationException } from '../../common/exceptions/delete-operation.exception';
 import { parseEthiopianTime, startOfDayEAT, startOfNextDayEAT } from '../../common/utils/timezone.utils';
 import { AuditService } from '../../common/audit.service';
+import { computePlannedStopTimes } from '../../common/utils/schedule-times.utils';

@Injectable()
 export class SchedulesService {
+  private readonly logger = new Logger(SchedulesService.name);
+
  constructor(
    private prisma: PrismaService,
    private routesService: RoutesService,
@@ -43,20 +46,14 @@ export class SchedulesService {
          departureAt: departureAt.toISOString(),
          arrivalAt: arrivalAt.toISOString(),
          plannedTimes: dto.plannedTimes || [],
+          coachIds: dto.coachIds,
        };

+        // createSchedule applies coachIds if given, else auto-applies the route coach template,
+        // and rejects the day outright (caught below) if it would end up with zero coaches.
        const schedule = await this.createSchedule(createDto);
        scheduleIds.push(schedule.id);

-        // createSchedule already auto-applies the route coach template;
-        // only override if explicit coachIds are provided
-        if (dto.coachIds && dto.coachIds.length > 0) {
-          await this.assignCoaches(
-            schedule.id,
-            dto.coachIds.map((coachId, idx) => ({ coachId, positionNumber: idx + 1 })),
-          );
-        }
-
        scheduleCount++;
      } catch (error) {
        errors.push(`Failed to create schedule for ${currentDate.toISOString()}: ${error instanceof Error ? error.message : String(error)}`);
@@ -103,6 +100,8 @@ export class SchedulesService {
    const dep = parseEthiopianTime(dto.departureAt);
    const arr = parseEthiopianTime(dto.arrivalAt);
    if (arr <= dep) throw new BadRequestException('arrivalAt must be after departureAt');
+    // M-4: a new schedule cannot depart in the past — the backoffice form does not enforce this.
+    if (dep.getTime() < Date.now()) throw new BadRequestException('departureAt must be in the future');

    const [train, route] = await Promise.all([
      this.prisma.train.findUnique({ where: { id: dto.trainId } }),
@@ -133,26 +132,7 @@ export class SchedulesService {

    let plannedTimes = dto.plannedTimes;
    if (!plannedTimes || plannedTimes.length === 0) {
-      const totalDuration = arr.getTime() - dep.getTime();
-      const totalDistance = route.stops[route.stops.length - 1].distanceKm || 0;
-
-      plannedTimes = route.stops.map((stop, index) => {
-        let stopTime: Date;
-        if (index === 0) {
-          stopTime = dep;
-        } else if (index === route.stops.length - 1) {
-          stopTime = arr;
-        } else {
-          const stopDistance = stop.distanceKm || 0;
-          const progress = totalDistance > 0 ? stopDistance / totalDistance : index / (route.stops.length - 1);
-          stopTime = new Date(dep.getTime() + totalDuration * progress);
-        }
-        return {
-          sequence: stop.sequence,
-          plannedArrivalAt: index === 0 ? undefined : stopTime.toISOString(),
-          plannedDepartureAt: index === route.stops.length - 1 ? undefined : stopTime.toISOString(),
-        };
-      });
+      plannedTimes = computePlannedStopTimes(route, dep, arr);
    }

    const providedSeqs = new Set((plannedTimes ?? []).map(t => t.sequence));
@@ -181,15 +161,34 @@ export class SchedulesService {
    const plannedTimesMap = Object.fromEntries(plannedTimes.map(t => [t.sequence, t]));
    await this.routesService.applyRouteToSchedule(dto.routeId, schedule.id, plannedTimesMap);

-    // Auto-apply route coach template if one is defined
-    const coachTemplates = await this.prisma.routeCoachTemplate.findMany({
-      where: { routeId: dto.routeId },
-      orderBy: { positionNumber: 'asc' },
-    });
-    if (coachTemplates.length > 0) {
+    // Explicit coachIds (from the schedule form's Coaches step) override the route's coach
+    // template; otherwise auto-apply the template if one is defined.
+    if (dto.coachIds && dto.coachIds.length > 0) {
      await this.assignCoaches(
        schedule.id,
-        coachTemplates.map(t => ({ coachId: t.coachId, positionNumber: t.positionNumber })),
+        dto.coachIds.map((coachId, idx) => ({ coachId, positionNumber: idx + 1 })),
+      );
+    } else {
+      const coachTemplates = await this.prisma.routeCoachTemplate.findMany({
+        where: { routeId: dto.routeId },
+        orderBy: { positionNumber: 'asc' },
+      });
+      if (coachTemplates.length > 0) {
+        await this.assignCoaches(
+          schedule.id,
+          coachTemplates.map(t => ({ coachId: t.coachId, positionNumber: t.positionNumber })),
+        );
+      }
+    }
+
+    // A schedule with zero coaches has zero seats and is silently invisible to search (and
+    // unbookable) with no indication why — block creation instead of leaving a dead schedule.
+    const assignedCoachCount = await this.prisma.coachAssignment.count({ where: { scheduleId: schedule.id } });
+    if (assignedCoachCount === 0) {
+      await this.prisma.tripStopTime.deleteMany({ where: { scheduleId: schedule.id } });
+      await this.prisma.trainSchedule.delete({ where: { id: schedule.id } });
+      throw new BadRequestException(
+        'A schedule must have at least one coach assigned to be bookable. Add coaches in the Coaches step, or set a Route Coach Template on this route so new schedules auto-assign coaches.',
      );
    }

@@ -304,26 +303,7 @@ export class SchedulesService {

    let plannedTimes = dto.plannedTimes;
    if (!plannedTimes || plannedTimes.length === 0) {
-      const totalDuration = arr.getTime() - dep.getTime();
-      const totalDistance = route.stops[route.stops.length - 1].distanceKm || 0;
-
-      plannedTimes = route.stops.map((stop, index) => {
-        let stopTime: Date;
-        if (index === 0) {
-          stopTime = dep;
-        } else if (index === route.stops.length - 1) {
-          stopTime = arr;
-        } else {
-          const stopDistance = stop.distanceKm || 0;
-          const progress = totalDistance > 0 ? stopDistance / totalDistance : index / (route.stops.length - 1);
-          stopTime = new Date(dep.getTime() + totalDuration * progress);
-        }
-        return {
-          sequence: stop.sequence,
-          plannedArrivalAt: index === 0 ? undefined : stopTime.toISOString(),
-          plannedDepartureAt: index === route.stops.length - 1 ? undefined : stopTime.toISOString(),
-        };
-      });
+      plannedTimes = computePlannedStopTimes(route, dep, arr);
    }

    const plannedTimesMap = Object.fromEntries(plannedTimes.map(t => [t.sequence, t]));
@@ -617,6 +597,24 @@ export class SchedulesService {
    return { synced, errors };
  }

+  async recalculateStopTimes(scheduleId: string) {
+    const schedule = await this.prisma.trainSchedule.findUnique({
+      where: { id: scheduleId },
+      include: { route: { include: { stops: { orderBy: { sequence: 'asc' } } } } },
+    });
+    if (!schedule) throw new NotFoundException('Schedule not found');
+    if (!schedule.routeId || !schedule.route) throw new BadRequestException('Schedule has no associated route');
+
+    const plannedTimes = computePlannedStopTimes(
+      schedule.route,
+      new Date(schedule.departureAt),
+      new Date(schedule.arrivalAt),
+    );
+    const plannedTimesMap = Object.fromEntries(plannedTimes.map(t => [t.sequence, t]));
+    await this.routesService.applyRouteToSchedule(schedule.routeId, scheduleId, plannedTimesMap);
+    return { recalculated: true, scheduleId, stopCount: plannedTimes.length };
+  }
+
  async assignCoaches(scheduleId: string, coaches: Array<{ coachId: string; positionNumber: number }>) {
    const schedule = await this.prisma.trainSchedule.findUnique({ where: { id: scheduleId } });
    if (!schedule) throw new NotFoundException('Schedule not found');
@@ -653,11 +651,14 @@ export class SchedulesService {
    if (!schedule) throw new NotFoundException('Schedule not found');

    const updateData: any = {};
+    let dep: Date | undefined;
+    let arr: Date | undefined;

    if (dto.departureAt || dto.arrivalAt) {
-      const dep = dto.departureAt ? parseEthiopianTime(dto.departureAt) : new Date(schedule.departureAt);
-      const arr = dto.arrivalAt ? parseEthiopianTime(dto.arrivalAt) : new Date(schedule.arrivalAt);
+      dep = dto.departureAt ? parseEthiopianTime(dto.departureAt) : new Date(schedule.departureAt);
+      arr = dto.arrivalAt ? parseEthiopianTime(dto.arrivalAt) : new Date(schedule.arrivalAt);
      if (arr <= dep) throw new BadRequestException('Arrival time must be after departure time');
+      if (dep.getTime() < Date.now()) throw new BadRequestException('departureAt must be in the future');
      updateData.departureAt = dep;
      updateData.arrivalAt = arr;
      updateData.durationMinutes = Math.round((arr.getTime() - dep.getTime()) / 60_000);
@@ -670,6 +671,22 @@ export class SchedulesService {
      await this.prisma.trainSchedule.update({ where: { id }, data: updateData });
    }

+    // departureAt/arrivalAt changed — the per-stop TripStopTime rows were computed against the
+    // OLD times and are now stale (same interpolation createSchedule/updateSchedule use). Left
+    // unfixed, check-in cutoff enforcement and search silently keep using outdated per-stop
+    // arrival/departure estimates for every intermediate stop.
+    if (dep && arr && schedule.routeId) {
+      const route = await this.prisma.route.findUnique({
+        where: { id: schedule.routeId },
+        include: { stops: { orderBy: { sequence: 'asc' } } },
+      });
+      if (route && route.stops.length >= 2) {
+        const plannedTimes = computePlannedStopTimes(route, dep, arr);
+        const plannedTimesMap = Object.fromEntries(plannedTimes.map(t => [t.sequence, t]));
+        await this.routesService.applyRouteToSchedule(schedule.routeId, id, plannedTimesMap);
+      }
+    }
+
    if (dto.coaches !== undefined) {
      if (dto.coaches.length > 0) {
        await this.assignCoaches(id, dto.coaches);
--- a/apps/edr-passenger-api/src/modules/search/search.service.ts
+++ b/apps/edr-passenger-api/src/modules/search/search.service.ts
@@ -10,7 +10,8 @@ import { CurrencyService } from "../currency/currency.service";
 import { FareEngineService } from "../fare-engine/fare-engine.service";
 import { SegmentsService } from "../segments/segments.service";
 import { resolveCurrencyFromNationality } from "../fare-engine/fare-engine.dto";
-import { Currency } from "@prisma/client";
+import { resolveCheckinCutoff } from "../../common/utils/checkin-cutoff.utils";
+import { Currency, Prisma } from "@prisma/client";

 const POINTS_TO_MINOR = 10;

@@ -220,12 +221,18 @@ export class SearchService {
    const totalPassengers = adultCount + (childCount ?? 0);
    const NEEDED = 3;

-    const baseWhere = {
-      status: "SCHEDULED",
+    // Include BOARDING alongside SCHEDULED: BOARDING is just an operational display status the
+    // schedule-level cron sets on a fixed 30-min-before-departure timer (see tasks.service.ts) —
+    // it does NOT mean booking is closed. The actual booking cutoff is per-stop and configurable
+    // (RouteStop/Route.checkinMinutesBefore), enforced below by buildScheduleResult's own live
+    // check against each stop's estimated arrival/departure. Excluding BOARDING here would
+    // silently impose a hidden, non-configurable 30-minute cutoff on top of that.
+    const baseWhere: Prisma.TrainScheduleWhereInput = {
+      status: { in: ["SCHEDULED", "BOARDING", "EN_ROUTE"] },
      isPackageOnly: false,
      stopTimes: { some: { stationId: originStationId } },
      coachAssignments: { some: {} },
-    } as const;
+    };

    // Fetch candidates before and after in parallel; take more than needed to
    // account for routes that don't serve the destination or have no availability.
@@ -300,23 +307,21 @@ export class SearchService {
    const nextDay = new Date(
      `${String(y)}-${String(m).padStart(2, "0")}-${String(d + 1).padStart(2, "0")}T00:00:00+03:00`,
    );
-    const now = new Date();
    const totalPassengers = adultCount + (childCount ?? 0);

-    // Use now as the lower bound for today so we don't fetch schedules that have
-    // already fully departed. The per-segment cutoff check in buildScheduleResult
-    // handles the exact check using each stop's own plannedDepartureAt.
-    const isToday =
-      now.getFullYear() === y &&
-      now.getMonth() === m - 1 &&
-      now.getDate() === d;
-    const earliest = isToday ? now : date;
-
+    // Match on the schedule's own departure DATE only — do NOT use `now` as a lower bound here.
+    // A schedule whose origin has already departed (EN_ROUTE) can still have a later stop (e.g.
+    // Lebu, Adama) whose own cutoff hasn't passed; using the overall departureAt as a floor would
+    // wrongly exclude the whole schedule for those still-bookable downstream segments. The
+    // per-segment cutoff check in buildScheduleResult is the sole authority for whether THIS
+    // specific origin stop is still bookable, using each stop's own estimated arrival/departure.
    const schedules = await this.prisma.trainSchedule.findMany({
      where: {
-        status: "SCHEDULED",
+        // EN_ROUTE/BOARDING included alongside SCHEDULED — these are operational display
+        // statuses, not booking-closed signals (see comment on searchAlternatives' baseWhere).
+        status: { in: ["SCHEDULED", "BOARDING", "EN_ROUTE"] },
        isPackageOnly: false,
-        departureAt: { gte: earliest, lt: nextDay },
+        departureAt: { gte: date, lt: nextDay },
        stopTimes: { some: { stationId: originStationId } },
        coachAssignments: { some: {} },
      },
@@ -368,7 +373,8 @@ export class SearchService {
    const [leg1Schedules, allCandidates] = await Promise.all([
      this.prisma.trainSchedule.findMany({
        where: {
-          status: "SCHEDULED",
+          // BOARDING included alongside SCHEDULED — see comment on searchAlternatives' baseWhere.
+          status: { in: ["SCHEDULED", "BOARDING", "EN_ROUTE"] },
          isPackageOnly: false,
          departureAt: { gte: dayStart, lt: dayEnd },
          stopTimes: { some: { stationId: originStationId } },
@@ -378,7 +384,7 @@ export class SearchService {
      }),
      this.prisma.trainSchedule.findMany({
        where: {
-          status: "SCHEDULED",
+          status: { in: ["SCHEDULED", "BOARDING", "EN_ROUTE"] },
          isPackageOnly: false,
          departureAt: { gte: dayStart, lt: leg2WindowEnd },
          coachAssignments: { some: {} },
@@ -547,24 +553,13 @@ export class SearchService {
    if (!originStop || !destStop || originStop.sequence >= destStop.sequence)
      return null;

-    // Segment-level cutoff: use the origin stop's planned departure, not the
+    // Segment-level cutoff: use the origin stop's own estimated arrival time, not the
    // schedule's overall departureAt (which is station A's time). This lets
-    // B→D remain bookable even after A→D closes.
-    // Cutoff resolution: stop-level override → route default → 30 min fallback.
-    const now = new Date();
-    const segmentDepartureAt =
-      originStop.plannedDepartureAt ?? schedule.departureAt;
-    const routeStop = schedule.route?.stops?.find(
-      (s) => s.stationId === originStationId,
-    );
-    const checkinMinutes =
-      routeStop?.checkinMinutesBefore ??
-      schedule.route?.checkinMinutesBefore ??
-      30;
-    if (
-      segmentDepartureAt.getTime() - now.getTime() <=
-      checkinMinutes * 60 * 1000
-    )
+    // B→D remain bookable even after A→D closes. Stop-level checkinMinutesBefore override →
+    // route default → 30 min fallback — same resolution GuestBookingService applies at
+    // booking-creation time, so a segment shown as bookable here stays bookable through
+    // checkout instead of being rejected against a different, hardcoded cutoff.
+    if (Date.now() >= resolveCheckinCutoff(schedule, originStop, originStationId).cutoffAt.getTime())
      return null;

    // Collect all valid seat IDs upfront for a single batch availability check
@@ -676,8 +671,11 @@ export class SearchService {
      nationality,
      availabilityByClass,
    );
-    const legDepartureAt = schedule.departureAt;
-    const legArrivalAt = schedule.arrivalAt;
+    // Use the selected stop's own planned time, not the schedule's full-route span —
+    // for stop-based (mid-route) boarding/alighting these differ from the train's
+    // overall origin departure / final destination arrival.
+    const legDepartureAt = originStop.plannedDepartureAt ?? schedule.departureAt;
+    const legArrivalAt = destStop.plannedArrivalAt ?? schedule.arrivalAt;

    const displayCurrency =
      faresByClass[0]?.displayCurrency ??
--- a/apps/edr-passenger-api/src/modules/seat-classes/seat-classes.dto.ts
+++ b/apps/edr-passenger-api/src/modules/seat-classes/seat-classes.dto.ts
@@ -1,4 +1,4 @@
-import { IsString, IsInt, IsBoolean, IsOptional, IsIn } from 'class-validator';
+import { IsString, IsInt, IsBoolean, IsOptional, IsIn, Min } from 'class-validator';
 import { ApiProperty, ApiPropertyOptional, PartialType } from '@nestjs/swagger';

 export class CreateSeatClassDto {
@@ -27,11 +27,13 @@ export class CreateSeatClassDto {

  @ApiProperty({ example: 3000, description: 'Per-km rate in minor units (tariff decimal × 100000)' })
  @IsInt()
+  @Min(0)
  basePrice: number;

  @ApiPropertyOptional({ example: 1200, description: 'Flat insurance fee in minor units' })
  @IsOptional()
  @IsInt()
+  @Min(0)
  insuranceFeeMinor?: number;

  @ApiPropertyOptional({ example: true })
--- a/apps/edr-passenger-api/src/modules/seats/seats.service.ts
+++ b/apps/edr-passenger-api/src/modules/seats/seats.service.ts
@@ -281,7 +281,7 @@ export class SeatsService {
      }),
      this.prisma.tripStopTime.findFirst({
        where: { scheduleId: dto.scheduleId, stationId: dto.originStationId },
-        select: { plannedDepartureAt: true },
+        select: { plannedArrivalAt: true, plannedDepartureAt: true },
      }),
      this.prisma.routeStop.findFirst({
        where: {
@@ -295,7 +295,10 @@ export class SeatsService {

    // Stop-level override wins; falls back to route-level; then to 30 min.
    const checkinMinutes = originRouteStop?.checkinMinutesBefore ?? schedule.route?.checkinMinutesBefore ?? 30;
-    const segmentDepartureAt = originStopTime?.plannedDepartureAt ?? schedule.departureAt;
+    // Departure basis: plannedDepartureAt = arrival + dwell. For the origin there is no
+    // arrival so plannedDepartureAt = schedule.departureAt. cutoffAt = departure - dwell = arrival,
+    // so holding closes the moment the train reaches the boarding stop.
+    const segmentDepartureAt = originStopTime?.plannedDepartureAt ?? originStopTime?.plannedArrivalAt ?? schedule.departureAt;
    const msUntilDeparture = segmentDepartureAt.getTime() - Date.now();
    if (msUntilDeparture <= checkinMinutes * 60 * 1000) {
      throw new BadRequestException(
--- a/apps/edr-passenger-api/src/modules/system-config/system-config.controller.ts
+++ b/apps/edr-passenger-api/src/modules/system-config/system-config.controller.ts
@@ -1,6 +1,7 @@
 import { Body, Controller, Get, Patch, SetMetadata, UseGuards } from '@nestjs/common';
 import { ApiTags, ApiBearerAuth, ApiOperation } from '@nestjs/swagger';
 import { SystemConfigService } from './system-config.service';
+import { UpdateSystemConfigDto } from './system-config.dto';
 import { IamGuard } from '../../common/iam-adapter';
 import { Roles } from '../../common/roles.decorator';

@@ -31,7 +32,12 @@ export class SystemConfigController {
  @UseGuards(IamGuard)
  @Roles('ADMIN')
  @ApiOperation({ summary: 'Update system config (admin)' })
-  update(@Body() body: Record<string, string>) {
-    return this.service.updateMany(body);
+  update(@Body() dto: UpdateSystemConfigDto) {
+    // The DTO validates/coerces each known key to a positive integer; persist back as strings.
+    const entries: Record<string, string> = {};
+    for (const [key, value] of Object.entries(dto)) {
+      if (value !== undefined) entries[key] = String(value);
+    }
+    return this.service.updateMany(entries);
  }
 }
--- a/apps/edr-passenger-api/src/modules/system-config/system-config.dto.ts
+++ b/apps/edr-passenger-api/src/modules/system-config/system-config.dto.ts
@@ -0,0 +1,48 @@
+import { IsInt, IsOptional, Min, Max } from 'class-validator';
+import { Type } from 'class-transformer';
+import { ApiPropertyOptional } from '@nestjs/swagger';
+
+/**
+ * Whitelisted, typed body for `PATCH /config`. Config is persisted as string key/values, but every
+ * known key is a positive integer (durations, hour windows, throttle limits/TTLs). Values arrive as
+ * strings from the backoffice form; `@Type(() => Number)` coerces them so the numeric/range checks
+ * apply (M-3 — the endpoint previously stored any raw string, e.g. `seat_hold_duration_minutes: -1`).
+ * Unknown keys are stripped by the global whitelisting ValidationPipe.
+ */
+export class UpdateSystemConfigDto {
+  @ApiPropertyOptional({ example: 5, description: 'Seat-hold duration in minutes (1..60)' })
+  @IsOptional() @Type(() => Number) @IsInt() @Min(1) @Max(60)
+  seat_hold_duration_minutes?: number;
+
+  @ApiPropertyOptional({ example: 2 })
+  @IsOptional() @Type(() => Number) @IsInt() @Min(0)
+  hold_cutoff_hours_before_departure?: number;
+
+  @ApiPropertyOptional({ example: 4 })
+  @IsOptional() @Type(() => Number) @IsInt() @Min(0)
+  boarding_window_hours_before_departure?: number;
+
+  @ApiPropertyOptional({ example: 5 })
+  @IsOptional() @Type(() => Number) @IsInt() @Min(1)
+  throttle_auth_limit?: number;
+
+  @ApiPropertyOptional({ example: 60000 })
+  @IsOptional() @Type(() => Number) @IsInt() @Min(1)
+  throttle_auth_ttl_ms?: number;
+
+  @ApiPropertyOptional({ example: 20 })
+  @IsOptional() @Type(() => Number) @IsInt() @Min(1)
+  throttle_strict_limit?: number;
+
+  @ApiPropertyOptional({ example: 60000 })
+  @IsOptional() @Type(() => Number) @IsInt() @Min(1)
+  throttle_strict_ttl_ms?: number;
+
+  @ApiPropertyOptional({ example: 100 })
+  @IsOptional() @Type(() => Number) @IsInt() @Min(1)
+  throttle_default_limit?: number;
+
+  @ApiPropertyOptional({ example: 60000 })
+  @IsOptional() @Type(() => Number) @IsInt() @Min(1)
+  throttle_default_ttl_ms?: number;
+}
--- a/apps/edr-passenger-api/src/modules/tasks/tasks.service.ts
+++ b/apps/edr-passenger-api/src/modules/tasks/tasks.service.ts
@@ -81,17 +81,23 @@ export class TasksService {
      byRoute.get(stop.routeId)!.push(stop.stationId);
    }

+    // Arrival basis: each stop's own estimated arrival time, not its departure. The first
+    // stop of a route has no arrival (nothing to arrive at), so it falls back to its
+    // departure — expressed below as COALESCE(plannedArrivalAt, plannedDepartureAt).
    let reopenedCount = 0;
    let checkinClosedCount = 0;
    for (const [mins, byRoute] of byMins) {
      const cutoffAt = new Date(now.getTime() + mins * 60 * 1000);
      for (const [routeId, stationIds] of byRoute) {
        // Revert first: if the cutoff was reduced, stops that were prematurely closed
-        // should reopen (departure is still beyond the new cutoff window).
+        // should reopen (arrival is still beyond the new cutoff window).
        const reverted = await this.prisma.tripStopTime.updateMany({
          where: {
            status: 'CHECKIN_CLOSED',
-            plannedDepartureAt: { gt: cutoffAt },
+            OR: [
+              { plannedArrivalAt: { gt: cutoffAt } },
+              { AND: [{ plannedArrivalAt: null }, { plannedDepartureAt: { gt: cutoffAt } }] },
+            ],
            stationId: { in: stationIds },
            schedule: { routeId },
          },
@@ -103,7 +109,10 @@ export class TasksService {
        const closed = await this.prisma.tripStopTime.updateMany({
          where: {
            status: 'OPEN',
-            plannedDepartureAt: { lte: cutoffAt },
+            OR: [
+              { plannedArrivalAt: { lte: cutoffAt } },
+              { AND: [{ plannedArrivalAt: null }, { plannedDepartureAt: { lte: cutoffAt } }] },
+            ],
            stationId: { in: stationIds },
            schedule: { routeId },
          },
@@ -169,8 +178,8 @@ export class TasksService {
          include: {
            originStation:      { select: { name: true } },
            destinationStation: { select: { name: true } },
-            stopTimes:          { select: { stationId: true, plannedDepartureAt: true } },
-            route:              { select: { checkinMinutesBefore: true } },
+            stopTimes:          { select: { stationId: true, plannedArrivalAt: true, plannedDepartureAt: true } },
+            route:              { select: { checkinMinutesBefore: true, stops: { select: { stationId: true, checkinMinutesBefore: true } } } },
          },
        },
      },
@@ -179,12 +188,17 @@ export class TasksService {
    for (const booking of bookings) {
      try {
        const createdAt = booking.createdAt as Date;
-        // Use the booking's origin-segment departure and the route's own check-in window.
+        // Use the booking's origin-segment estimated arrival (falling back to its departure
+        // for the first stop) and that stop's own check-in window (falling back to the route
+        // default), same resolution as holdSeats/search.
        const originStop = (booking.schedule as any).stopTimes?.find(
          (s: any) => s.stationId === (booking as any).originStationId,
        );
-        const dep            = (originStop?.plannedDepartureAt ?? booking.schedule.departureAt) as Date;
-        const checkinMinutes = (booking.schedule as any).route?.checkinMinutesBefore ?? 30;
+        const dep = (originStop?.plannedArrivalAt ?? originStop?.plannedDepartureAt ?? booking.schedule.departureAt) as Date;
+        const originRouteStop = (booking.schedule as any).route?.stops?.find(
+          (s: any) => s.stationId === (booking as any).originStationId,
+        );
+        const checkinMinutes = originRouteStop?.checkinMinutesBefore ?? (booking.schedule as any).route?.checkinMinutesBefore ?? 30;
        if (dep <= now) continue; // segment has already departed; cancel job handles clean-up
        const paymentDeadline = computePaymentDeadline(createdAt, dep, checkinMinutes);
        const totalWindowMs   = paymentDeadline.getTime() - createdAt.getTime();
@@ -230,13 +244,28 @@ export class TasksService {

  // ── Cancel bookings whose payment deadline has passed ─────────────────────
  private async cancelExpiredPendingBookings(now: Date) {
-    const twoHoursAgo     = new Date(now.getTime() - MAX_PAYMENT_HOURS * 60 * 60 * 1000);
-    const departureCutoff = new Date(now.getTime() + CUTOFF_MINUTES * 60 * 1000);
+    const twoHoursAgo = new Date(now.getTime() - MAX_PAYMENT_HOURS * 60 * 60 * 1000);

-    // payment_deadline = MIN(createdAt + 2h, departureAt - 30min)
+    // The departure pre-filter below is a query-scoping optimization only — the real
+    // deadline check happens per-row further down. It must be widened to the largest
+    // configured checkinMinutes across all routes/stops, or a booking on a route with a
+    // cutoff bigger than the CUTOFF_MINUTES default would never even be fetched here,
+    // silently never getting auto-cancelled.
+    const [maxRouteCutoff, maxStopCutoff] = await Promise.all([
+      this.prisma.route.aggregate({ _max: { checkinMinutesBefore: true } }),
+      this.prisma.routeStop.aggregate({ _max: { checkinMinutesBefore: true } }),
+    ]);
+    const effectiveMaxCutoffMinutes = Math.max(
+      CUTOFF_MINUTES,
+      maxRouteCutoff._max.checkinMinutesBefore ?? 0,
+      maxStopCutoff._max.checkinMinutesBefore ?? 0,
+    );
+    const departureCutoff = new Date(now.getTime() + effectiveMaxCutoffMinutes * 60 * 1000);
+
+    // payment_deadline = MIN(createdAt + 2h, segment_arrival - checkinMinutes)
    // Deadline is reached when either branch of the MIN is in the past:
-    //   (a) createdAt ≤ now - 2h        →  2-hour max window elapsed
-    //   (b) departureAt ≤ now + 30min   →  departure within 30 min
+    //   (a) createdAt ≤ now - 2h                    →  2-hour max window elapsed
+    //   (b) departureAt ≤ now + effectiveMaxCutoff   →  within the widest possible cutoff window
    const expiredBookings = await this.prisma.booking.findMany({
      where: {
        status: 'PENDING_PAYMENT',
@@ -250,8 +279,8 @@ export class TasksService {
          include: {
            originStation:      { select: { name: true } },
            destinationStation: { select: { name: true } },
-            stopTimes:          { select: { stationId: true, plannedDepartureAt: true } },
-            route:              { select: { checkinMinutesBefore: true } },
+            stopTimes:          { select: { stationId: true, plannedArrivalAt: true, plannedDepartureAt: true } },
+            route:              { select: { checkinMinutesBefore: true, stops: { select: { stationId: true, checkinMinutesBefore: true } } } },
          },
        },
        paymentIntent: { select: { method: true } },
@@ -264,14 +293,19 @@ export class TasksService {
    for (const booking of expiredBookings) {
      try {
        // Re-verify exact deadline to avoid racing with a concurrent payment confirmation.
-        // Use the booking's origin-segment departure for the deadline so that a B→C booking
-        // on an A→B→C→D schedule gets the correct payment window anchored to B, not A.
+        // Use the booking's origin-segment estimated arrival (falling back to its departure
+        // for the first stop) and that stop's own check-in window, so a B→C booking on an
+        // A→B→C→D schedule gets the correct payment window anchored to B, not A.
        const createdAt  = booking.createdAt as Date;
        const originStop = (booking.schedule as any).stopTimes?.find(
          (s: any) => s.stationId === (booking as any).originStationId,
        );
-        const dep             = (originStop?.plannedDepartureAt ?? booking.schedule.departureAt) as Date;
-        const paymentDeadline = computePaymentDeadline(createdAt, dep);
+        const dep = (originStop?.plannedArrivalAt ?? originStop?.plannedDepartureAt ?? booking.schedule.departureAt) as Date;
+        const originRouteStop = (booking.schedule as any).route?.stops?.find(
+          (s: any) => s.stationId === (booking as any).originStationId,
+        );
+        const checkinMinutes = originRouteStop?.checkinMinutesBefore ?? (booking.schedule as any).route?.checkinMinutesBefore ?? CUTOFF_MINUTES;
+        const paymentDeadline = computePaymentDeadline(createdAt, dep, checkinMinutes);
        if (now < paymentDeadline) continue;

        // 1a. Release held seats (Journey rows are the occupancy source of truth once paid)
--- a/apps/edr-passenger-api/src/modules/tickets/tickets.service.ts
+++ b/apps/edr-passenger-api/src/modules/tickets/tickets.service.ts
@@ -5,6 +5,7 @@ import { PrismaService } from '../../common/prisma.service';
 import { NotificationsService } from '../notifications/notifications.service';
 import { SystemConfigService, CONFIG_KEYS } from '../system-config/system-config.service';
 import { AuditService } from '../../common/audit.service';
+import { resolveBookingSegment } from '../../common/utils/segment-resolver.utils';
 import * as QRCode from 'qrcode';

 interface OfflineValidation {
@@ -129,6 +130,7 @@ export class TicketsService {
          : { fullName: 'Guest', email: guestEmail, phone: guestPhone };
        
        
+        const segment = resolveBookingSegment(t.booking?.schedule, t.booking?.originStationId, t.booking?.destinationStationId);
        return {
          id: t.id,
          ticketNumber: t.barcodePayload,
@@ -152,20 +154,14 @@ export class TicketsService {
            contactPhone: t.booking?.contactPhone,
            returnSchedule: t.booking?.returnSchedule ?? null,
            seats: t.booking?.seats ?? [],
-            originStation: (() => {
-              const id = t.booking?.originStationId;
-              if (!id) return t.booking?.schedule?.originStation ?? null;
-              const stop = t.booking?.schedule?.stopTimes?.find((st: any) => st.stationId === id);
-              return stop?.station ?? t.booking?.schedule?.originStation ?? null;
-            })(),
-            destinationStation: (() => {
-              const id = t.booking?.destinationStationId;
-              if (!id) return t.booking?.schedule?.destinationStation ?? null;
-              const stop = t.booking?.schedule?.stopTimes?.find((st: any) => st.stationId === id);
-              return stop?.station ?? t.booking?.schedule?.destinationStation ?? null;
-            })(),
+            originStation: segment.origin,
+            destinationStation: segment.destination,
          },
-          schedule: t.booking?.schedule,
+          schedule: t.booking?.schedule ? {
+            ...t.booking.schedule,
+            departureAt: segment.departureAt,
+            arrivalAt: segment.arrivalAt,
+          } : null,
          seat: t.seat ? {
            id: t.seat.id,
            seatNumber: t.seat.seatNumber,
@@ -643,11 +639,14 @@ export class TicketsService {
        throw new NotFoundException('No ticket found for this booking');
      }

-      // Check if ticket date matches today
+      // Check if ticket date matches today. Boarding window is relative to the
+      // passenger's actual boarding stop, not the train's origin — for a mid-route
+      // boarding these differ.
      const today = new Date();
-      
-      if ((booking as any).schedule?.departureAt) {
-        const departureTime = new Date((booking as any).schedule.departureAt);
+      const boardingSegment = resolveBookingSegment((booking as any).schedule, (booking as any).originStationId, (booking as any).destinationStationId);
+
+      if (boardingSegment.departureAt) {
+        const departureTime = new Date(boardingSegment.departureAt);
        const boardingWindowHours = await this.systemConfig.getNumber(CONFIG_KEYS.BOARDING_WINDOW_HOURS_BEFORE_DEPARTURE);
        const boardingOpenTime = new Date(departureTime.getTime() - boardingWindowHours * 60 * 60 * 1000);

@@ -673,18 +672,6 @@ export class TicketsService {
      // Send notifications after successful boarding
      await this.sendBoardingNotifications(booking, ticket, result.leg || 'OUTBOUND');

-      // Resolve user-selected segment rather than the full schedule route
-      const _schedStops = (booking as any).schedule?.stopTimes ?? [];
-      const _resolveStation = (id: string | null | undefined, fallback: any) => {
-        if (id) {
-          const found = _schedStops.find((st: any) => st.stationId === id)?.station;
-          if (found) return found;
-        }
-        return fallback;
-      };
-      const boardingOrigin = _resolveStation((booking as any).originStationId, (booking as any).schedule?.originStation);
-      const boardingDest = _resolveStation((booking as any).destinationStationId, (booking as any).schedule?.destinationStation);
-
      return {
        success: true,
        message: `Passenger boarded successfully (${result.leg || 'OUTBOUND'} leg)`,
@@ -693,11 +680,11 @@ export class TicketsService {
          ticketNumber: ticket.barcodePayload,
          bookingRef: booking.bookingRef,
          passengerName: seatInfo?.passengerName || ticket.passengerName || 'N/A',
-          route: `${boardingOrigin?.name || 'N/A'} → ${boardingDest?.name || 'N/A'}`,
+          route: `${boardingSegment.origin?.name || 'N/A'} → ${boardingSegment.destination?.name || 'N/A'}`,
          seat: seatNumber,
          coach: coachNumber,
          trainName: (booking as any).schedule?.train?.name || (booking as any).schedule?.train?.number || 'N/A',
-          departureTime: (booking as any).schedule?.departureAt,
+          departureTime: boardingSegment.departureAt,
          boardedAt: result.validatedAt,
          leg: result.leg || 'OUTBOUND',
          bookingType: booking.bookingType,